Update to 5.18.6.p2-1

- New upstream release based on 5.18.5
- Add MGLRU Zen patch
- Add linux-5.18.6 patches
- Move System.map from -headers into the base package to avoid
  external modules having wrong bpf symbols when running optimized
  builds. Fixes #5
- Remove M/m from CPUSUFFIXES_KBUILD and LCPU, fixes build failing
  when selecting an optimized build architecture that is not genering.
  Fixes #6.

Signed-off-by: Björn Bidar <bjorn.bidar@thaodan.de>

144 files changed, 12616 insertions, 43 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 726f7710845d..ddaa01718c1d 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,8 +1,8 @@
 # Generated by mksrcinfo v8
-# Mon Jun  6 09:37:16 UTC 2022
+# Fri Jun 24 17:26:43 UTC 2022
 pkgbase = linux-pf
 	pkgdesc = Linux with the pf-kernel patch (uksm, ZSTD, FSGSBASE and more)
-	pkgver = 5.18.0.pf1
+	pkgver = 5.18.6.pf2
 	pkgrel = 1
 	url = https://gitlab.com/post-factum/pf-kernel/wikis/README
 	arch = i686
@@ -24,7 +24,7 @@ pkgbase = linux-pf
 	source = config.i686
 	source = pf_defconfig
 	source = linux.preset
-	source = https://github.com/pfactum/pf-kernel/compare/v5.18...v5.18-pf1.diff
+	source = https://github.com/pfactum/pf-kernel/compare/v5.18...v5.18-pf2.diff
 	source = 90-linux.hook
 	source = 60-linux.hook
 	source = 0002-ZEN-Add-VHBA-driver.patch
@@ -53,13 +53,155 @@ pkgbase = linux-pf
 	source = 0028-ZEN-INTERACTIVE-mm-Disable-proactive-compaction-by-d.patch
 	source = 0029-ZEN-HID-lenovo-Add-support-for-ThinkPad-TrackPoint-K.patch
 	source = 0030-ZEN-dm-crypt-Disable-workqueues-for-crypto-operation.patch
+	source = 0015-ZEN-Tune-mgLRU-to-protect-cache-used-in-the-last-sec.patch
+	source = 0001-Revert-drm-amd-display-Fix-DCN3-B0-DP-Alt-Mapping.patch
+	source = 0002-arm64-dts-imx8mm-beacon-Enable-RTS-CTS-on-UART3.patch
+	source = 0003-arm64-dts-imx8mn-beacon-Enable-RTS-CTS-on-UART3.patch
+	source = 0004-io_uring-reinstate-the-inflight-tracking.patch
+	source = 0005-powerpc-kasan-Silence-KASAN-warnings-in-__get_wchan.patch
+	source = 0006-ASoC-nau8822-Add-operation-for-internal-PLL-off-and-.patch
+	source = 0007-ASoC-qcom-lpass-platform-Update-VMA-access-permissio.patch
+	source = 0008-drm-amd-display-Read-Golden-Settings-Table-from-VBIO.patch
+	source = 0009-drm-amdgpu-Resolve-RAS-GFX-error-count-issue-after-c.patch
+	source = 0010-drm-amdkfd-Use-mmget_not_zero-in-MMU-notifier.patch
+	source = 0011-dma-debug-make-things-less-spammy-under-memory-press.patch
+	source = 0012-ASoC-Intel-cirrus-common-fix-incorrect-channel-mappi.patch
+	source = 0013-ASoC-cs42l52-Fix-TLV-scales-for-mixer-controls.patch
+	source = 0014-ASoC-cs35l36-Update-digital-volume-TLV.patch
+	source = 0015-ASoC-cs53l30-Correct-number-of-volume-levels-on-SX-c.patch
+	source = 0016-ASoC-cs42l52-Correct-TLV-for-Bypass-Volume.patch
+	source = 0017-ASoC-cs42l56-Correct-typo-in-minimum-level-for-SX-vo.patch
+	source = 0018-ASoC-cs42l51-Correct-minimum-value-for-SX-volume-con.patch
+	source = 0019-drm-amdkfd-add-pinned-BOs-to-kfd_bo_list.patch
+	source = 0020-ata-libata-core-fix-NULL-pointer-deref-in-ata_host_a.patch
+	source = 0021-quota-Prevent-memory-allocation-recursion-while-hold.patch
+	source = 0022-ASoC-wm8962-Fix-suspend-while-playing-music.patch
+	source = 0023-ASoC-es8328-Fix-event-generation-for-deemphasis-cont.patch
+	source = 0024-ASoC-wm_adsp-Fix-event-generation-for-wm_adsp_fw_put.patch
+	source = 0025-ALSA-hda-MTL-add-HD-Audio-PCI-ID-and-HDMI-codec-vend.patch
+	source = 0026-Input-soc_button_array-also-add-Lenovo-Yoga-Tablet2-.patch
+	source = 0027-scsi-vmw_pvscsi-Expand-vcpuHint-to-16-bits.patch
+	source = 0028-scsi-lpfc-Resolve-NULL-ptr-dereference-after-an-ELS-.patch
+	source = 0029-scsi-lpfc-Fix-port-stuck-in-bypassed-state-after-LIP.patch
+	source = 0030-scsi-lpfc-Allow-reduced-polling-rate-for-nvme_admin_.patch
+	source = 0031-scsi-mpt3sas-Fix-out-of-bounds-compiler-warning.patch
+	source = 0032-scsi-ipr-Fix-missing-incorrect-resource-cleanup-in-e.patch
+	source = 0033-scsi-pmcraid-Fix-missing-resource-cleanup-in-error-c.patch
+	source = 0034-ALSA-hda-realtek-Add-HW8326-support.patch
+	source = 0035-virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch
+	source = 0036-nfc-nfcmrvl-Fix-memory-leak-in-nfcmrvl_play_deferred.patch
+	source = 0037-ipv6-Fix-signed-integer-overflow-in-__ip6_append_dat.patch
+	source = 0038-ipv6-Fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch
+	source = 0039-net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch
+	source = 0040-gcc-12-disable-Wdangling-pointer-warning-for-now.patch
+	source = 0041-mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch
+	source = 0042-gcc-12-disable-Warray-bounds-universally-for-now.patch
+	source = 0043-netfs-gcc-12-temporarily-disable-Wattribute-warning-.patch
+	source = 0044-MIPS-Loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch
+	source = 0045-random-credit-cpu-and-bootloader-seeds-by-default.patch
+	source = 0046-gpio-dwapb-Don-t-print-error-on-EPROBE_DEFER.patch
+	source = 0047-platform-x86-intel-Fix-pmt_crashlog-array-reference.patch
+	source = 0048-platform-x86-intel-pmc-Support-Intel-Raptorlake-P.patch
+	source = 0049-platform-x86-gigabyte-wmi-Add-Z690M-AORUS-ELITE-AX-D.patch
+	source = 0050-platform-x86-gigabyte-wmi-Add-support-for-B450M-DS3H.patch
+	source = 0051-platform-x86-intel-hid-Add-Surface-Go-to-VGBS-allow-.patch
+	source = 0052-staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch
+	source = 0053-staging-r8188eu-Fix-warning-of-array-overflow-in-ioc.patch
+	source = 0054-pNFS-Don-t-keep-retrying-if-the-server-replied-NFS4E.patch
+	source = 0055-pNFS-Avoid-a-live-lock-condition-in-pnfs_update_layo.patch
+	source = 0056-sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch
+	source = 0057-clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch
+	source = 0058-i40e-Fix-adding-ADQ-filter-to-TC0.patch
+	source = 0059-i40e-Fix-calculating-the-number-of-queue-pairs.patch
+	source = 0060-i40e-Fix-call-trace-in-setup_tx_descriptors.patch
+	source = 0061-iavf-Fix-issue-with-MAC-address-of-VF-shown-as-zero.patch
+	source = 0062-Drivers-hv-vmbus-Release-cpu-lock-in-error-case.patch
+	source = 0063-tty-goldfish-Fix-free_irq-on-remove.patch
+	source = 0064-misc-atmel-ssc-Fix-IRQ-check-in-ssc_probe.patch
+	source = 0065-riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch
+	source = 0066-io_uring-fix-races-with-file-table-unregister.patch
+	source = 0067-io_uring-fix-races-with-buffer-table-unregister.patch
+	source = 0068-drm-i915-reset-Fix-error_state_read-ptr-offset-use.patch
+	source = 0069-net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch
+	source = 0070-net-hns3-don-t-push-link-state-to-VF-if-unalive.patch
+	source = 0071-net-hns3-restore-tm-priority-qset-to-default-setting.patch
+	source = 0072-net-hns3-fix-PF-rss-size-initialization-bug.patch
+	source = 0073-net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch
+	source = 0074-nvme-add-device-name-to-warning-in-uuid_show.patch
+	source = 0075-mlxsw-spectrum_cnt-Reorder-counter-pools.patch
+	source = 0076-ice-Fix-PTP-TX-timestamp-offset-calculation.patch
+	source = 0077-ice-Sync-VLAN-filtering-features-for-DVM.patch
+	source = 0078-ice-Fix-queue-config-fail-handling.patch
+	source = 0079-ice-Fix-memory-corruption-in-VF-driver.patch
+	source = 0080-net-bgmac-Fix-an-erroneous-kfree-in-bgmac_remove.patch
+	source = 0081-net-remove-noblock-parameter-from-skb_recv_datagram.patch
+	source = 0082-net-ax25-Fix-deadlock-caused-by-skb_recv_datagram-in.patch
+	source = 0083-arm64-ftrace-fix-branch-range-checks.patch
+	source = 0084-arm64-ftrace-consistently-handle-PLTs.patch
+	source = 0085-certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch
+	source = 0086-init-Initialize-noop_backing_dev_info-early.patch
+	source = 0087-block-Fix-handling-of-offline-queues-in-blk_mq_alloc.patch
+	source = 0088-faddr2line-Fix-overlapping-text-section-failures-the.patch
+	source = 0089-x86-ftrace-Remove-OBJECT_FILES_NON_STANDARD-usage.patch
+	source = 0090-i2c-npcm7xx-Add-check-for-platform_driver_register.patch
+	source = 0091-irqchip-gic-realview-Fix-refcount-leak-in-realview_g.patch
+	source = 0092-irqchip-apple-aic-Fix-refcount-leak-in-build_fiq_aff.patch
+	source = 0093-irqchip-apple-aic-Fix-refcount-leak-in-aic_of_ic_ini.patch
+	source = 0094-irqchip-gic-v3-Fix-error-handling-in-gic_populate_pp.patch
+	source = 0095-irqchip-gic-v3-Fix-refcount-leak-in-gic_populate_ppi.patch
