From ee6b6da0d716e8c30094383cf63a59a0c184572b Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sat, 6 May 2023 07:59:19 -0400
Subject: [PATCH] Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...ix-evaluating-_pdc-method-when-runni.patch |  146 +++
 ...g-of-i_size-with-dv-jump-from-server.patch |   40 +
 ...s-gta04-fix-excess-dma-channel-usage.patch |   73 ++
 ...m-ipq4019-fix-the-pci-i-o-port-range.patch |   45 +
 ...m-ipq8064-fix-the-pci-i-o-port-range.patch |   68 +
 ...om-ipq8064-reduce-pci-io-size-to-64k.patch |   62 +
 ...m-ipq8074-fix-the-pci-i-o-port-range.patch |   61 +
 ...m-msm8996-fix-the-pci-i-o-port-range.patch |   68 +
 ...sm8998-fix-stm-stimulus-base-reg-nam.patch |   37 +
 ...m-msm8998-fix-the-pci-i-o-port-range.patch |   41 +
 ...dm845-correct-dynamic-power-coeffici.patch |  130 ++
 ...om-sdm845-fix-the-pci-i-o-port-range.patch |   55 +
 ...s-r8a774c0-remove-bogus-voltages-fro.patch |   53 +
 ...s-r8a77990-remove-bogus-voltages-fro.patch |   53 +
 ...state.ss-to-1-to-re-enable-single-st.patch |  128 ++
 ...s8316-handle-optional-irq-assignment.patch |   62 +
 ...irqf_no_autoen-when-requesting-the-i.patch |   46 +
 ...e-of_node_put-to-the-correct-locatio.patch |   72 ++
 ...ault-for-getsockopt-with-optval-null.patch |   55 +
 ...recision-propagation-verbose-logging.patch |   46 +
 ...ading-spec_v1-check-on-var-offset-st.patch |   93 ++
 ...deadlocks-in-the-sockhash-and-sockma.patch |   83 ++
 ...rt-buggy-deadlock-fix-in-the-sockhas.patch |  101 ++
 ...count-liveness-when-propagating-prec.patch |   61 +
 ...for-long-instructions-in-program-cfg.patch |   46 +
 ...of_node_put-in-assigned-clocks-prope.patch |   74 ++
 ...k-sam9x60-pll-fix-return-value-check.patch |   38 +
 ...ers-davinci-fix-memory-leak-in-davin.patch |  101 ++
 ...resight-etm_pmu-set-the-module-field.patch |   35 +
 ...clear-some-memory-in-instantiate_rng.patch |   52 +
 ...-drbg_prepare_hrng-handle-jent-insta.patch |   68 +
 ...-fail-when-jent-is-unavailable-in-fi.patch |   41 +
 .../crypto-sa2ul-select-crypto_des.patch      |   45 +
 ...revent-init-race-with-static-objects.patch |  283 ++++
 ...ac-do-not-enable-all-cyclic-channels.patch |   55 +
 ...a-fix-to-change-for-continuous-trans.patch |   90 ++
 ...a-fix-to-enable-to-issue-dma-request.patch |   44 +
 ...maengine-mv_xor_v2-fix-an-error-code.patch |   37 +
 ...33-fix-adv7533_mode_valid-for-adv753.patch |   70 +
 ...ntel_get_crtc_new_encoder-less-oopsy.patch |   45 +
 ...v-add-missing-unwind-goto-in-lima_pd.patch |   45 +
 ...o-defer-enabling-runpm-until-hw_init.patch |   62 +
 ...eno-disable-preemption-on-adreno-510.patch |   54 +
 ...eno-drop-bogus-pm_runtime_set_active.patch |   42 +
 ...-check-for-crtc-enable-rather-than-c.patch |   40 +
 ...-cancel-previous-job-before-starting.patch |   52 +
 ...m-rockchip-drop-unbalanced-obj-unref.patch |   38 +
 .../drm-vgem-add-missing-mutex_destroy.patch  |   42 +
 ...rflows-on-the-dram-row-address-mappi.patch |   55 +
 ...ial-overflow-calculating-xattr_isize.patch |   42 +
 ...ng-non-compact-head-index-if-cluster.patch |   65 +
 ...er-free-read-in-ext4_find_extent-for.patch |   94 ++
 ...apply-zone-capacity-to-all-zone-type.patch |  140 ++
 ...x-to-call-f2fs_wait_on_page_writebac.patch |   99 ++
 .../f2fs-enforce-single-zone-capacity.patch   |  186 +++
 ...id-use-after-free-for-cached-ipu-bio.patch |   76 ++
 ...t-error-in-f2fs_transfer_project_quo.patch |   50 +
 ...scm-clear-download-bit-during-reboot.patch |   39 +
 ...rypi-introduce-devm_rpi_firmware_get.patch |   98 ++
 ...10-svc-fix-an-null-vs-is_err-bug-in-.patch |   39 +
 ...fix-kernel-doc-parameter-description.patch |   39 +
 ..._i2c_master_xfer-fix-runtime-pm-leak.patch |   46 +
 ...g-fix-section-mismatch-warning-error.patch |   41 +
 ...placate-defined-but-not-used-warning.patch |   42 +
 .../ib-hfi1-add-additional-usdma-traces.patch |  176 +++
 queue-5.10/ib-hfi1-add-aip-tx-traces.patch    |  235 ++++
 ...-with-non-page_size-end-multi-iovec-.patch | 1148 +++++++++++++++++
 ...-mmu_rb_node-not-being-evicted-in-lr.patch |   93 ++
 ...44009-add-missing-of-device-matching.patch |   66 +
 ...i-ts-fix-refcount-leak-in-rpi_ts_pro.patch |   48 +
 ...i-ts-release-firmware-handle-when-no.patch |   37 +
 ...pmi_bmc-select-regmap_mmio-instead-o.patch |   51 +
 ...al-uninit-variable-access-bug-in-__i.patch |   56 +
 ...llow-flow-hash-to-be-set-via-ethtool.patch |   68 +
 ...-setting-rss-table-to-default-values.patch |  147 +++
 ...e-invalidation-of-already-invalidate.patch |   44 +
 ...-error-handling-of-using-fwnode_prop.patch |   62 +
 ...on-select-regmap-instead-of-dependin.patch |   44 +
 ...h-allow-either-builtin-or-modular-fo.patch |   58 +
 ...h-via-pmu-led-requires-ata-to-be-set.patch |   45 +
 ...farm_smu_sat-add-missing-of_node_put.patch |   36 +
 ...eak-of-r10bio-remaining-for-recovery.patch |   73 ++
 ...aid10-fix-memleak-for-conf-bio_split.patch |   96 ++
 .../md-raid10-fix-memleak-of-md-thread.patch  |   51 +
 ...d-missing-check-for-create_workqueue.patch |   37 +
 ...-use-after-free-bug-in-dm1105_remove.patch |   56 +
 .../media-max9286-free-control-handler.patch  |   41 +
 ...gpio-ir-recv-fix-support-for-wake-up.patch |   43 +
 ...-fix-pm_runtime_get_sync-usage-count.patch |   76 ++
 ...fix-refcount-leak-in-probe-and-remov.patch |   70 +
 ...fix-the-correct-variable-assignments.patch |   48 +
 ...make-use-of-the-helper-function-devm.patch |   49 +
 ...simplify-error-check-logic-at-fdp_op.patch |   62 +
 ...-use-after-free-bug-in-rkvdec_remove.patch |   56 +
 ...x-use-after-free-bug-in-saa7134_fini.patch |   86 ++
 ...us-dec-fix-handling-of-the-start-cmd.patch |   61 +
 ...enus-preserve-drc-state-across-seeks.patch |   74 ++
 ...-fix-non-reliable-setting-of-last-fl.patch |  186 +++
 ...ia-venus-vdec-handle-drc-after-drain.patch |   99 ++
 ...-make-decoder-return-last-flag-for-s.patch |  100 ++
 ...d-support-for-tqmx110eb-and-tqmxe40x.patch |   69 +
 ...x86-correct-board-names-for-tqmxe39x.patch |  119 ++
 ...t-access-i2c_detect-register-through.patch |   61 +
 ...6-remove-incorrect-tqmx90uc-board-id.patch |   53 +
 ...fy-io-port-register-range-more-preci.patch |   64 +
 ...hc-fix-quirk-to-ignore-command-inhib.patch |   82 ++
 ...nk-leak-when-verifying-config-failed.patch |   47 +
 ...mac-dwmac-rk-fix-optional-phy-regula.patch |   64 +
 ...-packet-annotate-accesses-to-po-xmit.patch |   70 +
 ...convert-po-auxdata-to-an-atomic-flag.patch |   95 ++
 ...convert-po-origdev-to-an-atomic-flag.patch |  126 ++
 ...rect-types-of-trace-event-parameters.patch |  108 ++
 ...ch_fq-fix-integer-overflow-of-credit.patch |   58 +
 ...les-don-t-write-table-validation-sta.patch |   87 ++
 ..._to_user-for-optval-in-netlink_getso.patch |  171 +++
 ...end-a-reclaim_complete-after-establi.patch |   45 +
 ...inconsistent-in-hardirq-w-hardirq-on.patch |  206 +++
 .../nvme-fix-async-event-trace-event.patch    |   92 ++
 ...le-the-persistent-internal-error-aer.patch |  113 ++
 .../of-fix-modalias-string-generation.patch   |   80 ++
 ...y-store-r31-to-pt_regs-on-unhandled-.patch |   56 +
 ...vice-status-after-edr-error-recovery.patch |   56 +
 ...-the-fault-handler-only-on-compatibl.patch |   78 ++
 ...rdlockup-failure-caused-by-perf-thro.patch |   51 +
 ...dd-missing-tegra_xusb_port_unregiste.patch |   47 +
 ...generic-adc-battery-fix-unit-scaling.patch |   42 +
 ...x-fix-resource-printk-format-warning.patch |   46 +
 ...-memmove-for-potentially-overlapping.patch |   56 +
 ...si108-fix-resource-printk-format-war.patch |   45 +
 ...-fix-resource-printk-format-warnings.patch |   87 ++
 ...ert-pmsg_lock-back-to-a-normal-mutex.patch |  100 ++
 ...ust-the-clocks-to-avoid-them-mismatc.patch |  198 +++
 ...able-shadow-registers-before-setting.patch |   74 ++
 ...-t-check-the-return-code-of-pwmchip_.patch |   47 +
 ...tick_dep_mask_rcu_exp-dependency-che.patch |   63 +
 ...m_send_rej-event-before-the-cm-state.patch |   49 +
 ...t-shift-wrapping-in-set_user_sq_size.patch |   46 +
 ...mlx5-fix-flow-counter-query-via-devx.patch |   93 ++
 ...rrect-device-num_ports-when-modify-d.patch |   39 +
 ...rdmavt-delete-unnecessary-null-check.patch |   41 +
 ...ential-page_array-out-of-range-acces.patch |   39 +
 ...namespace-check-from-siw_netdev_even.patch |   44 +
 ...-a-check-for-valid-mad_agent-pointer.patch |  112 ++
 ...void-lockdep-reports-when-resolving-.patch |  266 ++++
 ...onsistently-set-mutex_owner-when-usi.patch |   54 +
 ...egulator-stm32-pwr-fix-of_iomap-leak.patch |   69 +
 ...-btsdio-fix-use-after-free-bug-in-bt.patch |   39 +
 ...se-ktime_get_real_ts64-to-get-the-cu.patch |   60 +
 ...-header-for-omap_rtc_power_off_progr.patch |   40 +
 ...unc-setting-condition-for-so_passsec.patch |   77 ++
 ...db-bail-early-if-there-are-no-clocks.patch |   48 +
 ...ail-early-if-there-are-no-generic-pd.patch |   60 +
 ...remap-issues-in-lpfc_sli4_pci_mem_se.patch |   70 +
 ...aid-fix-mega_cmd_done-cmdid_int_cmds.patch |   38 +
 ...rget-fix-multiple-lun_reset-handling.patch |  142 ++
 ...it-fix-tas-handling-during-conn-clea.patch |   67 +
 .../scsi-target-make-state_list-per-cpu.patch |  420 ++++++
 ...ame-cmd.bad_sector-to-cmd.sense_info.patch |  130 ++
 ...me-struct-sense_info-to-sense_detail.patch |   94 ++
 ...it-for-receive-in-cg_storage_multi-t.patch |   68 +
 ...l-check-for-return-value-after-write.patch |   56 +
 ...l-return-null-if-malloc_and_init_mem.patch |   46 +
 ...v_permissions.h-is-built-when-needed.patch |   36 +
 ...fix-makefile-dependencies-of-flask.h.patch |   43 +
 ...0-add-missing-wakeup-event-reporting.patch |   53 +
 queue-5.10/series                             |  220 ++++
 ...ect-element-size-for-allocating-bitm.patch |   44 +
 ...able-basic-pm-runtime-support-for-ge.patch |   75 ++
 ...fix-refcount-leak-in-am33xx_pm_probe.patch |   53 +
 ...ve-pm_sleep-based-conditional-compil.patch |   48 +
 ...spi-fix-suspend-resume-implementatio.patch |   68 +
 ...fsl-spi-fix-cpm-qe-mode-litte-endian.patch |   71 +
 ...-skip-cleanup-in-remove-s-error-path.patch |   52 +
 ...-skip-cleanup-in-remove-s-error-path.patch |   65 +
 ...g-pm_runtime_resume_and_get-instead-.patch |   53 +
 ...-for-remove-callback-when-removing-a.patch |   65 +
 ...-fix-w_disable-does-not-work-after-s.patch |   44 +
 ...e-maximum-number-of-retries-in-call_.patch |   74 ++
 ...eaks-of-sk-and-zerocopy-skbs-with-tx.patch |  125 ++
 ...mediatek-use-devm_of_iomap-to-avoid-.patch |   63 +
 ...n-align-tick-period-with-the-hz-tick.patch |   67 +
 queue-5.10/tick-get-rid-of-tick_period.patch  |  192 +++
 ...ize-tick_do_update_jiffies64-further.patch |   62 +
 ...e-seqcount-held-scope-in-tick_do_upd.patch |   95 ++
 ...ick_next_period-for-lockless-quick-c.patch |  105 ++
 ...s-bpftool-remove-invalid-json-escape.patch |   53 +
 ...implement-usage-counter-for-locality.patch |  235 ++++
 ...m-locality-before-writing-interrupt-.patch |   85 ++
 ...m-locality-before-writing-tpm_int_en.patch |   47 +
 ...m-locality-when-interrupts-are-reena.patch |   68 +
 ...ble-interrupts-if-tpm_tis_probe_irq-.patch |   69 +
 ...ot-skip-reset-of-original-interrupt-.patch |  113 ++
 ...puart-adjust-buffer-length-to-the-in.patch |   39 +
 ...nst.h-prefer-iso-friendly-__typeof__.patch |   65 +
 ...ea-fix-missing-goto-in-ci_hdrc_probe.patch |   42 +
 ...change-condition-for-processing-susp.patch |   54 +
 ...et-tegra-xudc-fix-crash-in-vbus_draw.patch |   43 +
 ...enesas_usb3-fix-use-after-free-bug-i.patch |   62 +
 ...-rcar-remove-leftover-quirk-handling.patch |   46 +
 ...nel-panic-at-qmu-transfer-done-irq-h.patch |   73 ++
 ...ly-enable-siocshwtstamp-in-container.patch |   37 +
 ...race-condition-in-vmci_host_poll-cau.patch |   95 ++
 ...n-off-by-one-check-in-ath5k_eeprom_r.patch |   39 +
 ...ath6kl-minor-fix-for-allocation-size.patch |   40 +
 ...l-reduce-warn-to-dev_dbg-in-callback.patch |   43 +
 ...f_usb-fix-memory-leak-of-remain_skbs.patch |   87 ++
 ...wlwifi-fw-fix-memory-leak-in-debugfs.patch |   42 +
 ...i-fw-move-memset-before-early-return.patch |   53 +
 ...e-the-loop-for-card-preparation-effe.patch |   50 +
 ...ifi-mvm-check-firmware-response-size.patch |   53 +
 ...i-yoyo-fix-possible-division-by-zero.patch |   44 +
 ...-incorrect-error-codes-in-rtl_debugf.patch |   54 +
 ...rect-error-codes-in-rtl_debugf.patch-12104 |   54 +
 ...eturn-the-original-error-from-rtw_ma.patch |   51 +
 ...eturn-the-original-error-from-rtw_pw.patch |   39 +
 ...fix-hung-time-report-of-worker-pools.patch |   66 +
 ...-delayed-delayed-by-active-managemen.patch |  256 ++++
 ...mic-update-of-offset-in-reserve_eilv.patch |   49 +
 ...-return-0-from-arch_dynirq_lower_bou.patch |   72 ++
 .../x86-mce-amd-use-an-u64-for-bank_map.patch |   99 ++
 ...-fix-unaligned-descriptor-validation.patch |   65 +
 221 files changed, 17525 insertions(+)
 create mode 100644 queue-5.10/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch
 create mode 100644 queue-5.10/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch
 create mode 100644 queue-5.10/arm-dts-gta04-fix-excess-dma-channel-usage.patch
 create mode 100644 queue-5.10/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch
 create mode 100644 queue-5.10/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch
 create mode 100644 queue-5.10/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch
 create mode 100644 queue-5.10/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch
 create mode 100644 queue-5.10/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch
 create mode 100644 queue-5.10/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch
 create mode 100644 queue-5.10/asoc-es8316-handle-optional-irq-assignment.patch
 create mode 100644 queue-5.10/asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch
 create mode 100644 queue-5.10/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch
 create mode 100644 queue-5.10/bpf-don-t-efault-for-getsockopt-with-optval-null.patch
 create mode 100644 queue-5.10/bpf-fix-precision-propagation-verbose-logging.patch
 create mode 100644 queue-5.10/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch
 create mode 100644 queue-5.10/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch
 create mode 100644 queue-5.10/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch
 create mode 100644 queue-5.10/bpf-take-into-account-liveness-when-propagating-prec.patch
 create mode 100644 queue-5.10/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch
 create mode 100644 queue-5.10/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch
 create mode 100644 queue-5.10/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch
 create mode 100644 queue-5.10/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch
 create mode 100644 queue-5.10/coresight-etm_pmu-set-the-module-field.patch
 create mode 100644 queue-5.10/crypto-caam-clear-some-memory-in-instantiate_rng.patch
 create mode 100644 queue-5.10/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch
 create mode 100644 queue-5.10/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch
 create mode 100644 queue-5.10/crypto-sa2ul-select-crypto_des.patch
 create mode 100644 queue-5.10/debugobject-prevent-init-race-with-static-objects.patch
 create mode 100644 queue-5.10/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch
 create mode 100644 queue-5.10/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch
 create mode 100644 queue-5.10/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch
 create mode 100644 queue-5.10/dmaengine-mv_xor_v2-fix-an-error-code.patch
 create mode 100644 queue-5.10/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch
 create mode 100644 queue-5.10/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch
 create mode 100644 queue-5.10/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch
 create mode 100644 queue-5.10/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch
 create mode 100644 queue-5.10/drm-msm-adreno-disable-preemption-on-adreno-510.patch
 create mode 100644 queue-5.10/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch
 create mode 100644 queue-5.10/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch
 create mode 100644 queue-5.10/drm-probe-helper-cancel-previous-job-before-starting.patch
 create mode 100644 queue-5.10/drm-rockchip-drop-unbalanced-obj-unref.patch
 create mode 100644 queue-5.10/drm-vgem-add-missing-mutex_destroy.patch
 create mode 100644 queue-5.10/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch
 create mode 100644 queue-5.10/erofs-fix-potential-overflow-calculating-xattr_isize.patch
 create mode 100644 queue-5.10/erofs-stop-parsing-non-compact-head-index-if-cluster.patch
 create mode 100644 queue-5.10/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch
 create mode 100644 queue-5.10/f2fs-apply-zone-capacity-to-all-zone-type.patch
 create mode 100644 queue-5.10/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch
 create mode 100644 queue-5.10/f2fs-enforce-single-zone-capacity.patch
 create mode 100644 queue-5.10/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch
 create mode 100644 queue-5.10/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch
 create mode 100644 queue-5.10/firmware-qcom_scm-clear-download-bit-during-reboot.patch
 create mode 100644 queue-5.10/firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch
 create mode 100644 queue-5.10/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch
 create mode 100644 queue-5.10/fpga-bridge-fix-kernel-doc-parameter-description.patch
 create mode 100644 queue-5.10/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch
 create mode 100644 queue-5.10/ia64-mm-contig-fix-section-mismatch-warning-error.patch
 create mode 100644 queue-5.10/ia64-salinfo-placate-defined-but-not-used-warning.patch
 create mode 100644 queue-5.10/ib-hfi1-add-additional-usdma-traces.patch
 create mode 100644 queue-5.10/ib-hfi1-add-aip-tx-traces.patch
 create mode 100644 queue-5.10/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch
 create mode 100644 queue-5.10/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch
 create mode 100644 queue-5.10/iio-light-max44009-add-missing-of-device-matching.patch
 create mode 100644 queue-5.10/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch
 create mode 100644 queue-5.10/input-raspberrypi-ts-release-firmware-handle-when-no.patch
 create mode 100644 queue-5.10/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch
 create mode 100644 queue-5.10/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch
 create mode 100644 queue-5.10/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch
 create mode 100644 queue-5.10/ixgbe-enable-setting-rss-table-to-default-values.patch
 create mode 100644 queue-5.10/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch
 create mode 100644 queue-5.10/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch
 create mode 100644 queue-5.10/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch
 create mode 100644 queue-5.10/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch
 create mode 100644 queue-5.10/macintosh-via-pmu-led-requires-ata-to-be-set.patch
 create mode 100644 queue-5.10/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch
 create mode 100644 queue-5.10/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch
 create mode 100644 queue-5.10/md-raid10-fix-memleak-for-conf-bio_split.patch
 create mode 100644 queue-5.10/md-raid10-fix-memleak-of-md-thread.patch
 create mode 100644 queue-5.10/media-bdisp-add-missing-check-for-create_workqueue.patch
 create mode 100644 queue-5.10/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch
 create mode 100644 queue-5.10/media-max9286-free-control-handler.patch
 create mode 100644 queue-5.10/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch
 create mode 100644 queue-5.10/media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch
 create mode 100644 queue-5.10/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch
 create mode 100644 queue-5.10/media-rcar_fdp1-fix-the-correct-variable-assignments.patch
 create mode 100644 queue-5.10/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch
 create mode 100644 queue-5.10/media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch
 create mode 100644 queue-5.10/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch
 create mode 100644 queue-5.10/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch
 create mode 100644 queue-5.10/media-venus-dec-fix-handling-of-the-start-cmd.patch
 create mode 100644 queue-5.10/media-venus-preserve-drc-state-across-seeks.patch
 create mode 100644 queue-5.10/media-venus-vdec-fix-non-reliable-setting-of-last-fl.patch
 create mode 100644 queue-5.10/media-venus-vdec-handle-drc-after-drain.patch
 create mode 100644 queue-5.10/media-venus-vdec-make-decoder-return-last-flag-for-s.patch
 create mode 100644 queue-5.10/mfd-tqmx86-add-support-for-tqmx110eb-and-tqmxe40x.patch
 create mode 100644 queue-5.10/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch
 create mode 100644 queue-5.10/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch
 create mode 100644 queue-5.10/mfd-tqmx86-remove-incorrect-tqmx90uc-board-id.patch
 create mode 100644 queue-5.10/mfd-tqmx86-specify-io-port-register-range-more-preci.patch
 create mode 100644 queue-5.10/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch
 create mode 100644 queue-5.10/net-amd-fix-link-leak-when-verifying-config-failed.patch
 create mode 100644 queue-5.10/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch
 create mode 100644 queue-5.10/net-packet-annotate-accesses-to-po-xmit.patch
 create mode 100644 queue-5.10/net-packet-convert-po-auxdata-to-an-atomic-flag.patch
 create mode 100644 queue-5.10/net-packet-convert-po-origdev-to-an-atomic-flag.patch
 create mode 100644 queue-5.10/net-qrtr-correct-types-of-trace-event-parameters.patch
 create mode 100644 queue-5.10/net-sched-sch_fq-fix-integer-overflow-of-credit.patch
 create mode 100644 queue-5.10/netfilter-nf_tables-don-t-write-table-validation-sta.patch
 create mode 100644 queue-5.10/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch
 create mode 100644 queue-5.10/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch
 create mode 100644 queue-5.10/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch
 create mode 100644 queue-5.10/nvme-fix-async-event-trace-event.patch
 create mode 100644 queue-5.10/nvme-handle-the-persistent-internal-error-aer.patch
 create mode 100644 queue-5.10/of-fix-modalias-string-generation.patch
 create mode 100644 queue-5.10/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch
 create mode 100644 queue-5.10/pci-edr-clear-device-status-after-edr-error-recovery.patch
 create mode 100644 queue-5.10/pci-imx6-install-the-fault-handler-only-on-compatibl.patch
 create mode 100644 queue-5.10/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch
 create mode 100644 queue-5.10/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch
 create mode 100644 queue-5.10/power-supply-generic-adc-battery-fix-unit-scaling.patch
 create mode 100644 queue-5.10/powerpc-mpc512x-fix-resource-printk-format-warning.patch
 create mode 100644 queue-5.10/powerpc-rtas-use-memmove-for-potentially-overlapping.patch
 create mode 100644 queue-5.10/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch
 create mode 100644 queue-5.10/powerpc-wii-fix-resource-printk-format-warnings.patch
 create mode 100644 queue-5.10/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch
 create mode 100644 queue-5.10/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch
 create mode 100644 queue-5.10/pwm-mtk-disp-disable-shadow-registers-before-setting.patch
 create mode 100644 queue-5.10/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch
 create mode 100644 queue-5.10/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch
 create mode 100644 queue-5.10/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch
 create mode 100644 queue-5.10/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch
 create mode 100644 queue-5.10/rdma-mlx5-fix-flow-counter-query-via-devx.patch
 create mode 100644 queue-5.10/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch
 create mode 100644 queue-5.10/rdma-rdmavt-delete-unnecessary-null-check.patch
 create mode 100644 queue-5.10/rdma-siw-fix-potential-page_array-out-of-range-acces.patch
 create mode 100644 queue-5.10/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch
 create mode 100644 queue-5.10/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch
 create mode 100644 queue-5.10/regulator-core-avoid-lockdep-reports-when-resolving-.patch
 create mode 100644 queue-5.10/regulator-core-consistently-set-mutex_owner-when-usi.patch
 create mode 100644 queue-5.10/regulator-stm32-pwr-fix-of_iomap-leak.patch
 create mode 100644 queue-5.10/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch
 create mode 100644 queue-5.10/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch
 create mode 100644 queue-5.10/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch
 create mode 100644 queue-5.10/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch
 create mode 100644 queue-5.10/scripts-gdb-bail-early-if-there-are-no-clocks.patch
 create mode 100644 queue-5.10/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch
 create mode 100644 queue-5.10/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch
 create mode 100644 queue-5.10/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch
 create mode 100644 queue-5.10/scsi-target-fix-multiple-lun_reset-handling.patch
 create mode 100644 queue-5.10/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch
 create mode 100644 queue-5.10/scsi-target-make-state_list-per-cpu.patch
 create mode 100644 queue-5.10/scsi-target-rename-cmd.bad_sector-to-cmd.sense_info.patch
 create mode 100644 queue-5.10/scsi-target-rename-struct-sense_info-to-sense_detail.patch
 create mode 100644 queue-5.10/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch
 create mode 100644 queue-5.10/selftests-resctrl-check-for-return-value-after-write.patch
 create mode 100644 queue-5.10/selftests-resctrl-return-null-if-malloc_and_init_mem.patch
 create mode 100644 queue-5.10/selinux-ensure-av_permissions.h-is-built-when-needed.patch
 create mode 100644 queue-5.10/selinux-fix-makefile-dependencies-of-flask.h.patch
 create mode 100644 queue-5.10/serial-8250-add-missing-wakeup-event-reporting.patch
 create mode 100644 queue-5.10/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch
 create mode 100644 queue-5.10/soc-ti-pm33xx-enable-basic-pm-runtime-support-for-ge.patch
 create mode 100644 queue-5.10/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch
 create mode 100644 queue-5.10/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch
 create mode 100644 queue-5.10/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch
 create mode 100644 queue-5.10/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch
 create mode 100644 queue-5.10/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch
 create mode 100644 queue-5.10/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch
 create mode 100644 queue-5.10/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch
 create mode 100644 queue-5.10/spmi-add-a-check-for-remove-callback-when-removing-a.patch
 create mode 100644 queue-5.10/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch
 create mode 100644 queue-5.10/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch
 create mode 100644 queue-5.10/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch
 create mode 100644 queue-5.10/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch
 create mode 100644 queue-5.10/tick-common-align-tick-period-with-the-hz-tick.patch
 create mode 100644 queue-5.10/tick-get-rid-of-tick_period.patch
 create mode 100644 queue-5.10/tick-sched-optimize-tick_do_update_jiffies64-further.patch
 create mode 100644 queue-5.10/tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch
 create mode 100644 queue-5.10/tick-sched-use-tick_next_period-for-lockless-quick-c.patch
 create mode 100644 queue-5.10/tools-bpftool-remove-invalid-json-escape.patch
 create mode 100644 queue-5.10/tpm-tpm-implement-usage-counter-for-locality.patch
 create mode 100644 queue-5.10/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch
 create mode 100644 queue-5.10/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch
 create mode 100644 queue-5.10/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch
 create mode 100644 queue-5.10/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch
 create mode 100644 queue-5.10/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch
 create mode 100644 queue-5.10/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch
 create mode 100644 queue-5.10/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch
 create mode 100644 queue-5.10/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch
 create mode 100644 queue-5.10/usb-dwc3-gadget-change-condition-for-processing-susp.patch
 create mode 100644 queue-5.10/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch
 create mode 100644 queue-5.10/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch
 create mode 100644 queue-5.10/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch
 create mode 100644 queue-5.10/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch
 create mode 100644 queue-5.10/vlan-partially-enable-siocshwtstamp-in-container.patch
 create mode 100644 queue-5.10/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch
 create mode 100644 queue-5.10/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch
 create mode 100644 queue-5.10/wifi-ath6kl-minor-fix-for-allocation-size.patch
 create mode 100644 queue-5.10/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch
 create mode 100644 queue-5.10/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch
 create mode 100644 queue-5.10/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch
 create mode 100644 queue-5.10/wifi-iwlwifi-fw-move-memset-before-early-return.patch
 create mode 100644 queue-5.10/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch
 create mode 100644 queue-5.10/wifi-iwlwifi-mvm-check-firmware-response-size.patch
 create mode 100644 queue-5.10/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch
 create mode 100644 queue-5.10/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch
 create mode 100644 queue-5.10/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-12104
 create mode 100644 queue-5.10/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch
 create mode 100644 queue-5.10/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch
 create mode 100644 queue-5.10/workqueue-fix-hung-time-report-of-worker-pools.patch
 create mode 100644 queue-5.10/workqueue-rename-delayed-delayed-by-active-managemen.patch
 create mode 100644 queue-5.10/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch
 create mode 100644 queue-5.10/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch
 create mode 100644 queue-5.10/x86-mce-amd-use-an-u64-for-bank_map.patch
 create mode 100644 queue-5.10/xsk-fix-unaligned-descriptor-validation.patch

diff --git a/queue-5.10/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch b/queue-5.10/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch
new file mode 100644
index 00000000000..d952b0b4bf5
--- /dev/null
+++ b/queue-5.10/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch
@@ -0,0 +1,146 @@
+From 71e69e84971423733da9c206c791185014f11acc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 12:13:29 +0100
+Subject: ACPI: processor: Fix evaluating _PDC method when running as Xen dom0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Roger Pau Monne <roger.pau@citrix.com>
+
+[ Upstream commit 073828e954459b883f23e53999d31e4c55ab9654 ]
+
+In ACPI systems, the OS can direct power management, as opposed to the
+firmware.  This OS-directed Power Management is called OSPM.  Part of
+telling the firmware that the OS going to direct power management is
+making ACPI "_PDC" (Processor Driver Capabilities) calls.  These _PDC
+methods must be evaluated for every processor object.  If these _PDC
+calls are not completed for every processor it can lead to
+inconsistency and later failures in things like the CPU frequency
+driver.
+
+In a Xen system, the dom0 kernel is responsible for system-wide power
+management.  The dom0 kernel is in charge of OSPM.  However, the
+number of CPUs available to dom0 can be different than the number of
+CPUs physically present on the system.
+
+This leads to a problem: the dom0 kernel needs to evaluate _PDC for
+all the processors, but it can't always see them.
+
+In dom0 kernels, ignore the existing ACPI method for determining if a
+processor is physically present because it might not be accurate.
+Instead, ask the hypervisor for this information.
+
+Fix this by introducing a custom function to use when running as Xen
+dom0 in order to check whether a processor object matches a CPU that's
+online.  Such checking is done using the existing information fetched
+by the Xen pCPU subsystem, extending it to also store the ACPI ID.
+
+This ensures that _PDC method gets evaluated for all physically online
+CPUs, regardless of the number of CPUs made available to dom0.
+
+Fixes: 5d554a7bb064 ("ACPI: processor: add internal processor_physically_present()")
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_pdc.c | 11 +++++++++++
+ drivers/xen/pcpu.c           | 20 ++++++++++++++++++++
+ include/xen/xen.h            | 11 +++++++++++
+ 3 files changed, 42 insertions(+)
+
+diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c
+index 813f1b78c16a9..c0d2d9a2c0d58 100644
+--- a/drivers/acpi/processor_pdc.c
++++ b/drivers/acpi/processor_pdc.c
+@@ -14,6 +14,8 @@
+ #include <linux/acpi.h>
+ #include <acpi/processor.h>
+ 
++#include <xen/xen.h>
++
+ #include "internal.h"
+ 
+ #define _COMPONENT              ACPI_PROCESSOR_COMPONENT
+@@ -50,6 +52,15 @@ static bool __init processor_physically_present(acpi_handle handle)
+ 		return false;
+ 	}
+ 
++	if (xen_initial_domain())
++		/*
++		 * When running as a Xen dom0 the number of processors Linux
++		 * sees can be different from the real number of processors on
++		 * the system, and we still need to execute _PDC for all of
++		 * them.
++		 */
++		return xen_processor_present(acpi_id);
++
+ 	type = (acpi_type == ACPI_TYPE_DEVICE) ? 1 : 0;
+ 	cpuid = acpi_get_cpuid(handle, type, acpi_id);
+ 
+diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c
+index 9cf7085a260b4..4581217e31fea 100644
+--- a/drivers/xen/pcpu.c
++++ b/drivers/xen/pcpu.c
+@@ -58,6 +58,7 @@ struct pcpu {
+ 	struct list_head list;
+ 	struct device dev;
+ 	uint32_t cpu_id;
++	uint32_t acpi_id;
+ 	uint32_t flags;
+ };
+ 
+@@ -249,6 +250,7 @@ static struct pcpu *create_and_register_pcpu(struct xenpf_pcpuinfo *info)
+ 
+ 	INIT_LIST_HEAD(&pcpu->list);
+ 	pcpu->cpu_id = info->xen_cpuid;
++	pcpu->acpi_id = info->acpi_id;
+ 	pcpu->flags = info->flags;
+ 
+ 	/* Need hold on xen_pcpu_lock before pcpu list manipulations */
+@@ -416,3 +418,21 @@ static int __init xen_pcpu_init(void)
+ 	return ret;
+ }
+ arch_initcall(xen_pcpu_init);
++
++#ifdef CONFIG_ACPI
++bool __init xen_processor_present(uint32_t acpi_id)
++{
++	const struct pcpu *pcpu;
++	bool online = false;
++
++	mutex_lock(&xen_pcpu_lock);
++	list_for_each_entry(pcpu, &xen_pcpus, list)
++		if (pcpu->acpi_id == acpi_id) {
++			online = pcpu->flags & XEN_PCPU_FLAGS_ONLINE;
++			break;
++		}
++	mutex_unlock(&xen_pcpu_lock);
++
++	return online;
++}
++#endif
+diff --git a/include/xen/xen.h b/include/xen/xen.h
+index 43efba045acc7..5a6a2ab675bed 100644
+--- a/include/xen/xen.h
++++ b/include/xen/xen.h
+@@ -61,4 +61,15 @@ void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages);
+ #include <xen/balloon.h>
+ #endif
+ 
++#if defined(CONFIG_XEN_DOM0) && defined(CONFIG_ACPI) && defined(CONFIG_X86)
++bool __init xen_processor_present(uint32_t acpi_id);
++#else
++#include <linux/bug.h>
++static inline bool xen_processor_present(uint32_t acpi_id)
++{
++	BUG();
++	return false;
++}
++#endif
++
+ #endif	/* _XEN_XEN_H */
+-- 
+2.39.2
+
diff --git a/queue-5.10/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch b/queue-5.10/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch
new file mode 100644
index 00000000000..b041574e951
--- /dev/null
+++ b/queue-5.10/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch
@@ -0,0 +1,40 @@
+From 3d01e6ff7b9baf1cb9a4b4f75766c15c0e1444ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 10:07:01 -0400
+Subject: afs: Fix updating of i_size with dv jump from server
+
+From: Marc Dionne <marc.dionne@auristor.com>
+
+[ Upstream commit d7f74e9a917503ee78f2b603a456d7227cf38919 ]
+
+If the data version returned from the server is larger than expected,
+the local data is invalidated, but we may still want to note the remote
+file size.
+
+Since we're setting change_size, we have to also set data_changed
+for the i_size to get updated.
+
+Fixes: 3f4aa9818163 ("afs: Fix EOF corruption")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 826fae22a8cc9..fdca4262f806a 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -218,6 +218,7 @@ static void afs_apply_status(struct afs_operation *op,
+ 			set_bit(AFS_VNODE_ZAP_DATA, &vnode->flags);
+ 		}
+ 		change_size = true;
++		data_changed = true;
+ 	} else if (vnode->status.type == AFS_FTYPE_DIR) {
+ 		/* Expected directory change is handled elsewhere so
+ 		 * that we can locally edit the directory and save on a
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm-dts-gta04-fix-excess-dma-channel-usage.patch b/queue-5.10/arm-dts-gta04-fix-excess-dma-channel-usage.patch
new file mode 100644
index 00000000000..0aefc1b19a4
--- /dev/null
+++ b/queue-5.10/arm-dts-gta04-fix-excess-dma-channel-usage.patch
@@ -0,0 +1,73 @@
+From 9795b78f099401be8034283574ddb2f89310899c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 22:11:51 +0100
+Subject: ARM: dts: gta04: fix excess dma channel usage
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit a622310f7f0185da02e42cdb06475f533efaae60 ]
+
+OMAP processors support 32 channels but there is no check or
+inspect this except booting a device and looking at dmesg reports
+of not available channels.
+
+Recently some more subsystems with DMA (aes1+2) were added filling
+the list of dma channels beyond the limit of 32 (even if other
+parameters indicate 96 or 128 channels). This leads to random
+subsystem failures i(e.g. mcbsp for audio) after boot or boot
+messages that DMA can not be initialized.
+
+Another symptom is that
+
+/sys/kernel/debug/dmaengine/summary
+
+has 32 entries and does not show all required channels.
+
+Fix by disabling unused (on the GTA04 hardware) mcspi1...4.
+Each SPI channel allocates 4 DMA channels rapidly filling
+the available ones.
+
+Disabling unused SPI modules on the OMAP3 SoC may also save
+some energy (has not been checked).
+
+Fixes: c312f066314e ("ARM: dts: omap3: Migrate AES from hwmods to sysc-omap2")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+[re-enabled aes2, improved commit subject line]
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Message-Id: <20230113211151.2314874-1-andreas@kemnade.info>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index cc8a378dd076e..e61e5ddbf2027 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -609,6 +609,22 @@
+ 	clock-frequency = <100000>;
+ };
+ 
++&mcspi1 {
++	status = "disabled";
++};
++
++&mcspi2 {
++	status = "disabled";
++};
++
++&mcspi3 {
++	status = "disabled";
++};
++
++&mcspi4 {
++	status = "disabled";
++};
++
+ &usb_otg_hs {
+ 	interface-type = <0>;
+ 	usb-phy = <&usb2_phy>;
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch b/queue-5.10/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch
new file mode 100644
index 00000000000..6a65c5b938a
--- /dev/null
+++ b/queue-5.10/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch
@@ -0,0 +1,45 @@
+From ae6fdfe470fa642f196c19288a0195e9922a9a40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:51 +0530
+Subject: ARM: dts: qcom: ipq4019: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 2540279e9a9e74fc880d1e4c83754ecfcbe290a0 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address
+(0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 187519403273 ("ARM: dts: ipq4019: Add a few peripheral nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-16-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 3defd47fd8fab..037bb8a9b01ec 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -414,8 +414,8 @@
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
+-			ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>,
+-				 <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>;
++			ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>,
++				 <0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>;
+ 
+ 			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "msi";
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch b/queue-5.10/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch
new file mode 100644
index 00000000000..a502c311a48
--- /dev/null
+++ b/queue-5.10/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch
@@ -0,0 +1,68 @@
+From 198de427cf4b8f0ffae78bd9e78aef7f31df95e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:52 +0530
+Subject: ARM: dts: qcom: ipq8064: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 0b16b34e491629016109e56747ad64588074194b ]
+
+For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses
+(0x0fe00000, 0x31e00000, 0x35e00000) specified in the ranges property for
+I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 93241840b664 ("ARM: dts: qcom: Add pcie nodes for ipq8064")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-17-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+index f7ed87a35e34d..dca0ed6c8c8de 100644
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -465,8 +465,8 @@
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
+-			ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000   /* downstream I/O */
+-				  0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */
++			ranges = <0x81000000 0x0 0x00000000 0x0fe00000 0x0 0x00010000   /* I/O */
++				  0x82000000 0x0 0x08000000 0x08000000 0x0 0x07e00000>; /* MEM */
+ 
+ 			interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "msi";
+@@ -516,8 +516,8 @@
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
+-			ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000   /* downstream I/O */
+-				  0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */
++			ranges = <0x81000000 0x0 0x00000000 0x31e00000 0x0 0x00010000   /* I/O */
++				  0x82000000 0x0 0x2e000000 0x2e000000 0x0 0x03e00000>; /* MEM */
+ 
+ 			interrupts = <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "msi";
+@@ -567,8 +567,8 @@
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
+-			ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000   /* downstream I/O */
+-				  0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */
++			ranges = <0x81000000 0x0 0x00000000 0x35e00000 0x0 0x00010000   /* I/O */
++				  0x82000000 0x0 0x32000000 0x32000000 0x0 0x03e00000>; /* MEM */
+ 
+ 			interrupts = <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "msi";
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch b/queue-5.10/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch
new file mode 100644
index 00000000000..1c8195c2da0
--- /dev/null
+++ b/queue-5.10/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch
@@ -0,0 +1,62 @@
+From 00dfe62eaeac91aea6b737d8971e2b10c1f502de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jul 2022 03:09:40 +0200
+Subject: ARM: dts: qcom: ipq8064: reduce pci IO size to 64K
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+[ Upstream commit 8fafb7e5c041814876266259e5e439f93571dcef ]
+
+The current value for pci IO is problematic for ath10k wifi card
+commonly connected to ipq8064 SoC.
+The current value is probably a typo and is actually uncommon to find
+1MB IO space even on a x86 arch. Also with recent changes to the pci
+driver, pci1 and pci2 now fails to function as any connected device
+fails any reg read/write. Reduce this to 64K as it should be more than
+enough and 3 * 64K of total IO space doesn't exceed the IO_SPACE_LIMIT
+hardcoded for the ARM arch.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707010943.20857-7-ansuelsmth@gmail.com
+Stable-dep-of: 0b16b34e4916 ("ARM: dts: qcom: ipq8064: Fix the PCI I/O port range")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+index c51481405e7f8..f7ed87a35e34d 100644
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -465,7 +465,7 @@
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
+-			ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00100000   /* downstream I/O */
++			ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000   /* downstream I/O */
+ 				  0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */
+ 
+ 			interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+@@ -516,7 +516,7 @@
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
+-			ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00100000   /* downstream I/O */
++			ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000   /* downstream I/O */
+ 				  0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */
+ 
+ 			interrupts = <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>;
+@@ -567,7 +567,7 @@
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
+-			ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00100000   /* downstream I/O */
++			ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000   /* downstream I/O */
+ 				  0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */
+ 
+ 			interrupts = <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch b/queue-5.10/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch
new file mode 100644
index 00000000000..1869c165c24
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch
@@ -0,0 +1,61 @@
+From 73a443026d768368507ea688994ed5ba37adfdb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:41 +0530
+Subject: arm64: dts: qcom: ipq8074: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit e49eafefe5ab325e38dd074f2005076ffc271e54 ]
+
+For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses
+(0x10200000, 0x20200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses and align
+them in a single line.
+
+Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-6-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index e191a7bc532be..f85fcc7c8676b 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -609,10 +609,8 @@
+ 			phys = <&pcie_phy1>;
+ 			phy-names = "pciephy";
+ 
+-			ranges = <0x81000000 0 0x10200000 0x10200000
+-				  0 0x10000>,   /* downstream I/O */
+-				 <0x82000000 0 0x10220000 0x10220000
+-				  0 0xfde0000>; /* non-prefetchable memory */
++			ranges = <0x81000000 0x0 0x00000000 0x10200000 0x0 0x10000>,   /* I/O */
++				 <0x82000000 0x0 0x10220000 0x10220000 0x0 0xfde0000>; /* MEM */
+ 
+ 			interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "msi";
+@@ -673,10 +671,8 @@
+ 			phys = <&pcie_phy0>;
+ 			phy-names = "pciephy";
+ 
+-			ranges = <0x81000000 0 0x20200000 0x20200000
+-				  0 0x10000>, /* downstream I/O */
+-				 <0x82000000 0 0x20220000 0x20220000
+-				  0 0xfde0000>; /* non-prefetchable memory */
++			ranges = <0x81000000 0x0 0x00000000 0x20200000 0x0 0x10000>,   /* I/O */
++				 <0x82000000 0x0 0x20220000 0x20220000 0x0 0xfde0000>; /* MEM */
+ 
+ 			interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "msi";
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch b/queue-5.10/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch
new file mode 100644
index 00000000000..10a79c39543
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch
@@ -0,0 +1,68 @@
+From 982df0f672e4680c6aabcfc0fb39587bd0458bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:43 +0530
+Subject: arm64: dts: qcom: msm8996: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit cf0ac10feb17661987d0018eb9475dc03e2a2253 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x0c200000, 0x0d200000, 0x0e200000) specified in the ranges property for
+I/O region.
+
+While at it, let's also align the entries.
+
+Fixes: ed965ef89227 ("arm64: dts: qcom: msm8996: add support to pcie")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-8-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index bc140269e4cc5..02b5f6f1d331e 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -744,8 +744,8 @@
+ 
+ 				#address-cells = <3>;
+ 				#size-cells = <2>;
+-				ranges = <0x01000000 0x0 0x0c200000 0x0c200000 0x0 0x100000>,
+-					<0x02000000 0x0 0x0c300000 0x0c300000 0x0 0xd00000>;
++				ranges = <0x01000000 0x0 0x00000000 0x0c200000 0x0 0x100000>,
++					 <0x02000000 0x0 0x0c300000 0x0c300000 0x0 0xd00000>;
+ 
+ 				interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>;
+ 				interrupt-names = "msi";
+@@ -796,8 +796,8 @@
+ 
+ 				#address-cells = <3>;
+ 				#size-cells = <2>;
+-				ranges = <0x01000000 0x0 0x0d200000 0x0d200000 0x0 0x100000>,
+-					<0x02000000 0x0 0x0d300000 0x0d300000 0x0 0xd00000>;
++				ranges = <0x01000000 0x0 0x00000000 0x0d200000 0x0 0x100000>,
++					 <0x02000000 0x0 0x0d300000 0x0d300000 0x0 0xd00000>;
+ 
+ 				interrupts = <GIC_SPI 413 IRQ_TYPE_LEVEL_HIGH>;
+ 				interrupt-names = "msi";
+@@ -845,8 +845,8 @@
+ 
+ 				#address-cells = <3>;
+ 				#size-cells = <2>;
+-				ranges = <0x01000000 0x0 0x0e200000 0x0e200000 0x0 0x100000>,
+-					<0x02000000 0x0 0x0e300000 0x0e300000 0x0 0x1d00000>;
++				ranges = <0x01000000 0x0 0x00000000 0x0e200000 0x0 0x100000>,
++					 <0x02000000 0x0 0x0e300000 0x0e300000 0x0 0x1d00000>;
+ 
+ 				device_type = "pci";
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch b/queue-5.10/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch
new file mode 100644
index 00000000000..fe5b7e93f12
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch
@@ -0,0 +1,37 @@
+From ef5ab9fc498fb523f54b53e1ed2035814a1e8a93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 22:03:31 +0100
+Subject: arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit b5d08f08377218b1d2ab4026e427a7788b271c8e ]
+
+The name stm-data-base comes from ancient (msm-3.10 or older)
+downstream kernels. Upstream uses stm-stimulus-base instead. Fix it.
+
+Fixes: 783abfa2249a ("arm64: dts: qcom: msm8998: Add Coresight support")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230213210331.2106877-1-konrad.dybcio@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index 9e04ac3f596d0..0ea4c9e7e1800 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -1187,7 +1187,7 @@
+ 			compatible = "arm,coresight-stm", "arm,primecell";
+ 			reg = <0x06002000 0x1000>,
+ 			      <0x16280000 0x180000>;
+-			reg-names = "stm-base", "stm-data-base";
++			reg-names = "stm-base", "stm-stimulus-base";
+ 			status = "disabled";
+ 
+ 			clocks = <&rpmcc RPM_SMD_QDSS_CLK>, <&rpmcc RPM_SMD_QDSS_A_CLK>;
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch b/queue-5.10/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch
new file mode 100644
index 00000000000..806a4d1330a
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch
@@ -0,0 +1,41 @@
+From 53e644872381f0f125c5619e6347934266c44bfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:38 +0530
+Subject: arm64: dts: qcom: msm8998: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit c30a27dcfe4545edbda1578b3a63ed6147519cdd ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address
+(0x1b200000) specified in the ranges property for I/O region.
+
+Fixes: b84dfd175c09 ("arm64: dts: qcom: msm8998: Add PCIe PHY and RC nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-3-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index 0ea4c9e7e1800..7c8d69ca91cf4 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -942,7 +942,7 @@
+ 			phys = <&pciephy>;
+ 			phy-names = "pciephy";
+ 
+-			ranges = <0x01000000 0x0 0x1b200000 0x1b200000 0x0 0x100000>,
++			ranges = <0x01000000 0x0 0x00000000 0x1b200000 0x0 0x100000>,
+ 				 <0x02000000 0x0 0x1b300000 0x1b300000 0x0 0xd00000>;
+ 
+ 			#interrupt-cells = <1>;
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch b/queue-5.10/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch
new file mode 100644
index 00000000000..1ea612dfa6d
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch
@@ -0,0 +1,130 @@
+From 0d5d738f0fadf50ffbf38956b718f11b75d9906c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Mar 2022 17:11:04 +0300
+Subject: arm64: dts: qcom: sdm845: correct dynamic power coefficients
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 0e0a8e35d72533b3eef3365e900baacd7cede8e2 ]
+
+Following sm8150/sm8250 update sdm845 capacity-dmips-mhz and
+dynamic-power-coefficient based on the measurements [1], [2].
+
+The energy model dynamic-power-coefficient values were calculated with
+    DPC = µW / MHz / V^2
+for each OPP, and averaged across all OPPs within each cluster for the
+final coefficient. Voltages were obtained from the qcom-cpufreq-hw
+driver that reads voltages from the OSM LUT programmed into the SoC.
+
+Normalized DMIPS/MHz capacity scale values for each CPU were calculated
+from CoreMarks/MHz (CoreMark iterations per second per MHz), which
+serves the same purpose. For each CPU, the final capacity-dmips-mhz
+value is the C/MHz value of its maximum frequency normalized to
+SCHED_CAPACITY_SCALE (1024) for the fastest CPU in the system.
+
+For more details on measurement process see the commit message for the
+commit 6aabed5526ee ("arm64: dts: qcom: sm8250: Add CPU capacities and
+energy model").
+
+[1] https://github.com/kdrag0n/freqbench
+[2] https://github.com/kdrag0n/freqbench/tree/master/results/sdm845/main
+
+Cc: Danny Lin <danny@kdrag0n.dev>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220315141104.730235-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 9beb3c34fcdb5..076b6949a0eed 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -196,8 +196,8 @@
+ 			cpu-idle-states = <&LITTLE_CPU_SLEEP_0
+ 					   &LITTLE_CPU_SLEEP_1
+ 					   &CLUSTER_SLEEP_0>;
+-			capacity-dmips-mhz = <607>;
+-			dynamic-power-coefficient = <100>;
++			capacity-dmips-mhz = <611>;
++			dynamic-power-coefficient = <290>;
+ 			qcom,freq-domain = <&cpufreq_hw 0>;
+ 			operating-points-v2 = <&cpu0_opp_table>;
+ 			interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -221,8 +221,8 @@
+ 			cpu-idle-states = <&LITTLE_CPU_SLEEP_0
+ 					   &LITTLE_CPU_SLEEP_1
+ 					   &CLUSTER_SLEEP_0>;
+-			capacity-dmips-mhz = <607>;
+-			dynamic-power-coefficient = <100>;
++			capacity-dmips-mhz = <611>;
++			dynamic-power-coefficient = <290>;
+ 			qcom,freq-domain = <&cpufreq_hw 0>;
+ 			operating-points-v2 = <&cpu0_opp_table>;
+ 			interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -243,8 +243,8 @@
+ 			cpu-idle-states = <&LITTLE_CPU_SLEEP_0
+ 					   &LITTLE_CPU_SLEEP_1
+ 					   &CLUSTER_SLEEP_0>;
+-			capacity-dmips-mhz = <607>;
+-			dynamic-power-coefficient = <100>;
++			capacity-dmips-mhz = <611>;
++			dynamic-power-coefficient = <290>;
+ 			qcom,freq-domain = <&cpufreq_hw 0>;
+ 			operating-points-v2 = <&cpu0_opp_table>;
+ 			interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -265,8 +265,8 @@
+ 			cpu-idle-states = <&LITTLE_CPU_SLEEP_0
+ 					   &LITTLE_CPU_SLEEP_1
+ 					   &CLUSTER_SLEEP_0>;
+-			capacity-dmips-mhz = <607>;
+-			dynamic-power-coefficient = <100>;
++			capacity-dmips-mhz = <611>;
++			dynamic-power-coefficient = <290>;
+ 			qcom,freq-domain = <&cpufreq_hw 0>;
+ 			operating-points-v2 = <&cpu0_opp_table>;
+ 			interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -288,7 +288,7 @@
+ 			cpu-idle-states = <&BIG_CPU_SLEEP_0
+ 					   &BIG_CPU_SLEEP_1
+ 					   &CLUSTER_SLEEP_0>;
+-			dynamic-power-coefficient = <396>;
++			dynamic-power-coefficient = <442>;
+ 			qcom,freq-domain = <&cpufreq_hw 1>;
+ 			operating-points-v2 = <&cpu4_opp_table>;
+ 			interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -310,7 +310,7 @@
+ 			cpu-idle-states = <&BIG_CPU_SLEEP_0
+ 					   &BIG_CPU_SLEEP_1
+ 					   &CLUSTER_SLEEP_0>;
+-			dynamic-power-coefficient = <396>;
++			dynamic-power-coefficient = <442>;
+ 			qcom,freq-domain = <&cpufreq_hw 1>;
+ 			operating-points-v2 = <&cpu4_opp_table>;
+ 			interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -332,7 +332,7 @@
+ 			cpu-idle-states = <&BIG_CPU_SLEEP_0
+ 					   &BIG_CPU_SLEEP_1
+ 					   &CLUSTER_SLEEP_0>;
+-			dynamic-power-coefficient = <396>;
++			dynamic-power-coefficient = <442>;
+ 			qcom,freq-domain = <&cpufreq_hw 1>;
+ 			operating-points-v2 = <&cpu4_opp_table>;
+ 			interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+@@ -354,7 +354,7 @@
+ 			cpu-idle-states = <&BIG_CPU_SLEEP_0
+ 					   &BIG_CPU_SLEEP_1
+ 					   &CLUSTER_SLEEP_0>;
+-			dynamic-power-coefficient = <396>;
++			dynamic-power-coefficient = <442>;
+ 			qcom,freq-domain = <&cpufreq_hw 1>;
+ 			operating-points-v2 = <&cpu4_opp_table>;
+ 			interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>,
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch b/queue-5.10/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch
new file mode 100644
index 00000000000..4f0f0ea0eac
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch
@@ -0,0 +1,55 @@
+From 73c7c35cec6631a5817abc0ad874d7cfbfbb3c3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:37 +0530
+Subject: arm64: dts: qcom: sdm845: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 67aa109eee654c76dcc100554e637fa64d5aa099 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses
+(0x60200000, 0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 42ad231338c1 ("arm64: dts: qcom: sdm845: Add second PCIe PHY and controller")
+Fixes: 5c538e09cb19 ("arm64: dts: qcom: sdm845: Add first PCIe controller and PHY")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-2-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 076b6949a0eed..28fbd728304d3 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -1816,8 +1816,8 @@
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
+-			ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>,
+-				 <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0xd00000>;
++			ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
++				 <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0xd00000>;
+ 
+ 			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "msi";
+@@ -1920,7 +1920,7 @@
+ 			#address-cells = <3>;
+ 			#size-cells = <2>;
+ 
+-			ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>,
++			ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
+ 				 <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
+ 
+ 			interrupts = <GIC_SPI 307 IRQ_TYPE_EDGE_RISING>;
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch b/queue-5.10/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch
new file mode 100644
index 00000000000..450d7eb50c4
--- /dev/null
+++ b/queue-5.10/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch
@@ -0,0 +1,53 @@
+From ca6ba73466e8457a4b5b153bbd86bb9c25518225 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 16:30:32 +0100
+Subject: arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 554edc3e9239bb81e61be9f0f5dbbeb528a69e72 ]
+
+According to the RZ/G Series, 2nd Generation Hardware User’s Manual
+Rev. 1.11, the System CPU cores on RZ/G2E do not have their own power
+supply, but use the common internal power supply (typical 1.03V).
+
+Hence remove the "opp-microvolt" properties from the Operating
+Performance Points table.  They are optional, and unused, when none of
+the CPU nodes is tied to a regulator using the "cpu-supply" property.
+
+Fixes: 231d8908a66fa98f ("arm64: dts: renesas: r8a774c0: Add OPPs table for cpu devices")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/8348e18a011ded94e35919cd8e17c0be1f9acf2f.1676560856.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
+index 4c7d7e8f8e289..c4a6dfae93aad 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
+@@ -49,17 +49,14 @@
+ 		opp-shared;
+ 		opp-800000000 {
+ 			opp-hz = /bits/ 64 <800000000>;
+-			opp-microvolt = <820000>;
+ 			clock-latency-ns = <300000>;
+ 		};
+ 		opp-1000000000 {
+ 			opp-hz = /bits/ 64 <1000000000>;
+-			opp-microvolt = <820000>;
+ 			clock-latency-ns = <300000>;
+ 		};
+ 		opp-1200000000 {
+ 			opp-hz = /bits/ 64 <1200000000>;
+-			opp-microvolt = <820000>;
+ 			clock-latency-ns = <300000>;
+ 			opp-suspend;
+ 		};
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch b/queue-5.10/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch
new file mode 100644
index 00000000000..0eda729c14b
--- /dev/null
+++ b/queue-5.10/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch
@@ -0,0 +1,53 @@
+From eb66d383776a1245e871f8700c3550d3ca769681 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 16:30:31 +0100
+Subject: arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit fb76b0fae3ca880363214e1dcd6513ab8bd529e7 ]
+
+According to the R-Car Series, 3rd Generation Hardware User’s Manual
+Rev. 2.30, the System CPU cores on R-Car E3 do not have their own power
+supply, but use the common internal power supply (typical 1.03V).
+
+Hence remove the "opp-microvolt" properties from the Operating
+Performance Points table.  They are optional, and unused, when none of
+the CPU nodes is tied to a regulator using the "cpu-supply" property.
+
+Fixes: dd7188eb4ed128dc ("arm64: dts: renesas: r8a77990: Add OPPs table for cpu devices")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/9232578d9d395d529f64db3333a371e31327f459.1676560856.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77990.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
+index 37159b9408e8a..e91d197a4c0b4 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
+@@ -60,17 +60,14 @@
+ 		opp-shared;
+ 		opp-800000000 {
+ 			opp-hz = /bits/ 64 <800000000>;
+-			opp-microvolt = <820000>;
+ 			clock-latency-ns = <300000>;
+ 		};
+ 		opp-1000000000 {
+ 			opp-hz = /bits/ 64 <1000000000>;
+-			opp-microvolt = <820000>;
+ 			clock-latency-ns = <300000>;
+ 		};
+ 		opp-1200000000 {
+ 			opp-hz = /bits/ 64 <1200000000>;
+-			opp-microvolt = <820000>;
+ 			clock-latency-ns = <300000>;
+ 			opp-suspend;
+ 		};
+-- 
+2.39.2
+
diff --git a/queue-5.10/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch b/queue-5.10/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch
new file mode 100644
index 00000000000..71e326c6f55
--- /dev/null
+++ b/queue-5.10/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch
@@ -0,0 +1,128 @@
+From 6d2e6eafe08e3dfe95c9e44e4118a1773a9dcc91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 13:01:48 +0530
+Subject: arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step
+
+From: Sumit Garg <sumit.garg@linaro.org>
+
+[ Upstream commit af6c0bd59f4f3ad5daad2f7b777954b1954551d5 ]
+
+Currently only the first attempt to single-step has any effect. After
+that all further stepping remains "stuck" at the same program counter
+value.
+
+Refer to the ARM Architecture Reference Manual (ARM DDI 0487E.a) D2.12,
+PSTATE.SS=1 should be set at each step before transferring the PE to the
+'Active-not-pending' state. The problem here is PSTATE.SS=1 is not set
+since the second single-step.
+
+After the first single-step, the PE transferes to the 'Inactive' state,
+with PSTATE.SS=0 and MDSCR.SS=1, thus PSTATE.SS won't be set to 1 due to
+kernel_active_single_step()=true. Then the PE transferes to the
+'Active-pending' state when ERET and returns to the debugger by step
+exception.
+
+Before this patch:
+==================
+Entering kdb (current=0xffff3376039f0000, pid 1) on processor 0 due to Keyboard Entry
+[0]kdb>
+
+[0]kdb>
+[0]kdb> bp write_sysrq_trigger
+Instruction(i) BP #0 at 0xffffa45c13d09290 (write_sysrq_trigger)
+    is enabled   addr at ffffa45c13d09290, hardtype=0 installed=0
+
+[0]kdb> go
+$ echo h > /proc/sysrq-trigger
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to Breakpoint @ 0xffffad651a309290
+[1]kdb> ss
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294
+[1]kdb> ss
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294
+[1]kdb>
+
+After this patch:
+=================
+Entering kdb (current=0xffff6851c39f0000, pid 1) on processor 0 due to Keyboard Entry
+[0]kdb> bp write_sysrq_trigger
+Instruction(i) BP #0 at 0xffffc02d2dd09290 (write_sysrq_trigger)
+    is enabled   addr at ffffc02d2dd09290, hardtype=0 installed=0
+
+[0]kdb> go
+$ echo h > /proc/sysrq-trigger
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to Breakpoint @ 0xffffc02d2dd09290
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09294
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09298
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd0929c
+[1]kdb>
+
+Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support")
+Co-developed-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Tested-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20230202073148.657746-3-sumit.garg@linaro.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/debug-monitors.h | 1 +
+ arch/arm64/kernel/debug-monitors.c      | 5 +++++
+ arch/arm64/kernel/kgdb.c                | 2 ++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h
+index 657c921fd784a..c16ed5b68768e 100644
+--- a/arch/arm64/include/asm/debug-monitors.h
++++ b/arch/arm64/include/asm/debug-monitors.h
+@@ -116,6 +116,7 @@ void user_regs_reset_single_step(struct user_pt_regs *regs,
+ void kernel_enable_single_step(struct pt_regs *regs);
+ void kernel_disable_single_step(void);
+ int kernel_active_single_step(void);
++void kernel_rewind_single_step(struct pt_regs *regs);
+ 
+ #ifdef CONFIG_HAVE_HW_BREAKPOINT
+ int reinstall_suspended_bps(struct pt_regs *regs);
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index fa76151de6ff1..38a0213fdbeee 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -439,6 +439,11 @@ int kernel_active_single_step(void)
+ }
+ NOKPROBE_SYMBOL(kernel_active_single_step);
+ 
++void kernel_rewind_single_step(struct pt_regs *regs)
++{
++	set_regs_spsr_ss(regs);
++}
++
+ /* ptrace API */
+ void user_enable_single_step(struct task_struct *task)
+ {
+diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
+index 1a157ca33262d..e4e95821b1f6c 100644
+--- a/arch/arm64/kernel/kgdb.c
++++ b/arch/arm64/kernel/kgdb.c
+@@ -223,6 +223,8 @@ int kgdb_arch_handle_exception(int exception_vector, int signo,
+ 		 */
+ 		if (!kernel_active_single_step())
+ 			kernel_enable_single_step(linux_regs);
++		else
++			kernel_rewind_single_step(linux_regs);
+ 		err = 0;
+ 		break;
+ 	default:
+-- 
+2.39.2
+
diff --git a/queue-5.10/asoc-es8316-handle-optional-irq-assignment.patch b/queue-5.10/asoc-es8316-handle-optional-irq-assignment.patch
new file mode 100644
index 00000000000..f00997c60a2
--- /dev/null
+++ b/queue-5.10/asoc-es8316-handle-optional-irq-assignment.patch
@@ -0,0 +1,62 @@
+From e1bb52045c7770e95f3df03a536cc4a7b730d072 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 12:49:01 +0300
+Subject: ASoC: es8316: Handle optional IRQ assignment
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 39db65a0a17b54915b269d3685f253a4731f344c ]
+
+The driver is able to work fine without relying on a mandatory interrupt
+being assigned to the I2C device. This is only needed when making use of
+the jack-detect support.
+
+However, the following warning message is always emitted when there is
+no such interrupt available:
+
+  es8316 0-0011: Failed to get IRQ 0: -22
+
+Do not attempt to request an IRQ if it is not available/valid. This also
+ensures the rather misleading message is not displayed anymore.
+
+Also note the IRQ validation relies on commit dab472eb931bc291 ("i2c /
+ACPI: Use 0 to indicate that device does not have interrupt assigned").
+
+Fixes: 822257661031 ("ASoC: es8316: Add jack-detect support")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230328094901.50763-1-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8316.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index aa23e4e671897..bc3d46617a113 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -807,12 +807,14 @@ static int es8316_i2c_probe(struct i2c_client *i2c_client,
+ 	es8316->irq = i2c_client->irq;
+ 	mutex_init(&es8316->lock);
+ 
+-	ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq,
+-					IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN,
+-					"es8316", es8316);
+-	if (ret) {
+-		dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret);
+-		es8316->irq = -ENXIO;
++	if (es8316->irq > 0) {
++		ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq,
++						IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN,
++						"es8316", es8316);
++		if (ret) {
++			dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret);
++			es8316->irq = -ENXIO;
++		}
+ 	}
+ 
+ 	return devm_snd_soc_register_component(&i2c_client->dev,
+-- 
+2.39.2
+
diff --git a/queue-5.10/asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch b/queue-5.10/asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch
new file mode 100644
index 00000000000..82d19b2ff9e
--- /dev/null
+++ b/queue-5.10/asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch
@@ -0,0 +1,46 @@
+From 8603edda0e9d42884327862d1c8ec2dee748943c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Oct 2021 15:22:54 +0200
+Subject: ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1cf2aa665901054b140eb71748661ceae99b6b5a ]
+
+Use the new IRQF_NO_AUTOEN flag when requesting the IRQ, rather then
+disabling it immediately after requesting it.
+
+This fixes a possible race where the IRQ might trigger between requesting
+and disabling it; and this also leads to a small code cleanup.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20211003132255.31743-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 39db65a0a17b ("ASoC: es8316: Handle optional IRQ assignment")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8316.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index 609459077f9d9..aa23e4e671897 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -808,12 +808,9 @@ static int es8316_i2c_probe(struct i2c_client *i2c_client,
+ 	mutex_init(&es8316->lock);
+ 
+ 	ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq,
+-					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
++					IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN,
+ 					"es8316", es8316);
+-	if (ret == 0) {
+-		/* Gets re-enabled by es8316_set_jack() */
+-		disable_irq(es8316->irq);
+-	} else {
++	if (ret) {
+ 		dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret);
+ 		es8316->irq = -ENXIO;
+ 	}
+-- 
+2.39.2
+
diff --git a/queue-5.10/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch b/queue-5.10/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch
new file mode 100644
index 00000000000..2f3de205ba1
--- /dev/null
+++ b/queue-5.10/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch
@@ -0,0 +1,72 @@
+From a13425d1b5db831eb182ff9a0844dc66fb9554fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 23:26:47 +0800
+Subject: ASoC: fsl_mqs: move of_node_put() to the correct location
+
+From: Liliang Ye <yll@hust.edu.cn>
+
+[ Upstream commit 1c34890273a020d61d6127ade3f68ed1cb21c16a ]
+
+of_node_put() should have been done directly after
+mqs_priv->regmap = syscon_node_to_regmap(gpr_np);
+otherwise it creates a reference leak on the success path.
+
+To fix this, of_node_put() is moved to the correct location, and change
+all the gotos to direct returns.
+
+Fixes: a9d273671440 ("ASoC: fsl_mqs: Fix error handling in probe")
+Signed-off-by: Liliang Ye <yll@hust.edu.cn>
+Reviewed-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/20230403152647.17638-1-yll@hust.edu.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_mqs.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_mqs.c b/sound/soc/fsl/fsl_mqs.c
+index 0d4efbed41dab..c33439650823b 100644
+--- a/sound/soc/fsl/fsl_mqs.c
++++ b/sound/soc/fsl/fsl_mqs.c
+@@ -204,10 +204,10 @@ static int fsl_mqs_probe(struct platform_device *pdev)
+ 		}
+ 
+ 		mqs_priv->regmap = syscon_node_to_regmap(gpr_np);
++		of_node_put(gpr_np);
+ 		if (IS_ERR(mqs_priv->regmap)) {
+ 			dev_err(&pdev->dev, "failed to get gpr regmap\n");
+-			ret = PTR_ERR(mqs_priv->regmap);
+-			goto err_free_gpr_np;
++			return PTR_ERR(mqs_priv->regmap);
+ 		}
+ 	} else {
+ 		regs = devm_platform_ioremap_resource(pdev, 0);
+@@ -236,8 +236,7 @@ static int fsl_mqs_probe(struct platform_device *pdev)
+ 	if (IS_ERR(mqs_priv->mclk)) {
+ 		dev_err(&pdev->dev, "failed to get the clock: %ld\n",
+ 			PTR_ERR(mqs_priv->mclk));
+-		ret = PTR_ERR(mqs_priv->mclk);
+-		goto err_free_gpr_np;
++		return PTR_ERR(mqs_priv->mclk);
+ 	}
+ 
+ 	dev_set_drvdata(&pdev->dev, mqs_priv);
+@@ -246,13 +245,9 @@ static int fsl_mqs_probe(struct platform_device *pdev)
+ 	ret = devm_snd_soc_register_component(&pdev->dev, &soc_codec_fsl_mqs,
+ 			&fsl_mqs_dai, 1);
+ 	if (ret)
+-		goto err_free_gpr_np;
+-	return 0;
+-
+-err_free_gpr_np:
+-	of_node_put(gpr_np);
++		return ret;
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ static int fsl_mqs_remove(struct platform_device *pdev)
+-- 
+2.39.2
+
diff --git a/queue-5.10/bpf-don-t-efault-for-getsockopt-with-optval-null.patch b/queue-5.10/bpf-don-t-efault-for-getsockopt-with-optval-null.patch
new file mode 100644
index 00000000000..a5843cedd43
--- /dev/null
+++ b/queue-5.10/bpf-don-t-efault-for-getsockopt-with-optval-null.patch
@@ -0,0 +1,55 @@
+From 490e59dbdbff6fab1cdb1cba172ed6e7c022ec00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 15:53:38 -0700
+Subject: bpf: Don't EFAULT for getsockopt with optval=NULL
+
+From: Stanislav Fomichev <sdf@google.com>
+
+[ Upstream commit 00e74ae0863827d944e36e56a4ce1e77e50edb91 ]
+
+Some socket options do getsockopt with optval=NULL to estimate the size
+of the final buffer (which is returned via optlen). This breaks BPF
+getsockopt assumptions about permitted optval buffer size. Let's enforce
+these assumptions only when non-NULL optval is provided.
+
+Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
+Reported-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/ZD7Js4fj5YyI2oLd@google.com/T/#mb68daf700f87a9244a15d01d00c3f0e5b08f49f7
+Link: https://lore.kernel.org/bpf/20230418225343.553806-2-sdf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cgroup.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
+index 6d92e393e1bc6..d3593a520bb72 100644
+--- a/kernel/bpf/cgroup.c
++++ b/kernel/bpf/cgroup.c
+@@ -1516,7 +1516,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
+ 		goto out;
+ 	}
+ 
+-	if (ctx.optlen > max_optlen || ctx.optlen < 0) {
++	if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) {
+ 		ret = -EFAULT;
+ 		goto out;
+ 	}
+@@ -1530,8 +1530,11 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
+ 	}
+ 
+ 	if (ctx.optlen != 0) {
+-		if (copy_to_user(optval, ctx.optval, ctx.optlen) ||
+-		    put_user(ctx.optlen, optlen)) {
++		if (optval && copy_to_user(optval, ctx.optval, ctx.optlen)) {
++			ret = -EFAULT;
++			goto out;
++		}
++		if (put_user(ctx.optlen, optlen)) {
+ 			ret = -EFAULT;
+ 			goto out;
+ 		}
+-- 
+2.39.2
+
diff --git a/queue-5.10/bpf-fix-precision-propagation-verbose-logging.patch b/queue-5.10/bpf-fix-precision-propagation-verbose-logging.patch
new file mode 100644
index 00000000000..5e767b6c8f0
--- /dev/null
+++ b/queue-5.10/bpf-fix-precision-propagation-verbose-logging.patch
@@ -0,0 +1,46 @@
+From 3a734e4636b6e9931772f1d4c6cd5ee606567a3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 11:40:17 -0700
+Subject: bpf: fix precision propagation verbose logging
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 34f0677e7afd3a292bc1aadda7ce8e35faedb204 ]
+
+Fix wrong order of frame index vs register/slot index in precision
+propagation verbose (level 2) output. It's wrong and very confusing as is.
+
+Fixes: 529409ea92d5 ("bpf: propagate precision across all frames, not just the last one")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20230313184017.4083374-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index e2488a00efc5a..232f720104cdf 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -9554,7 +9554,7 @@ static int propagate_precision(struct bpf_verifier_env *env,
+ 			    !(state_reg->live & REG_LIVE_READ))
+ 				continue;
+ 			if (env->log.level & BPF_LOG_LEVEL2)
+-				verbose(env, "frame %d: propagating r%d\n", i, fr);
++				verbose(env, "frame %d: propagating r%d\n", fr, i);
+ 			err = mark_chain_precision_frame(env, fr, i);
+ 			if (err < 0)
+ 				return err;
+@@ -9570,7 +9570,7 @@ static int propagate_precision(struct bpf_verifier_env *env,
+ 				continue;
+ 			if (env->log.level & BPF_LOG_LEVEL2)
+ 				verbose(env, "frame %d: propagating fp%d\n",
+-					(-i - 1) * BPF_REG_SIZE, fr);
++					fr, (-i - 1) * BPF_REG_SIZE);
+ 			err = mark_chain_precision_stack_frame(env, fr, i);
+ 			if (err < 0)
+ 				return err;
+-- 
+2.39.2
+
diff --git a/queue-5.10/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch b/queue-5.10/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch
new file mode 100644
index 00000000000..5deff218455
--- /dev/null
+++ b/queue-5.10/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch
@@ -0,0 +1,93 @@
+From 138524c236d9c1d26566161838630a1c29db15f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 17:54:00 +0100
+Subject: bpf: Remove misleading spec_v1 check on var-offset stack read
+
+From: Luis Gerhorst <gerhorst@cs.fau.de>
+
+[ Upstream commit 082cdc69a4651dd2a77539d69416a359ed1214f5 ]
+
+For every BPF_ADD/SUB involving a pointer, adjust_ptr_min_max_vals()
+ensures that the resulting pointer has a constant offset if
+bypass_spec_v1 is false. This is ensured by calling sanitize_check_bounds()
+which in turn calls check_stack_access_for_ptr_arithmetic(). There,
+-EACCESS is returned if the register's offset is not constant, thereby
+rejecting the program.
+
+In summary, an unprivileged user must never be able to create stack
+pointers with a variable offset. That is also the case, because a
+respective check in check_stack_write() is missing. If they were able
+to create a variable-offset pointer, users could still use it in a
+stack-write operation to trigger unsafe speculative behavior [1].
+
+Because unprivileged users must already be prevented from creating
+variable-offset stack pointers, viable options are to either remove
+this check (replacing it with a clarifying comment), or to turn it
+into a "verifier BUG"-message, also adding a similar check in
+check_stack_write() (for consistency, as a second-level defense).
+This patch implements the first option to reduce verifier bloat.
+
+This check was introduced by commit 01f810ace9ed ("bpf: Allow
+variable-offset stack access") which correctly notes that
+"variable-offset reads and writes are disallowed (they were already
+disallowed for the indirect access case) because the speculative
+execution checking code doesn't support them". However, it does not
+further discuss why the check in check_stack_read() is necessary.
+The code which made this check obsolete was also introduced in this
+commit.
+
+I have compiled ~650 programs from the Linux selftests, Linux samples,
+Cilium, and libbpf/examples projects and confirmed that none of these
+trigger the check in check_stack_read() [2]. Instead, all of these
+programs are, as expected, already rejected when constructing the
+variable-offset pointers. Note that the check in
+check_stack_access_for_ptr_arithmetic() also prints "off=%d" while the
+code removed by this patch does not (the error removed does not appear
+in the "verification_error" values). For reproducibility, the
+repository linked includes the raw data and scripts used to create
+the plot.
+
+  [1] https://arxiv.org/pdf/1807.03757.pdf
+  [2] https://gitlab.cs.fau.de/un65esoq/bpf-spectre/-/raw/53dc19fcf459c186613b1156a81504b39c8d49db/data/plots/23-02-26_23-56_bpftool/bpftool/0004-errors.pdf?inline=false
+
+Fixes: 01f810ace9ed ("bpf: Allow variable-offset stack access")
+Signed-off-by: Luis Gerhorst <gerhorst@cs.fau.de>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230315165358.23701-1-gerhorst@cs.fau.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 232f720104cdf..6876796a8de0c 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -2775,17 +2775,13 @@ static int check_stack_read(struct bpf_verifier_env *env,
+ 	}
+ 	/* Variable offset is prohibited for unprivileged mode for simplicity
+ 	 * since it requires corresponding support in Spectre masking for stack
+-	 * ALU. See also retrieve_ptr_limit().
++	 * ALU. See also retrieve_ptr_limit(). The check in
++	 * check_stack_access_for_ptr_arithmetic() called by
++	 * adjust_ptr_min_max_vals() prevents users from creating stack pointers
++	 * with variable offsets, therefore no check is required here. Further,
++	 * just checking it here would be insufficient as speculative stack
++	 * writes could still lead to unsafe speculative behaviour.
+ 	 */
+-	if (!env->bypass_spec_v1 && var_off) {
+-		char tn_buf[48];
+-
+-		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
+-		verbose(env, "R%d variable offset stack access prohibited for !root, var_off=%s\n",
+-				ptr_regno, tn_buf);
+-		return -EACCES;
+-	}
+-
+ 	if (!var_off) {
+ 		off += reg->var_off.value;
+ 		err = check_stack_read_fixed_off(env, state, off, size,
+-- 
+2.39.2
+
diff --git a/queue-5.10/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch b/queue-5.10/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch
new file mode 100644
index 00000000000..725f73d1b2c
--- /dev/null
+++ b/queue-5.10/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch
@@ -0,0 +1,83 @@
+From 207fd84ff72962680c74ac5286e485c10f9a12c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 20:26:22 +0800
+Subject: bpf, sockmap: fix deadlocks in the sockhash and sockmap
+
+From: Xin Liu <liuxin350@huawei.com>
+
+[ Upstream commit ed17aa92dc56b6d8883e4b7a8f1c6fbf5ed6cd29 ]
+
+When huang uses sched_switch tracepoint, the tracepoint
+does only one thing in the mounted ebpf program, which
+deletes the fixed elements in sockhash ([0])
+
+It seems that elements in sockhash are rarely actively
+deleted by users or ebpf program. Therefore, we do not
+pay much attention to their deletion. Compared with hash
+maps, sockhash only provides spin_lock_bh protection.
+This causes it to appear to have self-locking behavior
+in the interrupt context.
+
+  [0]:https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/
+
+Reported-by: Hsin-Wei Hung <hsinweih@uci.edu>
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Xin Liu <liuxin350@huawei.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20230406122622.109978-1-liuxin350@huawei.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index ee5d3f49b0b5b..e21adbbb7461c 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -423,8 +423,9 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ {
+ 	struct sock *sk;
+ 	int err = 0;
++	unsigned long flags;
+ 
+-	raw_spin_lock_bh(&stab->lock);
++	raw_spin_lock_irqsave(&stab->lock, flags);
+ 	sk = *psk;
+ 	if (!sk_test || sk_test == sk)
+ 		sk = xchg(psk, NULL);
+@@ -434,7 +435,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ 	else
+ 		err = -EINVAL;
+ 
+-	raw_spin_unlock_bh(&stab->lock);
++	raw_spin_unlock_irqrestore(&stab->lock, flags);
+ 	return err;
+ }
+ 
+@@ -956,11 +957,12 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key)
+ 	struct bpf_shtab_bucket *bucket;
+ 	struct bpf_shtab_elem *elem;
+ 	int ret = -ENOENT;
++	unsigned long flags;
+ 
+ 	hash = sock_hash_bucket_hash(key, key_size);
+ 	bucket = sock_hash_select_bucket(htab, hash);
+ 
+-	raw_spin_lock_bh(&bucket->lock);
++	raw_spin_lock_irqsave(&bucket->lock, flags);
+ 	elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size);
+ 	if (elem) {
+ 		hlist_del_rcu(&elem->node);
+@@ -968,7 +970,7 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key)
+ 		sock_hash_free_elem(htab, elem);
+ 		ret = 0;
+ 	}
+-	raw_spin_unlock_bh(&bucket->lock);
++	raw_spin_unlock_irqrestore(&bucket->lock, flags);
+ 	return ret;
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch b/queue-5.10/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch
new file mode 100644
index 00000000000..6c76fc2cc8d
--- /dev/null
+++ b/queue-5.10/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch
@@ -0,0 +1,101 @@
+From 5d8db3afcfe3ecdbdcedb7e8a92579b52aeba652 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 20:28:42 +0200
+Subject: bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 8c5c2a4898e3d6bad86e29d471e023c8a19ba799 ]
+
+syzbot reported a splat and bisected it to recent commit ed17aa92dc56 ("bpf,
+sockmap: fix deadlocks in the sockhash and sockmap"):
+
+  [...]