+	source = 0096-irqchip-realtek-rtl-Fix-refcount-leak-in-map_interru.patch
+	source = 0097-sched-Fix-balance_push-vs-__sched_setscheduler.patch
+	source = 0098-i2c-designware-Use-standard-optional-ref-clock-imple.patch
+	source = 0099-i2c-mediatek-Fix-an-error-handling-path-in-mtk_i2c_p.patch
+	source = 0100-mei-hbm-drop-capability-response-on-early-shutdown.patch
+	source = 0101-mei-me-add-raptor-lake-point-S-DID.patch
+	source = 0102-comedi-vmk80xx-fix-expression-for-tx-buffer-size.patch
+	source = 0103-crypto-memneq-move-into-lib.patch
+	source = 0104-USB-serial-option-add-support-for-Cinterion-MV31-wit.patch
+	source = 0105-USB-serial-io_ti-add-Agilent-E5805A-support.patch
+	source = 0106-arm64-mm-Don-t-invalidate-FROM_DEVICE-buffers-at-sta.patch
+	source = 0107-usb-dwc2-Fix-memory-leak-in-dwc2_hcd_init.patch
+	source = 0108-usb-cdnsp-Fixed-setting-last_trb-incorrectly.patch
+	source = 0109-usb-dwc3-gadget-Fix-IN-endpoint-max-packet-size-allo.patch
+	source = 0110-usb-dwc3-pci-Restore-line-lost-in-merge-conflict-res.patch
+	source = 0111-usb-gadget-u_ether-fix-regression-in-setting-fixed-M.patch
+	source = 0112-usb-gadget-lpc32xx_udc-Fix-refcount-leak-in-lpc32xx_.patch
+	source = 0113-usb-gadget-f_fs-change-ep-status-safe-in-ffs_epfile_.patch
+	source = 0114-usb-gadget-f_fs-change-ep-ep-safe-in-ffs_epfile_io.patch
+	source = 0115-tty-n_gsm-Debug-output-allocation-must-use-GFP_ATOMI.patch
+	source = 0116-serial-8250-Store-to-lsr_save_flags-after-lsr-read.patch
+	source = 0117-bus-fsl-mc-bus-fix-KASAN-use-after-free-in-fsl_mc_bu.patch
+	source = 0118-md-raid5-ppl-Fix-argument-order-in-bio_alloc_bioset.patch
+	source = 0119-dm-fix-race-in-dm_start_io_acct.patch
+	source = 0120-dm-mirror-log-round-up-region-bitmap-size-to-BITS_PE.patch
+	source = 0121-drm-amdgpu-Fix-GTT-size-reporting-in-amdgpu_ioctl.patch
+	source = 0122-drm-amd-display-Cap-OLED-brightness-per-max-frame-av.patch
+	source = 0123-audit-free-module-name.patch
+	source = 0124-cfi-Fix-__cfi_slowpath_diag-RCU-usage-with-cpuidle.patch
+	source = 0125-fs-account-for-group-membership.patch
+	source = 0126-selinux-free-contexts-previously-transferred-in-seli.patch
+	source = 0127-ext4-fix-super-block-checksum-incorrect-after-mount.patch
+	source = 0128-ext4-fix-bug_on-ext4_mb_use_inode_pa.patch
+	source = 0129-ext4-make-variable-count-signed.patch
+	source = 0130-ext4-add-reserved-GDT-blocks-check.patch
+	source = 0131-KVM-arm64-Always-start-with-clearing-SVE-flag-on-loa.patch
+	source = 0132-KVM-arm64-Don-t-read-a-HW-interrupt-pending-state-in.patch
+	source = 0133-virtio-pci-Remove-wrong-address-verification-in-vp_d.patch
+	source = 0134-netfs-Fix-gcc-12-warning-by-embedding-vfs-inode-in-n.patch
+	source = 0135-drm-i915-uc-remove-accidental-static-from-a-local-va.patch
+	source = 0136-bpf-Use-safer-kvmalloc_array-where-possible.patch
+	source = 0137-powerpc-book3e-get-rid-of-include-generated-compile..patch
+	source = 0138-dt-bindings-mfd-bd9571mwv-update-rohm-bd9571mwv.yaml.patch
+	source = 0139-dt-bindings-interrupt-controller-update-brcm-l2-intc.patch
+	source = 0140-dm-fix-bio_set-allocation.patch
+	source = 0141-clk-imx8mp-fix-usb_root_clk-parent.patch
 	source = asus_zenith_ii_map.patch::https://bugzilla.kernel.org/attachment.cgi?id=294489
 	sha256sums = 51f3f1684a896e797182a0907299cc1f0ff5e5b51dd9a55478ae63a409855cee
 	sha256sums = 5770ad7cc2d34367193cfbeb2a8a37e46c73470b3f6ec7ad63a1cadab4245fbc
 	sha256sums = 93ebf63c9e95a9b8a7ae325ce11508334ca83fd00db9677c483216a6bdef3c68
 	sha256sums = 30566498a4f549e972fcd430d2fc44b2bd643c55bae20096f083f8837d8c43e4
 	sha256sums = 82d660caa11db0cd34fd550a049d7296b4a9dcd28f2a50c81418066d6e598864
-	sha256sums = 44fb5d030166ba3ac3290751f93c9c08f38c725283efc4a7449ea933993a65d7
+	sha256sums = 5463b44b2c66657e973bdb157e9507df5a9d4964c3689e0da9fe7c9af395d80e
 	sha256sums = 75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919
 	sha256sums = ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21
 	sha256sums = 7ef319249df009695b5477e30536e3edb07bcc93a58a76a63e58b012bb7debb1
@@ -88,6 +230,148 @@ pkgbase = linux-pf
 	sha256sums = 93b9b6124929ad689226b055be89cfd13be36ca927d0bed8508b069e080b7149
 	sha256sums = 76c90c2615b431c20d74926c03648dc482b5959951d4a10dddcac1c8cdde1f55
 	sha256sums = cc78995e6475785477e89733697492b962f3b393ad59dbf49ef34865dc2a073b
+	sha256sums = 6a7f697265eca470f6ef5129ab2659dd870c6846d492c23f7b9f091086f067c7
+	sha256sums = bf4580c6a5a449538f48af19351d2baa7cd0c59ba8df7fcac233ca12a720554c
+	sha256sums = 3365e896241ae6288b4c0f79cc88934f47feaa9d5c641bcb552d2d7d868d236c
+	sha256sums = 53bd11efc31e9cdb77a21f911fa04f6850bce064bfcb0632d71605a60e825df2
+	sha256sums = 7b08d88bc5ced423c6f5170f05411d388f3063b846a8cea0be85a4a8075976be
+	sha256sums = 71eb6465ba77f36552ff0b377f147f28fa5314ba619e4645dcb42d79abcd9ed8
+	sha256sums = 67c692171dd86d33b353516d31b1e53abafcda51926368b51b6028a6733fcde0
+	sha256sums = 8ef046c149530dfcc50da88896098e880a06c994c29a0690beb66c6ab77825ca
+	sha256sums = 8705b705f9dbcd0545c5b56ab65ca0f7dfe439d1e7fdc1b88cd1afb529591f30
+	sha256sums = e7117b3f0c21c235cb4fb5eaff182f4fe311327ca7da178c90a9693f79a0a19a
+	sha256sums = 1ed244baecf5bafc3e5e274b8afa7900d24081d35205dec013d1b2047b401ffd
+	sha256sums = 08999ff13ae3bd4f245b62f8a8e5350c9c4876c782928a1a3ee784c8782ce951
+	sha256sums = a5fad4dc9a75bb117943c523bc85aa05caac4982f8a4bd1cd525112f57bccf1b
+	sha256sums = 12e37cf4d04858e25bf17be3d8389deb983623eb460bc87739164aa57cb0ec66
+	sha256sums = 75ece20fb46fda88b48f399dc8076d271ecaf121b7baf794771432dd9d83e4fc
+	sha256sums = db69684922c5891913724a65461b6f35b7b3e4b595c446e4b4193d6d16135302
+	sha256sums = 51c6655a459f4f5172a31c97231d0f7a0fae9ac4d850104b39dd2dfeffedd31d
+	sha256sums = 2dcf6e1b0237dce0b37be39f086c74aa95f92ece0bb240045b2abe611e8047df
+	sha256sums = d0f45e890e2bbd36c35b80bd6bb8bc657549b9c51726e6d838e468a19bddbb8c
+	sha256sums = 19b5b7303366f0fcb704de4910c85f831b9e05b249b142e8f0a16ee20e221dc0
+	sha256sums = 2fdce8053cf8a00db6a6fb01f5e50487758a344664ea16a43d7a107c0535cfeb
+	sha256sums = 9d8399ed8114e37748ba0657d62cc29ce2f68aa7d63c6ba34b50662536e31bb2
+	sha256sums = be666e88314bd620da6b161929780a54b74d6264e48894ed1770008ac4765f10
+	sha256sums = 541ba90e1aad53e92340b24d02bb9cd4037a8bc6bc4c7c7fbebd35367cf45eb7
+	sha256sums = bcda0fa7067ea39b211e64bb7b918546525c2644ea5f4b52d442c6d9f685c551
+	sha256sums = e26b7d5ae4682223ed96eddeabafa690979fded479c9770a78207805ff624aa8
+	sha256sums = d69f4c5abfce5c63d410fc30b2b75597133b9f638e8cb0ae1a489068507390c6
+	sha256sums = 6bf12da93f22f2386e6d6f1079f8aca56b5a4319e0a7c438952c0343abe45679
+	sha256sums = b2087de63d389f19f4a6c60db66dab114c597a7f3711569ed4690e1c66efd171
+	sha256sums = f17f57ad286e82cbd984a005b1336ab87febb9998db2dc871e00610b336c6ee2
+	sha256sums = b356d5b82db62d71906cd54e3f47899312da3bc36995320b0caa4bb60cfe6cf3
+	sha256sums = 26d9b9bcbd45669bfc08b22db5c4b37a416581c1c9f01b5d092b5836699b32b2
+	sha256sums = 51ae8222e4555be471ea1b200fddccbede3ff4a692db9a2a547af692c05eac7c
+	sha256sums = 0bc9607ee2f3657535d3a66472935bc84d31f5b1b2c20ce1a120ebdff4438abd
+	sha256sums = 6241e00ef89e9aa63945cc8d57f8d7cd568d3aabf2780a559f346e641667c8bb
+	sha256sums = e75a9dd060a32a9158d5855ed9b8d0e2e0fa96918e42854e135b16c2e68bd71b
+	sha256sums = 01ac5f362c5aa02615de9249e125d8e341b6de2ae97e68c60eae324021d4d717
+	sha256sums = 369dda806203e5651333541702697cb83c968fc53d963f688e89cca3c113ad36
+	sha256sums = 668d1d9c25c0d45611e86008cdd570e30ba37f280a504adc877ebfa26f4eb379
+	sha256sums = 1a1e7e39c0bec3c254437d60dbdf222e602781df33c7591927cf05963c6ed5e1
+	sha256sums = cdfa1893ee96403dfced3a580ba310cba226ad9b10a6dacf2ea5fa58e49d6de0
+	sha256sums = 68dd95421c509626864dc247d7aee6603657dda71fbf813e8d347337c62e989c
+	sha256sums = 66e50e6d8dcbfedc23d908ca45317c2954839bbc799033480087ce934fd688c0
+	sha256sums = b3e38059db8926a960623c933e16579e95214fd7d60bde52e51b6728982c31d5
+	sha256sums = 3c4ddf38b20735a9103fc9a1177ade0918c411ab67899088914efadeb43f1fd8
+	sha256sums = cf9871daa25a2c36423b0b7809a08d83ba330ee2062d05b87207fb9add7eda94
+	sha256sums = 306bd4535ce857edd2c127e8af36f06baf962ba89d7f4406165412b1b981d064
+	sha256sums = d2dd42a8c9f039b1fd61ac77086619458a418bcac49d0d44097e990289dd04c5
+	sha256sums = ca1cc1b9dadb693fcce8f96f814fb9e4f7b2caea877e4483a81df9887905af80
+	sha256sums = 1a732f0e63212cfde3b2df7e87eaca900216f0fe4d0fd7dd188b83560e3b0239
+	sha256sums = fc94de835829b9a9ec00b30c2da9e1b1f43ed5c7e1f8e079bb283205d8afdf1d
+	sha256sums = c437a09e97d9c68c69fe24050544315bdaefd67331f94ec13f7d7c5974090f65
+	sha256sums = 865faa82098b7662955a7ab80ee9607b19578ab3c609da23762b0538b6692faa
+	sha256sums = ce82e08ec05a60358d85c2637bb972c9224d89cf9a184f9dcd12aa7f5c2991d4
+	sha256sums = a09c756c3e45d7163cc35288bb0ca1179035394015f4a356cd8894fd084c2db2
+	sha256sums = 07071685514086b64244cba23cbf381c6deac5548d3a6e9aaeb75c0b8eab91fe
+	sha256sums = 19db960863cd4cf8c024e6f7c2354e18ffe24293003ebd1a321ed6036db259f5
+	sha256sums = f9ecf00962a08396be1f90eaa0f35c2052afefd3890701e2178db9f364a495c1
+	sha256sums = 979652adf95d11ca557d6476cf5ce0c50c25b07c71f1f0f0ee5e1e5b94937d02
+	sha256sums = b2fa2bfd38c622d7f3652751d2aded39482331cc22a78d2a6febfde263f1c113
+	sha256sums = 51e91aa86e3841b69973a98ca204f025134d7d2a045251357da7a9bdca4aaeb0
+	sha256sums = 58939fc6e93f93e7783a498b6c2620364353ad67a47363d12e4ddbcebe65c22f
+	sha256sums = 6f32b2a1bcde1e2bc9590d88cd11e0dcdae828da9a34bf6ca9e7e7acffa2c83e
+	sha256sums = 6b054b28dcefba5385b6f3a018c2bd80844af7658809db6bec4ead3ed3ff797c
+	sha256sums = d75293a554a0e572b3fecc89f4b5cd1fcf55d7ccaf198a802d77861a5fde0d8f
+	sha256sums = 3bcbd547dd5702f9087dccd8dd1122a612b4cd674cb76a9b21556ee8a013abab
+	sha256sums = c7b5fb981b6b1981b0922674648b35ae635a7ad7eb4c5b9ce235af715a2164af
+	sha256sums = 10ca1bdccaa20a069e3a6ad2e4d100a3e65a8a8e1310b0594c1668da73a11c4a
+	sha256sums = 05f237b1e0a495d4b86099361d4910d415c922e248d96bdb08994d55c29a1172
+	sha256sums = 912e5e9f77c4221956686faffd57d1124764509b8892ff9cfa9e75d1d8e30790
+	sha256sums = 26790d65d73bd83575b2c363e5db54c5ab3f02e216eb45115d4ef22b6b680cb6
+	sha256sums = 38a741e359ce58e71f234f922e729bed7192d7999eebaa9adcaa103cadcd361f
+	sha256sums = 43629619d333c836497b9ee841430829474931dee557fc487e849f2512815c3d
+	sha256sums = 11608c0d06eaba285d689539726acbd8a00937d6ac9f61a92b3efaf459c349a3
+	sha256sums = 36621c6098729b6dcf52b2b714fec51ee1bc12bdc91fb2779203aced02f9401c
+	sha256sums = 01b581de8a5015a3d6f861b09746d2dc44aba3fa7ddc11efe0c3df621b2ef7d7
+	sha256sums = fa7d177441c5a7e9bb92bdcd6b57051e29993f7b43872c20e42b76ffad93328e
+	sha256sums = 823600f5c92ad995d8a928e99654fa4fed216341de35a9f46426650bbed47982
+	sha256sums = 03de8897fccbb175336d9da80c8b3e384ca2a366e6948362f70ec7a993b7b045
+	sha256sums = 79a8a637e0122c46b55902c91d1b09b6cb38d751aa2ec5e3a8f03914563c08d5
+	sha256sums = bf0fc3ee3dcbe8c37d60efb17085dd62e642f0e1d79d7b30ed912e43a3eabe81
+	sha256sums = 3694e1c112183dbf14dbcefdb45b8c1e229f84d484d500601201ded5e3e3ed54
+	sha256sums = b792fb3851c35d835579131c77bd7b68069d1faf2cc2f6f6b682b0d31d321864
+	sha256sums = e23a544fe8c87d8d9428bbd3e50a7a5d7334ca69d29c2d2564e28a359ff78cab
+	sha256sums = d3fc9bd37f17b219e72c4334c8d0269bbfa40af47b0f97a90e6e066a43258ce2
+	sha256sums = 77fa2f49c5efeb8ee58a02ff686c754b69814f8c82f1d4b31b5514f9b88c7b72
+	sha256sums = 1b4dd80e9088f00d93226c9e1a7b9aa093f41678e54c49c3c6fbe20845f83f4b
+	sha256sums = b4993087a58b3a9433048aa7da414a5514f529072dd1264d6d19d50391e9b15b
+	sha256sums = c9c3ff503c228eefbe1d891be962e66a496948dbc2e3113fc8b8f5431f46ddf9
+	sha256sums = 3d2627d9b23dc2c827e9483baa9a9be8fbfb0ade38ef79deab8af7707d79ad19
+	sha256sums = ebbd0323f88f0117a5cf86cbb2c1a0fcae8ea4baa36d231af67f4e272b106b69
+	sha256sums = 77f1b39b4147c1a30958edf5b88394bc7042f3aa6cf9bc21d4ec400c2ee5cdaf
+	sha256sums = 88511b4a9ee5966d497a59a93d681e855959ad807c74e0bcbc5b348ad2871e60
+	sha256sums = 1700f8ef559d1c33cc786348c68f41a1e21f0452c46f5f98b833cc8399965674
+	sha256sums = 41cf676b9ddc30098fcc01e7abdba4b32e9fe6ae56cb7a91fe92feb178357515
+	sha256sums = 71591c8ae9c3cf8777f62fe5556d495da67e587e5e59a1c061e3793d00b18877
+	sha256sums = 5844e0cc18fd9236ed927053b291c5dccae32d13b9a4f57ecdc64fcf13f6af01
+	sha256sums = 090f2b3c6e942cc54d1c5e9566b27cb16fdf513134310a975309ab80cdcfd3fe
+	sha256sums = 35db7ea210dd944ec16b55d073882e29e391884a86fbdd648f6d3231723e7d58
+	sha256sums = 080e1ad70ff51a52437cd68b8e23fa9517b9cbe00686a22919f499c5a0c6b4fa
+	sha256sums = ee7c0c865c2095aa3974f16424717860a3fd0ce52f6ad25f7f032ccba1957bf1
+	sha256sums = f9df0f6e70019cf49835819769407d0d743473a8ef0d651221281b8df60ed69d
+	sha256sums = 8aa663ca43059bc22b3d7a8ba5697459119aa96f118b49294568b7dcd6e4b294
+	sha256sums = 5114d3e0af1ec6f0717a80114b3e5a692453c65ebf7872a66abb6f0815dfd8a4
+	sha256sums = fbc72be74c569f3576d4f1fc7486d87c05d7b55c1336aa36d30127a41b0c109c
+	sha256sums = 1a29371a46dd3e21ad0d2ab5f6690a54b925add1a03559fef38b8acf3a7d4d82
+	sha256sums = 023628ddf6c8e2c79308301a83768362fb087a408e2a83ccfec31b0e60195435
+	sha256sums = 395d3b3f51b0e44086d59cd6f397144d4d5e873f784e25087e56c31ce3ea88dc
+	sha256sums = 57f7c6f4d2a4bd5a32fe58d6fb3dea8ed4cdaa14a82ff2ea0c6a917c2f788a2f
+	sha256sums = b0070a98b9276c91c81ed0f6557fb68b5a6ff1697ae8be210408cf4285603db0
+	sha256sums = 1e1731bbb3661fb5a462165bc3ef15916867d8478356fb21fc42e64bf951e472
+	sha256sums = 88477af3fda83a4622ebfa05b35b723b6c5ff893a1b92645f15c8ad6e4ecd782
+	sha256sums = d614b3659ea67561111dd6fa1a80faefe47dd8738e3a9a0c2c830ee759836d8a
+	sha256sums = fa142d6b3e46890fd99dc952c7505ff2ccc8cbbf50a1f22c16cd467a2b274f14
+	sha256sums = a6ce9b5dc311240cdf457458d544b01db80d40400244e0ca38804cd6aa5bd56a
+	sha256sums = ebc7b84c1e4c29937648ca828f1222c83e13f3bc43f76b4b61b4beaa67646968
+	sha256sums = e09bcc3717697cb240e76ea0d1405ec1ce0d4f5eb3d70d745d73f2cf4a51c07b
+	sha256sums = ce6f7d1351cd93e6c340dbb69e0f4364d73998ac20b08b532601e7b00c7a2cf1
+	sha256sums = 82df96ae4ee622865f84acf16937b5230a24194ae501ad6beac674d890f34c13
+	sha256sums = 669b6b969b2e6f1fee2f3cac8c89e9539b66fe6c5d02b1a5788893c8d0da55f3
+	sha256sums = 8fd9b5f76987d1c82babd499c95a4e560c3680faadf86a3ec522a59371e04e0d
+	sha256sums = 17e27847e259ca9042160c7731311d392dee51b5574f50ae3ab4330e1f0c47aa
+	sha256sums = b1f2ddb6d951b131409762662c202cbd256e0048bfc22a374689b2cf862fafc9
+	sha256sums = b4a17e6c97b486cff2d374c7ac565dea653ad57d6ac98d225aafa1afc4df1c42
+	sha256sums = 773795ea8f758f5357438fce546e7248064e351b366bcde7d9f109bc70316f8f
+	sha256sums = c1c2b81107a171de2bdd7d7db9334bfa2cdf05e107ae398188b68a1efe88b79c
+	sha256sums = a7582edae4d0c2eaa761688205e141508ee2aa1e2bb740ba3202bf38d9b7398d
+	sha256sums = 2846718243cdf93d3ce53325d974d528cbb85f69bff58462b9209e3eef2f2263
+	sha256sums = 7bf866d152061c0233ee5b776271ff98602504fb8f4b6e9221476f83daab3260
+	sha256sums = 64baac6bdca3e23abf662bc5ff6df423f23357c1e285b231b2424021542cc23d
+	sha256sums = fa2a7a2f14bc687dfb61b8ca577d6ab261c48fa8e22b8fb99d83061926406345
+	sha256sums = 6ac56bfae9d163fde3bff2182973094e0ca872fe0e10cc8ed05cbe175470ccb6
+	sha256sums = 291f0070413d973e8b59b94e20f31ff774e3e44cdd2cd98f1771ed504347eff3
+	sha256sums = 5d76a897001990ce87991f84aef27d135ebbeb3e72ce1c3ec9a54a0edce51844
+	sha256sums = 6871198575b62efea7779d8cc59cf2ff83ba68001b05b8c943470e1f47ab7a67
+	sha256sums = 00f78c62d9272b806d1b3f115a94d1a98a57cd572b8ae953a280595b54de730f
+	sha256sums = db91de5e9ac10d4ced6e75ad1f21a968bae34ff5d42ef7b060fd76337e085ac1
+	sha256sums = 028ab44455d2ebc99f0f47bb31a9e1f654acfc6f58d66461e5fdbe0436b6e2b2
+	sha256sums = 23b6eec5a652a112fb6c294cee71ef15c144eba5ffd0ca0ddf020089ef2463de
+	sha256sums = 426d9d85d26265ed2583f8c58093e391c8c2ae0552e9af2dd6c595b11f92cda1
+	sha256sums = cef8a1f322cf729b0799cdb4b4b8bf454a0ebcff860f013e3d732fa5bef30d2b
+	sha256sums = 71710e030ab73ce9dd145106b2ab7db4af8ca762f44cbb2e7f18c4ce16ee02ff
 	sha256sums = 67558840c3e1f1de229b23a54342cb126735282353a4d0a8cd10e4d582e6d9d6
 
 pkgname = linux-pf
@@ -109,7 +393,7 @@ pkgname = linux-pf
 	provides = UKSMD-BUILTIN
 	provides = V4L2LOOPBACK-MODULE
 	provides = VHBA-MODULE
-	provides = linux-pf=5.18.0.pf1
+	provides = linux-pf=5.18.6.pf2
 	conflicts = linux-pf
 	replaces = kernel26-pf
 
@@ -120,7 +404,7 @@ pkgname = linux-pf-headers
 pkgname = linux-pf-preset-default
 	pkgdesc = Linux-pf default preset
 	install = linux.install
-	depends = linux-pf=5.18.0.pf1
-	provides = linux-pf-preset=5.18.0.pf1
+	depends = linux-pf=5.18.6.pf2
+	provides = linux-pf-preset=5.18.6.pf2
 	backup = etc/mkinitcpio.d/linux-pf.preset
 
diff --git a/0001-Revert-drm-amd-display-Fix-DCN3-B0-DP-Alt-Mapping.patch b/0001-Revert-drm-amd-display-Fix-DCN3-B0-DP-Alt-Mapping.patch
new file mode 100644
index 000000000000..c673aa5dcd1a
--- /dev/null
+++ b/0001-Revert-drm-amd-display-Fix-DCN3-B0-DP-Alt-Mapping.patch
@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stylon Wang <stylon.wang@amd.com>
+Date: Wed, 4 May 2022 18:09:44 +0800
+Subject: [PATCH] Revert "drm/amd/display: Fix DCN3 B0 DP Alt Mapping"
+
+commit 1039188806d4cfdf9c412bb4ddb51b4d8cd15478 upstream.