+  WARNING: CPU: 1 PID: 9280 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
+  Modules linked in:
+  CPU: 1 PID: 9280 Comm: syz-executor.1 Not tainted 6.2.0-syzkaller-13249-gd319f344561d #0
+  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
+  RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
+  [...]
+  Call Trace:
+  <TASK>
+  spin_unlock_bh include/linux/spinlock.h:395 [inline]
+  sock_map_del_link+0x2ea/0x510 net/core/sock_map.c:165
+  sock_map_unref+0xb0/0x1d0 net/core/sock_map.c:184
+  sock_hash_delete_elem+0x1ec/0x2a0 net/core/sock_map.c:945
+  map_delete_elem kernel/bpf/syscall.c:1536 [inline]
+  __sys_bpf+0x2edc/0x53e0 kernel/bpf/syscall.c:5053
+  __do_sys_bpf kernel/bpf/syscall.c:5166 [inline]
+  __se_sys_bpf kernel/bpf/syscall.c:5164 [inline]
+  __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5164
+  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+  do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
+  entry_SYSCALL_64_after_hwframe+0x63/0xcd
+  RIP: 0033:0x7fe8f7c8c169
+  </TASK>
+  [...]
+
+Revert for now until we have a proper solution.
+
+Fixes: ed17aa92dc56 ("bpf, sockmap: fix deadlocks in the sockhash and sockmap")
+Reported-by: syzbot+49f6cef45247ff249498@syzkaller.appspotmail.com
+Cc: Hsin-Wei Hung <hsinweih@uci.edu>
+Cc: Xin Liu <liuxin350@huawei.com>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/000000000000f1db9605f939720e@google.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index e21adbbb7461c..ee5d3f49b0b5b 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -423,9 +423,8 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ {
+ 	struct sock *sk;
+ 	int err = 0;
+-	unsigned long flags;
+ 
+-	raw_spin_lock_irqsave(&stab->lock, flags);
++	raw_spin_lock_bh(&stab->lock);
+ 	sk = *psk;
+ 	if (!sk_test || sk_test == sk)
+ 		sk = xchg(psk, NULL);
+@@ -435,7 +434,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ 	else
+ 		err = -EINVAL;
+ 
+-	raw_spin_unlock_irqrestore(&stab->lock, flags);
++	raw_spin_unlock_bh(&stab->lock);
+ 	return err;
+ }
+ 
+@@ -957,12 +956,11 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key)
+ 	struct bpf_shtab_bucket *bucket;
+ 	struct bpf_shtab_elem *elem;
+ 	int ret = -ENOENT;
+-	unsigned long flags;
+ 
+ 	hash = sock_hash_bucket_hash(key, key_size);
+ 	bucket = sock_hash_select_bucket(htab, hash);
+ 
+-	raw_spin_lock_irqsave(&bucket->lock, flags);
++	raw_spin_lock_bh(&bucket->lock);
+ 	elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size);
+ 	if (elem) {
+ 		hlist_del_rcu(&elem->node);
+@@ -970,7 +968,7 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key)
+ 		sock_hash_free_elem(htab, elem);
+ 		ret = 0;
+ 	}
+-	raw_spin_unlock_irqrestore(&bucket->lock, flags);
++	raw_spin_unlock_bh(&bucket->lock);
+ 	return ret;
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/bpf-take-into-account-liveness-when-propagating-prec.patch b/queue-5.10/bpf-take-into-account-liveness-when-propagating-prec.patch
new file mode 100644
index 00000000000..36c81d19b7e
--- /dev/null
+++ b/queue-5.10/bpf-take-into-account-liveness-when-propagating-prec.patch
@@ -0,0 +1,61 @@
+From 11c74b4e4d66a405e6da9efb53e1b29c7a3e4b72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 14:41:31 -0800
+Subject: bpf: take into account liveness when propagating precision
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 52c2b005a3c18c565fc70cfd0ca49375f301e952 ]
+
+When doing state comparison, if old state has register that is not
+marked as REG_LIVE_READ, then we just skip comparison, regardless what's
+the state of corresponing register in current state. This is because not
+REG_LIVE_READ register is irrelevant for further program execution and
+correctness. All good here.
+
+But when we get to precision propagation, after two states were declared
+equivalent, we don't take into account old register's liveness, and thus
+attempt to propagate precision for register in current state even if
+that register in old state was not REG_LIVE_READ anymore. This is bad,
+because register in current state could be anything at all and this
+could cause -EFAULT due to internal logic bugs.
+
+Fix by taking into account REG_LIVE_READ liveness mark to keep the logic
+in state comparison in sync with precision propagation.
+
+Fixes: a3ce685dd01a ("bpf: fix precision tracking")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20230309224131.57449-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 5a96a9dd51e4c..e2488a00efc5a 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -9550,7 +9550,8 @@ static int propagate_precision(struct bpf_verifier_env *env,
+ 		state_reg = state->regs;
+ 		for (i = 0; i < BPF_REG_FP; i++, state_reg++) {
+ 			if (state_reg->type != SCALAR_VALUE ||
+-			    !state_reg->precise)
++			    !state_reg->precise ||
++			    !(state_reg->live & REG_LIVE_READ))
+ 				continue;
+ 			if (env->log.level & BPF_LOG_LEVEL2)
+ 				verbose(env, "frame %d: propagating r%d\n", i, fr);
+@@ -9564,7 +9565,8 @@ static int propagate_precision(struct bpf_verifier_env *env,
+ 				continue;
+ 			state_reg = &state->stack[i].spilled_ptr;
+ 			if (state_reg->type != SCALAR_VALUE ||
+-			    !state_reg->precise)
++			    !state_reg->precise ||
++			    !(state_reg->live & REG_LIVE_READ))
+ 				continue;
+ 			if (env->log.level & BPF_LOG_LEVEL2)
+ 				verbose(env, "frame %d: propagating fp%d\n",
+-- 
+2.39.2
+
diff --git a/queue-5.10/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch b/queue-5.10/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch
new file mode 100644
index 00000000000..a65f270cedb
--- /dev/null
+++ b/queue-5.10/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch
@@ -0,0 +1,46 @@
+From 575c523793a35855f488c3438422a312071ec512 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 14:21:15 +0100
+Subject: bpftool: Fix bug for long instructions in program CFG dumps
+
+From: Quentin Monnet <quentin@isovalent.com>
+
+[ Upstream commit 67cf52cdb6c8fa6365d29106555dacf95c9fd374 ]
+
+When dumping the control flow graphs for programs using the 16-byte long
+load instruction, we need to skip the second part of this instruction
+when looking for the next instruction to process. Otherwise, we end up
+printing "BUG_ld_00" from the kernel disassembler in the CFG.
+
+Fixes: efcef17a6d65 ("tools: bpftool: generate .dot graph from CFG information")
+Signed-off-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/r/20230405132120.59886-3-quentin@isovalent.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/xlated_dumper.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
+index 8608cd68cdd07..13d614b16f6c2 100644
+--- a/tools/bpf/bpftool/xlated_dumper.c
++++ b/tools/bpf/bpftool/xlated_dumper.c
+@@ -363,8 +363,15 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
+ 	struct bpf_insn *insn_start = buf_start;
+ 	struct bpf_insn *insn_end = buf_end;
+ 	struct bpf_insn *cur = insn_start;
++	bool double_insn = false;
+ 
+ 	for (; cur <= insn_end; cur++) {
++		if (double_insn) {
++			double_insn = false;
++			continue;
++		}
++		double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW);
++
+ 		printf("% 4d: ", (int)(cur - insn_start + start_idx));
+ 		print_bpf_insn(&cbs, cur, true);
+ 		if (cur != insn_end)
+-- 
+2.39.2
+
diff --git a/queue-5.10/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch b/queue-5.10/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch
new file mode 100644
index 00000000000..e07050a996c
--- /dev/null
+++ b/queue-5.10/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch
@@ -0,0 +1,74 @@
+From d9a38dac77d7d9456cd87c6978337756123952e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 09:32:27 +0100
+Subject: clk: add missing of_node_put() in "assigned-clocks" property parsing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <clement.leger@bootlin.com>
+
+[ Upstream commit 27a6e1b09a782517fddac91259970ac466a3f7b6 ]
+
+When returning from of_parse_phandle_with_args(), the np member of the
+of_phandle_args structure should be put after usage. Add missing
+of_node_put() calls in both __set_clk_parents() and __set_clk_rates().
+
+Fixes: 86be408bfbd8 ("clk: Support for clock parents and rates assigned from device tree")
+Signed-off-by: Clément Léger <clement.leger@bootlin.com>
+Link: https://lore.kernel.org/r/20230131083227.10990-1-clement.leger@bootlin.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-conf.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c
+index 2ef819606c417..1a4e6340f95ce 100644
+--- a/drivers/clk/clk-conf.c
++++ b/drivers/clk/clk-conf.c
+@@ -33,9 +33,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ 			else
+ 				return rc;
+ 		}
+-		if (clkspec.np == node && !clk_supplier)
++		if (clkspec.np == node && !clk_supplier) {
++			of_node_put(clkspec.np);
+ 			return 0;
++		}
+ 		pclk = of_clk_get_from_provider(&clkspec);
++		of_node_put(clkspec.np);
+ 		if (IS_ERR(pclk)) {
+ 			if (PTR_ERR(pclk) != -EPROBE_DEFER)
+ 				pr_warn("clk: couldn't get parent clock %d for %pOF\n",
+@@ -48,10 +51,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ 		if (rc < 0)
+ 			goto err;
+ 		if (clkspec.np == node && !clk_supplier) {
++			of_node_put(clkspec.np);
+ 			rc = 0;
+ 			goto err;
+ 		}
+ 		clk = of_clk_get_from_provider(&clkspec);
++		of_node_put(clkspec.np);
+ 		if (IS_ERR(clk)) {
+ 			if (PTR_ERR(clk) != -EPROBE_DEFER)
+ 				pr_warn("clk: couldn't get assigned clock %d for %pOF\n",
+@@ -93,10 +98,13 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier)
+ 				else
+ 					return rc;
+ 			}
+-			if (clkspec.np == node && !clk_supplier)
++			if (clkspec.np == node && !clk_supplier) {
++				of_node_put(clkspec.np);
+ 				return 0;
++			}
+ 
+ 			clk = of_clk_get_from_provider(&clkspec);
++			of_node_put(clkspec.np);
+ 			if (IS_ERR(clk)) {
+ 				if (PTR_ERR(clk) != -EPROBE_DEFER)
+ 					pr_warn("clk: couldn't get clock %d for %pOF\n",
+-- 
+2.39.2
+
diff --git a/queue-5.10/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch b/queue-5.10/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch
new file mode 100644
index 00000000000..5c3e06c1cb2
--- /dev/null
+++ b/queue-5.10/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch
@@ -0,0 +1,38 @@
+From 347820ad67b0182f8dd182d84a8ef9ecc966dc82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 12:59:31 +0200
+Subject: clk: at91: clk-sam9x60-pll: fix return value check
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 1bd8e27fd0db0fe7f489213836dcbab92934f8fa ]
+
+sam9x60_frac_pll_compute_mul_frac() can't return zero. Remove the check
+against zero to reflect this.
+
+Fixes: 43b1bb4a9b3e ("clk: at91: clk-sam9x60-pll: re-factor to support plls with multiple outputs")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230227105931.2812412-1-claudiu.beznea@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-sam9x60-pll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c
+index 5a9daa3643a72..5fe50ba173a80 100644
+--- a/drivers/clk/at91/clk-sam9x60-pll.c
++++ b/drivers/clk/at91/clk-sam9x60-pll.c
+@@ -452,7 +452,7 @@ sam9x60_clk_register_frac_pll(struct regmap *regmap, spinlock_t *lock,
+ 
+ 		ret = sam9x60_frac_pll_compute_mul_frac(&frac->core, FCORE_MIN,
+ 							parent_rate, true);
+-		if (ret <= 0) {
++		if (ret < 0) {
+ 			hw = ERR_PTR(ret);
+ 			goto free;
+ 		}
+-- 
+2.39.2
+
diff --git a/queue-5.10/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch b/queue-5.10/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch
new file mode 100644
index 00000000000..5a8eee6b1a3
--- /dev/null
+++ b/queue-5.10/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch
@@ -0,0 +1,101 @@
+From b1cf4fcc1bee02c539990727ee758434b59b79ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 13:50:37 +0000
+Subject: clocksource/drivers/davinci: Fix memory leak in
+ davinci_timer_register when init fails
+
+From: Qinrun Dai <flno@hust.edu.cn>
+
+[ Upstream commit fb73556386e074e9bee9fa2d253aeaefe4e063e0 ]
+
+Smatch reports:
+drivers/clocksource/timer-davinci.c:332 davinci_timer_register()
+warn: 'base' from ioremap() not released on lines: 274.
+
+Fix this and other potential memory leak problems
+by adding a set of corresponding exit lables.
+
+Fixes: 721154f972aa ("clocksource/drivers/davinci: Add support for clockevents")
+Signed-off-by: Qinrun Dai <flno@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230413135037.1505799-1-flno@hust.edu.cn
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-davinci.c | 30 +++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c
+index bb4eee31ae082..3dc0c6ceed027 100644
+--- a/drivers/clocksource/timer-davinci.c
++++ b/drivers/clocksource/timer-davinci.c
+@@ -258,21 +258,25 @@ int __init davinci_timer_register(struct clk *clk,
+ 				resource_size(&timer_cfg->reg),
+ 				"davinci-timer")) {
+ 		pr_err("Unable to request memory region\n");
+-		return -EBUSY;
++		rv = -EBUSY;
++		goto exit_clk_disable;
+ 	}
+ 
+ 	base = ioremap(timer_cfg->reg.start, resource_size(&timer_cfg->reg));
+ 	if (!base) {
+ 		pr_err("Unable to map the register range\n");
+-		return -ENOMEM;
++		rv = -ENOMEM;
++		goto exit_mem_region;
+ 	}
+ 
+ 	davinci_timer_init(base);
+ 	tick_rate = clk_get_rate(clk);
+ 
+ 	clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL);
+-	if (!clockevent)
+-		return -ENOMEM;
++	if (!clockevent) {
++		rv = -ENOMEM;
++		goto exit_iounmap_base;
++	}
+ 
+ 	clockevent->dev.name = "tim12";
+ 	clockevent->dev.features = CLOCK_EVT_FEAT_ONESHOT;
+@@ -297,7 +301,7 @@ int __init davinci_timer_register(struct clk *clk,
+ 			 "clockevent/tim12", clockevent);
+ 	if (rv) {
+ 		pr_err("Unable to request the clockevent interrupt\n");
+-		return rv;
++		goto exit_free_clockevent;
+ 	}
+ 
+ 	davinci_clocksource.dev.rating = 300;
+@@ -324,13 +328,27 @@ int __init davinci_timer_register(struct clk *clk,
+ 	rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate);
+ 	if (rv) {
+ 		pr_err("Unable to register clocksource\n");
+-		return rv;
++		goto exit_free_irq;
+ 	}
+ 
+ 	sched_clock_register(davinci_timer_read_sched_clock,
+ 			     DAVINCI_TIMER_CLKSRC_BITS, tick_rate);
+ 
+ 	return 0;
++
++exit_free_irq:
++	free_irq(timer_cfg->irq[DAVINCI_TIMER_CLOCKEVENT_IRQ].start,
++			clockevent);
++exit_free_clockevent:
++	kfree(clockevent);
++exit_iounmap_base:
++	iounmap(base);
++exit_mem_region:
++	release_mem_region(timer_cfg->reg.start,
++			   resource_size(&timer_cfg->reg));
++exit_clk_disable:
++	clk_disable_unprepare(clk);
++	return rv;
+ }
+ 
+ static int __init of_davinci_timer_register(struct device_node *np)
+-- 
+2.39.2
+
diff --git a/queue-5.10/coresight-etm_pmu-set-the-module-field.patch b/queue-5.10/coresight-etm_pmu-set-the-module-field.patch
new file mode 100644
index 00000000000..73c17b2bacc
--- /dev/null
+++ b/queue-5.10/coresight-etm_pmu-set-the-module-field.patch
@@ -0,0 +1,35 @@
+From 68592512b6a37f03ad33c917833ab1089a6ecda0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 10:49:22 +0100
+Subject: coresight: etm_pmu: Set the module field
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 18996a113f2567aef3057e300e3193ce2df1684c ]
+
+struct pmu::module must be set to the module owning the PMU driver.
+Set this for the coresight etm_pmu.
+
+Fixes: 8e264c52e1dab ("coresight: core: Allow the coresight core driver to be built as a module")
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20230405094922.667834-1-suzuki.poulose@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm-perf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index bdc34ca449f71..c5698c62b6103 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -619,6 +619,7 @@ int __init etm_perf_init(void)
+ 	etm_pmu.addr_filters_sync	= etm_addr_filters_sync;
+ 	etm_pmu.addr_filters_validate	= etm_addr_filters_validate;
+ 	etm_pmu.nr_addr_filters		= ETM_ADDR_CMP_MAX;
++	etm_pmu.module			= THIS_MODULE;
+ 
+ 	ret = perf_pmu_register(&etm_pmu, CORESIGHT_ETM_PMU_NAME, -1);
+ 	if (ret == 0)
+-- 
+2.39.2
+
diff --git a/queue-5.10/crypto-caam-clear-some-memory-in-instantiate_rng.patch b/queue-5.10/crypto-caam-clear-some-memory-in-instantiate_rng.patch
new file mode 100644
index 00000000000..ab75b70984d
--- /dev/null
+++ b/queue-5.10/crypto-caam-clear-some-memory-in-instantiate_rng.patch
@@ -0,0 +1,52 @@
+From aee7ee0c0a65597bd425e3260ce3182b03db3b14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 07:59:30 +0100
+Subject: crypto: caam - Clear some memory in instantiate_rng
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 9c19fb86a8cb2ee82a832c95e139f29ea05c4d08 ]
+
+According to the comment at the end of the 'for' loop just a few lines
+below, it looks needed to clear 'desc'.
+
+So it should also be cleared for the first iteration.
+
+Move the memset() to the beginning of the loop to be safe.
+
+Fixes: 281922a1d4f5 ("crypto: caam - add support for SEC v5.x RNG4")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Gaurav Jain <gaurav.jain@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/ctrl.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
+index f87aa2169e5f5..f9a1ec3c84851 100644
+--- a/drivers/crypto/caam/ctrl.c
++++ b/drivers/crypto/caam/ctrl.c
+@@ -284,6 +284,10 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
+ 		const u32 rdsta_if = RDSTA_IF0 << sh_idx;
+ 		const u32 rdsta_pr = RDSTA_PR0 << sh_idx;
+ 		const u32 rdsta_mask = rdsta_if | rdsta_pr;
++
++		/* Clear the contents before using the descriptor */
++		memset(desc, 0x00, CAAM_CMD_SZ * 7);
++
+ 		/*
+ 		 * If the corresponding bit is set, this state handle
+ 		 * was initialized by somebody else, so it's left alone.
+@@ -327,8 +331,6 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
+ 		}
+ 
+ 		dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx);
+-		/* Clear the contents before recreating the descriptor */
+-		memset(desc, 0x00, CAAM_CMD_SZ * 7);
+ 	}
+ 
+ 	kfree(desc);
+-- 
+2.39.2
+
diff --git a/queue-5.10/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch b/queue-5.10/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch
new file mode 100644
index 00000000000..bf33d0d619c
--- /dev/null
+++ b/queue-5.10/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch
@@ -0,0 +1,68 @@
+From 2c0a97dbb8eed71c4b40649a3c81de85f204adac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Nov 2021 15:18:08 +0100
+Subject: crypto: drbg - make drbg_prepare_hrng() handle jent instantiation
+ errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nicolai Stange <nstange@suse.de>
+
+[ Upstream commit 559edd47cce4cc407d606b4d7f376822816fd4b8 ]
+
+Now that drbg_prepare_hrng() doesn't do anything but to instantiate a
+jitterentropy crypto_rng instance, it looks a little odd to have the
+related error handling at its only caller, drbg_instantiate().
+
+Move the handling of jitterentropy allocation failures from
+drbg_instantiate() close to the allocation itself in drbg_prepare_hrng().
+
+There is no change in behaviour.
+
+Signed-off-by: Nicolai Stange <nstange@suse.de>
+Reviewed-by: Stephan Müller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 686cd976b6dd ("crypto: drbg - Only fail when jent is unavailable in FIPS mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/drbg.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index a4b5d6dbe99d3..ecc6b167b89e2 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -1515,6 +1515,14 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
+ 		return 0;
+ 
+ 	drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
++	if (IS_ERR(drbg->jent)) {
++		const int err = PTR_ERR(drbg->jent);
++
++		drbg->jent = NULL;
++		if (fips_enabled || err != -ENOENT)
++			return err;
++		pr_info("DRBG: Continuing without Jitter RNG\n");
++	}
+ 
+ 	return 0;
+ }
+@@ -1570,14 +1578,6 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
+ 		if (ret)
+ 			goto free_everything;
+ 
+-		if (IS_ERR(drbg->jent)) {
+-			ret = PTR_ERR(drbg->jent);
+-			drbg->jent = NULL;
+-			if (fips_enabled || ret != -ENOENT)
+-				goto free_everything;
+-			pr_info("DRBG: Continuing without Jitter RNG\n");
+-		}
+-
+ 		reseed = false;
+ 	}
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch b/queue-5.10/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch
new file mode 100644
index 00000000000..a03f2613ddd
--- /dev/null
+++ b/queue-5.10/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch
@@ -0,0 +1,41 @@
+From 5c7d028b3168e35c9f674bd6bc3ec03a5ea35ac2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 11:35:23 +0800
+Subject: crypto: drbg - Only fail when jent is unavailable in FIPS mode
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ]
+
+When jent initialisation fails for any reason other than ENOENT,
+the entire drbg fails to initialise, even when we're not in FIPS
+mode.  This is wrong because we can still use the kernel RNG when
+we're not in FIPS mode.
+
+Change it so that it only fails when we are in FIPS mode.
+
+Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/drbg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index ecc6b167b89e2..ba1fa5cdd90ac 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -1519,7 +1519,7 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
+ 		const int err = PTR_ERR(drbg->jent);
+ 
+ 		drbg->jent = NULL;
+-		if (fips_enabled || err != -ENOENT)
++		if (fips_enabled)
+ 			return err;
+ 		pr_info("DRBG: Continuing without Jitter RNG\n");
+ 	}
+-- 
+2.39.2
+
diff --git a/queue-5.10/crypto-sa2ul-select-crypto_des.patch b/queue-5.10/crypto-sa2ul-select-crypto_des.patch
new file mode 100644
index 00000000000..d5a043b56b7
--- /dev/null
+++ b/queue-5.10/crypto-sa2ul-select-crypto_des.patch
@@ -0,0 +1,45 @@
+From 843fe30fbf5110b6ccfedb7ff2982096e4aa3b9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 20:28:12 +0530
+Subject: crypto: sa2ul - Select CRYPTO_DES
+
+From: Suman Anna <s-anna@ti.com>
+
+[ Upstream commit 8832023efd20966e29944dac92118dfbf1fa1bc0 ]
+
+The SA2UL Crypto driver provides support for couple of
+DES3 algos "cbc(des3_ede)" and "ecb(des3_ede)", and enabling
+the crypto selftest throws the following errors (as seen on
+K3 J721E SoCs):
+  saul-crypto 4e00000.crypto: Error allocating fallback algo cbc(des3_ede)
+  alg: skcipher: failed to allocate transform for cbc-des3-sa2ul: -2
+  saul-crypto 4e00000.crypto: Error allocating fallback algo ecb(des3_ede)
+  alg: skcipher: failed to allocate transform for ecb-des3-sa2ul: -2
+
+Fix this by selecting CRYPTO_DES which was missed while
+adding base driver support.
+
+Fixes: 7694b6ca649f ("crypto: sa2ul - Add crypto driver")
+Signed-off-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
+index 0a3dd0793f30e..dbdee43c6ffcf 100644
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -897,6 +897,7 @@ config CRYPTO_DEV_SA2UL
+ 	select CRYPTO_AES_ARM64
+ 	select CRYPTO_ALGAPI
+ 	select CRYPTO_AUTHENC
++	select CRYPTO_DES
+ 	select CRYPTO_SHA1
+ 	select CRYPTO_SHA256
+ 	select CRYPTO_SHA512
+-- 
+2.39.2
+
diff --git a/queue-5.10/debugobject-prevent-init-race-with-static-objects.patch b/queue-5.10/debugobject-prevent-init-race-with-static-objects.patch
new file mode 100644
index 00000000000..6fa7530bbeb
--- /dev/null
+++ b/queue-5.10/debugobject-prevent-init-race-with-static-objects.patch
@@ -0,0 +1,283 @@
+From 23f10a3240e794ce6b11f9b7228f39334b685de2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 09:54:39 +0200
+Subject: debugobject: Prevent init race with static objects
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ]
+
+Statically initialized objects are usually not initialized via the init()
+function of the subsystem. They are special cased and the subsystem
+provides a function to validate whether an object which is not yet tracked
+by debugobjects is statically initialized. This means the object is started
+to be tracked on first use, e.g. activation.
+
+This works perfectly fine, unless there are two concurrent operations on
+that object. Schspa decoded the problem:
+
+T0 	          	    	    T1
+
+debug_object_assert_init(addr)
+  lock_hash_bucket()
+  obj = lookup_object(addr);
+  if (!obj) {
+  	unlock_hash_bucket();
+	- > preemption
+			            lock_subsytem_object(addr);
+				      activate_object(addr)
+				      lock_hash_bucket();
+				      obj = lookup_object(addr);
+				      if (!obj) {
+				    	unlock_hash_bucket();
+					if (is_static_object(addr))
+					   init_and_track(addr);
+				      lock_hash_bucket();
+				      obj = lookup_object(addr);
+				      obj->state = ACTIVATED;
+				      unlock_hash_bucket();
+
+				    subsys function modifies content of addr,
+				    so static object detection does
+				    not longer work.
+
+				    unlock_subsytem_object(addr);
+
+        if (is_static_object(addr)) <- Fails
+
+	  debugobject emits a warning and invokes the fixup function which
+	  reinitializes the already active object in the worst case.
+
+This race exists forever, but was never observed until mod_timer() got a
+debug_object_assert_init() added which is outside of the timer base lock
+held section right at the beginning of the function to cover the lockless
+early exit points too.
+
+Rework the code so that the lookup, the static object check and the
+tracking object association happens atomically under the hash bucket
+lock. This prevents the issue completely as all callers are serialized on
+the hash bucket lock and therefore cannot observe inconsistent state.
+
+Fixes: 3ac7fe5a4aab ("infrastructure to debug (dynamic) objects")
+Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com
+Debugged-by: Schspa Shi <schspa@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462
+Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com
+Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/debugobjects.c | 125 ++++++++++++++++++++++++---------------------
+ 1 file changed, 66 insertions(+), 59 deletions(-)
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 71bdc167a9ee7..8282ae37db4ef 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -219,10 +219,6 @@ static struct debug_obj *__alloc_object(struct hlist_head *list)
+ 	return obj;
+ }
+ 
+-/*
+- * Allocate a new object. If the pool is empty, switch off the debugger.
+- * Must be called with interrupts disabled.
+- */
+ static struct debug_obj *
+ alloc_object(void *addr, struct debug_bucket *b, const struct debug_obj_descr *descr)
+ {
+@@ -555,11 +551,49 @@ static void debug_object_is_on_stack(void *addr, int onstack)
+ 	WARN_ON(1);
+ }
+ 
++static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket *b,
++						const struct debug_obj_descr *descr,
++						bool onstack, bool alloc_ifstatic)
++{
++	struct debug_obj *obj = lookup_object(addr, b);
++	enum debug_obj_state state = ODEBUG_STATE_NONE;
++
++	if (likely(obj))
++		return obj;
++
++	/*
++	 * debug_object_init() unconditionally allocates untracked
++	 * objects. It does not matter whether it is a static object or
++	 * not.
++	 *
++	 * debug_object_assert_init() and debug_object_activate() allow
++	 * allocation only if the descriptor callback confirms that the
++	 * object is static and considered initialized. For non-static
++	 * objects the allocation needs to be done from the fixup callback.
++	 */
++	if (unlikely(alloc_ifstatic)) {
++		if (!descr->is_static_object || !descr->is_static_object(addr))
++			return ERR_PTR(-ENOENT);
++		/* Statically allocated objects are considered initialized */
++		state = ODEBUG_STATE_INIT;
++	}
++
++	obj = alloc_object(addr, b, descr);
++	if (likely(obj)) {
++		obj->state = state;
++		debug_object_is_on_stack(addr, onstack);
++		return obj;
++	}
++
++	/* Out of memory. Do the cleanup outside of the locked region */
++	debug_objects_enabled = 0;
++	return NULL;
++}
++
+ static void
+ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack)
+ {
+ 	enum debug_obj_state state;
+-	bool check_stack = false;
+ 	struct debug_bucket *db;
+ 	struct debug_obj *obj;
+ 	unsigned long flags;
+@@ -570,16 +604,11 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack
+ 
+ 	raw_spin_lock_irqsave(&db->lock, flags);
+ 
+-	obj = lookup_object(addr, db);
+-	if (!obj) {
+-		obj = alloc_object(addr, db, descr);
+-		if (!obj) {
+-			debug_objects_enabled = 0;
+-			raw_spin_unlock_irqrestore(&db->lock, flags);
+-			debug_objects_oom();
+-			return;
+-		}
+-		check_stack = true;
++	obj = lookup_object_or_alloc(addr, db, descr, onstack, false);
++	if (unlikely(!obj)) {
++		raw_spin_unlock_irqrestore(&db->lock, flags);
++		debug_objects_oom();
++		return;
+ 	}
+ 
+ 	switch (obj->state) {
+@@ -605,8 +634,6 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack
+ 	}
+ 
+ 	raw_spin_unlock_irqrestore(&db->lock, flags);
+-	if (check_stack)
+-		debug_object_is_on_stack(addr, onstack);
+ }
+ 
+ /**
+@@ -646,14 +673,12 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack);
+  */
+ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
+ {
++	struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ 	enum debug_obj_state state;
+ 	struct debug_bucket *db;
+ 	struct debug_obj *obj;
+ 	unsigned long flags;
+ 	int ret;
+-	struct debug_obj o = { .object = addr,
+-			       .state = ODEBUG_STATE_NOTAVAILABLE,
+-			       .descr = descr };
+ 
+ 	if (!debug_objects_enabled)
+ 		return 0;
+@@ -662,8 +687,8 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
+ 
+ 	raw_spin_lock_irqsave(&db->lock, flags);
+ 
+-	obj = lookup_object(addr, db);
+-	if (obj) {
++	obj = lookup_object_or_alloc(addr, db, descr, false, true);
++	if (likely(!IS_ERR_OR_NULL(obj))) {
+ 		bool print_object = false;
+ 
+ 		switch (obj->state) {
+@@ -696,24 +721,16 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
+ 
+ 	raw_spin_unlock_irqrestore(&db->lock, flags);
+ 
+-	/*
+-	 * We are here when a static object is activated. We
+-	 * let the type specific code confirm whether this is
+-	 * true or not. if true, we just make sure that the
+-	 * static object is tracked in the object tracker. If
+-	 * not, this must be a bug, so we try to fix it up.
+-	 */
+-	if (descr->is_static_object && descr->is_static_object(addr)) {
+-		/* track this static object */
+-		debug_object_init(addr, descr);
+-		debug_object_activate(addr, descr);
+-	} else {
+-		debug_print_object(&o, "activate");
+-		ret = debug_object_fixup(descr->fixup_activate, addr,
+-					ODEBUG_STATE_NOTAVAILABLE);
+-		return ret ? 0 : -EINVAL;
++	/* If NULL the allocation has hit OOM */
++	if (!obj) {
++		debug_objects_oom();
++		return 0;
+ 	}
+-	return 0;
++
++	/* Object is neither static nor tracked. It's not initialized */
++	debug_print_object(&o, "activate");
++	ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE);
++	return ret ? 0 : -EINVAL;
+ }
+ EXPORT_SYMBOL_GPL(debug_object_activate);
+ 
+@@ -867,6 +884,7 @@ EXPORT_SYMBOL_GPL(debug_object_free);
+  */
+ void debug_object_assert_init(void *addr, const struct debug_obj_descr *descr)
+ {
++	struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ 	struct debug_bucket *db;
+ 	struct debug_obj *obj;
+ 	unsigned long flags;
+@@ -877,31 +895,20 @@ void debug_object_assert_init(void *addr, const struct debug_obj_descr *descr)
+ 	db = get_bucket((unsigned long) addr);
+ 
+ 	raw_spin_lock_irqsave(&db->lock, flags);
++	obj = lookup_object_or_alloc(addr, db, descr, false, true);
++	raw_spin_unlock_irqrestore(&db->lock, flags);
++	if (likely(!IS_ERR_OR_NULL(obj)))
++		return;
+ 
+-	obj = lookup_object(addr, db);
++	/* If NULL the allocation has hit OOM */
+ 	if (!obj) {
+-		struct debug_obj o = { .object = addr,
+-				       .state = ODEBUG_STATE_NOTAVAILABLE,
+-				       .descr = descr };
+-
+-		raw_spin_unlock_irqrestore(&db->lock, flags);
+-		/*
+-		 * Maybe the object is static, and we let the type specific
+-		 * code confirm. Track this static object if true, else invoke
+-		 * fixup.
+-		 */
+-		if (descr->is_static_object && descr->is_static_object(addr)) {
+-			/* Track this static object */
+-			debug_object_init(addr, descr);
+-		} else {
+-			debug_print_object(&o, "assert_init");
+-			debug_object_fixup(descr->fixup_assert_init, addr,
+-					   ODEBUG_STATE_NOTAVAILABLE);
+-		}
++		debug_objects_oom();
+ 		return;
+ 	}
+ 
+-	raw_spin_unlock_irqrestore(&db->lock, flags);
++	/* Object is neither tracked nor static. It's not initialized. */
++	debug_print_object(&o, "assert_init");
++	debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_assert_init);
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch b/queue-5.10/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch
new file mode 100644
index 00000000000..2f64113f055
--- /dev/null
+++ b/queue-5.10/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch
@@ -0,0 +1,55 @@
+From a23c8535dcce38350e894730d95844ce242fecf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 17:18:25 +0200
+Subject: dmaengine: at_xdmac: do not enable all cyclic channels
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit f8435befd81dd85b7b610598551fadf675849bc1 ]
+
+Do not global enable all the cyclic channels in at_xdmac_resume(). Instead
+save the global status in at_xdmac_suspend() and re-enable the cyclic
+channel only if it was active before suspend.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230214151827.1050280-6-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_xdmac.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index b5d691ae45dcf..1fe006cc643e7 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -212,6 +212,7 @@ struct at_xdmac {
+ 	int			irq;
+ 	struct clk		*clk;
+ 	u32			save_gim;
++	u32			save_gs;
+ 	struct dma_pool		*at_xdmac_desc_pool;
+ 	struct at_xdmac_chan	chan[];
+ };
+@@ -1910,6 +1911,7 @@ static int atmel_xdmac_suspend(struct device *dev)
+ 		}
+ 	}
+ 	atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM);
++	atxdmac->save_gs = at_xdmac_read(atxdmac, AT_XDMAC_GS);
+ 
+ 	at_xdmac_off(atxdmac);
+ 	clk_disable_unprepare(atxdmac->clk);
+@@ -1946,7 +1948,8 @@ static int atmel_xdmac_resume(struct device *dev)
+ 			at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+ 			at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim);
+ 			wmb();
+-			at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
++			if (atxdmac->save_gs & atchan->mask)
++				at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
+ 		}
+ 	}
+ 	return 0;
+-- 
+2.39.2
+
diff --git a/queue-5.10/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch b/queue-5.10/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch
new file mode 100644
index 00000000000..0fa83c0b91a
--- /dev/null
+++ b/queue-5.10/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch
@@ -0,0 +1,90 @@
+From f6ffe3c4453a4e284769ad6fca9ab2bbc9780475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 19:17:57 +0900
+Subject: dmaengine: dw-edma: Fix to change for continuous transfer
+
+From: Shunsuke Mie <mie@igel.co.jp>
+
+[ Upstream commit a251994a441ee0a69ba7062c8cd2d08ead3db379 ]
+
+The dw-edma driver stops after processing a DMA request even if a request
+remains in the issued queue, which is not the expected behavior. The DMA
+engine API requires continuous processing.
+
+Add a trigger to start after one processing finished if there are requests
+remain.
+
+Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
+Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
+Link: https://lore.kernel.org/r/20230411101758.438472-1-mie@igel.co.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index d7ed50f8b9294..a3790f7b1b530 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -166,7 +166,7 @@ static void vchan_free_desc(struct virt_dma_desc *vdesc)
+ 	dw_edma_free_desc(vd2dw_edma_desc(vdesc));
+ }
+ 
+-static void dw_edma_start_transfer(struct dw_edma_chan *chan)
++static int dw_edma_start_transfer(struct dw_edma_chan *chan)
+ {
+ 	struct dw_edma_chunk *child;
+ 	struct dw_edma_desc *desc;
+@@ -174,16 +174,16 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan)
+ 
+ 	vd = vchan_next_desc(&chan->vc);
+ 	if (!vd)
+-		return;
++		return 0;
+ 
+ 	desc = vd2dw_edma_desc(vd);
+ 	if (!desc)
+-		return;
++		return 0;
+ 
+ 	child = list_first_entry_or_null(&desc->chunk->list,
+ 					 struct dw_edma_chunk, list);
+ 	if (!child)
+-		return;
++		return 0;
+ 
+ 	dw_edma_v0_core_start(child, !desc->xfer_sz);
+ 	desc->xfer_sz += child->ll_region.sz;
+@@ -191,6 +191,8 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan)
+ 	list_del(&child->list);
+ 	kfree(child);
+ 	desc->chunks_alloc--;
++
++	return 1;
+ }
+ 
+ static int dw_edma_device_config(struct dma_chan *dchan,
+@@ -497,14 +499,14 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ 		switch (chan->request) {
+ 		case EDMA_REQ_NONE:
+ 			desc = vd2dw_edma_desc(vd);
+-			if (desc->chunks_alloc) {
+-				chan->status = EDMA_ST_BUSY;
+-				dw_edma_start_transfer(chan);
+-			} else {
++			if (!desc->chunks_alloc) {
+ 				list_del(&vd->node);
+ 				vchan_cookie_complete(vd);
+-				chan->status = EDMA_ST_IDLE;
+ 			}
++
++			/* Continue transferring if there are remaining chunks or issued requests.
++			 */
++			chan->status = dw_edma_start_transfer(chan) ? EDMA_ST_BUSY : EDMA_ST_IDLE;
+ 			break;
+ 
+ 		case EDMA_REQ_STOP:
+-- 
+2.39.2
+
diff --git a/queue-5.10/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch b/queue-5.10/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch
new file mode 100644
index 00000000000..d7b446b0b02
--- /dev/null
+++ b/queue-5.10/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch
@@ -0,0 +1,44 @@
+From 2f29c1c6ff5e729554c12db2b87937c984ac4738 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 19:17:58 +0900
+Subject: dmaengine: dw-edma: Fix to enable to issue dma request on DMA
+ processing
+
+From: Shunsuke Mie <mie@igel.co.jp>
+
+[ Upstream commit 970b17dfe264a9085ba4e593730ecfd496b950ab ]
+
+The issue_pending request is ignored while driver is processing a DMA
+request. Fix to issue the pending requests on any dma channel status.
+
+Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
+Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
+Link: https://lore.kernel.org/r/20230411101758.438472-2-mie@igel.co.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index a3790f7b1b530..f91dbf43a5980 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -276,9 +276,12 @@ static void dw_edma_device_issue_pending(struct dma_chan *dchan)
+ 	struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
+ 	unsigned long flags;
+ 
++	if (!chan->configured)
++		return;
++
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+-	if (chan->configured && chan->request == EDMA_REQ_NONE &&
+-	    chan->status == EDMA_ST_IDLE && vchan_issue_pending(&chan->vc)) {
++	if (vchan_issue_pending(&chan->vc) && chan->request == EDMA_REQ_NONE &&
++	    chan->status == EDMA_ST_IDLE) {
+ 		chan->status = EDMA_ST_BUSY;
+ 		dw_edma_start_transfer(chan);
+ 	}
+-- 
+2.39.2
+
diff --git a/queue-5.10/dmaengine-mv_xor_v2-fix-an-error-code.patch b/queue-5.10/dmaengine-mv_xor_v2-fix-an-error-code.patch
new file mode 100644
index 00000000000..8ecb3a780d4
--- /dev/null
+++ b/queue-5.10/dmaengine-mv_xor_v2-fix-an-error-code.patch
@@ -0,0 +1,37 @@
+From cecff3ce8317187491ca50284a0df032f96756a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 09:06:37 +0200
+Subject: dmaengine: mv_xor_v2: Fix an error code.
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 827026ae2e56ec05ef1155661079badbbfc0b038 ]
+
+If the probe is deferred, -EPROBE_DEFER should be returned, not
++EPROBE_DEFER.
+
+Fixes: 3cd2c313f1d6 ("dmaengine: mv_xor_v2: Fix clock resource by adding a register clock")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/201170dff832a3c496d125772e10070cd834ebf2.1679814350.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index 4800c596433ad..9f3e011fbd914 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -756,7 +756,7 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
+ 
+ 	xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
+ 	if (PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) {
+-		ret = EPROBE_DEFER;
++		ret = -EPROBE_DEFER;
+ 		goto disable_reg_clk;
+ 	}
+ 	if (!IS_ERR(xor_dev->clk)) {
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch b/queue-5.10/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch
new file mode 100644
index 00000000000..3091e4914fd
--- /dev/null
+++ b/queue-5.10/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch
@@ -0,0 +1,70 @@
+From 83d1aacdb1dcc8c79d079c243f086a45653a308f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Mar 2023 07:55:24 -0500
+Subject: drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit ee0285e13455fdbce5de315bdbe91b5f198a2a06 ]
+
+When dynamically switching lanes was removed, the intent of the code
+was to check to make sure that higher speed items used 4 lanes, but
+it had the unintended consequence of removing the slower speeds for
+4-lane users.
+
+This attempts to remedy this by doing a check to see that the
+max frequency doesn't exceed the chip limit, and a second
+check to make sure that the max bit-rate doesn't exceed the
+number of lanes * max bit rate / lane.
+
+Fixes: 9a0cdcd6649b ("drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge")
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230319125524.58803-1-aford173@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7533.c | 25 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+index f304a5ff8e596..e0bdedf22390c 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c
+@@ -103,22 +103,19 @@ void adv7533_dsi_power_off(struct adv7511 *adv)
+ enum drm_mode_status adv7533_mode_valid(struct adv7511 *adv,
+ 					const struct drm_display_mode *mode)
+ {
+-	int lanes;
++	unsigned long max_lane_freq;
+ 	struct mipi_dsi_device *dsi = adv->dsi;
++	u8 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format);
+ 
+-	if (mode->clock > 80000)
+-		lanes = 4;
+-	else
+-		lanes = 3;
+-
+-	/*
+-	 * TODO: add support for dynamic switching of lanes
+-	 * by using the bridge pre_enable() op . Till then filter
+-	 * out the modes which shall need different number of lanes
+-	 * than what was configured in the device tree.
+-	 */
+-	if (lanes != dsi->lanes)
+-		return MODE_BAD;
++	/* Check max clock for either 7533 or 7535 */
++	if (mode->clock > (adv->type == ADV7533 ? 80000 : 148500))
++		return MODE_CLOCK_HIGH;
++
++	/* Check max clock for each lane */
++	max_lane_freq = (adv->type == ADV7533 ? 800000 : 891000);
++
++	if (mode->clock * bpp > max_lane_freq * adv->num_dsi_lanes)
++		return MODE_CLOCK_HIGH;
+ 
+ 	return MODE_OK;
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch b/queue-5.10/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch
new file mode 100644
index 00000000000..b1db5692615
--- /dev/null
+++ b/queue-5.10/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch
@@ -0,0 +1,45 @@
+From bb34af7f1a18780030ac1dcf0a3c5b0e8e67e7c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 23:06:02 +0300
+Subject: drm/i915: Make intel_get_crtc_new_encoder() less oopsy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 631420b06597a33c72b6dcef78d1c2dea17f452d ]
+
+The point of the WARN was to print something, not oops
+straight up. Currently that is precisely what happens
+if we can't find the connector for the crtc in the atomic
+state. Get the dev pointer from the atomic state instead
+of the potentially NULL encoder to avoid that.
+
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230413200602.6037-2-ville.syrjala@linux.intel.com
+Fixes: 3a47ae201e07 ("drm/i915/display: Make WARN* drm specific where encoder ptr is available")
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 3b6692357f70498f617ea1b31a0378070a0acf1c)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
+index d46011f7a8380..9a06bd8cb200b 100644
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -5844,7 +5844,7 @@ intel_get_crtc_new_encoder(const struct intel_atomic_state *state,
+ 		num_encoders++;
+ 	}
+ 
+-	drm_WARN(encoder->base.dev, num_encoders != 1,
++	drm_WARN(state->base.dev, num_encoders != 1,
+ 		 "%d encoders for pipe %c\n",
+ 		 num_encoders, pipe_name(crtc->pipe));
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch b/queue-5.10/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch
new file mode 100644
index 00000000000..8b527176c69
--- /dev/null
+++ b/queue-5.10/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch
@@ -0,0 +1,45 @@
+From d3be4042b0ebdd0fb4d6ac82825291b5cb26c37b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 22:27:11 -0700
+Subject: drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit c5647cae2704e58d1c4e5fedbf63f11bca6376c9 ]
+
+Smatch reports:
+drivers/gpu/drm/lima/lima_drv.c:396 lima_pdev_probe() warn:
+	missing unwind goto?
+
+Store return value in err and goto 'err_out0' which has
+lima_sched_slab_fini() before returning.
+
+Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs")
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Signed-off-by: Qiang Yu <yuq825@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230314052711.4061652-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/lima/lima_drv.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/lima/lima_drv.c b/drivers/gpu/drm/lima/lima_drv.c
+index ab460121fd52c..65dc0dc2c119a 100644
+--- a/drivers/gpu/drm/lima/lima_drv.c
++++ b/drivers/gpu/drm/lima/lima_drv.c
+@@ -392,8 +392,10 @@ static int lima_pdev_probe(struct platform_device *pdev)
+ 
+ 	/* Allocate and initialize the DRM device. */
+ 	ddev = drm_dev_alloc(&lima_drm_driver, &pdev->dev);
+-	if (IS_ERR(ddev))
+-		return PTR_ERR(ddev);
++	if (IS_ERR(ddev)) {
++		err = PTR_ERR(ddev);
++		goto err_out0;
++	}
+ 
+ 	ddev->dev_private = ldev;
+ 	ldev->ddev = ddev;
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch b/queue-5.10/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch
new file mode 100644
index 00000000000..da0ab8fbe4e
--- /dev/null
+++ b/queue-5.10/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch
@@ -0,0 +1,62 @@
+From f724e604956e4f899605a5341a957eadbfe2e56e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jun 2022 11:20:30 -0700
+Subject: drm/msm/adreno: Defer enabling runpm until hw_init()
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 4b18299b33655fa9672b774b6df774dc03d6aee8 ]
+
+To avoid preventing the display from coming up before the rootfs is
+mounted, without resorting to packing fw in the initrd, the GPU has
+this limbo state where the device is probed, but we aren't ready to
+start sending commands to it.  This is particularly problematic for
+a6xx, since the GMU (which requires fw to be loaded) is the one that
+is controlling the power/clk/icc votes.
+
+So defer enabling runpm until we are ready to call gpu->hw_init(),
+as that is a point where we know we have all the needed fw and are
+ready to start sending commands to the coproc's.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Patchwork: https://patchwork.freedesktop.org/patch/489337/
+Link: https://lore.kernel.org/r/20220613182036.2567963-1-robdclark@gmail.com
+Stable-dep-of: db7662d076c9 ("drm/msm/adreno: drop bogus pm_runtime_set_active()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 6 ++++++
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c    | 1 -
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
+index 58e03b20e1c7a..c06202b9243c4 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -301,6 +301,12 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev)
+ 	if (ret)
+ 		return NULL;
+ 
++	/*
++	 * Now that we have firmware loaded, and are ready to begin
++	 * booting the gpu, go ahead and enable runpm:
++	 */
++	pm_runtime_enable(&pdev->dev);
++
+ 	/* Make sure pm runtime is active and reset any previous errors */
+ 	pm_runtime_set_active(&pdev->dev);
+ 
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index 78181e2d78a97..11a6a41b4910f 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -916,7 +916,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+ 	pm_runtime_set_autosuspend_delay(dev,
+ 		adreno_gpu->info->inactive_period);
+ 	pm_runtime_use_autosuspend(dev);
+-	pm_runtime_enable(dev);
+ 
+ 	ret = msm_gpu_init(drm, pdev, &adreno_gpu->base, &funcs->base,
+ 			adreno_gpu->info->name, &adreno_gpu_config);
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-msm-adreno-disable-preemption-on-adreno-510.patch b/queue-5.10/drm-msm-adreno-disable-preemption-on-adreno-510.patch
new file mode 100644
index 00000000000..87b120750b6
--- /dev/null
+++ b/queue-5.10/drm-msm-adreno-disable-preemption-on-adreno-510.patch
@@ -0,0 +1,54 @@
+From 0b8117da19d29001344d115619fe4e665a6dfecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 23:17:17 +0100
+Subject: drm: msm: adreno: Disable preemption on Adreno 510
+
+From: Adam Skladowski <a39.skl@gmail.com>
+
+[ Upstream commit 010c8bbad2cb8c33c47963e29f051f1e917e45a5 ]
+
+Downstream driver appears to not support preemption on A510 target,
+trying to use one make device slow and fill log with rings related errors.
+Set num_rings to 1 to disable preemption.
+
+Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: e20c9284c8f2 ("drm/msm/adreno: Add support for Adreno 510 GPU")
+Signed-off-by: Adam Skladowski <a39.skl@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/526898/
+Link: https://lore.kernel.org/r/20230314221757.13096-1-a39.skl@gmail.com
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index 6f84db97e20e8..0fcba2bc26b8e 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -1569,6 +1569,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
+ 	struct a5xx_gpu *a5xx_gpu = NULL;
+ 	struct adreno_gpu *adreno_gpu;
+ 	struct msm_gpu *gpu;
++	unsigned int nr_rings;
+ 	int ret;
+ 
+ 	if (!pdev) {
+@@ -1589,7 +1590,12 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
+ 
+ 	check_speed_bin(&pdev->dev);
+ 
+-	ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 4);
++	nr_rings = 4;
++
++	if (adreno_is_a510(adreno_gpu))
++		nr_rings = 1;
++
++	ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, nr_rings);
+ 	if (ret) {
+ 		a5xx_destroy(&(a5xx_gpu->base.base));
+ 		return ERR_PTR(ret);
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch b/queue-5.10/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch
new file mode 100644
index 00000000000..a15660f2036
--- /dev/null
+++ b/queue-5.10/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch
@@ -0,0 +1,42 @@
+From 87edfcd0564859a37ef8d9cde1985ebd23a3643a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 17:48:06 +0100
+Subject: drm/msm/adreno: drop bogus pm_runtime_set_active()
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit db7662d076c973072d788bd0e8130e04430307a1 ]
+
+The runtime PM status can only be updated while runtime PM is disabled.
+
+Drop the bogus pm_runtime_set_active() call that was made after enabling
+runtime PM and which (incidentally but correctly) left the runtime PM
+status set to 'suspended'.
+
+Fixes: 2c087a336676 ("drm/msm/adreno: Load the firmware before bringing up the hardware")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Patchwork: https://patchwork.freedesktop.org/patch/524972/
+Link: https://lore.kernel.org/r/20230303164807.13124-4-johan+linaro@kernel.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
+index c06202b9243c4..760687f66ae5b 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -307,9 +307,6 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev)
+ 	 */
+ 	pm_runtime_enable(&pdev->dev);
+ 
+-	/* Make sure pm runtime is active and reset any previous errors */
+-	pm_runtime_set_active(&pdev->dev);
+-
+ 	ret = pm_runtime_get_sync(&pdev->dev);
+ 	if (ret < 0) {
+ 		pm_runtime_put_sync(&pdev->dev);
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch b/queue-5.10/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch
new file mode 100644
index 00000000000..9353d3fc647
--- /dev/null
+++ b/queue-5.10/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch
@@ -0,0 +1,40 @@
+From d0e491822ffa0396469f0e5a5b2a72a12c3438be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Mar 2023 22:03:07 +0530
+Subject: drm/msm/disp/dpu: check for crtc enable rather than crtc active to
+ release shared resources
+
+From: Vinod Polimera <quic_vpolimer@quicinc.com>
+
+[ Upstream commit b6975693846b562c4d3e0e60cc884affc5bdac00 ]
+
+According to KMS documentation, The driver must not release any shared
+resources if active is set to false but enable still true.
+
+Fixes: ccc862b957c6 ("drm/msm/dpu: Fix reservation failures in modeset")
+Signed-off-by: Vinod Polimera <quic_vpolimer@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/524726/
+Link: https://lore.kernel.org/r/1677774797-31063-5-git-send-email-quic_vpolimer@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index a0274fcfe9c9d..408fc6c8a6df8 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -634,7 +634,7 @@ static int dpu_encoder_virt_atomic_check(
+ 		if (drm_atomic_crtc_needs_modeset(crtc_state)) {
+ 			dpu_rm_release(global_state, drm_enc);
+ 
+-			if (!crtc_state->active_changed || crtc_state->active)
++			if (!crtc_state->active_changed || crtc_state->enable)
+ 				ret = dpu_rm_reserve(&dpu_kms->rm, global_state,
+ 						drm_enc, crtc_state, topology);
+ 		}
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-probe-helper-cancel-previous-job-before-starting.patch b/queue-5.10/drm-probe-helper-cancel-previous-job-before-starting.patch
new file mode 100644
index 00000000000..5a1042b8c25
--- /dev/null
+++ b/queue-5.10/drm-probe-helper-cancel-previous-job-before-starting.patch
@@ -0,0 +1,52 @@
+From ea28172af4d31017c774e3c4d1b255c0d482d25a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 16:40:52 +0100
+Subject: drm/probe-helper: Cancel previous job before starting new one
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit a8e47884f1906cd7440fafa056adc8817568e73e ]
+
+Currently we schedule a call to output_poll_execute from
+drm_kms_helper_poll_enable for 10s in future. Later we try to replace
+that in drm_helper_probe_single_connector_modes with a 0s schedule with
+delayed_event set.
+
+But as there is already a job in the queue this fails, and the immediate
+job we wanted with delayed_event set doesn't occur until 10s later.
+
+And that call acts as if connector state has changed, reprobing modes.
+This has a side effect of waking up a display that has been blanked.
+
+Make sure we cancel the old job before submitting the immediate one.
+
+Fixes: 162b6a57ac50 ("drm/probe-helper: don't lose hotplug event")
+Acked-by: Daniel Vetter <daniel@ffwll.ch>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+[Maxime: Switched to mod_delayed_work]
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127154052.452524-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_probe_helper.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index e5432dcf69996..d3f0d048594e7 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -488,8 +488,9 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
+ 		 */
+ 		dev->mode_config.delayed_event = true;
+ 		if (dev->mode_config.poll_enabled)
+-			schedule_delayed_work(&dev->mode_config.output_poll_work,
+-					      0);
++			mod_delayed_work(system_wq,
++					 &dev->mode_config.output_poll_work,
++					 0);
+ 	}
+ 
+ 	/* Re-enable polling in case the global poll config changed. */
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-rockchip-drop-unbalanced-obj-unref.patch b/queue-5.10/drm-rockchip-drop-unbalanced-obj-unref.patch
new file mode 100644
index 00000000000..b186efca14a
--- /dev/null
+++ b/queue-5.10/drm-rockchip-drop-unbalanced-obj-unref.patch
@@ -0,0 +1,38 @@
+From b609d66ea3e6c531511d978a9a4a5cbd98fc488d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:17:34 -0800
+Subject: drm/rockchip: Drop unbalanced obj unref
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 8ee3b0e85f6ccd9e6c527bc50eaba774c3bb18d0 ]
+
+In the error path, rockchip_drm_gem_object_mmap() is dropping an obj
+reference that it doesn't own.
+
+Fixes: 41315b793e13 ("drm/rockchip: use drm_gem_mmap helpers")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230119231734.2884543-1-robdclark@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+index 62e5d0970525e..22ff4a5929768 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+@@ -250,9 +250,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
+ 	else
+ 		ret = rockchip_drm_gem_object_mmap_dma(obj, vma);
+ 
+-	if (ret)
+-		drm_gem_vm_close(vma);
+-
+ 	return ret;
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/drm-vgem-add-missing-mutex_destroy.patch b/queue-5.10/drm-vgem-add-missing-mutex_destroy.patch
new file mode 100644
index 00000000000..9d02e0b19ee
--- /dev/null
+++ b/queue-5.10/drm-vgem-add-missing-mutex_destroy.patch
@@ -0,0 +1,42 @@
+From 5d2890599322e02803e401eb82e0f6075e6db831 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 09:55:17 -0300
+Subject: drm/vgem: add missing mutex_destroy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit 7c18189b14b33c1fbf76480b1bd217877c086e67 ]
+
+vgem_fence_open() instantiates a mutex for a particular fence
+instance, but never destroys it by calling mutex_destroy() in
+vgem_fence_close().
+
+So, add the missing mutex_destroy() to guarantee proper resource
+destruction.
+
+Fixes: 407779848445 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)")
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Signed-off-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230202125517.427976-1-mcanal@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vgem/vgem_fence.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c
+index 17f32f550dd99..575bc331716e8 100644
+--- a/drivers/gpu/drm/vgem/vgem_fence.c
++++ b/drivers/gpu/drm/vgem/vgem_fence.c
+@@ -249,4 +249,5 @@ void vgem_fence_close(struct vgem_file *vfile)
+ {
+ 	idr_for_each(&vfile->fence_idr, __vgem_fence_idr_fini, vfile);
+ 	idr_destroy(&vfile->fence_idr);
++	mutex_destroy(&vfile->fence_mutex);
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch b/queue-5.10/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch
new file mode 100644
index 00000000000..fa45db29e21
--- /dev/null
+++ b/queue-5.10/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch
@@ -0,0 +1,55 @@
+From 2f4b1809ae44fd0295b49de55917c5b7cf12aad2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 09:17:28 +0800
+Subject: EDAC/skx: Fix overflows on the DRAM row address mapping arrays
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 71b1e3ba3fed5a34c5fac6d3a15c2634b04c1eb7 ]
+
+The current DRAM row address mapping arrays skx_{open,close}_row[]
+only support ranks with sizes up to 16G. Decoding a rank address
+to a DRAM row address for a 32G rank by using either one of the
+above arrays by the skx_edac driver, will result in an overflow on
+the array.
+
+For a 32G rank, the most significant DRAM row address bit (the
+bit17) is mapped from the bit34 of the rank address. Add this new
+mapping item to both arrays to fix the overflow issue.
+
+Fixes: 4ec656bdf43a ("EDAC, skx_edac: Add EDAC driver for Skylake")
+Reported-by: Feng Xu <feng.f.xu@intel.com>
+Tested-by: Feng Xu <feng.f.xu@intel.com>
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/all/20230211011728.71764-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/skx_base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/skx_base.c b/drivers/edac/skx_base.c
+index f887e31666510..ba3e83313938b 100644
+--- a/drivers/edac/skx_base.c
++++ b/drivers/edac/skx_base.c
+@@ -509,7 +509,7 @@ static bool skx_rir_decode(struct decoded_addr *res)
+ }
+ 
+ static u8 skx_close_row[] = {
+-	15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33
++	15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33, 34
+ };
+ 
+ static u8 skx_close_column[] = {
+@@ -517,7 +517,7 @@ static u8 skx_close_column[] = {
+ };
+ 
+ static u8 skx_open_row[] = {
+-	14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33
++	14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33, 34
+ };
+ 
+ static u8 skx_open_column[] = {
+-- 
+2.39.2
+
diff --git a/queue-5.10/erofs-fix-potential-overflow-calculating-xattr_isize.patch b/queue-5.10/erofs-fix-potential-overflow-calculating-xattr_isize.patch
new file mode 100644
index 00000000000..1220917c82c
--- /dev/null
+++ b/queue-5.10/erofs-fix-potential-overflow-calculating-xattr_isize.patch
@@ -0,0 +1,42 @@
+From c54720b9934ae52c264f8b13334c2bf5538be1db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 14:18:10 +0800
+Subject: erofs: fix potential overflow calculating xattr_isize
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit 1b3567a1969b26f709d82a874498c0754ea841c3 ]
+
+Given on-disk i_xattr_icount is 16 bits and xattr_isize is calculated
+from i_xattr_icount multiplying 4, xattr_isize has a theoretical maximum
+of 256K (64K * 4).
+
+Thus declare xattr_isize as unsigned int to avoid the potential overflow.
+
+Fixes: bfb8674dc044 ("staging: erofs: add erofs in-memory stuffs")
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Link: https://lore.kernel.org/r/20230414061810.6479-1-jefflexu@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/internal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h
+index 67a7ec9456866..ce52f708a403d 100644
+--- a/fs/erofs/internal.h
++++ b/fs/erofs/internal.h
+@@ -232,7 +232,7 @@ struct erofs_inode {
+ 
+ 	unsigned char datalayout;
+ 	unsigned char inode_isize;
+-	unsigned short xattr_isize;
++	unsigned int xattr_isize;
+ 
+ 	unsigned int xattr_shared_count;
+ 	unsigned int *xattr_shared_xattrs;
+-- 
+2.39.2
+
diff --git a/queue-5.10/erofs-stop-parsing-non-compact-head-index-if-cluster.patch b/queue-5.10/erofs-stop-parsing-non-compact-head-index-if-cluster.patch
new file mode 100644
index 00000000000..befc25ac8c1
--- /dev/null
+++ b/queue-5.10/erofs-stop-parsing-non-compact-head-index-if-cluster.patch
@@ -0,0 +1,65 @@
+From 81e846766404258af2b524019ee5d1498f5d9743 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 01:37:14 +0800
+Subject: erofs: stop parsing non-compact HEAD index if clusterofs is invalid
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit cc4efd3dd2ac9f89143e5d881609747ecff04164 ]
+
+Syzbot generated a crafted image [1] with a non-compact HEAD index of
+clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,
+which causes the following unexpected behavior as below:
+
+ BUG: unable to handle page fault for address: fffff52101a3fff9
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 23ffed067 P4D 23ffed067 PUD 0
+ Oops: 0000 [#1] PREEMPT SMP KASAN
+ CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
+ Workqueue: erofs_worker z_erofs_decompressqueue_work
+ RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40
+ ...
+ Call Trace:
+  <TASK>
+  z_erofs_decompressqueue_work+0x99/0xe0
+  process_one_work+0x8f6/0x1170
+  worker_thread+0xa63/0x1210
+  kthread+0x270/0x300
+  ret_from_fork+0x1f/0x30
+
+Note that normal images or images using compact indexes are not
+impacted.  Let's fix this now.
+
+[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com
+
+Reported-and-tested-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com
+Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter")
+Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support")
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Link: https://lore.kernel.org/r/20230410173714.104604-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zmap.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
+index 14d2de35110cc..f18194fd8d770 100644
+--- a/fs/erofs/zmap.c
++++ b/fs/erofs/zmap.c
+@@ -179,6 +179,10 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m,
+ 	case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN:
+ 	case Z_EROFS_VLE_CLUSTER_TYPE_HEAD:
+ 		m->clusterofs = le16_to_cpu(di->di_clusterofs);
++		if (m->clusterofs >= 1 << vi->z_logical_clusterbits) {
++			DBG_BUGON(1);
++			return -EFSCORRUPTED;
++		}
+ 		m->pblk = le32_to_cpu(di->di_u.blkaddr);
+ 		break;
+ 	default:
+-- 
+2.39.2
+
diff --git a/queue-5.10/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch b/queue-5.10/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch
new file mode 100644
index 00000000000..92eecaf43f7
--- /dev/null
+++ b/queue-5.10/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch
@@ -0,0 +1,94 @@
+From 78fd6f2245575dea11b2214acd7170937576c409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 11:16:27 +0000
+Subject: ext4: fix use-after-free read in ext4_find_extent for bigalloc +
+ inline
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 835659598c67907b98cd2aa57bb951dfaf675c69 ]
+
+Syzbot found the following issue:
+loop0: detected capacity change from 0 to 2048
+EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none.
+==================================================================
+BUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline]
+BUG: KASAN: use-after-free in ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931
+Read of size 4 at addr ffff888073644750 by task syz-executor420/5067
+
+CPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
+ print_address_description+0x74/0x340 mm/kasan/report.c:306
+ print_report+0x107/0x1f0 mm/kasan/report.c:417
+ kasan_report+0xcd/0x100 mm/kasan/report.c:517
+ ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline]
+ ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931
+ ext4_clu_mapped+0x117/0x970 fs/ext4/extents.c:5809
+ ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline]
+ ext4_da_map_blocks fs/ext4/inode.c:1806 [inline]
+ ext4_da_get_block_prep+0x9e8/0x13c0 fs/ext4/inode.c:1870
+ ext4_block_write_begin+0x6a8/0x2290 fs/ext4/inode.c:1098
+ ext4_da_write_begin+0x539/0x760 fs/ext4/inode.c:3082
+ generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772
+ ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285
+ ext4_file_write_iter+0x1d0/0x18f0
+ call_write_iter include/linux/fs.h:2186 [inline]
+ new_sync_write fs/read_write.c:491 [inline]
+ vfs_write+0x7dc/0xc50 fs/read_write.c:584
+ ksys_write+0x177/0x2a0 fs/read_write.c:637
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7f4b7a9737b9
+RSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9
+RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004
+RBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000
+R10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ </TASK>
+
+Above issue is happens when enable bigalloc and inline data feature. As
+commit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for
+bigalloc + inline. But it only resolved issue when has inline data, if
+inline data has been converted to extent(ext4_da_convert_inline_data_to_extent)
+before writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However
+i_data is still store inline data in this scene. Then will trigger UAF
+when find extent.
+To resolve above issue, there is need to add judge "ext4_has_inline_data(inode)"
+in ext4_clu_mapped().
+
+Fixes: 131294c35ed6 ("ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline")
+Reported-by: syzbot+bf4bb7731ef73b83a3b4@syzkaller.appspotmail.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Tested-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://lore.kernel.org/r/20230406111627.1916759-1-tudor.ambarus@linaro.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 6c06ce9dd6bd8..2c2e1cc43e0e8 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -5805,7 +5805,8 @@ int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu)
+ 	 * mapped - no physical clusters have been allocated, and the
+ 	 * file has no extents
+ 	 */
+-	if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
++	if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ||
++	    ext4_has_inline_data(inode))
+ 		return 0;
+ 
+ 	/* search for the extent closest to the first block in the cluster */
+-- 
+2.39.2
+
diff --git a/queue-5.10/f2fs-apply-zone-capacity-to-all-zone-type.patch b/queue-5.10/f2fs-apply-zone-capacity-to-all-zone-type.patch
new file mode 100644
index 00000000000..71d220b3625
--- /dev/null
+++ b/queue-5.10/f2fs-apply-zone-capacity-to-all-zone-type.patch
@@ -0,0 +1,140 @@
+From 5887a71b2bb8215728465490c9fafa1d31a8091d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 15:58:04 -0700
+Subject: f2fs: apply zone capacity to all zone type
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 0b37ed21e3367539b79284e0b0af2246ffcf0dca ]
+
+If we manage the zone capacity per zone type, it'll break the GC assumption.
+And, the current logic complains valid block count mismatch.
+Let's apply zone capacity to all zone type, if specified.
+
+Fixes: de881df97768 ("f2fs: support zone capacity less than zone size")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 65 +++--------------------------------------------
+ fs/f2fs/segment.h |  3 +++
+ 2 files changed, 7 insertions(+), 61 deletions(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 5305913fe0d58..a27a934292715 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -4957,48 +4957,6 @@ int f2fs_check_write_pointer(struct f2fs_sb_info *sbi)
+ 	return 0;
+ }
+ 
+-static bool is_conv_zone(struct f2fs_sb_info *sbi, unsigned int zone_idx,
+-						unsigned int dev_idx)
+-{
+-	if (!bdev_is_zoned(FDEV(dev_idx).bdev))
+-		return true;
+-	return !test_bit(zone_idx, FDEV(dev_idx).blkz_seq);
+-}
+-
+-/* Return the zone index in the given device */
+-static unsigned int get_zone_idx(struct f2fs_sb_info *sbi, unsigned int secno,
+-					int dev_idx)
+-{
+-	block_t sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno));
+-
+-	return (sec_start_blkaddr - FDEV(dev_idx).start_blk) >>
+-						sbi->log_blocks_per_blkz;
+-}
+-
+-/*
+- * Return the usable segments in a section based on the zone's
+- * corresponding zone capacity. Zone is equal to a section.
+- */
+-static inline unsigned int f2fs_usable_zone_segs_in_sec(
+-		struct f2fs_sb_info *sbi, unsigned int segno)
+-{
+-	unsigned int dev_idx, zone_idx;
+-
+-	dev_idx = f2fs_target_device_index(sbi, START_BLOCK(sbi, segno));
+-	zone_idx = get_zone_idx(sbi, GET_SEC_FROM_SEG(sbi, segno), dev_idx);
+-
+-	/* Conventional zone's capacity is always equal to zone size */
+-	if (is_conv_zone(sbi, zone_idx, dev_idx))
+-		return sbi->segs_per_sec;
+-
+-	if (!sbi->unusable_blocks_per_sec)
+-		return sbi->segs_per_sec;
+-
+-	/* Get the segment count beyond zone capacity block */
+-	return sbi->segs_per_sec - (sbi->unusable_blocks_per_sec >>
+-						sbi->log_blocks_per_seg);
+-}
+-
+ /*
+  * Return the number of usable blocks in a segment. The number of blocks
+  * returned is always equal to the number of blocks in a segment for
+@@ -5011,23 +4969,13 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg(
+ 			struct f2fs_sb_info *sbi, unsigned int segno)
+ {
+ 	block_t seg_start, sec_start_blkaddr, sec_cap_blkaddr;
+-	unsigned int zone_idx, dev_idx, secno;
+-
+-	secno = GET_SEC_FROM_SEG(sbi, segno);
+-	seg_start = START_BLOCK(sbi, segno);
+-	dev_idx = f2fs_target_device_index(sbi, seg_start);
+-	zone_idx = get_zone_idx(sbi, secno, dev_idx);
+-
+-	/*
+-	 * Conventional zone's capacity is always equal to zone size,
+-	 * so, blocks per segment is unchanged.
+-	 */
+-	if (is_conv_zone(sbi, zone_idx, dev_idx))
+-		return sbi->blocks_per_seg;
++	unsigned int secno;
+ 
+ 	if (!sbi->unusable_blocks_per_sec)
+ 		return sbi->blocks_per_seg;
+ 
++	secno = GET_SEC_FROM_SEG(sbi, segno);
++	seg_start = START_BLOCK(sbi, segno);
+ 	sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno));
+ 	sec_cap_blkaddr = sec_start_blkaddr + CAP_BLKS_PER_SEC(sbi);
+ 
+@@ -5061,11 +5009,6 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg(struct f2fs_sb_info *sbi
+ 	return 0;
+ }
+ 
+-static inline unsigned int f2fs_usable_zone_segs_in_sec(struct f2fs_sb_info *sbi,
+-							unsigned int segno)
+-{
+-	return 0;
+-}
+ #endif
+ unsigned int f2fs_usable_blks_in_seg(struct f2fs_sb_info *sbi,
+ 					unsigned int segno)
+@@ -5080,7 +5023,7 @@ unsigned int f2fs_usable_segs_in_sec(struct f2fs_sb_info *sbi,
+ 					unsigned int segno)
+ {
+ 	if (f2fs_sb_has_blkzoned(sbi))
+-		return f2fs_usable_zone_segs_in_sec(sbi, segno);
++		return CAP_SEGS_PER_SEC(sbi);
+ 
+ 	return sbi->segs_per_sec;
+ }
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index aca6c9a3aad0b..979296b835b5a 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -104,6 +104,9 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi,
+ #define CAP_BLKS_PER_SEC(sbi)					\
+ 	((sbi)->segs_per_sec * (sbi)->blocks_per_seg -		\
+ 	 (sbi)->unusable_blocks_per_sec)
++#define CAP_SEGS_PER_SEC(sbi)					\
++	((sbi)->segs_per_sec - ((sbi)->unusable_blocks_per_sec >>\
++	(sbi)->log_blocks_per_seg))
+ #define GET_SEC_FROM_SEG(sbi, segno)				\
+ 	(((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec)
+ #define GET_SEG_FROM_SEC(sbi, secno)				\
+-- 
+2.39.2
+
diff --git a/queue-5.10/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch b/queue-5.10/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch
new file mode 100644
index 00000000000..cc8711d646c
--- /dev/null
+++ b/queue-5.10/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch
@@ -0,0 +1,99 @@
+From 93fad640519b78b046d18dd2646afb75b02d250e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 01:22:18 +0800
+Subject: f2fs: compress: fix to call f2fs_wait_on_page_writeback() in
+ f2fs_write_raw_pages()
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit babedcbac164cec970872b8097401ca913a80e61 ]
+
+BUG_ON() will be triggered when writing files concurrently,
+because the same page is writtenback multiple times.
+
+1597 void folio_end_writeback(struct folio *folio)
+1598 {
+		......
+1618     if (!__folio_end_writeback(folio))
+1619         BUG();
+		......
+1625 }
+
+kernel BUG at mm/filemap.c:1619!
+Call Trace:
+ <TASK>
+ f2fs_write_end_io+0x1a0/0x370
+ blk_update_request+0x6c/0x410
+ blk_mq_end_request+0x15/0x130
+ blk_complete_reqs+0x3c/0x50
+ __do_softirq+0xb8/0x29b
+ ? sort_range+0x20/0x20
+ run_ksoftirqd+0x19/0x20
+ smpboot_thread_fn+0x10b/0x1d0
+ kthread+0xde/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+ </TASK>
+
+Below is the concurrency scenario:
+
+[Process A]		[Process B]		[Process C]
+f2fs_write_raw_pages()
+  - redirty_page_for_writepage()
+  - unlock page()
+			f2fs_do_write_data_page()
+			  - lock_page()
+			  - clear_page_dirty_for_io()
+			  - set_page_writeback() [1st writeback]
+			    .....
+			    - unlock page()
+
+						generic_perform_write()
+						  - f2fs_write_begin()
+						    - wait_for_stable_page()
+
+						  - f2fs_write_end()
+						    - set_page_dirty()
+
+  - lock_page()
+    - f2fs_do_write_data_page()
+      - set_page_writeback() [2st writeback]
+
+This problem was introduced by the previous commit 7377e853967b ("f2fs:
+compress: fix potential deadlock of compress file"). All pagelocks were
+released in f2fs_write_raw_pages(), but whether the page was
+in the writeback state was ignored in the subsequent writing process.
+Let's fix it by waiting for the page to writeback before writing.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Fixes: 7377e853967b ("f2fs: compress: fix potential deadlock of compress file")
+Signed-off-by: Qi Han <hanqi@vivo.com>
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 1541da5ace85e..1be9de40f0b5a 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1391,6 +1391,12 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ 		if (!PageDirty(cc->rpages[i]))
+ 			goto continue_unlock;
+ 
++		if (PageWriteback(cc->rpages[i])) {
++			if (wbc->sync_mode == WB_SYNC_NONE)
++				goto continue_unlock;
++			f2fs_wait_on_page_writeback(cc->rpages[i], DATA, true, true);
++		}
++
+ 		if (!clear_page_dirty_for_io(cc->rpages[i]))
+ 			goto continue_unlock;
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/f2fs-enforce-single-zone-capacity.patch b/queue-5.10/f2fs-enforce-single-zone-capacity.patch
new file mode 100644
index 00000000000..e56eb86886e
--- /dev/null
+++ b/queue-5.10/f2fs-enforce-single-zone-capacity.patch
@@ -0,0 +1,186 @@
+From 7d048a43dfcd2bcec5d2e613d5e8b360595c28f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jun 2022 10:57:24 -0700
+Subject: f2fs: enforce single zone capacity
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit b771aadc6e4c221a468fe4a2dfcfffec01a06722 ]
+
+In order to simplify the complicated per-zone capacity, let's support
+only one capacity for entire zoned device.
+
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: 0b37ed21e336 ("f2fs: apply zone capacity to all zone type")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h    |  2 +-
+ fs/f2fs/segment.c | 19 ++++++-------------
+ fs/f2fs/segment.h |  3 +++
+ fs/f2fs/super.c   | 33 ++++++++++++---------------------
+ 4 files changed, 22 insertions(+), 35 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index c03fdda1bddf6..62b7848f1f71e 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1153,7 +1153,6 @@ struct f2fs_dev_info {
+ #ifdef CONFIG_BLK_DEV_ZONED
+ 	unsigned int nr_blkz;		/* Total number of zones */
+ 	unsigned long *blkz_seq;	/* Bitmap indicating sequential zones */
+-	block_t *zone_capacity_blocks;  /* Array of zone capacity in blks */
+ #endif
+ };
+ 
+@@ -1422,6 +1421,7 @@ struct f2fs_sb_info {
+ 	unsigned int meta_ino_num;		/* meta inode number*/
+ 	unsigned int log_blocks_per_seg;	/* log2 blocks per segment */
+ 	unsigned int blocks_per_seg;		/* blocks per segment */
++	unsigned int unusable_blocks_per_sec;	/* unusable blocks per section */
+ 	unsigned int segs_per_sec;		/* segments per section */
+ 	unsigned int secs_per_zone;		/* sections per zone */
+ 	unsigned int total_sections;		/* total section count */
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 7c90d93f4e435..5305913fe0d58 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -4982,7 +4982,7 @@ static unsigned int get_zone_idx(struct f2fs_sb_info *sbi, unsigned int secno,
+ static inline unsigned int f2fs_usable_zone_segs_in_sec(
+ 		struct f2fs_sb_info *sbi, unsigned int segno)
+ {
+-	unsigned int dev_idx, zone_idx, unusable_segs_in_sec;
++	unsigned int dev_idx, zone_idx;
+ 
+ 	dev_idx = f2fs_target_device_index(sbi, START_BLOCK(sbi, segno));
+ 	zone_idx = get_zone_idx(sbi, GET_SEC_FROM_SEG(sbi, segno), dev_idx);
+@@ -4991,18 +4991,12 @@ static inline unsigned int f2fs_usable_zone_segs_in_sec(
+ 	if (is_conv_zone(sbi, zone_idx, dev_idx))
+ 		return sbi->segs_per_sec;
+ 
+-	/*
+-	 * If the zone_capacity_blocks array is NULL, then zone capacity
+-	 * is equal to the zone size for all zones
+-	 */
+-	if (!FDEV(dev_idx).zone_capacity_blocks)
++	if (!sbi->unusable_blocks_per_sec)
+ 		return sbi->segs_per_sec;
+ 
+ 	/* Get the segment count beyond zone capacity block */
+-	unusable_segs_in_sec = (sbi->blocks_per_blkz -
+-				FDEV(dev_idx).zone_capacity_blocks[zone_idx]) >>
+-				sbi->log_blocks_per_seg;
+-	return sbi->segs_per_sec - unusable_segs_in_sec;
++	return sbi->segs_per_sec - (sbi->unusable_blocks_per_sec >>
++						sbi->log_blocks_per_seg);
+ }
+ 
+ /*
+@@ -5031,12 +5025,11 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg(
+ 	if (is_conv_zone(sbi, zone_idx, dev_idx))
+ 		return sbi->blocks_per_seg;
+ 
+-	if (!FDEV(dev_idx).zone_capacity_blocks)
++	if (!sbi->unusable_blocks_per_sec)
+ 		return sbi->blocks_per_seg;
+ 
+ 	sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno));
+-	sec_cap_blkaddr = sec_start_blkaddr +
+-				FDEV(dev_idx).zone_capacity_blocks[zone_idx];
++	sec_cap_blkaddr = sec_start_blkaddr + CAP_BLKS_PER_SEC(sbi);
+ 
+ 	/*
+ 	 * If segment starts before zone capacity and spans beyond
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index eafd89f0c77e8..aca6c9a3aad0b 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -101,6 +101,9 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi,
+ 		GET_SEGNO_FROM_SEG0(sbi, blk_addr)))
+ #define BLKS_PER_SEC(sbi)					\
+ 	((sbi)->segs_per_sec * (sbi)->blocks_per_seg)
++#define CAP_BLKS_PER_SEC(sbi)					\
++	((sbi)->segs_per_sec * (sbi)->blocks_per_seg -		\
++	 (sbi)->unusable_blocks_per_sec)
+ #define GET_SEC_FROM_SEG(sbi, segno)				\
+ 	(((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec)
+ #define GET_SEG_FROM_SEC(sbi, secno)				\
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 0bba5c72fc77e..9a74d60f61dba 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1242,7 +1242,6 @@ static void destroy_device_list(struct f2fs_sb_info *sbi)
+ 		blkdev_put(FDEV(i).bdev, FMODE_EXCL);
+ #ifdef CONFIG_BLK_DEV_ZONED
+ 		kvfree(FDEV(i).blkz_seq);
+-		kfree(FDEV(i).zone_capacity_blocks);
+ #endif
+ 	}
+ 	kvfree(sbi->devs);
+@@ -3199,24 +3198,29 @@ static int init_percpu_info(struct f2fs_sb_info *sbi)
+ #ifdef CONFIG_BLK_DEV_ZONED
+ 
+ struct f2fs_report_zones_args {
++	struct f2fs_sb_info *sbi;
+ 	struct f2fs_dev_info *dev;
+-	bool zone_cap_mismatch;
+ };
+ 
+ static int f2fs_report_zone_cb(struct blk_zone *zone, unsigned int idx,
+ 			      void *data)
+ {
+ 	struct f2fs_report_zones_args *rz_args = data;
++	block_t unusable_blocks = (zone->len - zone->capacity) >>
++					F2FS_LOG_SECTORS_PER_BLOCK;
+ 
+ 	if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
+ 		return 0;
+ 
+ 	set_bit(idx, rz_args->dev->blkz_seq);
+-	rz_args->dev->zone_capacity_blocks[idx] = zone->capacity >>
+-						F2FS_LOG_SECTORS_PER_BLOCK;
+-	if (zone->len != zone->capacity && !rz_args->zone_cap_mismatch)
+-		rz_args->zone_cap_mismatch = true;
+-
++	if (!rz_args->sbi->unusable_blocks_per_sec) {
++		rz_args->sbi->unusable_blocks_per_sec = unusable_blocks;
++		return 0;
++	}
++	if (rz_args->sbi->unusable_blocks_per_sec != unusable_blocks) {
++		f2fs_err(rz_args->sbi, "F2FS supports single zone capacity\n");
++		return -EINVAL;
++	}
+ 	return 0;
+ }
+ 
+@@ -3250,26 +3254,13 @@ static int init_blkz_info(struct f2fs_sb_info *sbi, int devi)
+ 	if (!FDEV(devi).blkz_seq)
+ 		return -ENOMEM;
+ 
+-	/* Get block zones type and zone-capacity */
+-	FDEV(devi).zone_capacity_blocks = f2fs_kzalloc(sbi,
+-					FDEV(devi).nr_blkz * sizeof(block_t),
+-					GFP_KERNEL);
+-	if (!FDEV(devi).zone_capacity_blocks)
+-		return -ENOMEM;
+-
++	rep_zone_arg.sbi = sbi;
+ 	rep_zone_arg.dev = &FDEV(devi);
+-	rep_zone_arg.zone_cap_mismatch = false;
+ 
+ 	ret = blkdev_report_zones(bdev, 0, BLK_ALL_ZONES, f2fs_report_zone_cb,
+ 				  &rep_zone_arg);
+ 	if (ret < 0)
+ 		return ret;
+-
+-	if (!rep_zone_arg.zone_cap_mismatch) {
+-		kfree(FDEV(devi).zone_capacity_blocks);
+-		FDEV(devi).zone_capacity_blocks = NULL;
+-	}
+-
+ 	return 0;
+ }
+ #endif
+-- 
+2.39.2
+
diff --git a/queue-5.10/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch b/queue-5.10/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch
new file mode 100644
index 00000000000..da06c00249d
--- /dev/null
+++ b/queue-5.10/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch
@@ -0,0 +1,76 @@
+From 0d97b1c80eb3b90751903cd42a38009d3e0812fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 10:14:02 +0800
+Subject: f2fs: fix to avoid use-after-free for cached IPU bio
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 5cdb422c839134273866208dad5360835ddb9794 ]
+
+xfstest generic/019 reports a bug:
+
+kernel BUG at mm/filemap.c:1619!
+RIP: 0010:folio_end_writeback+0x8a/0x90
+Call Trace:
+ end_page_writeback+0x1c/0x60
+ f2fs_write_end_io+0x199/0x420
+ bio_endio+0x104/0x180
+ submit_bio_noacct+0xa5/0x510
+ submit_bio+0x48/0x80
+ f2fs_submit_write_bio+0x35/0x300
+ f2fs_submit_merged_ipu_write+0x2a0/0x2b0
+ f2fs_write_single_data_page+0x838/0x8b0
+ f2fs_write_cache_pages+0x379/0xa30
+ f2fs_write_data_pages+0x30c/0x340
+ do_writepages+0xd8/0x1b0
+ __writeback_single_inode+0x44/0x370
+ writeback_sb_inodes+0x233/0x4d0
+ __writeback_inodes_wb+0x56/0xf0
+ wb_writeback+0x1dd/0x2d0
+ wb_workfn+0x367/0x4a0
+ process_one_work+0x21d/0x430
+ worker_thread+0x4e/0x3c0
+ kthread+0x103/0x130
+ ret_from_fork+0x2c/0x50
+
+The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write()
+in f2fs_write_single_data_page() tries to flush IPU bio in cache, however
+f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter,
+result in submitting random cached bio which belong to other IO context,
+then it will cause use-after-free issue, fix it by adding additional
+validity check.
+
+Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index db26e87b8f0dd..e9481c940895c 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -849,6 +849,8 @@ void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
+ 	bool found = false;
+ 	struct bio *target = bio ? *bio : NULL;
+ 
++	f2fs_bug_on(sbi, !target && !page);
++
+ 	for (temp = HOT; temp < NR_TEMP_TYPE && !found; temp++) {
+ 		struct f2fs_bio_info *io = sbi->write_io[DATA] + temp;
+ 		struct list_head *head = &io->bio_list;
+@@ -2917,7 +2919,8 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ 
+ 	if (unlikely(f2fs_cp_error(sbi))) {
+ 		f2fs_submit_merged_write(sbi, DATA);
+-		f2fs_submit_merged_ipu_write(sbi, bio, NULL);
++		if (bio && *bio)
++			f2fs_submit_merged_ipu_write(sbi, bio, NULL);
+ 		submitted = NULL;
+ 	}
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch b/queue-5.10/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch
new file mode 100644
index 00000000000..fc09926c626
--- /dev/null
+++ b/queue-5.10/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch
@@ -0,0 +1,50 @@
+From f6b4dc16ac5103c67349f30e1fc722759ef510fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Feb 2023 22:45:50 +0800
+Subject: f2fs: handle dqget error in f2fs_transfer_project_quota()
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit 8051692f5f23260215bfe9a72e712d93606acc5f ]
+
+We should set the error code when dqget() failed.
+
+Fixes: 2c1d03056991 ("f2fs: support F2FS_IOC_FS{GET,SET}XATTR")
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index d56fcace18211..a0d8aa52b696b 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3013,15 +3013,16 @@ int f2fs_transfer_project_quota(struct inode *inode, kprojid_t kprojid)
+ 	struct dquot *transfer_to[MAXQUOTAS] = {};
+ 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ 	struct super_block *sb = sbi->sb;
+-	int err = 0;
++	int err;
+ 
+ 	transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid));
+-	if (!IS_ERR(transfer_to[PRJQUOTA])) {
+-		err = __dquot_transfer(inode, transfer_to);
+-		if (err)
+-			set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
+-		dqput(transfer_to[PRJQUOTA]);
+-	}
++	if (IS_ERR(transfer_to[PRJQUOTA]))
++		return PTR_ERR(transfer_to[PRJQUOTA]);
++
++	err = __dquot_transfer(inode, transfer_to);
++	if (err)
++		set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
++	dqput(transfer_to[PRJQUOTA]);
+ 	return err;
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/firmware-qcom_scm-clear-download-bit-during-reboot.patch b/queue-5.10/firmware-qcom_scm-clear-download-bit-during-reboot.patch
new file mode 100644
index 00000000000..cb91fab3e85
--- /dev/null
+++ b/queue-5.10/firmware-qcom_scm-clear-download-bit-during-reboot.patch
@@ -0,0 +1,39 @@
+From fe1501910f3b8a4737939fd946336447e7ae04c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 20:44:26 +0530
+Subject: firmware: qcom_scm: Clear download bit during reboot
+
+From: Mukesh Ojha <quic_mojha@quicinc.com>
+
+[ Upstream commit 781d32d1c9709fd25655c4e3e3e15370ae4ae4db ]
+
+During normal restart of a system download bit should
+be cleared irrespective of whether download mode is
+set or not.
+
+Fixes: 8c1b7dc9ba22 ("firmware: qcom: scm: Expose download-mode control")
+Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/1678979666-551-1-git-send-email-quic_mojha@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index d417199f8fe94..96086e7df9100 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -1256,8 +1256,7 @@ static int qcom_scm_probe(struct platform_device *pdev)
+ static void qcom_scm_shutdown(struct platform_device *pdev)
+ {
+ 	/* Clean shutdown, disable download mode to allow normal restart */
+-	if (download_mode)
+-		qcom_scm_set_download_mode(false);
++	qcom_scm_set_download_mode(false);
+ }
+ 
+ static const struct of_device_id qcom_scm_dt_match[] = {
+-- 
+2.39.2
+
diff --git a/queue-5.10/firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch b/queue-5.10/firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch
new file mode 100644
index 00000000000..588ce67b4f8
--- /dev/null
+++ b/queue-5.10/firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch
@@ -0,0 +1,98 @@
+From 9304d2965847fa6faadfc90c837245864a4a7203 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 13:32:35 +0100
+Subject: firmware: raspberrypi: Introduce devm_rpi_firmware_get()
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit f663204c9a1f8d6fcc590667d9d7a9f44e064644 ]
+
+It'll simplify the firmware handling for most consumers.
+
+Suggested-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Stable-dep-of: 5bca3688bdbc ("Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/raspberrypi.c             | 29 ++++++++++++++++++++++
+ include/soc/bcm2835/raspberrypi-firmware.h |  8 ++++++
+ 2 files changed, 37 insertions(+)
+
+diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
+index 9eef49da47e04..45ff03da234a6 100644
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -243,6 +243,13 @@ void rpi_firmware_put(struct rpi_firmware *fw)
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_put);
+ 
++static void devm_rpi_firmware_put(void *data)
++{
++	struct rpi_firmware *fw = data;
++
++	rpi_firmware_put(fw);
++}
++
+ static int rpi_firmware_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -338,6 +345,28 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_get);
+ 
++/**
++ * devm_rpi_firmware_get - Get pointer to rpi_firmware structure.
++ * @firmware_node:    Pointer to the firmware Device Tree node.
++ *
++ * Returns NULL is the firmware device is not ready.
++ */
++struct rpi_firmware *devm_rpi_firmware_get(struct device *dev,
++					   struct device_node *firmware_node)
++{
++	struct rpi_firmware *fw;
++
++	fw = rpi_firmware_get(firmware_node);
++	if (!fw)
++		return NULL;
++
++	if (devm_add_action_or_reset(dev, devm_rpi_firmware_put, fw))
++		return NULL;
++
++	return fw;
++}
++EXPORT_SYMBOL_GPL(devm_rpi_firmware_get);
++
+ static const struct of_device_id rpi_firmware_of_match[] = {
+ 	{ .compatible = "raspberrypi,bcm2835-firmware", },
+ 	{},
+diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
+index fdfef7fe40df9..73ad784fca966 100644
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -142,6 +142,8 @@ int rpi_firmware_property_list(struct rpi_firmware *fw,
+ 			       void *data, size_t tag_size);
+ void rpi_firmware_put(struct rpi_firmware *fw);
+ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);
++struct rpi_firmware *devm_rpi_firmware_get(struct device *dev,
++					   struct device_node *firmware_node);
+ #else
+ static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag,
+ 					void *data, size_t len)
+@@ -160,6 +162,12 @@ static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware
+ {
+ 	return NULL;
+ }
++
++static inline struct rpi_firmware *devm_rpi_firmware_get(struct device *dev,
++					struct device_node *firmware_node)
++{
++	return NULL;
++}
+ #endif
+ 
+ #endif /* __SOC_RASPBERRY_FIRMWARE_H__ */
+-- 
+2.39.2
+
diff --git a/queue-5.10/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch b/queue-5.10/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch
new file mode 100644
index 00000000000..827da1ec26c
--- /dev/null
+++ b/queue-5.10/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch
@@ -0,0 +1,39 @@
+From 04f261fccb04daca209aed2c67f5e264dab18113 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 17:27:03 +0300
+Subject: firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit e1d6ca042e62c2a69513235f8629eb6e62ca79c5 ]
+
+The svc_create_memory_pool() function returns error pointers.  It never
+returns NULL.  Fix the check.
+
+Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/5f9a8cb4-5a4f-460b-9cdc-2fae6c5b7922@kili.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/stratix10-svc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
+index 7dd0ac1a0cfc7..78a446cb43486 100644
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -989,8 +989,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
+ 		return ret;
+ 
+ 	genpool = svc_create_memory_pool(pdev, sh_memory);
+-	if (!genpool)
+-		return -ENOMEM;
++	if (IS_ERR(genpool))
++		return PTR_ERR(genpool);
+ 
+ 	/* allocate service controller and supporting channel */
+ 	controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL);
+-- 
+2.39.2
+
diff --git a/queue-5.10/fpga-bridge-fix-kernel-doc-parameter-description.patch b/queue-5.10/fpga-bridge-fix-kernel-doc-parameter-description.patch
new file mode 100644
index 00000000000..a3547d9b7fd
--- /dev/null
+++ b/queue-5.10/fpga-bridge-fix-kernel-doc-parameter-description.patch
@@ -0,0 +1,39 @@
+From 36b0ab7f934f1b2893ce146c7b8a176bbf8b8da6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 15:03:08 +0100
+Subject: fpga: bridge: fix kernel-doc parameter description
+
+From: Marco Pagani <marpagan@redhat.com>
+
+[ Upstream commit 7ef1a2c1c9dffa177ecc3ea50b7f5ee63a621137 ]
+
+Fix the kernel-doc description for the "struct fpga_image_info *info"
+parameter of the fpga_bridge_get() function.
+
+Fixes: 060ac5c8fa7b ("fpga: bridge: kernel-doc fixes")
+Signed-off-by: Marco Pagani <marpagan@redhat.com>
+Reviewed-by: Tom Rix <trix@redhat.com>
+Acked-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/20230301140309.512578-1-marpagan@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/fpga-bridge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c
+index 2deccacc3aa75..851debe32bf0f 100644
+--- a/drivers/fpga/fpga-bridge.c
++++ b/drivers/fpga/fpga-bridge.c
+@@ -115,7 +115,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data)
+ /**
+  * fpga_bridge_get - get an exclusive reference to a fpga bridge
+  * @dev:	parent device that fpga bridge was registered with
+- * @info:	fpga manager info
++ * @info:	fpga image specific information
+  *
+  * Given a device, get an exclusive reference to a fpga bridge.
+  *
+-- 
+2.39.2
+
diff --git a/queue-5.10/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch b/queue-5.10/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch
new file mode 100644
index 00000000000..c96abea78c1
--- /dev/null
+++ b/queue-5.10/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch
@@ -0,0 +1,46 @@
+From ee9271589f808fe83949b89117e1b684218a04bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 19:10:21 -0700
+Subject: i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error
+ path
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit ae1664f04f504a998737f5bb563f16b44357bcca ]
+
+The cdns_i2c_master_xfer() function gets a runtime PM reference when the
+function is entered. This reference is released when the function is
+exited. There is currently one error path where the function exits
+directly, which leads to a leak of the runtime PM reference.
+
+Make sure that this error path also releases the runtime PM reference.
+
+Fixes: 1a351b10b967 ("i2c: cadence: Added slave support")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Reviewed-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-cadence.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index 50928216b3f28..24987902ca590 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -792,8 +792,10 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
+ #if IS_ENABLED(CONFIG_I2C_SLAVE)
+ 	/* Check i2c operating mode and switch if possible */
+ 	if (id->dev_mode == CDNS_I2C_MODE_SLAVE) {
+-		if (id->slave_state != CDNS_I2C_SLAVE_STATE_IDLE)
+-			return -EAGAIN;
++		if (id->slave_state != CDNS_I2C_SLAVE_STATE_IDLE) {
++			ret = -EAGAIN;
++			goto out;
++		}
+ 
+ 		/* Set mode to master */
+ 		cdns_i2c_set_mode(CDNS_I2C_MODE_MASTER, id);
+-- 
+2.39.2
+
diff --git a/queue-5.10/ia64-mm-contig-fix-section-mismatch-warning-error.patch b/queue-5.10/ia64-mm-contig-fix-section-mismatch-warning-error.patch
new file mode 100644
index 00000000000..2716f98ac10
--- /dev/null
+++ b/queue-5.10/ia64-mm-contig-fix-section-mismatch-warning-error.patch
@@ -0,0 +1,41 @@
+From c5a26b65f03ba4a0e3f073bab640b0d3d732830c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 19:42:58 -0800
+Subject: ia64: mm/contig: fix section mismatch warning/error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 58deeb4ef3b054498747d0929d94ac53ab90981f ]
+
+alloc_per_cpu_data() is called by find_memory(), which is marked as
+__init.  Therefore alloc_per_cpu_data() can also be marked as __init to
+remedy this modpost problem.
+
+WARNING: modpost: vmlinux.o: section mismatch in reference: alloc_per_cpu_data (section: .text) -> memblock_alloc_try_nid (section: .init.text)
+
+Link: https://lkml.kernel.org/r/20230223034258.12917-1-rdunlap@infradead.org
+Fixes: 4b9ddc7cf272 ("[IA64] Fix section mismatch in contig.c version of per_cpu_init()")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/mm/contig.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
+index e30e360beef84..c638e012ad051 100644
+--- a/arch/ia64/mm/contig.c
++++ b/arch/ia64/mm/contig.c
+@@ -79,7 +79,7 @@ void *per_cpu_init(void)
+ 	return __per_cpu_start + __per_cpu_offset[smp_processor_id()];
+ }
+ 
+-static inline void
++static inline __init void
+ alloc_per_cpu_data(void)
+ {
+ 	size_t size = PERCPU_PAGE_SIZE * num_possible_cpus();
+-- 
+2.39.2
+
diff --git a/queue-5.10/ia64-salinfo-placate-defined-but-not-used-warning.patch b/queue-5.10/ia64-salinfo-placate-defined-but-not-used-warning.patch
new file mode 100644
index 00000000000..6bd09624377
--- /dev/null
+++ b/queue-5.10/ia64-salinfo-placate-defined-but-not-used-warning.patch
@@ -0,0 +1,42 @@
+From cac0c9eb3eda40db6eba7d6f6a5d6617eb2dd54b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 19:43:09 -0800
+Subject: ia64: salinfo: placate defined-but-not-used warning
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 0de155752b152d6bcd96b5b5bf20af336abd183a ]
+
+When CONFIG_PROC_FS is not set, proc_salinfo_show() is not used.  Mark the
+function as __maybe_unused to quieten the warning message.
+
+../arch/ia64/kernel/salinfo.c:584:12: warning: 'proc_salinfo_show' defined but not used [-Wunused-function]
+  584 | static int proc_salinfo_show(struct seq_file *m, void *v)
+      |            ^~~~~~~~~~~~~~~~~
+
+Link: https://lkml.kernel.org/r/20230223034309.13375-1-rdunlap@infradead.org
+Fixes: 3f3942aca6da ("proc: introduce proc_create_single{,_data}")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/salinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c
+index a25ab9b37953e..bb99b543dc672 100644
+--- a/arch/ia64/kernel/salinfo.c
++++ b/arch/ia64/kernel/salinfo.c
+@@ -581,7 +581,7 @@ static int salinfo_cpu_pre_down(unsigned int cpu)
+  * 'data' contains an integer that corresponds to the feature we're
+  * testing
+  */
+-static int proc_salinfo_show(struct seq_file *m, void *v)
++static int __maybe_unused proc_salinfo_show(struct seq_file *m, void *v)
+ {
+ 	unsigned long data = (unsigned long)v;
+ 	seq_puts(m, (sal_platform_features & data) ? "1\n" : "0\n");
+-- 
+2.39.2
+
diff --git a/queue-5.10/ib-hfi1-add-additional-usdma-traces.patch b/queue-5.10/ib-hfi1-add-additional-usdma-traces.patch
new file mode 100644
index 00000000000..8e2578afa19
--- /dev/null
+++ b/queue-5.10/ib-hfi1-add-additional-usdma-traces.patch
@@ -0,0 +1,176 @@
+From e4363883eba786df4b7005bda6af6f862a21a359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 09:54:13 -0400
+Subject: IB/hfi1: Add additional usdma traces
+
+From: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+
+[ Upstream commit 6b13215df1d37f5be23fc4a01a915a287b25ce15 ]
+
+Add traces that were vital in isolating an issue with pq waitlist in
+commit fa8dac396863 ("IB/hfi1: Fix another case where pq is left on
+waitlist")
+
+Link: https://lore.kernel.org/r/1617026056-50483-8-git-send-email-dennis.dalessandro@cornelisnetworks.com
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 00cbce5cbf88 ("IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/trace_tx.h  | 75 ++++++++++++++++++++++++++
+ drivers/infiniband/hw/hfi1/user_sdma.c | 12 +++--
+ drivers/infiniband/hw/hfi1/user_sdma.h |  1 +
+ 3 files changed, 85 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/trace_tx.h b/drivers/infiniband/hw/hfi1/trace_tx.h
+index 847654196dd34..d44fc54858b90 100644
+--- a/drivers/infiniband/hw/hfi1/trace_tx.h
++++ b/drivers/infiniband/hw/hfi1/trace_tx.h
+@@ -54,6 +54,7 @@
+ #include "mad.h"
+ #include "sdma.h"
+ #include "ipoib.h"
++#include "user_sdma.h"
+ 
+ const char *parse_sdma_flags(struct trace_seq *p, u64 desc0, u64 desc1);
+ 
+@@ -654,6 +655,80 @@ TRACE_EVENT(hfi1_sdma_user_completion,
+ 		      __entry->code)
+ );
+ 
++TRACE_EVENT(hfi1_usdma_defer,
++	    TP_PROTO(struct hfi1_user_sdma_pkt_q *pq,
++		     struct sdma_engine *sde,
++		     struct iowait *wait),
++	    TP_ARGS(pq, sde, wait),
++	    TP_STRUCT__entry(DD_DEV_ENTRY(pq->dd)
++			     __field(struct hfi1_user_sdma_pkt_q *, pq)
++			     __field(struct sdma_engine *, sde)
++			     __field(struct iowait *, wait)
++			     __field(int, engine)
++			     __field(int, empty)
++			     ),
++	     TP_fast_assign(DD_DEV_ASSIGN(pq->dd);
++			    __entry->pq = pq;
++			    __entry->sde = sde;
++			    __entry->wait = wait;
++			    __entry->engine = sde->this_idx;
++			    __entry->empty = list_empty(&__entry->wait->list);
++			    ),
++	     TP_printk("[%s] pq %llx sde %llx wait %llx engine %d empty %d",
++		       __get_str(dev),
++		       (unsigned long long)__entry->pq,
++		       (unsigned long long)__entry->sde,
++		       (unsigned long long)__entry->wait,
++		       __entry->engine,
++		       __entry->empty
++		)
++);
++
++TRACE_EVENT(hfi1_usdma_activate,
++	    TP_PROTO(struct hfi1_user_sdma_pkt_q *pq,
++		     struct iowait *wait,
++		     int reason),
++	    TP_ARGS(pq, wait, reason),
++	    TP_STRUCT__entry(DD_DEV_ENTRY(pq->dd)
++			     __field(struct hfi1_user_sdma_pkt_q *, pq)
++			     __field(struct iowait *, wait)
++			     __field(int, reason)
++			     ),
++	     TP_fast_assign(DD_DEV_ASSIGN(pq->dd);
++			    __entry->pq = pq;
++			    __entry->wait = wait;
++			    __entry->reason = reason;
++			    ),
++	     TP_printk("[%s] pq %llx wait %llx reason %d",
++		       __get_str(dev),
++		       (unsigned long long)__entry->pq,
++		       (unsigned long long)__entry->wait,
++		       __entry->reason
++		)
++);
++
++TRACE_EVENT(hfi1_usdma_we,
++	    TP_PROTO(struct hfi1_user_sdma_pkt_q *pq,
++		     int we_ret),
++	    TP_ARGS(pq, we_ret),
++	    TP_STRUCT__entry(DD_DEV_ENTRY(pq->dd)
++			     __field(struct hfi1_user_sdma_pkt_q *, pq)
++			     __field(int, state)
++			     __field(int, we_ret)
++			     ),
++	     TP_fast_assign(DD_DEV_ASSIGN(pq->dd);
++			    __entry->pq = pq;
++			    __entry->state = pq->state;
++			    __entry->we_ret = we_ret;
++			    ),
++	     TP_printk("[%s] pq %llx state %d we_ret %d",
++		       __get_str(dev),
++		       (unsigned long long)__entry->pq,
++		       __entry->state,
++		       __entry->we_ret
++		)
++);
++
+ const char *print_u32_array(struct trace_seq *, u32 *, int);
+ #define __print_u32_hex(arr, len) print_u32_array(p, arr, len)
+ 
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index 4a4956f96a7eb..da5b2e37355ab 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -133,6 +133,7 @@ static int defer_packet_queue(
+ 		container_of(wait->iow, struct hfi1_user_sdma_pkt_q, busy);
+ 
+ 	write_seqlock(&sde->waitlock);
++	trace_hfi1_usdma_defer(pq, sde, &pq->busy);
+ 	if (sdma_progress(sde, seq, txreq))
+ 		goto eagain;
+ 	/*
+@@ -157,7 +158,8 @@ static void activate_packet_queue(struct iowait *wait, int reason)
+ {
+ 	struct hfi1_user_sdma_pkt_q *pq =
+ 		container_of(wait, struct hfi1_user_sdma_pkt_q, busy);
+-	pq->busy.lock = NULL;
++
++	trace_hfi1_usdma_activate(pq, wait, reason);
+ 	xchg(&pq->state, SDMA_PKT_Q_ACTIVE);
+ 	wake_up(&wait->wait_dma);
+ };
+@@ -599,13 +601,17 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ 	while (req->seqsubmitted != req->info.npkts) {
+ 		ret = user_sdma_send_pkts(req, pcount);
+ 		if (ret < 0) {
++			int we_ret;
++
+ 			if (ret != -EBUSY)
+ 				goto free_req;
+-			if (wait_event_interruptible_timeout(
++			we_ret = wait_event_interruptible_timeout(
+ 				pq->busy.wait_dma,
+ 				pq->state == SDMA_PKT_Q_ACTIVE,
+ 				msecs_to_jiffies(
+-					SDMA_IOWAIT_TIMEOUT)) <= 0)
++					SDMA_IOWAIT_TIMEOUT));
++			trace_hfi1_usdma_we(pq, we_ret);
++			if (we_ret <= 0)
+ 				flush_pq_iowait(pq);
+ 		}
+ 	}
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
+index 1e8c02fe8ad1d..fabe581399068 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.h
++++ b/drivers/infiniband/hw/hfi1/user_sdma.h
+@@ -53,6 +53,7 @@
+ #include "common.h"
+ #include "iowait.h"
+ #include "user_exp_rcv.h"
++#include "mmu_rb.h"
+ 
+ /* The maximum number of Data io vectors per message/request */
+ #define MAX_VECTORS_PER_REQ 8
+-- 
+2.39.2
+
diff --git a/queue-5.10/ib-hfi1-add-aip-tx-traces.patch b/queue-5.10/ib-hfi1-add-aip-tx-traces.patch
new file mode 100644
index 00000000000..6ca3653d009
--- /dev/null
+++ b/queue-5.10/ib-hfi1-add-aip-tx-traces.patch
@@ -0,0 +1,235 @@
+From 46c35927b13beb4e1277319fd3b0851e2c2fbd02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 09:54:07 -0400
+Subject: IB/hfi1: Add AIP tx traces
+
+From: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+
+[ Upstream commit 4bd00b55c978017aad10f0ff3e45525cd62cca07 ]
+
+Add traces to allow for debugging issues with AIP tx.
+
+Link: https://lore.kernel.org/r/1617026056-50483-2-git-send-email-dennis.dalessandro@cornelisnetworks.com
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 00cbce5cbf88 ("IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/ipoib_tx.c |  18 ++++-
+ drivers/infiniband/hw/hfi1/trace_tx.h | 104 ++++++++++++++++++++++++++
+ 2 files changed, 119 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+index ab1eefffc14b3..ec187ec746749 100644
+--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+@@ -15,6 +15,7 @@
+ #include "verbs.h"
+ #include "trace_ibhdrs.h"
+ #include "ipoib.h"
++#include "trace_tx.h"
+ 
+ /* Add a convenience helper */
+ #define CIRC_ADD(val, add, size) (((val) + (add)) & ((size) - 1))
+@@ -63,12 +64,14 @@ static u64 hfi1_ipoib_used(struct hfi1_ipoib_txq *txq)
+ 
+ static void hfi1_ipoib_stop_txq(struct hfi1_ipoib_txq *txq)
+ {
++	trace_hfi1_txq_stop(txq);
+ 	if (atomic_inc_return(&txq->stops) == 1)
+ 		netif_stop_subqueue(txq->priv->netdev, txq->q_idx);
+ }
+ 
+ static void hfi1_ipoib_wake_txq(struct hfi1_ipoib_txq *txq)
+ {
++	trace_hfi1_txq_wake(txq);
+ 	if (atomic_dec_and_test(&txq->stops))
+ 		netif_wake_subqueue(txq->priv->netdev, txq->q_idx);
+ }
+@@ -89,8 +92,10 @@ static void hfi1_ipoib_check_queue_depth(struct hfi1_ipoib_txq *txq)
+ {
+ 	++txq->sent_txreqs;
+ 	if (hfi1_ipoib_used(txq) >= hfi1_ipoib_ring_hwat(txq) &&
+-	    !atomic_xchg(&txq->ring_full, 1))
++	    !atomic_xchg(&txq->ring_full, 1)) {
++		trace_hfi1_txq_full(txq);
+ 		hfi1_ipoib_stop_txq(txq);
++	}
+ }
+ 
+ static void hfi1_ipoib_check_queue_stopped(struct hfi1_ipoib_txq *txq)
+@@ -112,8 +117,10 @@ static void hfi1_ipoib_check_queue_stopped(struct hfi1_ipoib_txq *txq)
+ 	 * to protect against ring overflow.
+ 	 */
+ 	if (hfi1_ipoib_used(txq) < hfi1_ipoib_ring_lwat(txq) &&
+-	    atomic_xchg(&txq->ring_full, 0))
++	    atomic_xchg(&txq->ring_full, 0)) {
++		trace_hfi1_txq_xmit_unstopped(txq);
+ 		hfi1_ipoib_wake_txq(txq);
++	}
+ }
+ 
+ static void hfi1_ipoib_free_tx(struct ipoib_txreq *tx, int budget)
+@@ -405,6 +412,7 @@ static struct ipoib_txreq *hfi1_ipoib_send_dma_common(struct net_device *dev,
+ 				sdma_select_engine_sc(priv->dd,
+ 						      txp->flow.tx_queue,
+ 						      txp->flow.sc5);
++			trace_hfi1_flow_switch(txp->txq);
+ 		}
+ 
+ 		return tx;
+@@ -525,6 +533,7 @@ static int hfi1_ipoib_send_dma_list(struct net_device *dev,
+ 	if (txq->flow.as_int != txp->flow.as_int) {
+ 		int ret;
+ 
++		trace_hfi1_flow_flush(txq);
+ 		ret = hfi1_ipoib_flush_tx_list(dev, txq);
+ 		if (unlikely(ret)) {
+ 			if (ret == -EBUSY)
+@@ -635,8 +644,10 @@ static int hfi1_ipoib_sdma_sleep(struct sdma_engine *sde,
+ 			/* came from non-list submit */
+ 			list_add_tail(&txreq->list, &txq->tx_list);
+ 		if (list_empty(&txq->wait.list)) {
+-			if (!atomic_xchg(&txq->no_desc, 1))
++			if (!atomic_xchg(&txq->no_desc, 1)) {
++				trace_hfi1_txq_queued(txq);
+ 				hfi1_ipoib_stop_txq(txq);
++			}
+ 			iowait_queue(pkts_sent, wait->iow, &sde->dmawait);
+ 		}
+ 
+@@ -659,6 +670,7 @@ static void hfi1_ipoib_sdma_wakeup(struct iowait *wait, int reason)
+ 	struct hfi1_ipoib_txq *txq =
+ 		container_of(wait, struct hfi1_ipoib_txq, wait);
+ 
++	trace_hfi1_txq_wakeup(txq);
+ 	if (likely(txq->priv->netdev->reg_state == NETREG_REGISTERED))
+ 		iowait_schedule(wait, system_highpri_wq, WORK_CPU_UNBOUND);
+ }
+diff --git a/drivers/infiniband/hw/hfi1/trace_tx.h b/drivers/infiniband/hw/hfi1/trace_tx.h
+index 769e5e4710c64..847654196dd34 100644
+--- a/drivers/infiniband/hw/hfi1/trace_tx.h
++++ b/drivers/infiniband/hw/hfi1/trace_tx.h
+@@ -53,6 +53,7 @@
+ #include "hfi.h"
+ #include "mad.h"
+ #include "sdma.h"
++#include "ipoib.h"
+ 
+ const char *parse_sdma_flags(struct trace_seq *p, u64 desc0, u64 desc1);
+ 
+@@ -858,6 +859,109 @@ DEFINE_EVENT(
+ 	TP_ARGS(qp, flag)
+ );
+ 
++DECLARE_EVENT_CLASS(/* AIP  */
++	hfi1_ipoib_txq_template,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq),
++	TP_STRUCT__entry(/* entry */
++		DD_DEV_ENTRY(txq->priv->dd)
++		__field(struct hfi1_ipoib_txq *, txq)
++		__field(struct sdma_engine *, sde)
++		__field(ulong, head)
++		__field(ulong, tail)
++		__field(uint, used)
++		__field(uint, flow)
++		__field(int, stops)
++		__field(int, no_desc)
++		__field(u8, idx)
++		__field(u8, stopped)
++	),
++	TP_fast_assign(/* assign */
++		DD_DEV_ASSIGN(txq->priv->dd)
++		__entry->txq = txq;
++		__entry->sde = txq->sde;
++		__entry->head = txq->tx_ring.head;
++		__entry->tail = txq->tx_ring.tail;
++		__entry->idx = txq->q_idx;
++		__entry->used =
++			txq->sent_txreqs -
++			atomic64_read(&txq->complete_txreqs);
++		__entry->flow = txq->flow.as_int;
++		__entry->stops = atomic_read(&txq->stops);
++		__entry->no_desc = atomic_read(&txq->no_desc);
++		__entry->stopped =
++		 __netif_subqueue_stopped(txq->priv->netdev, txq->q_idx);
++	),
++	TP_printk(/* print  */
++		"[%s] txq %llx idx %u sde %llx head %lx tail %lx flow %x used %u stops %d no_desc %d stopped %u",
++		__get_str(dev),
++		(unsigned long long)__entry->txq,
++		__entry->idx,
++		(unsigned long long)__entry->sde,
++		__entry->head,
++		__entry->tail,
++		__entry->flow,
++		__entry->used,
++		__entry->stops,
++		__entry->no_desc,
++		__entry->stopped
++	)
++);
++
++DEFINE_EVENT(/* queue stop */
++	hfi1_ipoib_txq_template, hfi1_txq_stop,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq)
++);
++
++DEFINE_EVENT(/* queue wake */
++	hfi1_ipoib_txq_template, hfi1_txq_wake,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq)
++);
++
++DEFINE_EVENT(/* flow flush */
++	hfi1_ipoib_txq_template, hfi1_flow_flush,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq)
++);
++
++DEFINE_EVENT(/* flow switch */
++	hfi1_ipoib_txq_template, hfi1_flow_switch,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq)
++);
++
++DEFINE_EVENT(/* wakeup */
++	hfi1_ipoib_txq_template, hfi1_txq_wakeup,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq)
++);
++
++DEFINE_EVENT(/* full */
++	hfi1_ipoib_txq_template, hfi1_txq_full,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq)
++);
++
++DEFINE_EVENT(/* queued */
++	hfi1_ipoib_txq_template, hfi1_txq_queued,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq)
++);
++
++DEFINE_EVENT(/* xmit_stopped */
++	hfi1_ipoib_txq_template, hfi1_txq_xmit_stopped,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq)
++);
++
++DEFINE_EVENT(/* xmit_unstopped */
++	hfi1_ipoib_txq_template, hfi1_txq_xmit_unstopped,
++	TP_PROTO(struct hfi1_ipoib_txq *txq),
++	TP_ARGS(txq)
++);
++
+ #endif /* __HFI1_TRACE_TX_H */
+ 
+ #undef TRACE_INCLUDE_PATH
+-- 
+2.39.2
+
diff --git a/queue-5.10/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch b/queue-5.10/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch
new file mode 100644
index 00000000000..e5fa7ef3da9
--- /dev/null
+++ b/queue-5.10/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch
@@ -0,0 +1,1148 @@
+From 659008e8729d0d2d2db2a572f551a58725b78808 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 12:52:44 -0400
+Subject: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA
+ requests
+
+From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+
+[ Upstream commit 00cbce5cbf88459cd1aa1d60d0f1df15477df127 ]
+
+hfi1 user SDMA request processing has two bugs that can cause data
+corruption for user SDMA requests that have multiple payload iovecs
+where an iovec other than the tail iovec does not run up to the page
+boundary for the buffer pointed to by that iovec.a
+
+Here are the specific bugs:
+1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len.
+   Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec
+   to the packet, even if some of those bytes are past
+   iovec->iov.iov_len and are thus not intended to be in the packet.
+2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the
+   next iovec in user_sdma_request->iovs when the current iovec
+   is not PAGE_SIZE and does not contain enough data to complete the
+   packet. The transmitted packet will contain the wrong data from the
+   iovec pages.
+
+This has not been an issue with SDMA packets from hfi1 Verbs or PSM2
+because they only produce iovecs that end short of PAGE_SIZE as the tail
+iovec of an SDMA request.
+
+Fixing these bugs exposes other bugs with the SDMA pin cache
+(struct mmu_rb_handler) that get in way of supporting user SDMA requests
+with multiple payload iovecs whose buffers do not end at PAGE_SIZE. So
+this commit fixes those issues as well.
+
+Here are the mmu_rb_handler bugs that non-PAGE_SIZE-end multi-iovec
+payload user SDMA requests can hit:
+1. Overlapping memory ranges in mmu_rb_handler will result in duplicate
+   pinnings.
+2. When extending an existing mmu_rb_handler entry (struct mmu_rb_node),
+   the mmu_rb code (1) removes the existing entry under a lock, (2)
+   releases that lock, pins the new pages, (3) then reacquires the lock
+   to insert the extended mmu_rb_node.
+
+   If someone else comes in and inserts an overlapping entry between (2)
+   and (3), insert in (3) will fail.
+
+   The failure path code in this case unpins _all_ pages in either the
+   original mmu_rb_node or the new mmu_rb_node that was inserted between
+   (2) and (3).
+3. In hfi1_mmu_rb_remove_unless_exact(), mmu_rb_node->refcount is
+   incremented outside of mmu_rb_handler->lock. As a result, mmu_rb_node
+   could be evicted by another thread that gets mmu_rb_handler->lock and
+   checks mmu_rb_node->refcount before mmu_rb_node->refcount is
+   incremented.
+4. Related to #2 above, SDMA request submission failure path does not
+   check mmu_rb_node->refcount before freeing mmu_rb_node object.
+
+   If there are other SDMA requests in progress whose iovecs have
+   pointers to the now-freed mmu_rb_node(s), those pointers to the
+   now-freed mmu_rb nodes will be dereferenced when those SDMA requests
+   complete.
+
+Fixes: 7be85676f1d1 ("IB/hfi1: Don't remove RB entry when not needed.")
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/168088636445.3027109.10054635277810177889.stgit@252.162.96.66.static.eigbox.net
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/ipoib_tx.c   |   1 +
+ drivers/infiniband/hw/hfi1/mmu_rb.c     |  66 +--
+ drivers/infiniband/hw/hfi1/mmu_rb.h     |   8 +-
+ drivers/infiniband/hw/hfi1/sdma.c       |  21 +-
+ drivers/infiniband/hw/hfi1/sdma.h       |  16 +-
+ drivers/infiniband/hw/hfi1/sdma_txreq.h |   1 +
+ drivers/infiniband/hw/hfi1/trace_mmu.h  |   4 -
+ drivers/infiniband/hw/hfi1/user_sdma.c  | 600 +++++++++++++++---------
+ drivers/infiniband/hw/hfi1/user_sdma.h  |   5 -
+ drivers/infiniband/hw/hfi1/verbs.c      |   4 +-
+ drivers/infiniband/hw/hfi1/vnic_sdma.c  |   1 +
+ 11 files changed, 423 insertions(+), 304 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+index ec187ec746749..956fc3fd88b99 100644
+--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
+@@ -251,6 +251,7 @@ static int hfi1_ipoib_build_ulp_payload(struct ipoib_txreq *tx,
+ 		const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+ 
+ 		ret = sdma_txadd_page(dd,
++				      NULL,
+ 				      txreq,
+ 				      skb_frag_page(frag),
+ 				      frag->bv_offset,
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index d8b6bf271db8f..d331184ded308 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -167,7 +167,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ 	spin_lock_irqsave(&handler->lock, flags);
+ 	node = __mmu_rb_search(handler, mnode->addr, mnode->len);
+ 	if (node) {
+-		ret = -EINVAL;
++		ret = -EEXIST;
+ 		goto unlock;
+ 	}
+ 	__mmu_int_rb_insert(mnode, &handler->root);
+@@ -184,6 +184,19 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ 	return ret;
+ }
+ 
++/* Caller must hold handler lock */
++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler,
++					  unsigned long addr, unsigned long len)
++{
++	struct mmu_rb_node *node;
++
++	trace_hfi1_mmu_rb_search(addr, len);
++	node = __mmu_int_rb_iter_first(&handler->root, addr, (addr + len) - 1);
++	if (node)
++		list_move_tail(&node->list, &handler->lru_list);
++	return node;
++}
++
+ /* Caller must hold handler lock */
+ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler,
+ 					   unsigned long addr,
+@@ -208,34 +221,6 @@ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler,
+ 	return node;
+ }
+ 
+-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+-				     unsigned long addr, unsigned long len,
+-				     struct mmu_rb_node **rb_node)
+-{
+-	struct mmu_rb_node *node;
+-	unsigned long flags;
+-	bool ret = false;
+-
+-	if (current->mm != handler->mn.mm)
+-		return ret;
+-
+-	spin_lock_irqsave(&handler->lock, flags);
+-	node = __mmu_rb_search(handler, addr, len);
+-	if (node) {
+-		if (node->addr == addr && node->len == len) {
+-			list_move_tail(&node->list, &handler->lru_list);
+-			goto unlock;
+-		}
+-		__mmu_int_rb_remove(node, &handler->root);
+-		list_del(&node->list); /* remove from LRU list */
+-		ret = true;
+-	}
+-unlock:
+-	spin_unlock_irqrestore(&handler->lock, flags);
+-	*rb_node = node;
+-	return ret;
+-}
+-
+ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ {
+ 	struct mmu_rb_node *rbnode, *ptr;
+@@ -266,29 +251,6 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ 	}
+ }
+ 
+-/*
+- * It is up to the caller to ensure that this function does not race with the
+- * mmu invalidate notifier which may be calling the users remove callback on
+- * 'node'.
+- */
+-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler,
+-			struct mmu_rb_node *node)
+-{
+-	unsigned long flags;
+-
+-	if (current->mm != handler->mn.mm)
+-		return;
+-
+-	/* Validity of handler and node pointers has been checked by caller. */
+-	trace_hfi1_mmu_rb_remove(node->addr, node->len);
+-	spin_lock_irqsave(&handler->lock, flags);
+-	__mmu_int_rb_remove(node, &handler->root);
+-	list_del(&node->list); /* remove from LRU list */
+-	spin_unlock_irqrestore(&handler->lock, flags);
+-
+-	handler->ops->remove(handler->ops_arg, node);
+-}
+-
+ static int mmu_notifier_range_start(struct mmu_notifier *mn,
+ 		const struct mmu_notifier_range *range)
+ {
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h
+index 423aacc67e948..0265d81c62061 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.h
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h
+@@ -93,10 +93,8 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler);
+ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ 		       struct mmu_rb_node *mnode);
+ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg);
+-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler,
+-			struct mmu_rb_node *mnode);
+-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+-				     unsigned long addr, unsigned long len,
+-				     struct mmu_rb_node **rb_node);
++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler,
++					  unsigned long addr,
++					  unsigned long len);
+ 
+ #endif /* _HFI1_MMU_RB_H */
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index a044bee257f94..061562627dae4 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -1635,22 +1635,7 @@ static inline void sdma_unmap_desc(
+ 	struct hfi1_devdata *dd,
+ 	struct sdma_desc *descp)
+ {
+-	switch (sdma_mapping_type(descp)) {
+-	case SDMA_MAP_SINGLE:
+-		dma_unmap_single(
+-			&dd->pcidev->dev,
+-			sdma_mapping_addr(descp),
+-			sdma_mapping_len(descp),
+-			DMA_TO_DEVICE);
+-		break;
+-	case SDMA_MAP_PAGE:
+-		dma_unmap_page(
+-			&dd->pcidev->dev,
+-			sdma_mapping_addr(descp),
+-			sdma_mapping_len(descp),
+-			DMA_TO_DEVICE);
+-		break;
+-	}
++	system_descriptor_complete(dd, descp);
+ }
+ 
+ /*
+@@ -3170,7 +3155,7 @@ int ext_coal_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx,
+ 
+ 		/* Add descriptor for coalesce buffer */
+ 		tx->desc_limit = MAX_DESC;
+-		return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx,
++		return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx,
+ 					 addr, tx->tlen);
+ 	}
+ 
+@@ -3210,10 +3195,12 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ 			return rval;
+ 		}
+ 	}
++
+ 	/* finish the one just added */
+ 	make_tx_sdma_desc(
+ 		tx,
+ 		SDMA_MAP_NONE,
++		NULL,
+ 		dd->sdma_pad_phys,
+ 		sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)));
+ 	_sdma_close_tx(dd, tx);
+diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h
+index 7a851191f9870..7d4f316ac6e43 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.h
++++ b/drivers/infiniband/hw/hfi1/sdma.h
+@@ -635,6 +635,7 @@ static inline dma_addr_t sdma_mapping_addr(struct sdma_desc *d)
+ static inline void make_tx_sdma_desc(
+ 	struct sdma_txreq *tx,
+ 	int type,
++	void *pinning_ctx,
+ 	dma_addr_t addr,
+ 	size_t len)
+ {
+@@ -653,6 +654,7 @@ static inline void make_tx_sdma_desc(
+ 				<< SDMA_DESC0_PHY_ADDR_SHIFT) |
+ 			(((u64)len & SDMA_DESC0_BYTE_COUNT_MASK)
+ 				<< SDMA_DESC0_BYTE_COUNT_SHIFT);
++	desc->pinning_ctx = pinning_ctx;
+ }
+ 
+ /* helper to extend txreq */
+@@ -685,6 +687,7 @@ static inline void _sdma_close_tx(struct hfi1_devdata *dd,
+ static inline int _sdma_txadd_daddr(
+ 	struct hfi1_devdata *dd,
+ 	int type,
++	void *pinning_ctx,
+ 	struct sdma_txreq *tx,
+ 	dma_addr_t addr,
+ 	u16 len)
+@@ -694,6 +697,7 @@ static inline int _sdma_txadd_daddr(
+ 	make_tx_sdma_desc(
+ 		tx,
+ 		type,
++		pinning_ctx,
+ 		addr, len);
+ 	WARN_ON(len > tx->tlen);
+ 	tx->tlen -= len;
+@@ -714,6 +718,7 @@ static inline int _sdma_txadd_daddr(
+ /**
+  * sdma_txadd_page() - add a page to the sdma_txreq
+  * @dd: the device to use for mapping
++ * @pinning_ctx: context to be released at descriptor retirement
+  * @tx: tx request to which the page is added
+  * @page: page to map
+  * @offset: offset within the page
+@@ -729,6 +734,7 @@ static inline int _sdma_txadd_daddr(
+  */
+ static inline int sdma_txadd_page(
+ 	struct hfi1_devdata *dd,
++	void *pinning_ctx,
+ 	struct sdma_txreq *tx,
+ 	struct page *page,
+ 	unsigned long offset,
+@@ -756,8 +762,7 @@ static inline int sdma_txadd_page(
+ 		return -ENOSPC;
+ 	}
+ 
+-	return _sdma_txadd_daddr(
+-			dd, SDMA_MAP_PAGE, tx, addr, len);
++	return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, pinning_ctx, tx, addr, len);
+ }
+ 
+ /**
+@@ -791,7 +796,8 @@ static inline int sdma_txadd_daddr(
+ 			return rval;
+ 	}
+ 
+-	return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, tx, addr, len);
++	return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, NULL, tx,
++				 addr, len);
+ }
+ 
+ /**
+@@ -837,8 +843,7 @@ static inline int sdma_txadd_kvaddr(
+ 		return -ENOSPC;
+ 	}
+ 
+-	return _sdma_txadd_daddr(
+-			dd, SDMA_MAP_SINGLE, tx, addr, len);
++	return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, addr, len);
+ }
+ 
+ struct iowait_work;
+@@ -1090,4 +1095,5 @@ extern uint mod_num_sdma;
+ 
+ void sdma_update_lmc(struct hfi1_devdata *dd, u64 mask, u32 lid);
+ 
++void system_descriptor_complete(struct hfi1_devdata *dd, struct sdma_desc *descp);
+ #endif
+diff --git a/drivers/infiniband/hw/hfi1/sdma_txreq.h b/drivers/infiniband/hw/hfi1/sdma_txreq.h
+index 514a4784566b2..4204650cebc29 100644
+--- a/drivers/infiniband/hw/hfi1/sdma_txreq.h
++++ b/drivers/infiniband/hw/hfi1/sdma_txreq.h
+@@ -61,6 +61,7 @@
+ struct sdma_desc {
+ 	/* private:  don't use directly */
+ 	u64 qw[2];
++	void *pinning_ctx;
+ };
+ 
+ /**
+diff --git a/drivers/infiniband/hw/hfi1/trace_mmu.h b/drivers/infiniband/hw/hfi1/trace_mmu.h
+index 3b7abbc382c20..c3055cff4d6bb 100644
+--- a/drivers/infiniband/hw/hfi1/trace_mmu.h
++++ b/drivers/infiniband/hw/hfi1/trace_mmu.h
+@@ -78,10 +78,6 @@ DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_search,
+ 	     TP_PROTO(unsigned long addr, unsigned long len),
+ 	     TP_ARGS(addr, len));
+ 
+-DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_remove,
+-	     TP_PROTO(unsigned long addr, unsigned long len),
+-	     TP_ARGS(addr, len));
+-
+ DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_mem_invalidate,
+ 	     TP_PROTO(unsigned long addr, unsigned long len),
+ 	     TP_ARGS(addr, len));
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index da5b2e37355ab..1eb5a44a4ae6a 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -65,7 +65,6 @@
+ 
+ #include "hfi.h"
+ #include "sdma.h"
+-#include "mmu_rb.h"
+ #include "user_sdma.h"
+ #include "verbs.h"  /* for the headers */
+ #include "common.h" /* for struct hfi1_tid_info */
+@@ -80,11 +79,7 @@ static unsigned initial_pkt_count = 8;
+ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts);
+ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status);
+ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq);
+-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin);
+-static int pin_vector_pages(struct user_sdma_request *req,
+-			    struct user_sdma_iovec *iovec);
+-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages,
+-			       unsigned start, unsigned npages);
++static void user_sdma_free_request(struct user_sdma_request *req);
+ static int check_header_template(struct user_sdma_request *req,
+ 				 struct hfi1_pkt_header *hdr, u32 lrhlen,
+ 				 u32 datalen);
+@@ -122,6 +117,11 @@ static struct mmu_rb_ops sdma_rb_ops = {
+ 	.invalidate = sdma_rb_invalidate
+ };
+ 
++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req,
++					   struct user_sdma_txreq *tx,
++					   struct user_sdma_iovec *iovec,
++					   u32 *pkt_remaining);
++
+ static int defer_packet_queue(
+ 	struct sdma_engine *sde,
+ 	struct iowait_work *wait,
+@@ -453,6 +453,7 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ 		ret = -EINVAL;
+ 		goto free_req;
+ 	}
++
+ 	/* Copy the header from the user buffer */
+ 	ret = copy_from_user(&req->hdr, iovec[idx].iov_base + sizeof(info),
+ 			     sizeof(req->hdr));
+@@ -527,9 +528,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ 		memcpy(&req->iovs[i].iov,
+ 		       iovec + idx++,
+ 		       sizeof(req->iovs[i].iov));
+-		ret = pin_vector_pages(req, &req->iovs[i]);
+-		if (ret) {
+-			req->data_iovs = i;
++		if (req->iovs[i].iov.iov_len == 0) {
++			ret = -EINVAL;
+ 			goto free_req;
+ 		}
+ 		req->data_len += req->iovs[i].iov.iov_len;
+@@ -627,7 +627,7 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ 		if (req->seqsubmitted)
+ 			wait_event(pq->busy.wait_dma,
+ 				   (req->seqcomp == req->seqsubmitted - 1));
+-		user_sdma_free_request(req, true);
++		user_sdma_free_request(req);
+ 		pq_update(pq);
+ 		set_comp_state(pq, cq, info.comp_idx, ERROR, ret);
+ 	}
+@@ -739,48 +739,6 @@ static int user_sdma_txadd_ahg(struct user_sdma_request *req,
+ 	return ret;
+ }
+ 
+-static int user_sdma_txadd(struct user_sdma_request *req,
+-			   struct user_sdma_txreq *tx,
+-			   struct user_sdma_iovec *iovec, u32 datalen,
+-			   u32 *queued_ptr, u32 *data_sent_ptr,
+-			   u64 *iov_offset_ptr)
+-{
+-	int ret;
+-	unsigned int pageidx, len;
+-	unsigned long base, offset;
+-	u64 iov_offset = *iov_offset_ptr;
+-	u32 queued = *queued_ptr, data_sent = *data_sent_ptr;
+-	struct hfi1_user_sdma_pkt_q *pq = req->pq;
+-
+-	base = (unsigned long)iovec->iov.iov_base;
+-	offset = offset_in_page(base + iovec->offset + iov_offset);
+-	pageidx = (((iovec->offset + iov_offset + base) - (base & PAGE_MASK)) >>
+-		   PAGE_SHIFT);
+-	len = offset + req->info.fragsize > PAGE_SIZE ?
+-		PAGE_SIZE - offset : req->info.fragsize;
+-	len = min((datalen - queued), len);
+-	ret = sdma_txadd_page(pq->dd, &tx->txreq, iovec->pages[pageidx],
+-			      offset, len);
+-	if (ret) {
+-		SDMA_DBG(req, "SDMA txreq add page failed %d\n", ret);
+-		return ret;
+-	}
+-	iov_offset += len;
+-	queued += len;
+-	data_sent += len;
+-	if (unlikely(queued < datalen && pageidx == iovec->npages &&
+-		     req->iov_idx < req->data_iovs - 1)) {
+-		iovec->offset += iov_offset;
+-		iovec = &req->iovs[++req->iov_idx];
+-		iov_offset = 0;
+-	}
+-
+-	*queued_ptr = queued;
+-	*data_sent_ptr = data_sent;
+-	*iov_offset_ptr = iov_offset;
+-	return ret;
+-}
+-
+ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts)
+ {
+ 	int ret = 0;
+@@ -812,8 +770,7 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts)
+ 		maxpkts = req->info.npkts - req->seqnum;
+ 
+ 	while (npkts < maxpkts) {
+-		u32 datalen = 0, queued = 0, data_sent = 0;
+-		u64 iov_offset = 0;
++		u32 datalen = 0;
+ 
+ 		/*
+ 		 * Check whether any of the completions have come back
+@@ -906,27 +863,17 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts)
+ 				goto free_txreq;
+ 		}
+ 
+-		/*
+-		 * If the request contains any data vectors, add up to
+-		 * fragsize bytes to the descriptor.
+-		 */
+-		while (queued < datalen &&
+-		       (req->sent + data_sent) < req->data_len) {
+-			ret = user_sdma_txadd(req, tx, iovec, datalen,
+-					      &queued, &data_sent, &iov_offset);
+-			if (ret)
+-				goto free_txreq;
+-		}
+-		/*
+-		 * The txreq was submitted successfully so we can update
+-		 * the counters.
+-		 */
+ 		req->koffset += datalen;
+ 		if (req_opcode(req->info.ctrl) == EXPECTED)
+ 			req->tidoffset += datalen;
+-		req->sent += data_sent;
+-		if (req->data_len)
+-			iovec->offset += iov_offset;
++		req->sent += datalen;
++		while (datalen) {
++			ret = add_system_pages_to_sdma_packet(req, tx, iovec,
++							      &datalen);
++			if (ret)
++				goto free_txreq;
++			iovec = &req->iovs[req->iov_idx];
++		}
+ 		list_add_tail(&tx->txreq.list, &req->txps);
+ 		/*
+ 		 * It is important to increment this here as it is used to
+@@ -963,133 +910,14 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts)
+ static u32 sdma_cache_evict(struct hfi1_user_sdma_pkt_q *pq, u32 npages)
+ {
+ 	struct evict_data evict_data;
++	struct mmu_rb_handler *handler = pq->handler;
+ 
+ 	evict_data.cleared = 0;
+ 	evict_data.target = npages;
+-	hfi1_mmu_rb_evict(pq->handler, &evict_data);
++	hfi1_mmu_rb_evict(handler, &evict_data);
+ 	return evict_data.cleared;
+ }
+ 
+-static int pin_sdma_pages(struct user_sdma_request *req,
+-			  struct user_sdma_iovec *iovec,
+-			  struct sdma_mmu_node *node,
+-			  int npages)
+-{
+-	int pinned, cleared;
+-	struct page **pages;
+-	struct hfi1_user_sdma_pkt_q *pq = req->pq;
+-
+-	pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL);
+-	if (!pages)
+-		return -ENOMEM;
+-	memcpy(pages, node->pages, node->npages * sizeof(*pages));
+-
+-	npages -= node->npages;
+-retry:
+-	if (!hfi1_can_pin_pages(pq->dd, current->mm,
+-				atomic_read(&pq->n_locked), npages)) {
+-		cleared = sdma_cache_evict(pq, npages);
+-		if (cleared >= npages)
+-			goto retry;
+-	}
+-	pinned = hfi1_acquire_user_pages(current->mm,
+-					 ((unsigned long)iovec->iov.iov_base +
+-					 (node->npages * PAGE_SIZE)), npages, 0,
+-					 pages + node->npages);
+-	if (pinned < 0) {
+-		kfree(pages);
+-		return pinned;
+-	}
+-	if (pinned != npages) {
+-		unpin_vector_pages(current->mm, pages, node->npages, pinned);
+-		return -EFAULT;
+-	}
+-	kfree(node->pages);
+-	node->rb.len = iovec->iov.iov_len;
+-	node->pages = pages;
+-	atomic_add(pinned, &pq->n_locked);
+-	return pinned;
+-}
+-
+-static void unpin_sdma_pages(struct sdma_mmu_node *node)
+-{
+-	if (node->npages) {
+-		unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0,
+-				   node->npages);
+-		atomic_sub(node->npages, &node->pq->n_locked);
+-	}
+-}
+-
+-static int pin_vector_pages(struct user_sdma_request *req,
+-			    struct user_sdma_iovec *iovec)
+-{
+-	int ret = 0, pinned, npages;
+-	struct hfi1_user_sdma_pkt_q *pq = req->pq;
+-	struct sdma_mmu_node *node = NULL;
+-	struct mmu_rb_node *rb_node;
+-	struct iovec *iov;
+-	bool extracted;
+-
+-	extracted =
+-		hfi1_mmu_rb_remove_unless_exact(pq->handler,
+-						(unsigned long)
+-						iovec->iov.iov_base,
+-						iovec->iov.iov_len, &rb_node);
+-	if (rb_node) {
+-		node = container_of(rb_node, struct sdma_mmu_node, rb);
+-		if (!extracted) {
+-			atomic_inc(&node->refcount);
+-			iovec->pages = node->pages;
+-			iovec->npages = node->npages;
+-			iovec->node = node;
+-			return 0;
+-		}
+-	}
+-
+-	if (!node) {
+-		node = kzalloc(sizeof(*node), GFP_KERNEL);
+-		if (!node)
+-			return -ENOMEM;
+-
+-		node->rb.addr = (unsigned long)iovec->iov.iov_base;
+-		node->pq = pq;
+-		atomic_set(&node->refcount, 0);
+-	}
+-
+-	iov = &iovec->iov;
+-	npages = num_user_pages((unsigned long)iov->iov_base, iov->iov_len);
+-	if (node->npages < npages) {
+-		pinned = pin_sdma_pages(req, iovec, node, npages);
+-		if (pinned < 0) {
+-			ret = pinned;
+-			goto bail;
+-		}
+-		node->npages += pinned;
+-		npages = node->npages;
+-	}
+-	iovec->pages = node->pages;
+-	iovec->npages = npages;
+-	iovec->node = node;
+-
+-	ret = hfi1_mmu_rb_insert(req->pq->handler, &node->rb);
+-	if (ret) {
+-		iovec->node = NULL;
+-		goto bail;
+-	}
+-	return 0;
+-bail:
+-	unpin_sdma_pages(node);
+-	kfree(node);
+-	return ret;
+-}
+-
+-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages,
+-			       unsigned start, unsigned npages)
+-{
+-	hfi1_release_user_pages(mm, pages + start, npages, false);
+-	kfree(pages);
+-}
+-
+ static int check_header_template(struct user_sdma_request *req,
+ 				 struct hfi1_pkt_header *hdr, u32 lrhlen,
+ 				 u32 datalen)
+@@ -1431,7 +1259,7 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status)
+ 	if (req->seqcomp != req->info.npkts - 1)
+ 		return;
+ 
+-	user_sdma_free_request(req, false);
++	user_sdma_free_request(req);
+ 	set_comp_state(pq, cq, req->info.comp_idx, state, status);
+ 	pq_update(pq);
+ }
+@@ -1442,10 +1270,8 @@ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq)
+ 		wake_up(&pq->wait);
+ }
+ 
+-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin)
++static void user_sdma_free_request(struct user_sdma_request *req)
+ {
+-	int i;
+-
+ 	if (!list_empty(&req->txps)) {
+ 		struct sdma_txreq *t, *p;
+ 
+@@ -1458,21 +1284,6 @@ static void user_sdma_free_request(struct user_sdma_request *req, bool unpin)
+ 		}
+ 	}
+ 
+-	for (i = 0; i < req->data_iovs; i++) {
+-		struct sdma_mmu_node *node = req->iovs[i].node;
+-
+-		if (!node)
+-			continue;
+-
+-		req->iovs[i].node = NULL;
+-
+-		if (unpin)
+-			hfi1_mmu_rb_remove(req->pq->handler,
+-					   &node->rb);
+-		else
+-			atomic_dec(&node->refcount);
+-	}
+-
+ 	kfree(req->tids);
+ 	clear_bit(req->info.comp_idx, req->pq->req_in_use);
+ }
+@@ -1490,6 +1301,368 @@ static inline void set_comp_state(struct hfi1_user_sdma_pkt_q *pq,
+ 					idx, state, ret);
+ }
+ 
++static void unpin_vector_pages(struct mm_struct *mm, struct page **pages,
++			       unsigned int start, unsigned int npages)
++{
++	hfi1_release_user_pages(mm, pages + start, npages, false);
++	kfree(pages);
++}
++
++static void free_system_node(struct sdma_mmu_node *node)
++{
++	if (node->npages) {
++		unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0,
++				   node->npages);
++		atomic_sub(node->npages, &node->pq->n_locked);
++	}
++	kfree(node);
++}
++
++static inline void acquire_node(struct sdma_mmu_node *node)
++{
++	atomic_inc(&node->refcount);
++	WARN_ON(atomic_read(&node->refcount) < 0);
++}
++
++static inline void release_node(struct mmu_rb_handler *handler,
++				struct sdma_mmu_node *node)
++{
++	atomic_dec(&node->refcount);
++	WARN_ON(atomic_read(&node->refcount) < 0);
++}
++
++static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler,
++					      unsigned long start,
++					      unsigned long end)
++{
++	struct mmu_rb_node *rb_node;
++	struct sdma_mmu_node *node;
++	unsigned long flags;
++
++	spin_lock_irqsave(&handler->lock, flags);
++	rb_node = hfi1_mmu_rb_get_first(handler, start, (end - start));
++	if (!rb_node) {
++		spin_unlock_irqrestore(&handler->lock, flags);
++		return NULL;
++	}
++	node = container_of(rb_node, struct sdma_mmu_node, rb);
++	acquire_node(node);
++	spin_unlock_irqrestore(&handler->lock, flags);
++
++	return node;
++}
++
++static int pin_system_pages(struct user_sdma_request *req,
++			    uintptr_t start_address, size_t length,
++			    struct sdma_mmu_node *node, int npages)
++{
++	struct hfi1_user_sdma_pkt_q *pq = req->pq;
++	int pinned, cleared;
++	struct page **pages;
++
++	pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL);
++	if (!pages)
++		return -ENOMEM;
++
++retry:
++	if (!hfi1_can_pin_pages(pq->dd, current->mm, atomic_read(&pq->n_locked),
++				npages)) {
++		SDMA_DBG(req, "Evicting: nlocked %u npages %u",
++			 atomic_read(&pq->n_locked), npages);
++		cleared = sdma_cache_evict(pq, npages);
++		if (cleared >= npages)
++			goto retry;
++	}
++
++	SDMA_DBG(req, "Acquire user pages start_address %lx node->npages %u npages %u",
++		 start_address, node->npages, npages);
++	pinned = hfi1_acquire_user_pages(current->mm, start_address, npages, 0,
++					 pages);
++
++	if (pinned < 0) {
++		kfree(pages);
++		SDMA_DBG(req, "pinned %d", pinned);
++		return pinned;
++	}
++	if (pinned != npages) {
++		unpin_vector_pages(current->mm, pages, node->npages, pinned);
++		SDMA_DBG(req, "npages %u pinned %d", npages, pinned);
++		return -EFAULT;
++	}
++	node->rb.addr = start_address;
++	node->rb.len = length;
++	node->pages = pages;
++	node->npages = npages;
++	atomic_add(pinned, &pq->n_locked);
++	SDMA_DBG(req, "done. pinned %d", pinned);
++	return 0;
++}
++
++static int add_system_pinning(struct user_sdma_request *req,
++			      struct sdma_mmu_node **node_p,
++			      unsigned long start, unsigned long len)
++
++{
++	struct hfi1_user_sdma_pkt_q *pq = req->pq;
++	struct sdma_mmu_node *node;
++	int ret;
++
++	node = kzalloc(sizeof(*node), GFP_KERNEL);
++	if (!node)
++		return -ENOMEM;
++
++	node->pq = pq;
++	ret = pin_system_pages(req, start, len, node, PFN_DOWN(len));
++	if (ret == 0) {
++		ret = hfi1_mmu_rb_insert(pq->handler, &node->rb);
++		if (ret)
++			free_system_node(node);
++		else
++			*node_p = node;
++
++		return ret;
++	}
++
++	kfree(node);
++	return ret;
++}
++
++static int get_system_cache_entry(struct user_sdma_request *req,
++				  struct sdma_mmu_node **node_p,
++				  size_t req_start, size_t req_len)
++{
++	struct hfi1_user_sdma_pkt_q *pq = req->pq;
++	u64 start = ALIGN_DOWN(req_start, PAGE_SIZE);
++	u64 end = PFN_ALIGN(req_start + req_len);
++	struct mmu_rb_handler *handler = pq->handler;
++	int ret;
++
++	if ((end - start) == 0) {
++		SDMA_DBG(req,
++			 "Request for empty cache entry req_start %lx req_len %lx start %llx end %llx",
++			 req_start, req_len, start, end);
++		return -EINVAL;
++	}
++
++	SDMA_DBG(req, "req_start %lx req_len %lu", req_start, req_len);
++
++	while (1) {
++		struct sdma_mmu_node *node =
++			find_system_node(handler, start, end);
++		u64 prepend_len = 0;
++
++		SDMA_DBG(req, "node %p start %llx end %llu", node, start, end);
++		if (!node) {
++			ret = add_system_pinning(req, node_p, start,
++						 end - start);
++			if (ret == -EEXIST) {
++				/*
++				 * Another execution context has inserted a
++				 * conficting entry first.
++				 */
++				continue;
++			}
++			return ret;
++		}
++
++		if (node->rb.addr <= start) {
++			/*
++			 * This entry covers at least part of the region. If it doesn't extend
++			 * to the end, then this will be called again for the next segment.
++			 */
++			*node_p = node;
++			return 0;
++		}
++
++		SDMA_DBG(req, "prepend: node->rb.addr %lx, node->refcount %d",
++			 node->rb.addr, atomic_read(&node->refcount));
++		prepend_len = node->rb.addr - start;
++
++		/*
++		 * This node will not be returned, instead a new node
++		 * will be. So release the reference.
++		 */
++		release_node(handler, node);
++
++		/* Prepend a node to cover the beginning of the allocation */
++		ret = add_system_pinning(req, node_p, start, prepend_len);
++		if (ret == -EEXIST) {
++			/* Another execution context has inserted a conficting entry first. */
++			continue;
++		}
++		return ret;
++	}
++}
++
++static int add_mapping_to_sdma_packet(struct user_sdma_request *req,
++				      struct user_sdma_txreq *tx,
++				      struct sdma_mmu_node *cache_entry,
++				      size_t start,
++				      size_t from_this_cache_entry)
++{
++	struct hfi1_user_sdma_pkt_q *pq = req->pq;
++	unsigned int page_offset;
++	unsigned int from_this_page;
++	size_t page_index;
++	void *ctx;
++	int ret;
++
++	/*
++	 * Because the cache may be more fragmented than the memory that is being accessed,
++	 * it's not strictly necessary to have a descriptor per cache entry.
++	 */
++
++	while (from_this_cache_entry) {
++		page_index = PFN_DOWN(start - cache_entry->rb.addr);
++
++		if (page_index >= cache_entry->npages) {
++			SDMA_DBG(req,
++				 "Request for page_index %zu >= cache_entry->npages %u",
++				 page_index, cache_entry->npages);
++			return -EINVAL;
++		}
++
++		page_offset = start - ALIGN_DOWN(start, PAGE_SIZE);
++		from_this_page = PAGE_SIZE - page_offset;
++
++		if (from_this_page < from_this_cache_entry) {
++			ctx = NULL;
++		} else {
++			/*
++			 * In the case they are equal the next line has no practical effect,
++			 * but it's better to do a register to register copy than a conditional
++			 * branch.
++			 */
++			from_this_page = from_this_cache_entry;
++			ctx = cache_entry;
++		}
++
++		ret = sdma_txadd_page(pq->dd, ctx, &tx->txreq,
++				      cache_entry->pages[page_index],
++				      page_offset, from_this_page);
++		if (ret) {
++			/*
++			 * When there's a failure, the entire request is freed by
++			 * user_sdma_send_pkts().
++			 */
++			SDMA_DBG(req,
++				 "sdma_txadd_page failed %d page_index %lu page_offset %u from_this_page %u",
++				 ret, page_index, page_offset, from_this_page);
++			return ret;
++		}
++		start += from_this_page;
++		from_this_cache_entry -= from_this_page;
++	}
++	return 0;
++}
++
++static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req,
++					   struct user_sdma_txreq *tx,
++					   struct user_sdma_iovec *iovec,
++					   size_t from_this_iovec)
++{
++	struct mmu_rb_handler *handler = req->pq->handler;
++
++	while (from_this_iovec > 0) {
++		struct sdma_mmu_node *cache_entry;
++		size_t from_this_cache_entry;
++		size_t start;
++		int ret;
++
++		start = (uintptr_t)iovec->iov.iov_base + iovec->offset;
++		ret = get_system_cache_entry(req, &cache_entry, start,
++					     from_this_iovec);
++		if (ret) {
++			SDMA_DBG(req, "pin system segment failed %d", ret);
++			return ret;
++		}
++
++		from_this_cache_entry = cache_entry->rb.len - (start - cache_entry->rb.addr);
++		if (from_this_cache_entry > from_this_iovec)
++			from_this_cache_entry = from_this_iovec;
++
++		ret = add_mapping_to_sdma_packet(req, tx, cache_entry, start,
++						 from_this_cache_entry);
++		if (ret) {
++			/*
++			 * We're guaranteed that there will be no descriptor
++			 * completion callback that releases this node
++			 * because only the last descriptor referencing it
++			 * has a context attached, and a failure means the
++			 * last descriptor was never added.
++			 */
++			release_node(handler, cache_entry);
++			SDMA_DBG(req, "add system segment failed %d", ret);
++			return ret;
++		}
++
++		iovec->offset += from_this_cache_entry;
++		from_this_iovec -= from_this_cache_entry;
++	}
++
++	return 0;
++}
++
++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req,
++					   struct user_sdma_txreq *tx,
++					   struct user_sdma_iovec *iovec,
++					   u32 *pkt_data_remaining)
++{
++	size_t remaining_to_add = *pkt_data_remaining;
++	/*
++	 * Walk through iovec entries, ensure the associated pages
++	 * are pinned and mapped, add data to the packet until no more
++	 * data remains to be added.
++	 */
++	while (remaining_to_add > 0) {
++		struct user_sdma_iovec *cur_iovec;
++		size_t from_this_iovec;
++		int ret;
++
++		cur_iovec = iovec;
++		from_this_iovec = iovec->iov.iov_len - iovec->offset;
++
++		if (from_this_iovec > remaining_to_add) {
++			from_this_iovec = remaining_to_add;
++		} else {
++			/* The current iovec entry will be consumed by this pass. */
++			req->iov_idx++;
++			iovec++;
++		}
++
++		ret = add_system_iovec_to_sdma_packet(req, tx, cur_iovec,
++						      from_this_iovec);
++		if (ret)
++			return ret;
++
++		remaining_to_add -= from_this_iovec;
++	}
++	*pkt_data_remaining = remaining_to_add;
++
++	return 0;
++}
++
++void system_descriptor_complete(struct hfi1_devdata *dd,
++				struct sdma_desc *descp)
++{
++	switch (sdma_mapping_type(descp)) {
++	case SDMA_MAP_SINGLE:
++		dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp),
++				 sdma_mapping_len(descp), DMA_TO_DEVICE);
++		break;
++	case SDMA_MAP_PAGE:
++		dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp),
++			       sdma_mapping_len(descp), DMA_TO_DEVICE);
++		break;
++	}
++
++	if (descp->pinning_ctx) {
++		struct sdma_mmu_node *node = descp->pinning_ctx;
++
++		release_node(node->rb.handler, node);
++	}
++}
++
+ static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr,
+ 			   unsigned long len)
+ {
+@@ -1536,8 +1709,7 @@ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode)
+ 	struct sdma_mmu_node *node =
+ 		container_of(mnode, struct sdma_mmu_node, rb);
+ 
+-	unpin_sdma_pages(node);
+-	kfree(node);
++	free_system_node(node);
+ }
+ 
+ static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode)
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
+index fabe581399068..9d417aacfa8b7 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.h
++++ b/drivers/infiniband/hw/hfi1/user_sdma.h
+@@ -153,16 +153,11 @@ struct sdma_mmu_node {
+ struct user_sdma_iovec {
+ 	struct list_head list;
+ 	struct iovec iov;
+-	/* number of pages in this vector */
+-	unsigned int npages;
+-	/* array of pinned pages for this vector */
+-	struct page **pages;
+ 	/*
+ 	 * offset into the virtual address space of the vector at
+ 	 * which we last left off.
+ 	 */
+ 	u64 offset;
+-	struct sdma_mmu_node *node;
+ };
+ 
+ /* evict operation argument */
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 5f3edd255ca3c..693922df3543b 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -820,8 +820,8 @@ static int build_verbs_tx_desc(
+ 
+ 	/* add icrc, lt byte, and padding to flit */
+ 	if (extra_bytes)
+-		ret = sdma_txadd_daddr(sde->dd, &tx->txreq,
+-				       sde->dd->sdma_pad_phys, extra_bytes);
++		ret = sdma_txadd_daddr(sde->dd, &tx->txreq, sde->dd->sdma_pad_phys,
++				       extra_bytes);
+ 
+ bail_txadd:
+ 	return ret;
+diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+index 7d90b900131ba..7658c620a125c 100644
+--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c
++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+@@ -106,6 +106,7 @@ static noinline int build_vnic_ulp_payload(struct sdma_engine *sde,
+ 
+ 		/* combine physically continuous fragments later? */
+ 		ret = sdma_txadd_page(sde->dd,
++				      NULL,
+ 				      &tx->txreq,
+ 				      skb_frag_page(frag),
+ 				      skb_frag_off(frag),
+-- 
+2.39.2
+
diff --git a/queue-5.10/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch b/queue-5.10/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch
new file mode 100644
index 00000000000..aa9be1684ab
--- /dev/null
+++ b/queue-5.10/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch
@@ -0,0 +1,93 @@
+From cf5a03cba130a8af9fd7d9e3eaeed7d9d6a013a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 12:52:39 -0400
+Subject: IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order
+
+From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+
+[ Upstream commit 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 ]
+
+hfi1_mmu_rb_remove_unless_exact() did not move mmu_rb_node objects in
+mmu_rb_handler->lru_list after getting a cache hit on an mmu_rb_node.
+
+As a result, hfi1_mmu_rb_evict() was not guaranteed to evict truly
+least-recently used nodes.
+
+This could be a performance issue for an application when that
+application:
+- Uses some long-lived buffers frequently.
+- Uses a large number of buffers once.
+- Hits the mmu_rb_handler cache size or pinned-page limits, forcing
+  mmu_rb_handler cache entries to be evicted.
+
+In this case, the one-time use buffers cause the long-lived buffer
+entries to eventually filter to the end of the LRU list where
+hfi1_mmu_rb_evict() will consider evicting a frequently-used long-lived
+entry instead of evicting one of the one-time use entries.
+
+Fix this by inserting new mmu_rb_node at the tail of
+mmu_rb_handler->lru_list and move mmu_rb_ndoe to the tail of
+mmu_rb_handler->lru_list when the mmu_rb_node is a hit in
+hfi1_mmu_rb_remove_unless_exact(). Change hfi1_mmu_rb_evict() to evict
+from the head of mmu_rb_handler->lru_list instead of the tail.
+
+Fixes: 0636e9ab8355 ("IB/hfi1: Add cache evict LRU list")
+Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/168088635931.3027109.10423156330761536044.stgit@252.162.96.66.static.eigbox.net
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index ed8a96ae61cef..d8b6bf271db8f 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -171,7 +171,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ 		goto unlock;
+ 	}
+ 	__mmu_int_rb_insert(mnode, &handler->root);
+-	list_add(&mnode->list, &handler->lru_list);
++	list_add_tail(&mnode->list, &handler->lru_list);
+ 
+ 	ret = handler->ops->insert(handler->ops_arg, mnode);
+ 	if (ret) {
+@@ -222,8 +222,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+ 	spin_lock_irqsave(&handler->lock, flags);
+ 	node = __mmu_rb_search(handler, addr, len);
+ 	if (node) {
+-		if (node->addr == addr && node->len == len)
++		if (node->addr == addr && node->len == len) {
++			list_move_tail(&node->list, &handler->lru_list);
+ 			goto unlock;
++		}
+ 		__mmu_int_rb_remove(node, &handler->root);
+ 		list_del(&node->list); /* remove from LRU list */
+ 		ret = true;
+@@ -247,8 +249,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ 	INIT_LIST_HEAD(&del_list);
+ 
+ 	spin_lock_irqsave(&handler->lock, flags);
+-	list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list,
+-					 list) {
++	list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) {
+ 		if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg,
+ 					&stop)) {
+ 			__mmu_int_rb_remove(rbnode, &handler->root);
+@@ -260,9 +261,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ 	}
+ 	spin_unlock_irqrestore(&handler->lock, flags);
+ 
+-	while (!list_empty(&del_list)) {
+-		rbnode = list_first_entry(&del_list, struct mmu_rb_node, list);
+-		list_del(&rbnode->list);
++	list_for_each_entry_safe(rbnode, ptr, &del_list, list) {
+ 		handler->ops->remove(handler->ops_arg, rbnode);
+ 	}
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/iio-light-max44009-add-missing-of-device-matching.patch b/queue-5.10/iio-light-max44009-add-missing-of-device-matching.patch
new file mode 100644
index 00000000000..3e058ce63e9
--- /dev/null
+++ b/queue-5.10/iio-light-max44009-add-missing-of-device-matching.patch
@@ -0,0 +1,66 @@
+From 71b1cad1ae1a6fc17825314a1968657e09e6932d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 16:34:28 +0100
+Subject: iio: light: max44009: add missing OF device matching
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b29c49026c3c05a11f845dba17cad0b3ba06836d ]
+
+The driver currently matches only via i2c_device_id, but also has
+of_device_id table:
+
+  drivers/iio/light/max44009.c:545:34: error: ‘max44009_of_match’ defined but not used [-Werror=unused-const-variable=]
+
+Fixes: 6aef699a7d7e ("iio: light: add driver for MAX44009")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230312153429.371702-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/light/max44009.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/iio/light/max44009.c b/drivers/iio/light/max44009.c
+index 801e5a0ad496b..f3648f20ef2c0 100644
+--- a/drivers/iio/light/max44009.c
++++ b/drivers/iio/light/max44009.c
+@@ -528,6 +528,12 @@ static int max44009_probe(struct i2c_client *client,
+ 	return devm_iio_device_register(&client->dev, indio_dev);
+ }
+ 
++static const struct of_device_id max44009_of_match[] = {
++	{ .compatible = "maxim,max44009" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, max44009_of_match);
++
+ static const struct i2c_device_id max44009_id[] = {
+ 	{ "max44009", 0 },
+ 	{ }
+@@ -537,18 +543,13 @@ MODULE_DEVICE_TABLE(i2c, max44009_id);
+ static struct i2c_driver max44009_driver = {
+ 	.driver = {
+ 		.name = MAX44009_DRV_NAME,
++		.of_match_table = max44009_of_match,
+ 	},
+ 	.probe = max44009_probe,
+ 	.id_table = max44009_id,
+ };
+ module_i2c_driver(max44009_driver);
+ 
+-static const struct of_device_id max44009_of_match[] = {
+-	{ .compatible = "maxim,max44009" },
+-	{ }
+-};
+-MODULE_DEVICE_TABLE(of, max44009_of_match);
+-
+ MODULE_AUTHOR("Robert Eshleman <bobbyeshleman@gmail.com>");
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("MAX44009 ambient light sensor driver");
+-- 
+2.39.2
+
diff --git a/queue-5.10/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch b/queue-5.10/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch
new file mode 100644
index 00000000000..9d12ede0cfb
--- /dev/null
+++ b/queue-5.10/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch
@@ -0,0 +1,48 @@
+From 6d8555685d4143c6e06fb90b9aa339fd4d59736f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 23:05:20 -0700
+Subject: Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 5bca3688bdbc3b58a2894b8671a8e2378efe28bd ]
+
+rpi_firmware_get() take reference, we need to release it in error paths
+as well. Use devm_rpi_firmware_get() helper to handling the resources.
+Also remove the existing rpi_firmware_put().
+
+Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver")
+Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+Link: https://lore.kernel.org/r/20221223074657.810346-1-linmq006@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/raspberrypi-ts.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c
+index 5000f5fd9ec38..45c575df994e0 100644
+--- a/drivers/input/touchscreen/raspberrypi-ts.c
++++ b/drivers/input/touchscreen/raspberrypi-ts.c
+@@ -134,7 +134,7 @@ static int rpi_ts_probe(struct platform_device *pdev)
+ 		return -ENOENT;
+ 	}
+ 
+-	fw = rpi_firmware_get(fw_node);
++	fw = devm_rpi_firmware_get(&pdev->dev, fw_node);
+ 	of_node_put(fw_node);
+ 	if (!fw)
+ 		return -EPROBE_DEFER;
+@@ -160,7 +160,6 @@ static int rpi_ts_probe(struct platform_device *pdev)
+ 	touchbuf = (u32)ts->fw_regs_phys;
+ 	error = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF,
+ 				      &touchbuf, sizeof(touchbuf));
+-	rpi_firmware_put(fw);
+ 	if (error || touchbuf != 0) {
+ 		dev_warn(dev, "Failed to set touchbuf, %d\n", error);
+ 		return error;
+-- 
+2.39.2
+
diff --git a/queue-5.10/input-raspberrypi-ts-release-firmware-handle-when-no.patch b/queue-5.10/input-raspberrypi-ts-release-firmware-handle-when-no.patch
new file mode 100644
index 00000000000..6924e2827b6
--- /dev/null
+++ b/queue-5.10/input-raspberrypi-ts-release-firmware-handle-when-no.patch
@@ -0,0 +1,37 @@
+From 8fe852d0d960f6923e19eb6ca6cc76a1bc77dd0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 13:32:41 +0100
+Subject: input: raspberrypi-ts: Release firmware handle when not needed
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit 3b8ddff780b7d12e99ae39177f84b9003097777a ]
+
+There is no use for the firmware interface after getting the touch
+buffer address, so release it.