+
+This reverts commit 4b7786d87fb3adf3e534c4f1e4f824d8700b786b.
+
+Commit 4b7786d87fb3 ("drm/amd/display: Fix DCN3 B0 DP Alt Mapping")
+is causing 2nd USB-C display not lighting up.
+Phy id remapping is done differently than is assumed in this
+patch.
+
+Signed-off-by: Stylon Wang <stylon.wang@amd.com>
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
+index d71e625cc476e87f12689fef58ad4b460255e1f9..559cf10831bea55364fc043399a7e93766606841 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
+@@ -1392,12 +1392,6 @@ static struct stream_encoder *dcn31_stream_encoder_create(
+ 		return NULL;
+ 	}
+ 
+-	if (ctx->asic_id.chip_family == FAMILY_YELLOW_CARP &&
+-			ctx->asic_id.hw_internal_rev == YELLOW_CARP_B0) {
+-		if ((eng_id == ENGINE_ID_DIGC) || (eng_id == ENGINE_ID_DIGD))
+-			eng_id = eng_id + 3; // For B0 only. C->F, D->G.
+-	}
+-
+ 	dcn30_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
+ 					eng_id, vpg, afmt,
+ 					&stream_enc_regs[eng_id],
diff --git a/0002-arm64-dts-imx8mm-beacon-Enable-RTS-CTS-on-UART3.patch b/0002-arm64-dts-imx8mm-beacon-Enable-RTS-CTS-on-UART3.patch
new file mode 100644
index 000000000000..f7e9f854bab4
--- /dev/null
+++ b/0002-arm64-dts-imx8mm-beacon-Enable-RTS-CTS-on-UART3.patch
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Adam Ford <aford173@gmail.com>
+Date: Tue, 26 Apr 2022 15:51:43 -0500
+Subject: [PATCH] arm64: dts: imx8mm-beacon: Enable RTS-CTS on UART3
+
+commit 4ce01ce36d77137cf60776b320babed89de6bd4c upstream.
+
+There is a header for a DB9 serial port, but any attempts to use
+hardware handshaking fail.  Enable RTS and CTS pin muxing and enable
+handshaking in the uart node.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi
+index ec3f2c17703579bddfb75d8381a0a40395ea6254..f338a886d8117d58886636621d21ad35d14c9c0c 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi
+@@ -278,6 +278,7 @@ &uart3 {
+ 	pinctrl-0 = <&pinctrl_uart3>;
+ 	assigned-clocks = <&clk IMX8MM_CLK_UART3>;
+ 	assigned-clock-parents = <&clk IMX8MM_SYS_PLL1_80M>;
++	uart-has-rtscts;
+ 	status = "okay";
+ };
+ 
+@@ -386,6 +387,8 @@ pinctrl_uart3: uart3grp {
+ 		fsl,pins = <
+ 			MX8MM_IOMUXC_ECSPI1_SCLK_UART3_DCE_RX	0x40
+ 			MX8MM_IOMUXC_ECSPI1_MOSI_UART3_DCE_TX	0x40
++			MX8MM_IOMUXC_ECSPI1_MISO_UART3_DCE_CTS_B	0x40
++			MX8MM_IOMUXC_ECSPI1_SS0_UART3_DCE_RTS_B	0x40
+ 		>;
+ 	};
+ 
diff --git a/0003-arm64-dts-imx8mn-beacon-Enable-RTS-CTS-on-UART3.patch b/0003-arm64-dts-imx8mn-beacon-Enable-RTS-CTS-on-UART3.patch
new file mode 100644
index 000000000000..4bce11ba77d3
--- /dev/null
+++ b/0003-arm64-dts-imx8mn-beacon-Enable-RTS-CTS-on-UART3.patch
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Adam Ford <aford173@gmail.com>
+Date: Tue, 26 Apr 2022 15:51:44 -0500
+Subject: [PATCH] arm64: dts: imx8mn-beacon: Enable RTS-CTS on UART3
+
+commit 5446ff1a67160ad92d9aae9530846aa54750be36 upstream.
+
+There is a header for a DB9 serial port, but any attempts to use
+hardware handshaking fail.  Enable RTS and CTS pin muxing and enable
+handshaking in the uart node.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi
+index 0f40b43ac091c0f96a23e75a9ba244f0570ffb62..02f37dcda7eda4b062174321e08e4ba0e6e4e1cb 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi
+@@ -175,6 +175,7 @@ &uart3 {
+ 	pinctrl-0 = <&pinctrl_uart3>;
+ 	assigned-clocks = <&clk IMX8MN_CLK_UART3>;
+ 	assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_80M>;
++	uart-has-rtscts;
+ 	status = "okay";
+ };
+ 
+@@ -258,6 +259,8 @@ pinctrl_uart3: uart3grp {
+ 		fsl,pins = <
+ 			MX8MN_IOMUXC_ECSPI1_SCLK_UART3_DCE_RX	0x40
+ 			MX8MN_IOMUXC_ECSPI1_MOSI_UART3_DCE_TX	0x40
++			MX8MN_IOMUXC_ECSPI1_MISO_UART3_DCE_CTS_B	0x40
++			MX8MN_IOMUXC_ECSPI1_SS0_UART3_DCE_RTS_B	0x40
+ 		>;
+ 	};
+ 
diff --git a/0004-io_uring-reinstate-the-inflight-tracking.patch b/0004-io_uring-reinstate-the-inflight-tracking.patch
new file mode 100644
index 000000000000..572cc05306e3
--- /dev/null
+++ b/0004-io_uring-reinstate-the-inflight-tracking.patch
@@ -0,0 +1,203 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Wed, 1 Jun 2022 23:57:02 -0600
+Subject: [PATCH] io_uring: reinstate the inflight tracking
+
+commit 9cae36a094e7e9d6e5fe8b6dcd4642138b3eb0c7 upstream.
+
+After some debugging, it was realized that we really do still need the
+old inflight tracking for any file type that has io_uring_fops assigned.
+If we don't, then trivial circular references will mean that we never get
+the ctx cleaned up and hence it'll leak.
+
+Just bring back the inflight tracking, which then also means we can
+eliminate the conditional dropping of the file when task_work is queued.
+
+Fixes: d5361233e9ab ("io_uring: drop the old style inflight file tracking")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/io_uring.c | 82 +++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 56 insertions(+), 26 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 9e247335e70d510301380bbf850904dc80dcdbda..3582db014aadfd76ee8c6e7e36c3c2edeed87c23 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -111,7 +111,8 @@
+ 			IOSQE_IO_DRAIN | IOSQE_CQE_SKIP_SUCCESS)
+ 
+ #define IO_REQ_CLEAN_FLAGS (REQ_F_BUFFER_SELECTED | REQ_F_NEED_CLEANUP | \
+-				REQ_F_POLLED | REQ_F_CREDS | REQ_F_ASYNC_DATA)
++				REQ_F_POLLED | REQ_F_INFLIGHT | REQ_F_CREDS | \
++				REQ_F_ASYNC_DATA)
+ 
+ #define IO_TCTX_REFS_CACHE_NR	(1U << 10)
+ 
+@@ -493,6 +494,7 @@ struct io_uring_task {
+ 	const struct io_ring_ctx *last;
+ 	struct io_wq		*io_wq;
+ 	struct percpu_counter	inflight;
++	atomic_t		inflight_tracked;
+ 	atomic_t		in_idle;
+ 
+ 	spinlock_t		task_lock;
+@@ -1186,8 +1188,6 @@ static void io_clean_op(struct io_kiocb *req);
+ static inline struct file *io_file_get_fixed(struct io_kiocb *req, int fd,
+ 					     unsigned issue_flags);
+ static inline struct file *io_file_get_normal(struct io_kiocb *req, int fd);
+-static void io_drop_inflight_file(struct io_kiocb *req);
+-static bool io_assign_file(struct io_kiocb *req, unsigned int issue_flags);
+ static void __io_queue_sqe(struct io_kiocb *req);
+ static void io_rsrc_put_work(struct work_struct *work);
+ 
+@@ -1435,9 +1435,29 @@ static bool io_match_task(struct io_kiocb *head, struct task_struct *task,
+ 			  bool cancel_all)
+ 	__must_hold(&req->ctx->timeout_lock)
+ {
++	struct io_kiocb *req;
++
+ 	if (task && head->task != task)
+ 		return false;
+-	return cancel_all;
++	if (cancel_all)
++		return true;
++
++	io_for_each_link(req, head) {
++		if (req->flags & REQ_F_INFLIGHT)
++			return true;
++	}
++	return false;
++}
++
++static bool io_match_linked(struct io_kiocb *head)
++{
++	struct io_kiocb *req;
++
++	io_for_each_link(req, head) {
++		if (req->flags & REQ_F_INFLIGHT)
++			return true;
++	}
++	return false;
+ }
+ 
+ /*
+@@ -1447,9 +1467,24 @@ static bool io_match_task(struct io_kiocb *head, struct task_struct *task,
+ static bool io_match_task_safe(struct io_kiocb *head, struct task_struct *task,
+ 			       bool cancel_all)
+ {
++	bool matched;
++
+ 	if (task && head->task != task)
+ 		return false;
+-	return cancel_all;
++	if (cancel_all)
++		return true;
++
++	if (head->flags & REQ_F_LINK_TIMEOUT) {
++		struct io_ring_ctx *ctx = head->ctx;
++
++		/* protect against races with linked timeouts */
++		spin_lock_irq(&ctx->timeout_lock);
++		matched = io_match_linked(head);
++		spin_unlock_irq(&ctx->timeout_lock);
++	} else {
++		matched = io_match_linked(head);
++	}
++	return matched;
+ }
+ 
+ static inline bool req_has_async_data(struct io_kiocb *req)
+@@ -1608,6 +1643,14 @@ static inline bool io_req_ffs_set(struct io_kiocb *req)
+ 	return req->flags & REQ_F_FIXED_FILE;
+ }
+ 
++static inline void io_req_track_inflight(struct io_kiocb *req)
++{
++	if (!(req->flags & REQ_F_INFLIGHT)) {
++		req->flags |= REQ_F_INFLIGHT;
++		atomic_inc(&current->io_uring->inflight_tracked);
++	}
++}
++
+ static struct io_kiocb *__io_prep_linked_timeout(struct io_kiocb *req)
+ {
+ 	if (WARN_ON_ONCE(!req->link))
+@@ -2516,8 +2559,6 @@ static void io_req_task_work_add(struct io_kiocb *req, bool priority)
+ 
+ 	WARN_ON_ONCE(!tctx);
+ 
+-	io_drop_inflight_file(req);
+-
+ 	spin_lock_irqsave(&tctx->task_lock, flags);
+ 	if (priority)
+ 		wq_list_add_tail(&req->io_task_work.node, &tctx->prior_task_list);
+@@ -5869,10 +5910,6 @@ static int io_poll_check_events(struct io_kiocb *req, bool locked)
+ 
+ 		if (!req->result) {
+ 			struct poll_table_struct pt = { ._key = req->apoll_events };
+-			unsigned flags = locked ? 0 : IO_URING_F_UNLOCKED;
+-
+-			if (unlikely(!io_assign_file(req, flags)))
+-				return -EBADF;
+ 			req->result = vfs_poll(req->file, &pt) & req->apoll_events;
+ 		}
+ 
+@@ -7097,6 +7134,11 @@ static void io_clean_op(struct io_kiocb *req)
+ 		kfree(req->apoll);
+ 		req->apoll = NULL;
+ 	}
++	if (req->flags & REQ_F_INFLIGHT) {
++		struct io_uring_task *tctx = req->task->io_uring;
++
++		atomic_dec(&tctx->inflight_tracked);
++	}
+ 	if (req->flags & REQ_F_CREDS)
+ 		put_cred(req->creds);
+ 	if (req->flags & REQ_F_ASYNC_DATA) {
+@@ -7393,19 +7435,6 @@ static inline struct file *io_file_get_fixed(struct io_kiocb *req, int fd,
+ 	return file;
+ }
+ 
+-/*
+- * Drop the file for requeue operations. Only used of req->file is the
+- * io_uring descriptor itself.