+
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Stable-dep-of: 5bca3688bdbc ("Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/raspberrypi-ts.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c
+index ef6aaed217cfb..5000f5fd9ec38 100644
+--- a/drivers/input/touchscreen/raspberrypi-ts.c
++++ b/drivers/input/touchscreen/raspberrypi-ts.c
+@@ -160,7 +160,7 @@ static int rpi_ts_probe(struct platform_device *pdev)
+ 	touchbuf = (u32)ts->fw_regs_phys;
+ 	error = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF,
+ 				      &touchbuf, sizeof(touchbuf));
+-
++	rpi_firmware_put(fw);
+ 	if (error || touchbuf != 0) {
+ 		dev_warn(dev, "Failed to set touchbuf, %d\n", error);
+ 		return error;
+-- 
+2.39.2
+
diff --git a/queue-5.10/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch b/queue-5.10/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch
new file mode 100644
index 00000000000..015386b0fe7
--- /dev/null
+++ b/queue-5.10/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch
@@ -0,0 +1,51 @@
+From 5f88e64577bec54169e6c17aa505681969effdb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Feb 2023 21:39:46 -0800
+Subject: ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on
+ it
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 2a587b9ad052e7e92e508aea90c1e2ae433c1908 ]
+
+REGMAP is a hidden (not user visible) symbol. Users cannot set it
+directly thru "make *config", so drivers should select it instead of
+depending on it if they need it.
+
+Consistently using "select" or "depends on" can also help reduce
+Kconfig circular dependency issues.
+
+Therefore, change the use of "depends on REGMAP_MMIO" to
+"select REGMAP_MMIO", which will also set REGMAP.
+
+Fixes: eb994594bc22 ("ipmi: bt-bmc: Use a regmap for register access")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Andrew Jeffery <andrew@aj.id.au>
+Cc: Corey Minyard <minyard@acm.org>
+Cc: openipmi-developer@lists.sourceforge.net
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Message-Id: <20230226053953.4681-2-rdunlap@infradead.org>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/char/ipmi/Kconfig b/drivers/char/ipmi/Kconfig
+index 07847d9a459af..f443186269e1c 100644
+--- a/drivers/char/ipmi/Kconfig
++++ b/drivers/char/ipmi/Kconfig
+@@ -126,7 +126,8 @@ config NPCM7XX_KCS_IPMI_BMC
+ 
+ config ASPEED_BT_IPMI_BMC
+ 	depends on ARCH_ASPEED || COMPILE_TEST
+-	depends on REGMAP && REGMAP_MMIO && MFD_SYSCON
++	depends on MFD_SYSCON
++	select REGMAP_MMIO
+ 	tristate "BT IPMI bmc driver"
+ 	help
+ 	  Provides a driver for the BT (Block Transfer) IPMI interface
+-- 
+2.39.2
+
diff --git a/queue-5.10/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch b/queue-5.10/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch
new file mode 100644
index 00000000000..85b422a5e2b
--- /dev/null
+++ b/queue-5.10/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch
@@ -0,0 +1,56 @@
+From 980ef6680cd9da6fabc5468b876ef932a047be62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 20:40:35 +0800
+Subject: ipv4: Fix potential uninit variable access bug in __ip_make_skb()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit 99e5acae193e369b71217efe6f1dad42f3f18815 ]
+
+Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in
+__ip6_make_skb()"). icmphdr does not in skb linear region under the
+scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will
+trigger the uninit variable access bug.
+
+Use a local variable icmp_type to carry the correct value in different
+scenarios.
+
+Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)")
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_output.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 0dbf950de832f..1e07df2821773 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1564,9 +1564,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ 	cork->dst = NULL;
+ 	skb_dst_set(skb, &rt->dst);
+ 
+-	if (iph->protocol == IPPROTO_ICMP)
+-		icmp_out_count(net, ((struct icmphdr *)
+-			skb_transport_header(skb))->type);
++	if (iph->protocol == IPPROTO_ICMP) {
++		u8 icmp_type;
++
++		/* For such sockets, transhdrlen is zero when do ip_append_data(),
++		 * so icmphdr does not in skb linear region and can not get icmp_type
++		 * by icmp_hdr(skb)->type.
++		 */
++		if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl)
++			icmp_type = fl4->fl4_icmp_type;
++		else
++			icmp_type = icmp_hdr(skb)->type;
++		icmp_out_count(net, icmp_type);
++	}
+ 
+ 	ip_cork_release(cork);
+ out:
+-- 
+2.39.2
+
diff --git a/queue-5.10/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch b/queue-5.10/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch
new file mode 100644
index 00000000000..6c3295f886c
--- /dev/null
+++ b/queue-5.10/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch
@@ -0,0 +1,68 @@
+From bdda7e7fcf7f5d3a47e1f0a74c50e557f356780f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 19:12:22 +0000
+Subject: ixgbe: Allow flow hash to be set via ethtool
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit 4f3ed1293feb9502dc254b05802faf1ad3317ac6 ]
+
+ixgbe currently returns `EINVAL` whenever the flowhash it set by ethtool
+because the ethtool code in the kernel passes a non-zero value for hfunc
+that ixgbe should allow.
+
+When ethtool is called with `ETHTOOL_SRXFHINDIR`,
+`ethtool_set_rxfh_indir` will call ixgbe's set_rxfh function
+with `ETH_RSS_HASH_NO_CHANGE`. This value should be accepted.
+
+When ethtool is called with `ETHTOOL_SRSSH`, `ethtool_set_rxfh` will
+call ixgbe's set_rxfh function with `rxfh.hfunc`, which appears to be
+hardcoded in ixgbe to always be `ETH_RSS_HASH_TOP`. This value should
+also be accepted.
+
+Before this patch:
+
+$ sudo ethtool -L eth1 combined 10
+$ sudo ethtool -X eth1 default
+Cannot set RX flow hash configuration: Invalid argument
+
+After this patch:
+
+$ sudo ethtool -L eth1 combined 10
+$ sudo ethtool -X eth1 default
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 10 RX ring(s):
+    0:      0     1     2     3     4     5     6     7
+    8:      8     9     0     1     2     3     4     5
+   16:      6     7     8     9     0     1     2     3
+   24:      4     5     6     7     8     9     0     1
+   ...
+
+Fixes: 1c7cf0784e4d ("ixgbe: support for ethtool set_rxfh")
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index 55983904b6df1..472ea068ea7b0 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -3107,8 +3107,8 @@ static int ixgbe_set_rxfh(struct net_device *netdev, const u32 *indir,
+ 	int i;
+ 	u32 reta_entries = ixgbe_rss_indir_tbl_entries(adapter);
+ 
+-	if (hfunc)
+-		return -EINVAL;
++	if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP)
++		return -EOPNOTSUPP;
+ 
+ 	/* Fill out the redirection table */
+ 	if (indir) {
+-- 
+2.39.2
+
diff --git a/queue-5.10/ixgbe-enable-setting-rss-table-to-default-values.patch b/queue-5.10/ixgbe-enable-setting-rss-table-to-default-values.patch
new file mode 100644
index 00000000000..a88271647e0
--- /dev/null
+++ b/queue-5.10/ixgbe-enable-setting-rss-table-to-default-values.patch
@@ -0,0 +1,147 @@
+From 6d0bc2b0d94cdfa420bfccd5581304fe755d8d05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 19:12:23 +0000
+Subject: ixgbe: Enable setting RSS table to default values
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit e85d3d55875f7a1079edfbc4e4e98d6f8aea9ac7 ]
+
+ethtool uses `ETHTOOL_GRXRINGS` to compute how many queues are supported
+by RSS. The driver should return the smaller of either:
+  - The maximum number of RSS queues the device supports, OR
+  - The number of RX queues configured
+
+Prior to this change, running `ethtool -X $iface default` fails if the
+number of queues configured is larger than the number supported by RSS,
+even though changing the queue count correctly resets the flowhash to
+use all supported queues.
+
+Other drivers (for example, i40e) will succeed but the flow hash will
+reset to support the maximum number of queues supported by RSS, even if
+that amount is smaller than the configured amount.
+
+Prior to this change:
+
+$ sudo ethtool -L eth1 combined 20
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 20 RX ring(s):
+    0:      0     1     2     3     4     5     6     7
+    8:      8     9    10    11    12    13    14    15
+   16:      0     1     2     3     4     5     6     7
+   24:      8     9    10    11    12    13    14    15
+   32:      0     1     2     3     4     5     6     7
+...
+
+You can see that the flowhash was correctly set to use the maximum
+number of queues supported by the driver (16).
+
+However, asking the NIC to reset to "default" fails:
+
+$ sudo ethtool -X eth1 default
+Cannot set RX flow hash configuration: Invalid argument
+
+After this change, the flowhash can be reset to default which will use
+all of the available RSS queues (16) or the configured queue count,
+whichever is smaller.
+
+Starting with eth1 which has 10 queues and a flowhash distributing to
+all 10 queues:
+
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 10 RX ring(s):
+    0:      0     1     2     3     4     5     6     7
+    8:      8     9     0     1     2     3     4     5
+   16:      6     7     8     9     0     1     2     3
+...
+
+Increasing the queue count to 48 resets the flowhash to distribute to 16
+queues, as it did before this patch:
+
+$ sudo ethtool -L eth1 combined 48
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+    0:      0     1     2     3     4     5     6     7
+    8:      8     9    10    11    12    13    14    15
+   16:      0     1     2     3     4     5     6     7
+...
+
+Due to the other bugfix in this series, the flowhash can be set to use
+queues 0-5:
+
+$ sudo ethtool -X eth1 equal 5
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+    0:      0     1     2     3     4     0     1     2
+    8:      3     4     0     1     2     3     4     0
+   16:      1     2     3     4     0     1     2     3
+...
+
+Due to this bugfix, the flowhash can be reset to default and use 16
+queues:
+
+$ sudo ethtool -X eth1 default
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+    0:      0     1     2     3     4     5     6     7
+    8:      8     9    10    11    12    13    14    15
+   16:      0     1     2     3     4     5     6     7
+...
+
+Fixes: 91cd94bfe4f0 ("ixgbe: add basic support for setting and getting nfc controls")
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c  | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index 472ea068ea7b0..2eb1331834731 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -2641,6 +2641,14 @@ static int ixgbe_get_rss_hash_opts(struct ixgbe_adapter *adapter,
+ 	return 0;
+ }
+ 
++static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
++{
++	if (adapter->hw.mac.type < ixgbe_mac_X550)
++		return 16;
++	else
++		return 64;
++}
++
+ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+ 			   u32 *rule_locs)
+ {
+@@ -2649,7 +2657,8 @@ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+ 
+ 	switch (cmd->cmd) {
+ 	case ETHTOOL_GRXRINGS:
+-		cmd->data = adapter->num_rx_queues;
++		cmd->data = min_t(int, adapter->num_rx_queues,
++				  ixgbe_rss_indir_tbl_max(adapter));
+ 		ret = 0;
+ 		break;
+ 	case ETHTOOL_GRXCLSRLCNT:
+@@ -3051,14 +3060,6 @@ static int ixgbe_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd)
+ 	return ret;
+ }
+ 
+-static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
+-{
+-	if (adapter->hw.mac.type < ixgbe_mac_X550)
+-		return 16;
+-	else
+-		return 64;
+-}
+-
+ static u32 ixgbe_get_rxfh_key_size(struct net_device *netdev)
+ {
+ 	return IXGBE_RSS_KEY_SIZE;
+-- 
+2.39.2
+
diff --git a/queue-5.10/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch b/queue-5.10/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch
new file mode 100644
index 00000000000..6ca1b99e887
--- /dev/null
+++ b/queue-5.10/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch
@@ -0,0 +1,44 @@
+From 33218f9e0b6ae8dbe54548e0b67f10ce38e6a6ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 17:49:32 +0200
+Subject: jdb2: Don't refuse invalidation of already invalidated buffers
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit bd159398a2d2234de07d310132865706964aaaa7 ]
+
+When invalidating buffers under the partial tail page,
+jbd2_journal_invalidate_folio() returns -EBUSY if the buffer is part of
+the committing transaction as we cannot safely modify buffer state.
+However if the buffer is already invalidated (due to previous
+invalidation attempts from ext4_wait_for_tail_page_commit()), there's
+nothing to do and there's no point in returning -EBUSY. This fixes
+occasional warnings from ext4_journalled_invalidate_folio() triggered by
+generic/051 fstest when blocksize < pagesize.
+
+Fixes: 53e872681fed ("ext4: fix deadlock in journal_unmap_buffer()")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230329154950.19720-1-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/transaction.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 1923528154b52..1baf2d607268f 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -2378,6 +2378,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
+ 			spin_unlock(&jh->b_state_lock);
+ 			write_unlock(&journal->j_state_lock);
+ 			jbd2_journal_put_journal_head(jh);
++			/* Already zapped buffer? Nothing to do... */
++			if (!bh->b_bdev)
++				return 0;
+ 			return -EBUSY;
+ 		}
+ 		/*
+-- 
+2.39.2
+
diff --git a/queue-5.10/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch b/queue-5.10/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch
new file mode 100644
index 00000000000..f94b57095af
--- /dev/null
+++ b/queue-5.10/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch
@@ -0,0 +1,62 @@
+From d0fda5bdb3020efed235ddc794fa7cdae391abb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Apr 2023 13:12:59 +0200
+Subject: leds: tca6507: Fix error handling of using
+ fwnode_property_read_string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit c1087c29e96a48e9080377e168d35dcb52fb068b ]
+
+Commit 96f524105b9c ("leds: tca6507: use fwnode API instead of OF")
+
+changed to fwnode API but did not take into account that a missing property
+"linux,default-trigger" now seems to return an error and as a side effect
+sets value to -1. This seems to be different from of_get_property() which
+always returned NULL in any case of error.
+
+Neglecting this side-effect leads to
+
+[   11.201965] Unable to handle kernel paging request at virtual address ffffffff when read
+
+in the strcmp() of led_trigger_set_default() if there is no led-trigger
+defined in the DTS.
+
+I don't know if this was recently introduced somewhere in the fwnode lib
+or if the effect was missed in initial testing. Anyways it seems to be a
+bug to ignore the error return value of an optional value here in the
+driver.
+
+Fixes: 96f524105b9c ("leds: tca6507: use fwnode API instead of OF")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/cbae7617db83113de726fcc423a805ebaa1bfca6.1680433978.git.hns@goldelico.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-tca6507.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c
+index 225b765830bdc..caad9d3e0eac8 100644
+--- a/drivers/leds/leds-tca6507.c
++++ b/drivers/leds/leds-tca6507.c
+@@ -696,8 +696,9 @@ tca6507_led_dt_init(struct device *dev)
+ 		if (fwnode_property_read_string(child, "label", &led.name))
+ 			led.name = fwnode_get_name(child);
+ 
+-		fwnode_property_read_string(child, "linux,default-trigger",
+-					    &led.default_trigger);
++		if (fwnode_property_read_string(child, "linux,default-trigger",
++						&led.default_trigger))
++			led.default_trigger = NULL;
+ 
+ 		led.flags = 0;
+ 		if (fwnode_property_match_string(child, "compatible",
+-- 
+2.39.2
+
diff --git a/queue-5.10/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch b/queue-5.10/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch
new file mode 100644
index 00000000000..12c30c32a1c
--- /dev/null
+++ b/queue-5.10/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch
@@ -0,0 +1,44 @@
+From f454de627251b00fee11dbbc6a68c5410ad98298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Feb 2023 21:39:49 -0800
+Subject: leds: TI_LMU_COMMON: select REGMAP instead of depending on it
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit a61079efc87888587e463afaed82417b162fbd69 ]
+
+REGMAP is a hidden (not user visible) symbol. Users cannot set it
+directly thru "make *config", so drivers should select it instead of
+depending on it if they need it.
+
+Consistently using "select" or "depends on" can also help reduce
+Kconfig circular dependency issues.
+
+Therefore, change the use of "depends on REGMAP" to "select REGMAP".
+
+Fixes: 3fce8e1eb994 ("leds: TI LMU: Add common code for TI LMU devices")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230226053953.4681-5-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
+index 56e8198e13d10..ad84be4f68171 100644
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -871,7 +871,7 @@ config LEDS_SPI_BYTE
+ config LEDS_TI_LMU_COMMON
+ 	tristate "LED driver for TI LMU"
+ 	depends on LEDS_CLASS
+-	depends on REGMAP
++	select REGMAP
+ 	help
+ 	  Say Y to enable the LED driver for TI LMU devices.
+ 	  This supports common features between the TI LM3532, LM3631, LM3632,
+-- 
+2.39.2
+
diff --git a/queue-5.10/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch b/queue-5.10/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch
new file mode 100644
index 00000000000..f54ca66bd06
--- /dev/null
+++ b/queue-5.10/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch
@@ -0,0 +1,58 @@
+From bfc84fdce0e0950cd8445cf4488e46ed961d7546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 19:15:29 -0700
+Subject: linux/vt_buffer.h: allow either builtin or modular for macros
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 2b76ffe81e32afd6d318dc4547e2ba8c46207b77 ]
+
+Fix build errors on ARCH=alpha when CONFIG_MDA_CONSOLE=m.
+This allows the ARCH macros to be the only ones defined.
+
+In file included from ../drivers/video/console/mdacon.c:37:
+../arch/alpha/include/asm/vga.h:17:40: error: expected identifier or '(' before 'volatile'
+   17 | static inline void scr_writew(u16 val, volatile u16 *addr)
+      |                                        ^~~~~~~~
+../include/linux/vt_buffer.h:24:34: note: in definition of macro 'scr_writew'
+   24 | #define scr_writew(val, addr) (*(addr) = (val))
+      |                                  ^~~~
+../include/linux/vt_buffer.h:24:40: error: expected ')' before '=' token
+   24 | #define scr_writew(val, addr) (*(addr) = (val))
+      |                                        ^
+../arch/alpha/include/asm/vga.h:17:20: note: in expansion of macro 'scr_writew'
+   17 | static inline void scr_writew(u16 val, volatile u16 *addr)
+      |                    ^~~~~~~~~~
+../arch/alpha/include/asm/vga.h:25:29: error: expected identifier or '(' before 'volatile'
+   25 | static inline u16 scr_readw(volatile const u16 *addr)
+      |                             ^~~~~~~~
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-fbdev@vger.kernel.org
+Link: https://lore.kernel.org/r/20230329021529.16188-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/vt_buffer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h
+index 848db1b1569ff..919d999a8c1db 100644
+--- a/include/linux/vt_buffer.h
++++ b/include/linux/vt_buffer.h
+@@ -16,7 +16,7 @@
+ 
+ #include <linux/string.h>
+ 
+-#if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_MDA_CONSOLE)
++#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE)
+ #include <asm/vga.h>
+ #endif
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/macintosh-via-pmu-led-requires-ata-to-be-set.patch b/queue-5.10/macintosh-via-pmu-led-requires-ata-to-be-set.patch
new file mode 100644
index 00000000000..164c53c9c3b
--- /dev/null
+++ b/queue-5.10/macintosh-via-pmu-led-requires-ata-to-be-set.patch
@@ -0,0 +1,45 @@
+From 67d36b48ac8fb7d6b814ddc0f2dcf8ce02342cad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 17:42:41 -0800
+Subject: macintosh: via-pmu-led: requires ATA to be set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 05dce4ba125336875cd3eed3c1503fa81cd2f691 ]
+
+LEDS_TRIGGER_DISK depends on ATA, so selecting LEDS_TRIGGER_DISK
+when ATA is not set/enabled causes a Kconfig warning:
+
+WARNING: unmet direct dependencies detected for LEDS_TRIGGER_DISK
+  Depends on [n]: NEW_LEDS [=y] && LEDS_TRIGGERS [=y] && ATA [=n]
+  Selected by [y]:
+  - ADB_PMU_LED_DISK [=y] && MACINTOSH_DRIVERS [=y] && ADB_PMU_LED [=y] && LEDS_CLASS [=y]
+
+Fix this by making ADB_PMU_LED_DISK depend on ATA.
+
+Seen on both PPC32 and PPC64.
+
+Fixes: 0e865a80c135 ("macintosh: Remove dependency on IDE_GD_ATA if ADB_PMU_LED_DISK is selected")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223014241.20878-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
+index 539a2ed4e13dc..a0e717a986dcb 100644
+--- a/drivers/macintosh/Kconfig
++++ b/drivers/macintosh/Kconfig
+@@ -86,6 +86,7 @@ config ADB_PMU_LED
+ 
+ config ADB_PMU_LED_DISK
+ 	bool "Use front LED as DISK LED by default"
++	depends on ATA
+ 	depends on ADB_PMU_LED
+ 	depends on LEDS_CLASS
+ 	select LEDS_TRIGGERS
+-- 
+2.39.2
+
diff --git a/queue-5.10/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch b/queue-5.10/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch
new file mode 100644
index 00000000000..bd7c719a6d8
--- /dev/null
+++ b/queue-5.10/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch
@@ -0,0 +1,36 @@
+From db25e24057119716456bbd96e5e3f7e6356acb5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 11:35:58 +0800
+Subject: macintosh/windfarm_smu_sat: Add missing of_node_put()
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 631cf002826007ab7415258ee647dcaf8845ad5a ]
+
+We call of_node_get() in wf_sat_probe() after sat is created,
+so we need the of_node_put() before *kfree(sat)*.
+
+Fixes: ac171c46667c ("[PATCH] powerpc: Thermal control for dual core G5s")
+Signed-off-by: Liang He <windhl@126.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230330033558.2562778-1-windhl@126.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/windfarm_smu_sat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
+index e46e1153a0b43..7d7d6213e32aa 100644
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -171,6 +171,7 @@ static void wf_sat_release(struct kref *ref)
+ 
+ 	if (sat->nr >= 0)
+ 		sats[sat->nr] = NULL;
++	of_node_put(sat->node);
+ 	kfree(sat);
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch b/queue-5.10/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch
new file mode 100644
index 00000000000..a518b8b85d3
--- /dev/null
+++ b/queue-5.10/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch
@@ -0,0 +1,73 @@
+From 19d0098b3394ee050036d819860b80c741a1d74a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:53 +0800
+Subject: md/raid10: fix leak of 'r10bio->remaining' for recovery
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 26208a7cffd0c7cbf14237ccd20c7270b3ffeb7e ]
+
+raid10_sync_request() will add 'r10bio->remaining' for both rdev and
+replacement rdev. However, if the read io fails, recovery_request_write()
+returns without issuing the write io, in this case, end_sync_request()
+is only called once and 'remaining' is leaked, cause an io hang.
+
+Fix the problem by decreasing 'remaining' according to if 'bio' and
+'repl_bio' is valid.
+
+Fixes: 24afd80d99f8 ("md/raid10: handle recovery of replacement devices.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-5-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 0e741a8d278df..ea0351fa1b549 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2212,11 +2212,22 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ {
+ 	struct r10conf *conf = mddev->private;
+ 	int d;
+-	struct bio *wbio, *wbio2;
++	struct bio *wbio = r10_bio->devs[1].bio;
++	struct bio *wbio2 = r10_bio->devs[1].repl_bio;
++
++	/* Need to test wbio2->bi_end_io before we call
++	 * submit_bio_noacct as if the former is NULL,
++	 * the latter is free to free wbio2.
++	 */
++	if (wbio2 && !wbio2->bi_end_io)
++		wbio2 = NULL;
+ 
+ 	if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) {
+ 		fix_recovery_read_error(r10_bio);
+-		end_sync_request(r10_bio);
++		if (wbio->bi_end_io)
++			end_sync_request(r10_bio);
++		if (wbio2)
++			end_sync_request(r10_bio);
+ 		return;
+ 	}
+ 
+@@ -2225,14 +2236,6 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ 	 * and submit the write request
+ 	 */
+ 	d = r10_bio->devs[1].devnum;
+-	wbio = r10_bio->devs[1].bio;
+-	wbio2 = r10_bio->devs[1].repl_bio;
+-	/* Need to test wbio2->bi_end_io before we call
+-	 * submit_bio_noacct as if the former is NULL,
+-	 * the latter is free to free wbio2.
+-	 */
+-	if (wbio2 && !wbio2->bi_end_io)
+-		wbio2 = NULL;
+ 	if (wbio->bi_end_io) {
+ 		atomic_inc(&conf->mirrors[d].rdev->nr_pending);
+ 		md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio));
+-- 
+2.39.2
+
diff --git a/queue-5.10/md-raid10-fix-memleak-for-conf-bio_split.patch b/queue-5.10/md-raid10-fix-memleak-for-conf-bio_split.patch
new file mode 100644
index 00000000000..1fe0fb3ab0b
--- /dev/null
+++ b/queue-5.10/md-raid10-fix-memleak-for-conf-bio_split.patch
@@ -0,0 +1,96 @@
+From e825ecc837738de29d32527d97718cbb5c08ecdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:54 +0800
+Subject: md/raid10: fix memleak for 'conf->bio_split'
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit c9ac2acde53f5385de185bccf6aaa91cf9ac1541 ]
+
+In the error path of raid10_run(), 'conf' need be freed, however,
+'conf->bio_split' is missed and memory will be leaked.
+
+Since there are 3 places to free 'conf', factor out a helper to fix the
+problem.
+
+Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-6-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 37 +++++++++++++++++--------------------
+ 1 file changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index ea0351fa1b549..51f122db9668e 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3618,6 +3618,20 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
+ 	return nc*fc;
+ }
+ 
++static void raid10_free_conf(struct r10conf *conf)
++{
++	if (!conf)
++		return;
++
++	mempool_exit(&conf->r10bio_pool);
++	kfree(conf->mirrors);
++	kfree(conf->mirrors_old);
++	kfree(conf->mirrors_new);
++	safe_put_page(conf->tmppage);
++	bioset_exit(&conf->bio_split);
++	kfree(conf);
++}
++
+ static struct r10conf *setup_conf(struct mddev *mddev)
+ {
+ 	struct r10conf *conf = NULL;
+@@ -3700,13 +3714,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+ 	return conf;
+ 
+  out:
+-	if (conf) {
+-		mempool_exit(&conf->r10bio_pool);
+-		kfree(conf->mirrors);
+-		safe_put_page(conf->tmppage);
+-		bioset_exit(&conf->bio_split);
+-		kfree(conf);
+-	}
++	raid10_free_conf(conf);
+ 	return ERR_PTR(err);
+ }
+ 
+@@ -3912,10 +3920,7 @@ static int raid10_run(struct mddev *mddev)
+ 
+ out_free_conf:
+ 	md_unregister_thread(&mddev->thread);
+-	mempool_exit(&conf->r10bio_pool);
+-	safe_put_page(conf->tmppage);
+-	kfree(conf->mirrors);
+-	kfree(conf);
++	raid10_free_conf(conf);
+ 	mddev->private = NULL;
+ out:
+ 	return -EIO;
+@@ -3923,15 +3928,7 @@ static int raid10_run(struct mddev *mddev)
+ 
+ static void raid10_free(struct mddev *mddev, void *priv)
+ {
+-	struct r10conf *conf = priv;
+-
+-	mempool_exit(&conf->r10bio_pool);
+-	safe_put_page(conf->tmppage);
+-	kfree(conf->mirrors);
+-	kfree(conf->mirrors_old);
+-	kfree(conf->mirrors_new);
+-	bioset_exit(&conf->bio_split);
+-	kfree(conf);
++	raid10_free_conf(priv);
+ }
+ 
+ static void raid10_quiesce(struct mddev *mddev, int quiesce)
+-- 
+2.39.2
+
diff --git a/queue-5.10/md-raid10-fix-memleak-of-md-thread.patch b/queue-5.10/md-raid10-fix-memleak-of-md-thread.patch
new file mode 100644
index 00000000000..683e6df73ca
--- /dev/null
+++ b/queue-5.10/md-raid10-fix-memleak-of-md-thread.patch
@@ -0,0 +1,51 @@
+From 27b907e7eba53ab9bfa71d5875806d9b10093b9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:55 +0800
+Subject: md/raid10: fix memleak of md thread
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit f0ddb83da3cbbf8a1f9087a642c448ff52ee9abd ]
+
+In raid10_run(), if setup_conf() succeed and raid10_run() failed before
+setting 'mddev->thread', then in the error path 'conf->thread' is not
+freed.
+
+Fix the problem by setting 'mddev->thread' right after setup_conf().
+
+Fixes: 43a521238aca ("md-cluster: choose correct label when clustered layout is not supported")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-7-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 51f122db9668e..c6a196a10f894 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3752,6 +3752,9 @@ static int raid10_run(struct mddev *mddev)
+ 	if (!conf)
+ 		goto out;
+ 
++	mddev->thread = conf->thread;
++	conf->thread = NULL;
++
+ 	if (mddev_is_clustered(conf->mddev)) {
+ 		int fc, fo;
+ 
+@@ -3764,9 +3767,6 @@ static int raid10_run(struct mddev *mddev)
+ 		}
+ 	}
+ 
+-	mddev->thread = conf->thread;
+-	conf->thread = NULL;
+-
+ 	if (mddev->queue) {
+ 		blk_queue_max_discard_sectors(mddev->queue,
+ 					      mddev->chunk_sectors);
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-bdisp-add-missing-check-for-create_workqueue.patch b/queue-5.10/media-bdisp-add-missing-check-for-create_workqueue.patch
new file mode 100644
index 00000000000..7fd7219ca8f
--- /dev/null
+++ b/queue-5.10/media-bdisp-add-missing-check-for-create_workqueue.patch
@@ -0,0 +1,37 @@
+From 6ce3f2c0314f217d97e91360dca2380cf7761e31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 08:14:42 +0100
+Subject: media: bdisp: Add missing check for create_workqueue
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 2371adeab717d8fe32144a84f3491a03c5838cfb ]
+
+Add the check for the return value of the create_workqueue
+in order to avoid NULL pointer dereference.
+
+Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+index 85288da9d2ae6..182e5a4aeb171 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+@@ -1310,6 +1310,8 @@ static int bdisp_probe(struct platform_device *pdev)
+ 	init_waitqueue_head(&bdisp->irq_queue);
+ 	INIT_DELAYED_WORK(&bdisp->timeout_work, bdisp_irq_timeout);
+ 	bdisp->work_queue = create_workqueue(BDISP_NAME);
++	if (!bdisp->work_queue)
++		return -ENOMEM;
+ 
+ 	spin_lock_init(&bdisp->slock);
+ 	mutex_init(&bdisp->lock);
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch b/queue-5.10/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch
new file mode 100644
index 00000000000..44d6d8e5ff2
--- /dev/null
+++ b/queue-5.10/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch
@@ -0,0 +1,56 @@
+From c547c2c34f6b209af58379d84994b59c416f2c39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 16:15:06 +0800
+Subject: media: dm1105: Fix use after free bug in dm1105_remove due to race
+ condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ]
+
+In dm1105_probe, it called dm1105_ir_init and bound
+&dm1105->ir.work with dm1105_emit_key.
+When it handles IRQ request with dm1105_irq,
+it may call schedule_work to start the work.
+
+When we call dm1105_remove to remove the driver, there
+may be a sequence as follows:
+
+Fix it by finishing the work before cleanup in dm1105_remove
+
+CPU0                  CPU1
+
+                    |dm1105_emit_key
+dm1105_remove      |
+  dm1105_ir_exit       |
+    rc_unregister_device |
+    rc_free_device  |
+    rc_dev_release  |
+    kfree(dev);     |
+                    |
+                    | rc_keydown
+                    |   //use
+
+Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/dm1105/dm1105.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c
+index 9dce31d2b525b..d2e194a24e7e7 100644
+--- a/drivers/media/pci/dm1105/dm1105.c
++++ b/drivers/media/pci/dm1105/dm1105.c
+@@ -1178,6 +1178,7 @@ static void dm1105_remove(struct pci_dev *pdev)
+ 	struct dvb_demux *dvbdemux = &dev->demux;
+ 	struct dmx_demux *dmx = &dvbdemux->dmx;
+ 
++	cancel_work_sync(&dev->ir.work);
+ 	dm1105_ir_exit(dev);
+ 	dmx->close(dmx);
+ 	dvb_net_release(&dev->dvbnet);
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-max9286-free-control-handler.patch b/queue-5.10/media-max9286-free-control-handler.patch
new file mode 100644
index 00000000000..a1c9a65f575
--- /dev/null
+++ b/queue-5.10/media-max9286-free-control-handler.patch
@@ -0,0 +1,41 @@
+From d2d7b452cf2db589b58c14200f787d70859b6aae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jan 2023 22:46:50 +0100
+Subject: media: max9286: Free control handler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit bfce6a12e5ba1edde95126aa06778027f16115d4 ]
+
+The control handler is leaked in some probe-time error paths, as well as
+in the remove path. Fix it.
+
+Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver")
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/max9286.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
+index 79a11c0184c65..62ce27552dd3c 100644
+--- a/drivers/media/i2c/max9286.c
++++ b/drivers/media/i2c/max9286.c
+@@ -899,6 +899,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv)
+ static void max9286_v4l2_unregister(struct max9286_priv *priv)
+ {
+ 	fwnode_handle_put(priv->sd.fwnode);
++	v4l2_ctrl_handler_free(&priv->ctrls);
+ 	v4l2_async_unregister_subdev(&priv->sd);
+ 	max9286_v4l2_notifier_unregister(priv);
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch b/queue-5.10/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch
new file mode 100644
index 00000000000..2c71e68a35d
--- /dev/null
+++ b/queue-5.10/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch
@@ -0,0 +1,43 @@
+From 9cf5c3c911b6fd26500d2cb58a74bc606efa57ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 13:38:33 -0700
+Subject: media: rc: gpio-ir-recv: Fix support for wake-up
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 9c592f8ab114875fdb3b2040f01818e53de44991 ]
+
+The driver was intended from the start to be a wake-up source for the
+system, however due to the absence of a suitable call to
+device_set_wakeup_capable(), the device_may_wakeup() call used to decide
+whether to enable the GPIO interrupt as a wake-up source would never
+happen. Lookup the DT standard "wakeup-source" property and call
+device_init_wakeup() to ensure the device is flagged as being wakeup
+capable.
+
+Reported-by: Matthew Lear <matthew.lear@broadcom.com>
+Fixes: fd0f6851eb46 ("[media] rc: Add support for GPIO based IR Receiver driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/gpio-ir-recv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c
+index a56c844d7f816..16795e07dc103 100644
+--- a/drivers/media/rc/gpio-ir-recv.c
++++ b/drivers/media/rc/gpio-ir-recv.c
+@@ -107,6 +107,8 @@ static int gpio_ir_recv_probe(struct platform_device *pdev)
+ 		rcdev->map_name = RC_MAP_EMPTY;
+ 
+ 	gpio_dev->rcdev = rcdev;
++	if (of_property_read_bool(np, "wakeup-source"))
++		device_init_wakeup(dev, true);
+ 
+ 	rc = devm_rc_register_device(dev, rcdev);
+ 	if (rc < 0) {
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.10/media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch
new file mode 100644
index 00000000000..dfb4770fb18
--- /dev/null
+++ b/queue-5.10/media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch
@@ -0,0 +1,76 @@
+From 40c979b26edd2df68330c7383322abc5b9ff599a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 16:59:34 +0200
+Subject: media: rcar_fdp1: fix pm_runtime_get_sync() usage count
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 45e75a8c6fa455a5909ac04db76a4b15d6bb8368 ]
+
+The pm_runtime_get_sync() internally increments the
+dev->power.usage_count without decrementing it, even on errors.
+Replace it by the new pm_runtime_resume_and_get(), introduced by:
+commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter")
+in order to properly decrement the usage counter, avoiding
+a potential PM usage counter leak.
+
+Also, right now, the driver is ignoring any troubles when
+trying to do PM resume. So, add the proper error handling
+for the code.
+
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index ac2e7b2c60829..cedae184c6ad4 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2139,7 +2139,9 @@ static int fdp1_open(struct file *file)
+ 	}
+ 
+ 	/* Perform any power management required */
+-	pm_runtime_get_sync(fdp1->dev);
++	ret = pm_runtime_resume_and_get(fdp1->dev);
++	if (ret < 0)
++		goto error_pm;
+ 
+ 	v4l2_fh_add(&ctx->fh);
+ 
+@@ -2149,6 +2151,8 @@ static int fdp1_open(struct file *file)
+ 	mutex_unlock(&fdp1->dev_mutex);
+ 	return 0;
+ 
++error_pm:
++       v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+ error_ctx:
+ 	v4l2_ctrl_handler_free(&ctx->hdl);
+ 	kfree(ctx);
+@@ -2356,7 +2360,9 @@ static int fdp1_probe(struct platform_device *pdev)
+ 
+ 	/* Power up the cells to read HW */
+ 	pm_runtime_enable(&pdev->dev);
+-	pm_runtime_get_sync(fdp1->dev);
++	ret = pm_runtime_resume_and_get(fdp1->dev);
++	if (ret < 0)
++		goto disable_pm;
+ 
+ 	hw_version = fdp1_read(fdp1, FD1_IP_INTDATA);
+ 	switch (hw_version) {
+@@ -2385,6 +2391,9 @@ static int fdp1_probe(struct platform_device *pdev)
+ 
+ 	return 0;
+ 
++disable_pm:
++	pm_runtime_disable(fdp1->dev);
++
+ release_m2m:
+ 	v4l2_m2m_release(fdp1->m2m_dev);
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch b/queue-5.10/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch
new file mode 100644
index 00000000000..22fa0c1e457
--- /dev/null
+++ b/queue-5.10/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch
@@ -0,0 +1,70 @@
+From 676e8e0b938a5d7e0e37b5a36d8c035213c46de4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 11:58:09 +0400
+Subject: media: rcar_fdp1: Fix refcount leak in probe and remove function
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit c766c90faf93897b77c9c5daa603cffab85ba907 ]
+
+rcar_fcp_get() take reference, which should be balanced with
+rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and
+the error paths of fdp1_probe() to fix this.
+
+Fixes: 4710b752e029 ("[media] v4l: Add Renesas R-Car FDP1 Driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+[hverkuil: resolve merge conflict, remove() is now void]
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 1dd8bebb66f53..44a57fa06e74a 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2317,8 +2317,10 @@ static int fdp1_probe(struct platform_device *pdev)
+ 
+ 	/* Determine our clock rate */
+ 	clk = clk_get(&pdev->dev, NULL);
+-	if (IS_ERR(clk))
+-		return PTR_ERR(clk);
++	if (IS_ERR(clk)) {
++		ret = PTR_ERR(clk);
++		goto put_dev;
++	}
+ 
+ 	fdp1->clk_rate = clk_get_rate(clk);
+ 	clk_put(clk);
+@@ -2327,7 +2329,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ 	ret = v4l2_device_register(&pdev->dev, &fdp1->v4l2_dev);
+ 	if (ret) {
+ 		v4l2_err(&fdp1->v4l2_dev, "Failed to register video device\n");
+-		return ret;
++		goto put_dev;
+ 	}
+ 
+ 	/* M2M registration */
+@@ -2397,6 +2399,8 @@ static int fdp1_probe(struct platform_device *pdev)
+ unreg_dev:
+ 	v4l2_device_unregister(&fdp1->v4l2_dev);
+ 
++put_dev:
++	rcar_fcp_put(fdp1->fcp);
+ 	return ret;
+ }
+ 
+@@ -2408,6 +2412,7 @@ static int fdp1_remove(struct platform_device *pdev)
+ 	video_unregister_device(&fdp1->vfd);
+ 	v4l2_device_unregister(&fdp1->v4l2_dev);
+ 	pm_runtime_disable(&pdev->dev);
++	rcar_fcp_put(fdp1->fcp);
+ 
+ 	return 0;
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-rcar_fdp1-fix-the-correct-variable-assignments.patch b/queue-5.10/media-rcar_fdp1-fix-the-correct-variable-assignments.patch
new file mode 100644
index 00000000000..71a47ec4742
--- /dev/null
+++ b/queue-5.10/media-rcar_fdp1-fix-the-correct-variable-assignments.patch
@@ -0,0 +1,48 @@
+From df57f364449f52243f92a9c44b9ba27de4ef679e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Oct 2021 05:09:38 +0200
+Subject: media: rcar_fdp1: Fix the correct variable assignments
+
+From: Tang Bin <tangbin@cmss.chinamobile.com>
+
+[ Upstream commit af88c2adbb72a09ab1bb5c37ba388c98fecca69b ]
+
+In the function fdp1_probe(), when get irq failed, the
+function platform_get_irq() log an error message, so
+remove redundant message here. And the variable type
+of "ret" is int, the "fdp1->irq" is unsigned int, when
+irq failed, this place maybe wrong, thus fix it.
+
+Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 782e805b85da2..1dd8bebb66f53 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2291,11 +2291,10 @@ static int fdp1_probe(struct platform_device *pdev)
+ 		return PTR_ERR(fdp1->regs);
+ 
+ 	/* Interrupt service routine registration */
+-	fdp1->irq = ret = platform_get_irq(pdev, 0);
+-	if (ret < 0) {
+-		dev_err(&pdev->dev, "cannot find IRQ\n");
++	ret = platform_get_irq(pdev, 0);
++	if (ret < 0)
+ 		return ret;
+-	}
++	fdp1->irq = ret;
+ 
+ 	ret = devm_request_irq(&pdev->dev, fdp1->irq, fdp1_irq_handler, 0,
+ 			       dev_name(&pdev->dev), fdp1);
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch b/queue-5.10/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch
new file mode 100644
index 00000000000..5f0531665f4
--- /dev/null
+++ b/queue-5.10/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch
@@ -0,0 +1,49 @@
+From f0b5b212ca55560f932d98f361c7f8af6751aeb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Sep 2021 07:55:24 +0200
+Subject: media: rcar_fdp1: Make use of the helper function
+ devm_platform_ioremap_resource()
+
+From: Cai Huoqing <caihuoqing@baidu.com>
+
+[ Upstream commit 736cce12fa630e28705de06570d74f0513d948d5 ]
+
+Use the devm_platform_ioremap_resource() helper instead of
+calling platform_get_resource() and devm_ioremap_resource()
+separately
+
+Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index cedae184c6ad4..782e805b85da2 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2260,7 +2260,6 @@ static int fdp1_probe(struct platform_device *pdev)
+ 	struct fdp1_dev *fdp1;
+ 	struct video_device *vfd;
+ 	struct device_node *fcp_node;
+-	struct resource *res;
+ 	struct clk *clk;
+ 	unsigned int i;
+ 
+@@ -2287,8 +2286,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, fdp1);
+ 
+ 	/* Memory-mapped registers */
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	fdp1->regs = devm_ioremap_resource(&pdev->dev, res);
++	fdp1->regs = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(fdp1->regs))
+ 		return PTR_ERR(fdp1->regs);
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch b/queue-5.10/media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch
new file mode 100644
index 00000000000..35ca13d41e2
--- /dev/null
+++ b/queue-5.10/media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch
@@ -0,0 +1,62 @@
+From 1dc2009c9e96d3d1606bacf11a1aacb2899bdadb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 16:59:34 +0200
+Subject: media: rcar_fdp1: simplify error check logic at fdp_open()
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fa9f443f7c962d072d150472e2bb77de39817a9a ]
+
+Avoid some code duplication by moving the common error path
+logic at fdp_open().
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index c9448de885b62..ac2e7b2c60829 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2121,9 +2121,7 @@ static int fdp1_open(struct file *file)
+ 
+ 	if (ctx->hdl.error) {
+ 		ret = ctx->hdl.error;
+-		v4l2_ctrl_handler_free(&ctx->hdl);
+-		kfree(ctx);
+-		goto done;
++		goto error_ctx;
+ 	}
+ 
+ 	ctx->fh.ctrl_handler = &ctx->hdl;
+@@ -2137,10 +2135,7 @@ static int fdp1_open(struct file *file)
+ 
+ 	if (IS_ERR(ctx->fh.m2m_ctx)) {
+ 		ret = PTR_ERR(ctx->fh.m2m_ctx);
+-
+-		v4l2_ctrl_handler_free(&ctx->hdl);
+-		kfree(ctx);
+-		goto done;
++		goto error_ctx;
+ 	}
+ 
+ 	/* Perform any power management required */
+@@ -2151,6 +2146,12 @@ static int fdp1_open(struct file *file)
+ 	dprintk(fdp1, "Created instance: %p, m2m_ctx: %p\n",
+ 		ctx, ctx->fh.m2m_ctx);
+ 
++	mutex_unlock(&fdp1->dev_mutex);
++	return 0;
++
++error_ctx:
++	v4l2_ctrl_handler_free(&ctx->hdl);
++	kfree(ctx);
+ done:
+ 	mutex_unlock(&fdp1->dev_mutex);
+ 	return ret;
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch b/queue-5.10/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch
new file mode 100644
index 00000000000..e19eef80d06
--- /dev/null
+++ b/queue-5.10/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch
@@ -0,0 +1,56 @@
+From 42255cb267cfa9ee45eb103eaa51838f63011ee9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 16:42:20 +0000
+Subject: media: rkvdec: fix use after free bug in rkvdec_remove
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 3228cec23b8b29215e18090c6ba635840190993d ]
+
+In rkvdec_probe, rkvdec->watchdog_work is bound with
+rkvdec_watchdog_func. Then rkvdec_vp9_run may
+be called to start the work.
+
+If we remove the module which will call rkvdec_remove
+ to make cleanup, there may be a unfinished work.
+ The possible sequence is as follows, which will
+ cause a typical UAF bug.
+
+Fix it by canceling the work before cleanup in rkvdec_remove.
+
+CPU0                  CPU1
+
+                    |rkvdec_watchdog_func
+rkvdec_remove       |
+ rkvdec_v4l2_cleanup|
+  v4l2_m2m_release  |
+    kfree(m2m_dev); |
+                    |
+                    | v4l2_m2m_get_curr_priv
+                    |   m2m_dev->curr_ctx //use
+
+Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkvdec/rkvdec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
+index e384ea8d72801..f6a29a7078625 100644
+--- a/drivers/staging/media/rkvdec/rkvdec.c
++++ b/drivers/staging/media/rkvdec/rkvdec.c
+@@ -1077,6 +1077,8 @@ static int rkvdec_remove(struct platform_device *pdev)
+ {
+ 	struct rkvdec_dev *rkvdec = platform_get_drvdata(pdev);
+ 
++	cancel_delayed_work_sync(&rkvdec->watchdog_work);
++
+ 	rkvdec_v4l2_cleanup(rkvdec);
+ 	pm_runtime_disable(&pdev->dev);
+ 	pm_runtime_dont_use_autosuspend(&pdev->dev);
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch b/queue-5.10/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch
new file mode 100644
index 00000000000..6d5938abdc6
--- /dev/null
+++ b/queue-5.10/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch
@@ -0,0 +1,86 @@
+From 854aad1deede9565e1cea7ee25e2e31a85e9d8c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 16:50:23 +0800
+Subject: media: saa7134: fix use after free bug in saa7134_finidev due to race
+ condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ]
+
+In saa7134_initdev, it will call saa7134_hwinit1. There are three
+function invoking here: saa7134_video_init1, saa7134_ts_init1
+and saa7134_vbi_init1.
+
+All of them will init a timer with same function. Take
+saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout
+with saa7134_buffer_timeout.
+
+In buffer_activate, the timer funtcion is started.
+
+If we remove the module or device which will call saa7134_finidev
+to make cleanup, there may be a unfinished work. The
+possible sequence is as follows, which will cause a
+typical UAF bug.
+
+Fix it by canceling the timer works accordingly before cleanup in
+saa7134_finidev.
+
+CPU0                  CPU1
+
+                    |saa7134_buffer_timeout
+saa7134_finidev     |
+  kfree(dev);       |
+                    |
+                    | saa7134_buffer_next
+                    | //use dev
+
+Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-ts.c    | 1 +
+ drivers/media/pci/saa7134/saa7134-vbi.c   | 1 +
+ drivers/media/pci/saa7134/saa7134-video.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c
+index 6a5053126237f..437dbe5e75e29 100644
+--- a/drivers/media/pci/saa7134/saa7134-ts.c
++++ b/drivers/media/pci/saa7134/saa7134-ts.c
+@@ -300,6 +300,7 @@ int saa7134_ts_start(struct saa7134_dev *dev)
+ 
+ int saa7134_ts_fini(struct saa7134_dev *dev)
+ {
++	del_timer_sync(&dev->ts_q.timeout);
+ 	saa7134_pgtable_free(dev->pci, &dev->ts_q.pt);
+ 	return 0;
+ }
+diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c
+index 3f0b0933eed69..3e773690468bd 100644
+--- a/drivers/media/pci/saa7134/saa7134-vbi.c
++++ b/drivers/media/pci/saa7134/saa7134-vbi.c
+@@ -185,6 +185,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev)
+ int saa7134_vbi_fini(struct saa7134_dev *dev)
+ {
+ 	/* nothing */
++	del_timer_sync(&dev->vbi_q.timeout);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
+index 85d082baaadc5..df9e3293015a2 100644
+--- a/drivers/media/pci/saa7134/saa7134-video.c
++++ b/drivers/media/pci/saa7134/saa7134-video.c
+@@ -2153,6 +2153,7 @@ int saa7134_video_init1(struct saa7134_dev *dev)
+ 
+ void saa7134_video_fini(struct saa7134_dev *dev)
+ {
++	del_timer_sync(&dev->video_q.timeout);
+ 	/* free stuff */
+ 	saa7134_pgtable_free(dev->pci, &dev->video_q.pt);
+ 	saa7134_pgtable_free(dev->pci, &dev->vbi_q.pt);
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-venus-dec-fix-handling-of-the-start-cmd.patch b/queue-5.10/media-venus-dec-fix-handling-of-the-start-cmd.patch
new file mode 100644
index 00000000000..a2214ff3abb
--- /dev/null
+++ b/queue-5.10/media-venus-dec-fix-handling-of-the-start-cmd.patch
@@ -0,0 +1,61 @@
+From a18cf94cbc0db2d756f917e3831c541bf930cda5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 13:54:18 +0000
+Subject: media: venus: dec: Fix handling of the start cmd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Krawczyk <mk@semihalf.com>
+
+[ Upstream commit 50248ad9f190d527cbd578190ca769729518b703 ]
+
+The decoder driver should clear the last_buffer_dequeued flag of the
+capture queue upon receiving V4L2_DEC_CMD_START.
+
+The last_buffer_dequeued flag is set upon receiving EOS (which always
+happens upon receiving V4L2_DEC_CMD_STOP).
+
+Without this patch, after issuing the V4L2_DEC_CMD_STOP and
+V4L2_DEC_CMD_START, the vb2_dqbuf() function will always fail, even if
+the buffers are completed by the hardware.
+
+Fixes: beac82904a87 ("media: venus: make decoder compliant with stateful codec API")
+
+Signed-off-by: Michał Krawczyk <mk@semihalf.com>
+Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/vdec.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index 766c292915272..c437a929a5451 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -495,6 +495,7 @@ static int
+ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
+ {
+ 	struct venus_inst *inst = to_inst(file);
++	struct vb2_queue *dst_vq;
+ 	struct hfi_frame_data fdata = {0};
+ 	int ret;
+ 
+@@ -522,6 +523,13 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
+ 			inst->codec_state = VENUS_DEC_STATE_DRAIN;
+ 			inst->drain_active = true;
+ 		}
++	} else if (cmd->cmd == V4L2_DEC_CMD_START &&
++		   inst->codec_state == VENUS_DEC_STATE_STOPPED) {
++		dst_vq = v4l2_m2m_get_vq(inst->fh.m2m_ctx,
++					 V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++		vb2_clear_last_buffer_dequeued(dst_vq);
++
++		inst->codec_state = VENUS_DEC_STATE_DECODING;
+ 	}
+ 
+ unlock:
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-venus-preserve-drc-state-across-seeks.patch b/queue-5.10/media-venus-preserve-drc-state-across-seeks.patch
new file mode 100644
index 00000000000..39b2691e12c
--- /dev/null
+++ b/queue-5.10/media-venus-preserve-drc-state-across-seeks.patch
@@ -0,0 +1,74 @@
+From e72b67036536dd913483fb18c8580a7b7f2b860a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 06:34:24 +0100
+Subject: media: venus: preserve DRC state across seeks
+
+From: Alexandre Courbot <acourbot@chromium.org>
+
+[ Upstream commit d5ee32d7e5929592ad9b6e7a919dcdf89d05221b ]
+
+DRC events can happen virtually at anytime, including when we are
+starting a seek. Should this happen, we must make sure to return to the
+DRC state, otherwise the firmware will expect buffers of the new
+resolution whereas userspace will still work with the old one.
+
+Returning to the DRC state upon resume for seeking makes sure that the
+client will get the DRC event and will reallocate the buffers to fit the
+firmware's expectations.
+
+Signed-off-by: Alexandre Courbot <acourbot@chromium.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 50248ad9f190 ("media: venus: dec: Fix handling of the start cmd")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/vdec.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index 3adff10fce6a7..1bb2350408cf2 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -987,7 +987,10 @@ static int vdec_start_output(struct venus_inst *inst)
+ 
+ 	if (inst->codec_state == VENUS_DEC_STATE_SEEK) {
+ 		ret = venus_helper_process_initial_out_bufs(inst);
+-		inst->codec_state = VENUS_DEC_STATE_DECODING;
++		if (inst->next_buf_last)
++			inst->codec_state = VENUS_DEC_STATE_DRC;
++		else
++			inst->codec_state = VENUS_DEC_STATE_DECODING;
+ 		goto done;
+ 	}
+ 
+@@ -1093,8 +1096,10 @@ static int vdec_stop_capture(struct venus_inst *inst)
+ 		ret = hfi_session_flush(inst, HFI_FLUSH_ALL, true);
+ 		fallthrough;
+ 	case VENUS_DEC_STATE_DRAIN:
+-		vdec_cancel_dst_buffers(inst);
+ 		inst->codec_state = VENUS_DEC_STATE_STOPPED;
++		fallthrough;
++	case VENUS_DEC_STATE_SEEK:
++		vdec_cancel_dst_buffers(inst);
+ 		break;
+ 	case VENUS_DEC_STATE_DRC:
+ 		ret = hfi_session_flush(inst, HFI_FLUSH_OUTPUT, true);
+@@ -1116,6 +1121,7 @@ static int vdec_stop_output(struct venus_inst *inst)
+ 	case VENUS_DEC_STATE_DECODING:
+ 	case VENUS_DEC_STATE_DRAIN:
+ 	case VENUS_DEC_STATE_STOPPED:
++	case VENUS_DEC_STATE_DRC:
+ 		ret = hfi_session_flush(inst, HFI_FLUSH_ALL, true);
+ 		inst->codec_state = VENUS_DEC_STATE_SEEK;
+ 		break;
+@@ -1375,6 +1381,7 @@ static void vdec_event_change(struct venus_inst *inst,
+ 			dev_dbg(dev, VDBGH "flush output error %d\n", ret);
+ 	}
+ 
++	inst->next_buf_last = true;
+ 	inst->reconfig = true;
+ 	v4l2_event_queue_fh(&inst->fh, &ev);
+ 	wake_up(&inst->reconf_wait);
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-venus-vdec-fix-non-reliable-setting-of-last-fl.patch b/queue-5.10/media-venus-vdec-fix-non-reliable-setting-of-last-fl.patch
new file mode 100644
index 00000000000..374193bbfef
--- /dev/null
+++ b/queue-5.10/media-venus-vdec-fix-non-reliable-setting-of-last-fl.patch
@@ -0,0 +1,186 @@
+From ab5d6e1b42a6d13729e4221624b03d964acf0036 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Sep 2020 18:44:29 +0200
+Subject: media: venus: vdec: Fix non reliable setting of LAST flag
+
+From: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+
+[ Upstream commit acf8a57d8caf5ceabbe50774953fe04745ad1a50 ]
+
+In real use of dynamic-resolution-change it is observed that the
+LAST buffer flag (which marks the last decoded buffer with the
+resolution before the resolution-change event) is not reliably set.
+
+Fix this by set the LAST buffer flag on next queued capture buffer
+after the resolution-change event.
+
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 50248ad9f190 ("media: venus: dec: Fix handling of the start cmd")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/core.h    |  5 +--
+ drivers/media/platform/qcom/venus/helpers.c |  6 +++
+ drivers/media/platform/qcom/venus/vdec.c    | 45 ++++++++++++---------
+ 3 files changed, 33 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h
+index f2a0ef9ee884e..f78eed2c243a8 100644
+--- a/drivers/media/platform/qcom/venus/core.h
++++ b/drivers/media/platform/qcom/venus/core.h
+@@ -283,7 +283,6 @@ enum venus_dec_state {
+ 	VENUS_DEC_STATE_DRAIN		= 5,
+ 	VENUS_DEC_STATE_DECODING	= 6,
+ 	VENUS_DEC_STATE_DRC		= 7,
+-	VENUS_DEC_STATE_DRC_FLUSH_DONE	= 8,
+ };
+ 
+ struct venus_ts_metadata {
+@@ -348,7 +347,7 @@ struct venus_ts_metadata {
+  * @priv:	a private for HFI operations callbacks
+  * @session_type:	the type of the session (decoder or encoder)
+  * @hprop:	a union used as a holder by get property
+- * @last_buf:	last capture buffer for dynamic-resoluton-change
++ * @next_buf_last: a flag to mark next queued capture buffer as last
+  */
+ struct venus_inst {
+ 	struct list_head list;
+@@ -410,7 +409,7 @@ struct venus_inst {
+ 	union hfi_get_property hprop;
+ 	unsigned int core_acquired: 1;
+ 	unsigned int bit_depth;
+-	struct vb2_buffer *last_buf;
++	bool next_buf_last;
+ };
+ 
+ #define IS_V1(core)	((core)->res->hfi_version == HFI_VERSION_1XX)
+diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
+index 50439eb1ffeaa..5ca3920237c5a 100644
+--- a/drivers/media/platform/qcom/venus/helpers.c
++++ b/drivers/media/platform/qcom/venus/helpers.c
+@@ -1347,6 +1347,12 @@ void venus_helper_vb2_buf_queue(struct vb2_buffer *vb)
+ 
+ 	v4l2_m2m_buf_queue(m2m_ctx, vbuf);
+ 
++	/* Skip processing queued capture buffers after LAST flag */
++	if (inst->session_type == VIDC_SESSION_TYPE_DEC &&
++	    V4L2_TYPE_IS_CAPTURE(vb->vb2_queue->type) &&
++	    inst->codec_state == VENUS_DEC_STATE_DRC)
++		goto unlock;
++
+ 	cache_payload(inst, vb);
+ 
+ 	if (inst->session_type == VIDC_SESSION_TYPE_ENC &&
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index de34a87d1130e..b6b5ae0a457bb 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -916,10 +916,6 @@ static int vdec_start_capture(struct venus_inst *inst)
+ 		return 0;
+ 
+ reconfigure:
+-	ret = hfi_session_flush(inst, HFI_FLUSH_OUTPUT, true);
+-	if (ret)
+-		return ret;
+-
+ 	ret = vdec_output_conf(inst);
+ 	if (ret)
+ 		return ret;
+@@ -947,6 +943,8 @@ static int vdec_start_capture(struct venus_inst *inst)
+ 
+ 	venus_pm_load_scale(inst);
+ 
++	inst->next_buf_last = false;
++
+ 	ret = hfi_session_continue(inst);
+ 	if (ret)
+ 		goto free_dpb_bufs;
+@@ -987,6 +985,7 @@ static int vdec_start_output(struct venus_inst *inst)
+ 	venus_helper_init_instance(inst);
+ 	inst->sequence_out = 0;
+ 	inst->reconfig = false;
++	inst->next_buf_last = false;
+ 
+ 	ret = vdec_set_properties(inst);
+ 	if (ret)
+@@ -1080,9 +1079,7 @@ static int vdec_stop_capture(struct venus_inst *inst)
+ 		inst->codec_state = VENUS_DEC_STATE_STOPPED;
+ 		break;
+ 	case VENUS_DEC_STATE_DRC:
+-		WARN_ON(1);
+-		fallthrough;
+-	case VENUS_DEC_STATE_DRC_FLUSH_DONE:
++		ret = hfi_session_flush(inst, HFI_FLUSH_OUTPUT, true);
+ 		inst->codec_state = VENUS_DEC_STATE_CAPTURE_SETUP;
+ 		venus_helper_free_dpb_bufs(inst);
+ 		break;
+@@ -1206,9 +1203,28 @@ static void vdec_buf_cleanup(struct vb2_buffer *vb)
+ static void vdec_vb2_buf_queue(struct vb2_buffer *vb)
+ {
+ 	struct venus_inst *inst = vb2_get_drv_priv(vb->vb2_queue);
++	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
++	static const struct v4l2_event eos = { .type = V4L2_EVENT_EOS };
+ 
+ 	vdec_pm_get_put(inst);
+ 
++	mutex_lock(&inst->lock);
++
++	if (inst->next_buf_last && V4L2_TYPE_IS_CAPTURE(vb->vb2_queue->type) &&
++	    inst->codec_state == VENUS_DEC_STATE_DRC) {
++		vbuf->flags |= V4L2_BUF_FLAG_LAST;
++		vbuf->sequence = inst->sequence_cap++;
++		vbuf->field = V4L2_FIELD_NONE;
++		vb2_set_plane_payload(vb, 0, 0);
++		v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_DONE);
++		v4l2_event_queue_fh(&inst->fh, &eos);
++		inst->next_buf_last = false;
++		mutex_unlock(&inst->lock);
++		return;
++	}
++
++	mutex_unlock(&inst->lock);
++
+ 	venus_helper_vb2_buf_queue(vb);
+ }
+ 
+@@ -1252,13 +1268,6 @@ static void vdec_buf_done(struct venus_inst *inst, unsigned int buf_type,
+ 		vb->timestamp = timestamp_us * NSEC_PER_USEC;
+ 		vbuf->sequence = inst->sequence_cap++;
+ 
+-		if (inst->last_buf == vb) {
+-			inst->last_buf = NULL;
+-			vbuf->flags |= V4L2_BUF_FLAG_LAST;
+-			vb2_set_plane_payload(vb, 0, 0);
+-			vb->timestamp = 0;
+-		}
+-
+ 		if (vbuf->flags & V4L2_BUF_FLAG_LAST) {
+ 			const struct v4l2_event ev = { .type = V4L2_EVENT_EOS };
+ 
+@@ -1343,12 +1352,9 @@ static void vdec_event_change(struct venus_inst *inst,
+ 	 */
+ 
+ 	if (!sufficient && inst->codec_state == VENUS_DEC_STATE_DRC) {
+-		struct vb2_v4l2_buffer *last;
+ 		int ret;
+ 
+-		last = v4l2_m2m_last_dst_buf(inst->m2m_ctx);
+-		if (last)
+-			inst->last_buf = &last->vb2_buf;
++		inst->next_buf_last = true;
+ 
+ 		ret = hfi_session_flush(inst, HFI_FLUSH_OUTPUT, false);
+ 		if (ret)
+@@ -1397,8 +1403,7 @@ static void vdec_event_notify(struct venus_inst *inst, u32 event,
+ 
+ static void vdec_flush_done(struct venus_inst *inst)
+ {
+-	if (inst->codec_state == VENUS_DEC_STATE_DRC)
+-		inst->codec_state = VENUS_DEC_STATE_DRC_FLUSH_DONE;
++	dev_dbg(inst->core->dev_dec, VDBGH "flush done\n");
+ }
+ 
+ static const struct hfi_inst_ops vdec_hfi_ops = {
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-venus-vdec-handle-drc-after-drain.patch b/queue-5.10/media-venus-vdec-handle-drc-after-drain.patch
new file mode 100644
index 00000000000..238d6cf9e09
--- /dev/null
+++ b/queue-5.10/media-venus-vdec-handle-drc-after-drain.patch
@@ -0,0 +1,99 @@
+From bdcfc4c8b14f00bc27fb00f3b823ed3260d29d1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 05:23:23 +0100
+Subject: media: venus: vdec: Handle DRC after drain
+
+From: Fritz Koenig <frkoenig@chromium.org>
+
+[ Upstream commit c8e8dabcd1a8c7aaedc514052d383a8152119084 ]
+
+If the DRC is near the end of the stream the client
+may send a V4L2_DEC_CMD_STOP before the DRC occurs.
+V4L2_DEC_CMD_STOP puts the driver into the
+VENUS_DEC_STATE_DRAIN state.  DRC must be aware so
+that after the DRC event the state can be restored
+correctly.
+
+Signed-off-by: Fritz Koenig <frkoenig@chromium.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 50248ad9f190 ("media: venus: dec: Fix handling of the start cmd")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/core.h |  1 +
+ drivers/media/platform/qcom/venus/vdec.c | 14 ++++++++++++--
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h
+index f78eed2c243a8..aebd4c664bfa1 100644
+--- a/drivers/media/platform/qcom/venus/core.h
++++ b/drivers/media/platform/qcom/venus/core.h
+@@ -410,6 +410,7 @@ struct venus_inst {
+ 	unsigned int core_acquired: 1;
+ 	unsigned int bit_depth;
+ 	bool next_buf_last;
++	bool drain_active;
+ };
+ 
+ #define IS_V1(core)	((core)->res->hfi_version == HFI_VERSION_1XX)
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index 1bb2350408cf2..766c292915272 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -518,8 +518,10 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
+ 
+ 		ret = hfi_session_process_buf(inst, &fdata);
+ 
+-		if (!ret && inst->codec_state == VENUS_DEC_STATE_DECODING)
++		if (!ret && inst->codec_state == VENUS_DEC_STATE_DECODING) {
+ 			inst->codec_state = VENUS_DEC_STATE_DRAIN;
++			inst->drain_active = true;
++		}
+ 	}
+ 
+ unlock:
+@@ -969,9 +971,13 @@ static int vdec_start_capture(struct venus_inst *inst)
+ 
+ 	inst->codec_state = VENUS_DEC_STATE_DECODING;
+ 
++	if (inst->drain_active)
++		inst->codec_state = VENUS_DEC_STATE_DRAIN;
++
+ 	inst->streamon_cap = 1;
+ 	inst->sequence_cap = 0;
+ 	inst->reconfig = false;
++	inst->drain_active = false;
+ 
+ 	return 0;
+ 
+@@ -1097,6 +1103,7 @@ static int vdec_stop_capture(struct venus_inst *inst)
+ 		fallthrough;
+ 	case VENUS_DEC_STATE_DRAIN:
+ 		inst->codec_state = VENUS_DEC_STATE_STOPPED;
++		inst->drain_active = false;
+ 		fallthrough;
+ 	case VENUS_DEC_STATE_SEEK:
+ 		vdec_cancel_dst_buffers(inst);
+@@ -1297,8 +1304,10 @@ static void vdec_buf_done(struct venus_inst *inst, unsigned int buf_type,
+ 
+ 			v4l2_event_queue_fh(&inst->fh, &ev);
+ 
+-			if (inst->codec_state == VENUS_DEC_STATE_DRAIN)
++			if (inst->codec_state == VENUS_DEC_STATE_DRAIN) {
++				inst->drain_active = false;
+ 				inst->codec_state = VENUS_DEC_STATE_STOPPED;
++			}
+ 		}
+ 
+ 		if (!bytesused)
+@@ -1359,6 +1368,7 @@ static void vdec_event_change(struct venus_inst *inst,
+ 		inst->codec_state = VENUS_DEC_STATE_CAPTURE_SETUP;
+ 		break;
+ 	case VENUS_DEC_STATE_DECODING:
++	case VENUS_DEC_STATE_DRAIN:
+ 		inst->codec_state = VENUS_DEC_STATE_DRC;
+ 		break;
+ 	default:
+-- 
+2.39.2
+
diff --git a/queue-5.10/media-venus-vdec-make-decoder-return-last-flag-for-s.patch b/queue-5.10/media-venus-vdec-make-decoder-return-last-flag-for-s.patch
new file mode 100644
index 00000000000..88ab6f4a9ab
--- /dev/null
+++ b/queue-5.10/media-venus-vdec-make-decoder-return-last-flag-for-s.patch
@@ -0,0 +1,100 @@
+From d1513e08b807d8cae88222b20f7a2be5ebb85f0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Sep 2020 18:44:30 +0200
+Subject: media: venus: vdec: Make decoder return LAST flag for sufficient
+ event
+
+From: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+
+[ Upstream commit a4ca67af8b831a781ac53060c5d5c3dccaf7676e ]
+
+This makes the decoder to behaives equally for sufficient and
+insufficient events. After this change the LAST buffer flag will be set
+when the new resolution (in dynamic-resolution-change state) is smaller
+then the old bitstream resolution.
+
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: 50248ad9f190 ("media: venus: dec: Fix handling of the start cmd")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/vdec.c | 42 ++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index b6b5ae0a457bb..3adff10fce6a7 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -636,6 +636,7 @@ static int vdec_output_conf(struct venus_inst *inst)
+ {
+ 	struct venus_core *core = inst->core;
+ 	struct hfi_enable en = { .enable = 1 };
++	struct hfi_buffer_requirements bufreq;
+ 	u32 width = inst->out_width;
+ 	u32 height = inst->out_height;
+ 	u32 out_fmt, out2_fmt;
+@@ -711,6 +712,23 @@ static int vdec_output_conf(struct venus_inst *inst)
+ 	}
+ 
+ 	if (IS_V3(core) || IS_V4(core)) {
++		ret = venus_helper_get_bufreq(inst, HFI_BUFFER_OUTPUT, &bufreq);
++		if (ret)
++			return ret;
++
++		if (bufreq.size > inst->output_buf_size)
++			return -EINVAL;
++
++		if (inst->dpb_fmt) {
++			ret = venus_helper_get_bufreq(inst, HFI_BUFFER_OUTPUT2,
++						      &bufreq);
++			if (ret)
++				return ret;
++
++			if (bufreq.size > inst->output2_buf_size)
++				return -EINVAL;
++		}
++
+ 		if (inst->output2_buf_size) {
+ 			ret = venus_helper_set_bufsize(inst,
+ 						       inst->output2_buf_size,
+@@ -1330,19 +1348,15 @@ static void vdec_event_change(struct venus_inst *inst,
+ 	dev_dbg(dev, VDBGM "event %s sufficient resources (%ux%u)\n",
+ 		sufficient ? "" : "not", ev_data->width, ev_data->height);
+ 
+-	if (sufficient) {
+-		hfi_session_continue(inst);
+-	} else {
+-		switch (inst->codec_state) {
+-		case VENUS_DEC_STATE_INIT:
+-			inst->codec_state = VENUS_DEC_STATE_CAPTURE_SETUP;
+-			break;
+-		case VENUS_DEC_STATE_DECODING:
+-			inst->codec_state = VENUS_DEC_STATE_DRC;
+-			break;
+-		default:
+-			break;
+-		}
++	switch (inst->codec_state) {
++	case VENUS_DEC_STATE_INIT:
++		inst->codec_state = VENUS_DEC_STATE_CAPTURE_SETUP;
++		break;
++	case VENUS_DEC_STATE_DECODING:
++		inst->codec_state = VENUS_DEC_STATE_DRC;
++		break;
++	default:
++		break;
+ 	}
+ 
+ 	/*
+@@ -1351,7 +1365,7 @@ static void vdec_event_change(struct venus_inst *inst,
+ 	 * itself doesn't mark the last decoder output buffer with HFI EOS flag.
+ 	 */
+ 
+-	if (!sufficient && inst->codec_state == VENUS_DEC_STATE_DRC) {
++	if (inst->codec_state == VENUS_DEC_STATE_DRC) {
+ 		int ret;
+ 
+ 		inst->next_buf_last = true;
+-- 
+2.39.2
+
diff --git a/queue-5.10/mfd-tqmx86-add-support-for-tqmx110eb-and-tqmxe40x.patch b/queue-5.10/mfd-tqmx86-add-support-for-tqmx110eb-and-tqmxe40x.patch
new file mode 100644
index 00000000000..5e9f4cde468
--- /dev/null
+++ b/queue-5.10/mfd-tqmx86-add-support-for-tqmx110eb-and-tqmxe40x.patch
@@ -0,0 +1,69 @@
+From 0cb35a55aece8671bc33a35f4614218834deb617 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 12:00:51 +0200
+Subject: mfd: tqmx86: Add support for TQMx110EB and TQMxE40x
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 3da48ccb1d0f3b53b1e8c9022edbedc2a6e3f50a ]
+
+Add the board IDs for the TQMx110EB and the TQMxE40x family. All use a
+24MHz LPC clock.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Stable-dep-of: 051c69ff4f60 ("mfd: tqmx86: Specify IO port register range more precisely")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tqmx86.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
+index c5c5846dcf995..1db95aed5012e 100644
+--- a/drivers/mfd/tqmx86.c
++++ b/drivers/mfd/tqmx86.c
+@@ -35,6 +35,11 @@
+ #define TQMX86_REG_BOARD_ID_E39x	7
+ #define TQMX86_REG_BOARD_ID_70EB	8
+ #define TQMX86_REG_BOARD_ID_80UC	9
++#define TQMX86_REG_BOARD_ID_110EB	11
++#define TQMX86_REG_BOARD_ID_E40M	12
++#define TQMX86_REG_BOARD_ID_E40S	13
++#define TQMX86_REG_BOARD_ID_E40C1	14
++#define TQMX86_REG_BOARD_ID_E40C2	15
+ #define TQMX86_REG_BOARD_REV	0x21
+ #define TQMX86_REG_IO_EXT_INT	0x26
+ #define TQMX86_REG_IO_EXT_INT_NONE		0
+@@ -126,6 +131,16 @@ static const char *tqmx86_board_id_to_name(u8 board_id)
+ 		return "TQMx70EB";
+ 	case TQMX86_REG_BOARD_ID_80UC:
+ 		return "TQMx80UC";
++	case TQMX86_REG_BOARD_ID_110EB:
++		return "TQMx110EB";
++	case TQMX86_REG_BOARD_ID_E40M:
++		return "TQMxE40M";
++	case TQMX86_REG_BOARD_ID_E40S:
++		return "TQMxE40S";
++	case TQMX86_REG_BOARD_ID_E40C1:
++		return "TQMxE40C1";
++	case TQMX86_REG_BOARD_ID_E40C2:
++		return "TQMxE40C2";
+ 	default:
+ 		return "Unknown";
+ 	}
+@@ -138,6 +153,11 @@ static int tqmx86_board_id_to_clk_rate(u8 board_id)
+ 	case TQMX86_REG_BOARD_ID_60EB:
+ 	case TQMX86_REG_BOARD_ID_70EB:
+ 	case TQMX86_REG_BOARD_ID_80UC:
++	case TQMX86_REG_BOARD_ID_110EB:
++	case TQMX86_REG_BOARD_ID_E40M:
++	case TQMX86_REG_BOARD_ID_E40S:
++	case TQMX86_REG_BOARD_ID_E40C1:
++	case TQMX86_REG_BOARD_ID_E40C2:
+ 		return 24000;
+ 	case TQMX86_REG_BOARD_ID_E39M:
+ 	case TQMX86_REG_BOARD_ID_E39C:
+-- 
+2.39.2
+
diff --git a/queue-5.10/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch b/queue-5.10/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch
new file mode 100644
index 00000000000..6474f5446c4
--- /dev/null
+++ b/queue-5.10/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch
@@ -0,0 +1,119 @@
+From 076905fd94ff47db2d7f5ee2896411df8afdfab3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Feb 2023 12:25:46 +0100
+Subject: mfd: tqmx86: Correct board names for TQMxE39x
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit f376c479668557bcc2fd9e9fbc0f53e7819a11cd ]
+
+It seems that this driver was developed based on preliminary documentation.
+Report the correct names for all TQMxE39x variants, as they are used by
+the released hardware revisions:
+
+- Fix names for TQMxE39C1/C2 board IDs
+- Distinguish TQMxE39M and TQMxE39S, which use the same board ID
+
+The TQMxE39M/S are distinguished using the SAUC (Sanctioned Alternate
+Uses Configuration) register of the GPIO controller. This also prepares
+for the correct handling of the differences between the GPIO controllers
+of our COMe and SMARC modules.
+
+Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/aca9a7cb42a85181bcb456c437554d2728e708ec.1676892223.git.matthias.schiffer@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tqmx86.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
+index c8ec0f92bc10a..0498f1b7e2e36 100644
+--- a/drivers/mfd/tqmx86.c
++++ b/drivers/mfd/tqmx86.c
+@@ -30,9 +30,9 @@
+ #define TQMX86_REG_BOARD_ID_50UC	2
+ #define TQMX86_REG_BOARD_ID_E38C	3
+ #define TQMX86_REG_BOARD_ID_60EB	4
+-#define TQMX86_REG_BOARD_ID_E39M	5
+-#define TQMX86_REG_BOARD_ID_E39C	6
+-#define TQMX86_REG_BOARD_ID_E39x	7
++#define TQMX86_REG_BOARD_ID_E39MS	5
++#define TQMX86_REG_BOARD_ID_E39C1	6
++#define TQMX86_REG_BOARD_ID_E39C2	7
+ #define TQMX86_REG_BOARD_ID_70EB	8
+ #define TQMX86_REG_BOARD_ID_80UC	9
+ #define TQMX86_REG_BOARD_ID_110EB	11
+@@ -48,6 +48,7 @@
+ #define TQMX86_REG_IO_EXT_INT_12		3
+ #define TQMX86_REG_IO_EXT_INT_MASK		0x3
+ #define TQMX86_REG_IO_EXT_INT_GPIO_SHIFT	4
++#define TQMX86_REG_SAUC		0x17
+ 
+ #define TQMX86_REG_I2C_DETECT	0x1a7
+ #define TQMX86_REG_I2C_DETECT_SOFT		0xa5
+@@ -110,7 +111,7 @@ static const struct mfd_cell tqmx86_devs[] = {
+ 	},
+ };
+ 
+-static const char *tqmx86_board_id_to_name(u8 board_id)
++static const char *tqmx86_board_id_to_name(u8 board_id, u8 sauc)
+ {
+ 	switch (board_id) {
+ 	case TQMX86_REG_BOARD_ID_E38M:
+@@ -121,12 +122,12 @@ static const char *tqmx86_board_id_to_name(u8 board_id)
+ 		return "TQMxE38C";
+ 	case TQMX86_REG_BOARD_ID_60EB:
+ 		return "TQMx60EB";
+-	case TQMX86_REG_BOARD_ID_E39M:
+-		return "TQMxE39M";
+-	case TQMX86_REG_BOARD_ID_E39C:
+-		return "TQMxE39C";
+-	case TQMX86_REG_BOARD_ID_E39x:
+-		return "TQMxE39x";
++	case TQMX86_REG_BOARD_ID_E39MS:
++		return (sauc == 0xff) ? "TQMxE39M" : "TQMxE39S";
++	case TQMX86_REG_BOARD_ID_E39C1:
++		return "TQMxE39C1";
++	case TQMX86_REG_BOARD_ID_E39C2:
++		return "TQMxE39C2";
+ 	case TQMX86_REG_BOARD_ID_70EB:
+ 		return "TQMx70EB";
+ 	case TQMX86_REG_BOARD_ID_80UC:
+@@ -159,9 +160,9 @@ static int tqmx86_board_id_to_clk_rate(u8 board_id)
+ 	case TQMX86_REG_BOARD_ID_E40C1:
+ 	case TQMX86_REG_BOARD_ID_E40C2:
+ 		return 24000;
+-	case TQMX86_REG_BOARD_ID_E39M:
+-	case TQMX86_REG_BOARD_ID_E39C:
+-	case TQMX86_REG_BOARD_ID_E39x:
++	case TQMX86_REG_BOARD_ID_E39MS:
++	case TQMX86_REG_BOARD_ID_E39C1:
++	case TQMX86_REG_BOARD_ID_E39C2:
+ 		return 25000;
+ 	case TQMX86_REG_BOARD_ID_E38M:
+ 	case TQMX86_REG_BOARD_ID_E38C:
+@@ -173,7 +174,7 @@ static int tqmx86_board_id_to_clk_rate(u8 board_id)
+ 
+ static int tqmx86_probe(struct platform_device *pdev)
+ {
+-	u8 board_id, rev, i2c_det, io_ext_int_val;
++	u8 board_id, sauc, rev, i2c_det, io_ext_int_val;
+ 	struct device *dev = &pdev->dev;
+ 	u8 gpio_irq_cfg, readback;
+ 	const char *board_name;
+@@ -203,7 +204,8 @@ static int tqmx86_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 
+ 	board_id = ioread8(io_base + TQMX86_REG_BOARD_ID);
+-	board_name = tqmx86_board_id_to_name(board_id);
++	sauc = ioread8(io_base + TQMX86_REG_SAUC);
++	board_name = tqmx86_board_id_to_name(board_id, sauc);
+ 	rev = ioread8(io_base + TQMX86_REG_BOARD_REV);
+ 
+ 	dev_info(dev,
+-- 
+2.39.2
+
diff --git a/queue-5.10/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch b/queue-5.10/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch
new file mode 100644
index 00000000000..4d03f0f3297
--- /dev/null
+++ b/queue-5.10/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch
@@ -0,0 +1,61 @@
+From 99e6e24d2603279dc7d0dd7b9149cb58553e872f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Feb 2023 12:25:44 +0100
+Subject: mfd: tqmx86: Do not access I2C_DETECT register through io_base
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 1be1b23696b3d4b0231c694f5e0767b4471d33a9 ]
+
+The I2C_DETECT register is at IO port 0x1a7, which is outside the range
+passed to devm_ioport_map() for io_base, and was only working because
+there aren't actually any bounds checks for IO port accesses.
+
+Extending the range does not seem like a good solution here, as it would
+then conflict with the IO resource assigned to the I2C controller. As
+this is just a one-off access during probe, use a simple inb() instead.
+
+While we're at it, drop the unused define TQMX86_REG_I2C_INT_EN.
+
+Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/e8300a30f0791afb67d79db8089fb6004855f378.1676892223.git.matthias.schiffer@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tqmx86.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
+index 732013f40e4e8..99a59341e4492 100644
+--- a/drivers/mfd/tqmx86.c
++++ b/drivers/mfd/tqmx86.c
+@@ -45,9 +45,8 @@
+ #define TQMX86_REG_IO_EXT_INT_MASK		0x3
+ #define TQMX86_REG_IO_EXT_INT_GPIO_SHIFT	4
+ 
+-#define TQMX86_REG_I2C_DETECT	0x47
++#define TQMX86_REG_I2C_DETECT	0x1a7
+ #define TQMX86_REG_I2C_DETECT_SOFT		0xa5
+-#define TQMX86_REG_I2C_INT_EN	0x49
+ 
+ static uint gpio_irq;
+ module_param(gpio_irq, uint, 0);
+@@ -195,7 +194,12 @@ static int tqmx86_probe(struct platform_device *pdev)
+ 		 "Found %s - Board ID %d, PCB Revision %d, PLD Revision %d\n",
+ 		 board_name, board_id, rev >> 4, rev & 0xf);
+ 
+-	i2c_det = ioread8(io_base + TQMX86_REG_I2C_DETECT);
++	/*
++	 * The I2C_DETECT register is in the range assigned to the I2C driver
++	 * later, so we don't extend TQMX86_IOSIZE. Use inb() for this one-off
++	 * access instead of ioport_map + unmap.
++	 */
++	i2c_det = inb(TQMX86_REG_I2C_DETECT);
+ 
+ 	if (gpio_irq_cfg) {
+ 		io_ext_int_val =
+-- 
+2.39.2
+
diff --git a/queue-5.10/mfd-tqmx86-remove-incorrect-tqmx90uc-board-id.patch b/queue-5.10/mfd-tqmx86-remove-incorrect-tqmx90uc-board-id.patch
new file mode 100644
index 00000000000..12576c7a503
--- /dev/null
+++ b/queue-5.10/mfd-tqmx86-remove-incorrect-tqmx90uc-board-id.patch
@@ -0,0 +1,53 @@
+From 7327ed7b9a72d86164662b66e343eb503372d9b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 12:00:49 +0200
+Subject: mfd: tqmx86: Remove incorrect TQMx90UC board ID
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 16b2ad150f74db0eb91f445061f16140b5aaa650 ]
+
+No TQMx90UC exists at the moment, and it is undecided whether ID 10 will
+be used eventually (and if it is, how that SoM will be named).