+- */
+-static void io_drop_inflight_file(struct io_kiocb *req)
+-{
+-	if (unlikely(req->flags & REQ_F_INFLIGHT)) {
+-		fput(req->file);
+-		req->file = NULL;
+-		req->flags &= ~REQ_F_INFLIGHT;
+-	}
+-}
+-
+ static struct file *io_file_get_normal(struct io_kiocb *req, int fd)
+ {
+ 	struct file *file = fget(fd);
+@@ -7414,7 +7443,7 @@ static struct file *io_file_get_normal(struct io_kiocb *req, int fd)
+ 
+ 	/* we don't allow fixed io_uring files */
+ 	if (file && file->f_op == &io_uring_fops)
+-		req->flags |= REQ_F_INFLIGHT;
++		io_req_track_inflight(req);
+ 	return file;
+ }
+ 
+@@ -9211,6 +9240,7 @@ static __cold int io_uring_alloc_task_context(struct task_struct *task,
+ 	xa_init(&tctx->xa);
+ 	init_waitqueue_head(&tctx->wait);
+ 	atomic_set(&tctx->in_idle, 0);
++	atomic_set(&tctx->inflight_tracked, 0);
+ 	task->io_uring = tctx;
+ 	spin_lock_init(&tctx->task_lock);
+ 	INIT_WQ_LIST(&tctx->task_list);
+@@ -10402,7 +10432,7 @@ static __cold void io_uring_clean_tctx(struct io_uring_task *tctx)
+ static s64 tctx_inflight(struct io_uring_task *tctx, bool tracked)
+ {
+ 	if (tracked)
+-		return 0;
++		return atomic_read(&tctx->inflight_tracked);
+ 	return percpu_counter_sum(&tctx->inflight);
+ }
+ 
diff --git a/0005-powerpc-kasan-Silence-KASAN-warnings-in-__get_wchan.patch b/0005-powerpc-kasan-Silence-KASAN-warnings-in-__get_wchan.patch
new file mode 100644
index 000000000000..4386fe9bea45
--- /dev/null
+++ b/0005-powerpc-kasan-Silence-KASAN-warnings-in-__get_wchan.patch
@@ -0,0 +1,86 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: He Ying <heying24@huawei.com>
+Date: Thu, 20 Jan 2022 20:44:18 -0500
+Subject: [PATCH] powerpc/kasan: Silence KASAN warnings in __get_wchan()
+
+[ Upstream commit a1b29ba2f2c171b9bea73be993bfdf0a62d37d15 ]
+
+The following KASAN warning was reported in our kernel.
+
+  BUG: KASAN: stack-out-of-bounds in get_wchan+0x188/0x250
+  Read of size 4 at addr d216f958 by task ps/14437
+
+  CPU: 3 PID: 14437 Comm: ps Tainted: G           O      5.10.0 #1
+  Call Trace:
+  [daa63858] [c0654348] dump_stack+0x9c/0xe4 (unreliable)
+  [daa63888] [c035cf0c] print_address_description.constprop.3+0x8c/0x570
+  [daa63908] [c035d6bc] kasan_report+0x1ac/0x218
+  [daa63948] [c00496e8] get_wchan+0x188/0x250
+  [daa63978] [c0461ec8] do_task_stat+0xce8/0xe60
+  [daa63b98] [c0455ac8] proc_single_show+0x98/0x170
+  [daa63bc8] [c03cab8c] seq_read_iter+0x1ec/0x900
+  [daa63c38] [c03cb47c] seq_read+0x1dc/0x290
+  [daa63d68] [c037fc94] vfs_read+0x164/0x510
+  [daa63ea8] [c03808e4] ksys_read+0x144/0x1d0
+  [daa63f38] [c005b1dc] ret_from_syscall+0x0/0x38
+  --- interrupt: c00 at 0x8fa8f4
+      LR = 0x8fa8cc
+
+  The buggy address belongs to the page:
+  page:98ebcdd2 refcount:0 mapcount:0 mapping:00000000 index:0x2 pfn:0x1216f
+  flags: 0x0()
+  raw: 00000000 00000000 01010122 00000000 00000002 00000000 ffffffff 00000000
+  raw: 00000000
+  page dumped because: kasan: bad access detected
+
+  Memory state around the buggy address:
+   d216f800: 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00
+   d216f880: f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+  >d216f900: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
+                                            ^
+   d216f980: f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00
+   d216fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+
+After looking into this issue, I find the buggy address belongs
+to the task stack region. It seems KASAN has something wrong.
+I look into the code of __get_wchan in x86 architecture and
+find the same issue has been resolved by the commit
+f7d27c35ddff ("x86/mm, kasan: Silence KASAN warnings in get_wchan()").
+The solution could be applied to powerpc architecture too.
+
+As Andrey Ryabinin said, get_wchan() is racy by design, it may
+access volatile stack of running task, thus it may access
+redzone in a stack frame and cause KASAN to warn about this.
+
+Use READ_ONCE_NOCHECK() to silence these warnings.
+
+Reported-by: Wanming Hu <huwanming@huaweil.com>
+Signed-off-by: He Ying <heying24@huawei.com>
+Signed-off-by: Chen Jingwen <chenjingwen6@huawei.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220121014418.155675-1-heying24@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/process.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 984813a4d5dc47283687e0cc7f38f7e5deaf19c9..a75d20f23dac8efd7620f2d610fd5e935fe261b3 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -2160,12 +2160,12 @@ static unsigned long ___get_wchan(struct task_struct *p)
+ 		return 0;
+ 
+ 	do {
+-		sp = *(unsigned long *)sp;
++		sp = READ_ONCE_NOCHECK(*(unsigned long *)sp);
+ 		if (!validate_sp(sp, p, STACK_FRAME_OVERHEAD) ||
+ 		    task_is_running(p))
+ 			return 0;
+ 		if (count > 0) {
+-			ip = ((unsigned long *)sp)[STACK_FRAME_LR_SAVE];
++			ip = READ_ONCE_NOCHECK(((unsigned long *)sp)[STACK_FRAME_LR_SAVE]);
+ 			if (!in_sched_functions(ip))
+ 				return ip;
+ 		}
diff --git a/0006-ASoC-nau8822-Add-operation-for-internal-PLL-off-and-.patch b/0006-ASoC-nau8822-Add-operation-for-internal-PLL-off-and-.patch
new file mode 100644
index 000000000000..dbc940e041e4
--- /dev/null
+++ b/0006-ASoC-nau8822-Add-operation-for-internal-PLL-off-and-.patch
@@ -0,0 +1,67 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 30 May 2022 12:01:50 +0800
+Subject: [PATCH] ASoC: nau8822: Add operation for internal PLL off and on
+
+[ Upstream commit aeca8a3295022bcec46697f16e098140423d8463 ]
+
+We tried to enable the audio on an imx6sx EVB with the codec nau8822,
+after setting the internal PLL fractional parameters, the audio still
+couldn't work and the there was no sdma irq at all.
+
+After checking with the section "8.1.1 Phase Locked Loop (PLL) Design
+Example" of "NAU88C22 Datasheet Rev 0.6", we found we need to
+turn off the PLL before programming fractional parameters and turn on
+the PLL after programming.
+
+After this change, the audio driver could record and play sound and
+the sdma's irq is triggered when playing or recording.
+
+Cc: David Lin <ctlin0@nuvoton.com>
+Cc: John Hsu <kchsu0@nuvoton.com>
+Cc: Seven Li <wtli@nuvoton.com>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20220530040151.95221-2-hui.wang@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8822.c | 4 ++++
+ sound/soc/codecs/nau8822.h | 3 +++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/sound/soc/codecs/nau8822.c b/sound/soc/codecs/nau8822.c
+index 58123390c7a3189e908853a6b53faef2eb66da69..b436e532993d11933c012da2c0c6b97aa3b016ef 100644
+--- a/sound/soc/codecs/nau8822.c
++++ b/sound/soc/codecs/nau8822.c
+@@ -740,6 +740,8 @@ static int nau8822_set_pll(struct snd_soc_dai *dai, int pll_id, int source,
+ 		pll_param->pll_int, pll_param->pll_frac,
+ 		pll_param->mclk_scaler, pll_param->pre_factor);
+ 
++	snd_soc_component_update_bits(component,
++		NAU8822_REG_POWER_MANAGEMENT_1, NAU8822_PLL_EN_MASK, NAU8822_PLL_OFF);
+ 	snd_soc_component_update_bits(component,
+ 		NAU8822_REG_PLL_N, NAU8822_PLLMCLK_DIV2 | NAU8822_PLLN_MASK,
+ 		(pll_param->pre_factor ? NAU8822_PLLMCLK_DIV2 : 0) |
+@@ -757,6 +759,8 @@ static int nau8822_set_pll(struct snd_soc_dai *dai, int pll_id, int source,
+ 		pll_param->mclk_scaler << NAU8822_MCLKSEL_SFT);
+ 	snd_soc_component_update_bits(component,
+ 		NAU8822_REG_CLOCKING, NAU8822_CLKM_MASK, NAU8822_CLKM_PLL);
++	snd_soc_component_update_bits(component,
++		NAU8822_REG_POWER_MANAGEMENT_1, NAU8822_PLL_EN_MASK, NAU8822_PLL_ON);
+ 
+ 	return 0;
+ }
+diff --git a/sound/soc/codecs/nau8822.h b/sound/soc/codecs/nau8822.h
+index 489191ff187ec79e249fd0fe1669edff425da603..b45d42c15de6b679926b3184650854c6dd395b93 100644
+--- a/sound/soc/codecs/nau8822.h
++++ b/sound/soc/codecs/nau8822.h
+@@ -90,6 +90,9 @@
+ #define NAU8822_REFIMP_3K			0x3
+ #define NAU8822_IOBUF_EN			(0x1 << 2)
+ #define NAU8822_ABIAS_EN			(0x1 << 3)
++#define NAU8822_PLL_EN_MASK			(0x1 << 5)
++#define NAU8822_PLL_ON				(0x1 << 5)
++#define NAU8822_PLL_OFF				(0x0 << 5)
+ 
+ /* NAU8822_REG_AUDIO_INTERFACE (0x4) */
+ #define NAU8822_AIFMT_MASK			(0x3 << 3)
diff --git a/0007-ASoC-qcom-lpass-platform-Update-VMA-access-permissio.patch b/0007-ASoC-qcom-lpass-platform-Update-VMA-access-permissio.patch
new file mode 100644
index 000000000000..762e2d851122
--- /dev/null
+++ b/0007-ASoC-qcom-lpass-platform-Update-VMA-access-permissio.patch
@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
+Date: Fri, 27 May 2022 19:40:08 +0530
+Subject: [PATCH] ASoC: qcom: lpass-platform: Update VMA access permissions in
+ mmap callback
+
+[ Upstream commit ef8d89b83bf453ea9cc3c4873a84b50ff334f797 ]
+
+Replace page protection permissions from noncashed to writecombine,
+in lpass codec DMA path mmp callabck, to support 64 bit chromeOS.
+Avoid SIGBUS error in userspace caused by noncached permissions in
+64 bit chromeOS.
+
+Signed-off-by: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
+Link: https://lore.kernel.org/r/1653660608-27245-1-git-send-email-quic_srivasam@quicinc.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index 74d62f377dfddcba14610e876055dfbe43c29558..ae2a7837e5ccf198dbd302edf38f4dfc6e51602f 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -898,7 +898,7 @@ static int lpass_platform_cdc_dma_mmap(struct snd_pcm_substream *substream,
+ 	struct snd_pcm_runtime *runtime = substream->runtime;
+ 	unsigned long size, offset;
+ 
+-	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
++	vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+ 	size = vma->vm_end - vma->vm_start;
+ 	offset = vma->vm_pgoff << PAGE_SHIFT;
+ 	return io_remap_pfn_range(vma, vma->vm_start,
diff --git a/0008-drm-amd-display-Read-Golden-Settings-Table-from-VBIO.patch b/0008-drm-amd-display-Read-Golden-Settings-Table-from-VBIO.patch
new file mode 100644
index 000000000000..debcf3f29344
--- /dev/null
+++ b/0008-drm-amd-display-Read-Golden-Settings-Table-from-VBIO.patch
@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Sherry Wang <YAO.WANG1@amd.com>
+Date: Tue, 10 May 2022 18:42:18 +0800
+Subject: [PATCH] drm/amd/display: Read Golden Settings Table from VBIOS
+
+[ Upstream commit 4b81dd2cc6f4f4e8cea0ed6ee8d5193a8ae14a72 ]
+
+[Why]
+Dmub read AUX_DPHY_RX_CONTROL0 from Golden Setting Table,
+but driver will set it to default value 0x103d1110, which
+causes issue in some case
+
+[How]
+Remove the driver code, use the value set by dmub in
+dp_aux_init
+
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Jasdeep Dhillon <jdhillon@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Sherry Wang <YAO.WANG1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c
+index d94fd1010debcfa582f11294d0039bbfef23ff17..8b12b4111c8870a54bda0561c8d5b076720e83d9 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c
+@@ -230,9 +230,7 @@ static void enc31_hw_init(struct link_encoder *enc)
+ 	AUX_RX_PHASE_DETECT_LEN,  [21,20] = 0x3 default is 3
+ 	AUX_RX_DETECTION_THRESHOLD [30:28] = 1
+ */
+-	AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, 0x103d1110);
+-
+-	AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c7a);
++	// dmub will read AUX_DPHY_RX_CONTROL0/AUX_DPHY_TX_CONTROL from vbios table in dp_aux_init
+ 
+ 	//AUX_DPHY_TX_REF_CONTROL'AUX_TX_REF_DIV HW default is 0x32;
+ 	// Set AUX_TX_REF_DIV Divider to generate 2 MHz reference from refclk
diff --git a/0009-drm-amdgpu-Resolve-RAS-GFX-error-count-issue-after-c.patch b/0009-drm-amdgpu-Resolve-RAS-GFX-error-count-issue-after-c.patch
new file mode 100644
index 000000000000..b89309147b71
--- /dev/null
+++ b/0009-drm-amdgpu-Resolve-RAS-GFX-error-count-issue-after-c.patch
@@ -0,0 +1,117 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Candice Li <candice.li@amd.com>
+Date: Wed, 1 Jun 2022 17:10:44 +0800
+Subject: [PATCH] drm/amdgpu: Resolve RAS GFX error count issue after cold boot
+ on Arcturus
+
+[ Upstream commit 2a460963350ec6b1534d28d7f943b5f84815aff2 ]
+
+Adjust the sequence for ras late init and separate ras reset error status
+from query status.
+
+v2: squash in fix from Candice
+
+Signed-off-by: Candice Li <candice.li@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c |  9 ++++++---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 27 ++++++++++++++++++++-----
+ 2 files changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+index 28a736c507bb3f84e956203d2c115b8afdc160de..bd3b32e5ba9e99023a34427ba22c7018192d95a0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+@@ -625,17 +625,20 @@ int amdgpu_get_gfx_off_status(struct amdgpu_device *adev, uint32_t *value)
+ int amdgpu_gfx_ras_late_init(struct amdgpu_device *adev, struct ras_common_if *ras_block)
+ {
+ 	int r;
+-	r = amdgpu_ras_block_late_init(adev, ras_block);
+-	if (r)
+-		return r;
+ 
+ 	if (amdgpu_ras_is_supported(adev, ras_block->block)) {
+ 		if (!amdgpu_persistent_edc_harvesting_supported(adev))
+ 			amdgpu_ras_reset_error_status(adev, AMDGPU_RAS_BLOCK__GFX);
+ 
++		r = amdgpu_ras_block_late_init(adev, ras_block);
++		if (r)
++			return r;
++
+ 		r = amdgpu_irq_get(adev, &adev->gfx.cp_ecc_error_irq, 0);
+ 		if (r)
+ 			goto late_fini;
++	} else {
++		amdgpu_ras_feature_enable_on_boot(adev, ras_block, 0);
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 424c22a841f401ae0a5177cb3183855254b65689..3f96dadf2698b2617b22eb751cfc333e6a34141f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -195,6 +195,13 @@ static ssize_t amdgpu_ras_debugfs_read(struct file *f, char __user *buf,
+ 	if (amdgpu_ras_query_error_status(obj->adev, &info))
+ 		return -EINVAL;
+ 
++	/* Hardware counter will be reset automatically after the query on Vega20 and Arcturus */
++	if (obj->adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 2) &&
++	    obj->adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 4)) {
++		if (amdgpu_ras_reset_error_status(obj->adev, info.head.block))
++			dev_warn(obj->adev->dev, "Failed to reset error counter and error status");
++	}
++
+ 	s = snprintf(val, sizeof(val), "%s: %lu\n%s: %lu\n",
+ 			"ue", info.ue_count,
+ 			"ce", info.ce_count);
+@@ -548,9 +555,10 @@ static ssize_t amdgpu_ras_sysfs_read(struct device *dev,
+ 	if (amdgpu_ras_query_error_status(obj->adev, &info))
+ 		return -EINVAL;
+ 
+-	if (obj->adev->asic_type == CHIP_ALDEBARAN) {
++	if (obj->adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 2) &&
++	    obj->adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 4)) {
+ 		if (amdgpu_ras_reset_error_status(obj->adev, info.head.block))
+-			DRM_WARN("Failed to reset error counter and error status");
++			dev_warn(obj->adev->dev, "Failed to reset error counter and error status");
+ 	}
+ 
+ 	return sysfs_emit(buf, "%s: %lu\n%s: %lu\n", "ue", info.ue_count,
+@@ -1023,9 +1031,6 @@ int amdgpu_ras_query_error_status(struct amdgpu_device *adev,
+ 		}
+ 	}
+ 
+-	if (!amdgpu_persistent_edc_harvesting_supported(adev))
+-		amdgpu_ras_reset_error_status(adev, info->head.block);
+-
+ 	return 0;
+ }
+ 
+@@ -1145,6 +1150,12 @@ int amdgpu_ras_query_error_count(struct amdgpu_device *adev,
+ 		if (res)
+ 			return res;
+ 
++		if (adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 2) &&
++		    adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 4)) {
++			if (amdgpu_ras_reset_error_status(adev, info.head.block))
++				dev_warn(adev->dev, "Failed to reset error counter and error status");
++		}
++
+ 		ce += info.ce_count;
+ 		ue += info.ue_count;
+ 	}
+@@ -1705,6 +1716,12 @@ static void amdgpu_ras_log_on_err_counter(struct amdgpu_device *adev)
+ 			continue;
+ 
+ 		amdgpu_ras_query_error_status(adev, &info);
++
++		if (adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 2) &&
++		    adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 4)) {
++			if (amdgpu_ras_reset_error_status(adev, info.head.block))
++				dev_warn(adev->dev, "Failed to reset error counter and error status");
++		}
+ 	}
+ }
+ 
diff --git a/0010-drm-amdkfd-Use-mmget_not_zero-in-MMU-notifier.patch b/0010-drm-amdkfd-Use-mmget_not_zero-in-MMU-notifier.patch
new file mode 100644
index 000000000000..c59141e3e928
--- /dev/null
+++ b/0010-drm-amdkfd-Use-mmget_not_zero-in-MMU-notifier.patch
@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Philip Yang <Philip.Yang@amd.com>
+Date: Thu, 26 May 2022 16:15:38 -0400
+Subject: [PATCH] drm/amdkfd: Use mmget_not_zero in MMU notifier
+
+[ Upstream commit fa582c6f3684ac0098a9d02ddf0ed52a02b37127 ]
+
+MMU notifier callback may pass in mm with mm->mm_users==0 when process
+is exiting, use mmget_no_zero to avoid accessing invalid mm in deferred
+list work after mm is gone.
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 3b8856b4cece8e2d0229d9843892bbe6010b23cf..5979335d7afdca82aaa9c59b137a272e41e1d95a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -2286,6 +2286,8 @@ svm_range_cpu_invalidate_pagetables(struct mmu_interval_notifier *mni,
+ 
+ 	if (range->event == MMU_NOTIFY_RELEASE)
+ 		return true;
++	if (!mmget_not_zero(mni->mm))
++		return true;
+ 
+ 	start = mni->interval_tree.start;
+ 	last = mni->interval_tree.last;
+@@ -2312,6 +2314,7 @@ svm_range_cpu_invalidate_pagetables(struct mmu_interval_notifier *mni,
+ 	}
+ 
+ 	svm_range_unlock(prange);
++	mmput(mni->mm);
+ 
+ 	return true;
+ }
diff --git a/0011-dma-debug-make-things-less-spammy-under-memory-press.patch b/0011-dma-debug-make-things-less-spammy-under-memory-press.patch
new file mode 100644
index 000000000000..ede0dfb89e17
--- /dev/null
+++ b/0011-dma-debug-make-things-less-spammy-under-memory-press.patch
@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Rob Clark <robdclark@chromium.org>
+Date: Wed, 1 Jun 2022 07:51:16 -0700
+Subject: [PATCH] dma-debug: make things less spammy under memory pressure
+
+[ Upstream commit e19f8fa6ce1ca9b8b934ba7d2e8f34c95abc6e60 ]
+
+Limit the error msg to avoid flooding the console.  If you have a lot of
+threads hitting this at once, they could have already gotten passed the
+dma_debug_disabled() check before they get to the point of allocation
+failure, resulting in quite a lot of this error message spamming the
+log.  Use pr_err_once() to limit that.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index ac740630c79c2bdb4000115a6663186aca184eed..2caafd13f8aac27f92e0675d94050175c45d585d 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -564,7 +564,7 @@ static void add_dma_entry(struct dma_debug_entry *entry, unsigned long attrs)
+ 
+ 	rc = active_cacheline_insert(entry);
+ 	if (rc == -ENOMEM) {
+-		pr_err("cacheline tracking ENOMEM, dma-debug disabled\n");
++		pr_err_once("cacheline tracking ENOMEM, dma-debug disabled\n");
+ 		global_disable = true;
+ 	} else if (rc == -EEXIST && !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) {
+ 		err_printk(entry->dev, entry,
diff --git a/0012-ASoC-Intel-cirrus-common-fix-incorrect-channel-mappi.patch b/0012-ASoC-Intel-cirrus-common-fix-incorrect-channel-mappi.patch
new file mode 100644
index 000000000000..791d4b376f47
--- /dev/null
+++ b/0012-ASoC-Intel-cirrus-common-fix-incorrect-channel-mappi.patch
@@ -0,0 +1,99 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: xliu <xiang.liu@cirrus.com>
+Date: Thu, 2 Jun 2022 13:19:22 +0800
+Subject: [PATCH] ASoC: Intel: cirrus-common: fix incorrect channel mapping
+
+[ Upstream commit d69a155555c9d57463b788c400f6b452d976bacd ]
+
+The default mapping of ASPRX1 (DAC source) is slot 0. Change the slot
+mapping of right amplifiers (WR and TR) to slot 1 to receive right
+channel data. Also update the ACPI instance ID mapping according to HW
+configuration.