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Stable-dep-of: 051c69ff4f60 ("mfd: tqmx86: Specify IO port register range more precisely")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tqmx86.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
+index 99a59341e4492..c5c5846dcf995 100644
+--- a/drivers/mfd/tqmx86.c
++++ b/drivers/mfd/tqmx86.c
+@@ -35,7 +35,6 @@
+ #define TQMX86_REG_BOARD_ID_E39x	7
+ #define TQMX86_REG_BOARD_ID_70EB	8
+ #define TQMX86_REG_BOARD_ID_80UC	9
+-#define TQMX86_REG_BOARD_ID_90UC	10
+ #define TQMX86_REG_BOARD_REV	0x21
+ #define TQMX86_REG_IO_EXT_INT	0x26
+ #define TQMX86_REG_IO_EXT_INT_NONE		0
+@@ -127,8 +126,6 @@ static const char *tqmx86_board_id_to_name(u8 board_id)
+ 		return "TQMx70EB";
+ 	case TQMX86_REG_BOARD_ID_80UC:
+ 		return "TQMx80UC";
+-	case TQMX86_REG_BOARD_ID_90UC:
+-		return "TQMx90UC";
+ 	default:
+ 		return "Unknown";
+ 	}
+@@ -141,7 +138,6 @@ static int tqmx86_board_id_to_clk_rate(u8 board_id)
+ 	case TQMX86_REG_BOARD_ID_60EB:
+ 	case TQMX86_REG_BOARD_ID_70EB:
+ 	case TQMX86_REG_BOARD_ID_80UC:
+-	case TQMX86_REG_BOARD_ID_90UC:
+ 		return 24000;
+ 	case TQMX86_REG_BOARD_ID_E39M:
+ 	case TQMX86_REG_BOARD_ID_E39C:
+-- 
+2.39.2
+
diff --git a/queue-5.10/mfd-tqmx86-specify-io-port-register-range-more-preci.patch b/queue-5.10/mfd-tqmx86-specify-io-port-register-range-more-preci.patch
new file mode 100644
index 00000000000..3fa064f8255
--- /dev/null
+++ b/queue-5.10/mfd-tqmx86-specify-io-port-register-range-more-preci.patch
@@ -0,0 +1,64 @@
+From 6469f738edfc6cf4a3ea40ec0d506649b8521c61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Feb 2023 12:25:45 +0100
+Subject: mfd: tqmx86: Specify IO port register range more precisely
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 051c69ff4f607aa114c7bbdd7c41ed881367aeee ]
+
+Registers 0x160..0x17f are unassigned. Use 0x180 as base register and
+update offets accordingly.
+
+Also change the size of the range to include 0x19f. While 0x19f is
+currently reserved for future extensions, so are several of the previous
+registers up to 0x19e, and it is weird to leave out just the last one.
+
+Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/db4677ac318b1283c8956f637f409995a30a31c3.1676892223.git.matthias.schiffer@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tqmx86.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
+index 1db95aed5012e..c8ec0f92bc10a 100644
+--- a/drivers/mfd/tqmx86.c
++++ b/drivers/mfd/tqmx86.c
+@@ -16,8 +16,8 @@
+ #include <linux/platform_data/i2c-ocores.h>
+ #include <linux/platform_device.h>
+ 
+-#define TQMX86_IOBASE	0x160
+-#define TQMX86_IOSIZE	0x3f
++#define TQMX86_IOBASE	0x180
++#define TQMX86_IOSIZE	0x20
+ #define TQMX86_IOBASE_I2C	0x1a0
+ #define TQMX86_IOSIZE_I2C	0xa
+ #define TQMX86_IOBASE_WATCHDOG	0x18b
+@@ -25,7 +25,7 @@
+ #define TQMX86_IOBASE_GPIO	0x18d
+ #define TQMX86_IOSIZE_GPIO	0x4
+ 
+-#define TQMX86_REG_BOARD_ID	0x20
++#define TQMX86_REG_BOARD_ID	0x00
+ #define TQMX86_REG_BOARD_ID_E38M	1
+ #define TQMX86_REG_BOARD_ID_50UC	2
+ #define TQMX86_REG_BOARD_ID_E38C	3
+@@ -40,8 +40,8 @@
+ #define TQMX86_REG_BOARD_ID_E40S	13
+ #define TQMX86_REG_BOARD_ID_E40C1	14
+ #define TQMX86_REG_BOARD_ID_E40C2	15
+-#define TQMX86_REG_BOARD_REV	0x21
+-#define TQMX86_REG_IO_EXT_INT	0x26
++#define TQMX86_REG_BOARD_REV	0x01
++#define TQMX86_REG_IO_EXT_INT	0x06
+ #define TQMX86_REG_IO_EXT_INT_NONE		0
+ #define TQMX86_REG_IO_EXT_INT_7			1
+ #define TQMX86_REG_IO_EXT_INT_9			2
+-- 
+2.39.2
+
diff --git a/queue-5.10/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch b/queue-5.10/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch
new file mode 100644
index 00000000000..034f348539c
--- /dev/null
+++ b/queue-5.10/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch
@@ -0,0 +1,82 @@
+From aa66bb5459250d56505b8494f754a4bcbd121ca0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 23:37:15 +0300
+Subject: mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data
+
+From: Georgii Kruglov <georgy.kruglov@yandex.ru>
+
+[ Upstream commit 0dd8316037a2a6d85b2be208bef9991de7b42170 ]
+
+If spec_reg is equal to 'SDHCI_PRESENT_STATE', esdhc_readl_fixup()
+fixes up register value and returns it immediately. As a result, the
+further block
+(spec_reg == SDHCI_PRESENT_STATE)
+    &&(esdhc->quirk_ignore_data_inhibit == true),
+is never executed.
+
+The patch merges the second block into the first one.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 1f1929f3f2fa ("mmc: sdhci-of-esdhc: add quirk to ignore command inhibit for data")
+Signed-off-by: Georgii Kruglov <georgy.kruglov@yandex.ru>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20230321203715.3975-1-georgy.kruglov@yandex.ru
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-of-esdhc.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index d53374991e137..5b853f651b389 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -126,6 +126,7 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
+ 			return ret;
+ 		}
+ 	}
++
+ 	/*
+ 	 * The DAT[3:0] line signal levels and the CMD line signal level are
+ 	 * not compatible with standard SDHC register. The line signal levels
+@@ -137,6 +138,16 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
+ 		ret = value & 0x000fffff;
+ 		ret |= (value >> 4) & SDHCI_DATA_LVL_MASK;
+ 		ret |= (value << 1) & SDHCI_CMD_LVL;
++
++		/*
++		 * Some controllers have unreliable Data Line Active
++		 * bit for commands with busy signal. This affects
++		 * Command Inhibit (data) bit. Just ignore it since
++		 * MMC core driver has already polled card status
++		 * with CMD13 after any command with busy siganl.
++		 */
++		if (esdhc->quirk_ignore_data_inhibit)
++			ret &= ~SDHCI_DATA_INHIBIT;
+ 		return ret;
+ 	}
+ 
+@@ -151,19 +162,6 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
+ 		return ret;
+ 	}
+ 
+-	/*
+-	 * Some controllers have unreliable Data Line Active
+-	 * bit for commands with busy signal. This affects
+-	 * Command Inhibit (data) bit. Just ignore it since
+-	 * MMC core driver has already polled card status
+-	 * with CMD13 after any command with busy siganl.
+-	 */
+-	if ((spec_reg == SDHCI_PRESENT_STATE) &&
+-	(esdhc->quirk_ignore_data_inhibit == true)) {
+-		ret = value & ~SDHCI_DATA_INHIBIT;
+-		return ret;
+-	}
+-
+ 	ret = value;
+ 	return ret;
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/net-amd-fix-link-leak-when-verifying-config-failed.patch b/queue-5.10/net-amd-fix-link-leak-when-verifying-config-failed.patch
new file mode 100644
index 00000000000..1aa24682a1a
--- /dev/null
+++ b/queue-5.10/net-amd-fix-link-leak-when-verifying-config-failed.patch
@@ -0,0 +1,47 @@
+From 057d6ca5a2b0ab57a0482939ee83a958eabb2df9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 23:28:01 +0800
+Subject: net: amd: Fix link leak when verifying config failed
+
+From: Gencen Gan <gangecen@hust.edu.cn>
+
+[ Upstream commit d325c34d9e7e38d371c0a299d415e9b07f66a1fb ]
+
+After failing to verify configuration, it returns directly without
+releasing link, which may cause memory leak.
+
+Paolo Abeni thinks that the whole code of this driver is quite
+"suboptimal" and looks unmainatained since at least ~15y, so he
+suggests that we could simply remove the whole driver, please
+take it into consideration.
+
+Simon Horman suggests that the fix label should be set to
+"Linux-2.6.12-rc2" considering that the problem has existed
+since the driver was introduced and the commit above doesn't
+seem to exist in net/net-next.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gan Gecen <gangecen@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/nmclan_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c
+index 11c0b13edd30f..f34881637505e 100644
+--- a/drivers/net/ethernet/amd/nmclan_cs.c
++++ b/drivers/net/ethernet/amd/nmclan_cs.c
+@@ -650,7 +650,7 @@ static int nmclan_config(struct pcmcia_device *link)
+     } else {
+       pr_notice("mace id not found: %x %x should be 0x40 0x?9\n",
+ 		sig[0], sig[1]);
+-      return -ENODEV;
++      goto failed;
+     }
+   }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch b/queue-5.10/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch
new file mode 100644
index 00000000000..6d3baa9ff34
--- /dev/null
+++ b/queue-5.10/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch
@@ -0,0 +1,64 @@
+From 7ba80ef45bbf19aeb1245cd3fe7e0ae3941dd7ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 18:11:29 +0200
+Subject: net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit db21973263f8c56750cb610f1d5e8bee00a513b9 ]
+
+The usual devm_regulator_get() call already handles "optional"
+regulators by returning a valid dummy and printing a warning
+that the dummy regulator should be described properly. This
+code open coded the same behaviour, but masked any errors that
+are not -EPROBE_DEFER and is quite noisy.
+
+This change effectively unmasks and propagates regulators errors
+not involving -ENODEV, downgrades the error print to warning level
+if no regulator is specified and captures the probe defer message
+for /sys/kernel/debug/devices_deferred.
+
+Fixes: 2e12f536635f ("net: stmmac: dwmac-rk: Use standard devicetree property for phy regulator")
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+index e7fbc9b30bf96..d0d47d91b460c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -1194,9 +1194,6 @@ static int phy_power_on(struct rk_priv_data *bsp_priv, bool enable)
+ 	int ret;
+ 	struct device *dev = &bsp_priv->pdev->dev;
+ 
+-	if (!ldo)
+-		return 0;
+-
+ 	if (enable) {
+ 		ret = regulator_enable(ldo);
+ 		if (ret)
+@@ -1227,14 +1224,11 @@ static struct rk_priv_data *rk_gmac_setup(struct platform_device *pdev,
+ 	of_get_phy_mode(dev->of_node, &bsp_priv->phy_iface);
+ 	bsp_priv->ops = ops;
+ 
+-	bsp_priv->regulator = devm_regulator_get_optional(dev, "phy");
++	bsp_priv->regulator = devm_regulator_get(dev, "phy");
+ 	if (IS_ERR(bsp_priv->regulator)) {
+-		if (PTR_ERR(bsp_priv->regulator) == -EPROBE_DEFER) {
+-			dev_err(dev, "phy regulator is not available yet, deferred probing\n");
+-			return ERR_PTR(-EPROBE_DEFER);
+-		}
+-		dev_err(dev, "no regulator found\n");
+-		bsp_priv->regulator = NULL;
++		ret = PTR_ERR(bsp_priv->regulator);
++		dev_err_probe(dev, ret, "failed to get phy regulator\n");
++		return ERR_PTR(ret);
+ 	}
+ 
+ 	ret = of_property_read_string(dev->of_node, "clock_in_out", &strings);
+-- 
+2.39.2
+
diff --git a/queue-5.10/net-packet-annotate-accesses-to-po-xmit.patch b/queue-5.10/net-packet-annotate-accesses-to-po-xmit.patch
new file mode 100644
index 00000000000..0ae2622f5ac
--- /dev/null
+++ b/queue-5.10/net-packet-annotate-accesses-to-po-xmit.patch
@@ -0,0 +1,70 @@
+From 552f1db5ae98b62bd27b5cddfd783a6903c2b2cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:06 +0000
+Subject: net/packet: annotate accesses to po->xmit
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b9d83ab8a708f23a4001d60e9d8d0b3be3d9f607 ]
+
+po->xmit can be set from setsockopt(PACKET_QDISC_BYPASS),
+while read locklessly.
+
+Use READ_ONCE()/WRITE_ONCE() to avoid potential load/store
+tearing issues.
+
+Fixes: d346a3fae3ff ("packet: introduce PACKET_QDISC_BYPASS socket option")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 3716797c55643..2b435d9916e64 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -269,7 +269,8 @@ static void packet_cached_dev_reset(struct packet_sock *po)
+ 
+ static bool packet_use_direct_xmit(const struct packet_sock *po)
+ {
+-	return po->xmit == packet_direct_xmit;
++	/* Paired with WRITE_ONCE() in packet_setsockopt() */
++	return READ_ONCE(po->xmit) == packet_direct_xmit;
+ }
+ 
+ static u16 packet_pick_tx_queue(struct sk_buff *skb)
+@@ -2825,7 +2826,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ 		packet_inc_pending(&po->tx_ring);
+ 
+ 		status = TP_STATUS_SEND_REQUEST;
+-		err = po->xmit(skb);
++		/* Paired with WRITE_ONCE() in packet_setsockopt() */
++		err = READ_ONCE(po->xmit)(skb);
+ 		if (unlikely(err != 0)) {
+ 			if (err > 0)
+ 				err = net_xmit_errno(err);
+@@ -3028,7 +3030,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ 		virtio_net_hdr_set_proto(skb, &vnet_hdr);
+ 	}
+ 
+-	err = po->xmit(skb);
++	/* Paired with WRITE_ONCE() in packet_setsockopt() */
++	err = READ_ONCE(po->xmit)(skb);
+ 	if (unlikely(err != 0)) {
+ 		if (err > 0)
+ 			err = net_xmit_errno(err);
+@@ -3979,7 +3982,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,
+ 		if (copy_from_sockptr(&val, optval, sizeof(val)))
+ 			return -EFAULT;
+ 
+-		po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
++		/* Paired with all lockless reads of po->xmit */
++		WRITE_ONCE(po->xmit, val ? packet_direct_xmit : dev_queue_xmit);
+ 		return 0;
+ 	}
+ 	default:
+-- 
+2.39.2
+
diff --git a/queue-5.10/net-packet-convert-po-auxdata-to-an-atomic-flag.patch b/queue-5.10/net-packet-convert-po-auxdata-to-an-atomic-flag.patch
new file mode 100644
index 00000000000..156f5f56e5a
--- /dev/null
+++ b/queue-5.10/net-packet-convert-po-auxdata-to-an-atomic-flag.patch
@@ -0,0 +1,95 @@
+From cdee6a38b9e6185e778f5de26990685d3ad2307c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:08 +0000
+Subject: net/packet: convert po->auxdata to an atomic flag
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit fd53c297aa7b077ae98a3d3d2d3aa278a1686ba6 ]
+
+po->auxdata can be read while another thread
+is changing its value, potentially raising KCSAN splat.
+
+Convert it to PACKET_SOCK_AUXDATA flag.
+
+Fixes: 8dc419447415 ("[PACKET]: Add optional checksum computation for recvmsg")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 8 +++-----
+ net/packet/diag.c      | 2 +-
+ net/packet/internal.h  | 4 ++--
+ 3 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index df93f4b09ab9e..9b6f6a5e0b147 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3485,7 +3485,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ 	}
+ 
+-	if (pkt_sk(sk)->auxdata) {
++	if (packet_sock_flag(pkt_sk(sk), PACKET_SOCK_AUXDATA)) {
+ 		struct tpacket_auxdata aux;
+ 
+ 		aux.tp_status = TP_STATUS_USER;
+@@ -3869,9 +3869,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,
+ 		if (copy_from_sockptr(&val, optval, sizeof(val)))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+-		po->auxdata = !!val;
+-		release_sock(sk);
++		packet_sock_flag_set(po, PACKET_SOCK_AUXDATA, val);
+ 		return 0;
+ 	}
+ 	case PACKET_ORIGDEV:
+@@ -4032,7 +4030,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ 
+ 		break;
+ 	case PACKET_AUXDATA:
+-		val = po->auxdata;
++		val = packet_sock_flag(po, PACKET_SOCK_AUXDATA);
+ 		break;
+ 	case PACKET_ORIGDEV:
+ 		val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV);
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index e1ac9bb375b31..d704c7bf51b20 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -23,7 +23,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+ 	pinfo.pdi_flags = 0;
+ 	if (po->running)
+ 		pinfo.pdi_flags |= PDI_RUNNING;
+-	if (po->auxdata)
++	if (packet_sock_flag(po, PACKET_SOCK_AUXDATA))
+ 		pinfo.pdi_flags |= PDI_AUXDATA;
+ 	if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV))
+ 		pinfo.pdi_flags |= PDI_ORIGDEV;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 7fea453dc7215..3938cb413d5d3 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -118,8 +118,7 @@ struct packet_sock {
+ 	struct mutex		pg_vec_lock;
+ 	unsigned long		flags;
+ 	unsigned int		running;	/* bind_lock must be held */
+-	unsigned int		auxdata:1,	/* writer must hold sock lock */
+-				has_vnet_hdr:1,
++	unsigned int		has_vnet_hdr:1, /* writer must hold sock lock */
+ 				tp_loss:1,
+ 				tp_tx_has_off:1;
+ 	int			pressure;
+@@ -146,6 +145,7 @@ static struct packet_sock *pkt_sk(struct sock *sk)
+ 
+ enum packet_sock_flags {
+ 	PACKET_SOCK_ORIGDEV,
++	PACKET_SOCK_AUXDATA,
+ };
+ 
+ static inline void packet_sock_flag_set(struct packet_sock *po,
+-- 
+2.39.2
+
diff --git a/queue-5.10/net-packet-convert-po-origdev-to-an-atomic-flag.patch b/queue-5.10/net-packet-convert-po-origdev-to-an-atomic-flag.patch
new file mode 100644
index 00000000000..fa081fec64f
--- /dev/null
+++ b/queue-5.10/net-packet-convert-po-origdev-to-an-atomic-flag.patch
@@ -0,0 +1,126 @@
+From d58ddcfbe94e6fda4996c788b93ff7126ade3b11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:07 +0000
+Subject: net/packet: convert po->origdev to an atomic flag
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ee5675ecdf7a4e713ed21d98a70c2871d6ebed01 ]
+
+syzbot/KCAN reported that po->origdev can be read
+while another thread is changing its value.
+
+We can avoid this splat by converting this field
+to an actual bit.
+
+Following patches will convert remaining 1bit fields.
+
+Fixes: 80feaacb8a64 ("[AF_PACKET]: Add option to return orig_dev to userspace.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 10 ++++------
+ net/packet/diag.c      |  2 +-
+ net/packet/internal.h  | 22 +++++++++++++++++++++-
+ 3 files changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 2b435d9916e64..df93f4b09ab9e 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2146,7 +2146,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+ 	sll = &PACKET_SKB_CB(skb)->sa.ll;
+ 	sll->sll_hatype = dev->type;
+ 	sll->sll_pkttype = skb->pkt_type;
+-	if (unlikely(po->origdev))
++	if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ 		sll->sll_ifindex = orig_dev->ifindex;
+ 	else
+ 		sll->sll_ifindex = dev->ifindex;
+@@ -2419,7 +2419,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ 	sll->sll_hatype = dev->type;
+ 	sll->sll_protocol = skb->protocol;
+ 	sll->sll_pkttype = skb->pkt_type;
+-	if (unlikely(po->origdev))
++	if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ 		sll->sll_ifindex = orig_dev->ifindex;
+ 	else
+ 		sll->sll_ifindex = dev->ifindex;
+@@ -3883,9 +3883,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,
+ 		if (copy_from_sockptr(&val, optval, sizeof(val)))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+-		po->origdev = !!val;
+-		release_sock(sk);
++		packet_sock_flag_set(po, PACKET_SOCK_ORIGDEV, val);
+ 		return 0;
+ 	}
+ 	case PACKET_VNET_HDR:
+@@ -4037,7 +4035,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ 		val = po->auxdata;
+ 		break;
+ 	case PACKET_ORIGDEV:
+-		val = po->origdev;
++		val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV);
+ 		break;
+ 	case PACKET_VNET_HDR:
+ 		val = po->has_vnet_hdr;
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index 07812ae5ca073..e1ac9bb375b31 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -25,7 +25,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+ 		pinfo.pdi_flags |= PDI_RUNNING;
+ 	if (po->auxdata)
+ 		pinfo.pdi_flags |= PDI_AUXDATA;
+-	if (po->origdev)
++	if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV))
+ 		pinfo.pdi_flags |= PDI_ORIGDEV;
+ 	if (po->has_vnet_hdr)
+ 		pinfo.pdi_flags |= PDI_VNETHDR;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 7af1e9179385f..7fea453dc7215 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -116,9 +116,9 @@ struct packet_sock {
+ 	int			copy_thresh;
+ 	spinlock_t		bind_lock;
+ 	struct mutex		pg_vec_lock;
++	unsigned long		flags;
+ 	unsigned int		running;	/* bind_lock must be held */
+ 	unsigned int		auxdata:1,	/* writer must hold sock lock */
+-				origdev:1,
+ 				has_vnet_hdr:1,
+ 				tp_loss:1,
+ 				tp_tx_has_off:1;
+@@ -144,4 +144,24 @@ static struct packet_sock *pkt_sk(struct sock *sk)
+ 	return (struct packet_sock *)sk;
+ }
+ 
++enum packet_sock_flags {
++	PACKET_SOCK_ORIGDEV,
++};
++
++static inline void packet_sock_flag_set(struct packet_sock *po,
++					enum packet_sock_flags flag,
++					bool val)
++{
++	if (val)
++		set_bit(flag, &po->flags);
++	else
++		clear_bit(flag, &po->flags);
++}
++
++static inline bool packet_sock_flag(const struct packet_sock *po,
++				    enum packet_sock_flags flag)
++{
++	return test_bit(flag, &po->flags);
++}
++
+ #endif
+-- 
+2.39.2
+
diff --git a/queue-5.10/net-qrtr-correct-types-of-trace-event-parameters.patch b/queue-5.10/net-qrtr-correct-types-of-trace-event-parameters.patch
new file mode 100644
index 00000000000..0fbc9414a16
--- /dev/null
+++ b/queue-5.10/net-qrtr-correct-types-of-trace-event-parameters.patch
@@ -0,0 +1,108 @@
+From feca0c8b051703e8324306eedf7b27711c189ab0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 17:43:16 +0200
+Subject: net: qrtr: correct types of trace event parameters
+
+From: Simon Horman <horms@kernel.org>
+
+[ Upstream commit 054fbf7ff8143d35ca7d3bb5414bb44ee1574194 ]
+
+The arguments passed to the trace events are of type unsigned int,
+however the signature of the events used __le32 parameters.
+
+I may be missing the point here, but sparse flagged this and it
+does seem incorrect to me.
+
+  net/qrtr/ns.c: note: in included file (through include/trace/trace_events.h, include/trace/define_trace.h, include/trace/events/qrtr.h):
+  ./include/trace/events/qrtr.h:11:1: warning: cast to restricted __le32
+  ./include/trace/events/qrtr.h:11:1: warning: restricted __le32 degrades to integer
+  ./include/trace/events/qrtr.h:11:1: warning: restricted __le32 degrades to integer
+  ... (a lot more similar warnings)
+  net/qrtr/ns.c:115:47:    expected restricted __le32 [usertype] service
+  net/qrtr/ns.c:115:47:    got unsigned int service
+  net/qrtr/ns.c:115:61: warning: incorrect type in argument 2 (different base types)
+  ... (a lot more similar warnings)
+
+Fixes: dfddb54043f0 ("net: qrtr: Add tracepoint support")
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20230402-qrtr-trace-types-v1-1-92ad55008dd3@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/qrtr.h | 33 ++++++++++++++++++---------------
+ 1 file changed, 18 insertions(+), 15 deletions(-)
+
+diff --git a/include/trace/events/qrtr.h b/include/trace/events/qrtr.h
+index b1de14c3bb934..441132c67133f 100644
+--- a/include/trace/events/qrtr.h
++++ b/include/trace/events/qrtr.h
+@@ -10,15 +10,16 @@
+ 
+ TRACE_EVENT(qrtr_ns_service_announce_new,
+ 
+-	TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port),
++	TP_PROTO(unsigned int service, unsigned int instance,
++		 unsigned int node, unsigned int port),
+ 
+ 	TP_ARGS(service, instance, node, port),
+ 
+ 	TP_STRUCT__entry(
+-		__field(__le32, service)
+-		__field(__le32, instance)
+-		__field(__le32, node)
+-		__field(__le32, port)
++		__field(unsigned int, service)
++		__field(unsigned int, instance)
++		__field(unsigned int, node)
++		__field(unsigned int, port)
+ 	),
+ 
+ 	TP_fast_assign(
+@@ -36,15 +37,16 @@ TRACE_EVENT(qrtr_ns_service_announce_new,
+ 
+ TRACE_EVENT(qrtr_ns_service_announce_del,
+ 
+-	TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port),
++	TP_PROTO(unsigned int service, unsigned int instance,
++		 unsigned int node, unsigned int port),
+ 
+ 	TP_ARGS(service, instance, node, port),
+ 
+ 	TP_STRUCT__entry(
+-		__field(__le32, service)
+-		__field(__le32, instance)
+-		__field(__le32, node)
+-		__field(__le32, port)
++		__field(unsigned int, service)
++		__field(unsigned int, instance)
++		__field(unsigned int, node)
++		__field(unsigned int, port)
+ 	),
+ 
+ 	TP_fast_assign(
+@@ -62,15 +64,16 @@ TRACE_EVENT(qrtr_ns_service_announce_del,
+ 
+ TRACE_EVENT(qrtr_ns_server_add,
+ 
+-	TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port),
++	TP_PROTO(unsigned int service, unsigned int instance,
++		 unsigned int node, unsigned int port),
+ 
+ 	TP_ARGS(service, instance, node, port),
+ 
+ 	TP_STRUCT__entry(
+-		__field(__le32, service)
+-		__field(__le32, instance)
+-		__field(__le32, node)
+-		__field(__le32, port)
++		__field(unsigned int, service)
++		__field(unsigned int, instance)
++		__field(unsigned int, node)
++		__field(unsigned int, port)
+ 	),
+ 
+ 	TP_fast_assign(
+-- 
+2.39.2
+
diff --git a/queue-5.10/net-sched-sch_fq-fix-integer-overflow-of-credit.patch b/queue-5.10/net-sched-sch_fq-fix-integer-overflow-of-credit.patch
new file mode 100644
index 00000000000..24384363744
--- /dev/null
+++ b/queue-5.10/net-sched-sch_fq-fix-integer-overflow-of-credit.patch
@@ -0,0 +1,58 @@
+From 85375e6c20eeaf25a72d58935f17336736406900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 16:59:46 +0200
+Subject: net/sched: sch_fq: fix integer overflow of "credit"
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit 7041101ff6c3073fd8f2e99920f535b111c929cb ]
+
+if sch_fq is configured with "initial quantum" having values greater than
+INT_MAX, the first assignment of "credit" does signed integer overflow to
+a very negative value.
+In this situation, the syzkaller script provided by Cristoph triggers the
+CPU soft-lockup warning even with few sockets. It's not an infinite loop,
+but "credit" wasn't probably meant to be minus 2Gb for each new flow.
+Capping "initial quantum" to INT_MAX proved to fix the issue.
+
+v2: validation of "initial quantum" is done in fq_policy, instead of open
+    coding in fq_change() _ suggested by Jakub Kicinski
+
+Reported-by: Christoph Paasch <cpaasch@apple.com>
+Link: https://github.com/multipath-tcp/mptcp_net-next/issues/377
+Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler")
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Link: https://lore.kernel.org/r/7b3a3c7e36d03068707a021760a194a8eb5ad41a.1682002300.git.dcaratti@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_fq.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
+index 2fb76fc0cc31b..5a1274199fe33 100644
+--- a/net/sched/sch_fq.c
++++ b/net/sched/sch_fq.c
+@@ -779,13 +779,17 @@ static int fq_resize(struct Qdisc *sch, u32 log)
+ 	return 0;
+ }
+ 
++static struct netlink_range_validation iq_range = {
++	.max = INT_MAX,
++};
++
+ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = {
+ 	[TCA_FQ_UNSPEC]			= { .strict_start_type = TCA_FQ_TIMER_SLACK },
+ 
+ 	[TCA_FQ_PLIMIT]			= { .type = NLA_U32 },
+ 	[TCA_FQ_FLOW_PLIMIT]		= { .type = NLA_U32 },
+ 	[TCA_FQ_QUANTUM]		= { .type = NLA_U32 },
+-	[TCA_FQ_INITIAL_QUANTUM]	= { .type = NLA_U32 },
++	[TCA_FQ_INITIAL_QUANTUM]	= NLA_POLICY_FULL_RANGE(NLA_U32, &iq_range),
+ 	[TCA_FQ_RATE_ENABLE]		= { .type = NLA_U32 },
+ 	[TCA_FQ_FLOW_DEFAULT_RATE]	= { .type = NLA_U32 },
+ 	[TCA_FQ_FLOW_MAX_RATE]		= { .type = NLA_U32 },
+-- 
+2.39.2
+
diff --git a/queue-5.10/netfilter-nf_tables-don-t-write-table-validation-sta.patch b/queue-5.10/netfilter-nf_tables-don-t-write-table-validation-sta.patch
new file mode 100644
index 00000000000..7f3300c296c
--- /dev/null
+++ b/queue-5.10/netfilter-nf_tables-don-t-write-table-validation-sta.patch
@@ -0,0 +1,87 @@
+From b1ec61ba825ef79c6126e79cd828aa0ac6b4abf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 17:13:19 +0200
+Subject: netfilter: nf_tables: don't write table validation state without
+ mutex
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ]
+
+The ->cleanup callback needs to be removed, this doesn't work anymore as
+the transaction mutex is already released in the ->abort function.
+
+Just do it after a successful validation pass, this either happens
+from commit or abort phases where transaction mutex is held.
+
+Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/nfnetlink.h | 1 -
+ net/netfilter/nf_tables_api.c       | 8 ++------
+ net/netfilter/nfnetlink.c           | 2 --
+ 3 files changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index 791d516e1e880..0518ca72b7616 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -39,7 +39,6 @@ struct nfnetlink_subsystem {
+ 	int (*commit)(struct net *net, struct sk_buff *skb);
+ 	int (*abort)(struct net *net, struct sk_buff *skb,
+ 		     enum nfnl_abort_action action);
+-	void (*cleanup)(struct net *net);
+ 	bool (*valid_genid)(struct net *net, u32 genid);
+ };
+ 
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 2143edafba772..7bb716df7afce 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -7442,6 +7442,8 @@ static int nf_tables_validate(struct net *net)
+ 			if (nft_table_validate(net, table) < 0)
+ 				return -EAGAIN;
+ 		}
++
++		nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+ 		break;
+ 	}
+ 
+@@ -8273,11 +8275,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
+ 	return 0;
+ }
+ 
+-static void nf_tables_cleanup(struct net *net)
+-{
+-	nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+-}
+-
+ static int nf_tables_abort(struct net *net, struct sk_buff *skb,
+ 			   enum nfnl_abort_action action)
+ {
+@@ -8309,7 +8306,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = {
+ 	.cb		= nf_tables_cb,
+ 	.commit		= nf_tables_commit,
+ 	.abort		= nf_tables_abort,
+-	.cleanup	= nf_tables_cleanup,
+ 	.valid_genid	= nf_tables_valid_genid,
+ 	.owner		= THIS_MODULE,
+ };
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index d3df66a39b5e0..edf386a020b9e 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -530,8 +530,6 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ 			goto replay_abort;
+ 		}
+ 	}
+-	if (ss->cleanup)
+-		ss->cleanup(net);
+ 
+ 	nfnl_err_deliver(&err_list, oskb);
+ 	kfree_skb(skb);
+-- 
+2.39.2
+
diff --git a/queue-5.10/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch b/queue-5.10/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch
new file mode 100644
index 00000000000..e9cb32aea91
--- /dev/null
+++ b/queue-5.10/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch
@@ -0,0 +1,171 @@
+From 1076a6a4d1aa919417649a9bdd9a747a7d7d3521 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 11:52:55 -0700
+Subject: netlink: Use copy_to_user() for optval in netlink_getsockopt().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 ]
+
+Brad Spencer provided a detailed report [0] that when calling getsockopt()
+for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such
+options require at least sizeof(int) as length.
+
+The options return a flag value that fits into 1 byte, but such behaviour
+confuses users who do not initialise the variable before calling
+getsockopt() and do not strictly check the returned value as char.
+
+Currently, netlink_getsockopt() uses put_user() to copy data to optlen and
+optval, but put_user() casts the data based on the pointer, char *optval.
+As a result, only 1 byte is set to optval.
+
+To avoid this behaviour, we need to use copy_to_user() or cast optval for
+put_user().
+
+Note that this changes the behaviour on big-endian systems, but we document
+that the size of optval is int in the man page.
+
+  $ man 7 netlink
+  ...
+  Socket options
+       To set or get a netlink socket option, call getsockopt(2) to read
+       or setsockopt(2) to write the option with the option level argument
+       set to SOL_NETLINK.  Unless otherwise noted, optval is a pointer to
+       an int.
+
+Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups")
+Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option")
+Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag")
+Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option")
+Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting")
+Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps")
+Reported-by: Brad Spencer <bspencer@blackberry.com>
+Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 75 ++++++++++++----------------------------
+ 1 file changed, 23 insertions(+), 52 deletions(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 2104fbdd63d29..eedb16517f16a 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1744,7 +1744,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ {
+ 	struct sock *sk = sock->sk;
+ 	struct netlink_sock *nlk = nlk_sk(sk);
+-	int len, val, err;
++	unsigned int flag;
++	int len, val;
+ 
+ 	if (level != SOL_NETLINK)
+ 		return -ENOPROTOOPT;
+@@ -1756,39 +1757,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ 
+ 	switch (optname) {
+ 	case NETLINK_PKTINFO:
+-		if (len < sizeof(int))
+-			return -EINVAL;
+-		len = sizeof(int);
+-		val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
+-		if (put_user(len, optlen) ||
+-		    put_user(val, optval))
+-			return -EFAULT;
+-		err = 0;
++		flag = NETLINK_F_RECV_PKTINFO;
+ 		break;
+ 	case NETLINK_BROADCAST_ERROR:
+-		if (len < sizeof(int))
+-			return -EINVAL;
+-		len = sizeof(int);
+-		val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
+-		if (put_user(len, optlen) ||
+-		    put_user(val, optval))
+-			return -EFAULT;
+-		err = 0;
++		flag = NETLINK_F_BROADCAST_SEND_ERROR;
+ 		break;
+ 	case NETLINK_NO_ENOBUFS:
+-		if (len < sizeof(int))
+-			return -EINVAL;
+-		len = sizeof(int);
+-		val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
+-		if (put_user(len, optlen) ||
+-		    put_user(val, optval))
+-			return -EFAULT;
+-		err = 0;
++		flag = NETLINK_F_RECV_NO_ENOBUFS;
+ 		break;
+ 	case NETLINK_LIST_MEMBERSHIPS: {
+-		int pos, idx, shift;
++		int pos, idx, shift, err = 0;
+ 
+-		err = 0;
+ 		netlink_lock_table();
+ 		for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
+ 			if (len - pos < sizeof(u32))
+@@ -1805,40 +1784,32 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ 		if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
+ 			err = -EFAULT;
+ 		netlink_unlock_table();
+-		break;
++		return err;
+ 	}
+ 	case NETLINK_CAP_ACK:
+-		if (len < sizeof(int))
+-			return -EINVAL;
+-		len = sizeof(int);
+-		val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
+-		if (put_user(len, optlen) ||
+-		    put_user(val, optval))
+-			return -EFAULT;
+-		err = 0;
++		flag = NETLINK_F_CAP_ACK;
+ 		break;
+ 	case NETLINK_EXT_ACK:
+-		if (len < sizeof(int))
+-			return -EINVAL;
+-		len = sizeof(int);
+-		val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0;
+-		if (put_user(len, optlen) || put_user(val, optval))
+-			return -EFAULT;
+-		err = 0;
++		flag = NETLINK_F_EXT_ACK;
+ 		break;
+ 	case NETLINK_GET_STRICT_CHK:
+-		if (len < sizeof(int))
+-			return -EINVAL;
+-		len = sizeof(int);
+-		val = nlk->flags & NETLINK_F_STRICT_CHK ? 1 : 0;
+-		if (put_user(len, optlen) || put_user(val, optval))
+-			return -EFAULT;
+-		err = 0;
++		flag = NETLINK_F_STRICT_CHK;
+ 		break;
+ 	default:
+-		err = -ENOPROTOOPT;
++		return -ENOPROTOOPT;
+ 	}
+-	return err;
++
++	if (len < sizeof(int))
++		return -EINVAL;
++
++	len = sizeof(int);
++	val = nlk->flags & flag ? 1 : 0;
++
++	if (put_user(len, optlen) ||
++	    copy_to_user(optval, &val, len))
++		return -EFAULT;
++
++	return 0;
+ }
+ 
+ static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
+-- 
+2.39.2
+
diff --git a/queue-5.10/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch b/queue-5.10/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch
new file mode 100644
index 00000000000..7b0c05275d7
--- /dev/null
+++ b/queue-5.10/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch
@@ -0,0 +1,45 @@
+From a3e0f18664c52bee7f44a927a764f654297fdd09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 18:45:53 -0400
+Subject: NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 40882deb83c29d8df4470d4e5e7f137b6acf7ad1 ]
+
+The spec requires that we always at least send a RECLAIM_COMPLETE when
+we're done establishing the lease and recovering any state.
+
+Fixes: fce5c838e133 ("nfs41: RECLAIM_COMPLETE functionality")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 628e030f8e3ba..ff6ca05a9d441 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -67,6 +67,8 @@
+ 
+ #define OPENOWNER_POOL_SIZE	8
+ 
++static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp);
++
+ const nfs4_stateid zero_stateid = {
+ 	{ .data = { 0 } },
+ 	.type = NFS4_SPECIAL_STATEID_TYPE,
+@@ -330,6 +332,8 @@ int nfs41_init_clientid(struct nfs_client *clp, const struct cred *cred)
+ 	status = nfs4_proc_create_session(clp, cred);
+ 	if (status != 0)
+ 		goto out;
++	if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R))
++		nfs4_state_start_reclaim_reboot(clp);
+ 	nfs41_finish_session_reset(clp);
+ 	nfs_mark_client_ready(clp, NFS_CS_READY);
+ out:
+-- 
+2.39.2
+
diff --git a/queue-5.10/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch b/queue-5.10/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch
new file mode 100644
index 00000000000..14f6291933c
--- /dev/null
+++ b/queue-5.10/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch
@@ -0,0 +1,206 @@
+From a00785012895eeb44e97d77a39afbb2b190cd31d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 16:49:04 +0800
+Subject: nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W}
+ usage"
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 4f86a6ff6fbd891232dda3ca97fd1b9630b59809 ]
+
+fcloop_fcp_op() could be called from flush request's ->end_io(flush_end_io) in
+which the spinlock of fq->mq_flush_lock is grabbed with irq saved/disabled.
+
+So fcloop_fcp_op() can't call spin_unlock_irq(&tfcp_req->reqlock) simply
+which enables irq unconditionally.
+
+Fixes the warning by switching to spin_lock_irqsave()/spin_unlock_irqrestore()
+
+Fixes: c38dbbfab1bc ("nvme-fcloop: fix inconsistent lock state warnings")
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fcloop.c | 48 ++++++++++++++++++++----------------
+ 1 file changed, 27 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index 3da067a8311e5..80a208fb34f52 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -570,10 +570,11 @@ fcloop_fcp_recv_work(struct work_struct *work)
+ 	struct fcloop_fcpreq *tfcp_req =
+ 		container_of(work, struct fcloop_fcpreq, fcp_rcv_work);
+ 	struct nvmefc_fcp_req *fcpreq = tfcp_req->fcpreq;
++	unsigned long flags;
+ 	int ret = 0;
+ 	bool aborted = false;
+ 
+-	spin_lock_irq(&tfcp_req->reqlock);
++	spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ 	switch (tfcp_req->inistate) {
+ 	case INI_IO_START:
+ 		tfcp_req->inistate = INI_IO_ACTIVE;
+@@ -582,11 +583,11 @@ fcloop_fcp_recv_work(struct work_struct *work)
+ 		aborted = true;
+ 		break;
+ 	default:
+-		spin_unlock_irq(&tfcp_req->reqlock);
++		spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 		WARN_ON(1);
+ 		return;
+ 	}
+-	spin_unlock_irq(&tfcp_req->reqlock);
++	spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 
+ 	if (unlikely(aborted))
+ 		ret = -ECANCELED;
+@@ -607,8 +608,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work)
+ 		container_of(work, struct fcloop_fcpreq, abort_rcv_work);
+ 	struct nvmefc_fcp_req *fcpreq;
+ 	bool completed = false;
++	unsigned long flags;
+ 
+-	spin_lock_irq(&tfcp_req->reqlock);
++	spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ 	fcpreq = tfcp_req->fcpreq;
+ 	switch (tfcp_req->inistate) {
+ 	case INI_IO_ABORTED:
+@@ -617,11 +619,11 @@ fcloop_fcp_abort_recv_work(struct work_struct *work)
+ 		completed = true;
+ 		break;
+ 	default:
+-		spin_unlock_irq(&tfcp_req->reqlock);
++		spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 		WARN_ON(1);
+ 		return;
+ 	}
+-	spin_unlock_irq(&tfcp_req->reqlock);
++	spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 
+ 	if (unlikely(completed)) {
+ 		/* remove reference taken in original abort downcall */
+@@ -633,9 +635,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work)
+ 		nvmet_fc_rcv_fcp_abort(tfcp_req->tport->targetport,
+ 					&tfcp_req->tgt_fcp_req);
+ 
+-	spin_lock_irq(&tfcp_req->reqlock);
++	spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ 	tfcp_req->fcpreq = NULL;
+-	spin_unlock_irq(&tfcp_req->reqlock);
++	spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 
+ 	fcloop_call_host_done(fcpreq, tfcp_req, -ECANCELED);
+ 	/* call_host_done releases reference for abort downcall */
+@@ -651,11 +653,12 @@ fcloop_tgt_fcprqst_done_work(struct work_struct *work)
+ 	struct fcloop_fcpreq *tfcp_req =
+ 		container_of(work, struct fcloop_fcpreq, tio_done_work);
+ 	struct nvmefc_fcp_req *fcpreq;
++	unsigned long flags;
+ 
+-	spin_lock_irq(&tfcp_req->reqlock);
++	spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ 	fcpreq = tfcp_req->fcpreq;
+ 	tfcp_req->inistate = INI_IO_COMPLETED;
+-	spin_unlock_irq(&tfcp_req->reqlock);
++	spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 
+ 	fcloop_call_host_done(fcpreq, tfcp_req, tfcp_req->status);
+ }
+@@ -759,13 +762,14 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+ 	u32 rsplen = 0, xfrlen = 0;
+ 	int fcp_err = 0, active, aborted;
+ 	u8 op = tgt_fcpreq->op;
++	unsigned long flags;
+ 
+-	spin_lock_irq(&tfcp_req->reqlock);
++	spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ 	fcpreq = tfcp_req->fcpreq;
+ 	active = tfcp_req->active;
+ 	aborted = tfcp_req->aborted;
+ 	tfcp_req->active = true;
+-	spin_unlock_irq(&tfcp_req->reqlock);
++	spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 
+ 	if (unlikely(active))
+ 		/* illegal - call while i/o active */
+@@ -773,9 +777,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+ 
+ 	if (unlikely(aborted)) {
+ 		/* target transport has aborted i/o prior */
+-		spin_lock_irq(&tfcp_req->reqlock);
++		spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ 		tfcp_req->active = false;
+-		spin_unlock_irq(&tfcp_req->reqlock);
++		spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 		tgt_fcpreq->transferred_length = 0;
+ 		tgt_fcpreq->fcp_error = -ECANCELED;
+ 		tgt_fcpreq->done(tgt_fcpreq);
+@@ -832,9 +836,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+ 		break;
+ 	}
+ 
+-	spin_lock_irq(&tfcp_req->reqlock);
++	spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ 	tfcp_req->active = false;
+-	spin_unlock_irq(&tfcp_req->reqlock);
++	spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 
+ 	tgt_fcpreq->transferred_length = xfrlen;
+ 	tgt_fcpreq->fcp_error = fcp_err;
+@@ -848,15 +852,16 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport,
+ 			struct nvmefc_tgt_fcp_req *tgt_fcpreq)
+ {
+ 	struct fcloop_fcpreq *tfcp_req = tgt_fcp_req_to_fcpreq(tgt_fcpreq);
++	unsigned long flags;
+ 
+ 	/*
+ 	 * mark aborted only in case there were 2 threads in transport
+ 	 * (one doing io, other doing abort) and only kills ops posted
+ 	 * after the abort request
+ 	 */
+-	spin_lock_irq(&tfcp_req->reqlock);
++	spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ 	tfcp_req->aborted = true;
+-	spin_unlock_irq(&tfcp_req->reqlock);
++	spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 
+ 	tfcp_req->status = NVME_SC_INTERNAL;
+ 
+@@ -898,6 +903,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
+ 	struct fcloop_ini_fcpreq *inireq = fcpreq->private;
+ 	struct fcloop_fcpreq *tfcp_req;
+ 	bool abortio = true;
++	unsigned long flags;
+ 
+ 	spin_lock(&inireq->inilock);
+ 	tfcp_req = inireq->tfcp_req;
+@@ -910,7 +916,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
+ 		return;
+ 
+ 	/* break initiator/target relationship for io */
+-	spin_lock_irq(&tfcp_req->reqlock);
++	spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ 	switch (tfcp_req->inistate) {
+ 	case INI_IO_START:
+ 	case INI_IO_ACTIVE:
+@@ -920,11 +926,11 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
+ 		abortio = false;
+ 		break;
+ 	default:
+-		spin_unlock_irq(&tfcp_req->reqlock);
++		spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 		WARN_ON(1);
+ 		return;
+ 	}
+-	spin_unlock_irq(&tfcp_req->reqlock);
++	spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ 
+ 	if (abortio)
+ 		/* leave the reference while the work item is scheduled */
+-- 
+2.39.2
+
diff --git a/queue-5.10/nvme-fix-async-event-trace-event.patch b/queue-5.10/nvme-fix-async-event-trace-event.patch
new file mode 100644
index 00000000000..2cb50df34f7
--- /dev/null
+++ b/queue-5.10/nvme-fix-async-event-trace-event.patch
@@ -0,0 +1,92 @@
+From f19411b43ebfa20342ea64dd931feebc8bec1503 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 14:57:20 -0700
+Subject: nvme: fix async event trace event
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 6622b76fe922b94189499a90ccdb714a4a8d0773 ]
+
+Mixing AER Event Type and Event Info has masking clashes. Just print the
+event type, but also include the event info of the AER result in the
+trace.
+
+Fixes: 09bd1ff4b15143b ("nvme-core: add async event trace helper")
+Reported-by: Nate Thornton <nate.thornton@samsung.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Minwoo Im <minwoo.im@samsung.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c  |  5 +----
+ drivers/nvme/host/trace.h | 15 ++++++---------
+ 2 files changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index cb3f807ede1b8..07c41a149328a 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4430,8 +4430,6 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+ {
+ 	u32 aer_notice_type = nvme_aer_subtype(result);
+ 
+-	trace_nvme_async_event(ctrl, aer_notice_type);
+-
+ 	switch (aer_notice_type) {
+ 	case NVME_AER_NOTICE_NS_CHANGED:
+ 		set_bit(NVME_AER_NOTICE_NS_CHANGED, &ctrl->events);
+@@ -4463,7 +4461,6 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+ 
+ static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl)
+ {
+-	trace_nvme_async_event(ctrl, NVME_AER_ERROR);
+ 	dev_warn(ctrl->device, "resetting controller due to AER\n");
+ 	nvme_reset_ctrl(ctrl);
+ }
+@@ -4478,6 +4475,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ 	if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS)
+ 		return;
+ 
++	trace_nvme_async_event(ctrl, result);
+ 	switch (aer_type) {
+ 	case NVME_AER_NOTICE:
+ 		nvme_handle_aen_notice(ctrl, result);
+@@ -4495,7 +4493,6 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ 	case NVME_AER_SMART:
+ 	case NVME_AER_CSS:
+ 	case NVME_AER_VS:
+-		trace_nvme_async_event(ctrl, aer_type);
+ 		ctrl->aen_result = result;
+ 		break;
+ 	default:
+diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h
+index aa8b0f86b2be1..b258f7b8788e1 100644
+--- a/drivers/nvme/host/trace.h
++++ b/drivers/nvme/host/trace.h
+@@ -127,15 +127,12 @@ TRACE_EVENT(nvme_async_event,
+ 	),
+ 	TP_printk("nvme%d: NVME_AEN=%#08x [%s]",
+ 		__entry->ctrl_id, __entry->result,
+-		__print_symbolic(__entry->result,
+-		aer_name(NVME_AER_NOTICE_NS_CHANGED),
+-		aer_name(NVME_AER_NOTICE_ANA),
+-		aer_name(NVME_AER_NOTICE_FW_ACT_STARTING),
+-		aer_name(NVME_AER_NOTICE_DISC_CHANGED),
+-		aer_name(NVME_AER_ERROR),
+-		aer_name(NVME_AER_SMART),
+-		aer_name(NVME_AER_CSS),
+-		aer_name(NVME_AER_VS))
++		__print_symbolic(__entry->result & 0x7,
++			aer_name(NVME_AER_ERROR),
++			aer_name(NVME_AER_SMART),
++			aer_name(NVME_AER_NOTICE),
++			aer_name(NVME_AER_CSS),
++			aer_name(NVME_AER_VS))
+ 	)
+ );
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/nvme-handle-the-persistent-internal-error-aer.patch b/queue-5.10/nvme-handle-the-persistent-internal-error-aer.patch
new file mode 100644
index 00000000000..45b3b7a4b7f
--- /dev/null
+++ b/queue-5.10/nvme-handle-the-persistent-internal-error-aer.patch
@@ -0,0 +1,113 @@
+From 6f1246a515f500eb0a0c6c231ee8f26e6e1ef48f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jun 2022 11:52:21 -0700
+Subject: nvme: handle the persistent internal error AER
+
+From: Michael Kelley <mikelley@microsoft.com>
+
+[ Upstream commit 2c61c97fb12b806e1c8eb15f04c277ad097ec95e ]
+
+In the NVM Express Revision 1.4 spec, Figure 145 describes possible
+values for an AER with event type "Error" (value 000b). For a
+Persistent Internal Error (value 03h), the host should perform a
+controller reset.
+
+Add support for this error using code that already exists for
+doing a controller reset. As part of this support, introduce
+two utility functions for parsing the AER type and subtype.
+
+This new support was tested in a lab environment where we can
+generate the persistent internal error on demand, and observe
+both the Linux side and NVMe controller side to see that the
+controller reset has been done.
+
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 6622b76fe922 ("nvme: fix async event trace event")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 31 +++++++++++++++++++++++++++++--
+ include/linux/nvme.h     |  4 ++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index a4b6aa932a8fe..cb3f807ede1b8 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4416,9 +4416,19 @@ static void nvme_fw_act_work(struct work_struct *work)
+ 	nvme_get_fw_slot_info(ctrl);
+ }
+ 
++static u32 nvme_aer_type(u32 result)
++{
++	return result & 0x7;
++}
++
++static u32 nvme_aer_subtype(u32 result)
++{
++	return (result & 0xff00) >> 8;
++}
++
+ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+ {
+-	u32 aer_notice_type = (result & 0xff00) >> 8;
++	u32 aer_notice_type = nvme_aer_subtype(result);
+ 
+ 	trace_nvme_async_event(ctrl, aer_notice_type);
+ 
+@@ -4451,11 +4461,19 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+ 	}
+ }
+ 
++static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl)
++{
++	trace_nvme_async_event(ctrl, NVME_AER_ERROR);
++	dev_warn(ctrl->device, "resetting controller due to AER\n");
++	nvme_reset_ctrl(ctrl);
++}
++
+ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ 		volatile union nvme_result *res)
+ {
+ 	u32 result = le32_to_cpu(res->u32);
+-	u32 aer_type = result & 0x07;
++	u32 aer_type = nvme_aer_type(result);
++	u32 aer_subtype = nvme_aer_subtype(result);
+ 
+ 	if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS)
+ 		return;
+@@ -4465,6 +4483,15 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ 		nvme_handle_aen_notice(ctrl, result);
+ 		break;
+ 	case NVME_AER_ERROR:
++		/*
++		 * For a persistent internal error, don't run async_event_work
++		 * to submit a new AER. The controller reset will do it.
++		 */
++		if (aer_subtype == NVME_AER_ERROR_PERSIST_INT_ERR) {
++			nvme_handle_aer_persistent_error(ctrl);
++			return;
++		}
++		fallthrough;
+ 	case NVME_AER_SMART:
+ 	case NVME_AER_CSS:
+ 	case NVME_AER_VS:
+diff --git a/include/linux/nvme.h b/include/linux/nvme.h
+index fe39ed9e9303e..f454dd1003347 100644
+--- a/include/linux/nvme.h
++++ b/include/linux/nvme.h
+@@ -602,6 +602,10 @@ enum {
+ 	NVME_AER_VS			= 7,
+ };
+ 
++enum {
++	NVME_AER_ERROR_PERSIST_INT_ERR	= 0x03,
++};
++
+ enum {
+ 	NVME_AER_NOTICE_NS_CHANGED	= 0x00,
+ 	NVME_AER_NOTICE_FW_ACT_STARTING = 0x01,
+-- 
+2.39.2
+
diff --git a/queue-5.10/of-fix-modalias-string-generation.patch b/queue-5.10/of-fix-modalias-string-generation.patch
new file mode 100644
index 00000000000..b1fb6630a8a
--- /dev/null
+++ b/queue-5.10/of-fix-modalias-string-generation.patch
@@ -0,0 +1,80 @@
+From 13371f5cdb72bf7e51ce17c800999d1cb5be2b72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 18:21:09 +0100
+Subject: of: Fix modalias string generation
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit b19a4266c52de78496fe40f0b37580a3b762e67d ]
+
+The helper generating an OF based modalias (of_device_get_modalias())
+works fine, but due to the use of snprintf() internally it needs a
+buffer one byte longer than what should be needed just for the entire
+string (excluding the '\0'). Most users of this helper are sysfs hooks
+providing the modalias string to users. They all provide a PAGE_SIZE
+buffer which is way above the number of bytes required to fit the
+modalias string and hence do not suffer from this issue.
+
+There is another user though, of_device_request_module(), which is only
+called by drivers/usb/common/ulpi.c. This request module function is
+faulty, but maybe because in most cases there is an alternative, ULPI
+driver users have not noticed it.
+
+In this function, of_device_get_modalias() is called twice. The first
+time without buffer just to get the number of bytes required by the
+modalias string (excluding the null byte), and a second time, after
+buffer allocation, to fill the buffer. The allocation asks for an
+additional byte, in order to store the trailing '\0'. However, the
+buffer *length* provided to of_device_get_modalias() excludes this extra
+byte. The internal use of snprintf() with a length that is exactly the
+number of bytes to be written has the effect of using the last available
+byte to store a '\0', which then smashes the last character of the
+modalias string.
+
+Provide the actual size of the buffer to of_device_get_modalias() to fix
+this issue.
+
+Note: the "str[size - 1] = '\0';" line is not really needed as snprintf
+will anyway end the string with a null byte, but there is a possibility
+that this function might be called on a struct device_node without
+compatible, in this case snprintf() would not be executed. So we keep it
+just to avoid possible unbounded strings.
+
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Peter Chen <peter.chen@kernel.org>
+Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/device.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index 1122daa8e2736..3a547793135c3 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -264,12 +264,15 @@ int of_device_request_module(struct device *dev)
+ 	if (size < 0)
+ 		return size;
+ 
+-	str = kmalloc(size + 1, GFP_KERNEL);
++	/* Reserve an additional byte for the trailing '\0' */
++	size++;
++
++	str = kmalloc(size, GFP_KERNEL);
+ 	if (!str)
+ 		return -ENOMEM;
+ 
+ 	of_device_get_modalias(dev, str, size);
+-	str[size] = '\0';
++	str[size - 1] = '\0';
+ 	ret = request_module(str);
+ 	kfree(str);
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch b/queue-5.10/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch
new file mode 100644
index 00000000000..c94a1f33ff0
--- /dev/null
+++ b/queue-5.10/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch
@@ -0,0 +1,56 @@
+From cb37079fed8471bb66e2921660b714ab78155227 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 19:14:06 +0900
+Subject: openrisc: Properly store r31 to pt_regs on unhandled exceptions
+
+From: Stafford Horne <shorne@gmail.com>
+
+[ Upstream commit 812489ac4dd91144a74ce65ecf232252a2e406fb ]
+
+In commit 91993c8c2ed5 ("openrisc: use shadow registers to save regs on
+exception") the unhandled exception path was changed to do an early
+store of r30 instead of r31.  The entry code was not updated and r31 is
+not getting stored to pt_regs.
+
+This patch updates the entry handler to store r31 instead of r30.  We
+also remove some misleading commented out store r30 and r31
+instructrions.
+
+I noticed this while working on adding floating point exception
+handling,  This issue probably would never impact anything since we kill
+the process or Oops right away on unhandled exceptions.
+
+Fixes: 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception")
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index b42d32d79b2e6..7257e942731df 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -173,7 +173,6 @@ handler:							;\
+ 	l.sw    PT_GPR28(r1),r28					;\
+ 	l.sw    PT_GPR29(r1),r29					;\
+ 	/* r30 already save */					;\
+-/*        l.sw    PT_GPR30(r1),r30*/					;\
+ 	l.sw    PT_GPR31(r1),r31					;\
+ 	TRACE_IRQS_OFF_ENTRY						;\
+ 	/* Store -1 in orig_gpr11 for non-syscall exceptions */	;\
+@@ -211,9 +210,8 @@ handler:							;\
+ 	l.sw    PT_GPR27(r1),r27					;\
+ 	l.sw    PT_GPR28(r1),r28					;\
+ 	l.sw    PT_GPR29(r1),r29					;\
+-	/* r31 already saved */					;\
+-	l.sw    PT_GPR30(r1),r30					;\
+-/*        l.sw    PT_GPR31(r1),r31	*/				;\
++	/* r30 already saved */						;\
++	l.sw    PT_GPR31(r1),r31					;\
+ 	/* Store -1 in orig_gpr11 for non-syscall exceptions */	;\
+ 	l.addi	r30,r0,-1					;\
+ 	l.sw	PT_ORIG_GPR11(r1),r30				;\
+-- 
+2.39.2
+
diff --git a/queue-5.10/pci-edr-clear-device-status-after-edr-error-recovery.patch b/queue-5.10/pci-edr-clear-device-status-after-edr-error-recovery.patch
new file mode 100644
index 00000000000..6b4d535ca65
--- /dev/null
+++ b/queue-5.10/pci-edr-clear-device-status-after-edr-error-recovery.patch
@@ -0,0 +1,56 @@
+From 7c9dfb9990acd6a05d0879698aacc52fb5fefb6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 16:54:49 -0700
+Subject: PCI/EDR: Clear Device Status after EDR error recovery
+
+From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+
+[ Upstream commit c441b1e03da6c680a3e12da59c554f454f2ccf5e ]
+
+During EDR recovery, the OS must clear error status of the port that
+triggered DPC even if firmware retains control of DPC and AER (see the
+implementation note in the PCI Firmware spec r3.3, sec 4.6.12).
+
+Prior to 068c29a248b6 ("PCI/ERR: Clear PCIe Device Status errors only if
+OS owns AER"), the port Device Status was cleared in this path:
+
+  edr_handle_event
+    dpc_process_error(dev)                 # "dev" triggered DPC
+    pcie_do_recovery(dev, dpc_reset_link)
+      dpc_reset_link                       # exit DPC
+      pcie_clear_device_status(dev)        # clear Device Status
+
+After 068c29a248b6, pcie_do_recovery() no longer clears Device Status when
+firmware controls AER, so the error bit remains set even after recovery.
+
+Per the "Downstream Port Containment configuration control" bit in the
+returned _OSC Control Field (sec 4.5.1), the OS is allowed to clear error
+status until it evaluates _OST, so clear Device Status in
+edr_handle_event() if the error recovery was successful.
+
+[bhelgaas: commit log]
+Fixes: 068c29a248b6 ("PCI/ERR: Clear PCIe Device Status errors only if OS owns AER")
+Link: https://lore.kernel.org/r/20230315235449.1279209-1-sathyanarayanan.kuppuswamy@linux.intel.com
+Reported-by: Tsaur Erwin <erwin.tsaur@intel.com>
+Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/edr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/pcie/edr.c b/drivers/pci/pcie/edr.c
+index a6b9b479b97ad..87734e4c3c204 100644
+--- a/drivers/pci/pcie/edr.c
++++ b/drivers/pci/pcie/edr.c
+@@ -193,6 +193,7 @@ static void edr_handle_event(acpi_handle handle, u32 event, void *data)
+ 	 */
+ 	if (estate == PCI_ERS_RESULT_RECOVERED) {
+ 		pci_dbg(edev, "DPC port successfully recovered\n");
++		pcie_clear_device_status(edev);
+ 		acpi_send_edr_status(pdev, edev, EDR_OST_SUCCESS);
+ 	} else {
+ 		pci_dbg(edev, "DPC port recovery failed\n");
+-- 
+2.39.2
+
diff --git a/queue-5.10/pci-imx6-install-the-fault-handler-only-on-compatibl.patch b/queue-5.10/pci-imx6-install-the-fault-handler-only-on-compatibl.patch
new file mode 100644
index 00000000000..d2ef50d8aa0
--- /dev/null
+++ b/queue-5.10/pci-imx6-install-the-fault-handler-only-on-compatibl.patch
@@ -0,0 +1,78 @@
+From d7bae66a2221814f62420b3b1f78a0c827a13e09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 17:56:31 +0100
+Subject: PCI: imx6: Install the fault handler only on compatible match
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 5f5ac460dfe7f4e11f99de9870f240e39189cf72 ]
+
+commit bb38919ec56e ("PCI: imx6: Add support for i.MX6 PCIe controller")
+added a fault hook to this driver in the probe function. So it was only
+installed if needed.
+
+commit bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO")
+moved it from probe to driver init which installs the hook unconditionally
+as soon as the driver is compiled into a kernel.
+
+When this driver is compiled as a module, the hook is not registered
+until after the driver has been matched with a .compatible and
+loaded.
+
+commit 415b6185c541 ("PCI: imx6: Fix config read timeout handling")
+extended the fault handling code.
+
+commit 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ")
+added some protection for non-ARM architectures, but this does not
+protect non-i.MX ARM architectures.
+
+Since fault handlers can be triggered on any architecture for different
+reasons, there is no guarantee that they will be triggered only for the
+assumed situation, leading to improper error handling (i.MX6-specific
+imx6q_pcie_abort_handler) on foreign systems.
+
+I had seen strange L3 imprecise external abort messages several times on
+OMAP4 and OMAP5 devices and couldn't make sense of them until I realized
+they were related to this unused imx6q driver because I had
+CONFIG_PCI_IMX6=y.
+
+Note that CONFIG_PCI_IMX6=y is useful for kernel binaries that are designed
+to run on different ARM SoC and be differentiated only by device tree
+binaries. So turning off CONFIG_PCI_IMX6 is not a solution.
+
+Therefore we check the compatible in the init function before registering
+the fault handler.
+
+Link: https://lore.kernel.org/r/e1bcfc3078c82b53aa9b78077a89955abe4ea009.1678380991.git.hns@goldelico.com
+Fixes: bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO")
+Fixes: 415b6185c541 ("PCI: imx6: Fix config read timeout handling")
+Fixes: 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index ceb4815379cd4..8117f2dad86c4 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1272,6 +1272,13 @@ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_SYNOPSYS, 0xabcd,
+ static int __init imx6_pcie_init(void)
+ {
+ #ifdef CONFIG_ARM
++	struct device_node *np;
++
++	np = of_find_matching_node(NULL, imx6_pcie_of_match);
++	if (!np)
++		return -ENODEV;
++	of_node_put(np);
++
+ 	/*
+ 	 * Since probe() can be deferred we need to make sure that
+ 	 * hook_fault_code is not called after __init memory is freed
+-- 
+2.39.2
+
diff --git a/queue-5.10/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch b/queue-5.10/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch
new file mode 100644
index 00000000000..44e8dd454e9
--- /dev/null
+++ b/queue-5.10/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch
@@ -0,0 +1,51 @@
+From f407b9dde57451994a9c06934b7a72c91659c936 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 10:35:08 +0800
+Subject: perf/core: Fix hardlockup failure caused by perf throttle
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 15def34e2635ab7e0e96f1bc32e1b69609f14942 ]
+
+commit e050e3f0a71bf ("perf: Fix broken interrupt rate throttling")
+introduces a change in throttling threshold judgment. Before this,
+compare hwc->interrupts and max_samples_per_tick, then increase
+hwc->interrupts by 1, but this commit reverses order of these two
+behaviors, causing the semantics of max_samples_per_tick to change.
+In literal sense of "max_samples_per_tick", if hwc->interrupts ==
+max_samples_per_tick, it should not be throttled, therefore, the judgment
+condition should be changed to "hwc->interrupts > max_samples_per_tick".
+
+In fact, this may cause the hardlockup to fail, The minimum value of
+max_samples_per_tick may be 1, in this case, the return value of
+__perf_event_account_interrupt function is 1.
+As a result, nmi_watchdog gets throttled, which would stop PMU (Use x86
+architecture as an example, see x86_pmu_handle_irq).
+
+Fixes: e050e3f0a71b ("perf: Fix broken interrupt rate throttling")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20230227023508.102230-1-yangjihong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index f0df3bc0e6415..53f36bbaf0c66 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -8925,8 +8925,8 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle)
+ 		hwc->interrupts = 1;
+ 	} else {
+ 		hwc->interrupts++;
+-		if (unlikely(throttle
+-			     && hwc->interrupts >= max_samples_per_tick)) {
++		if (unlikely(throttle &&
++			     hwc->interrupts > max_samples_per_tick)) {
+ 			__this_cpu_inc(perf_throttled_count);
+ 			tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS);
+ 			hwc->interrupts = MAX_INTERRUPTS;
+-- 
+2.39.2
+
diff --git a/queue-5.10/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch b/queue-5.10/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch
new file mode 100644
index 00000000000..b93b9cc5399
--- /dev/null
+++ b/queue-5.10/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch
@@ -0,0 +1,47 @@
+From 6b3912eb9c38e7b08fbaae793b5941f922624d21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 19:16:34 +0800
+Subject: phy: tegra: xusb: Add missing tegra_xusb_port_unregister for
+ usb2_port and ulpi_port
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit e024854048e733391b31fe5a398704b31b9af803 ]
+
+The tegra_xusb_port_unregister should be called when usb2_port
+and ulpi_port map fails in tegra_xusb_add_usb2_port() or in
+tegra_xusb_add_ulpi_port(), fix it.
+
+Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20221129111634.1547747-1-cuigaosheng1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/tegra/xusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index 181a1be5f4917..d07f33ec79397 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -775,6 +775,7 @@ static int tegra_xusb_add_usb2_port(struct tegra_xusb_padctl *padctl,
+ 	usb2->base.lane = usb2->base.ops->map(&usb2->base);
+ 	if (IS_ERR(usb2->base.lane)) {
+ 		err = PTR_ERR(usb2->base.lane);
++		tegra_xusb_port_unregister(&usb2->base);
+ 		goto out;
+ 	}
+ 
+@@ -841,6 +842,7 @@ static int tegra_xusb_add_ulpi_port(struct tegra_xusb_padctl *padctl,
+ 	ulpi->base.lane = ulpi->base.ops->map(&ulpi->base);
+ 	if (IS_ERR(ulpi->base.lane)) {
+ 		err = PTR_ERR(ulpi->base.lane);
++		tegra_xusb_port_unregister(&ulpi->base);
+ 		goto out;
+ 	}
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/power-supply-generic-adc-battery-fix-unit-scaling.patch b/queue-5.10/power-supply-generic-adc-battery-fix-unit-scaling.patch
new file mode 100644
index 00000000000..eda063843e7
--- /dev/null
+++ b/queue-5.10/power-supply-generic-adc-battery-fix-unit-scaling.patch
@@ -0,0 +1,42 @@
+From 4f85f3f54c67cfb90401b00fce92f5b5df8e0f91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 23:56:57 +0100
+Subject: power: supply: generic-adc-battery: fix unit scaling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Reichel <sre@kernel.org>
+
+[ Upstream commit 44263f50065969f2344808388bd589740f026167 ]
+
+power-supply properties are reported in µV, µA and µW.
+The IIO API provides mV, mA, mW, so the values need to
+be multiplied by 1000.
+
+Fixes: e60fea794e6e ("power: battery: Generic battery driver using IIO")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/generic-adc-battery.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c
+index 58f09314741a7..09bb4ff291cb0 100644
+--- a/drivers/power/supply/generic-adc-battery.c
++++ b/drivers/power/supply/generic-adc-battery.c
+@@ -138,6 +138,9 @@ static int read_channel(struct gab *adc_bat, enum power_supply_property psp,
+ 			result);
+ 	if (ret < 0)
+ 		pr_err("read channel error\n");
++	else
++		*result *= 1000;
++
+ 	return ret;
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/powerpc-mpc512x-fix-resource-printk-format-warning.patch b/queue-5.10/powerpc-mpc512x-fix-resource-printk-format-warning.patch
new file mode 100644
index 00000000000..858c00fffcb
--- /dev/null
+++ b/queue-5.10/powerpc-mpc512x-fix-resource-printk-format-warning.patch
@@ -0,0 +1,46 @@
+From 1f259003c211d18033bb3f8640bd9813c05b877f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:13 -0800
+Subject: powerpc/mpc512x: fix resource printk format warning
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7538c97e2b80ff6b7a8ea2ecf16a04355461b439 ]
+
+Use "%pa" format specifier for resource_size_t to avoid a compiler
+printk format warning.
+
+../arch/powerpc/platforms/512x/clock-commonclk.c: In function 'mpc5121_clk_provide_backwards_compat':
+../arch/powerpc/platforms/512x/clock-commonclk.c:989:44: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+  989 |         snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \
+      |                                            ^~~~~~~~~  ~~~~~~~~~
+      |                                                          |
+      |                                                          resource_size_t {aka long long unsigned int}
+
+Prevents 24 such warnings.
+
+Fixes: 01f25c371658 ("clk: mpc512x: add backwards compat to the CCF code")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-2-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/512x/clock-commonclk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c
+index 30342b60aa63f..42c3d40355d90 100644
+--- a/arch/powerpc/platforms/512x/clock-commonclk.c
++++ b/arch/powerpc/platforms/512x/clock-commonclk.c
+@@ -984,7 +984,7 @@ static void mpc5121_clk_provide_migration_support(void)
+ 
+ #define NODE_PREP do { \
+ 	of_address_to_resource(np, 0, &res); \
+-	snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \
++	snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \
+ } while (0)
+ 
+ #define NODE_CHK(clkname, clkitem, regnode, regflag) do { \
+-- 
+2.39.2
+
diff --git a/queue-5.10/powerpc-rtas-use-memmove-for-potentially-overlapping.patch b/queue-5.10/powerpc-rtas-use-memmove-for-potentially-overlapping.patch
new file mode 100644
index 00000000000..b6961c9ba5f
--- /dev/null
+++ b/queue-5.10/powerpc-rtas-use-memmove-for-potentially-overlapping.patch
@@ -0,0 +1,56 @@
+From d33f66b36b8581f5172308bb55cd744d70811686 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 15:33:41 -0600
+Subject: powerpc/rtas: use memmove for potentially overlapping buffer copy
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 271208ee5e335cb1ad280d22784940daf7ddf820 ]
+
+Using memcpy() isn't safe when buf is identical to rtas_err_buf, which
+can happen during boot before slab is up. Full context which may not
+be obvious from the diff:
+
+	if (altbuf) {
+		buf = altbuf;
+	} else {
+		buf = rtas_err_buf;
+		if (slab_is_available())
+			buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC);
+	}
+	if (buf)
+		memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
+
+This was found by inspection and I'm not aware of it causing problems
+in practice. It appears to have been introduced by commit
+033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"); the
+old ppc64 version of this code did not have this problem.
+
+Use memmove() instead.
+
+Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230220-rtas-queue-for-6-4-v1-2-010e4416f13f@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index c2e407a112a28..5976a25c6264d 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -399,7 +399,7 @@ static char *__fetch_rtas_last_error(char *altbuf)
+ 				buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC);
+ 		}
+ 		if (buf)
+-			memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
++			memmove(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
+ 	}
+ 
+ 	return buf;
+-- 
+2.39.2
+
diff --git a/queue-5.10/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch b/queue-5.10/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch
new file mode 100644
index 00000000000..68ca08fbc0a
--- /dev/null
+++ b/queue-5.10/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch
@@ -0,0 +1,45 @@
+From b0fe8335dde01cdb53337e04c7b84bc52c35d7ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:16 -0800
+Subject: powerpc/sysdev/tsi108: fix resource printk format warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 55d8bd02cc1b9f1063993b5c42c9cabf4af67dea ]
+
+Use "%pa" format specifier for resource_size_t to avoid a compiler
+printk format warning.
+
+  arch/powerpc/sysdev/tsi108_pci.c: In function 'tsi108_setup_pci':
+  include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t'
+
+Fixes: c4342ff92bed ("[POWERPC] Update mpc7448hpc2 board irq support using device tree")
+Fixes: 2b9d7467a6db ("[POWERPC] Add tsi108 pci and platform device data register function")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[mpe: Use pr_info() and unsplit string]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-5-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/tsi108_pci.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c
+index 49f9541954f8d..3664ffcbb313c 100644
+--- a/arch/powerpc/sysdev/tsi108_pci.c
++++ b/arch/powerpc/sysdev/tsi108_pci.c
+@@ -216,9 +216,8 @@ int __init tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary)
+ 
+ 	(hose)->ops = &tsi108_direct_pci_ops;
+ 
+-	printk(KERN_INFO "Found tsi108 PCI host bridge at 0x%08x. "
+-	       "Firmware bus number: %d->%d\n",
+-	       rsrc.start, hose->first_busno, hose->last_busno);
++	pr_info("Found tsi108 PCI host bridge at 0x%pa. Firmware bus number: %d->%d\n",
++		&rsrc.start, hose->first_busno, hose->last_busno);
+ 
+ 	/* Interpret the "ranges" property */
+ 	/* This also maps the I/O region and sets isa_io/mem_base */
+-- 
+2.39.2
+
diff --git a/queue-5.10/powerpc-wii-fix-resource-printk-format-warnings.patch b/queue-5.10/powerpc-wii-fix-resource-printk-format-warnings.patch
new file mode 100644
index 00000000000..f0ec2eaa48c
--- /dev/null
+++ b/queue-5.10/powerpc-wii-fix-resource-printk-format-warnings.patch
@@ -0,0 +1,87 @@
+From 6b7c69961c5be204bdd134734f4de2a03d775d27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:14 -0800
+Subject: powerpc/wii: fix resource printk format warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7b69600d4da0049244e9be2f5ef5a2f8e04fcd9a ]
+
+Use "%pa" format specifier for resource_size_t to avoid compiler
+printk format warnings.
+
+../arch/powerpc/platforms/embedded6xx/flipper-pic.c: In function 'flipper_pic_init':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/flipper-pic.c:148:9: note: in expansion of macro 'pr_info'
+  148 |         pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
+      |         ^~~~~~~
+
+../arch/powerpc/platforms/embedded6xx/hlwd-pic.c: In function 'hlwd_pic_init':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/hlwd-pic.c:174:9: note: in expansion of macro 'pr_info'
+  174 |         pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
+      |         ^~~~~~~
+
+../arch/powerpc/platforms/embedded6xx/wii.c: In function 'wii_ioremap_hw_regs':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/wii.c:77:17: note: in expansion of macro 'pr_info'
+   77 |                 pr_info("%s at 0x%08x mapped to 0x%p\n", name,
+      |                 ^~~~~~~
+
+Fixes: 028ee972f032 ("powerpc: gamecube/wii: flipper interrupt controller support")
+Fixes: 9c21025c7845 ("powerpc: wii: hollywood interrupt controller support")
+Fixes: 5a7ee3198dfa ("powerpc: wii: platform support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-3-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/embedded6xx/flipper-pic.c | 2 +-
+ arch/powerpc/platforms/embedded6xx/hlwd-pic.c    | 2 +-
+ arch/powerpc/platforms/embedded6xx/wii.c         | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+index d39a9213a3e69..7dd2e2f97aae5 100644
+--- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+@@ -144,7 +144,7 @@ static struct irq_domain * __init flipper_pic_init(struct device_node *np)
+ 	}
+ 	io_base = ioremap(res.start, resource_size(&res));
+ 
+-	pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++	pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+ 
+ 	__flipper_quiesce(io_base);
+ 
+diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+index de10c13de15c6..c6b492ebb7662 100644
+--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+@@ -173,7 +173,7 @@ static struct irq_domain *hlwd_pic_init(struct device_node *np)
+ 		return NULL;
+ 	}
+ 
+-	pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++	pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+ 
+ 	__hlwd_quiesce(io_base);
+ 
+diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c
+index a802ef957d63e..458a63a30e803 100644
+--- a/arch/powerpc/platforms/embedded6xx/wii.c
++++ b/arch/powerpc/platforms/embedded6xx/wii.c
+@@ -89,8 +89,8 @@ static void __iomem *wii_ioremap_hw_regs(char *name, char *compatible)
+ 
+ 	hw_regs = ioremap(res.start, resource_size(&res));
+ 	if (hw_regs) {
+-		pr_info("%s at 0x%08x mapped to 0x%p\n", name,
+-			res.start, hw_regs);
++		pr_info("%s at 0x%pa mapped to 0x%p\n", name,
++			&res.start, hw_regs);
+ 	}
+ 
+ out_put:
+-- 
+2.39.2
+
diff --git a/queue-5.10/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch b/queue-5.10/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch
new file mode 100644
index 00000000000..337ab073cda
--- /dev/null
+++ b/queue-5.10/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch
@@ -0,0 +1,100 @@
+From 040a1776b3cf321cac046b3f4de1f91a19ed9960 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 20:40:43 +0000
+Subject: pstore: Revert pmsg_lock back to a normal mutex
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: John Stultz <jstultz@google.com>
+
+[ Upstream commit 5239a89b06d6b199f133bf0ffea421683187f257 ]
+
+This reverts commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721.
+
+So while priority inversion on the pmsg_lock is an occasional
+problem that an rt_mutex would help with, in uses where logging
+is writing to pmsg heavily from multiple threads, the pmsg_lock
+can be heavily contended.
+
+After this change landed, it was reported that cases where the
+mutex locking overhead was commonly adding on the order of 10s
+of usecs delay had suddenly jumped to ~msec delay with rtmutex.
+
+It seems the slight differences in the locks under this level
+of contention causes the normal mutexes to utilize the spinning
+optimizations, while the rtmutexes end up in the sleeping
+slowpath (which allows additional threads to pile on trying
+to take the lock).
+
+In this case, it devolves to a worse case senerio where the lock
+acquisition and scheduling overhead dominates, and each thread
+is waiting on the order of ~ms to do ~us of work.
+
+Obviously, having tons of threads all contending on a single
+lock for logging is non-optimal, so the proper fix is probably
+reworking pstore pmsg to have per-cpu buffers so we don't have
+contention.
+
+Additionally, Steven Rostedt has provided some furhter
+optimizations for rtmutexes that improves the rtmutex spinning
+path, but at least in my testing, I still see the test tripping
+into the sleeping path on rtmutexes while utilizing the spinning
+path with mutexes.
+
+But in the short term, lets revert the change to the rt_mutex
+and go back to normal mutexes to avoid a potentially major
+performance regression. And we can work on optimizations to both
+rtmutexes and finer-grained locking for pstore pmsg in the
+future.
+
+Cc: Wei Wang <wvw@google.com>
+Cc: Midas Chien<midaschieh@google.com>
+Cc: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Anton Vorontsov <anton@enomsg.org>
+Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: kernel-team@android.com
+Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion")
+Reported-by: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
+Signed-off-by: John Stultz <jstultz@google.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/pmsg.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c
+index 18cf94b597e05..d8542ec2f38c6 100644
+--- a/fs/pstore/pmsg.c
++++ b/fs/pstore/pmsg.c
+@@ -7,10 +7,9 @@
+ #include <linux/device.h>
+ #include <linux/fs.h>
+ #include <linux/uaccess.h>
+-#include <linux/rtmutex.h>
+ #include "internal.h"
+ 
+-static DEFINE_RT_MUTEX(pmsg_lock);
++static DEFINE_MUTEX(pmsg_lock);
+ 
+ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ 			  size_t count, loff_t *ppos)
+@@ -29,9 +28,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ 	if (!access_ok(buf, count))
+ 		return -EFAULT;
+ 
+-	rt_mutex_lock(&pmsg_lock);
++	mutex_lock(&pmsg_lock);
+ 	ret = psinfo->write_user(&record, buf);
+-	rt_mutex_unlock(&pmsg_lock);
++	mutex_unlock(&pmsg_lock);
+ 	return ret ? ret : count;
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch b/queue-5.10/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch
new file mode 100644
index 00000000000..92b47f994e3
--- /dev/null
+++ b/queue-5.10/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch
@@ -0,0 +1,198 @@
+From 41d8c52714add0bff2897b6f4a68a2fb4f258c21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Aug 2021 21:24:29 +0800
+Subject: pwm: mtk-disp: Adjust the clocks to avoid them mismatch
+
+From: Jitao Shi <jitao.shi@mediatek.com>
+
+[ Upstream commit d7a4e582587d97a586b1f7709e3bddcf35928e96 ]
+
+The clks "main" and "mm" are prepared in .probe() (and unprepared in
+.remove()). This results in the clocks being on during suspend which
+results in unnecessarily increased power consumption.
+
+Remove the clock operations from .probe() and .remove(). Add the
+clk_prepare_enable() in .enable() and the clk_disable_unprepare() in
+.disable().
+
+Signed-off-by: Jitao Shi <jitao.shi@mediatek.com>
+[thierry.reding@gmail.com: squashed in fixup patch]
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 91 +++++++++++++++++---------------------
+ 1 file changed, 41 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index af63aaab8e153..a594a0fdddd7b 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -74,6 +74,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	u64 div, rate;
+ 	int err;
+ 
++	err = clk_prepare_enable(mdp->clk_main);
++	if (err < 0) {
++		dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err));
++		return err;
++	}
++
++	err = clk_prepare_enable(mdp->clk_mm);
++	if (err < 0) {
++		dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err));
++		clk_disable_unprepare(mdp->clk_main);
++		return err;
++	}
++
+ 	/*
+ 	 * Find period, high_width and clk_div to suit duty_ns and period_ns.
+ 	 * Calculate proper div value to keep period value in the bound.