+
+Signed-off-by: xliu <xiang.liu@cirrus.com>
+Signed-off-by: Brent Lu <brent.lu@intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220602051922.1232457-1-brent.lu@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_cirrus_common.c | 40 +++++++++++++++++++---
+ 1 file changed, 36 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_cirrus_common.c b/sound/soc/intel/boards/sof_cirrus_common.c
+index e71d74ec1b0b85cf19c79f5c2dc0e5cf9398127d..f4192df962d60faf89ca1029ee055d028d434875 100644
+--- a/sound/soc/intel/boards/sof_cirrus_common.c
++++ b/sound/soc/intel/boards/sof_cirrus_common.c
+@@ -54,22 +54,29 @@ static struct snd_soc_dai_link_component cs35l41_components[] = {
+ 	},
+ };
+ 
++/*
++ * Mapping between ACPI instance id and speaker position.
++ *
++ * Four speakers:
++ *         0: Tweeter left, 1: Woofer left
++ *         2: Tweeter right, 3: Woofer right
++ */
+ static struct snd_soc_codec_conf cs35l41_codec_conf[] = {
+ 	{
+ 		.dlc = COMP_CODEC_CONF(CS35L41_DEV0_NAME),
+-		.name_prefix = "WL",
++		.name_prefix = "TL",
+ 	},
+ 	{
+ 		.dlc = COMP_CODEC_CONF(CS35L41_DEV1_NAME),
+-		.name_prefix = "WR",
++		.name_prefix = "WL",
+ 	},
+ 	{
+ 		.dlc = COMP_CODEC_CONF(CS35L41_DEV2_NAME),
+-		.name_prefix = "TL",
++		.name_prefix = "TR",
+ 	},
+ 	{
+ 		.dlc = COMP_CODEC_CONF(CS35L41_DEV3_NAME),
+-		.name_prefix = "TR",
++		.name_prefix = "WR",
+ 	},
+ };
+ 
+@@ -101,6 +108,21 @@ static int cs35l41_init(struct snd_soc_pcm_runtime *rtd)
+ 	return ret;
+ }
+ 
++/*
++ * Channel map:
++ *
++ * TL/WL: ASPRX1 on slot 0, ASPRX2 on slot 1 (default)
++ * TR/WR: ASPRX1 on slot 1, ASPRX2 on slot 0
++ */
++static const struct {
++	unsigned int rx[2];
++} cs35l41_channel_map[] = {
++	{.rx = {0, 1}}, /* TL */
++	{.rx = {0, 1}}, /* WL */
++	{.rx = {1, 0}}, /* TR */
++	{.rx = {1, 0}}, /* WR */
++};
++
+ static int cs35l41_hw_params(struct snd_pcm_substream *substream,
+ 			     struct snd_pcm_hw_params *params)
+ {
+@@ -134,6 +156,16 @@ static int cs35l41_hw_params(struct snd_pcm_substream *substream,
+ 				ret);
+ 			return ret;
+ 		}
++
++		/* setup channel map */
++		ret = snd_soc_dai_set_channel_map(codec_dai, 0, NULL,
++						  ARRAY_SIZE(cs35l41_channel_map[i].rx),
++						  (unsigned int *)cs35l41_channel_map[i].rx);
++		if (ret < 0) {
++			dev_err(codec_dai->dev, "fail to set channel map, ret %d\n",
++				ret);
++			return ret;
++		}
+ 	}
+ 
+ 	return 0;
diff --git a/0013-ASoC-cs42l52-Fix-TLV-scales-for-mixer-controls.patch b/0013-ASoC-cs42l52-Fix-TLV-scales-for-mixer-controls.patch
new file mode 100644
index 000000000000..e206d508f573
--- /dev/null
+++ b/0013-ASoC-cs42l52-Fix-TLV-scales-for-mixer-controls.patch
@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Thu, 2 Jun 2022 17:21:14 +0100
+Subject: [PATCH] ASoC: cs42l52: Fix TLV scales for mixer controls
+
+[ Upstream commit 8bf5aabf524eec61013e506f764a0b2652dc5665 ]
+
+The datasheet specifies the range of the mixer volumes as between
+-51.5dB and 12dB with a 0.5dB step. Update the TLVs for this.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220602162119.3393857-2-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l52.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
+index 80161151b3f2ca59c3bf356338827282b232855a..785caba3f653d89aa00c2d217817ce626e1224db 100644
+--- a/sound/soc/codecs/cs42l52.c
++++ b/sound/soc/codecs/cs42l52.c
+@@ -137,7 +137,7 @@ static DECLARE_TLV_DB_SCALE(mic_tlv, 1600, 100, 0);
+ 
+ static DECLARE_TLV_DB_SCALE(pga_tlv, -600, 50, 0);
+ 
+-static DECLARE_TLV_DB_SCALE(mix_tlv, -50, 50, 0);
++static DECLARE_TLV_DB_SCALE(mix_tlv, -5150, 50, 0);
+ 
+ static DECLARE_TLV_DB_SCALE(beep_tlv, -56, 200, 0);
+ 
+@@ -364,7 +364,7 @@ static const struct snd_kcontrol_new cs42l52_snd_controls[] = {
+ 			      CS42L52_ADCB_VOL, 0, 0xA0, 0x78, ipd_tlv),
+ 	SOC_DOUBLE_R_SX_TLV("ADC Mixer Volume",
+ 			     CS42L52_ADCA_MIXER_VOL, CS42L52_ADCB_MIXER_VOL,
+-				0, 0x19, 0x7F, ipd_tlv),
++				0, 0x19, 0x7F, mix_tlv),
+ 
+ 	SOC_DOUBLE("ADC Switch", CS42L52_ADC_MISC_CTL, 0, 1, 1, 0),
+ 
diff --git a/0014-ASoC-cs35l36-Update-digital-volume-TLV.patch b/0014-ASoC-cs35l36-Update-digital-volume-TLV.patch
new file mode 100644
index 000000000000..3a9e4e2e392c
--- /dev/null
+++ b/0014-ASoC-cs35l36-Update-digital-volume-TLV.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Thu, 2 Jun 2022 17:21:15 +0100
+Subject: [PATCH] ASoC: cs35l36: Update digital volume TLV
+
+[ Upstream commit 5005a2345825eb8346546d99bfe669f73111b5c5 ]
+
+The digital volume TLV specifies the step as 0.25dB but the actual step
+of the control is 0.125dB. Update the TLV to correct this.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220602162119.3393857-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l36.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs35l36.c b/sound/soc/codecs/cs35l36.c
+index d83c1b318c1c46f76f82e4bc723d05e4a5fb063e..0accdb45ed7276df78dacdfc3ff38cfbff7681bb 100644
+--- a/sound/soc/codecs/cs35l36.c
++++ b/sound/soc/codecs/cs35l36.c
+@@ -444,7 +444,8 @@ static bool cs35l36_volatile_reg(struct device *dev, unsigned int reg)
+ 	}
+ }
+ 
+-static DECLARE_TLV_DB_SCALE(dig_vol_tlv, -10200, 25, 0);
++static const DECLARE_TLV_DB_RANGE(dig_vol_tlv, 0, 912,
++				  TLV_DB_MINMAX_ITEM(-10200, 1200));
+ static DECLARE_TLV_DB_SCALE(amp_gain_tlv, 0, 1, 1);
+ 
+ static const char * const cs35l36_pcm_sftramp_text[] =  {
diff --git a/0015-ASoC-cs53l30-Correct-number-of-volume-levels-on-SX-c.patch b/0015-ASoC-cs53l30-Correct-number-of-volume-levels-on-SX-c.patch
new file mode 100644
index 000000000000..492c4daf1bc9
--- /dev/null
+++ b/0015-ASoC-cs53l30-Correct-number-of-volume-levels-on-SX-c.patch
@@ -0,0 +1,54 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Thu, 2 Jun 2022 17:21:16 +0100
+Subject: [PATCH] ASoC: cs53l30: Correct number of volume levels on SX controls
+
+[ Upstream commit 7fbd6dd68127927e844912a16741016d432a0737 ]
+
+This driver specified the maximum value rather than the number of volume
+levels on the SX controls, this is incorrect, so correct them.
+
+Reported-by: David Rhodes <david.rhodes@cirrus.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220602162119.3393857-4-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs53l30.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/cs53l30.c b/sound/soc/codecs/cs53l30.c
+index f2087bd38dbc81d484a1bb88edbbff6345203696..c2912ad3851b71a39430c4334d083cc55343f310 100644
+--- a/sound/soc/codecs/cs53l30.c
++++ b/sound/soc/codecs/cs53l30.c
+@@ -348,22 +348,22 @@ static const struct snd_kcontrol_new cs53l30_snd_controls[] = {
+ 	SOC_ENUM("ADC2 NG Delay", adc2_ng_delay_enum),
+ 
+ 	SOC_SINGLE_SX_TLV("ADC1A PGA Volume",
+-		    CS53L30_ADC1A_AFE_CTL, 0, 0x34, 0x18, pga_tlv),
++		    CS53L30_ADC1A_AFE_CTL, 0, 0x34, 0x24, pga_tlv),
+ 	SOC_SINGLE_SX_TLV("ADC1B PGA Volume",
+-		    CS53L30_ADC1B_AFE_CTL, 0, 0x34, 0x18, pga_tlv),
++		    CS53L30_ADC1B_AFE_CTL, 0, 0x34, 0x24, pga_tlv),
+ 	SOC_SINGLE_SX_TLV("ADC2A PGA Volume",
+-		    CS53L30_ADC2A_AFE_CTL, 0, 0x34, 0x18, pga_tlv),
++		    CS53L30_ADC2A_AFE_CTL, 0, 0x34, 0x24, pga_tlv),
+ 	SOC_SINGLE_SX_TLV("ADC2B PGA Volume",
+-		    CS53L30_ADC2B_AFE_CTL, 0, 0x34, 0x18, pga_tlv),
++		    CS53L30_ADC2B_AFE_CTL, 0, 0x34, 0x24, pga_tlv),
+ 
+ 	SOC_SINGLE_SX_TLV("ADC1A Digital Volume",
+-		    CS53L30_ADC1A_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv),
++		    CS53L30_ADC1A_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv),
+ 	SOC_SINGLE_SX_TLV("ADC1B Digital Volume",
+-		    CS53L30_ADC1B_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv),
++		    CS53L30_ADC1B_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv),
+ 	SOC_SINGLE_SX_TLV("ADC2A Digital Volume",
+-		    CS53L30_ADC2A_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv),
++		    CS53L30_ADC2A_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv),
+ 	SOC_SINGLE_SX_TLV("ADC2B Digital Volume",
+-		    CS53L30_ADC2B_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv),
++		    CS53L30_ADC2B_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv),
+ };
+ 
+ static const struct snd_soc_dapm_widget cs53l30_dapm_widgets[] = {
diff --git a/0015-ZEN-Tune-mgLRU-to-protect-cache-used-in-the-last-sec.patch b/0015-ZEN-Tune-mgLRU-to-protect-cache-used-in-the-last-sec.patch
new file mode 100644
index 000000000000..8ee4aef66231
--- /dev/null
+++ b/0015-ZEN-Tune-mgLRU-to-protect-cache-used-in-the-last-sec.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Steven Barrett <steven@liquorix.net>
+Date: Wed, 11 Aug 2021 18:41:50 -0500
+Subject: [PATCH] ZEN: Tune mgLRU to protect cache used in the last second
+
+Although not identical to the le9 patches that protect a byte-amount of
+cache through tunables, multigenerational LRU now supports protecting
+cache accessed in the last X milliseconds.
+
+In #218, Yu recommends starting with 1000ms and tuning as needed.  This
+looks like a safe default and turning on this feature should help users
+that don't know they need it.