+@@ -87,8 +100,11 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	rate = clk_get_rate(mdp->clk_main);
+ 	clk_div = div_u64(rate * period_ns, NSEC_PER_SEC) >>
+ 			  PWM_PERIOD_BIT_WIDTH;
+-	if (clk_div > PWM_CLKDIV_MAX)
++	if (clk_div > PWM_CLKDIV_MAX) {
++		clk_disable_unprepare(mdp->clk_mm);
++		clk_disable_unprepare(mdp->clk_main);
+ 		return -EINVAL;
++	}
+ 
+ 	div = NSEC_PER_SEC * (clk_div + 1);
+ 	period = div64_u64(rate * period_ns, div);
+@@ -98,16 +114,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	high_width = div64_u64(rate * duty_ns, div);
+ 	value = period | (high_width << PWM_HIGH_WIDTH_SHIFT);
+ 
+-	err = clk_enable(mdp->clk_main);
+-	if (err < 0)
+-		return err;
+-
+-	err = clk_enable(mdp->clk_mm);
+-	if (err < 0) {
+-		clk_disable(mdp->clk_main);
+-		return err;
+-	}
+-
+ 	mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+ 				 PWM_CLKDIV_MASK,
+ 				 clk_div << PWM_CLKDIV_SHIFT);
+@@ -122,10 +128,21 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 		mtk_disp_pwm_update_bits(mdp, mdp->data->commit,
+ 					 mdp->data->commit_mask,
+ 					 0x0);
++	} else {
++		/*
++		 * For MT2701, disable double buffer before writing register
++		 * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
++		 */
++		mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
++					 mdp->data->bls_debug_mask,
++					 mdp->data->bls_debug_mask);
++		mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
++					 mdp->data->con0_sel,
++					 mdp->data->con0_sel);
+ 	}
+ 
+-	clk_disable(mdp->clk_mm);
+-	clk_disable(mdp->clk_main);
++	clk_disable_unprepare(mdp->clk_mm);
++	clk_disable_unprepare(mdp->clk_main);
+ 
+ 	return 0;
+ }
+@@ -135,13 +152,16 @@ static int mtk_disp_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+ 	struct mtk_disp_pwm *mdp = to_mtk_disp_pwm(chip);
+ 	int err;
+ 
+-	err = clk_enable(mdp->clk_main);
+-	if (err < 0)
++	err = clk_prepare_enable(mdp->clk_main);
++	if (err < 0) {
++		dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err));
+ 		return err;
++	}
+ 
+-	err = clk_enable(mdp->clk_mm);
++	err = clk_prepare_enable(mdp->clk_mm);
+ 	if (err < 0) {
+-		clk_disable(mdp->clk_main);
++		dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err));
++		clk_disable_unprepare(mdp->clk_main);
+ 		return err;
+ 	}
+ 
+@@ -158,8 +178,8 @@ static void mtk_disp_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ 	mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask,
+ 				 0x0);
+ 
+-	clk_disable(mdp->clk_mm);
+-	clk_disable(mdp->clk_main);
++	clk_disable_unprepare(mdp->clk_mm);
++	clk_disable_unprepare(mdp->clk_main);
+ }
+ 
+ static const struct pwm_ops mtk_disp_pwm_ops = {
+@@ -194,14 +214,6 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+ 	if (IS_ERR(mdp->clk_mm))
+ 		return PTR_ERR(mdp->clk_mm);
+ 
+-	ret = clk_prepare(mdp->clk_main);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = clk_prepare(mdp->clk_mm);
+-	if (ret < 0)
+-		goto disable_clk_main;
+-
+ 	mdp->chip.dev = &pdev->dev;
+ 	mdp->chip.ops = &mtk_disp_pwm_ops;
+ 	mdp->chip.base = -1;
+@@ -209,32 +221,13 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+ 
+ 	ret = pwmchip_add(&mdp->chip);
+ 	if (ret < 0) {
+-		dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret);
+-		goto disable_clk_mm;
++		dev_err(&pdev->dev, "pwmchip_add() failed: %pe\n", ERR_PTR(ret));
++		return ret;
+ 	}
+ 
+ 	platform_set_drvdata(pdev, mdp);
+ 
+-	/*
+-	 * For MT2701, disable double buffer before writing register
+-	 * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
+-	 */
+-	if (!mdp->data->has_commit) {
+-		mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
+-					 mdp->data->bls_debug_mask,
+-					 mdp->data->bls_debug_mask);
+-		mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+-					 mdp->data->con0_sel,
+-					 mdp->data->con0_sel);
+-	}
+-
+ 	return 0;
+-
+-disable_clk_mm:
+-	clk_unprepare(mdp->clk_mm);
+-disable_clk_main:
+-	clk_unprepare(mdp->clk_main);
+-	return ret;
+ }
+ 
+ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+@@ -242,8 +235,6 @@ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+ 	struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev);
+ 
+ 	pwmchip_remove(&mdp->chip);
+-	clk_unprepare(mdp->clk_mm);
+-	clk_unprepare(mdp->clk_main);
+ 
+ 	return 0;
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/pwm-mtk-disp-disable-shadow-registers-before-setting.patch b/queue-5.10/pwm-mtk-disp-disable-shadow-registers-before-setting.patch
new file mode 100644
index 00000000000..4c7f306fd59
--- /dev/null
+++ b/queue-5.10/pwm-mtk-disp-disable-shadow-registers-before-setting.patch
@@ -0,0 +1,74 @@
+From f5c5917fe701a8423cf28be13c41f134fed96bb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 15:30:53 +0200
+Subject: pwm: mtk-disp: Disable shadow registers before setting backlight
+ values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 36dd7f530ae7d9ce9e853ffb8aa337de65c6600b ]
+
+If shadow registers usage is not desired, disable that before performing
+any write to CON0/1 registers in the .apply() callback, otherwise we may
+lose clkdiv or period/width updates.
+
+Fixes: cd4b45ac449a ("pwm: Add MediaTek MT2701 display PWM driver support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Tested-by: Alexandre Mergnat <amergnat@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index a594a0fdddd7b..327c780d433da 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -114,6 +114,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	high_width = div64_u64(rate * duty_ns, div);
+ 	value = period | (high_width << PWM_HIGH_WIDTH_SHIFT);
+ 
++	if (mdp->data->bls_debug && !mdp->data->has_commit) {
++		/*
++		 * For MT2701, disable double buffer before writing register
++		 * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
++		 */
++		mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
++					 mdp->data->bls_debug_mask,
++					 mdp->data->bls_debug_mask);
++		mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
++					 mdp->data->con0_sel,
++					 mdp->data->con0_sel);
++	}
++
+ 	mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+ 				 PWM_CLKDIV_MASK,
+ 				 clk_div << PWM_CLKDIV_SHIFT);
+@@ -128,17 +141,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 		mtk_disp_pwm_update_bits(mdp, mdp->data->commit,
+ 					 mdp->data->commit_mask,
+ 					 0x0);
+-	} else {
+-		/*
+-		 * For MT2701, disable double buffer before writing register
+-		 * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
+-		 */
+-		mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
+-					 mdp->data->bls_debug_mask,
+-					 mdp->data->bls_debug_mask);
+-		mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+-					 mdp->data->con0_sel,
+-					 mdp->data->con0_sel);
+ 	}
+ 
+ 	clk_disable_unprepare(mdp->clk_mm);
+-- 
+2.39.2
+
diff --git a/queue-5.10/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch b/queue-5.10/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch
new file mode 100644
index 00000000000..1c112442be7
--- /dev/null
+++ b/queue-5.10/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch
@@ -0,0 +1,47 @@
+From 9c4ade29612fdab2bc674ff5b3ddda5227af9ace Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 18:28:27 +0200
+Subject: pwm: mtk-disp: Don't check the return code of pwmchip_remove()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 9b7b5736ffd5da6f8f6329ebe5f1829cbcf8afae ]
+
+pwmchip_remove() returns always 0. Don't use the value to make it
+possible to eventually change the function to return void. Also the
+driver core ignores the return value of mtk_disp_pwm_remove().
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index 83b8be0209b74..af63aaab8e153 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -240,13 +240,12 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+ {
+ 	struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev);
+-	int ret;
+ 
+-	ret = pwmchip_remove(&mdp->chip);
++	pwmchip_remove(&mdp->chip);
+ 	clk_unprepare(mdp->clk_mm);
+ 	clk_unprepare(mdp->clk_main);
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ static const struct mtk_pwm_data mt2701_pwm_data = {
+-- 
+2.39.2
+
diff --git a/queue-5.10/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch b/queue-5.10/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch
new file mode 100644
index 00000000000..95b4ba983da
--- /dev/null
+++ b/queue-5.10/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch
@@ -0,0 +1,63 @@
+From c5168c28a38344c5e4e64ccf7c4d3bb43a5aa611 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 22:16:25 +0800
+Subject: rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check
+
+From: Zqiang <qiang1.zhang@intel.com>
+
+[ Upstream commit db7b464df9d820186e98a65aa6a10f0d51fbf8ce ]
+
+This commit adds checks for the TICK_DEP_MASK_RCU_EXP bit, thus enabling
+RCU expedited grace periods to actually force-enable scheduling-clock
+interrupts on holdout CPUs.
+
+Fixes: df1e849ae455 ("rcu: Enable tick for nohz_full CPUs slow to provide expedited QS")
+Signed-off-by: Zqiang <qiang1.zhang@intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Anna-Maria Behnsen <anna-maria@linutronix.de>
+Acked-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/timer.h | 3 ++-
+ kernel/time/tick-sched.c     | 5 +++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
+index 19abb6c3eb73f..40e9b5a12732d 100644
+--- a/include/trace/events/timer.h
++++ b/include/trace/events/timer.h
+@@ -368,7 +368,8 @@ TRACE_EVENT(itimer_expire,
+ 		tick_dep_name(PERF_EVENTS)		\
+ 		tick_dep_name(SCHED)			\
+ 		tick_dep_name(CLOCK_UNSTABLE)		\
+-		tick_dep_name_end(RCU)
++		tick_dep_name(RCU)			\
++		tick_dep_name_end(RCU_EXP)
+ 
+ #undef tick_dep_name
+ #undef tick_dep_mask_name
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index e4e0d032126bc..378096fc8c560 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -213,6 +213,11 @@ static bool check_tick_dependency(atomic_t *dep)
+ 		return true;
+ 	}
+ 
++	if (val & TICK_DEP_MASK_RCU_EXP) {
++		trace_tick_stop(0, TICK_DEP_MASK_RCU_EXP);
++		return true;
++	}
++
+ 	return false;
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch b/queue-5.10/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch
new file mode 100644
index 00000000000..1295147809a
--- /dev/null
+++ b/queue-5.10/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch
@@ -0,0 +1,49 @@
+From 111a840d72502a0228ceab8721bc158d39ef140b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 10:23:51 +0300
+Subject: RDMA/cm: Trace icm_send_rej event before the cm state is reset
+
+From: Mark Zhang <markzhang@nvidia.com>
+
+[ Upstream commit bd9de1badac7e4ff6780365d4aa38983f5e2a436 ]
+
+Trace icm_send_rej event before the cm state is reset to idle, so that
+correct cm state will be logged. For example when an incoming request is
+rejected, the old trace log was:
+    icm_send_rej: local_id=961102742 remote_id=3829151631 state=IDLE reason=REJ_CONSUMER_DEFINED
+With this patch:
+    icm_send_rej: local_id=312971016 remote_id=3778819983 state=MRA_REQ_SENT reason=REJ_CONSUMER_DEFINED
+
+Fixes: 8dc105befe16 ("RDMA/cm: Add tracepoints to track MAD send operations")
+Signed-off-by: Mark Zhang <markzhang@nvidia.com>
+Link: https://lore.kernel.org/r/20230330072351.481200-1-markzhang@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 3133b6be6cab9..db1a25fbe2fa9 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -2924,6 +2924,8 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv,
+ 	    (ari && ari_length > IB_CM_REJ_ARI_LENGTH))
+ 		return -EINVAL;
+ 
++	trace_icm_send_rej(&cm_id_priv->id, reason);
++
+ 	switch (state) {
+ 	case IB_CM_REQ_SENT:
+ 	case IB_CM_MRA_REQ_RCVD:
+@@ -2954,7 +2956,6 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv,
+ 		return -EINVAL;
+ 	}
+ 
+-	trace_icm_send_rej(&cm_id_priv->id, reason);
+ 	ret = ib_post_send_mad(msg, NULL);
+ 	if (ret) {
+ 		cm_free_msg(msg);
+-- 
+2.39.2
+
diff --git a/queue-5.10/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch b/queue-5.10/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch
new file mode 100644
index 00000000000..ce699306346
--- /dev/null
+++ b/queue-5.10/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch
@@ -0,0 +1,46 @@
+From e38ad9444830a3fc28e9117f7bde3843d458a361 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 12:51:27 +0300
+Subject: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb ]
+
+The ucmd->log_sq_bb_count variable is controlled by the user so this
+shift can wrap.  Fix it by using check_shl_overflow() in the same way
+that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined
+behavior in hns_roce_set_user_sq_size()").
+
+Fixes: 839041329fd3 ("IB/mlx4: Sanity check userspace send queue sizes")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/a8dfbd1d-c019-4556-930b-bab1ded73b10@kili.mountain
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx4/qp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index c6a815a705fef..255194029e2d8 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -412,9 +412,13 @@ static int set_user_sq_size(struct mlx4_ib_dev *dev,
+ 			    struct mlx4_ib_qp *qp,
+ 			    struct mlx4_ib_create_qp *ucmd)
+ {
++	u32 cnt;
++
+ 	/* Sanity check SQ size before proceeding */
+-	if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes	 ||
+-	    ucmd->log_sq_stride >
++	if (check_shl_overflow(1, ucmd->log_sq_bb_count, &cnt) ||
++	    cnt > dev->dev->caps.max_wqes)
++		return -EINVAL;
++	if (ucmd->log_sq_stride >
+ 		ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) ||
+ 	    ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE)
+ 		return -EINVAL;
+-- 
+2.39.2
+
diff --git a/queue-5.10/rdma-mlx5-fix-flow-counter-query-via-devx.patch b/queue-5.10/rdma-mlx5-fix-flow-counter-query-via-devx.patch
new file mode 100644
index 00000000000..fc5144e7370
--- /dev/null
+++ b/queue-5.10/rdma-mlx5-fix-flow-counter-query-via-devx.patch
@@ -0,0 +1,93 @@
+From 52332170805aec5c89040318d732eb7ab51ee9af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 12:23:09 +0300
+Subject: RDMA/mlx5: Fix flow counter query via DEVX
+
+From: Mark Bloch <mbloch@nvidia.com>
+
+[ Upstream commit 3e358ea8614ddfbc59ca7a3f5dff5dde2b350b2c ]
+
+Commit cited in "fixes" tag added bulk support for flow counters but it
+didn't account that's also possible to query a counter using a non-base id
+if the counter was allocated as bulk.
+
+When a user performs a query, validate the flow counter id given in the
+mailbox is inside the valid range taking bulk value into account.
+
+Fixes: 208d70f562e5 ("IB/mlx5: Support flow counters offset for bulk counters")
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Link: https://lore.kernel.org/r/79d7fbe291690128e44672418934256254d93115.1681377114.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/devx.c | 31 ++++++++++++++++++++++++++-----
+ include/linux/mlx5/mlx5_ifc.h     |  3 ++-
+ 2 files changed, 28 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index 2f053f48f1beb..a56ebdc15723c 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -595,7 +595,21 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs,
+ 				      obj_id;
+ 
+ 	case MLX5_IB_OBJECT_DEVX_OBJ:
+-		return ((struct devx_obj *)uobj->object)->obj_id == obj_id;
++	{
++		u16 opcode = MLX5_GET(general_obj_in_cmd_hdr, in, opcode);
++		struct devx_obj *devx_uobj = uobj->object;
++
++		if (opcode == MLX5_CMD_OP_QUERY_FLOW_COUNTER &&
++		    devx_uobj->flow_counter_bulk_size) {
++			u64 end;
++
++			end = devx_uobj->obj_id +
++				devx_uobj->flow_counter_bulk_size;
++			return devx_uobj->obj_id <= obj_id && end > obj_id;
++		}
++
++		return devx_uobj->obj_id == obj_id;
++	}
+ 
+ 	default:
+ 		return false;
+@@ -1416,10 +1430,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
+ 		goto obj_free;
+ 
+ 	if (opcode == MLX5_CMD_OP_ALLOC_FLOW_COUNTER) {
+-		u8 bulk = MLX5_GET(alloc_flow_counter_in,
+-				   cmd_in,
+-				   flow_counter_bulk);
+-		obj->flow_counter_bulk_size = 128UL * bulk;
++		u32 bulk = MLX5_GET(alloc_flow_counter_in,
++				    cmd_in,
++				    flow_counter_bulk_log_size);
++
++		if (bulk)
++			bulk = 1 << bulk;
++		else
++			bulk = 128UL * MLX5_GET(alloc_flow_counter_in,
++						cmd_in,
++						flow_counter_bulk);
++		obj->flow_counter_bulk_size = bulk;
+ 	}
+ 
+ 	uobj->object = obj;
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 6ca97729b54a4..88dbb20090805 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -8331,7 +8331,8 @@ struct mlx5_ifc_alloc_flow_counter_in_bits {
+ 	u8         reserved_at_20[0x10];
+ 	u8         op_mod[0x10];
+ 
+-	u8         reserved_at_40[0x38];
++	u8         reserved_at_40[0x33];
++	u8         flow_counter_bulk_log_size[0x5];
+ 	u8         flow_counter_bulk[0x8];
+ };
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch b/queue-5.10/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch
new file mode 100644
index 00000000000..a5f3794b955
--- /dev/null
+++ b/queue-5.10/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch
@@ -0,0 +1,39 @@
+From b463764cf2aa07464b1a51065992d91bfb3ca6f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 04:39:06 +0300
+Subject: RDMA/mlx5: Use correct device num_ports when modify DC
+
+From: Mark Zhang <markzhang@nvidia.com>
+
+[ Upstream commit 746aa3c8cb1a650ff2583497ac646e505831b9b9 ]
+
+Just like other QP types, when modify DC, the port_num should be compared
+with dev->num_ports, instead of HCA_CAP.num_ports.  Otherwise Multi-port
+vHCA on DC may not work.
+
+Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP")
+Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com
+Signed-off-by: Mark Zhang <markzhang@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 0caff276f2c18..0c47e3e24b2a4 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -4164,7 +4164,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ 			return -EINVAL;
+ 
+ 		if (attr->port_num == 0 ||
+-		    attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) {
++		    attr->port_num > dev->num_ports) {
+ 			mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n",
+ 				    attr->port_num, dev->num_ports);
+ 			return -EINVAL;
+-- 
+2.39.2
+
diff --git a/queue-5.10/rdma-rdmavt-delete-unnecessary-null-check.patch b/queue-5.10/rdma-rdmavt-delete-unnecessary-null-check.patch
new file mode 100644
index 00000000000..cfaab22e45b
--- /dev/null
+++ b/queue-5.10/rdma-rdmavt-delete-unnecessary-null-check.patch
@@ -0,0 +1,41 @@
+From ff50129223ad8b60e4c87f92e808e959c758aa87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 15:44:08 +0300
+Subject: RDMA/rdmavt: Delete unnecessary NULL check
+
+From: Natalia Petrova <n.petrova@fintech.ru>
+
+[ Upstream commit b73a0b80c69de77d8d4942abb37066531c0169b2 ]
+
+There is no need to check 'rdi->qp_dev' for NULL. The field 'qp_dev'
+is created in rvt_register_device() which will fail if the 'qp_dev'
+allocation fails in rvt_driver_qp_init(). Overwise this pointer
+doesn't changed and passed to rvt_qp_exit() by the next step.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table")
+Signed-off-by: Natalia Petrova <n.petrova@fintech.ru>
+Link: https://lore.kernel.org/r/20230303124408.16685-1-n.petrova@fintech.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rdmavt/qp.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
+index 585a9c76e5183..ddc8825d526e0 100644
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -505,8 +505,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi)
+ 	if (qps_inuse)
+ 		rvt_pr_err(rdi, "QP memory leak! %u still in use\n",
+ 			   qps_inuse);
+-	if (!rdi->qp_dev)
+-		return;
+ 
+ 	kfree(rdi->qp_dev->qp_table);
+ 	free_qpn_table(&rdi->qp_dev->qpn_table);
+-- 
+2.39.2
+
diff --git a/queue-5.10/rdma-siw-fix-potential-page_array-out-of-range-acces.patch b/queue-5.10/rdma-siw-fix-potential-page_array-out-of-range-acces.patch
new file mode 100644
index 00000000000..bef1971c685
--- /dev/null
+++ b/queue-5.10/rdma-siw-fix-potential-page_array-out-of-range-acces.patch
@@ -0,0 +1,39 @@
+From 2fe09ee39f0a5c6faa8c14aaf858b56b2f318942 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 01:17:51 -0800
+Subject: RDMA/siw: Fix potential page_array out of range access
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 271bfcfb83a9f77cbae3d6e1a16e3c14132922f0 ]
+
+When seg is equal to MAX_ARRAY, the loop should break, otherwise
+it will result in out of range access.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Link: https://lore.kernel.org/r/20230227091751.589612-1-d.dulov@aladdin.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c
+index df8802b4981cf..ccc6d5bb1a276 100644
+--- a/drivers/infiniband/sw/siw/siw_qp_tx.c
++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
+@@ -548,7 +548,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
+ 			data_len -= plen;
+ 			fp_off = 0;
+ 
+-			if (++seg > (int)MAX_ARRAY) {
++			if (++seg >= (int)MAX_ARRAY) {
+ 				siw_dbg_qp(tx_qp(c_tx), "to many fragments\n");
+ 				siw_unmap_pages(page_array, kmap_mask);
+ 				wqe->processed -= c_tx->bytes_unsent;
+-- 
+2.39.2
+
diff --git a/queue-5.10/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch b/queue-5.10/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch
new file mode 100644
index 00000000000..248b9c3ee00
--- /dev/null
+++ b/queue-5.10/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch
@@ -0,0 +1,44 @@
+From f2034a646158da0d6b97b5896202d0a776b33a52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Apr 2023 14:10:13 +0900
+Subject: RDMA/siw: Remove namespace check from siw_netdev_event()
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 266e9b3475ba82212062771fdbc40be0e3c06ec8 ]
+
+syzbot is reporting that siw_netdev_event(NETDEV_UNREGISTER) cannot destroy
+siw_device created after unshare(CLONE_NEWNET) due to net namespace check.
+It seems that this check was by error there and should be removed.
+
+Reported-by: syzbot <syzbot+5e70d01ee8985ae62a3b@syzkaller.appspotmail.com>
+Link: https://syzkaller.appspot.com/bug?extid=5e70d01ee8985ae62a3b
+Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
+Suggested-by: Leon Romanovsky <leon@kernel.org>
+Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface")
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://lore.kernel.org/r/a44e9ac5-44e2-d575-9e30-02483cc7ffd1@I-love.SAKURA.ne.jp
+Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
+index 32a553a1b905e..5ba0893f1f017 100644
+--- a/drivers/infiniband/sw/siw/siw_main.c
++++ b/drivers/infiniband/sw/siw/siw_main.c
+@@ -458,9 +458,6 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event,
+ 
+ 	dev_dbg(&netdev->dev, "siw: event %lu\n", event);
+ 
+-	if (dev_net(netdev) != &init_net)
+-		return NOTIFY_OK;
+-
+ 	base_dev = ib_device_get_by_netdev(netdev, RDMA_DRIVER_SIW);
+ 	if (!base_dev)
+ 		return NOTIFY_OK;
+-- 
+2.39.2
+
diff --git a/queue-5.10/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch b/queue-5.10/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch
new file mode 100644
index 00000000000..860a7344601
--- /dev/null
+++ b/queue-5.10/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch
@@ -0,0 +1,112 @@
+From a22b609d25b6404d60991ab262dfa9730ee90244 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 21:25:49 -0700
+Subject: RDMA/srpt: Add a check for valid 'mad_agent' pointer
+
+From: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+
+[ Upstream commit eca5cd9474cd26d62f9756f536e2e656d3f62f3a ]
+
+When unregistering MAD agent, srpt module has a non-null check
+for 'mad_agent' pointer before invoking ib_unregister_mad_agent().
+This check can pass if 'mad_agent' variable holds an error value.
+The 'mad_agent' can have an error value for a short window when
+srpt_add_one() and srpt_remove_one() is executed simultaneously.
+
+In srpt module, added a valid pointer check for 'sport->mad_agent'
+before unregistering MAD agent.
+
+This issue can hit when RoCE driver unregisters ib_device
+
+Stack Trace:
+------------
+BUG: kernel NULL pointer dereference, address: 000000000000004d
+PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0
+Oops: 0002 [#1] PREEMPT SMP NOPTI
+CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P
+Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020
+Workqueue: bnxt_re bnxt_re_task [bnxt_re]
+RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40
+Call Trace:
+  ib_unregister_mad_agent+0x46/0x2f0 [ib_core]
+  IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
+  ? __schedule+0x20b/0x560
+  srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt]
+  srpt_remove_one+0x20/0x150 [ib_srpt]
+  remove_client_context+0x88/0xd0 [ib_core]
+  bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex
+  disable_device+0x8a/0x160 [ib_core]
+  bond0: active interface up!
+  ? kernfs_name_hash+0x12/0x80
+ (NULL device *): Bonding Info Received: rdev: 000000006c0b8247
+  __ib_unregister_device+0x42/0xb0 [ib_core]
+ (NULL device *):         Master: mode: 4 num_slaves:2
+  ib_unregister_device+0x22/0x30 [ib_core]
+ (NULL device *):         Slave: id: 105069936 name:p2p1 link:0 state:0
+  bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re]
+  bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re]
+
+Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
+Reviewed-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Reviewed-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+Link: https://lore.kernel.org/r/20230406042549.507328-1-saravanan.vajravel@broadcom.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index c0ed08fcab480..983f59c87b79f 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -549,6 +549,7 @@ static int srpt_format_guid(char *buf, unsigned int size, const __be64 *guid)
+  */
+ static int srpt_refresh_port(struct srpt_port *sport)
+ {
++	struct ib_mad_agent *mad_agent;
+ 	struct ib_mad_reg_req reg_req;
+ 	struct ib_port_modify port_modify;
+ 	struct ib_port_attr port_attr;
+@@ -593,24 +594,26 @@ static int srpt_refresh_port(struct srpt_port *sport)
+ 		set_bit(IB_MGMT_METHOD_GET, reg_req.method_mask);
+ 		set_bit(IB_MGMT_METHOD_SET, reg_req.method_mask);
+ 
+-		sport->mad_agent = ib_register_mad_agent(sport->sdev->device,
+-							 sport->port,
+-							 IB_QPT_GSI,
+-							 &reg_req, 0,
+-							 srpt_mad_send_handler,
+-							 srpt_mad_recv_handler,
+-							 sport, 0);
+-		if (IS_ERR(sport->mad_agent)) {
++		mad_agent = ib_register_mad_agent(sport->sdev->device,
++						  sport->port,
++						  IB_QPT_GSI,
++						  &reg_req, 0,
++						  srpt_mad_send_handler,
++						  srpt_mad_recv_handler,
++						  sport, 0);
++		if (IS_ERR(mad_agent)) {
+ 			pr_err("%s-%d: MAD agent registration failed (%ld). Note: this is expected if SR-IOV is enabled.\n",
+ 			       dev_name(&sport->sdev->device->dev), sport->port,
+-			       PTR_ERR(sport->mad_agent));
++			       PTR_ERR(mad_agent));
+ 			sport->mad_agent = NULL;
+ 			memset(&port_modify, 0, sizeof(port_modify));
+ 			port_modify.clr_port_cap_mask = IB_PORT_DEVICE_MGMT_SUP;
+ 			ib_modify_port(sport->sdev->device, sport->port, 0,
+ 				       &port_modify);
+-
++			return 0;
+ 		}
++
++		sport->mad_agent = mad_agent;
+ 	}
+ 
+ 	return 0;
+-- 
+2.39.2
+
diff --git a/queue-5.10/regulator-core-avoid-lockdep-reports-when-resolving-.patch b/queue-5.10/regulator-core-avoid-lockdep-reports-when-resolving-.patch
new file mode 100644
index 00000000000..78f9a0bbaf3
--- /dev/null
+++ b/queue-5.10/regulator-core-avoid-lockdep-reports-when-resolving-.patch
@@ -0,0 +1,266 @@
+From 32225848b53d4be537731618abefbd6cb9b73a9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 14:33:54 -0700
+Subject: regulator: core: Avoid lockdep reports when resolving supplies
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit cba6cfdc7c3f1516f0d08ddfb24e689af0932573 ]
+
+An automated bot told me that there was a potential lockdep problem
+with regulators. This was on the chromeos-5.15 kernel, but I see
+nothing that would be different downstream compared to upstream. The
+bot said:
+  ============================================
+  WARNING: possible recursive locking detected
+  5.15.104-lockdep-17461-gc1e499ed6604 #1 Not tainted
+  --------------------------------------------
+  kworker/u16:4/115 is trying to acquire lock:
+  ffffff8083110170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: create_regulator+0x398/0x7ec
+
+  but task is already holding lock:
+  ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8
+
+  other info that might help us debug this:
+   Possible unsafe locking scenario:
+
+         CPU0
+         ----
+    lock(regulator_ww_class_mutex);
+    lock(regulator_ww_class_mutex);
+
+   *** DEADLOCK ***
+
+   May be due to missing lock nesting notation
+
+  4 locks held by kworker/u16:4/115:
+   #0: ffffff808006a948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x520/0x1348
+   #1: ffffffc00e0a7cc0 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x55c/0x1348
+   #2: ffffff80828a2260 (&dev->mutex){....}-{3:3}, at: __device_attach_async_helper+0xd0/0x2a4
+   #3: ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8
+
+  stack backtrace:
+  CPU: 2 PID: 115 Comm: kworker/u16:4 Not tainted 5.15.104-lockdep-17461-gc1e499ed6604 #1 9292e52fa83c0e23762b2b3aa1bacf5787a4d5da
+  Hardware name: Google Quackingstick (rev0+) (DT)
+  Workqueue: events_unbound async_run_entry_fn
+  Call trace:
+   dump_backtrace+0x0/0x4ec
+   show_stack+0x34/0x50
+   dump_stack_lvl+0xdc/0x11c
+   dump_stack+0x1c/0x48
+   __lock_acquire+0x16d4/0x6c74
+   lock_acquire+0x208/0x750
+   __mutex_lock_common+0x11c/0x11f8
+   ww_mutex_lock+0xc0/0x440
+   create_regulator+0x398/0x7ec
+   regulator_resolve_supply+0x654/0x7c4
+   regulator_register_resolve_supply+0x30/0x120
+   class_for_each_device+0x1b8/0x230
+   regulator_register+0x17a4/0x1f40
+   devm_regulator_register+0x60/0xd0
+   reg_fixed_voltage_probe+0x728/0xaec
+   platform_probe+0x150/0x1c8
+   really_probe+0x274/0xa20
+   __driver_probe_device+0x1dc/0x3f4
+   driver_probe_device+0x78/0x1c0
+   __device_attach_driver+0x1ac/0x2c8
+   bus_for_each_drv+0x11c/0x190
+   __device_attach_async_helper+0x1e4/0x2a4
+   async_run_entry_fn+0xa0/0x3ac
+   process_one_work+0x638/0x1348
+   worker_thread+0x4a8/0x9c4
+   kthread+0x2e4/0x3a0
+   ret_from_fork+0x10/0x20
+
+The problem was first reported soon after we made many of the
+regulators probe asynchronously, though nothing I've seen implies that
+the problems couldn't have also happened even without that.
+
+I haven't personally been able to reproduce the lockdep issue, but the
+issue does look somewhat legitimate. Specifically, it looks like in
+regulator_resolve_supply() we are holding a "rdev" lock while calling
+set_supply() -> create_regulator() which grabs the lock of a
+_different_ "rdev" (the one for our supply). This is not necessarily
+safe from a lockdep perspective since there is no documented ordering
+between these two locks.
+
+In reality, we should always be locking a regulator before the
+supplying regulator, so I don't expect there to be any real deadlocks
+in practice. However, the regulator framework in general doesn't
+express this to lockdep.
+
+Let's fix the issue by simply grabbing the two locks involved in the
+same way we grab multiple locks elsewhere in the regulator framework:
+using the "wound/wait" mechanisms.
+
+Fixes: eaa7995c529b ("regulator: core: avoid regulator_resolve_supply() race condition")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230329143317.RFC.v2.2.I30d8e1ca10cfbe5403884cdd192253a2e063eb9e@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 91 ++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 83 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index bd2a3f44dd6ea..47a04c5f7a9b8 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -216,6 +216,78 @@ static void regulator_unlock(struct regulator_dev *rdev)
+ 	mutex_unlock(&regulator_nesting_mutex);
+ }
+ 
++/**
++ * regulator_lock_two - lock two regulators
++ * @rdev1:		first regulator
++ * @rdev2:		second regulator
++ * @ww_ctx:		w/w mutex acquire context
++ *
++ * Locks both rdevs using the regulator_ww_class.
++ */
++static void regulator_lock_two(struct regulator_dev *rdev1,
++			       struct regulator_dev *rdev2,
++			       struct ww_acquire_ctx *ww_ctx)
++{
++	struct regulator_dev *tmp;
++	int ret;
++
++	ww_acquire_init(ww_ctx, &regulator_ww_class);
++
++	/* Try to just grab both of them */
++	ret = regulator_lock_nested(rdev1, ww_ctx);
++	WARN_ON(ret);
++	ret = regulator_lock_nested(rdev2, ww_ctx);
++	if (ret != -EDEADLOCK) {
++		WARN_ON(ret);
++		goto exit;
++	}
++
++	while (true) {
++		/*
++		 * Start of loop: rdev1 was locked and rdev2 was contended.
++		 * Need to unlock rdev1, slowly lock rdev2, then try rdev1
++		 * again.
++		 */
++		regulator_unlock(rdev1);
++
++		ww_mutex_lock_slow(&rdev2->mutex, ww_ctx);
++		rdev2->ref_cnt++;
++		rdev2->mutex_owner = current;
++		ret = regulator_lock_nested(rdev1, ww_ctx);
++
++		if (ret == -EDEADLOCK) {
++			/* More contention; swap which needs to be slow */
++			tmp = rdev1;
++			rdev1 = rdev2;
++			rdev2 = tmp;
++		} else {
++			WARN_ON(ret);
++			break;
++		}
++	}
++
++exit:
++	ww_acquire_done(ww_ctx);
++}
++
++/**
++ * regulator_unlock_two - unlock two regulators
++ * @rdev1:		first regulator
++ * @rdev2:		second regulator
++ * @ww_ctx:		w/w mutex acquire context
++ *
++ * The inverse of regulator_lock_two().
++ */
++
++static void regulator_unlock_two(struct regulator_dev *rdev1,
++				 struct regulator_dev *rdev2,
++				 struct ww_acquire_ctx *ww_ctx)
++{
++	regulator_unlock(rdev2);
++	regulator_unlock(rdev1);
++	ww_acquire_fini(ww_ctx);
++}
++
+ static bool regulator_supply_is_couple(struct regulator_dev *rdev)
+ {
+ 	struct regulator_dev *c_rdev;
+@@ -1460,8 +1532,8 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+ 
+ /**
+  * set_supply - set regulator supply regulator
+- * @rdev: regulator name
+- * @supply_rdev: supply regulator name
++ * @rdev: regulator (locked)
++ * @supply_rdev: supply regulator (locked))
+  *
+  * Called by platform initialisation code to set the supply regulator for this
+  * regulator. This ensures that a regulators supply will also be enabled by the
+@@ -1633,6 +1705,8 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ 	struct regulator *regulator;
+ 	int err = 0;
+ 
++	lockdep_assert_held_once(&rdev->mutex.base);
++
+ 	if (dev) {
+ 		char buf[REG_STR_SIZE];
+ 		int size;
+@@ -1660,9 +1734,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ 	regulator->rdev = rdev;
+ 	regulator->supply_name = supply_name;
+ 
+-	regulator_lock(rdev);
+ 	list_add(&regulator->list, &rdev->consumer_list);
+-	regulator_unlock(rdev);
+ 
+ 	if (dev) {
+ 		regulator->dev = dev;
+@@ -1828,6 +1900,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ {
+ 	struct regulator_dev *r;
+ 	struct device *dev = rdev->dev.parent;
++	struct ww_acquire_ctx ww_ctx;
+ 	int ret = 0;
+ 
+ 	/* No supply to resolve? */
+@@ -1894,23 +1967,23 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ 	 * between rdev->supply null check and setting rdev->supply in
+ 	 * set_supply() from concurrent tasks.
+ 	 */
+-	regulator_lock(rdev);
++	regulator_lock_two(rdev, r, &ww_ctx);
+ 
+ 	/* Supply just resolved by a concurrent task? */
+ 	if (rdev->supply) {
+-		regulator_unlock(rdev);
++		regulator_unlock_two(rdev, r, &ww_ctx);
+ 		put_device(&r->dev);
+ 		goto out;
+ 	}
+ 
+ 	ret = set_supply(rdev, r);
+ 	if (ret < 0) {
+-		regulator_unlock(rdev);
++		regulator_unlock_two(rdev, r, &ww_ctx);
+ 		put_device(&r->dev);
+ 		goto out;
+ 	}
+ 
+-	regulator_unlock(rdev);
++	regulator_unlock_two(rdev, r, &ww_ctx);
+ 
+ 	/*
+ 	 * In set_machine_constraints() we may have turned this regulator on
+@@ -2023,7 +2096,9 @@ struct regulator *_regulator_get(struct device *dev, const char *id,
+ 		return regulator;
+ 	}
+ 
++	regulator_lock(rdev);
+ 	regulator = create_regulator(rdev, dev, id);
++	regulator_unlock(rdev);
+ 	if (regulator == NULL) {
+ 		regulator = ERR_PTR(-ENOMEM);
+ 		module_put(rdev->owner);
+-- 
+2.39.2
+
diff --git a/queue-5.10/regulator-core-consistently-set-mutex_owner-when-usi.patch b/queue-5.10/regulator-core-consistently-set-mutex_owner-when-usi.patch
new file mode 100644
index 00000000000..9b33c1a0fb7
--- /dev/null
+++ b/queue-5.10/regulator-core-consistently-set-mutex_owner-when-usi.patch
@@ -0,0 +1,54 @@
+From 9a0f544c5aef0b284157875080f75ed70d812969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 14:33:53 -0700
+Subject: regulator: core: Consistently set mutex_owner when using
+ ww_mutex_lock_slow()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit b83a1772be854f87602de14726737d3e5b06e1f4 ]
+
+When a codepath locks a rdev using ww_mutex_lock_slow() directly then
+that codepath is responsible for incrementing the "ref_cnt" and also
+setting the "mutex_owner" to "current".
+
+The regulator core consistently got that right for "ref_cnt" but
+didn't always get it right for "mutex_owner". Let's fix this.
+
+It's unlikely that this truly matters because the "mutex_owner" is
+only needed if we're going to do subsequent locking of the same
+rdev. However, even though it's not truly needed it seems less
+surprising if we consistently set "mutex_owner" properly.
+
+Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230329143317.RFC.v2.1.I4e9d433ea26360c06dd1381d091c82bb1a4ce843@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 6dd698b2d0af3..bd2a3f44dd6ea 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -343,6 +343,7 @@ static void regulator_lock_dependent(struct regulator_dev *rdev,
+ 			ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx);
+ 			old_contended_rdev = new_contended_rdev;
+ 			old_contended_rdev->ref_cnt++;
++			old_contended_rdev->mutex_owner = current;
+ 		}
+ 
+ 		err = regulator_lock_recursive(rdev,
+@@ -5800,6 +5801,7 @@ static void regulator_summary_lock(struct ww_acquire_ctx *ww_ctx)
+ 			ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx);
+ 			old_contended_rdev = new_contended_rdev;
+ 			old_contended_rdev->ref_cnt++;
++			old_contended_rdev->mutex_owner = current;
+ 		}
+ 
+ 		err = regulator_summary_lock_all(ww_ctx,
+-- 
+2.39.2
+
diff --git a/queue-5.10/regulator-stm32-pwr-fix-of_iomap-leak.patch b/queue-5.10/regulator-stm32-pwr-fix-of_iomap-leak.patch
new file mode 100644
index 00000000000..51db8df4d37
--- /dev/null
+++ b/queue-5.10/regulator-stm32-pwr-fix-of_iomap-leak.patch
@@ -0,0 +1,69 @@
+From 67f798a97f4b2565ffe0f338c8b19de3aa8b769d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 11:35:29 +0800
+Subject: regulator: stm32-pwr: fix of_iomap leak
+
+From: YAN SHI <m202071378@hust.edu.cn>
+
+[ Upstream commit c4a413e56d16a2ae84e6d8992f215c4dcc7fac20 ]
+
+Smatch reports:
+drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn:
+'base' from of_iomap() not released on lines: 151,166.
+
+In stm32_pwr_regulator_probe(), base is not released
+when devm_kzalloc() fails to allocate memory or
+devm_regulator_register() fails to register a new regulator device,
+which may cause a leak.
+
+To fix this issue, replace of_iomap() with
+devm_platform_ioremap_resource(). devm_platform_ioremap_resource()
+is a specialized function for platform devices.
+It allows 'base' to be automatically released whether the probe
+function succeeds or fails.
+
+Besides, use IS_ERR(base) instead of !base
+as the return value of devm_platform_ioremap_resource()
+can either be a pointer to the remapped memory or
+an ERR_PTR() encoded error code if the operation fails.
+
+Fixes: dc62f951a6a8 ("regulator: stm32-pwr: Fix return value check in stm32_pwr_regulator_probe()")
+Signed-off-by: YAN SHI <m202071378@hust.edu.cn>
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/oe-kbuild-all/202304111750.o2643eJN-lkp@intel.com/
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230412033529.18890-1-m202071378@hust.edu.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/stm32-pwr.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/stm32-pwr.c b/drivers/regulator/stm32-pwr.c
+index 2a42acb7c24e9..e5dd4db6403b2 100644
+--- a/drivers/regulator/stm32-pwr.c
++++ b/drivers/regulator/stm32-pwr.c
+@@ -129,17 +129,16 @@ static const struct regulator_desc stm32_pwr_desc[] = {
+ 
+ static int stm32_pwr_regulator_probe(struct platform_device *pdev)
+ {
+-	struct device_node *np = pdev->dev.of_node;
+ 	struct stm32_pwr_reg *priv;
+ 	void __iomem *base;
+ 	struct regulator_dev *rdev;
+ 	struct regulator_config config = { };
+ 	int i, ret = 0;
+ 
+-	base = of_iomap(np, 0);
+-	if (!base) {
++	base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(base)) {
+ 		dev_err(&pdev->dev, "Unable to map IO memory\n");
+-		return -ENOMEM;
++		return PTR_ERR(base);
+ 	}
+ 
+ 	config.dev = &pdev->dev;
+-- 
+2.39.2
+
diff --git a/queue-5.10/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch b/queue-5.10/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch
new file mode 100644
index 00000000000..3dbd3f55339
--- /dev/null
+++ b/queue-5.10/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch
@@ -0,0 +1,39 @@
+From 2aa6b9227db591fc222ee6d7f52eaef2b220ca1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 18:30:06 +0800
+Subject: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove
+ due to unfinished work"
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit db2bf510bd5d57f064d9e1db395ed86a08320c54 ]
+
+This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f.
+
+This patch introduces a possible null-ptr-def problem. Revert it. And the
+fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth:
+btsdio: fix use after free bug in btsdio_remove due to race condition").
+
+Fixes: 1e9ac114c442 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btsdio.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
+index 7050a16e7efeb..199e8f7d426d9 100644
+--- a/drivers/bluetooth/btsdio.c
++++ b/drivers/bluetooth/btsdio.c
+@@ -352,7 +352,6 @@ static void btsdio_remove(struct sdio_func *func)
+ 
+ 	BT_DBG("func %p", func);
+ 
+-	cancel_work_sync(&data->work);
+ 	if (!data)
+ 		return;
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch b/queue-5.10/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch
new file mode 100644
index 00000000000..5f015b5760b
--- /dev/null
+++ b/queue-5.10/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch
@@ -0,0 +1,60 @@
+From 2bb3b259f3bd799a090fc6dc2c9c9d9b42c46033 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 22:21:42 +0100
+Subject: rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 0e6255fa3f649170da6bd1a544680589cfae1131 ]
+
+The VRTC alarm register can be programmed with an amount of seconds
+after which the SoC will be woken up by the VRTC timer again. We are
+already converting the alarm time from meson_vrtc_set_alarm() to
+"seconds since 1970". This means we also need to use "seconds since
+1970" for the current time.
+
+This fixes a problem where setting the alarm to one minute in the future
+results in the firmware (which handles wakeup) to output (on the serial
+console) that the system will be woken up in billions of seconds.
+ktime_get_raw_ts64() returns the time since boot, not since 1970. Switch
+to ktime_get_real_ts64() to fix the calculation of the alarm time and to
+make the SoC wake up at the specified date/time. Also the firmware
+(which manages suspend) now prints either 59 or 60 seconds until wakeup
+(depending on how long it takes for the system to enter suspend).
+
+Fixes: 6ef35398e827 ("rtc: Add Amlogic Virtual Wake RTC")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20230320212142.2355062-1-martin.blumenstingl@googlemail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-meson-vrtc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-meson-vrtc.c b/drivers/rtc/rtc-meson-vrtc.c
+index e6bd0808a092b..18ff8439b5bb5 100644
+--- a/drivers/rtc/rtc-meson-vrtc.c
++++ b/drivers/rtc/rtc-meson-vrtc.c
+@@ -23,7 +23,7 @@ static int meson_vrtc_read_time(struct device *dev, struct rtc_time *tm)
+ 	struct timespec64 time;
+ 
+ 	dev_dbg(dev, "%s\n", __func__);
+-	ktime_get_raw_ts64(&time);
++	ktime_get_real_ts64(&time);
+ 	rtc_time64_to_tm(time.tv_sec, tm);
+ 
+ 	return 0;
+@@ -96,7 +96,7 @@ static int __maybe_unused meson_vrtc_suspend(struct device *dev)
+ 		long alarm_secs;
+ 		struct timespec64 time;
+ 
+-		ktime_get_raw_ts64(&time);
++		ktime_get_real_ts64(&time);
+ 		local_time = time.tv_sec;
+ 
+ 		dev_dbg(dev, "alarm_time = %lus, local_time=%lus\n",
+-- 
+2.39.2
+
diff --git a/queue-5.10/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch b/queue-5.10/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch
new file mode 100644
index 00000000000..7e2ad36298a
--- /dev/null
+++ b/queue-5.10/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch
@@ -0,0 +1,40 @@
+From a6ec8ac534bff25f262937b391c7ab43281809e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Mar 2023 10:40:21 +0100
+Subject: rtc: omap: include header for omap_rtc_power_off_program prototype
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit f69c2b5420497b7a54181ce170d682cbeb1f119f ]
+
+Non-static functions should have a prototype:
+
+  drivers/rtc/rtc-omap.c:410:5: error: no previous prototype for ‘omap_rtc_power_off_program’ [-Werror=missing-prototypes]
+
+Fixes: 6256f7f7f217 ("rtc: OMAP: Add support for rtc-only mode")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230311094021.79730-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-omap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
+index c20fc7937dfa8..18ae2a4f26eab 100644
+--- a/drivers/rtc/rtc-omap.c
++++ b/drivers/rtc/rtc-omap.c
+@@ -25,6 +25,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/rtc.h>
++#include <linux/rtc/rtc-omap.h>
+ 
+ /*
+  * The OMAP RTC is a year/month/day/hours/minutes/seconds BCD clock
+-- 
+2.39.2
+
diff --git a/queue-5.10/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch b/queue-5.10/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch
new file mode 100644
index 00000000000..818543e61b4
--- /dev/null
+++ b/queue-5.10/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch
@@ -0,0 +1,77 @@
+From 59679f6366e72a5cb2999ff91dba74990240f10d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 12:32:11 +0100
+Subject: scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
+
+From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+
+[ Upstream commit a02d83f9947d8f71904eda4de046630c3eb6802c ]
+
+Currently, kernel would set MSG_CTRUNC flag if msg_control buffer
+wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS.
+
+For some reason we have no corresponding check for SO_PASSSEC.
+
+In the recvmsg(2) doc we have:
+       MSG_CTRUNC
+              indicates that some control data was discarded due to lack
+              of space in the buffer for ancillary data.
+
+So, we need to set MSG_CTRUNC flag for all types of SCM.
+
+This change can break applications those don't check MSG_CTRUNC flag.
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Leon Romanovsky <leon@kernel.org>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+
+v2:
+- commit message was rewritten according to Eric's suggestion
+Acked-by: Paul Moore <paul@paul-moore.com>
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/scm.h | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 1ce365f4c2560..585adc1346bd0 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
+ 		}
+ 	}
+ }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++	return test_bit(SOCK_PASSSEC, &sock->flags);
++}
+ #else
+ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
+ { }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++	return false;
++}
+ #endif /* CONFIG_SECURITY_NETWORK */
+ 
+ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
+ 				struct scm_cookie *scm, int flags)
+ {
+ 	if (!msg->msg_control) {
+-		if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
++		if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp ||
++		    scm_has_secdata(sock))
+ 			msg->msg_flags |= MSG_CTRUNC;
+ 		scm_destroy(scm);
+ 		return;
+-- 
+2.39.2
+
diff --git a/queue-5.10/scripts-gdb-bail-early-if-there-are-no-clocks.patch b/queue-5.10/scripts-gdb-bail-early-if-there-are-no-clocks.patch
new file mode 100644
index 00000000000..d537402f83e
--- /dev/null
+++ b/queue-5.10/scripts-gdb-bail-early-if-there-are-no-clocks.patch
@@ -0,0 +1,48 @@
+From 3e4771ea3269f6770fab3c9844996bf25abe81c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 15:52:45 -0700
+Subject: scripts/gdb: bail early if there are no clocks
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 1d7adbc74c009057ed9dc3112f388e91a9c79acc ]
+
+Avoid generating an exception if there are no clocks registered:
+
+(gdb) lx-clk-summary
+                                 enable  prepare  protect
+   clock                          count    count    count        rate
+------------------------------------------------------------------------
+Python Exception <class 'gdb.error'>: No symbol "clk_root_list" in
+current context.
+Error occurred in Python: No symbol "clk_root_list" in current context.
+
+Link: https://lkml.kernel.org/r/20230323225246.3302977-1-f.fainelli@gmail.com
+Fixes: d1e9710b63d8 ("scripts/gdb: initial clk support: lx-clk-summary")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Leonard Crestez <leonard.crestez@nxp.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/clk.py | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/scripts/gdb/linux/clk.py b/scripts/gdb/linux/clk.py
+index 061aecfa294e6..7a01fdc3e8446 100644
+--- a/scripts/gdb/linux/clk.py
++++ b/scripts/gdb/linux/clk.py
+@@ -41,6 +41,8 @@ are cached and potentially out of date"""
+             self.show_subtree(child, level + 1)
+ 
+     def invoke(self, arg, from_tty):
++        if utils.gdb_eval_or_none("clk_root_list") is None:
++            raise gdb.GdbError("No clocks registered")
+         gdb.write("                                 enable  prepare  protect               \n")
+         gdb.write("   clock                          count    count    count        rate   \n")
+         gdb.write("------------------------------------------------------------------------\n")
+-- 
+2.39.2
+
diff --git a/queue-5.10/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch b/queue-5.10/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch
new file mode 100644
index 00000000000..9eb5fac5a28
--- /dev/null
+++ b/queue-5.10/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch
@@ -0,0 +1,60 @@
+From 5d22b70f18d74c7cae51e8f34d723ba4a13b73a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 16:16:57 -0700
+Subject: scripts/gdb: bail early if there are no generic PD
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit f19c3c2959e465209ade1a7a699e6cbf4359ce78 ]
+
+Avoid generating an exception if there are no generic power domain(s)
+registered:
+
+(gdb) lx-genpd-summary
+domain                          status          children
+    /device                                             runtime status
+----------------------------------------------------------------------
+Python Exception <class 'gdb.error'>: No symbol "gpd_list" in current context.
+Error occurred in Python: No symbol "gpd_list" in current context.
+(gdb) quit
+
+[f.fainelli@gmail.com: correctly invoke gdb_eval_or_none]
+  Link: https://lkml.kernel.org/r/20230327185746.3856407-1-f.fainelli@gmail.com
+Link: https://lkml.kernel.org/r/20230323231659.3319941-1-f.fainelli@gmail.com
+Fixes: 8207d4a88e1e ("scripts/gdb: add lx-genpd-summary command")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Leonard Crestez <leonard.crestez@nxp.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/genpd.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/genpd.py b/scripts/gdb/linux/genpd.py
+index 39cd1abd85590..b53649c0a77a6 100644
+--- a/scripts/gdb/linux/genpd.py
++++ b/scripts/gdb/linux/genpd.py
+@@ -5,7 +5,7 @@
+ import gdb
+ import sys
+ 
+-from linux.utils import CachedType
++from linux.utils import CachedType, gdb_eval_or_none
+ from linux.lists import list_for_each_entry
+ 
+ generic_pm_domain_type = CachedType('struct generic_pm_domain')
+@@ -70,6 +70,8 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary'''
+             gdb.write('    %-50s  %s\n' % (kobj_path, rtpm_status_str(dev)))
+ 
+     def invoke(self, arg, from_tty):
++        if gdb_eval_or_none("&gpd_list") is None:
++            raise gdb.GdbError("No power domain(s) registered")
+         gdb.write('domain                          status          children\n');
+         gdb.write('    /device                                             runtime status\n');
+         gdb.write('----------------------------------------------------------------------\n');
+-- 
+2.39.2
+
diff --git a/queue-5.10/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch b/queue-5.10/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch
new file mode 100644
index 00000000000..4287d1ace30
--- /dev/null
+++ b/queue-5.10/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch
@@ -0,0 +1,70 @@
+From 764a6f9ac0f0c75345da170f502422f565551c4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 15:21:32 +0800
+Subject: scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
+
+From: Shuchang Li <lishuchang@hust.edu.cn>
+
+[ Upstream commit 91a0c0c1413239d0548b5aac4c82f38f6d53a91e ]
+
+When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4)
+returns false, drbl_regs_memmap_p is not remapped. This passes a NULL
+pointer to iounmap(), which can trigger a WARN() on certain arches.
+
+When if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4)
+returns true, drbl_regs_memmap_p may has been remapped and
+ctrl_regs_memmap_p is not remapped. This is a resource leak and passes a
+NULL pointer to iounmap().
+
+To fix these issues, we need to add null checks before iounmap(), and
+change some goto labels.
+
+Fixes: 1351e69fc6db ("scsi: lpfc: Add push-to-adapter support to sli4")
+Signed-off-by: Shuchang Li <lishuchang@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230404072133.1022-1-lishuchang@hust.edu.cn
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_init.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 17200b453cbbb..1bb3c96a04bd6 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -10477,7 +10477,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
+ 				goto out_iounmap_all;
+ 		} else {
+ 			error = -ENOMEM;
+-			goto out_iounmap_all;
++			goto out_iounmap_ctrl;
+ 		}
+ 	}
+ 
+@@ -10495,7 +10495,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
+ 			dev_err(&pdev->dev,
+ 			   "ioremap failed for SLI4 HBA dpp registers.\n");
+ 			error = -ENOMEM;
+-			goto out_iounmap_ctrl;
++			goto out_iounmap_all;
+ 		}
+ 		phba->pci_bar4_memmap_p = phba->sli4_hba.dpp_regs_memmap_p;
+ 	}
+@@ -10520,9 +10520,11 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
+ 	return 0;
+ 
+ out_iounmap_all:
+-	iounmap(phba->sli4_hba.drbl_regs_memmap_p);
++	if (phba->sli4_hba.drbl_regs_memmap_p)
++		iounmap(phba->sli4_hba.drbl_regs_memmap_p);
+ out_iounmap_ctrl:
+-	iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
++	if (phba->sli4_hba.ctrl_regs_memmap_p)
++		iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
+ out_iounmap_conf:
+ 	iounmap(phba->sli4_hba.conf_regs_memmap_p);
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch b/queue-5.10/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch
new file mode 100644
index 00000000000..4a167329b10
--- /dev/null
+++ b/queue-5.10/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch
@@ -0,0 +1,38 @@
+From 4d8fc9ab54342e74457b0011deb817c86ac172ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 17:51:09 +0000
+Subject: scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
+
+From: Danila Chernetsov <listdansp@mail.ru>
+
+[ Upstream commit 75cb113cd43f06aaf4f1bda0069cfd5b98e909eb ]
+
+When cmdid == CMDID_INT_CMDS, the 'cmds' pointer is NULL but is
+dereferenced below.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 0f2bb84d2a68 ("[SCSI] megaraid: simplify internal command handling")
+Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
+Link: https://lore.kernel.org/r/20230317175109.18585-1-listdansp@mail.ru
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index daffa36988aee..810d803406761 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -1443,6 +1443,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status)
+ 		 */
+ 		if (cmdid == CMDID_INT_CMDS) {
+ 			scb = &adapter->int_scb;
++			cmd = scb->cmd;
+ 
+ 			list_del_init(&scb->list);
+ 			scb->state = SCB_FREE;
+-- 
+2.39.2
+
diff --git a/queue-5.10/scsi-target-fix-multiple-lun_reset-handling.patch b/queue-5.10/scsi-target-fix-multiple-lun_reset-handling.patch
new file mode 100644
index 00000000000..008adb4ab7e
--- /dev/null
+++ b/queue-5.10/scsi-target-fix-multiple-lun_reset-handling.patch
@@ -0,0 +1,142 @@
+From 99d46eb36979b3f79b1d9b7427b3aeabe6c7eea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:18 -0500
+Subject: scsi: target: Fix multiple LUN_RESET handling
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 673db054d7a2b5a470d7a25baf65956d005ad729 ]
+
+This fixes a bug where an initiator thinks a LUN_RESET has cleaned up
+running commands when it hasn't. The bug was added in commit 51ec502a3266
+("target: Delete tmr from list before processing").
+
+The problem occurs when:
+
+ 1. We have N I/O cmds running in the target layer spread over 2 sessions.
+
+ 2. The initiator sends a LUN_RESET for each session.
+
+ 3. session1's LUN_RESET loops over all the running commands from both
+    sessions and moves them to its local drain_task_list.
+
+ 4. session2's LUN_RESET does not see the LUN_RESET from session1 because
+    the commit above has it remove itself. session2 also does not see any
+    commands since the other reset moved them off the state lists.
+
+ 5. sessions2's LUN_RESET will then complete with a successful response.
+
+ 6. sessions2's inititor believes the running commands on its session are
+    now cleaned up due to the successful response and cleans up the running
+    commands from its side. It then restarts them.
+
+ 7. The commands do eventually complete on the backend and the target
+    starts to return aborted task statuses for them. The initiator will
+    either throw a invalid ITT error or might accidentally lookup a new
+    task if the ITT has been reallocated already.
+
+Fix the bug by reverting the patch, and serialize the execution of
+LUN_RESETs and Preempt and Aborts.
+
+Also prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list,
+because it turns out the original patch fixed a bug that was not
+mentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second
+LUN_RESET and wait on it. Then the second reset will run
+core_tmr_drain_tmr_list and see the first reset and wait on it resulting in
+a deadlock.
+
+Fixes: 51ec502a3266 ("target: Delete tmr from list before processing")
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-8-michael.christie@oracle.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_device.c |  1 +
+ drivers/target/target_core_tmr.c    | 26 +++++++++++++++++++++++---
+ include/target/target_core_base.h   |  1 +
+ 3 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index bd3f1192c75a1..4664330fb55dd 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -770,6 +770,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
+ 	spin_lock_init(&dev->t10_alua.lba_map_lock);
+ 
+ 	INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work);
++	mutex_init(&dev->lun_reset_mutex);
+ 
+ 	dev->t10_wwn.t10_dev = dev;
+ 	dev->t10_alua.t10_dev = dev;
+diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
+index 5da384bb88c82..a2b18a98d6718 100644
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -202,14 +202,23 @@ static void core_tmr_drain_tmr_list(
+ 	 * LUN_RESET tmr..
+ 	 */
+ 	spin_lock_irqsave(&dev->se_tmr_lock, flags);
+-	if (tmr)
+-		list_del_init(&tmr->tmr_list);
+ 	list_for_each_entry_safe(tmr_p, tmr_pp, &dev->dev_tmr_list, tmr_list) {
++		if (tmr_p == tmr)
++			continue;
++
+ 		cmd = tmr_p->task_cmd;
+ 		if (!cmd) {
+ 			pr_err("Unable to locate struct se_cmd for TMR\n");
+ 			continue;
+ 		}
++
++		/*
++		 * We only execute one LUN_RESET at a time so we can't wait
++		 * on them below.
++		 */
++		if (tmr_p->function == TMR_LUN_RESET)
++			continue;
++
+ 		/*
+ 		 * If this function was called with a valid pr_res_key
+ 		 * parameter (eg: for PROUT PREEMPT_AND_ABORT service action
+@@ -390,14 +399,25 @@ int core_tmr_lun_reset(
+ 				tmr_nacl->initiatorname);
+ 		}
+ 	}
++
++
++	/*
++	 * We only allow one reset or preempt and abort to execute at a time
++	 * to prevent one call from claiming all the cmds causing a second
++	 * call from returning while cmds it should have waited on are still
++	 * running.
++	 */
++	mutex_lock(&dev->lun_reset_mutex);
++
+ 	pr_debug("LUN_RESET: %s starting for [%s], tas: %d\n",
+ 		(preempt_and_abort_list) ? "Preempt" : "TMR",
+ 		dev->transport->name, tas);
+-
+ 	core_tmr_drain_tmr_list(dev, tmr, preempt_and_abort_list);
+ 	core_tmr_drain_state_list(dev, prout_cmd, tmr_sess, tas,
+ 				preempt_and_abort_list);
+ 
++	mutex_unlock(&dev->lun_reset_mutex);
++
+ 	/*
+ 	 * Clear any legacy SPC-2 reservation when called during
+ 	 * LOGICAL UNIT RESET
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 0109adcdfa0b4..e681c712fcca2 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -850,6 +850,7 @@ struct se_device {
+ 	struct rcu_head		rcu_head;
+ 	int			queue_cnt;
+ 	struct se_device_queue	*queues;
++	struct mutex		lun_reset_mutex;
+ };
+ 
+ struct se_hba {
+-- 
+2.39.2
+
diff --git a/queue-5.10/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch b/queue-5.10/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch
new file mode 100644
index 00000000000..3bfceb584b9
--- /dev/null
+++ b/queue-5.10/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch
@@ -0,0 +1,67 @@
+From 399998f383577f9795fec1f36260373972fb5d1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:19 -0500
+Subject: scsi: target: iscsit: Fix TAS handling during conn cleanup
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit cc79da306ebb2edb700c3816b90219223182ac3c ]
+
+Fix a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort
+fabric stop race").
+
+If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the
+last put on the cmd and free it, because the connection is down and we will
+not up sending the response and doing the put from the normal I/O
+path.
+
+Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now
+detect this case and run iscsit_free_cmd().
+
+Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race")
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index a237f1cf9bd60..6bb8403580729 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4084,9 +4084,12 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ 	list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ 		struct se_cmd *se_cmd = &cmd->se_cmd;
+ 
+-		if (se_cmd->se_tfo != NULL) {
+-			spin_lock_irq(&se_cmd->t_state_lock);
+-			if (se_cmd->transport_state & CMD_T_ABORTED) {
++		if (!se_cmd->se_tfo)
++			continue;
++
++		spin_lock_irq(&se_cmd->t_state_lock);
++		if (se_cmd->transport_state & CMD_T_ABORTED) {
++			if (!(se_cmd->transport_state & CMD_T_TAS))
+ 				/*
+ 				 * LIO's abort path owns the cleanup for this,
+ 				 * so put it back on the list and let
+@@ -4094,11 +4097,10 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ 				 */
+ 				list_move_tail(&cmd->i_conn_node,
+ 					       &conn->conn_cmd_list);
+-			} else {
+-				se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+-			}
+-			spin_unlock_irq(&se_cmd->t_state_lock);
++		} else {
++			se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+ 		}
++		spin_unlock_irq(&se_cmd->t_state_lock);
+ 	}
+ 	spin_unlock_bh(&conn->cmd_lock);
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/scsi-target-make-state_list-per-cpu.patch b/queue-5.10/scsi-target-make-state_list-per-cpu.patch
new file mode 100644
index 00000000000..4889b3758c2
--- /dev/null
+++ b/queue-5.10/scsi-target-make-state_list-per-cpu.patch
@@ -0,0 +1,420 @@
+From e4f77ff76e674bdfdc3488467cf301012fbd5195 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Nov 2020 12:59:33 -0600
+Subject: scsi: target: Make state_list per CPU
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 1526d9f10c6184031e42afad0adbdde1213e8ad1 ]
+
+Do a state_list/execute_task_lock per CPU, so we can do submissions from
+different CPUs without contention with each other.
+
+Note: tcm_fc was passing TARGET_SCF_USE_CPUID, but never set cpuid.  The
+assumption is that it wanted to set the cpuid to the CPU it was submitting
+from so it will get this behavior with this patch.
+
+[mkp: s/printk/pr_err/ + resolve COMPARE AND WRITE patch conflict]
+
+Link: https://lore.kernel.org/r/1604257174-4524-8-git-send-email-michael.christie@oracle.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 673db054d7a2 ("scsi: target: Fix multiple LUN_RESET handling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_device.c    |  16 ++-
+ drivers/target/target_core_tmr.c       | 166 +++++++++++++------------
+ drivers/target/target_core_transport.c |  27 ++--
+ drivers/target/tcm_fc/tfc_cmd.c        |   2 +-
+ include/target/target_core_base.h      |  13 +-
+ 5 files changed, 126 insertions(+), 98 deletions(-)
+
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 1eded5c4ebda6..bd3f1192c75a1 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -724,11 +724,24 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
+ {
+ 	struct se_device *dev;
+ 	struct se_lun *xcopy_lun;
++	int i;
+ 
+ 	dev = hba->backend->ops->alloc_device(hba, name);
+ 	if (!dev)
+ 		return NULL;
+ 
++	dev->queues = kcalloc(nr_cpu_ids, sizeof(*dev->queues), GFP_KERNEL);
++	if (!dev->queues) {
++		dev->transport->free_device(dev);
++		return NULL;
++	}
++
++	dev->queue_cnt = nr_cpu_ids;
++	for (i = 0; i < dev->queue_cnt; i++) {
++		INIT_LIST_HEAD(&dev->queues[i].state_list);
++		spin_lock_init(&dev->queues[i].lock);
++	}
++
+ 	dev->se_hba = hba;
+ 	dev->transport = hba->backend->ops;
+ 	dev->transport_flags = dev->transport->transport_flags_default;
+@@ -738,9 +751,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
+ 	INIT_LIST_HEAD(&dev->dev_sep_list);
+ 	INIT_LIST_HEAD(&dev->dev_tmr_list);
+ 	INIT_LIST_HEAD(&dev->delayed_cmd_list);
+-	INIT_LIST_HEAD(&dev->state_list);
+ 	INIT_LIST_HEAD(&dev->qf_cmd_list);
+-	spin_lock_init(&dev->execute_task_lock);
+ 	spin_lock_init(&dev->delayed_cmd_lock);
+ 	spin_lock_init(&dev->dev_reservation_lock);
+ 	spin_lock_init(&dev->se_port_lock);
+@@ -1014,6 +1025,7 @@ void target_free_device(struct se_device *dev)
+ 	if (dev->transport->free_prot)
+ 		dev->transport->free_prot(dev);
+ 
++	kfree(dev->queues);
+ 	dev->transport->free_device(dev);
+ }
+ 
+diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
+index 3efd5a3bd69d1..5da384bb88c82 100644
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -121,57 +121,61 @@ void core_tmr_abort_task(
+ 	unsigned long flags;
+ 	bool rc;
+ 	u64 ref_tag;
+-
+-	spin_lock_irqsave(&dev->execute_task_lock, flags);
+-	list_for_each_entry_safe(se_cmd, next, &dev->state_list, state_list) {
+-
+-		if (se_sess != se_cmd->se_sess)
+-			continue;
+-
+-		/* skip task management functions, including tmr->task_cmd */
+-		if (se_cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
+-			continue;
+-
+-		ref_tag = se_cmd->tag;
+-		if (tmr->ref_task_tag != ref_tag)
+-			continue;
+-
+-		printk("ABORT_TASK: Found referenced %s task_tag: %llu\n",
+-			se_cmd->se_tfo->fabric_name, ref_tag);
+-
+-		spin_lock(&se_sess->sess_cmd_lock);
+-		rc = __target_check_io_state(se_cmd, se_sess, 0);
+-		spin_unlock(&se_sess->sess_cmd_lock);
+-		if (!rc)
+-			continue;
+-
+-		list_move_tail(&se_cmd->state_list, &aborted_list);
+-		se_cmd->state_active = false;
+-
+-		spin_unlock_irqrestore(&dev->execute_task_lock, flags);
+-
+-		/*
+-		 * Ensure that this ABORT request is visible to the LU RESET
+-		 * code.
+-		 */
+-		if (!tmr->tmr_dev)
+-			WARN_ON_ONCE(transport_lookup_tmr_lun(tmr->task_cmd) <
+-					0);
+-
+-		if (dev->transport->tmr_notify)
+-			dev->transport->tmr_notify(dev, TMR_ABORT_TASK,
+-						   &aborted_list);
+-
+-		list_del_init(&se_cmd->state_list);
+-		target_put_cmd_and_wait(se_cmd);
+-
+-		printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
+-				" ref_tag: %llu\n", ref_tag);
+-		tmr->response = TMR_FUNCTION_COMPLETE;
+-		atomic_long_inc(&dev->aborts_complete);
+-		return;
++	int i;
++
++	for (i = 0; i < dev->queue_cnt; i++) {
++		spin_lock_irqsave(&dev->queues[i].lock, flags);
++		list_for_each_entry_safe(se_cmd, next, &dev->queues[i].state_list,
++					 state_list) {
++			if (se_sess != se_cmd->se_sess)
++				continue;
++
++			/*
++			 * skip task management functions, including
++			 * tmr->task_cmd
++			 */
++			if (se_cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
++				continue;
++
++			ref_tag = se_cmd->tag;
++			if (tmr->ref_task_tag != ref_tag)
++				continue;
++
++			pr_err("ABORT_TASK: Found referenced %s task_tag: %llu\n",
++			       se_cmd->se_tfo->fabric_name, ref_tag);
++
++			spin_lock(&se_sess->sess_cmd_lock);
++			rc = __target_check_io_state(se_cmd, se_sess, 0);
++			spin_unlock(&se_sess->sess_cmd_lock);
++			if (!rc)
++				continue;
++
++			list_move_tail(&se_cmd->state_list, &aborted_list);
++			se_cmd->state_active = false;
++			spin_unlock_irqrestore(&dev->queues[i].lock, flags);
++
++			/*
++			 * Ensure that this ABORT request is visible to the LU
++			 * RESET code.
++			 */
++			if (!tmr->tmr_dev)
++				WARN_ON_ONCE(transport_lookup_tmr_lun(tmr->task_cmd) < 0);
++
++			if (dev->transport->tmr_notify)
++				dev->transport->tmr_notify(dev, TMR_ABORT_TASK,
++							   &aborted_list);
++
++			list_del_init(&se_cmd->state_list);
++			target_put_cmd_and_wait(se_cmd);
++
++			pr_err("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for ref_tag: %llu\n",
++			       ref_tag);
++			tmr->response = TMR_FUNCTION_COMPLETE;
++			atomic_long_inc(&dev->aborts_complete);
++			return;
++		}
++		spin_unlock_irqrestore(&dev->queues[i].lock, flags);
+ 	}
+-	spin_unlock_irqrestore(&dev->execute_task_lock, flags);
+ 
+ 	if (dev->transport->tmr_notify)
+ 		dev->transport->tmr_notify(dev, TMR_ABORT_TASK, &aborted_list);
+@@ -273,7 +277,7 @@ static void core_tmr_drain_state_list(
+ 	struct se_session *sess;
+ 	struct se_cmd *cmd, *next;
+ 	unsigned long flags;
+-	int rc;
++	int rc, i;
+ 
+ 	/*
+ 	 * Complete outstanding commands with TASK_ABORTED SAM status.
+@@ -297,35 +301,39 @@ static void core_tmr_drain_state_list(
+ 	 * Note that this seems to be independent of TAS (Task Aborted Status)
+ 	 * in the Control Mode Page.
+ 	 */
+-	spin_lock_irqsave(&dev->execute_task_lock, flags);
+-	list_for_each_entry_safe(cmd, next, &dev->state_list, state_list) {
+-		/*
+-		 * For PREEMPT_AND_ABORT usage, only process commands
+-		 * with a matching reservation key.
+-		 */
+-		if (target_check_cdb_and_preempt(preempt_and_abort_list, cmd))
+-			continue;
+-
+-		/*
+-		 * Not aborting PROUT PREEMPT_AND_ABORT CDB..
+-		 */
+-		if (prout_cmd == cmd)
+-			continue;
+-
+-		sess = cmd->se_sess;
+-		if (WARN_ON_ONCE(!sess))
+-			continue;
+-
+-		spin_lock(&sess->sess_cmd_lock);
+-		rc = __target_check_io_state(cmd, tmr_sess, tas);
+-		spin_unlock(&sess->sess_cmd_lock);
+-		if (!rc)
+-			continue;
+-
+-		list_move_tail(&cmd->state_list, &drain_task_list);
+-		cmd->state_active = false;
++	for (i = 0; i < dev->queue_cnt; i++) {
++		spin_lock_irqsave(&dev->queues[i].lock, flags);
++		list_for_each_entry_safe(cmd, next, &dev->queues[i].state_list,
++					 state_list) {
++			/*
++			 * For PREEMPT_AND_ABORT usage, only process commands
++			 * with a matching reservation key.
++			 */
++			if (target_check_cdb_and_preempt(preempt_and_abort_list,
++							 cmd))
++				continue;
++
++			/*
++			 * Not aborting PROUT PREEMPT_AND_ABORT CDB..
++			 */
++			if (prout_cmd == cmd)
++				continue;
++
++			sess = cmd->se_sess;
++			if (WARN_ON_ONCE(!sess))
++				continue;
++
++			spin_lock(&sess->sess_cmd_lock);
++			rc = __target_check_io_state(cmd, tmr_sess, tas);
++			spin_unlock(&sess->sess_cmd_lock);
++			if (!rc)
++				continue;
++
++			list_move_tail(&cmd->state_list, &drain_task_list);
++			cmd->state_active = false;
++		}
++		spin_unlock_irqrestore(&dev->queues[i].lock, flags);
+ 	}
+-	spin_unlock_irqrestore(&dev->execute_task_lock, flags);
+ 
+ 	if (dev->transport->tmr_notify)
+ 		dev->transport->tmr_notify(dev, preempt_and_abort_list ?
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 84d654c14917c..230fffa993c00 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -650,12 +650,12 @@ static void target_remove_from_state_list(struct se_cmd *cmd)
+ 	if (!dev)
+ 		return;
+ 
+-	spin_lock_irqsave(&dev->execute_task_lock, flags);
++	spin_lock_irqsave(&dev->queues[cmd->cpuid].lock, flags);
+ 	if (cmd->state_active) {
+ 		list_del(&cmd->state_list);
+ 		cmd->state_active = false;
+ 	}
+-	spin_unlock_irqrestore(&dev->execute_task_lock, flags);
++	spin_unlock_irqrestore(&dev->queues[cmd->cpuid].lock, flags);
+ }
+ 
+ /*
+@@ -866,10 +866,7 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
+ 
+ 	INIT_WORK(&cmd->work, success ? target_complete_ok_work :
+ 		  target_complete_failure_work);
+-	if (cmd->se_cmd_flags & SCF_USE_CPUID)
+-		queue_work_on(cmd->cpuid, target_completion_wq, &cmd->work);
+-	else
+-		queue_work(target_completion_wq, &cmd->work);
++	queue_work_on(cmd->cpuid, target_completion_wq, &cmd->work);
+ }
+ EXPORT_SYMBOL(target_complete_cmd);
+ 
+@@ -904,12 +901,13 @@ static void target_add_to_state_list(struct se_cmd *cmd)
+ 	struct se_device *dev = cmd->se_dev;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&dev->execute_task_lock, flags);
++	spin_lock_irqsave(&dev->queues[cmd->cpuid].lock, flags);
+ 	if (!cmd->state_active) {
+-		list_add_tail(&cmd->state_list, &dev->state_list);
++		list_add_tail(&cmd->state_list,
++			      &dev->queues[cmd->cpuid].state_list);
+ 		cmd->state_active = true;
+ 	}
+-	spin_unlock_irqrestore(&dev->execute_task_lock, flags);
++	spin_unlock_irqrestore(&dev->queues[cmd->cpuid].lock, flags);
+ }
+ 
+ /*
+@@ -1397,6 +1395,9 @@ void transport_init_se_cmd(
+ 	cmd->sense_buffer = sense_buffer;
+ 	cmd->orig_fe_lun = unpacked_lun;
+ 
++	if (!(cmd->se_cmd_flags & SCF_USE_CPUID))
++		cmd->cpuid = smp_processor_id();
++
+ 	cmd->state_active = false;
+ }
+ EXPORT_SYMBOL(transport_init_se_cmd);
+@@ -1614,6 +1615,9 @@ int target_submit_cmd_map_sgls(struct se_cmd *se_cmd, struct se_session *se_sess
+ 	BUG_ON(!se_tpg);
+ 	BUG_ON(se_cmd->se_tfo || se_cmd->se_sess);
+ 	BUG_ON(in_interrupt());
++
++	if (flags & TARGET_SCF_USE_CPUID)
++		se_cmd->se_cmd_flags |= SCF_USE_CPUID;
+ 	/*
+ 	 * Initialize se_cmd for target operation.  From this point
+ 	 * exceptions are handled by sending exception status via
+@@ -1623,11 +1627,6 @@ int target_submit_cmd_map_sgls(struct se_cmd *se_cmd, struct se_session *se_sess
+ 				data_length, data_dir, task_attr, sense,
+ 				unpacked_lun);
+ 
+-	if (flags & TARGET_SCF_USE_CPUID)
+-		se_cmd->se_cmd_flags |= SCF_USE_CPUID;
+-	else
+-		se_cmd->cpuid = WORK_CPU_UNBOUND;
+-
+ 	if (flags & TARGET_SCF_UNKNOWN_SIZE)
+ 		se_cmd->unknown_data_length = 1;
+ 	/*
+diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
+index a7ed56602c6cd..8936a094f8461 100644
+--- a/drivers/target/tcm_fc/tfc_cmd.c
++++ b/drivers/target/tcm_fc/tfc_cmd.c
+@@ -551,7 +551,7 @@ static void ft_send_work(struct work_struct *work)
+ 	if (target_submit_cmd(&cmd->se_cmd, cmd->sess->se_sess, fcp->fc_cdb,
+ 			      &cmd->ft_sense_buffer[0], scsilun_to_int(&fcp->fc_lun),
+ 			      ntohl(fcp->fc_dl), task_attr, data_dir,
+-			      TARGET_SCF_ACK_KREF | TARGET_SCF_USE_CPUID))
++			      TARGET_SCF_ACK_KREF))
+ 		goto err;
+ 
+ 	pr_debug("r_ctl %x target_submit_cmd %p\n", fh->fh_r_ctl, cmd);
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 16992ba455deb..0109adcdfa0b4 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -541,6 +541,10 @@ struct se_cmd {
+ 	unsigned int		t_prot_nents;
+ 	sense_reason_t		pi_err;
+ 	u64			sense_info;
++	/*
++	 * CPU LIO will execute the cmd on. Defaults to the CPU the cmd is
++	 * initialized on. Drivers can override.
++	 */
+ 	int			cpuid;
+ };
+ 
+@@ -761,6 +765,11 @@ struct se_dev_stat_grps {
+ 	struct config_group scsi_lu_group;
+ };
+ 
++struct se_device_queue {
++	struct list_head	state_list;
++	spinlock_t		lock;
++};
++
+ struct se_device {
+ 	/* RELATIVE TARGET PORT IDENTIFER Counter */
+ 	u16			dev_rpti_counter;
+@@ -794,7 +803,6 @@ struct se_device {
+ 	atomic_t		dev_qf_count;
+ 	u32			export_count;
+ 	spinlock_t		delayed_cmd_lock;
+-	spinlock_t		execute_task_lock;
+ 	spinlock_t		dev_reservation_lock;
+ 	unsigned int		dev_reservation_flags;
+ #define DRF_SPC2_RESERVATIONS			0x00000001
+@@ -814,7 +822,6 @@ struct se_device {
+ 	struct work_struct	qf_work_queue;
+ 	struct work_struct	delayed_cmd_work;
+ 	struct list_head	delayed_cmd_list;
+-	struct list_head	state_list;
+ 	struct list_head	qf_cmd_list;
+ 	/* Pointer to associated SE HBA */
+ 	struct se_hba		*se_hba;
+@@ -841,6 +848,8 @@ struct se_device {
+ 	/* For se_lun->lun_se_dev RCU read-side critical access */
+ 	u32			hba_index;
+ 	struct rcu_head		rcu_head;
++	int			queue_cnt;
++	struct se_device_queue	*queues;
+ };
+ 
+ struct se_hba {
+-- 
+2.39.2
+
diff --git a/queue-5.10/scsi-target-rename-cmd.bad_sector-to-cmd.sense_info.patch b/queue-5.10/scsi-target-rename-cmd.bad_sector-to-cmd.sense_info.patch
new file mode 100644
index 00000000000..966bd13878f
--- /dev/null
+++ b/queue-5.10/scsi-target-rename-cmd.bad_sector-to-cmd.sense_info.patch
@@ -0,0 +1,130 @@
+From 4e614c8d9a8e93fb38262520de2f0224b86b5142 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Nov 2020 00:32:09 +0100
+Subject: scsi: target: Rename cmd.bad_sector to cmd.sense_info
+
+From: David Disseldorp <ddiss@suse.de>
+
+[ Upstream commit 8dd992fb67f33a0777fb4bee1e22a5ee5530f024 ]
+
+cmd.bad_sector currently gets packed into the sense INFORMATION field for
+TCM_LOGICAL_BLOCK_{GUARD,APP_TAG,REF_TAG}_CHECK_FAILED errors, which carry
+an .add_sector_info flag in the sense_detail_table to ensure this.
+
+In preparation for propagating a byte offset on COMPARE AND WRITE
+TCM_MISCOMPARE_VERIFY error, rename cmd.bad_sector to cmd.sense_info and
+sense_detail.add_sector_info to sense_detail.add_sense_info so that it
+better reflects the sense INFORMATION field destination.
+
+[ddiss: update previously overlooked ib_isert]
+
+Link: https://lore.kernel.org/r/20201031233211.5207-3-ddiss@suse.de
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 673db054d7a2 ("scsi: target: Fix multiple LUN_RESET handling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/isert/ib_isert.c |  4 ++--
+ drivers/target/target_core_sbc.c        |  2 +-
+ drivers/target/target_core_transport.c  | 12 ++++++------
+ include/target/target_core_base.h       |  2 +-
+ 4 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index edea37da8a5bd..2d0d966fba2c8 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -1553,12 +1553,12 @@ isert_check_pi_status(struct se_cmd *se_cmd, struct ib_mr *sig_mr)
+ 		}
+ 		sec_offset_err = mr_status.sig_err.sig_err_offset;
+ 		do_div(sec_offset_err, block_size);
+-		se_cmd->bad_sector = sec_offset_err + se_cmd->t_task_lba;
++		se_cmd->sense_info = sec_offset_err + se_cmd->t_task_lba;
+ 
+ 		isert_err("PI error found type %d at sector 0x%llx "
+ 			  "expected 0x%x vs actual 0x%x\n",
+ 			  mr_status.sig_err.err_type,
+-			  (unsigned long long)se_cmd->bad_sector,
++			  (unsigned long long)se_cmd->sense_info,
+ 			  mr_status.sig_err.expected,
+ 			  mr_status.sig_err.actual);
+ 		ret = 1;
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index eaf8551ebc612..47c5f26e6012d 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -1438,7 +1438,7 @@ sbc_dif_verify(struct se_cmd *cmd, sector_t start, unsigned int sectors,
+ 			if (rc) {
+ 				kunmap_atomic(daddr - dsg->offset);
+ 				kunmap_atomic(paddr - psg->offset);
+-				cmd->bad_sector = sector;
++				cmd->sense_info = sector;
+ 				return rc;
+ 			}
+ next:
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index ce521d3d30470..84d654c14917c 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -3135,7 +3135,7 @@ struct sense_detail {
+ 	u8 key;
+ 	u8 asc;
+ 	u8 ascq;
+-	bool add_sector_info;
++	bool add_sense_info;
+ };
+ 
+ static const struct sense_detail sense_detail_table[] = {
+@@ -3238,19 +3238,19 @@ static const struct sense_detail sense_detail_table[] = {
+ 		.key = ABORTED_COMMAND,
+ 		.asc = 0x10,
+ 		.ascq = 0x01, /* LOGICAL BLOCK GUARD CHECK FAILED */
+-		.add_sector_info = true,
++		.add_sense_info = true,
+ 	},
+ 	[TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED] = {
+ 		.key = ABORTED_COMMAND,
+ 		.asc = 0x10,
+ 		.ascq = 0x02, /* LOGICAL BLOCK APPLICATION TAG CHECK FAILED */
+-		.add_sector_info = true,
++		.add_sense_info = true,
+ 	},
+ 	[TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED] = {
+ 		.key = ABORTED_COMMAND,
+ 		.asc = 0x10,
+ 		.ascq = 0x03, /* LOGICAL BLOCK REFERENCE TAG CHECK FAILED */
+-		.add_sector_info = true,
++		.add_sense_info = true,
+ 	},
+ 	[TCM_COPY_TARGET_DEVICE_NOT_REACHABLE] = {
+ 		.key = COPY_ABORTED,
+@@ -3330,10 +3330,10 @@ static void translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason)
+ 	cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+ 	cmd->scsi_sense_length  = TRANSPORT_SENSE_BUFFER;
+ 	scsi_build_sense_buffer(desc_format, buffer, key, asc, ascq);
+-	if (sd->add_sector_info)
++	if (sd->add_sense_info)
+ 		WARN_ON_ONCE(scsi_set_sense_information(buffer,
+ 							cmd->scsi_sense_length,
+-							cmd->bad_sector) < 0);
++							cmd->sense_info) < 0);
+ }
+ 
+ int
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 18a5dcd275f88..16992ba455deb 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -540,7 +540,7 @@ struct se_cmd {
+ 	struct scatterlist	*t_prot_sg;
+ 	unsigned int		t_prot_nents;
+ 	sense_reason_t		pi_err;
+-	sector_t		bad_sector;
++	u64			sense_info;
+ 	int			cpuid;
+ };
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/scsi-target-rename-struct-sense_info-to-sense_detail.patch b/queue-5.10/scsi-target-rename-struct-sense_info-to-sense_detail.patch
new file mode 100644
index 00000000000..c1fb9e55f7c
--- /dev/null
+++ b/queue-5.10/scsi-target-rename-struct-sense_info-to-sense_detail.patch
@@ -0,0 +1,94 @@
+From b8bdb3cf8d48ffb9d0e610fc2e12a442f3bcaa12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Nov 2020 00:32:08 +0100
+Subject: scsi: target: Rename struct sense_info to sense_detail
+
+From: David Disseldorp <ddiss@suse.de>
+
+[ Upstream commit b455233dcc403e3eb955a642dd69b6676e12b245 ]
+
+This helps distinguish it from the SCSI sense INFORMATION field.
+
+Link: https://lore.kernel.org/r/20201031233211.5207-2-ddiss@suse.de
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 673db054d7a2 ("scsi: target: Fix multiple LUN_RESET handling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_transport.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index bca3a32a4bfb7..ce521d3d30470 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -3131,14 +3131,14 @@ bool transport_wait_for_tasks(struct se_cmd *cmd)
+ }
+ EXPORT_SYMBOL(transport_wait_for_tasks);
+ 
+-struct sense_info {
++struct sense_detail {
+ 	u8 key;
+ 	u8 asc;
+ 	u8 ascq;
+ 	bool add_sector_info;
+ };
+ 
+-static const struct sense_info sense_info_table[] = {
++static const struct sense_detail sense_detail_table[] = {
+ 	[TCM_NO_SENSE] = {
+ 		.key = NOT_READY
+ 	},
+@@ -3298,39 +3298,39 @@ static const struct sense_info sense_info_table[] = {
+  */
+ static void translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason)
+ {
+-	const struct sense_info *si;
++	const struct sense_detail *sd;
+ 	u8 *buffer = cmd->sense_buffer;
+ 	int r = (__force int)reason;
+ 	u8 key, asc, ascq;
+ 	bool desc_format = target_sense_desc_format(cmd->se_dev);
+ 
+-	if (r < ARRAY_SIZE(sense_info_table) && sense_info_table[r].key)
+-		si = &sense_info_table[r];
++	if (r < ARRAY_SIZE(sense_detail_table) && sense_detail_table[r].key)
++		sd = &sense_detail_table[r];
+ 	else
+-		si = &sense_info_table[(__force int)
++		sd = &sense_detail_table[(__force int)
+ 				       TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE];
+ 
+-	key = si->key;
++	key = sd->key;
+ 	if (reason == TCM_CHECK_CONDITION_UNIT_ATTENTION) {
+ 		if (!core_scsi3_ua_for_check_condition(cmd, &key, &asc,
+ 						       &ascq)) {
+ 			cmd->scsi_status = SAM_STAT_BUSY;
+ 			return;
+ 		}
+-	} else if (si->asc == 0) {
++	} else if (sd->asc == 0) {
+ 		WARN_ON_ONCE(cmd->scsi_asc == 0);
+ 		asc = cmd->scsi_asc;
+ 		ascq = cmd->scsi_ascq;
+ 	} else {
+-		asc = si->asc;
+-		ascq = si->ascq;
++		asc = sd->asc;
++		ascq = sd->ascq;
+ 	}
+ 
+ 	cmd->se_cmd_flags |= SCF_EMULATED_TASK_SENSE;
+ 	cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+ 	cmd->scsi_sense_length  = TRANSPORT_SENSE_BUFFER;
+ 	scsi_build_sense_buffer(desc_format, buffer, key, asc, ascq);
+-	if (si->add_sector_info)
++	if (sd->add_sector_info)
+ 		WARN_ON_ONCE(scsi_set_sense_information(buffer,
+ 							cmd->scsi_sense_length,
+ 							cmd->bad_sector) < 0);
+-- 
+2.39.2
+
diff --git a/queue-5.10/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch b/queue-5.10/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch
new file mode 100644
index 00000000000..23747b59c52
--- /dev/null
+++ b/queue-5.10/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch
@@ -0,0 +1,68 @@
+From 18edd94a9c15e91ed2648722b2c3b163bf41bb00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 19:33:54 +0000
+Subject: selftests/bpf: Wait for receive in cg_storage_multi test
+
+From: YiFei Zhu <zhuyifei@google.com>
+
+[ Upstream commit 5af607a861d43ffff830fc1890033e579ec44799 ]
+
+In some cases the loopback latency might be large enough, causing
+the assertion on invocations to be run before ingress prog getting
+executed. The assertion would fail and the test would flake.
+
+This can be reliably reproduced by arbitrarily increasing the
+loopback latency (thanks to [1]):
+  tc qdisc add dev lo root handle 1: htb default 12
+  tc class add dev lo parent 1:1 classid 1:12 htb rate 20kbps ceil 20kbps
+  tc qdisc add dev lo parent 1:12 netem delay 100ms
+
+Fix this by waiting on the receive end, instead of instantly
+returning to the assert. The call to read() will wait for the
+default SO_RCVTIMEO timeout of 3 seconds provided by
+start_server().
+
+[1] https://gist.github.com/kstevens715/4598301
+
+Reported-by: Martin KaFai Lau <martin.lau@linux.dev>
+Link: https://lore.kernel.org/bpf/9c5c8b7e-1d89-a3af-5400-14fde81f4429@linux.dev/
+Fixes: 3573f384014f ("selftests/bpf: Test CGROUP_STORAGE behavior on shared egress + ingress")
+Acked-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: YiFei Zhu <zhuyifei@google.com>
+Link: https://lore.kernel.org/r/20230405193354.1956209-1-zhuyifei@google.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c
+index 643dfa35419c1..48dc5827daa7f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c
++++ b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c
+@@ -56,8 +56,9 @@ static bool assert_storage_noexist(struct bpf_map *map, const void *key)
+ 
+ static bool connect_send(const char *cgroup_path)
+ {
+-	bool res = true;
+ 	int server_fd = -1, client_fd = -1;
++	char message[] = "message";
++	bool res = true;
+ 
+ 	if (join_cgroup(cgroup_path))
+ 		goto out_clean;
+@@ -70,7 +71,10 @@ static bool connect_send(const char *cgroup_path)
+ 	if (client_fd < 0)
+ 		goto out_clean;
+ 
+-	if (send(client_fd, "message", strlen("message"), 0) < 0)
++	if (send(client_fd, &message, sizeof(message), 0) < 0)
++		goto out_clean;
++
++	if (read(server_fd, &message, sizeof(message)) < 0)
+ 		goto out_clean;
+ 
+ 	res = false;
+-- 
+2.39.2
+
diff --git a/queue-5.10/selftests-resctrl-check-for-return-value-after-write.patch b/queue-5.10/selftests-resctrl-check-for-return-value-after-write.patch
new file mode 100644
index 00000000000..8d318d9af87
--- /dev/null
+++ b/queue-5.10/selftests-resctrl-check-for-return-value-after-write.patch
@@ -0,0 +1,56 @@
+From a1b86102feecd8f3ab3d813ff950c99c41880f0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:06:00 +0200
+Subject: selftests/resctrl: Check for return value after write_schemata()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 0d45c83b95da414e98ad333e723141a94f6e2c64 ]
+
+MBA test case writes schemata but it does not check if the write is
+successful or not.
+
+Add the error check and return error properly.
+
+Fixes: 01fee6b4d1f9 ("selftests/resctrl: Add MBA test")
+Co-developed-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/mba_test.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/resctrl/mba_test.c b/tools/testing/selftests/resctrl/mba_test.c
+index 6449fbd96096a..6cfddd1d43558 100644
+--- a/tools/testing/selftests/resctrl/mba_test.c
++++ b/tools/testing/selftests/resctrl/mba_test.c
+@@ -28,6 +28,7 @@ static int mba_setup(int num, ...)
+ 	struct resctrl_val_param *p;
+ 	char allocation_str[64];
+ 	va_list param;
++	int ret;
+ 
+ 	va_start(param, num);
+ 	p = va_arg(param, struct resctrl_val_param *);
+@@ -45,7 +46,11 @@ static int mba_setup(int num, ...)
+ 
+ 	sprintf(allocation_str, "%d", allocation);
+ 
+-	write_schemata(p->ctrlgrp, allocation_str, p->cpu_no, p->resctrl_val);
++	ret = write_schemata(p->ctrlgrp, allocation_str, p->cpu_no,
++			     p->resctrl_val);
++	if (ret < 0)
++		return ret;
++
+ 	allocation -= ALLOCATION_STEP;
+ 
+ 	return 0;
+-- 
+2.39.2
+
diff --git a/queue-5.10/selftests-resctrl-return-null-if-malloc_and_init_mem.patch b/queue-5.10/selftests-resctrl-return-null-if-malloc_and_init_mem.patch
new file mode 100644
index 00000000000..3577e7115a7
--- /dev/null
+++ b/queue-5.10/selftests-resctrl-return-null-if-malloc_and_init_mem.patch
@@ -0,0 +1,46 @@
+From 448d588be91ba367126495e82daa8c93d1549a25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:05:57 +0200
+Subject: selftests/resctrl: Return NULL if malloc_and_init_memory() did not
+ alloc mem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 22a8be280383812235131dda18a8212a59fadd2d ]
+
+malloc_and_init_memory() in fill_buf isn't checking if memalign()
+successfully allocated memory or not before accessing the memory.
+
+Check the return value of memalign() and return NULL if allocating
+aligned memory fails.
+
+Fixes: a2561b12fe39 ("selftests/resctrl: Add built in benchmark")
+Co-developed-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/fill_buf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c
+index 56ccbeae0638d..c20d0a7ecbe63 100644
+--- a/tools/testing/selftests/resctrl/fill_buf.c
++++ b/tools/testing/selftests/resctrl/fill_buf.c
+@@ -68,6 +68,8 @@ static void *malloc_and_init_memory(size_t s)
+ 	size_t s64;
+ 
+ 	void *p = memalign(PAGE_SIZE, s);
++	if (!p)
++		return NULL;
+ 
+ 	p64 = (uint64_t *)p;
+ 	s64 = s / sizeof(uint64_t);
+-- 
+2.39.2
+
diff --git a/queue-5.10/selinux-ensure-av_permissions.h-is-built-when-needed.patch b/queue-5.10/selinux-ensure-av_permissions.h-is-built-when-needed.patch
new file mode 100644
index 00000000000..b3403ed18c9
--- /dev/null
+++ b/queue-5.10/selinux-ensure-av_permissions.h-is-built-when-needed.patch
@@ -0,0 +1,36 @@
+From f589214fd48bc3ed6e9a5c5e9b8e5d37e1e53fb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 13:29:11 -0400
+Subject: selinux: ensure av_permissions.h is built when needed
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 4ce1f694eb5d8ca607fed8542d32a33b4f1217a5 ]
+
+The Makefile rule responsible for building flask.h and
+av_permissions.h only lists flask.h as a target which means that
+av_permissions.h is only generated when flask.h needs to be
+generated.  This patch fixes this by adding av_permissions.h as a
+target to the rule.
+
+Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index 47e4aba3a868d..ee1ddda964478 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -24,5 +24,5 @@ quiet_cmd_flask = GEN     $(obj)/flask.h $(obj)/av_permissions.h
+       cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+ 
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
++$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE
+ 	$(call if_changed,flask)
+-- 
+2.39.2
+
diff --git a/queue-5.10/selinux-fix-makefile-dependencies-of-flask.h.patch b/queue-5.10/selinux-fix-makefile-dependencies-of-flask.h.patch
new file mode 100644
index 00000000000..98f1b7b0e9a
--- /dev/null
+++ b/queue-5.10/selinux-fix-makefile-dependencies-of-flask.h.patch
@@ -0,0 +1,43 @@
+From ed9375be8a647920ccfa59732e8d12f3b2fccdf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 15:59:19 +0200
+Subject: selinux: fix Makefile dependencies of flask.h
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ]
+
+Make the flask.h target depend on the genheaders binary instead of
+classmap.h to ensure that it is rebuilt if any of the dependencies of
+genheaders are changed.
+
+Notably this fixes flask.h not being rebuilt when
+initial_sid_to_string.h is modified.
+
+Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index 4d8e0e8adf0b1..47e4aba3a868d 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -21,8 +21,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
+ $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h
+ 
+ quiet_cmd_flask = GEN     $(obj)/flask.h $(obj)/av_permissions.h
+-      cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h
++      cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+ 
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h: $(src)/include/classmap.h FORCE
++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
+ 	$(call if_changed,flask)
+-- 
+2.39.2
+
diff --git a/queue-5.10/serial-8250-add-missing-wakeup-event-reporting.patch b/queue-5.10/serial-8250-add-missing-wakeup-event-reporting.patch
new file mode 100644
index 00000000000..195925846bd
--- /dev/null
+++ b/queue-5.10/serial-8250-add-missing-wakeup-event-reporting.patch
@@ -0,0 +1,53 @@
+From a1817f73a9124cfc6ea47660bd3caf4b6d3c9390 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 10:02:39 -0700
+Subject: serial: 8250: Add missing wakeup event reporting
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 0ba9e3a13c6adfa99e32b2576d20820ab10ad48a ]
+
+An 8250 UART configured as a wake-up source would not have reported
+itself through sysfs as being the source of wake-up, correct that.
+
+Fixes: b3b708fa2780 ("wake up from a serial port")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230414170241.2016255-1-f.fainelli@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 1f231fcda657b..1f9e4b87387b5 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -15,6 +15,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/ioport.h>
+ #include <linux/init.h>
++#include <linux/irq.h>
+ #include <linux/console.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/sysrq.h>
+@@ -1889,6 +1890,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ 	unsigned char status;
+ 	unsigned long flags;
+ 	struct uart_8250_port *up = up_to_u8250p(port);
++	struct tty_port *tport = &port->state->port;
+ 	bool skip_rx = false;
+ 
+ 	if (iir & UART_IIR_NO_INT)
+@@ -1912,6 +1914,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ 		skip_rx = true;
+ 
+ 	if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) {
++		if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
++			pm_wakeup_event(tport->tty->dev, 0);
+ 		if (!up->dma || handle_rx_dma(up, iir))
+ 			status = serial8250_rx_chars(up, status);
+ 	}
+-- 
+2.39.2
+
diff --git a/queue-5.10/series b/queue-5.10/series
index db422b85374..259e916c8ae 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -49,3 +49,223 @@ ubifs-fix-memleak-when-insert_old_idx-failed.patch
 ubi-fix-return-value-overwrite-issue-in-try_write_vid_and_data.patch
 ubifs-free-memory-for-tmpfile-name.patch
 sound-oss-dmasound-fix-build-when-drivers-are-mixed-y-m.patch
+rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch
+selftests-resctrl-return-null-if-malloc_and_init_mem.patch
+selftests-resctrl-check-for-return-value-after-write.patch
+selinux-fix-makefile-dependencies-of-flask.h.patch
+selinux-ensure-av_permissions.h-is-built-when-needed.patch
+tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch
+tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch
+tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch
+tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch
+tpm-tpm-implement-usage-counter-for-locality.patch
+tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch
+erofs-stop-parsing-non-compact-head-index-if-cluster.patch
+erofs-fix-potential-overflow-calculating-xattr_isize.patch
+drm-rockchip-drop-unbalanced-obj-unref.patch
+drm-vgem-add-missing-mutex_destroy.patch
+drm-probe-helper-cancel-previous-job-before-starting.patch
+soc-ti-pm33xx-enable-basic-pm-runtime-support-for-ge.patch
+soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch
+arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch
+arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch
+drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch
+edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch
+arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch
+arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch
+arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch
+arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch
+arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch
+arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch
+arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch
+x86-mce-amd-use-an-u64-for-bank_map.patch
+media-bdisp-add-missing-check-for-create_workqueue.patch
+firmware-qcom_scm-clear-download-bit-during-reboot.patch
+drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch
+media-max9286-free-control-handler.patch
+drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch
+drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch
+drm-msm-adreno-disable-preemption-on-adreno-510.patch
+acpi-processor-fix-evaluating-_pdc-method-when-runni.patch
+mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch
+arm-dts-gta04-fix-excess-dma-channel-usage.patch
+drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch
+regulator-core-consistently-set-mutex_owner-when-usi.patch
+regulator-core-avoid-lockdep-reports-when-resolving-.patch
+x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch
+media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch
+media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch
+media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch
+media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch
+media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch
+media-rcar_fdp1-make-use-of-the-helper-function-devm.patch
+media-rcar_fdp1-fix-the-correct-variable-assignments.patch
+media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch
+media-rc-gpio-ir-recv-fix-support-for-wake-up.patch
+media-venus-vdec-fix-non-reliable-setting-of-last-fl.patch
+media-venus-vdec-make-decoder-return-last-flag-for-s.patch
+media-venus-preserve-drc-state-across-seeks.patch
+media-venus-vdec-handle-drc-after-drain.patch
+media-venus-dec-fix-handling-of-the-start-cmd.patch
+regulator-stm32-pwr-fix-of_iomap-leak.patch
+x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch
+arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch
+debugobject-prevent-init-race-with-static-objects.patch
+drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch
+tick-sched-use-tick_next_period-for-lockless-quick-c.patch
+tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch
+tick-sched-optimize-tick_do_update_jiffies64-further.patch
+tick-get-rid-of-tick_period.patch
+tick-common-align-tick-period-with-the-hz-tick.patch
+wifi-ath6kl-minor-fix-for-allocation-size.patch
+wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch
+wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch
+wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch
+tools-bpftool-remove-invalid-json-escape.patch
+wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch
+wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch
+bpf-take-into-account-liveness-when-propagating-prec.patch
+bpf-fix-precision-propagation-verbose-logging.patch
+scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch
+bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch
+vlan-partially-enable-siocshwtstamp-in-container.patch
+net-packet-annotate-accesses-to-po-xmit.patch
+net-packet-convert-po-origdev-to-an-atomic-flag.patch
+net-packet-convert-po-auxdata-to-an-atomic-flag.patch
+scsi-target-rename-struct-sense_info-to-sense_detail.patch
+scsi-target-rename-cmd.bad_sector-to-cmd.sense_info.patch
+scsi-target-make-state_list-per-cpu.patch
+scsi-target-fix-multiple-lun_reset-handling.patch
+scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch
+scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch
+f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch
+f2fs-enforce-single-zone-capacity.patch
+f2fs-apply-zone-capacity-to-all-zone-type.patch
+f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch
+crypto-caam-clear-some-memory-in-instantiate_rng.patch
+crypto-sa2ul-select-crypto_des.patch
+wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch
+wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-12104
+net-qrtr-correct-types-of-trace-event-parameters.patch
+selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch
+bpftool-fix-bug-for-long-instructions-in-program-cfg.patch
+crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch
+crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch
+xsk-fix-unaligned-descriptor-validation.patch
+f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch
+scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch
+net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch
+bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch
+nvme-handle-the-persistent-internal-error-aer.patch
+nvme-fix-async-event-trace-event.patch
+nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch
+bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch
+md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch
+md-raid10-fix-memleak-for-conf-bio_split.patch
+md-raid10-fix-memleak-of-md-thread.patch
+wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch
+wifi-iwlwifi-fw-move-memset-before-early-return.patch
+jdb2-don-t-refuse-invalidation-of-already-invalidate.patch
+wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch
+wifi-iwlwifi-mvm-check-firmware-response-size.patch
+wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch
+ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch
+ixgbe-enable-setting-rss-table-to-default-values.patch
+bpf-don-t-efault-for-getsockopt-with-optval-null.patch
+netfilter-nf_tables-don-t-write-table-validation-sta.patch
+net-sched-sch_fq-fix-integer-overflow-of-credit.patch
+ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch
+revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch
+netlink-use-copy_to_user-for-optval-in-netlink_getso.patch
+net-amd-fix-link-leak-when-verifying-config-failed.patch
+tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch
+ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch
+pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch
+usb-host-xhci-rcar-remove-leftover-quirk-handling.patch
+usb-dwc3-gadget-change-condition-for-processing-susp.patch
+fpga-bridge-fix-kernel-doc-parameter-description.patch
+iio-light-max44009-add-missing-of-device-matching.patch
+spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch
+spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch
+usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch
+pci-imx6-install-the-fault-handler-only-on-compatibl.patch
+asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch
+asoc-es8316-handle-optional-irq-assignment.patch
+linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch
+spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch
+spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch
+vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch
+of-fix-modalias-string-generation.patch
+pci-edr-clear-device-status-after-edr-error-recovery.patch
+ia64-mm-contig-fix-section-mismatch-warning-error.patch
+ia64-salinfo-placate-defined-but-not-used-warning.patch
+scripts-gdb-bail-early-if-there-are-no-clocks.patch
+scripts-gdb-bail-early-if-there-are-no-generic-pd.patch
+coresight-etm_pmu-set-the-module-field.patch
+asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch
+spi-cadence-quadspi-fix-suspend-resume-implementatio.patch
+i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch
+uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch
+sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch
+usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch
+usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch
+usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch
+firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch
+tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch
+serial-8250-add-missing-wakeup-event-reporting.patch
+staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch
+spmi-add-a-check-for-remove-callback-when-removing-a.patch
+spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch
+macintosh-windfarm_smu_sat-add-missing-of_node_put.patch
+powerpc-mpc512x-fix-resource-printk-format-warning.patch
+powerpc-wii-fix-resource-printk-format-warnings.patch
+powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch
+macintosh-via-pmu-led-requires-ata-to-be-set.patch
+powerpc-rtas-use-memmove-for-potentially-overlapping.patch
+perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch
+clk-at91-clk-sam9x60-pll-fix-return-value-check.patch
+rdma-siw-fix-potential-page_array-out-of-range-acces.patch
+rdma-rdmavt-delete-unnecessary-null-check.patch
+workqueue-rename-delayed-delayed-by-active-managemen.patch
+workqueue-fix-hung-time-report-of-worker-pools.patch
+rtc-omap-include-header-for-omap_rtc_power_off_progr.patch
+rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch
+rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch
+power-supply-generic-adc-battery-fix-unit-scaling.patch
+clk-add-missing-of_node_put-in-assigned-clocks-prope.patch
+rdma-siw-remove-namespace-check-from-siw_netdev_even.patch
+rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch
+rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch
+ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch
+ib-hfi1-add-aip-tx-traces.patch
+ib-hfi1-add-additional-usdma-traces.patch
+ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch
+nfsv4.1-always-send-a-reclaim_complete-after-establi.patch
+firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch
+input-raspberrypi-ts-release-firmware-handle-when-no.patch
+input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch
+rdma-mlx5-fix-flow-counter-query-via-devx.patch
+sunrpc-remove-the-maximum-number-of-retries-in-call_.patch
+rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch
+clocksource-drivers-davinci-fix-memory-leak-in-davin.patch
+openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch
+ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch
+leds-ti_lmu_common-select-regmap-instead-of-dependin.patch
+dmaengine-mv_xor_v2-fix-an-error-code.patch
+leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch
+pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch
+pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch
+pwm-mtk-disp-disable-shadow-registers-before-setting.patch
+phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch
+dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch
+dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch
+dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch
+thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch
+mfd-tqmx86-do-not-access-i2c_detect-register-through.patch
+mfd-tqmx86-remove-incorrect-tqmx90uc-board-id.patch
+mfd-tqmx86-add-support-for-tqmx110eb-and-tqmxe40x.patch
+mfd-tqmx86-specify-io-port-register-range-more-preci.patch
+mfd-tqmx86-correct-board-names-for-tqmxe39x.patch
+afs-fix-updating-of-i_size-with-dv-jump-from-server.patch
diff --git a/queue-5.10/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch b/queue-5.10/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch
new file mode 100644
index 00000000000..ce48899058a
--- /dev/null
+++ b/queue-5.10/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch
@@ -0,0 +1,44 @@
+From f2b91ec65bb89ee1b38410c67e7407b5ed7c35b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 13:48:52 +0200
+Subject: sh: sq: Fix incorrect element size for allocating bitmap buffer
+
+From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+
+[ Upstream commit 80f746e2bd0e1da3fdb49a53570e54a1a225faac ]
+
+The Store Queue code allocates a bitmap buffer with the size of
+multiple of sizeof(long) in sq_api_init(). While the buffer size
+is calculated correctly, the code uses the wrong element size to
+allocate the buffer which results in the allocated bitmap buffer
+being too small.
+
+Fix this by allocating the buffer with kcalloc() with element size
+sizeof(long) instead of kzalloc() whose elements size defaults to
+sizeof(char).
+
+Fixes: d7c30c682a27 ("sh: Store Queue API rework.")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230419114854.528677-1-glaubitz@physik.fu-berlin.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/kernel/cpu/sh4/sq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c
+index d432164b23b7c..c31ec0fea3003 100644
+--- a/arch/sh/kernel/cpu/sh4/sq.c
++++ b/arch/sh/kernel/cpu/sh4/sq.c
+@@ -381,7 +381,7 @@ static int __init sq_api_init(void)
+ 	if (unlikely(!sq_cache))
+ 		return ret;
+ 
+-	sq_bitmap = kzalloc(size, GFP_KERNEL);
++	sq_bitmap = kcalloc(size, sizeof(long), GFP_KERNEL);
+ 	if (unlikely(!sq_bitmap))
+ 		goto out;
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/soc-ti-pm33xx-enable-basic-pm-runtime-support-for-ge.patch b/queue-5.10/soc-ti-pm33xx-enable-basic-pm-runtime-support-for-ge.patch
new file mode 100644
index 00000000000..603f85fa28f
--- /dev/null
+++ b/queue-5.10/soc-ti-pm33xx-enable-basic-pm-runtime-support-for-ge.patch
@@ -0,0 +1,75 @@
+From 8c9076aea1cb0aa72269fe4a3f16403246ec74dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 12:57:13 +0200
+Subject: soc: ti: pm33xx: Enable basic PM runtime support for genpd
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 74033131d2467fda6b76ba10bc80a75fb47e03d1 ]
+
+To prepare for moving to use genpd, let's enable basic PM
+runtime support.
+
+Cc: Dave Gerlach <d-gerlach@ti.com>
+Cc: Santosh Shilimkar <ssantosh@kernel.org>
+Cc: Suman Anna <s-anna@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Stable-dep-of: 8f3c307b580a ("soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pm33xx.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/pm33xx.c b/drivers/soc/ti/pm33xx.c
+index dc21aa855a458..332588de22f3f 100644
+--- a/drivers/soc/ti/pm33xx.c
++++ b/drivers/soc/ti/pm33xx.c
+@@ -19,6 +19,7 @@
+ #include <linux/of_address.h>
+ #include <linux/platform_data/pm33xx.h>
+ #include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
+ #include <linux/rtc.h>
+ #include <linux/rtc/rtc-omap.h>
+ #include <linux/sizes.h>
+@@ -555,16 +556,26 @@ static int am33xx_pm_probe(struct platform_device *pdev)
+ 	suspend_wfi_flags |= WFI_FLAG_WAKE_M3;
+ #endif /* CONFIG_SUSPEND */
+ 
++	pm_runtime_enable(dev);
++	ret = pm_runtime_get_sync(dev);
++	if (ret < 0) {
++		pm_runtime_put_noidle(dev);
++		goto err_pm_runtime_disable;
++	}
++
+ 	ret = pm_ops->init(am33xx_do_sram_idle);
+ 	if (ret) {
+ 		dev_err(dev, "Unable to call core pm init!\n");
+ 		ret = -ENODEV;
+-		goto err_put_wkup_m3_ipc;
++		goto err_pm_runtime_put;
+ 	}
+ 
+ 	return 0;
+ 
+-err_put_wkup_m3_ipc:
++err_pm_runtime_put:
++	pm_runtime_put_sync(dev);
++err_pm_runtime_disable:
++	pm_runtime_disable(dev);
+ 	wkup_m3_ipc_put(m3_ipc);
+ err_unsetup_rtc:
+ 	iounmap(rtc_base_virt);
+@@ -577,6 +588,8 @@ static int am33xx_pm_probe(struct platform_device *pdev)
+ 
+ static int am33xx_pm_remove(struct platform_device *pdev)
+ {
++	pm_runtime_put_sync(&pdev->dev);
++	pm_runtime_disable(&pdev->dev);
+ 	if (pm_ops->deinit)
+ 		pm_ops->deinit();
+ 	suspend_set_ops(NULL);
+-- 
+2.39.2
+
diff --git a/queue-5.10/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch b/queue-5.10/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch
new file mode 100644
index 00000000000..e48bcbab434
--- /dev/null
+++ b/queue-5.10/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch
@@ -0,0 +1,53 @@
+From 1735b26770a4841636b8f3474f7ae115c10b8761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 09:40:22 +0400
+Subject: soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 8f3c307b580a4a6425896007325bddefc36e8d91 ]
+
+wkup_m3_ipc_get() takes refcount, which should be freed by
+wkup_m3_ipc_put(). Add missing refcount release in the error paths.
+
+Fixes: 5a99ae0092fe ("soc: ti: pm33xx: AM437X: Add rtc_only with ddr in self-refresh support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20230106054022.947529-1-linmq006@gmail.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pm33xx.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/pm33xx.c b/drivers/soc/ti/pm33xx.c
+index 332588de22f3f..44ec0048911cd 100644
+--- a/drivers/soc/ti/pm33xx.c
++++ b/drivers/soc/ti/pm33xx.c
+@@ -529,7 +529,7 @@ static int am33xx_pm_probe(struct platform_device *pdev)
+ 
+ 	ret = am33xx_pm_alloc_sram();
+ 	if (ret)
+-		return ret;
++		goto err_wkup_m3_ipc_put;
+ 
+ 	ret = am33xx_pm_rtc_setup();
+ 	if (ret)
+@@ -576,13 +576,14 @@ static int am33xx_pm_probe(struct platform_device *pdev)
+ 	pm_runtime_put_sync(dev);
+ err_pm_runtime_disable:
+ 	pm_runtime_disable(dev);
+-	wkup_m3_ipc_put(m3_ipc);
+ err_unsetup_rtc:
+ 	iounmap(rtc_base_virt);
+ 	clk_put(rtc_fck);
+ err_free_sram:
+ 	am33xx_pm_free_sram();
+ 	pm33xx_dev = NULL;
++err_wkup_m3_ipc_put:
++	wkup_m3_ipc_put(m3_ipc);
+ 	return ret;
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch b/queue-5.10/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch
new file mode 100644
index 00000000000..15cfd660121
--- /dev/null
+++ b/queue-5.10/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch
@@ -0,0 +1,48 @@
+From 46ee0486aaf567c7373fccc71805fd84de0fca6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 17:46:15 +0530
+Subject: spi: bcm63xx: remove PM_SLEEP based conditional compilation
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 25f0617109496e1aff49594fbae5644286447a0f ]
+
+Get rid of conditional compilation based on CONFIG_PM_SLEEP because
+it may introduce build issues with certain configs where it maybe disabled
+This is because if above config is not enabled the suspend-resume
+functions are never part of the code but the bcm63xx_spi_pm_ops struct
+still inits them to non-existent suspend-resume functions.
+
+Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver")
+
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230420121615.967487-1-d-gole@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm63xx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
+index 96d075e633f43..a718ec50957f0 100644
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -626,7 +626,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
+-#ifdef CONFIG_PM_SLEEP
+ static int bcm63xx_spi_suspend(struct device *dev)
+ {
+ 	struct spi_master *master = dev_get_drvdata(dev);
+@@ -653,7 +652,6 @@ static int bcm63xx_spi_resume(struct device *dev)
+ 
+ 	return 0;
+ }
+-#endif
+ 
+ static const struct dev_pm_ops bcm63xx_spi_pm_ops = {
+ 	SET_SYSTEM_SLEEP_PM_OPS(bcm63xx_spi_suspend, bcm63xx_spi_resume)
+-- 
+2.39.2
+
diff --git a/queue-5.10/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch b/queue-5.10/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch
new file mode 100644
index 00000000000..dc1bcbfb3af
--- /dev/null
+++ b/queue-5.10/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch
@@ -0,0 +1,68 @@
+From 1b71a41a9f87ebca962530f435c9062eabaf67be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 14:40:27 +0530
+Subject: spi: cadence-quadspi: fix suspend-resume implementations
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 2087e85bb66ee3652dafe732bb9b9b896229eafc ]
+
+The cadence QSPI driver misbehaves after performing a full system suspend
+resume:
+...
+spi-nor spi0.0: resume() failed
+...
+This results in a flash connected via OSPI interface after system suspend-
+resume to be unusable.
+fix these suspend and resume functions.
+
+Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller")
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230417091027.966146-3-d-gole@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index 2e1255bf1b429..23d50a19ae271 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -1355,17 +1355,30 @@ static int cqspi_remove(struct platform_device *pdev)
+ static int cqspi_suspend(struct device *dev)
+ {
+ 	struct cqspi_st *cqspi = dev_get_drvdata(dev);
++	struct spi_master *master = dev_get_drvdata(dev);
++	int ret;
+ 
++	ret = spi_master_suspend(master);
+ 	cqspi_controller_enable(cqspi, 0);
+-	return 0;
++
++	clk_disable_unprepare(cqspi->clk);
++
++	return ret;
+ }
+ 
+ static int cqspi_resume(struct device *dev)
+ {
+ 	struct cqspi_st *cqspi = dev_get_drvdata(dev);
++	struct spi_master *master = dev_get_drvdata(dev);
+ 
+-	cqspi_controller_enable(cqspi, 1);
+-	return 0;
++	clk_prepare_enable(cqspi->clk);
++	cqspi_wait_idle(cqspi);
++	cqspi_controller_init(cqspi);
++
++	cqspi->current_cs = -1;
++	cqspi->sclk = 0;
++
++	return spi_master_resume(master);
+ }
+ 
+ static const struct dev_pm_ops cqspi__dev_pm_ops = {
+-- 
+2.39.2
+
diff --git a/queue-5.10/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch b/queue-5.10/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch
new file mode 100644
index 00000000000..4a7b7dd3bef
--- /dev/null
+++ b/queue-5.10/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch
@@ -0,0 +1,71 @@
+From e5c1b5f640e88213f15e41d06fb7092cab8a258d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Apr 2023 19:59:46 +0200
+Subject: spi: fsl-spi: Fix CPM/QE mode Litte Endian
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit c20c57d9868d7f9fd1b2904c7801b07e128f6322 ]
+
+CPM has the same problem as QE so for CPM also use the fix added
+by commit 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian"):
+
+  CPM mode uses Little Endian so words > 8 bits are byte swapped.
+  Workaround this by always enforcing wordsize 8 for 16 and 32 bits
+  words. Unfortunately this will not work for LSB transfers
+  where wordsize is > 8 bits so disable these for now.
+
+Also limit the workaround to 16 and 32 bits words because it can
+only work for multiples of 8-bits.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Joakim Tjernlund <Joakim.Tjernlund@infinera.com>
+Fixes: 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian")
+Link: https://lore.kernel.org/r/1b7d3e84b1128f42c1887dd2fb9cdf390f541bc1.1680371809.git.christophe.leroy@csgroup.eu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index bdf94cc7be1af..1bad0ceac81b4 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -207,8 +207,8 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ 				struct spi_device *spi,
+ 				int bits_per_word)
+ {
+-	/* QE uses Little Endian for words > 8
+-	 * so transform all words > 8 into 8 bits
++	/* CPM/QE uses Little Endian for words > 8
++	 * so transform 16 and 32 bits words into 8 bits
+ 	 * Unfortnatly that doesn't work for LSB so
+ 	 * reject these for now */
+ 	/* Note: 32 bits word, LSB works iff
+@@ -216,9 +216,11 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ 	if (spi->mode & SPI_LSB_FIRST &&
+ 	    bits_per_word > 8)
+ 		return -EINVAL;
+-	if (bits_per_word > 8)
++	if (bits_per_word <= 8)
++		return bits_per_word;
++	if (bits_per_word == 16 || bits_per_word == 32)
+ 		return 8; /* pretend its 8 bits */
+-	return bits_per_word;
++	return -EINVAL;
+ }
+ 
+ static int fsl_spi_setup_transfer(struct spi_device *spi,
+@@ -248,7 +250,7 @@ static int fsl_spi_setup_transfer(struct spi_device *spi,
+ 		bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi,
+ 							   mpc8xxx_spi,
+ 							   bits_per_word);
+-	else if (mpc8xxx_spi->flags & SPI_QE)
++	else
+ 		bits_per_word = mspi_apply_qe_mode_quirks(cs, spi,
+ 							  bits_per_word);
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch b/queue-5.10/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch
new file mode 100644
index 00000000000..3f0e74c151e
--- /dev/null
+++ b/queue-5.10/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch
@@ -0,0 +1,52 @@
+From ad709a75d71654aa4c922c47f50564b2537140b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 07:57:32 +0100
+Subject: spi: imx: Don't skip cleanup in remove's error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 11951c9e3f364d7ae3b568a0e52c8335d43066b5 ]
+
+Returning early in a platform driver's remove callback is wrong. In this
+case the dma resources are not released in the error path. this is never
+retried later and so this is a permanent leak. To fix this, only skip
+hardware disabling if waking the device fails.
+
+Fixes: d593574aff0a ("spi: imx: do not access registers while clocks disabled")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20230306065733.2170662-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 66b568de96af6..bbc420865f0fd 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -1764,13 +1764,11 @@ static int spi_imx_remove(struct platform_device *pdev)
+ 
+ 	spi_bitbang_stop(&spi_imx->bitbang);
+ 
+-	ret = pm_runtime_resume_and_get(spi_imx->dev);
+-	if (ret < 0) {
+-		dev_err(spi_imx->dev, "failed to enable clock\n");
+-		return ret;
+-	}
+-
+-	writel(0, spi_imx->base + MXC_CSPICTRL);
++	ret = pm_runtime_get_sync(spi_imx->dev);
++	if (ret >= 0)
++		writel(0, spi_imx->base + MXC_CSPICTRL);
++	else
++		dev_warn(spi_imx->dev, "failed to enable clock, skip hw disable\n");
+ 
+ 	pm_runtime_dont_use_autosuspend(spi_imx->dev);
+ 	pm_runtime_put_sync(spi_imx->dev);
+-- 
+2.39.2
+
diff --git a/queue-5.10/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch b/queue-5.10/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch
new file mode 100644
index 00000000000..17c74736347
--- /dev/null
+++ b/queue-5.10/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch
@@ -0,0 +1,65 @@
+From e056e4ae6047a4fe4f6fd8f5bf71fe750f35ca6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 23:03:40 +0200
+Subject: spi: qup: Don't skip cleanup in remove's error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 61f49171a43ab1f80c73c5c88c508770c461e0f2 ]
+
+Returning early in a platform driver's remove callback is wrong. In this
+case the dma resources are not released in the error path. this is never
+retried later and so this is a permanent leak. To fix this, only skip
+hardware disabling if waking the device fails.
+
+Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20230330210341.2459548-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-qup.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index f3877eeb3da65..8bf58510cca6d 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1276,18 +1276,22 @@ static int spi_qup_remove(struct platform_device *pdev)
+ 	struct spi_qup *controller = spi_master_get_devdata(master);
+ 	int ret;
+ 
+-	ret = pm_runtime_resume_and_get(&pdev->dev);
+-	if (ret < 0)
+-		return ret;
++	ret = pm_runtime_get_sync(&pdev->dev);
+ 
+-	ret = spi_qup_set_state(controller, QUP_STATE_RESET);
+-	if (ret)
+-		return ret;
++	if (ret >= 0) {
++		ret = spi_qup_set_state(controller, QUP_STATE_RESET);
++		if (ret)
++			dev_warn(&pdev->dev, "failed to reset controller (%pe)\n",
++				 ERR_PTR(ret));
+ 
+-	spi_qup_release_dma(master);
++		clk_disable_unprepare(controller->cclk);
++		clk_disable_unprepare(controller->iclk);
++	} else {
++		dev_warn(&pdev->dev, "failed to resume, skip hw disable (%pe)\n",
++			 ERR_PTR(ret));
++	}
+ 
+-	clk_disable_unprepare(controller->cclk);
+-	clk_disable_unprepare(controller->iclk);
++	spi_qup_release_dma(master);
+ 
+ 	pm_runtime_put_noidle(&pdev->dev);
+ 	pm_runtime_disable(&pdev->dev);
+-- 
+2.39.2
+
diff --git a/queue-5.10/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch b/queue-5.10/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch
new file mode 100644
index 00000000000..0e98a11ae66
--- /dev/null
+++ b/queue-5.10/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch
@@ -0,0 +1,53 @@
+From a8b5b38b58381db1cd0b8eea3e6e81e5dd5a33e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Apr 2022 08:53:42 +0000
+Subject: spi: spi-imx: using pm_runtime_resume_and_get instead of
+ pm_runtime_get_sync
+
+From: Minghao Chi <chi.minghao@zte.com.cn>
+
+[ Upstream commit 7d34ff58f35c82207698f43af79817a05e1342e5 ]
+
+Using pm_runtime_resume_and_get() to replace pm_runtime_get_sync and
+pm_runtime_put_noidle. This change is just to simplify the code, no
+actual functional changes.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Minghao Chi <chi.minghao@zte.com.cn>
+Link: https://lore.kernel.org/r/20220414085343.2541608-1-chi.minghao@zte.com.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 11951c9e3f36 ("spi: imx: Don't skip cleanup in remove's error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 74b3b6ca15efb..66b568de96af6 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -1554,9 +1554,8 @@ spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg)
+ 	struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+ 	int ret;
+ 
+-	ret = pm_runtime_get_sync(spi_imx->dev);
++	ret = pm_runtime_resume_and_get(spi_imx->dev);
+ 	if (ret < 0) {
+-		pm_runtime_put_noidle(spi_imx->dev);
+ 		dev_err(spi_imx->dev, "failed to enable clock\n");
+ 		return ret;
+ 	}
+@@ -1765,9 +1764,8 @@ static int spi_imx_remove(struct platform_device *pdev)
+ 
+ 	spi_bitbang_stop(&spi_imx->bitbang);
+ 
+-	ret = pm_runtime_get_sync(spi_imx->dev);
++	ret = pm_runtime_resume_and_get(spi_imx->dev);
+ 	if (ret < 0) {
+-		pm_runtime_put_noidle(spi_imx->dev);
+ 		dev_err(spi_imx->dev, "failed to enable clock\n");
+ 		return ret;
+ 	}
+-- 
+2.39.2
+
diff --git a/queue-5.10/spmi-add-a-check-for-remove-callback-when-removing-a.patch b/queue-5.10/spmi-add-a-check-for-remove-callback-when-removing-a.patch
new file mode 100644
index 00000000000..b83470ed4c4
--- /dev/null
+++ b/queue-5.10/spmi-add-a-check-for-remove-callback-when-removing-a.patch
@@ -0,0 +1,65 @@
+From 3e725bd9cf70e8f60f3d2990d13b31569fda723d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 15:38:34 -0700
+Subject: spmi: Add a check for remove callback when removing a SPMI driver
+
+From: Jishnu Prakash <quic_jprakash@quicinc.com>
+
+[ Upstream commit b56eef3e16d888883fefab47425036de80dd38fc ]
+
+When removing a SPMI driver, there can be a crash due to NULL pointer
+dereference if it does not have a remove callback defined. This is
+one such call trace observed when removing the QCOM SPMI PMIC driver:
+
+ dump_backtrace.cfi_jt+0x0/0x8
+ dump_stack_lvl+0xd8/0x16c
+ panic+0x188/0x498
+ __cfi_slowpath+0x0/0x214
+ __cfi_slowpath+0x1dc/0x214
+ spmi_drv_remove+0x16c/0x1e0
+ device_release_driver_internal+0x468/0x79c
+ driver_detach+0x11c/0x1a0
+ bus_remove_driver+0xc4/0x124
+ driver_unregister+0x58/0x84
+ cleanup_module+0x1c/0xc24 [qcom_spmi_pmic]
+ __do_sys_delete_module+0x3ec/0x53c
+ __arm64_sys_delete_module+0x18/0x28
+ el0_svc_common+0xdc/0x294
+ el0_svc+0x38/0x9c
+ el0_sync_handler+0x8c/0xf0
+ el0_sync+0x1b4/0x1c0
+
+If a driver has all its resources allocated through devm_() APIs and
+does not need any other explicit cleanup, it would not require a
+remove callback to be defined. Hence, add a check for remove callback
+presence before calling it when removing a SPMI driver.
+
+Link: https://lore.kernel.org/r/1671601032-18397-2-git-send-email-quic_jprakash@quicinc.com
+Fixes: 6f00f8c8635f ("mfd: qcom-spmi-pmic: Use devm_of_platform_populate()")
+Fixes: 5a86bf343976 ("spmi: Linux driver framework for SPMI")
+Signed-off-by: Jishnu Prakash <quic_jprakash@quicinc.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lore.kernel.org/r/20230413223834.4084793-7-sboyd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spmi/spmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
+index c16b60f645a4d..8ca7e004a53dc 100644
+--- a/drivers/spmi/spmi.c
++++ b/drivers/spmi/spmi.c
+@@ -348,7 +348,8 @@ static int spmi_drv_remove(struct device *dev)
+ 	const struct spmi_driver *sdrv = to_spmi_driver(dev->driver);
+ 
+ 	pm_runtime_get_sync(dev);
+-	sdrv->remove(to_spmi_device(dev));
++	if (sdrv->remove)
++		sdrv->remove(to_spmi_device(dev));
+ 	pm_runtime_put_noidle(dev);
+ 
+ 	pm_runtime_disable(dev);
+-- 
+2.39.2
+
diff --git a/queue-5.10/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch b/queue-5.10/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch
new file mode 100644
index 00000000000..3910fa40688
--- /dev/null
+++ b/queue-5.10/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch
@@ -0,0 +1,44 @@
+From 64042515bd532fd977df072cd7b7f90cd0409cfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 22:02:01 +0200
+Subject: staging: rtl8192e: Fix W_DISABLE# does not work after stop/start
+
+From: Philipp Hortmann <philipp.g.hortmann@gmail.com>
+
+[ Upstream commit 3fac2397f562eb669ddc2f45867a253f3fc26184 ]
+
+When loading the driver for rtl8192e, the W_DISABLE# switch is working as
+intended. But when the WLAN is turned off in software and then turned on
+again the W_DISABLE# does not work anymore. Reason for this is that in
+the function _rtl92e_dm_check_rf_ctrl_gpio() the bfirst_after_down is
+checked and returned when true. bfirst_after_down is set true when
+switching the WLAN off in software. But it is not set to false again
+when WLAN is turned on again.
+
+Add bfirst_after_down = false in _rtl92e_sta_up to reset bit and fix
+above described bug.
+
+Fixes: 94a799425eee ("From: wlanfae <wlanfae@realtek.com> [PATCH 1/8] rtl8192e: Import new version of driver from realtek")
+Signed-off-by: Philipp Hortmann <philipp.g.hortmann@gmail.com>
+Link: https://lore.kernel.org/r/20230418200201.GA17398@matrix-ESPRIMO-P710
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+index 99c27d6b42333..291f98251f7f7 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -770,6 +770,7 @@ static int _rtl92e_sta_up(struct net_device *dev, bool is_silent_reset)
+ 	else
+ 		netif_wake_queue(dev);
+ 
++	priv->bfirst_after_down = false;
+ 	return 0;
+ }
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch b/queue-5.10/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch
new file mode 100644
index 00000000000..334c3997c6d
--- /dev/null
+++ b/queue-5.10/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch
@@ -0,0 +1,74 @@
+From bd9dc8b1fe1b2ead0862f18ca803ac2ee94445c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 13:19:02 -0700
+Subject: SUNRPC: remove the maximum number of retries in call_bind_status
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+[ Upstream commit 691d0b782066a6eeeecbfceb7910a8f6184e6105 ]
+
+Currently call_bind_status places a hard limit of 3 to the number of
+retries on EACCES error. This limit was done to prevent NLM unlock
+requests from being hang forever when the server keeps returning garbage.
+However this change causes problem for cases when NLM service takes
+longer than 9 seconds to register with the port mapper after a restart.
+
+This patch removes this hard coded limit and let the RPC handles
+the retry based on the standard hard/soft task semantics.
+
+Fixes: 0b760113a3a1 ("NLM: Don't hang forever on NLM unlock requests")
+Reported-by: Helen Chao <helen.chao@oracle.com>
+Tested-by: Helen Chao <helen.chao@oracle.com>
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/sched.h | 3 +--
+ net/sunrpc/clnt.c            | 3 ---
+ net/sunrpc/sched.c           | 1 -
+ 3 files changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
+index df696efdd6753..256dff36cf720 100644
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -90,8 +90,7 @@ struct rpc_task {
+ #endif
+ 	unsigned char		tk_priority : 2,/* Task priority */
+ 				tk_garb_retry : 2,
+-				tk_cred_retry : 2,
+-				tk_rebind_retry : 2;
++				tk_cred_retry : 2;
+ };
+ 
+ typedef void			(*rpc_action)(struct rpc_task *);
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index c6e8bd78e35d6..e1ce0f261f0be 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1967,9 +1967,6 @@ call_bind_status(struct rpc_task *task)
+ 			status = -EOPNOTSUPP;
+ 			break;
+ 		}
+-		if (task->tk_rebind_retry == 0)
+-			break;
+-		task->tk_rebind_retry--;
+ 		rpc_delay(task, 3*HZ);
+ 		goto retry_timeout;
+ 	case -ENOBUFS:
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index f0f55fbd13752..a00890962e115 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -796,7 +796,6 @@ rpc_init_task_statistics(struct rpc_task *task)
+ 	/* Initialize retry counters */
+ 	task->tk_garb_retry = 2;
+ 	task->tk_cred_retry = 2;
+-	task->tk_rebind_retry = 2;
+ 
+ 	/* starting timestamp */
+ 	task->tk_start = ktime_get();
+-- 
+2.39.2
+
diff --git a/queue-5.10/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch b/queue-5.10/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch
new file mode 100644
index 00000000000..ca1926f1de1
--- /dev/null
+++ b/queue-5.10/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch
@@ -0,0 +1,125 @@
+From 494023ac2e4c96e186445e76ea362dd2206d399a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 15:20:22 -0700
+Subject: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 50749f2dd6854a41830996ad302aef2ffaf011d8 ]
+
+syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY
+skbs.  We can reproduce the problem with these sequences:
+
+  sk = socket(AF_INET, SOCK_DGRAM, 0)
+  sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE)
+  sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1)
+  sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53))
+  sk.close()
+
+sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets
+skb->cb->ubuf.refcnt to 1, and calls sock_hold().  Here, struct
+ubuf_info_msgzc indirectly holds a refcnt of the socket.  When the
+skb is sent, __skb_tstamp_tx() clones it and puts the clone into
+the socket's error queue with the TX timestamp.
+
+When the original skb is received locally, skb_copy_ubufs() calls
+skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt.
+This additional count is decremented while freeing the skb, but struct
+ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is
+not called.
+
+The last refcnt is not released unless we retrieve the TX timestamped
+skb by recvmsg().  Since we clear the error queue in inet_sock_destruct()
+after the socket's refcnt reaches 0, there is a circular dependency.
+If we close() the socket holding such skbs, we never call sock_put()
+and leak the count, sk, and skb.
+
+TCP has the same problem, and commit e0c8bccd40fc ("net: stream:
+purge sk_error_queue in sk_stream_kill_queues()") tried to fix it
+by calling skb_queue_purge() during close().  However, there is a
+small chance that skb queued in a qdisc or device could be put
+into the error queue after the skb_queue_purge() call.
+
+In __skb_tstamp_tx(), the cloned skb should not have a reference
+to the ubuf to remove the circular dependency, but skb_clone() does
+not call skb_copy_ubufs() for zerocopy skb.  So, we need to call
+skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs().
+
+[0]:
+BUG: memory leak
+unreferenced object 0xffff88800c6d2d00 (size 1152):
+  comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s)
+  hex dump (first 32 bytes):
+    00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00  ................
+    02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
+  backtrace:
+    [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024
+    [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083
+    [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline]
+    [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245
+    [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515
+    [<00000000b9b11231>] sock_create net/socket.c:1566 [inline]
+    [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline]
+    [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline]
+    [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636
+    [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline]
+    [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline]
+    [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647
+    [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+    [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+    [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+BUG: memory leak
+unreferenced object 0xffff888017633a00 (size 240):
+  comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s)
+  hex dump (first 32 bytes):
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+    00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff  .........-m.....
+  backtrace:
+    [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497
+    [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline]
+    [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596
+    [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline]
+    [<00000000be626478>] msg_zerocopy_realloc+0x1ce/0x7f0 net/core/skbuff.c:1370
+    [<00000000cbfc9870>] __ip_append_data+0x2adf/0x3b30 net/ipv4/ip_output.c:1037
+    [<0000000089869146>] ip_make_skb+0x26c/0x2e0 net/ipv4/ip_output.c:1652
+    [<00000000098015c2>] udp_sendmsg+0x1bac/0x2390 net/ipv4/udp.c:1253
+    [<0000000045e0e95e>] inet_sendmsg+0x10a/0x150 net/ipv4/af_inet.c:819
+    [<000000008d31bfde>] sock_sendmsg_nosec net/socket.c:714 [inline]
+    [<000000008d31bfde>] sock_sendmsg+0x141/0x190 net/socket.c:734
+    [<0000000021e21aa4>] __sys_sendto+0x243/0x360 net/socket.c:2117
+    [<00000000ac0af00c>] __do_sys_sendto net/socket.c:2129 [inline]
+    [<00000000ac0af00c>] __se_sys_sendto net/socket.c:2125 [inline]
+    [<00000000ac0af00c>] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2125
+    [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+    [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+    [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY")
+Fixes: b5947e5d1e71 ("udp: msg_zerocopy")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 09cdefe5e1c83..fb6b3f2ae1921 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4750,6 +4750,9 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
+ 			skb = alloc_skb(0, GFP_ATOMIC);
+ 	} else {
+ 		skb = skb_clone(orig_skb, GFP_ATOMIC);
++
++		if (skb_orphan_frags_rx(skb, GFP_ATOMIC))
++			return;
+ 	}
+ 	if (!skb)
+ 		return;
+-- 
+2.39.2
+
diff --git a/queue-5.10/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch b/queue-5.10/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch
new file mode 100644
index 00000000000..1271cf00658
--- /dev/null
+++ b/queue-5.10/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch
@@ -0,0 +1,63 @@
+From 865e1980fc52a7ceb385fcea0896f1c91db142b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 10:07:48 +0800
+Subject: thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in
+ mtk_thermal_probe
+
+From: Kang Chen <void0red@hust.edu.cn>
+
+[ Upstream commit f05c7b7d9ea9477fcc388476c6f4ade8c66d2d26 ]
+
+Smatch reports:
+1. mtk_thermal_probe() warn: 'apmixed_base' from of_iomap() not released.
+2. mtk_thermal_probe() warn: 'auxadc_base' from of_iomap() not released.
+
+The original code forgets to release iomap resource when handling errors,
+fix it by switch to devm_of_iomap.
+
+Fixes: 89945047b166 ("thermal: mediatek: Add tsensor support for V2 thermal system")
+Signed-off-by: Kang Chen <void0red@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20230419020749.621257-1-void0red@hust.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/mtk_thermal.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
+index 0bd7aa564bc25..9fe169dbed887 100644
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -1026,7 +1026,12 @@ static int mtk_thermal_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 	}
+ 
+-	auxadc_base = of_iomap(auxadc, 0);
++	auxadc_base = devm_of_iomap(&pdev->dev, auxadc, 0, NULL);
++	if (IS_ERR(auxadc_base)) {
++		of_node_put(auxadc);
++		return PTR_ERR(auxadc_base);
++	}
++
+ 	auxadc_phys_base = of_get_phys_base(auxadc);
+ 
+ 	of_node_put(auxadc);
+@@ -1042,7 +1047,12 @@ static int mtk_thermal_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 	}
+ 
+-	apmixed_base = of_iomap(apmixedsys, 0);
++	apmixed_base = devm_of_iomap(&pdev->dev, apmixedsys, 0, NULL);
++	if (IS_ERR(apmixed_base)) {
++		of_node_put(apmixedsys);
++		return PTR_ERR(apmixed_base);
++	}
++
+ 	apmixed_phys_base = of_get_phys_base(apmixedsys);
+ 
+ 	of_node_put(apmixedsys);
+-- 
+2.39.2
+
diff --git a/queue-5.10/tick-common-align-tick-period-with-the-hz-tick.patch b/queue-5.10/tick-common-align-tick-period-with-the-hz-tick.patch
new file mode 100644
index 00000000000..3409884d93d
--- /dev/null
+++ b/queue-5.10/tick-common-align-tick-period-with-the-hz-tick.patch
@@ -0,0 +1,67 @@
+From 1eb15f90df7e4dc7883849c6d0fc9bafb5e635c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 14:26:39 +0200
+Subject: tick/common: Align tick period with the HZ tick.
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit e9523a0d81899361214d118ad60ef76f0e92f71d ]
+
+With HIGHRES enabled tick_sched_timer() is programmed every jiffy to
+expire the timer_list timers. This timer is programmed accurate in
+respect to CLOCK_MONOTONIC so that 0 seconds and nanoseconds is the
+first tick and the next one is 1000/CONFIG_HZ ms later. For HZ=250 it is
+every 4 ms and so based on the current time the next tick can be
+computed.
+
+This accuracy broke since the commit mentioned below because the jiffy
+based clocksource is initialized with higher accuracy in
+read_persistent_wall_and_boot_offset(). This higher accuracy is
+inherited during the setup in tick_setup_device(). The timer still fires
+every 4ms with HZ=250 but timer is no longer aligned with
+CLOCK_MONOTONIC with 0 as it origin but has an offset in the us/ns part
+of the timestamp. The offset differs with every boot and makes it
+impossible for user land to align with the tick.
+
+Align the tick period with CLOCK_MONOTONIC ensuring that it is always a
+multiple of 1000/CONFIG_HZ ms.
+
+Fixes: 857baa87b6422 ("sched/clock: Enable sched clock early")
+Reported-by: Gusenleitner Klaus <gus@keba.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/20230406095735.0_14edn3@linutronix.de
+Link: https://lore.kernel.org/r/20230418122639.ikgfvu3f@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-common.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 92bf99d558b48..2b7448ae5b478 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -216,9 +216,19 @@ static void tick_setup_device(struct tick_device *td,
+ 		 * this cpu:
+ 		 */
+ 		if (tick_do_timer_cpu == TICK_DO_TIMER_BOOT) {
++			ktime_t next_p;
++			u32 rem;
++
+ 			tick_do_timer_cpu = cpu;
+ 
+-			tick_next_period = ktime_get();
++			next_p = ktime_get();
++			div_u64_rem(next_p, TICK_NSEC, &rem);
++			if (rem) {
++				next_p -= rem;
++				next_p += TICK_NSEC;
++			}
++
++			tick_next_period = next_p;
+ #ifdef CONFIG_NO_HZ_FULL
+ 			/*
+ 			 * The boot CPU may be nohz_full, in which case set
+-- 
+2.39.2
+
diff --git a/queue-5.10/tick-get-rid-of-tick_period.patch b/queue-5.10/tick-get-rid-of-tick_period.patch
new file mode 100644
index 00000000000..58d0a2ed923
--- /dev/null
+++ b/queue-5.10/tick-get-rid-of-tick_period.patch
@@ -0,0 +1,192 @@
+From 7b4e3f0ff79a9532603265ea1aa9fd74123eb494 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:19:49 +0100
+Subject: tick: Get rid of tick_period
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit b996544916429946bf4934c1c01a306d1690972c ]
+
+The variable tick_period is initialized to NSEC_PER_TICK / HZ during boot
+and never updated again.
+
+If NSEC_PER_TICK is not an integer multiple of HZ this computation is less
+accurate than TICK_NSEC which has proper rounding in place.
+
+Aside of the inaccuracy there is no reason for having this variable at
+all. It's just a pointless indirection and all usage sites can just use the
+TICK_NSEC constant.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201117132006.766643526@linutronix.de
+Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-broadcast.c |  2 +-
+ kernel/time/tick-common.c    |  8 +++-----
+ kernel/time/tick-internal.h  |  1 -
+ kernel/time/tick-sched.c     | 22 +++++++++++-----------
+ 4 files changed, 15 insertions(+), 18 deletions(-)
+
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index 36d7464c89625..a9530e866e5f1 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -331,7 +331,7 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
+ 	bc_local = tick_do_periodic_broadcast();
+ 
+ 	if (clockevent_state_oneshot(dev)) {
+-		ktime_t next = ktime_add(dev->next_event, tick_period);
++		ktime_t next = ktime_add_ns(dev->next_event, TICK_NSEC);
+ 
+ 		clockevents_program_event(dev, next, true);
+ 	}
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 6c9c342dd0e53..92bf99d558b48 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -30,7 +30,6 @@ DEFINE_PER_CPU(struct tick_device, tick_cpu_device);
+  * Tick next event: keeps track of the tick time
+  */
+ ktime_t tick_next_period;
+-ktime_t tick_period;
+ 
+ /*
+  * tick_do_timer_cpu is a timer core internal variable which holds the CPU NR
+@@ -88,7 +87,7 @@ static void tick_periodic(int cpu)
+ 		write_seqcount_begin(&jiffies_seq);
+ 
+ 		/* Keep track of the next tick event */
+-		tick_next_period = ktime_add(tick_next_period, tick_period);
++		tick_next_period = ktime_add_ns(tick_next_period, TICK_NSEC);
+ 
+ 		do_timer(1);
+ 		write_seqcount_end(&jiffies_seq);
+@@ -127,7 +126,7 @@ void tick_handle_periodic(struct clock_event_device *dev)
+ 		 * Setup the next period for devices, which do not have
+ 		 * periodic mode:
+ 		 */
+-		next = ktime_add(next, tick_period);
++		next = ktime_add_ns(next, TICK_NSEC);
+ 
+ 		if (!clockevents_program_event(dev, next, false))
+ 			return;
+@@ -173,7 +172,7 @@ void tick_setup_periodic(struct clock_event_device *dev, int broadcast)
+ 		for (;;) {
+ 			if (!clockevents_program_event(dev, next, false))
+ 				return;
+-			next = ktime_add(next, tick_period);
++			next = ktime_add_ns(next, TICK_NSEC);
+ 		}
+ 	}
+ }
+@@ -220,7 +219,6 @@ static void tick_setup_device(struct tick_device *td,
+ 			tick_do_timer_cpu = cpu;
+ 
+ 			tick_next_period = ktime_get();
+-			tick_period = NSEC_PER_SEC / HZ;
+ #ifdef CONFIG_NO_HZ_FULL
+ 			/*
+ 			 * The boot CPU may be nohz_full, in which case set
+diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
+index 5294f5b1f9550..e61c1244e7d46 100644
+--- a/kernel/time/tick-internal.h
++++ b/kernel/time/tick-internal.h
+@@ -15,7 +15,6 @@
+ 
+ DECLARE_PER_CPU(struct tick_device, tick_cpu_device);
+ extern ktime_t tick_next_period;
+-extern ktime_t tick_period;
+ extern int tick_do_timer_cpu __read_mostly;
+ 
+ extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast);
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 5c3d4355266db..17dc3f53efef8 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -92,17 +92,17 @@ static void tick_do_update_jiffies64(ktime_t now)
+ 	write_seqcount_begin(&jiffies_seq);
+ 
+ 	delta = ktime_sub(now, tick_next_period);
+-	if (unlikely(delta >= tick_period)) {
++	if (unlikely(delta >= TICK_NSEC)) {
+ 		/* Slow path for long idle sleep times */
+-		s64 incr = ktime_to_ns(tick_period);
++		s64 incr = TICK_NSEC;
+ 
+ 		ticks += ktime_divns(delta, incr);
+ 
+ 		last_jiffies_update = ktime_add_ns(last_jiffies_update,
+ 						   incr * ticks);
+ 	} else {
+-		last_jiffies_update = ktime_add(last_jiffies_update,
+-						tick_period);
++		last_jiffies_update = ktime_add_ns(last_jiffies_update,
++						   TICK_NSEC);
+ 	}
+ 
+ 	do_timer(ticks);
+@@ -112,7 +112,7 @@ static void tick_do_update_jiffies64(ktime_t now)
+ 	 * pairs with the READ_ONCE() in the lockless quick check above.
+ 	 */
+ 	WRITE_ONCE(tick_next_period,
+-		   ktime_add(last_jiffies_update, tick_period));
++		   ktime_add_ns(last_jiffies_update, TICK_NSEC));
+ 
+ 	write_seqcount_end(&jiffies_seq);
+ 	raw_spin_unlock(&jiffies_lock);
+@@ -688,7 +688,7 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now)
+ 	hrtimer_set_expires(&ts->sched_timer, ts->last_tick);
+ 
+ 	/* Forward the time to expire in the future */
+-	hrtimer_forward(&ts->sched_timer, now, tick_period);
++	hrtimer_forward(&ts->sched_timer, now, TICK_NSEC);
+ 
+ 	if (ts->nohz_mode == NOHZ_MODE_HIGHRES) {
+ 		hrtimer_start_expires(&ts->sched_timer,
+@@ -1250,7 +1250,7 @@ static void tick_nohz_handler(struct clock_event_device *dev)
+ 	if (unlikely(ts->tick_stopped))
+ 		return;
+ 
+-	hrtimer_forward(&ts->sched_timer, now, tick_period);
++	hrtimer_forward(&ts->sched_timer, now, TICK_NSEC);
+ 	tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1);
+ }
+ 
+@@ -1287,7 +1287,7 @@ static void tick_nohz_switch_to_nohz(void)
+ 	next = tick_init_jiffy_update();
+ 
+ 	hrtimer_set_expires(&ts->sched_timer, next);
+-	hrtimer_forward_now(&ts->sched_timer, tick_period);
++	hrtimer_forward_now(&ts->sched_timer, TICK_NSEC);
+ 	tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1);
+ 	tick_nohz_activate(ts, NOHZ_MODE_LOWRES);
+ }
+@@ -1353,7 +1353,7 @@ static enum hrtimer_restart tick_sched_timer(struct hrtimer *timer)
+ 	if (unlikely(ts->tick_stopped))
+ 		return HRTIMER_NORESTART;
+ 
+-	hrtimer_forward(timer, now, tick_period);
++	hrtimer_forward(timer, now, TICK_NSEC);
+ 
+ 	return HRTIMER_RESTART;
+ }
+@@ -1387,13 +1387,13 @@ void tick_setup_sched_timer(void)
+ 
+ 	/* Offset the tick to avert jiffies_lock contention. */
+ 	if (sched_skew_tick) {
+-		u64 offset = ktime_to_ns(tick_period) >> 1;
++		u64 offset = TICK_NSEC >> 1;
+ 		do_div(offset, num_possible_cpus());
+ 		offset *= smp_processor_id();
+ 		hrtimer_add_expires_ns(&ts->sched_timer, offset);
+ 	}
+ 
+-	hrtimer_forward(&ts->sched_timer, now, tick_period);
++	hrtimer_forward(&ts->sched_timer, now, TICK_NSEC);
+ 	hrtimer_start_expires(&ts->sched_timer, HRTIMER_MODE_ABS_PINNED_HARD);
+ 	tick_nohz_activate(ts, NOHZ_MODE_HIGHRES);
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/tick-sched-optimize-tick_do_update_jiffies64-further.patch b/queue-5.10/tick-sched-optimize-tick_do_update_jiffies64-further.patch
new file mode 100644
index 00000000000..5ba4cadfe2d
--- /dev/null
+++ b/queue-5.10/tick-sched-optimize-tick_do_update_jiffies64-further.patch
@@ -0,0 +1,62 @@
+From 1d489a2000cd30998f3b70572ab7f7d1143418c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:19:47 +0100
+Subject: tick/sched: Optimize tick_do_update_jiffies64() further
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 7a35bf2a6a871cd0252cd371d741e7d070b53af9 ]
+
+Now that it's clear that there is always one tick to account, simplify the
+calculations some more.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201117132006.565663056@linutronix.de
+Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-sched.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index ac9953f6f92ce..5c3d4355266db 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -53,7 +53,7 @@ static ktime_t last_jiffies_update;
+  */
+ static void tick_do_update_jiffies64(ktime_t now)
+ {
+-	unsigned long ticks = 0;
++	unsigned long ticks = 1;
+ 	ktime_t delta;
+ 
+ 	/*
+@@ -91,20 +91,21 @@ static void tick_do_update_jiffies64(ktime_t now)
+ 
+ 	write_seqcount_begin(&jiffies_seq);
+ 
+-	last_jiffies_update = ktime_add(last_jiffies_update, tick_period);
+-
+ 	delta = ktime_sub(now, tick_next_period);
+ 	if (unlikely(delta >= tick_period)) {
+ 		/* Slow path for long idle sleep times */
+ 		s64 incr = ktime_to_ns(tick_period);
+ 
+-		ticks = ktime_divns(delta, incr);
++		ticks += ktime_divns(delta, incr);
+ 
+ 		last_jiffies_update = ktime_add_ns(last_jiffies_update,
+ 						   incr * ticks);
++	} else {
++		last_jiffies_update = ktime_add(last_jiffies_update,
++						tick_period);
+ 	}
+ 
+-	do_timer(++ticks);
++	do_timer(ticks);
+ 
+ 	/*
+ 	 * Keep the tick_next_period variable up to date.  WRITE_ONCE()
+-- 
+2.39.2
+
diff --git a/queue-5.10/tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch b/queue-5.10/tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch
new file mode 100644
index 00000000000..ebf9946fe79
--- /dev/null
+++ b/queue-5.10/tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch
@@ -0,0 +1,95 @@
+From 12bbe7f697c74348f271f9282c570a3362750a99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:19:46 +0100
+Subject: tick/sched: Reduce seqcount held scope in tick_do_update_jiffies64()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit 94ad2e3cedb82af034f6d97c58022f162b669f9b ]
+
+If jiffies are up to date already (caller lost the race against another
+CPU) there is no point to change the sequence count. Doing that just forces
+other CPUs into the seqcount retry loop in tick_nohz_next_event() for
+nothing.
+
+Just bail out early.
+
+[ tglx: Rewrote most of it ]
+
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201117132006.462195901@linutronix.de
+Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-sched.c | 47 +++++++++++++++++++---------------------
+ 1 file changed, 22 insertions(+), 25 deletions(-)
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 4f1b6170b3a20..ac9953f6f92ce 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -84,38 +84,35 @@ static void tick_do_update_jiffies64(ktime_t now)
+ 
+ 	/* Reevaluate with jiffies_lock held */
+ 	raw_spin_lock(&jiffies_lock);
++	if (ktime_before(now, tick_next_period)) {
++		raw_spin_unlock(&jiffies_lock);
++		return;
++	}
++
+ 	write_seqcount_begin(&jiffies_seq);
+ 
+-	delta = ktime_sub(now, last_jiffies_update);
+-	if (delta >= tick_period) {
++	last_jiffies_update = ktime_add(last_jiffies_update, tick_period);
+ 
+-		delta = ktime_sub(delta, tick_period);
+-		last_jiffies_update = ktime_add(last_jiffies_update,
+-						tick_period);
++	delta = ktime_sub(now, tick_next_period);
++	if (unlikely(delta >= tick_period)) {
++		/* Slow path for long idle sleep times */
++		s64 incr = ktime_to_ns(tick_period);
+ 
+-		/* Slow path for long timeouts */
+-		if (unlikely(delta >= tick_period)) {
+-			s64 incr = ktime_to_ns(tick_period);
++		ticks = ktime_divns(delta, incr);
+ 
+-			ticks = ktime_divns(delta, incr);
++		last_jiffies_update = ktime_add_ns(last_jiffies_update,
++						   incr * ticks);
++	}
+ 
+-			last_jiffies_update = ktime_add_ns(last_jiffies_update,
+-							   incr * ticks);
+-		}
+-		do_timer(++ticks);
++	do_timer(++ticks);
++
++	/*
++	 * Keep the tick_next_period variable up to date.  WRITE_ONCE()
++	 * pairs with the READ_ONCE() in the lockless quick check above.
++	 */
++	WRITE_ONCE(tick_next_period,
++		   ktime_add(last_jiffies_update, tick_period));
+ 
+-		/*
+-		 * Keep the tick_next_period variable up to date.
+-		 * WRITE_ONCE() pairs with the READ_ONCE() in the lockless
+-		 * quick check above.
+-		 */
+-		WRITE_ONCE(tick_next_period,
+-			   ktime_add(last_jiffies_update, tick_period));
+-	} else {
+-		write_seqcount_end(&jiffies_seq);
+-		raw_spin_unlock(&jiffies_lock);
+-		return;
+-	}
+ 	write_seqcount_end(&jiffies_seq);
+ 	raw_spin_unlock(&jiffies_lock);
+ 	update_wall_time();
+-- 
+2.39.2
+
diff --git a/queue-5.10/tick-sched-use-tick_next_period-for-lockless-quick-c.patch b/queue-5.10/tick-sched-use-tick_next_period-for-lockless-quick-c.patch
new file mode 100644
index 00000000000..35b6a69c53d
--- /dev/null
+++ b/queue-5.10/tick-sched-use-tick_next_period-for-lockless-quick-c.patch
@@ -0,0 +1,105 @@
+From 568273b55a09fcdffe663c3bf337d392b084760f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:19:45 +0100
+Subject: tick/sched: Use tick_next_period for lockless quick check
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 372acbbaa80940189593f9d69c7c069955f24f7a ]
+
+No point in doing calculations.
+
+   tick_next_period = last_jiffies_update + tick_period
+
+Just check whether now is before tick_next_period to figure out whether
+jiffies need an update.
+
+Add a comment why the intentional data race in the quick check is safe or
+not so safe in a 32bit corner case and why we don't worry about it.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201117132006.337366695@linutronix.de
+Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-sched.c | 46 ++++++++++++++++++++++++++++------------
+ 1 file changed, 33 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 378096fc8c560..4f1b6170b3a20 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -57,11 +57,29 @@ static void tick_do_update_jiffies64(ktime_t now)
+ 	ktime_t delta;
+ 
+ 	/*
+-	 * Do a quick check without holding jiffies_lock:
+-	 * The READ_ONCE() pairs with two updates done later in this function.
++	 * Do a quick check without holding jiffies_lock. The READ_ONCE()
++	 * pairs with the update done later in this function.
++	 *
++	 * This is also an intentional data race which is even safe on
++	 * 32bit in theory. If there is a concurrent update then the check
++	 * might give a random answer. It does not matter because if it
++	 * returns then the concurrent update is already taking care, if it
++	 * falls through then it will pointlessly contend on jiffies_lock.
++	 *
++	 * Though there is one nasty case on 32bit due to store tearing of
++	 * the 64bit value. If the first 32bit store makes the quick check
++	 * return on all other CPUs and the writing CPU context gets
++	 * delayed to complete the second store (scheduled out on virt)
++	 * then jiffies can become stale for up to ~2^32 nanoseconds
++	 * without noticing. After that point all CPUs will wait for
++	 * jiffies lock.
++	 *
++	 * OTOH, this is not any different than the situation with NOHZ=off
++	 * where one CPU is responsible for updating jiffies and
++	 * timekeeping. If that CPU goes out for lunch then all other CPUs
++	 * will operate on stale jiffies until it decides to come back.
+ 	 */
+-	delta = ktime_sub(now, READ_ONCE(last_jiffies_update));
+-	if (delta < tick_period)
++	if (ktime_before(now, READ_ONCE(tick_next_period)))
+ 		return;
+ 
+ 	/* Reevaluate with jiffies_lock held */
+@@ -72,9 +90,8 @@ static void tick_do_update_jiffies64(ktime_t now)
+ 	if (delta >= tick_period) {
+ 
+ 		delta = ktime_sub(delta, tick_period);
+-		/* Pairs with the lockless read in this function. */
+-		WRITE_ONCE(last_jiffies_update,
+-			   ktime_add(last_jiffies_update, tick_period));
++		last_jiffies_update = ktime_add(last_jiffies_update,
++						tick_period);
+ 
+ 		/* Slow path for long timeouts */
+ 		if (unlikely(delta >= tick_period)) {
+@@ -82,15 +99,18 @@ static void tick_do_update_jiffies64(ktime_t now)
+ 
+ 			ticks = ktime_divns(delta, incr);
+ 
+-			/* Pairs with the lockless read in this function. */
+-			WRITE_ONCE(last_jiffies_update,
+-				   ktime_add_ns(last_jiffies_update,
+-						incr * ticks));
++			last_jiffies_update = ktime_add_ns(last_jiffies_update,
++							   incr * ticks);
+ 		}
+ 		do_timer(++ticks);
+ 
+-		/* Keep the tick_next_period variable up to date */
+-		tick_next_period = ktime_add(last_jiffies_update, tick_period);
++		/*
++		 * Keep the tick_next_period variable up to date.
++		 * WRITE_ONCE() pairs with the READ_ONCE() in the lockless
++		 * quick check above.
++		 */
++		WRITE_ONCE(tick_next_period,
++			   ktime_add(last_jiffies_update, tick_period));
+ 	} else {
+ 		write_seqcount_end(&jiffies_seq);
+ 		raw_spin_unlock(&jiffies_lock);
+-- 
+2.39.2
+
diff --git a/queue-5.10/tools-bpftool-remove-invalid-json-escape.patch b/queue-5.10/tools-bpftool-remove-invalid-json-escape.patch
new file mode 100644
index 00000000000..648939b7ed1
--- /dev/null
+++ b/queue-5.10/tools-bpftool-remove-invalid-json-escape.patch
@@ -0,0 +1,53 @@
+From 7a8234315a802d278f66980cc24ad6b21b573167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 16:08:54 +0100
+Subject: tools: bpftool: Remove invalid \' json escape
+
+From: Luis Gerhorst <gerhorst@cs.fau.de>
+
+[ Upstream commit c679bbd611c08b0559ffae079330bc4e5574696a ]
+
+RFC8259 ("The JavaScript Object Notation (JSON) Data Interchange
+Format") only specifies \", \\, \/, \b, \f, \n, \r, and \r as valid
+two-character escape sequences. This does not include \', which is not
+required in JSON because it exclusively uses double quotes as string
+separators.
+
+Solidus (/) may be escaped, but does not have to. Only reverse
+solidus (\), double quotes ("), and the control characters have to be
+escaped. Therefore, with this fix, bpftool correctly supports all valid
+two-character escape sequences (but still does not support characters
+that require multi-character escape sequences).
+
+Witout this fix, attempting to load a JSON file generated by bpftool
+using Python 3.10.6's default json.load() may fail with the error
+"Invalid \escape" if the file contains the invalid escaped single
+quote (\').
+
+Fixes: b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository")
+Signed-off-by: Luis Gerhorst <gerhorst@cs.fau.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20230227150853.16863-1-gerhorst@cs.fau.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/json_writer.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c
+index 7fea83bedf488..bca5dd0a59e34 100644
+--- a/tools/bpf/bpftool/json_writer.c
++++ b/tools/bpf/bpftool/json_writer.c
+@@ -80,9 +80,6 @@ static void jsonw_puts(json_writer_t *self, const char *str)
+ 		case '"':
+ 			fputs("\\\"", self->out);
+ 			break;
+-		case '\'':
+-			fputs("\\\'", self->out);
+-			break;
+ 		default:
+ 			putc(*str, self->out);
+ 		}
+-- 
+2.39.2
+
diff --git a/queue-5.10/tpm-tpm-implement-usage-counter-for-locality.patch b/queue-5.10/tpm-tpm-implement-usage-counter-for-locality.patch
new file mode 100644
index 00000000000..c144b4c5b0a
--- /dev/null
+++ b/queue-5.10/tpm-tpm-implement-usage-counter-for-locality.patch
@@ -0,0 +1,235 @@
+From fe925b612e06592e1547e8126314e8c8906d2f07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:33 +0100
+Subject: tpm, tpm: Implement usage counter for locality
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 7a2f55d0be296c4e81fd782f3d6c43ed4ec7e265 ]
+
+Implement a usage counter for the (default) locality used by the TPM TIS
+driver:
+Request the locality from the TPM if it has not been claimed yet, otherwise
+only increment the counter. Also release the locality if the counter is 0
+otherwise only decrement the counter. Since in case of SPI the register
+accesses are locked by means of the SPI bus mutex use a sleepable lock
+(i.e. also a mutex) to ensure thread-safety of the counter which may be
+accessed by both a userspace thread and the interrupt handler.
+
+By doing this refactor the names of the amended functions to use a more
+appropriate prefix.
+
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Michael Niewöhner <linux@mniewoehner.de>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 63 +++++++++++++++++++++++----------
+ drivers/char/tpm/tpm_tis_core.h |  2 ++
+ 2 files changed, 47 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 52826a7edf800..3ea0fff30273e 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -136,16 +136,27 @@ static bool check_locality(struct tpm_chip *chip, int l)
+ 	return false;
+ }
+ 
+-static int release_locality(struct tpm_chip *chip, int l)
++static int __tpm_tis_relinquish_locality(struct tpm_tis_data *priv, int l)
++{
++	tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
++
++	return 0;
++}
++
++static int tpm_tis_relinquish_locality(struct tpm_chip *chip, int l)
+ {
+ 	struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+ 
+-	tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
++	mutex_lock(&priv->locality_count_mutex);
++	priv->locality_count--;
++	if (priv->locality_count == 0)
++		__tpm_tis_relinquish_locality(priv, l);
++	mutex_unlock(&priv->locality_count_mutex);
+ 
+ 	return 0;
+ }
+ 
+-static int request_locality(struct tpm_chip *chip, int l)
++static int __tpm_tis_request_locality(struct tpm_chip *chip, int l)
+ {
+ 	struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+ 	unsigned long stop, timeout;
+@@ -186,6 +197,20 @@ static int request_locality(struct tpm_chip *chip, int l)
+ 	return -1;
+ }
+ 
++static int tpm_tis_request_locality(struct tpm_chip *chip, int l)
++{
++	struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
++	int ret = 0;
++
++	mutex_lock(&priv->locality_count_mutex);
++	if (priv->locality_count == 0)
++		ret = __tpm_tis_request_locality(chip, l);
++	if (!ret)
++		priv->locality_count++;
++	mutex_unlock(&priv->locality_count_mutex);
++	return ret;
++}
++
+ static u8 tpm_tis_status(struct tpm_chip *chip)
+ {
+ 	struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+@@ -638,7 +663,7 @@ static int probe_itpm(struct tpm_chip *chip)
+ 	if (vendor != TPM_VID_INTEL)
+ 		return 0;
+ 
+-	if (request_locality(chip, 0) != 0)
++	if (tpm_tis_request_locality(chip, 0) != 0)
+ 		return -EBUSY;
+ 
+ 	rc = tpm_tis_send_data(chip, cmd_getticks, len);
+@@ -659,7 +684,7 @@ static int probe_itpm(struct tpm_chip *chip)
+ 
+ out:
+ 	tpm_tis_ready(chip);
+-	release_locality(chip, priv->locality);
++	tpm_tis_relinquish_locality(chip, priv->locality);
+ 
+ 	return rc;
+ }
+@@ -747,14 +772,14 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ 	}
+ 	priv->irq = irq;
+ 
+-	rc = request_locality(chip, 0);
++	rc = tpm_tis_request_locality(chip, 0);
+ 	if (rc < 0)
+ 		return rc;
+ 
+ 	rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality),
+ 			   &original_int_vec);
+ 	if (rc < 0) {
+-		release_locality(chip, priv->locality);
++		tpm_tis_relinquish_locality(chip, priv->locality);
+ 		return rc;
+ 	}
+ 
+@@ -793,7 +818,7 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ 		rc = -1;
+ 	}
+ 
+-	release_locality(chip, priv->locality);
++	tpm_tis_relinquish_locality(chip, priv->locality);
+ 
+ 	return rc;
+ }
+@@ -909,8 +934,8 @@ static const struct tpm_class_ops tpm_tis = {
+ 	.req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+ 	.req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+ 	.req_canceled = tpm_tis_req_canceled,
+-	.request_locality = request_locality,
+-	.relinquish_locality = release_locality,
++	.request_locality = tpm_tis_request_locality,
++	.relinquish_locality = tpm_tis_relinquish_locality,
+ 	.clk_enable = tpm_tis_clkrun_enable,
+ };
+ 
+@@ -944,6 +969,8 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ 	priv->timeout_min = TPM_TIMEOUT_USECS_MIN;
+ 	priv->timeout_max = TPM_TIMEOUT_USECS_MAX;
+ 	priv->phy_ops = phy_ops;
++	priv->locality_count = 0;
++	mutex_init(&priv->locality_count_mutex);
+ 
+ 	dev_set_drvdata(&chip->dev, priv);
+ 
+@@ -990,14 +1017,14 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ 		   TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT;
+ 	intmask &= ~TPM_GLOBAL_INT_ENABLE;
+ 
+-	rc = request_locality(chip, 0);
++	rc = tpm_tis_request_locality(chip, 0);
+ 	if (rc < 0) {
+ 		rc = -ENODEV;
+ 		goto out_err;
+ 	}
+ 
+ 	tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask);
+-	release_locality(chip, 0);
++	tpm_tis_relinquish_locality(chip, 0);
+ 
+ 	rc = tpm_chip_start(chip);
+ 	if (rc)
+@@ -1057,13 +1084,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ 		 * proper timeouts for the driver.
+ 		 */
+ 
+-		rc = request_locality(chip, 0);
++		rc = tpm_tis_request_locality(chip, 0);
+ 		if (rc < 0)
+ 			goto out_err;
+ 
+ 		rc = tpm_get_timeouts(chip);
+ 
+-		release_locality(chip, 0);
++		tpm_tis_relinquish_locality(chip, 0);
+ 
+ 		if (rc) {
+ 			dev_err(dev, "Could not get TPM timeouts and durations\n");
+@@ -1081,11 +1108,11 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ 			dev_err(&chip->dev, FW_BUG
+ 					"TPM interrupt not working, polling instead\n");
+ 
+-			rc = request_locality(chip, 0);
++			rc = tpm_tis_request_locality(chip, 0);
+ 			if (rc < 0)
+ 				goto out_err;
+ 			disable_interrupts(chip);
+-			release_locality(chip, 0);
++			tpm_tis_relinquish_locality(chip, 0);
+ 		}
+ 	}
+ 
+@@ -1158,13 +1185,13 @@ int tpm_tis_resume(struct device *dev)
+ 	 * an error code but for unknown reason it isn't handled.
+ 	 */
+ 	if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
+-		ret = request_locality(chip, 0);
++		ret = tpm_tis_request_locality(chip, 0);
+ 		if (ret < 0)
+ 			return ret;
+ 
+ 		tpm1_do_selftest(chip);
+ 
+-		release_locality(chip, 0);
++		tpm_tis_relinquish_locality(chip, 0);
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h
+index 3be24f221e32a..464ed352ab2e8 100644
+--- a/drivers/char/tpm/tpm_tis_core.h
++++ b/drivers/char/tpm/tpm_tis_core.h
+@@ -90,6 +90,8 @@ enum tpm_tis_flags {
+ 
+ struct tpm_tis_data {
+ 	u16 manufacturer_id;
++	struct mutex locality_count_mutex;
++	unsigned int locality_count;
+ 	int locality;
+ 	int irq;
+ 	bool irq_tested;
+-- 
+2.39.2
+
diff --git a/queue-5.10/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch b/queue-5.10/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch
new file mode 100644
index 00000000000..72e9a3acf9b
--- /dev/null
+++ b/queue-5.10/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch
@@ -0,0 +1,85 @@
+From c6cfb21325d6d00adbd61e8c06e8fe2c58dd4270 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:29 +0100
+Subject: tpm, tpm_tis: Claim locality before writing interrupt registers
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 15d7aa4e46eba87242a320f39773aa16faddadee ]
+
+In tpm_tis_probe_single_irq() interrupt registers TPM_INT_VECTOR,
+TPM_INT_STATUS and TPM_INT_ENABLE are modified to setup the interrupts.
+Currently these modifications are done without holding a locality thus they
+have no effect. Fix this by claiming the (default) locality before the
+registers are written.
+
+Since now tpm_tis_gen_interrupt() is called with the locality already
+claimed remove locality request and release from this function.
+
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 99cbf6fb062ce..52826a7edf800 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -721,16 +721,10 @@ static void tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ 	cap_t cap;
+ 	int ret;
+ 
+-	ret = request_locality(chip, 0);
+-	if (ret < 0)
+-		return;
+-
+ 	if (chip->flags & TPM_CHIP_FLAG_TPM2)
+ 		ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc);
+ 	else
+ 		ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0);
+-
+-	release_locality(chip, 0);
+ }
+ 
+ /* Register the IRQ and issue a command that will cause an interrupt. If an
+@@ -753,10 +747,16 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ 	}
+ 	priv->irq = irq;
+ 
++	rc = request_locality(chip, 0);
++	if (rc < 0)
++		return rc;
++
+ 	rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality),
+ 			   &original_int_vec);
+-	if (rc < 0)
++	if (rc < 0) {
++		release_locality(chip, priv->locality);
+ 		return rc;
++	}
+ 
+ 	rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq);
+ 	if (rc < 0)
+@@ -790,10 +790,12 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ 	if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+ 		tpm_tis_write8(priv, original_int_vec,
+ 			       TPM_INT_VECTOR(priv->locality));
+-		return -1;
++		rc = -1;
+ 	}
+ 
+-	return 0;
++	release_locality(chip, priv->locality);
++
++	return rc;
+ }
+ 
+ /* Try to find the IRQ the TPM is using. This is for legacy x86 systems that
+-- 
+2.39.2
+
diff --git a/queue-5.10/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch b/queue-5.10/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch
new file mode 100644
index 00000000000..820c72fe031
--- /dev/null
+++ b/queue-5.10/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch
@@ -0,0 +1,47 @@
+From bda55d391610b0e85ffc61981c703ed2eda698dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:26 +0100
+Subject: tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 282657a8bd7fddcf511b834f43705001668b33a7 ]
+
+In disable_interrupts() the TPM_GLOBAL_INT_ENABLE bit is unset in the
+TPM_INT_ENABLE register to shut the interrupts off. However modifying the
+register is only possible with a held locality. So claim the locality
+before disable_interrupts() is called.
+
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Michael Niewöhner <linux@mniewoehner.de>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index ae0c773a6041a..274096fece3fa 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -1076,7 +1076,11 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ 				dev_err(&chip->dev, FW_BUG
+ 					"TPM interrupt not working, polling instead\n");
+ 
++				rc = request_locality(chip, 0);
++				if (rc < 0)
++					goto out_err;
+ 				disable_interrupts(chip);
++				release_locality(chip, 0);
+ 			}
+ 		} else {
+ 			tpm_tis_probe_irq(chip, intmask);
+-- 
+2.39.2
+
diff --git a/queue-5.10/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch b/queue-5.10/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch
new file mode 100644
index 00000000000..7b99564860d
--- /dev/null
+++ b/queue-5.10/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch
@@ -0,0 +1,68 @@
+From 8f4824e56e50f1030d7678d5738cbabff72c8cd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:36 +0100
+Subject: tpm, tpm_tis: Claim locality when interrupts are reenabled on resume
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 955df4f87760b3bb2af253d3fbb12fb712b3ffa6 ]
+
+In tpm_tis_resume() make sure that the locality has been claimed when
+tpm_tis_reenable_interrupts() is called. Otherwise the writings to the
+register might not have any effect.
+
+Fixes: 45baa1d1fa39 ("tpm_tis: Re-enable interrupts upon (S3) resume")
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 3ea0fff30273e..d65fff4e2ebe9 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -1173,28 +1173,27 @@ int tpm_tis_resume(struct device *dev)
+ 	struct tpm_chip *chip = dev_get_drvdata(dev);
+ 	int ret;
+ 
++	ret = tpm_tis_request_locality(chip, 0);
++	if (ret < 0)
++		return ret;
++
+ 	if (chip->flags & TPM_CHIP_FLAG_IRQ)
+ 		tpm_tis_reenable_interrupts(chip);
+ 
+ 	ret = tpm_pm_resume(dev);
+ 	if (ret)
+-		return ret;
++		goto out;
+ 
+ 	/*
+ 	 * TPM 1.2 requires self-test on resume. This function actually returns
+ 	 * an error code but for unknown reason it isn't handled.
+ 	 */
+-	if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
+-		ret = tpm_tis_request_locality(chip, 0);
+-		if (ret < 0)
+-			return ret;
+-
++	if (!(chip->flags & TPM_CHIP_FLAG_TPM2))
+ 		tpm1_do_selftest(chip);
++out:
++	tpm_tis_relinquish_locality(chip, 0);
+ 
+-		tpm_tis_relinquish_locality(chip, 0);
+-	}
+-
+-	return 0;
++	return ret;
+ }
+ EXPORT_SYMBOL_GPL(tpm_tis_resume);
+ #endif
+-- 
+2.39.2
+
diff --git a/queue-5.10/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch b/queue-5.10/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch
new file mode 100644
index 00000000000..1e06967c3cc
--- /dev/null
+++ b/queue-5.10/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch
@@ -0,0 +1,69 @@
+From 0578fca0afff154a7083e0b0be4bd2e17a531f2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:27 +0100
+Subject: tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 6d789ad726950e612a7f31044260337237c5b490 ]
+
+Both functions tpm_tis_probe_irq_single() and tpm_tis_probe_irq() may setup
+the interrupts and then return with an error. This case is indicated by a
+missing TPM_CHIP_FLAG_IRQ flag in chip->flags.
+Currently the interrupt setup is only undone if tpm_tis_probe_irq_single()
+fails. Undo the setup also if tpm_tis_probe_irq() fails.
+
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Michael Niewöhner <linux@mniewoehner.de>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 274096fece3fa..99cbf6fb062ce 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -1069,21 +1069,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ 			goto out_err;
+ 		}
+ 
+-		if (irq) {
++		if (irq)
+ 			tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED,
+ 						 irq);
+-			if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+-				dev_err(&chip->dev, FW_BUG
++		else
++			tpm_tis_probe_irq(chip, intmask);
++
++		if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
++			dev_err(&chip->dev, FW_BUG
+ 					"TPM interrupt not working, polling instead\n");
+ 
+-				rc = request_locality(chip, 0);
+-				if (rc < 0)
+-					goto out_err;
+-				disable_interrupts(chip);
+-				release_locality(chip, 0);
+-			}
+-		} else {
+-			tpm_tis_probe_irq(chip, intmask);
++			rc = request_locality(chip, 0);
++			if (rc < 0)
++				goto out_err;
++			disable_interrupts(chip);
++			release_locality(chip, 0);
+ 		}
+ 	}
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch b/queue-5.10/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch
new file mode 100644
index 00000000000..31e1cf40090
--- /dev/null
+++ b/queue-5.10/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch
@@ -0,0 +1,113 @@
+From 253a6118ca6eb705b96d3e1b4498aa6cb54072e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:28 +0100
+Subject: tpm, tpm_tis: Do not skip reset of original interrupt vector
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit ed9be0e6c892a783800d77a41ca4c7255c6af8c5 ]
+
+If in tpm_tis_probe_irq_single() an error occurs after the original
+interrupt vector has been read, restore the interrupts before the error is
+returned.
+
+Since the caller does not check the error value, return -1 in any case that
+the TPM_CHIP_FLAG_IRQ flag is not set. Since the return value of function
+tpm_tis_gen_interrupt() is not longer used, make it a void function.
+
+Fixes: 1107d065fdf1 ("tpm_tis: Introduce intermediate layer for TPM access")
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 29 +++++++++++------------------
+ 1 file changed, 11 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index dc56b976d8162..ae0c773a6041a 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -714,7 +714,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id)
+ 	return IRQ_HANDLED;
+ }
+ 
+-static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
++static void tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ {
+ 	const char *desc = "attempting to generate an interrupt";
+ 	u32 cap2;
+@@ -723,7 +723,7 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ 
+ 	ret = request_locality(chip, 0);
+ 	if (ret < 0)
+-		return ret;
++		return;
+ 
+ 	if (chip->flags & TPM_CHIP_FLAG_TPM2)
+ 		ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc);
+@@ -731,8 +731,6 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ 		ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0);
+ 
+ 	release_locality(chip, 0);
+-
+-	return ret;
+ }
+ 
+ /* Register the IRQ and issue a command that will cause an interrupt. If an
+@@ -762,42 +760,37 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ 
+ 	rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq);
+ 	if (rc < 0)
+-		return rc;
++		goto restore_irqs;
+ 
+ 	rc = tpm_tis_read32(priv, TPM_INT_STATUS(priv->locality), &int_status);
+ 	if (rc < 0)
+-		return rc;
++		goto restore_irqs;
+ 
+ 	/* Clear all existing */
+ 	rc = tpm_tis_write32(priv, TPM_INT_STATUS(priv->locality), int_status);
+ 	if (rc < 0)
+-		return rc;
+-
++		goto restore_irqs;
+ 	/* Turn on */
+ 	rc = tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality),
+ 			     intmask | TPM_GLOBAL_INT_ENABLE);
+ 	if (rc < 0)
+-		return rc;
++		goto restore_irqs;
+ 
+ 	priv->irq_tested = false;
+ 
+ 	/* Generate an interrupt by having the core call through to
+ 	 * tpm_tis_send
+ 	 */
+-	rc = tpm_tis_gen_interrupt(chip);
+-	if (rc < 0)
+-		return rc;
++	tpm_tis_gen_interrupt(chip);
+ 
++restore_irqs:
+ 	/* tpm_tis_send will either confirm the interrupt is working or it
+ 	 * will call disable_irq which undoes all of the above.
+ 	 */
+ 	if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+-		rc = tpm_tis_write8(priv, original_int_vec,
+-				TPM_INT_VECTOR(priv->locality));
+-		if (rc < 0)
+-			return rc;
+-
+-		return 1;
++		tpm_tis_write8(priv, original_int_vec,
++			       TPM_INT_VECTOR(priv->locality));
++		return -1;
+ 	}
+ 
+ 	return 0;
+-- 
+2.39.2
+
diff --git a/queue-5.10/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch b/queue-5.10/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch
new file mode 100644
index 00000000000..8b4f9341d8f
--- /dev/null
+++ b/queue-5.10/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch
@@ -0,0 +1,39 @@
+From 978453b58baa463c8b9ebaf437a4fb10ec676ef8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 14:55:55 -0500
+Subject: tty: serial: fsl_lpuart: adjust buffer length to the intended size
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+[ Upstream commit f73fd750552524b06b5d77ebfdd106ccc8fcac61 ]
+
+Based on the fls function definition provided below, we should not
+subtract 1 to obtain the correct buffer length:
+
+fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32.
+
+Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx")
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Link: https://lore.kernel.org/r/20230410195555.1003900-1-shenwei.wang@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index f481c260b7049..a2efa81471f30 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1220,7 +1220,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
+ 	 * 10ms at any baud rate.
+ 	 */
+ 	sport->rx_dma_rng_buf_len = (DMA_RX_TIMEOUT * baud /  bits / 1000) * 2;
+-	sport->rx_dma_rng_buf_len = (1 << (fls(sport->rx_dma_rng_buf_len) - 1));
++	sport->rx_dma_rng_buf_len = (1 << fls(sport->rx_dma_rng_buf_len));
+ 	if (sport->rx_dma_rng_buf_len < 16)
+ 		sport->rx_dma_rng_buf_len = 16;
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch b/queue-5.10/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch
new file mode 100644
index 00000000000..c8e391707d1
--- /dev/null
+++ b/queue-5.10/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch
@@ -0,0 +1,65 @@
+From ff8311fd17903dcc93cf1296bebb9dd13c0a96c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 10:27:47 +0100
+Subject: uapi/linux/const.h: prefer ISO-friendly __typeof__
+
+From: Kevin Brodsky <kevin.brodsky@arm.com>
+
+[ Upstream commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 ]
+
+typeof is (still) a GNU extension, which means that it cannot be used when
+building ISO C (e.g.  -std=c99).  It should therefore be avoided in uapi
+headers in favour of the ISO-friendly __typeof__.
+
+Unfortunately this issue could not be detected by
+CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in
+any uapi header.
+
+This matters from a userspace perspective, not a kernel one. uapi
+headers and their contents are expected to be usable in a variety of
+situations, and in particular when building ISO C applications (with
+-std=c99 or similar).
+
+This particular problem can be reproduced by trying to use the
+__ALIGN_KERNEL macro directly in application code, say:
+
+#include <linux/const.h>
+
+int align(int x, int a)
+{
+	return __KERNEL_ALIGN(x, a);
+}
+
+and trying to build that with -std=c99.
+
+Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com
+Fixes: a79ff731a1b2 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()")
+Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
+Reported-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
+Tested-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Tested-by: Petr Vorel <pvorel@suse.cz>
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/const.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h
+index af2a44c08683d..a429381e7ca50 100644
+--- a/include/uapi/linux/const.h
++++ b/include/uapi/linux/const.h
+@@ -28,7 +28,7 @@
+ #define _BITUL(x)	(_UL(1) << (x))
+ #define _BITULL(x)	(_ULL(1) << (x))
+ 
+-#define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
++#define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
+ #define __ALIGN_KERNEL_MASK(x, mask)	(((x) + (mask)) & ~(mask))
+ 
+ #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
+-- 
+2.39.2
+
diff --git a/queue-5.10/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch b/queue-5.10/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch
new file mode 100644
index 00000000000..ca57c3c3cb6
--- /dev/null
+++ b/queue-5.10/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch
@@ -0,0 +1,42 @@
+From 6403b9508690ac2da82e7f9ca635261a358d76d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 13:58:52 +0800
+Subject: usb: chipidea: fix missing goto in `ci_hdrc_probe`
+
+From: Yinhao Hu <dddddd@hust.edu.cn>
+
+[ Upstream commit d6f712f53b79f5017cdcefafb7a5aea9ec52da5d ]
+
+From the comment of ci_usb_phy_init, it returns an error code if
+usb_phy_init has failed, and it should do some clean up, not just
+return directly.
+
+Fix this by goto the error handling.
+
+Fixes: 74475ede784d ("usb: chipidea: move PHY operation to core")
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Yinhao Hu <dddddd@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index f26dd1f054f21..3d18599c5b9e4 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -1090,7 +1090,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ 	ret = ci_usb_phy_init(ci);
+ 	if (ret) {
+ 		dev_err(dev, "unable to init phy: %d\n", ret);
+-		return ret;
++		goto ulpi_exit;
+ 	}
+ 
+ 	ci->hw_bank.phys = res->start;
+-- 
+2.39.2
+
diff --git a/queue-5.10/usb-dwc3-gadget-change-condition-for-processing-susp.patch b/queue-5.10/usb-dwc3-gadget-change-condition-for-processing-susp.patch
new file mode 100644
index 00000000000..fdb915ccf69
--- /dev/null
+++ b/queue-5.10/usb-dwc3-gadget-change-condition-for-processing-susp.patch
@@ -0,0 +1,54 @@
+From de1598ace9e8063040bea09c18884eccf3ba4e69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 11:16:58 +0530
+Subject: usb: dwc3: gadget: Change condition for processing suspend event
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+[ Upstream commit 4decf4060ecfee1f7a710999fcd421645ac0c419 ]
+
+Currently we process the suspend interrupt event only if the
+device is in configured state. Consider a case where device
+is not configured and got suspend interrupt, in that case our
+gadget will still use 100mA as composite_suspend didn't happen.
+But battery charging specification (BC1.2) expects a downstream
+device to draw less than 2.5mA when unconnected OR suspended.
+
+Fix this by removing the condition for processing suspend event,
+and thus composite_resume would set vbus draw to 2.
+
+Fixes: 72704f876f50 ("dwc3: gadget: Implement the suspend entry event handler")
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/1677217619-10261-2-git-send-email-quic_prashk@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 01cecde76140b..4e3b451ed749e 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3726,15 +3726,8 @@ static void dwc3_gadget_interrupt(struct dwc3 *dwc,
+ 		break;
+ 	case DWC3_DEVICE_EVENT_EOPF:
+ 		/* It changed to be suspend event for version 2.30a and above */
+-		if (!DWC3_VER_IS_PRIOR(DWC3, 230A)) {
+-			/*
+-			 * Ignore suspend event until the gadget enters into
+-			 * USB_STATE_CONFIGURED state.
+-			 */
+-			if (dwc->gadget->state >= USB_STATE_CONFIGURED)
+-				dwc3_gadget_suspend_interrupt(dwc,
+-						event->event_info);
+-		}
++		if (!DWC3_VER_IS_PRIOR(DWC3, 230A))
++			dwc3_gadget_suspend_interrupt(dwc, event->event_info);
+ 		break;
+ 	case DWC3_DEVICE_EVENT_SOF:
+ 	case DWC3_DEVICE_EVENT_ERRATIC_ERROR:
+-- 
+2.39.2
+
diff --git a/queue-5.10/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch b/queue-5.10/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch
new file mode 100644
index 00000000000..98a72e6da54
--- /dev/null
+++ b/queue-5.10/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch
@@ -0,0 +1,43 @@
+From cd59abc607cea330a2d0060d7779e7e46e0a3099 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 19:18:53 +0100
+Subject: usb: gadget: tegra-xudc: Fix crash in vbus_draw
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+[ Upstream commit 5629d31955297ca47b9283c64fff70f2f34aa528 ]
+
+Commit ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support")
+populated the vbus_draw callback for the Tegra XUDC driver. The function
+tegra_xudc_gadget_vbus_draw(), that was added by this commit, assumes
+that the pointer 'curr_usbphy' has been initialised, which is not always
+the case because this is only initialised when the USB role is updated.
+Fix this crash, by checking that the 'curr_usbphy' is valid before
+dereferencing.
+
+Fixes: ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support")
+Reviewed-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20230405181854.42355-1-jonathanh@nvidia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/tegra-xudc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c
+index 3ebc8c5416e30..66d5f6a85c848 100644
+--- a/drivers/usb/gadget/udc/tegra-xudc.c
++++ b/drivers/usb/gadget/udc/tegra-xudc.c
+@@ -2154,7 +2154,7 @@ static int tegra_xudc_gadget_vbus_draw(struct usb_gadget *gadget,
+ 
+ 	dev_dbg(xudc->dev, "%s: %u mA\n", __func__, m_a);
+ 
+-	if (xudc->curr_usbphy->chg_type == SDP_TYPE)
++	if (xudc->curr_usbphy && xudc->curr_usbphy->chg_type == SDP_TYPE)
+ 		ret = usb_phy_set_power(xudc->curr_usbphy, m_a);
+ 
+ 	return ret;
+-- 
+2.39.2
+
diff --git a/queue-5.10/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch b/queue-5.10/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch
new file mode 100644
index 00000000000..b53d06f82d0
--- /dev/null
+++ b/queue-5.10/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch
@@ -0,0 +1,62 @@
+From 0da70f52a0af22cc65e00368a94d076f161e9354 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 14:29:31 +0800
+Subject: usb: gadget: udc: renesas_usb3: Fix use after free bug in
+ renesas_usb3_remove due to race condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ]
+
+In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work.
+renesas_usb3_start will be called to start the work.
+
+If we remove the driver which will call usbhs_remove, there may be
+an unfinished work. The possible sequence is as follows:
+
+CPU0                  			CPU1
+
+                    			 renesas_usb3_role_work
+renesas_usb3_remove
+usb_role_switch_unregister
+device_unregister
+kfree(sw)
+//free usb3->role_sw
+                    			 usb_role_switch_set_role
+                    			 //use usb3->role_sw
+
+The usb3->role_sw could be freed under such circumstance and then
+used in usb_role_switch_set_role.
+
+This bug was found by static analysis. And note that removing a
+driver is a root-only operation, and should never happen in normal
+case. But the root user may directly remove the device which
+will also trigger the remove function.
+
+Fix it by canceling the work before cleanup in the renesas_usb3_remove.
+
+Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index 601829a6b4bad..a10f41c4a3f2f 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2568,6 +2568,7 @@ static int renesas_usb3_remove(struct platform_device *pdev)
+ 	debugfs_remove_recursive(usb3->dentry);
+ 	device_remove_file(&pdev->dev, &dev_attr_role);
+ 
++	cancel_work_sync(&usb3->role_work);
+ 	usb_role_switch_unregister(usb3->role_sw);
+ 
+ 	usb_del_gadget_udc(&usb3->gadget);
+-- 
+2.39.2
+
diff --git a/queue-5.10/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch b/queue-5.10/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch
new file mode 100644
index 00000000000..8410b256bcd
--- /dev/null
+++ b/queue-5.10/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch
@@ -0,0 +1,46 @@
+From 9f2df67281fafe62c54014625bb9d1bcdf9c297a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 17:30:37 +0100
+Subject: usb: host: xhci-rcar: remove leftover quirk handling
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 5d67f4861884762ebc2bddb5d667444e45f25782 ]
+
+Loading V3 firmware does not need a quirk anymore, remove the leftover
+code.
+
+Fixes: ed8603e11124 ("usb: host: xhci-rcar: Simplify getting the firmware name for R-Car Gen3")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/20230307163041.3815-10-wsa+renesas@sang-engineering.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-rcar.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index 9888ba7d85b6a..cfafa1c50adea 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -75,7 +75,6 @@ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3);
+ 
+ /* For soc_device_attribute */
+ #define RCAR_XHCI_FIRMWARE_V2   BIT(0) /* FIRMWARE V2 */
+-#define RCAR_XHCI_FIRMWARE_V3   BIT(1) /* FIRMWARE V3 */
+ 
+ static const struct soc_device_attribute rcar_quirks_match[]  = {
+ 	{
+@@ -147,8 +146,6 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd)
+ 
+ 	if (quirks & RCAR_XHCI_FIRMWARE_V2)
+ 		firmware_name = XHCI_RCAR_FIRMWARE_NAME_V2;
+-	else if (quirks & RCAR_XHCI_FIRMWARE_V3)
+-		firmware_name = XHCI_RCAR_FIRMWARE_NAME_V3;
+ 	else
+ 		firmware_name = priv->firmware_name;
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch b/queue-5.10/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch
new file mode 100644
index 00000000000..eb911e5db11
--- /dev/null
+++ b/queue-5.10/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch
@@ -0,0 +1,73 @@
+From 91273edaeea2052c3274c046c8eb5b476d2a5f7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 10:51:59 +0800
+Subject: usb: mtu3: fix kernel panic at qmu transfer done irq handler
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 ]
+
+When handle qmu transfer irq, it will unlock @mtu->lock before give back
+request, if another thread handle disconnect event at the same time, and
+try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
+irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
+handling it.
+
+e.g.
+qmu done irq on cpu0                 thread running on cpu1
+
+qmu_done_tx()
+  handle gpd [0]
+    mtu3_requ_complete()        mtu3_gadget_ep_disable()
+      unlock @mtu->lock
+        give back request         lock @mtu->lock
+                                    mtu3_ep_disable()
+                                      mtu3_gpd_ring_free()
+                                   unlock @mtu->lock
+      lock @mtu->lock
+    get next gpd [1]
+
+[1]: goto [0] to handle next gpd, and next gpd may be NULL.
+
+Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format")
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/20230417025203.18097-3-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mtu3/mtu3_qmu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c
+index 2ea3157ddb6e2..e65586147965d 100644
+--- a/drivers/usb/mtu3/mtu3_qmu.c
++++ b/drivers/usb/mtu3/mtu3_qmu.c
+@@ -210,6 +210,7 @@ static struct qmu_gpd *advance_enq_gpd(struct mtu3_gpd_ring *ring)
+ 	return ring->enqueue;
+ }
+ 
++/* @dequeue may be NULL if ring is unallocated or freed */
+ static struct qmu_gpd *advance_deq_gpd(struct mtu3_gpd_ring *ring)
+ {
+ 	if (ring->dequeue < ring->end)
+@@ -484,7 +485,7 @@ static void qmu_done_tx(struct mtu3 *mtu, u8 epnum)
+ 	dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n",
+ 		__func__, epnum, gpd, gpd_current, ring->enqueue);
+ 
+-	while (gpd != gpd_current && !GET_GPD_HWO(gpd)) {
++	while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) {
+ 
+ 		mreq = next_request(mep);
+ 
+@@ -523,7 +524,7 @@ static void qmu_done_rx(struct mtu3 *mtu, u8 epnum)
+ 	dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n",
+ 		__func__, epnum, gpd, gpd_current, ring->enqueue);
+ 
+-	while (gpd != gpd_current && !GET_GPD_HWO(gpd)) {
++	while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) {
+ 
+ 		mreq = next_request(mep);
+ 
+-- 
+2.39.2
+
diff --git a/queue-5.10/vlan-partially-enable-siocshwtstamp-in-container.patch b/queue-5.10/vlan-partially-enable-siocshwtstamp-in-container.patch
new file mode 100644
index 00000000000..c65a415dae7
--- /dev/null
+++ b/queue-5.10/vlan-partially-enable-siocshwtstamp-in-container.patch
@@ -0,0 +1,37 @@
+From c0e4557772e894eb844b9c6520531f16fc227153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 08:33:02 -0700
+Subject: vlan: partially enable SIOCSHWTSTAMP in container
+
+From: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+
+[ Upstream commit 731b73dba359e3ff00517c13aa0daa82b34ff466 ]
+
+Setting timestamp filter was explicitly disabled on vlan devices in
+containers because it might affect other processes on the host. But it's
+absolutely legit in case when real device is in the same namespace.
+
+Fixes: 873017af7784 ("vlan: disable SIOCSHWTSTAMP in container")
+Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/8021q/vlan_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 86a1c99025ea0..929f85c6cf112 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -365,7 +365,7 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ 
+ 	switch (cmd) {
+ 	case SIOCSHWTSTAMP:
+-		if (!net_eq(dev_net(dev), &init_net))
++		if (!net_eq(dev_net(dev), dev_net(real_dev)))
+ 			break;
+ 		fallthrough;
+ 	case SIOCGMIIPHY:
+-- 
+2.39.2
+
diff --git a/queue-5.10/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch b/queue-5.10/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch
new file mode 100644
index 00000000000..a48c75d4e6f
--- /dev/null
+++ b/queue-5.10/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch
@@ -0,0 +1,95 @@
+From ee34a37186cc9cc6ee22645f5a972d4f6b257b4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 21:01:53 +0900
+Subject: vmci_host: fix a race condition in vmci_host_poll() causing GPF
+
+From: Dae R. Jeong <threeearcat@gmail.com>
+
+[ Upstream commit ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 ]
+
+During fuzzing, a general protection fault is observed in
+vmci_host_poll().
+
+general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN
+KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
+RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926
+<- omitting registers ->
+Call Trace:
+ <TASK>
+ lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672
+ __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
+ _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162
+ add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22
+ poll_wait include/linux/poll.h:49 [inline]
+ vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174
+ vfs_poll include/linux/poll.h:88 [inline]
+ do_pollfd fs/select.c:873 [inline]
+ do_poll fs/select.c:921 [inline]
+ do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015
+ __do_sys_ppoll fs/select.c:1121 [inline]
+ __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Example thread interleaving that causes the general protection fault
+is as follows:
+
+CPU1 (vmci_host_poll)               CPU2 (vmci_host_do_init_context)
+-----                               -----
+// Read uninitialized context
+context = vmci_host_dev->context;
+                                    // Initialize context
+                                    vmci_host_dev->context = vmci_ctx_create();
+                                    vmci_host_dev->ct_type = VMCIOBJ_CONTEXT;
+
+if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
+    // Dereferencing the wrong pointer
+    poll_wait(..., &context->host_context);
+}
+
+In this scenario, vmci_host_poll() reads vmci_host_dev->context first,
+and then reads vmci_host_dev->ct_type to check that
+vmci_host_dev->context is initialized. However, since these two reads
+are not atomically executed, there is a chance of a race condition as
+described above.
+
+To fix this race condition, read vmci_host_dev->context after checking
+the value of vmci_host_dev->ct_type so that vmci_host_poll() always
+reads an initialized context.
+
+Reported-by: Dae R. Jeong <threeearcat@gmail.com>
+Fixes: 8bf503991f87 ("VMCI: host side driver implementation.")
+Signed-off-by: Dae R. Jeong <threeearcat@gmail.com>
+Link: https://lore.kernel.org/r/ZCGFsdBAU4cYww5l@dragonet
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/vmw_vmci/vmci_host.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
+index 2d8328d928d53..4a903770b8e1d 100644
+--- a/drivers/misc/vmw_vmci/vmci_host.c
++++ b/drivers/misc/vmw_vmci/vmci_host.c
+@@ -165,10 +165,16 @@ static int vmci_host_close(struct inode *inode, struct file *filp)
+ static __poll_t vmci_host_poll(struct file *filp, poll_table *wait)
+ {
+ 	struct vmci_host_dev *vmci_host_dev = filp->private_data;
+-	struct vmci_ctx *context = vmci_host_dev->context;
++	struct vmci_ctx *context;
+ 	__poll_t mask = 0;
+ 
+ 	if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
++		/*
++		 * Read context only if ct_type == VMCIOBJ_CONTEXT to make
++		 * sure that context is initialized
++		 */
++		context = vmci_host_dev->context;
++
+ 		/* Check for VMCI calls to this VM context. */
+ 		if (wait)
+ 			poll_wait(filp, &context->host_context.wait_queue,
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch b/queue-5.10/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch
new file mode 100644
index 00000000000..9899b916ce4
--- /dev/null
+++ b/queue-5.10/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch
@@ -0,0 +1,39 @@
+From 0c53b871f91bc10c4c278d0c04749f65931e0641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 16:15:48 +0300
+Subject: wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 4c856ee12df85aabd437c3836ed9f68d94268358 ]
+
+This loop checks that i < max at the start of loop but then it does
+i++ which could put it past the end of the array.  It's harmless to
+check again and prevent a potential out of bounds.
+
+Fixes: 1048643ea94d ("ath5k: Clean up eeprom parsing and add missing calibration data")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/Y+D9hPQrHfWBJhXz@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath5k/eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
+index d444b3d70ba2e..58d3e86f6256d 100644
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -529,7 +529,7 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max,
+ 		ee->ee_n_piers[mode]++;
+ 
+ 		freq2 = (val >> 8) & 0xff;
+-		if (!freq2)
++		if (!freq2 || i >= max)
+ 			break;
+ 
+ 		pc[i++].freq = ath5k_eeprom_bin2freq(ee,
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-ath6kl-minor-fix-for-allocation-size.patch b/queue-5.10/wifi-ath6kl-minor-fix-for-allocation-size.patch
new file mode 100644
index 00000000000..b490c294e20
--- /dev/null
+++ b/queue-5.10/wifi-ath6kl-minor-fix-for-allocation-size.patch
@@ -0,0 +1,40 @@
+From 4cc2cb3c38d0c86bea4eadd30b43023f69942149 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 20:31:37 +0200
+Subject: wifi: ath6kl: minor fix for allocation size
+
+From: Alexey V. Vissarionov <gremlin@altlinux.org>
+
+[ Upstream commit 778f83f889e7fca37780d9640fcbd0229ae38eaa ]
+
+Although the "param" pointer occupies more or equal space compared
+to "*param", the allocation size should use the size of variable
+itself.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver")
+Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230117110414.GC12547@altlinux.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/bmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c
+index bde5a10d470c8..af98e871199d3 100644
+--- a/drivers/net/wireless/ath/ath6kl/bmi.c
++++ b/drivers/net/wireless/ath/ath6kl/bmi.c
+@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param)
+ 		return -EACCES;
+ 	}
+ 
+-	size = sizeof(cid) + sizeof(addr) + sizeof(param);
++	size = sizeof(cid) + sizeof(addr) + sizeof(*param);
+ 	if (size > ar->bmi.max_cmd_size) {
+ 		WARN_ON(1);
+ 		return -EINVAL;
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch b/queue-5.10/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch
new file mode 100644
index 00000000000..5eef6ce68c2
--- /dev/null
+++ b/queue-5.10/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch
@@ -0,0 +1,43 @@
+From 777354528c0686d80c311c3473879c94309ea428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 12:28:05 +0200
+Subject: wifi: ath6kl: reduce WARN to dev_dbg() in callback
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 75c4a8154cb6c7239fb55d5550f481f6765fb83c ]
+
+The warn is triggered on a known race condition, documented in the code above
+the test, that is correctly handled.  Using WARN() hinders automated testing.
+Reducing severity.
+
+Fixes: de2070fc4aa7 ("ath6kl: Fix kernel panic on continuous driver load/unload")
+Reported-and-tested-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230126182431.867984-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/htc_pipe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+index c68848819a52d..9b88d96bfe96c 100644
+--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
++++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+@@ -960,8 +960,8 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
+ 	 * Thus the possibility of ar->htc_target being NULL
+ 	 * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work.
+ 	 */
+-	if (WARN_ON_ONCE(!target)) {
+-		ath6kl_err("Target not yet initialized\n");
++	if (!target) {
++		ath6kl_dbg(ATH6KL_DBG_HTC, "Target not yet initialized\n");
+ 		status = -EINVAL;
+ 		goto free_skb;
+ 	}
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch b/queue-5.10/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch
new file mode 100644
index 00000000000..ed1883ec30b
--- /dev/null
+++ b/queue-5.10/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch
@@ -0,0 +1,87 @@
+From 99caa6e0bbbfc36ebb7f5a40b575558008599c9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 22:23:01 +0300
+Subject: wifi: ath9k: hif_usb: fix memory leak of remain_skbs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ]
+
+hif_dev->remain_skb is allocated and used exclusively in
+ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is
+processed and subsequently freed (in error paths) only during the next
+call of ath9k_hif_usb_rx_stream().
+
+So, if the urbs are deallocated between those two calls due to the device
+deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream()
+is not called next time and the allocated remain_skb is leaked. Our local
+Syzkaller instance was able to trigger that.
+
+remain_skb makes sense when receiving two consecutive urbs which are
+logically linked together, i.e. a specific data field from the first skb
+indicates a cached skb to be allocated, memcpy'd with some data and
+subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs
+deallocation supposedly makes that link irrelevant so we need to free the
+cached skb in those cases.
+
+Fix the leak by introducing a function to explicitly free remain_skb (if
+it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL
+when it has not been allocated at all (hif_dev struct is kzalloced) or
+when it has been processed in next call to ath9k_hif_usb_rx_stream().
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index f521dfa2f1945..e0130beb304df 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = {
+ 	.send = hif_usb_send,
+ };
+ 
++/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream
++ * in case ath9k_hif_usb_rx_stream wasn't called next time to
++ * process the buffer and subsequently free it.
++ */
++static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&hif_dev->rx_lock, flags);
++	if (hif_dev->remain_skb) {
++		dev_kfree_skb_any(hif_dev->remain_skb);
++		hif_dev->remain_skb = NULL;
++		hif_dev->rx_remain_len = 0;
++		RX_STAT_INC(hif_dev, skb_dropped);
++	}
++	spin_unlock_irqrestore(&hif_dev->rx_lock, flags);
++}
++
+ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ 				    struct sk_buff *skb)
+ {
+@@ -868,6 +886,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
+ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+ 	usb_kill_anchored_urbs(&hif_dev->rx_submitted);
++	ath9k_hif_usb_free_rx_remain_skb(hif_dev);
+ }
+ 
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch b/queue-5.10/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch
new file mode 100644
index 00000000000..67dcc0999b8
--- /dev/null
+++ b/queue-5.10/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch
@@ -0,0 +1,42 @@
+From 90c8a372f0b293b307a536be531715945c8c94df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 12:28:05 +0300
+Subject: wifi: iwlwifi: fw: fix memory leak in debugfs
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 3d90d2f4a018fe8cfd65068bc6350b6222be4852 ]
+
+Fix a memory leak that occurs when reading the fw_info
+file all the way, since we return NULL indicating no
+more data, but don't free the status tracking object.
+
+Fixes: 36dfe9ac6e8b ("iwlwifi: dump api version in yaml format")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230418122405.239e501b3b8d.I4268f87809ef91209cbcd748eee0863195e70fa2@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
+index 267ad4eddb5c0..24d6ed3513ce5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
+@@ -344,8 +344,10 @@ static void *iwl_dbgfs_fw_info_seq_next(struct seq_file *seq,
+ 	const struct iwl_fw *fw = priv->fwrt->fw;
+ 
+ 	*pos = ++state->pos;
+-	if (*pos >= fw->ucode_capa.n_cmd_versions)
++	if (*pos >= fw->ucode_capa.n_cmd_versions) {
++		kfree(state);
+ 		return NULL;
++	}
+ 
+ 	return state;
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-iwlwifi-fw-move-memset-before-early-return.patch b/queue-5.10/wifi-iwlwifi-fw-move-memset-before-early-return.patch
new file mode 100644
index 00000000000..c5457ddd446
--- /dev/null
+++ b/queue-5.10/wifi-iwlwifi-fw-move-memset-before-early-return.patch
@@ -0,0 +1,53 @@
+From a408d5ec786ff7bf773e83424179515a33ff0c33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 13:11:58 +0300
+Subject: wifi: iwlwifi: fw: move memset before early return
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 8ce437dd5b2e4adef13aa4ecce07392f9966b1ab ]
+
+Clang static analysis reports this representative issue
+dbg.c:1455:6: warning: Branch condition evaluates to
+a garbage value
+  if (!rxf_data.size)
+       ^~~~~~~~~~~~~~
+
+This check depends on iwl_ini_get_rxf_data() to clear
+rxf_data but the function can return early without
+doing the clear.  So move the memset before the early
+return.
+
+Fixes: cc9b6012d34b ("iwlwifi: yoyo: use hweight_long instead of bit manipulating")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230414130637.872a7175f1ff.I33802a77a91998276992b088fbe25f61c87c33ac@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index 419eaa5cf0b50..79d08e5d9a81c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -1372,13 +1372,13 @@ static void iwl_ini_get_rxf_data(struct iwl_fw_runtime *fwrt,
+ 	if (!data)
+ 		return;
+ 
++	memset(data, 0, sizeof(*data));
++
+ 	/* make sure only one bit is set in only one fid */
+ 	if (WARN_ONCE(hweight_long(fid1) + hweight_long(fid2) != 1,
+ 		      "fid1=%x, fid2=%x\n", fid1, fid2))
+ 		return;
+ 
+-	memset(data, 0, sizeof(*data));
+-
+ 	if (fid1) {
+ 		fifo_idx = ffs(fid1) - 1;
+ 		if (WARN_ONCE(fifo_idx >= MAX_NUM_LMAC, "fifo_idx=%d\n",
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch b/queue-5.10/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch
new file mode 100644
index 00000000000..9ff3f1f2226
--- /dev/null
+++ b/queue-5.10/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch
@@ -0,0 +1,50 @@
+From 8af54fdc777cba3e81fc98791d4d1e07355bbbaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 15:47:38 +0300
+Subject: wifi: iwlwifi: make the loop for card preparation effective
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit 28965ec0b5d9112585f725660e2ff13218505ace ]
+
+Since we didn't reset t to 0, only the first iteration of the loop
+did checked the ready bit several times.
+From the second iteration and on, we just tested the bit once and
+continued to the next iteration.
+
+Reported-and-tested-by: Lorenzo Zolfanelli <lorenzo@zolfa.nl>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216452
+Fixes: 289e5501c314 ("iwlwifi: fix the preparation of the card")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230416154301.615b683ab9c8.Ic52c3229d3345b0064fa34263293db095d88daf8@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index daec61a60fec5..7f8b7f7697cfd 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -620,7 +620,6 @@ static int iwl_pcie_set_hw_ready(struct iwl_trans *trans)
+ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ {
+ 	int ret;
+-	int t = 0;
+ 	int iter;
+ 
+ 	IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
+@@ -635,6 +634,8 @@ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ 	usleep_range(1000, 2000);
+ 
+ 	for (iter = 0; iter < 10; iter++) {
++		int t = 0;
++
+ 		/* If HW is not ready, prepare the conditions to check again */
+ 		iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+ 			    CSR_HW_IF_CONFIG_REG_PREPARE);
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-iwlwifi-mvm-check-firmware-response-size.patch b/queue-5.10/wifi-iwlwifi-mvm-check-firmware-response-size.patch
new file mode 100644
index 00000000000..84693b4b690
--- /dev/null
+++ b/queue-5.10/wifi-iwlwifi-mvm-check-firmware-response-size.patch
@@ -0,0 +1,53 @@
+From bc66a0c15225dfab791e3f7857effbe2270707bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 11:41:33 +0300
+Subject: wifi: iwlwifi: mvm: check firmware response size
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 13513cec93ac9902d0b896976d8bab3758a9881c ]
+
+Check the firmware response size for responses to the
+memory read/write command in debugfs before using it.
+
+Fixes: 2b55f43f8e47 ("iwlwifi: mvm: Add mem debugfs entry")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230417113648.0d56fcaf68ee.I70e9571f3ed7263929b04f8fabad23c9b999e4ea@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+index 3395c46759883..36f75d5946304 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+@@ -1885,6 +1885,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
+ 	if (ret < 0)
+ 		return ret;
+ 
++	if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++		ret = -EIO;
++		goto out;
++	}
++
+ 	rsp = (void *)hcmd.resp_pkt->data;
+ 	if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) {
+ 		ret = -ENXIO;
+@@ -1962,6 +1967,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file,
+ 	if (ret < 0)
+ 		return ret;
+ 
++	if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++		ret = -EIO;
++		goto out;
++	}
++
+ 	rsp = (void *)hcmd.resp_pkt->data;
+ 	if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) {
+ 		ret = -ENXIO;
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch b/queue-5.10/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch
new file mode 100644
index 00000000000..39f2791b455
--- /dev/null
+++ b/queue-5.10/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch
@@ -0,0 +1,44 @@
+From ec2d61793e9805d100859e388dda644052aa707b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 21:40:34 +0300
+Subject: wifi: iwlwifi: yoyo: Fix possible division by zero
+
+From: Daniel Gabay <daniel.gabay@intel.com>
+
+[ Upstream commit ba30415118eee374a08b39a0460a1d1e52c24a25 ]
+
+Don't allow buffer allocation TLV with zero req_size since it
+leads later to division by zero in iwl_dbg_tlv_alloc_fragments().
+Also, NPK/SRAM locations are allowed to have zero buffer req_size,
+don't discard them.
+
+Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support")
+Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230413213309.5d6688ed74d8.I5c2f3a882b50698b708d54f4524dc5bdf11e3d32@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+index 3c931b1b2a0bb..fdf2c6ea41d96 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+@@ -191,6 +191,12 @@ static int iwl_dbg_tlv_alloc_buf_alloc(struct iwl_trans *trans,
+ 	    alloc_id != IWL_FW_INI_ALLOCATION_ID_INTERNAL)
+ 		goto err;
+ 
++	if (buf_location == IWL_FW_INI_LOCATION_DRAM_PATH &&
++	    alloc->req_size == 0) {
++		IWL_ERR(trans, "WRT: Invalid DRAM buffer allocation requested size (0)\n");
++		return -EINVAL;
++	}
++
+ 	trans->dbg.fw_mon_cfg[alloc_id] = *alloc;
+ 
+ 	return 0;
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch b/queue-5.10/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch
new file mode 100644
index 00000000000..1f9dd1d7083
--- /dev/null
+++ b/queue-5.10/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch
@@ -0,0 +1,54 @@
+From 12fca882f64b8232e63bb2c487c4e97d354d75bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 05:31:38 +0000
+Subject: wifi: rtlwifi: fix incorrect error codes in
+ rtl_debugfs_set_write_rfreg()
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 905a9241e4e8c15d2c084fee916280514848fe35 ]
+
+If there is a failure during copy_from_user or user-provided data buffer
+is invalid, rtl_debugfs_set_write_rfreg should return negative error code
+instead of a positive value count.
+
+Fix this bug by returning correct error code. Moreover, the check of buffer
+against null is removed since it will be handled by copy_from_user.
+
+Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230326053138.91338-1-harperchen1110@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index 0b1bc04cb6adb..602717928887d 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -375,8 +375,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+ 
+ 	tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+ 
+-	if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+-		return count;
++	if (copy_from_user(tmp, buffer, tmp_len))
++		return -EFAULT;
+ 
+ 	tmp[tmp_len] = '\0';
+ 
+@@ -386,7 +386,7 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+ 	if (num != 4) {
+ 		rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
+ 			"Format is <path> <addr> <mask> <data>\n");
+-		return count;
++		return -EINVAL;
+ 	}
+ 
+ 	rtl_set_rfreg(hw, path, addr, bitmask, data);
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-12104 b/queue-5.10/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-12104
new file mode 100644
index 00000000000..d6ea11c9b9b
--- /dev/null
+++ b/queue-5.10/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-12104
@@ -0,0 +1,54 @@
+From 6836b341d78e45749a7a879ba1473acce1135345 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 05:42:17 +0000
+Subject: wifi: rtlwifi: fix incorrect error codes in
+ rtl_debugfs_set_write_reg()
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 5dbe1f8eb8c5ac69394400a5b86fd81775e96c43 ]
+
+If there is a failure during copy_from_user or user-provided data buffer is
+invalid, rtl_debugfs_set_write_reg should return negative error code instead
+of a positive value count.
+
+Fix this bug by returning correct error code. Moreover, the check of buffer
+against null is removed since it will be handled by copy_from_user.
+
+Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230326054217.93492-1-harperchen1110@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index 602717928887d..9eb26dfe4ca92 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -278,8 +278,8 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+ 
+ 	tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+ 
+-	if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+-		return count;
++	if (copy_from_user(tmp, buffer, tmp_len))
++		return -EFAULT;
+ 
+ 	tmp[tmp_len] = '\0';
+ 
+@@ -287,7 +287,7 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+ 	num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
+ 
+ 	if (num !=  3)
+-		return count;
++		return -EINVAL;
+ 
+ 	switch (len) {
+ 	case 1:
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch b/queue-5.10/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch
new file mode 100644
index 00000000000..04e72c74a44
--- /dev/null
+++ b/queue-5.10/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch
@@ -0,0 +1,51 @@
+From 7bad12ea9c246845bd8cf70b67f5c91c92a8aa81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Feb 2023 23:10:04 +0100
+Subject: wifi: rtw88: mac: Return the original error from
+ rtw_mac_power_switch()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 15c8e267dfa62f207ee1db666c822324e3362b84 ]
+
+rtw_mac_power_switch() calls rtw_pwr_seq_parser() which can return
+-EINVAL, -EBUSY or 0. Propagate the original error code instead of
+unconditionally returning -EINVAL in case of an error.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230226221004.138331-3-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/mac.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c
+index fd427c606fa2d..a6d554a9dd995 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -247,6 +247,7 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
+ 	const struct rtw_pwr_seq_cmd **pwr_seq;
+ 	u8 rpwm;
+ 	bool cur_pwr;
++	int ret;
+ 
+ 	if (rtw_chip_wcpu_11ac(rtwdev)) {
+ 		rpwm = rtw_read8(rtwdev, rtwdev->hci.rpwm_addr);
+@@ -270,8 +271,9 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
+ 		return -EALREADY;
+ 
+ 	pwr_seq = pwr_on ? chip->pwr_on_seq : chip->pwr_off_seq;
+-	if (rtw_pwr_seq_parser(rtwdev, pwr_seq))
+-		return -EINVAL;
++	ret = rtw_pwr_seq_parser(rtwdev, pwr_seq);
++	if (ret)
++		return ret;
+ 
+ 	return 0;
+ }
+-- 
+2.39.2
+
diff --git a/queue-5.10/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch b/queue-5.10/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch
new file mode 100644
index 00000000000..a6579f280d5
--- /dev/null
+++ b/queue-5.10/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch
@@ -0,0 +1,39 @@
+From 536b55664d3dee252fa366905910af1be3cae359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Feb 2023 23:10:03 +0100
+Subject: wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit b7ed9fa2cb76ca7a3c3cd4a6d35748fe1fbda9f6 ]
+
+rtw_pwr_seq_parser() calls rtw_sub_pwr_seq_parser() which can either
+return -EBUSY, -EINVAL or 0. Propagate the original error code instead
+of unconditionally returning -EBUSY in case of an error.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230226221004.138331-2-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c
+index 59028b121b00e..fd427c606fa2d 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -233,7 +233,7 @@ static int rtw_pwr_seq_parser(struct rtw_dev *rtwdev,
+ 
+ 		ret = rtw_sub_pwr_seq_parser(rtwdev, intf_mask, cut_mask, cmd);
+ 		if (ret)
+-			return -EBUSY;
++			return ret;
+ 
+ 		idx++;
+ 	} while (1);
+-- 
+2.39.2
+
diff --git a/queue-5.10/workqueue-fix-hung-time-report-of-worker-pools.patch b/queue-5.10/workqueue-fix-hung-time-report-of-worker-pools.patch
new file mode 100644
index 00000000000..4d4b0f25dbf
--- /dev/null
+++ b/queue-5.10/workqueue-fix-hung-time-report-of-worker-pools.patch
@@ -0,0 +1,66 @@
+From 05923f18082703d53a80d3da8895013e50ad4667 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 13:53:31 +0100
+Subject: workqueue: Fix hung time report of worker pools
+
+From: Petr Mladek <pmladek@suse.com>
+
+[ Upstream commit 335a42ebb0ca8ee9997a1731aaaae6dcd704c113 ]
+
+The workqueue watchdog prints a warning when there is no progress in
+a worker pool. Where the progress means that the pool started processing
+a pending work item.
+
+Note that it is perfectly fine to process work items much longer.
+The progress should be guaranteed by waking up or creating idle
+workers.
+
+show_one_worker_pool() prints state of non-idle worker pool. It shows
+a delay since the last pool->watchdog_ts.
+
+The timestamp is updated when a first pending work is queued in
+__queue_work(). Also it is updated when a work is dequeued for
+processing in worker_thread() and rescuer_thread().
+
+The delay is misleading when there is no pending work item. In this
+case it shows how long the last work item is being proceed. Show
+zero instead. There is no stall if there is no pending work.
+
+Fixes: 82607adcf9cdf40fb7b ("workqueue: implement lockup detector")
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 7f57fed719957..b9041ab881bc8 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -4816,16 +4816,19 @@ void show_workqueue_state(void)
+ 	for_each_pool(pool, pi) {
+ 		struct worker *worker;
+ 		bool first = true;
++		unsigned long hung = 0;
+ 
+ 		raw_spin_lock_irqsave(&pool->lock, flags);
+ 		if (pool->nr_workers == pool->nr_idle)
+ 			goto next_pool;
+ 
++		/* How long the first pending work is waiting for a worker. */
++		if (!list_empty(&pool->worklist))
++			hung = jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000;
++
+ 		pr_info("pool %d:", pool->id);
+ 		pr_cont_pool_info(pool);
+-		pr_cont(" hung=%us workers=%d",
+-			jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000,
+-			pool->nr_workers);
++		pr_cont(" hung=%lus workers=%d", hung, pool->nr_workers);
+ 		if (pool->manager)
+ 			pr_cont(" manager: %d",
+ 				task_pid_nr(pool->manager->task));
+-- 
+2.39.2
+
diff --git a/queue-5.10/workqueue-rename-delayed-delayed-by-active-managemen.patch b/queue-5.10/workqueue-rename-delayed-delayed-by-active-managemen.patch
new file mode 100644
index 00000000000..3e687603bdf
--- /dev/null
+++ b/queue-5.10/workqueue-rename-delayed-delayed-by-active-managemen.patch
@@ -0,0 +1,256 @@
+From 700a86275b4be9867f8876dc3badec3a6b877533 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 09:32:34 +0800
+Subject: workqueue: Rename "delayed" (delayed by active management) to
+ "inactive"
+
+From: Lai Jiangshan <laijs@linux.alibaba.com>
+
+[ Upstream commit f97a4a1a3f8769e3452885967955e21c88f3f263 ]
+
+There are two kinds of "delayed" work items in workqueue subsystem.
+
+One is for timer-delayed work items which are visible to workqueue users.
+The other kind is for work items delayed by active management which can
+not be directly visible to workqueue users.  We mixed the word "delayed"
+for both kinds and caused somewhat ambiguity.
+
+This patch renames the later one (delayed by active management) to
+"inactive", because it is used for workqueue active management and
+most of its related symbols are named with "active" or "activate".
+
+All "delayed" and "DELAYED" are carefully checked and renamed one by
+one to avoid accidentally changing the name of the other kind for
+timer-delayed.
+
+No functional change intended.
+
+Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Stable-dep-of: 335a42ebb0ca ("workqueue: Fix hung time report of worker pools")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/workqueue.h |  4 +--
+ kernel/workqueue.c        | 58 +++++++++++++++++++--------------------
+ 2 files changed, 31 insertions(+), 31 deletions(-)
+
+diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
+index 26de0cae2a0a8..2fa9b311e5663 100644
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -29,7 +29,7 @@ void delayed_work_timer_fn(struct timer_list *t);
+ 
+ enum {
+ 	WORK_STRUCT_PENDING_BIT	= 0,	/* work item is pending execution */
+-	WORK_STRUCT_DELAYED_BIT	= 1,	/* work item is delayed */
++	WORK_STRUCT_INACTIVE_BIT= 1,	/* work item is inactive */
+ 	WORK_STRUCT_PWQ_BIT	= 2,	/* data points to pwq */
+ 	WORK_STRUCT_LINKED_BIT	= 3,	/* next work is linked to this one */
+ #ifdef CONFIG_DEBUG_OBJECTS_WORK
+@@ -42,7 +42,7 @@ enum {
+ 	WORK_STRUCT_COLOR_BITS	= 4,
+ 
+ 	WORK_STRUCT_PENDING	= 1 << WORK_STRUCT_PENDING_BIT,
+-	WORK_STRUCT_DELAYED	= 1 << WORK_STRUCT_DELAYED_BIT,
++	WORK_STRUCT_INACTIVE	= 1 << WORK_STRUCT_INACTIVE_BIT,
+ 	WORK_STRUCT_PWQ		= 1 << WORK_STRUCT_PWQ_BIT,
+ 	WORK_STRUCT_LINKED	= 1 << WORK_STRUCT_LINKED_BIT,
+ #ifdef CONFIG_DEBUG_OBJECTS_WORK
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 0cc2a62e88f9e..7f57fed719957 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -207,7 +207,7 @@ struct pool_workqueue {
+ 						/* L: nr of in_flight works */
+ 	int			nr_active;	/* L: nr of active works */
+ 	int			max_active;	/* L: max active works */
+-	struct list_head	delayed_works;	/* L: delayed works */
++	struct list_head	inactive_works;	/* L: inactive works */
+ 	struct list_head	pwqs_node;	/* WR: node on wq->pwqs */
+ 	struct list_head	mayday_node;	/* MD: node on wq->maydays */
+ 
+@@ -1145,7 +1145,7 @@ static void put_pwq_unlocked(struct pool_workqueue *pwq)
+ 	}
+ }
+ 
+-static void pwq_activate_delayed_work(struct work_struct *work)
++static void pwq_activate_inactive_work(struct work_struct *work)
+ {
+ 	struct pool_workqueue *pwq = get_work_pwq(work);
+ 
+@@ -1153,16 +1153,16 @@ static void pwq_activate_delayed_work(struct work_struct *work)
+ 	if (list_empty(&pwq->pool->worklist))
+ 		pwq->pool->watchdog_ts = jiffies;
+ 	move_linked_works(work, &pwq->pool->worklist, NULL);
+-	__clear_bit(WORK_STRUCT_DELAYED_BIT, work_data_bits(work));
++	__clear_bit(WORK_STRUCT_INACTIVE_BIT, work_data_bits(work));
+ 	pwq->nr_active++;
+ }
+ 
+-static void pwq_activate_first_delayed(struct pool_workqueue *pwq)
++static void pwq_activate_first_inactive(struct pool_workqueue *pwq)
+ {
+-	struct work_struct *work = list_first_entry(&pwq->delayed_works,
++	struct work_struct *work = list_first_entry(&pwq->inactive_works,
+ 						    struct work_struct, entry);
+ 
+-	pwq_activate_delayed_work(work);
++	pwq_activate_inactive_work(work);
+ }
+ 
+ /**
+@@ -1185,10 +1185,10 @@ static void pwq_dec_nr_in_flight(struct pool_workqueue *pwq, int color)
+ 	pwq->nr_in_flight[color]--;
+ 
+ 	pwq->nr_active--;
+-	if (!list_empty(&pwq->delayed_works)) {
+-		/* one down, submit a delayed one */
++	if (!list_empty(&pwq->inactive_works)) {
++		/* one down, submit an inactive one */
+ 		if (pwq->nr_active < pwq->max_active)
+-			pwq_activate_first_delayed(pwq);
++			pwq_activate_first_inactive(pwq);
+ 	}
+ 
+ 	/* is flush in progress and are we at the flushing tip? */
+@@ -1290,14 +1290,14 @@ static int try_to_grab_pending(struct work_struct *work, bool is_dwork,
+ 		debug_work_deactivate(work);
+ 
+ 		/*
+-		 * A delayed work item cannot be grabbed directly because
++		 * An inactive work item cannot be grabbed directly because
+ 		 * it might have linked NO_COLOR work items which, if left
+-		 * on the delayed_list, will confuse pwq->nr_active
++		 * on the inactive_works list, will confuse pwq->nr_active
+ 		 * management later on and cause stall.  Make sure the work
+ 		 * item is activated before grabbing.
+ 		 */
+-		if (*work_data_bits(work) & WORK_STRUCT_DELAYED)
+-			pwq_activate_delayed_work(work);
++		if (*work_data_bits(work) & WORK_STRUCT_INACTIVE)
++			pwq_activate_inactive_work(work);
+ 
+ 		list_del_init(&work->entry);
+ 		pwq_dec_nr_in_flight(pwq, get_work_color(work));
+@@ -1496,8 +1496,8 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
+ 		if (list_empty(worklist))
+ 			pwq->pool->watchdog_ts = jiffies;
+ 	} else {
+-		work_flags |= WORK_STRUCT_DELAYED;
+-		worklist = &pwq->delayed_works;
++		work_flags |= WORK_STRUCT_INACTIVE;
++		worklist = &pwq->inactive_works;
+ 	}
+ 
+ 	debug_work_activate(work);
+@@ -2534,7 +2534,7 @@ static int rescuer_thread(void *__rescuer)
+ 			/*
+ 			 * The above execution of rescued work items could
+ 			 * have created more to rescue through
+-			 * pwq_activate_first_delayed() or chained
++			 * pwq_activate_first_inactive() or chained
+ 			 * queueing.  Let's put @pwq back on mayday list so
+ 			 * that such back-to-back work items, which may be
+ 			 * being used to relieve memory pressure, don't
+@@ -2960,7 +2960,7 @@ void drain_workqueue(struct workqueue_struct *wq)
+ 		bool drained;
+ 
+ 		raw_spin_lock_irq(&pwq->pool->lock);
+-		drained = !pwq->nr_active && list_empty(&pwq->delayed_works);
++		drained = !pwq->nr_active && list_empty(&pwq->inactive_works);
+ 		raw_spin_unlock_irq(&pwq->pool->lock);
+ 
+ 		if (drained)
+@@ -3714,7 +3714,7 @@ static void pwq_unbound_release_workfn(struct work_struct *work)
+  * @pwq: target pool_workqueue
+  *
+  * If @pwq isn't freezing, set @pwq->max_active to the associated
+- * workqueue's saved_max_active and activate delayed work items
++ * workqueue's saved_max_active and activate inactive work items
+  * accordingly.  If @pwq is freezing, clear @pwq->max_active to zero.
+  */
+ static void pwq_adjust_max_active(struct pool_workqueue *pwq)
+@@ -3743,9 +3743,9 @@ static void pwq_adjust_max_active(struct pool_workqueue *pwq)
+ 
+ 		pwq->max_active = wq->saved_max_active;
+ 
+-		while (!list_empty(&pwq->delayed_works) &&
++		while (!list_empty(&pwq->inactive_works) &&
+ 		       pwq->nr_active < pwq->max_active) {
+-			pwq_activate_first_delayed(pwq);
++			pwq_activate_first_inactive(pwq);
+ 			kick = true;
+ 		}
+ 
+@@ -3776,7 +3776,7 @@ static void init_pwq(struct pool_workqueue *pwq, struct workqueue_struct *wq,
+ 	pwq->wq = wq;
+ 	pwq->flush_color = -1;
+ 	pwq->refcnt = 1;
+-	INIT_LIST_HEAD(&pwq->delayed_works);
++	INIT_LIST_HEAD(&pwq->inactive_works);
+ 	INIT_LIST_HEAD(&pwq->pwqs_node);
+ 	INIT_LIST_HEAD(&pwq->mayday_node);
+ 	INIT_WORK(&pwq->unbound_release_work, pwq_unbound_release_workfn);
+@@ -4363,7 +4363,7 @@ static bool pwq_busy(struct pool_workqueue *pwq)
+ 
+ 	if ((pwq != pwq->wq->dfl_pwq) && (pwq->refcnt > 1))
+ 		return true;
+-	if (pwq->nr_active || !list_empty(&pwq->delayed_works))
++	if (pwq->nr_active || !list_empty(&pwq->inactive_works))
+ 		return true;
+ 
+ 	return false;
+@@ -4559,7 +4559,7 @@ bool workqueue_congested(int cpu, struct workqueue_struct *wq)
+ 	else
+ 		pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu));
+ 
+-	ret = !list_empty(&pwq->delayed_works);
++	ret = !list_empty(&pwq->inactive_works);
+ 	preempt_enable();
+ 	rcu_read_unlock();
+ 
+@@ -4755,11 +4755,11 @@ static void show_pwq(struct pool_workqueue *pwq)
+ 		pr_cont("\n");
+ 	}
+ 
+-	if (!list_empty(&pwq->delayed_works)) {
++	if (!list_empty(&pwq->inactive_works)) {
+ 		bool comma = false;
+ 
+-		pr_info("    delayed:");
+-		list_for_each_entry(work, &pwq->delayed_works, entry) {
++		pr_info("    inactive:");
++		list_for_each_entry(work, &pwq->inactive_works, entry) {
+ 			pr_cont_work(comma, work);
+ 			comma = !(*work_data_bits(work) & WORK_STRUCT_LINKED);
+ 		}
+@@ -4789,7 +4789,7 @@ void show_workqueue_state(void)
+ 		bool idle = true;
+ 
+ 		for_each_pwq(pwq, wq) {
+-			if (pwq->nr_active || !list_empty(&pwq->delayed_works)) {
++			if (pwq->nr_active || !list_empty(&pwq->inactive_works)) {
+ 				idle = false;
+ 				break;
+ 			}
+@@ -4801,7 +4801,7 @@ void show_workqueue_state(void)
+ 
+ 		for_each_pwq(pwq, wq) {
+ 			raw_spin_lock_irqsave(&pwq->pool->lock, flags);
+-			if (pwq->nr_active || !list_empty(&pwq->delayed_works))
++			if (pwq->nr_active || !list_empty(&pwq->inactive_works))
+ 				show_pwq(pwq);
+ 			raw_spin_unlock_irqrestore(&pwq->pool->lock, flags);
+ 			/*
+@@ -5176,7 +5176,7 @@ EXPORT_SYMBOL_GPL(work_on_cpu_safe);
+  * freeze_workqueues_begin - begin freezing workqueues
+  *
+  * Start freezing workqueues.  After this function returns, all freezable
+- * workqueues will queue new works to their delayed_works list instead of
++ * workqueues will queue new works to their inactive_works list instead of
+  * pool->worklist.
+  *
+  * CONTEXT:
+-- 
+2.39.2
+
diff --git a/queue-5.10/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch b/queue-5.10/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch
new file mode 100644
index 00000000000..6e0b14c3c61
--- /dev/null
+++ b/queue-5.10/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch
@@ -0,0 +1,49 @@
+From ae1b3cabe31d45e475f1437fea8cca0e4ea9ea30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 17:09:17 +0100
+Subject: x86/apic: Fix atomic update of offset in reserve_eilvt_offset()
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit f96fb2df3eb31ede1b34b0521560967310267750 ]
+
+The detection of atomic update failure in reserve_eilvt_offset() is
+not correct. The value returned by atomic_cmpxchg() should be compared
+to the old value from the location to be updated.
+
+If these two are the same, then atomic update succeeded and
+"eilvt_offsets[offset]" location is updated to "new" in an atomic way.
+
+Otherwise, the atomic update failed and it should be retried with the
+value from "eilvt_offsets[offset]" - exactly what atomic_try_cmpxchg()
+does in a correct and more optimal way.
+
+Fixes: a68c439b1966c ("apic, x86: Check if EILVT APIC registers are available (AMD only)")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230227160917.107820-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/apic.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 1c96f2425eafd..25eb69f26e039 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -410,10 +410,9 @@ static unsigned int reserve_eilvt_offset(int offset, unsigned int new)
+ 		if (vector && !eilvt_entry_is_changeable(vector, new))
+ 			/* may not change if vectors are different */
+ 			return rsvd;
+-		rsvd = atomic_cmpxchg(&eilvt_offsets[offset], rsvd, new);
+-	} while (rsvd != new);
++	} while (!atomic_try_cmpxchg(&eilvt_offsets[offset], &rsvd, new));
+ 
+-	rsvd &= ~APIC_EILVT_MASKED;
++	rsvd = new & ~APIC_EILVT_MASKED;
+ 	if (rsvd && rsvd != vector)
+ 		pr_info("LVT offset %d assigned for vector 0x%02x\n",
+ 			offset, rsvd);
+-- 
+2.39.2
+
diff --git a/queue-5.10/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch b/queue-5.10/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch
new file mode 100644
index 00000000000..b2c536c34a2
--- /dev/null
+++ b/queue-5.10/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch
@@ -0,0 +1,72 @@
+From 5ab4fa94db63319a1628a63c026ae1d0c31702e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 00:30:04 -0700
+Subject: x86/ioapic: Don't return 0 from arch_dynirq_lower_bound()
+
+From: Saurabh Sengar <ssengar@linux.microsoft.com>
+
+[ Upstream commit 5af507bef93c09a94fb8f058213b489178f4cbe5 ]
+
+arch_dynirq_lower_bound() is invoked by the core interrupt code to
+retrieve the lowest possible Linux interrupt number for dynamically
+allocated interrupts like MSI.
+
+The x86 implementation uses this to exclude the IO/APIC GSI space.
+This works correctly as long as there is an IO/APIC registered, but
+returns 0 if not. This has been observed in VMs where the BIOS does
+not advertise an IO/APIC.
+
+0 is an invalid interrupt number except for the legacy timer interrupt
+on x86. The return value is unchecked in the core code, so it ends up
+to allocate interrupt number 0 which is subsequently considered to be
+invalid by the caller, e.g. the MSI allocation code.
+
+The function has already a check for 0 in the case that an IO/APIC is
+registered, as ioapic_dynirq_base is 0 in case of device tree setups.
+
+Consolidate this and zero check for both ioapic_dynirq_base and gsi_top,
+which is used in the case that no IO/APIC is registered.
+
+Fixes: 3e5bedc2c258 ("x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines")
+Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/1679988604-20308-1-git-send-email-ssengar@linux.microsoft.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/io_apic.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 25b1d5c6af969..74794387bf59d 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2442,17 +2442,21 @@ static int io_apic_get_redir_entries(int ioapic)
+ 
+ unsigned int arch_dynirq_lower_bound(unsigned int from)
+ {
++	unsigned int ret;
++
+ 	/*
+ 	 * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use
+ 	 * gsi_top if ioapic_dynirq_base hasn't been initialized yet.
+ 	 */
+-	if (!ioapic_initialized)
+-		return gsi_top;
++	ret = ioapic_dynirq_base ? : gsi_top;
++
+ 	/*
+-	 * For DT enabled machines ioapic_dynirq_base is irrelevant and not
+-	 * updated. So simply return @from if ioapic_dynirq_base == 0.
++	 * For DT enabled machines ioapic_dynirq_base is irrelevant and
++	 * always 0. gsi_top can be 0 if there is no IO/APIC registered.
++	 * 0 is an invalid interrupt number for dynamic allocations. Return
++	 * @from instead.
+ 	 */
+-	return ioapic_dynirq_base ? : from;
++	return ret ? : from;
+ }
+ 
+ #ifdef CONFIG_X86_32
+-- 
+2.39.2
+
diff --git a/queue-5.10/x86-mce-amd-use-an-u64-for-bank_map.patch b/queue-5.10/x86-mce-amd-use-an-u64-for-bank_map.patch
new file mode 100644
index 00000000000..361e782242e
--- /dev/null
+++ b/queue-5.10/x86-mce-amd-use-an-u64-for-bank_map.patch
@@ -0,0 +1,99 @@
+From dbef2732796c8fda641fd4442407923429df66ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 15:16:01 +0000
+Subject: x86/MCE/AMD: Use an u64 for bank_map
+
+From: Muralidhara M K <muralimk@amd.com>
+
+[ Upstream commit 4c1cdec319b9aadb65737c3eb1f5cb74bd6aa156 ]
+
+Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see
+
+  a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64").
+
+However, the bank_map which contains a bitfield of which banks to
+initialize is of type unsigned int and that overflows when those bit
+numbers are >= 32, leading to UBSAN complaining correctly:
+
+  UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38
+  shift exponent 32 is too large for 32-bit type 'int'
+
+Change the bank_map to a u64 and use the proper BIT_ULL() macro when
+modifying bits in there.
+
+  [ bp: Rewrite commit message. ]
+
+Fixes: a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64")
+Signed-off-by: Muralidhara M K <muralimk@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230127151601.1068324-1-muralimk@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mce/amd.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c
+index 4f9b7c1cfc36f..cd8db6b9ca2f5 100644
+--- a/arch/x86/kernel/cpu/mce/amd.c
++++ b/arch/x86/kernel/cpu/mce/amd.c
+@@ -197,10 +197,10 @@ static DEFINE_PER_CPU(struct threshold_bank **, threshold_banks);
+  * A list of the banks enabled on each logical CPU. Controls which respective
+  * descriptors to initialize later in mce_threshold_create_device().
+  */
+-static DEFINE_PER_CPU(unsigned int, bank_map);
++static DEFINE_PER_CPU(u64, bank_map);
+ 
+ /* Map of banks that have more than MCA_MISC0 available. */
+-static DEFINE_PER_CPU(u32, smca_misc_banks_map);
++static DEFINE_PER_CPU(u64, smca_misc_banks_map);
+ 
+ static void amd_threshold_interrupt(void);
+ static void amd_deferred_error_interrupt(void);
+@@ -229,7 +229,7 @@ static void smca_set_misc_banks_map(unsigned int bank, unsigned int cpu)
+ 		return;
+ 
+ 	if (low & MASK_BLKPTR_LO)
+-		per_cpu(smca_misc_banks_map, cpu) |= BIT(bank);
++		per_cpu(smca_misc_banks_map, cpu) |= BIT_ULL(bank);
+ 
+ }
+ 
+@@ -492,7 +492,7 @@ static u32 smca_get_block_address(unsigned int bank, unsigned int block,
+ 	if (!block)
+ 		return MSR_AMD64_SMCA_MCx_MISC(bank);
+ 
+-	if (!(per_cpu(smca_misc_banks_map, cpu) & BIT(bank)))
++	if (!(per_cpu(smca_misc_banks_map, cpu) & BIT_ULL(bank)))
+ 		return 0;
+ 
+ 	return MSR_AMD64_SMCA_MCx_MISCy(bank, block - 1);
+@@ -536,7 +536,7 @@ prepare_threshold_block(unsigned int bank, unsigned int block, u32 addr,
+ 	int new;
+ 
+ 	if (!block)
+-		per_cpu(bank_map, cpu) |= (1 << bank);
++		per_cpu(bank_map, cpu) |= BIT_ULL(bank);
+ 
+ 	memset(&b, 0, sizeof(b));
+ 	b.cpu			= cpu;
+@@ -1048,7 +1048,7 @@ static void amd_threshold_interrupt(void)
+ 		return;
+ 
+ 	for (bank = 0; bank < this_cpu_read(mce_num_banks); ++bank) {
+-		if (!(per_cpu(bank_map, cpu) & (1 << bank)))
++		if (!(per_cpu(bank_map, cpu) & BIT_ULL(bank)))
+ 			continue;
+ 
+ 		first_block = bp[bank]->blocks;
+@@ -1525,7 +1525,7 @@ int mce_threshold_create_device(unsigned int cpu)
+ 		return -ENOMEM;
+ 
+ 	for (bank = 0; bank < numbanks; ++bank) {
+-		if (!(this_cpu_read(bank_map) & (1 << bank)))
++		if (!(this_cpu_read(bank_map) & BIT_ULL(bank)))
+ 			continue;
+ 		err = threshold_create_bank(bp, cpu, bank);
+ 		if (err) {
+-- 
+2.39.2
+
diff --git a/queue-5.10/xsk-fix-unaligned-descriptor-validation.patch b/queue-5.10/xsk-fix-unaligned-descriptor-validation.patch
new file mode 100644
index 00000000000..150b83ecc8b
--- /dev/null
+++ b/queue-5.10/xsk-fix-unaligned-descriptor-validation.patch
@@ -0,0 +1,65 @@
+From 6be2ddb398d70ae14cb4294b92f3e548466dbd86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 01:59:18 +0200
+Subject: xsk: Fix unaligned descriptor validation
+
+From: Kal Conley <kal.conley@dectris.com>
+
+[ Upstream commit d769ccaf957fe7391f357c0a923de71f594b8a2b ]
+
+Make sure unaligned descriptors that straddle the end of the UMEM are
+considered invalid. Currently, descriptor validation is broken for
+zero-copy mode which only checks descriptors at page granularity.
+For example, descriptors in zero-copy mode that overrun the end of the
+UMEM but not a page boundary are (incorrectly) considered valid. The
+UMEM boundary check needs to happen before the page boundary and
+contiguity checks in xp_desc_crosses_non_contig_pg(). Do this check in
+xp_unaligned_validate_desc() instead like xp_check_unaligned() already
+does.
+
+Fixes: 2b43470add8c ("xsk: Introduce AF_XDP buffer allocation API")
+Signed-off-by: Kal Conley <kal.conley@dectris.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/r/20230405235920.7305-2-kal.conley@dectris.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xsk_buff_pool.h | 9 ++-------
+ net/xdp/xsk_queue.h         | 1 +
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/xsk_buff_pool.h b/include/net/xsk_buff_pool.h
+index c9a47d3d8f503..5a63e3b12335a 100644
+--- a/include/net/xsk_buff_pool.h
++++ b/include/net/xsk_buff_pool.h
+@@ -150,13 +150,8 @@ static inline bool xp_desc_crosses_non_contig_pg(struct xsk_buff_pool *pool,
+ 	if (likely(!cross_pg))
+ 		return false;
+ 
+-	if (pool->dma_pages_cnt) {
+-		return !(pool->dma_pages[addr >> PAGE_SHIFT] &
+-			 XSK_NEXT_PG_CONTIG_MASK);
+-	}
+-
+-	/* skb path */
+-	return addr + len > pool->addrs_cnt;
++	return pool->dma_pages_cnt &&
++	       !(pool->dma_pages[addr >> PAGE_SHIFT] & XSK_NEXT_PG_CONTIG_MASK);
+ }
+ 
+ static inline u64 xp_aligned_extract_addr(struct xsk_buff_pool *pool, u64 addr)
+diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
+index 3c7ce60fe9a5a..a76d43787549f 100644
+--- a/net/xdp/xsk_queue.h
++++ b/net/xdp/xsk_queue.h
+@@ -155,6 +155,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool,
+ 		return false;
+ 
+ 	if (base_addr >= pool->addrs_cnt || addr >= pool->addrs_cnt ||
++	    addr + desc->len > pool->addrs_cnt ||
+ 	    xp_desc_crosses_non_contig_pg(pool, addr, desc->len))
+ 		return false;
+ 
+-- 
+2.39.2
+
-- 
2.47.3