+---
+ mm/vmscan.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index aef71c45c424f046fe850a57c6b3fce10c63d93a..421e5a6eaedc2958e68dd67322b5725278ae5f38 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4355,7 +4355,11 @@ static bool age_lruvec(struct lruvec *lruvec, struct scan_control *sc,
+ }
+ 
+ /* to protect the working set of the last N jiffies */
++#ifdef CONFIG_ZEN_INTERACTIVE
++static unsigned long lru_gen_min_ttl __read_mostly = HZ;
++#else
+ static unsigned long lru_gen_min_ttl __read_mostly;
++#endif
+ 
+ static void lru_gen_age_node(struct pglist_data *pgdat, struct scan_control *sc)
+ {
diff --git a/0016-ASoC-cs42l52-Correct-TLV-for-Bypass-Volume.patch b/0016-ASoC-cs42l52-Correct-TLV-for-Bypass-Volume.patch
new file mode 100644
index 000000000000..a688061ec05c
--- /dev/null
+++ b/0016-ASoC-cs42l52-Correct-TLV-for-Bypass-Volume.patch
@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Thu, 2 Jun 2022 17:21:17 +0100
+Subject: [PATCH] ASoC: cs42l52: Correct TLV for Bypass Volume
+
+[ Upstream commit 91e90c712fade0b69cdff7cc6512f6099bd18ae5 ]
+
+The Bypass Volume is accidentally using a -6dB minimum TLV rather than
+the correct -60dB minimum. Add a new TLV to correct this.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220602162119.3393857-5-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l52.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
+index 785caba3f653d89aa00c2d217817ce626e1224db..c19ad3c247026ee64ada80e18358642278458ad7 100644
+--- a/sound/soc/codecs/cs42l52.c
++++ b/sound/soc/codecs/cs42l52.c
+@@ -137,6 +137,8 @@ static DECLARE_TLV_DB_SCALE(mic_tlv, 1600, 100, 0);
+ 
+ static DECLARE_TLV_DB_SCALE(pga_tlv, -600, 50, 0);
+ 
++static DECLARE_TLV_DB_SCALE(pass_tlv, -6000, 50, 0);
++
+ static DECLARE_TLV_DB_SCALE(mix_tlv, -5150, 50, 0);
+ 
+ static DECLARE_TLV_DB_SCALE(beep_tlv, -56, 200, 0);
+@@ -351,7 +353,7 @@ static const struct snd_kcontrol_new cs42l52_snd_controls[] = {
+ 			      CS42L52_SPKB_VOL, 0, 0x40, 0xC0, hl_tlv),
+ 
+ 	SOC_DOUBLE_R_SX_TLV("Bypass Volume", CS42L52_PASSTHRUA_VOL,
+-			      CS42L52_PASSTHRUB_VOL, 0, 0x88, 0x90, pga_tlv),
++			      CS42L52_PASSTHRUB_VOL, 0, 0x88, 0x90, pass_tlv),
+ 
+ 	SOC_DOUBLE("Bypass Mute", CS42L52_MISC_CTL, 4, 5, 1, 0),
+ 
diff --git a/0017-ASoC-cs42l56-Correct-typo-in-minimum-level-for-SX-vo.patch b/0017-ASoC-cs42l56-Correct-typo-in-minimum-level-for-SX-vo.patch
new file mode 100644
index 000000000000..931770bcc17b
--- /dev/null
+++ b/0017-ASoC-cs42l56-Correct-typo-in-minimum-level-for-SX-vo.patch
@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Thu, 2 Jun 2022 17:21:18 +0100
+Subject: [PATCH] ASoC: cs42l56: Correct typo in minimum level for SX volume
+ controls
+
+[ Upstream commit a8928ada9b96944cadd8b65d191e33199fd38782 ]
+
+A couple of the SX volume controls specify 0x84 as the lowest volume
+value, however the correct value from the datasheet is 0x44. The
+datasheet don't include spaces in the value it displays as binary so
+this was almost certainly just a typo reading 1000100.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220602162119.3393857-6-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l56.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
+index 3cf8a0b4478cd1f3769d6ff04516bb8d3f863290..b39c25409c239fa762974f5a398ffc7a09a93bd2 100644
+--- a/sound/soc/codecs/cs42l56.c
++++ b/sound/soc/codecs/cs42l56.c
+@@ -391,9 +391,9 @@ static const struct snd_kcontrol_new cs42l56_snd_controls[] = {
+ 	SOC_DOUBLE("ADC Boost Switch", CS42L56_GAIN_BIAS_CTL, 3, 2, 1, 1),
+ 
+ 	SOC_DOUBLE_R_SX_TLV("Headphone Volume", CS42L56_HPA_VOLUME,
+-			      CS42L56_HPB_VOLUME, 0, 0x84, 0x48, hl_tlv),
++			      CS42L56_HPB_VOLUME, 0, 0x44, 0x48, hl_tlv),
+ 	SOC_DOUBLE_R_SX_TLV("LineOut Volume", CS42L56_LOA_VOLUME,
+-			      CS42L56_LOB_VOLUME, 0, 0x84, 0x48, hl_tlv),
++			      CS42L56_LOB_VOLUME, 0, 0x44, 0x48, hl_tlv),
+ 
+ 	SOC_SINGLE_TLV("Bass Shelving Volume", CS42L56_TONE_CTL,
+ 			0, 0x00, 1, tone_tlv),
diff --git a/0018-ASoC-cs42l51-Correct-minimum-value-for-SX-volume-con.patch b/0018-ASoC-cs42l51-Correct-minimum-value-for-SX-volume-con.patch
new file mode 100644
index 000000000000..68ae2afd5679
--- /dev/null
+++ b/0018-ASoC-cs42l51-Correct-minimum-value-for-SX-volume-con.patch
@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Thu, 2 Jun 2022 17:21:19 +0100
+Subject: [PATCH] ASoC: cs42l51: Correct minimum value for SX volume control
+
+[ Upstream commit fcb3b5a58926d16d9a338841b74af06d4c29be15 ]
+
+The minimum value for the PGA Volume is given as 0x1A, however the
+values from there to 0x19 are all the same volume and this is not
+represented in the TLV structure. The number of volumes given is correct
+so this leads to all the volumes being shifted. Move the minimum value
+up to 0x19 to fix this.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220602162119.3393857-7-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l51.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c
+index e9c3cb4e2bfcb8cbe663118d272c84b35dcb733e..b9c262a15edf4556dce8bab0631cfa24b027ec92 100644
+--- a/sound/soc/codecs/cs42l51.c
++++ b/sound/soc/codecs/cs42l51.c
+@@ -146,7 +146,7 @@ static const struct snd_kcontrol_new cs42l51_snd_controls[] = {
+ 			0, 0xA0, 96, adc_att_tlv),
+ 	SOC_DOUBLE_R_SX_TLV("PGA Volume",
+ 			CS42L51_ALC_PGA_CTL, CS42L51_ALC_PGB_CTL,
+-			0, 0x1A, 30, pga_tlv),
++			0, 0x19, 30, pga_tlv),
+ 	SOC_SINGLE("Playback Deemphasis Switch", CS42L51_DAC_CTL, 3, 1, 0),
+ 	SOC_SINGLE("Auto-Mute Switch", CS42L51_DAC_CTL, 2, 1, 0),
+ 	SOC_SINGLE("Soft Ramp Switch", CS42L51_DAC_CTL, 1, 1, 0),
diff --git a/0019-drm-amdkfd-add-pinned-BOs-to-kfd_bo_list.patch b/0019-drm-amdkfd-add-pinned-BOs-to-kfd_bo_list.patch
new file mode 100644
index 000000000000..eba81afa05e7
--- /dev/null
+++ b/0019-drm-amdkfd-add-pinned-BOs-to-kfd_bo_list.patch
@@ -0,0 +1,72 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lang Yu <Lang.Yu@amd.com>
+Date: Tue, 31 May 2022 09:19:43 +0800
+Subject: [PATCH] drm/amdkfd: add pinned BOs to kfd_bo_list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 4fac4fcf4500bce515b0f32195e7bb86aa0246c6 ]
+
+The kfd_bo_list is used to restore process BOs after
+evictions. As page tables could be destroyed during
+evictions, we should also update pinned BOs' page tables
+during restoring to make sure they are valid.
+
+So for pinned BOs,
+1, Validate them and update their page tables.
+2, Don't add eviction fence for them.
+
+v2:
+ - Don't handle pinned ones specially in BO validation.(Felix)
+
+Signed-off-by: Lang Yu <Lang.Yu@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+index cd89d2e46852d071c0a997627488aacc76b70330..f4509656ea8c859df89199b95b720e2ce6ee57e7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+@@ -1955,9 +1955,6 @@ int amdgpu_amdkfd_gpuvm_map_gtt_bo_to_kernel(struct amdgpu_device *adev,
+ 		return -EINVAL;
+ 	}
+ 
+-	/* delete kgd_mem from kfd_bo_list to avoid re-validating
+-	 * this BO in BO's restoring after eviction.
+-	 */
+ 	mutex_lock(&mem->process_info->lock);
+ 
+ 	ret = amdgpu_bo_reserve(bo, true);
+@@ -1980,7 +1977,6 @@ int amdgpu_amdkfd_gpuvm_map_gtt_bo_to_kernel(struct amdgpu_device *adev,
+ 
+ 	amdgpu_amdkfd_remove_eviction_fence(
+ 		bo, mem->process_info->eviction_fence);
+-	list_del_init(&mem->validate_list.head);
+ 
+ 	if (size)
+ 		*size = amdgpu_bo_size(bo);
+@@ -2544,12 +2540,15 @@ int amdgpu_amdkfd_gpuvm_restore_process_bos(void *info, struct dma_fence **ef)
+ 	process_info->eviction_fence = new_fence;
+ 	*ef = dma_fence_get(&new_fence->base);
+ 
+-	/* Attach new eviction fence to all BOs */
++	/* Attach new eviction fence to all BOs except pinned ones */
+ 	list_for_each_entry(mem, &process_info->kfd_bo_list,
+-		validate_list.head)
++		validate_list.head) {
++		if (mem->bo->tbo.pin_count)
++			continue;
++
+ 		amdgpu_bo_fence(mem->bo,
+ 			&process_info->eviction_fence->base, true);
+-
++	}
+ 	/* Attach eviction fence to PD / PT BOs */
+ 	list_for_each_entry(peer_vm, &process_info->vm_list_head,
+ 			    vm_list_node) {
diff --git a/0020-ata-libata-core-fix-NULL-pointer-deref-in-ata_host_a.patch b/0020-ata-libata-core-fix-NULL-pointer-deref-in-ata_host_a.patch
new file mode 100644
index 000000000000..0031463cf547
--- /dev/null
+++ b/0020-ata-libata-core-fix-NULL-pointer-deref-in-ata_host_a.patch
@@ -0,0 +1,46 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+Date: Sat, 21 May 2022 23:34:10 +0300
+Subject: [PATCH] ata: libata-core: fix NULL pointer deref in
+ ata_host_alloc_pinfo()
+
+[ Upstream commit bf476fe22aa1851bab4728e0c49025a6a0bea307 ]
+
+In an unlikely (and probably wrong?) case that the 'ppi' parameter of
+ata_host_alloc_pinfo() points to an array starting with a NULL pointer,
+there's going to be a kernel oops as the 'pi' local variable won't get
+reassigned from the initial value of NULL. Initialize 'pi' instead to
+'&ata_dummy_port_info' to fix the possible kernel oops for good...
+
+Found by Linux Verification Center (linuxtesting.org) with the SVACE static
+analysis tool.
+
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 3d57fa84e2be84cc7cd4b2ed622b5a0abde4bb11..ea967182125898c317dcdcced64a6e67c64cd837 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5506,7 +5506,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
+ 				      const struct ata_port_info * const * ppi,
+ 				      int n_ports)
+ {
+-	const struct ata_port_info *pi;
++	const struct ata_port_info *pi = &ata_dummy_port_info;
+ 	struct ata_host *host;
+ 	int i, j;
+ 
+@@ -5514,7 +5514,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
+ 	if (!host)
+ 		return NULL;
+ 
+-	for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) {
++	for (i = 0, j = 0; i < host->n_ports; i++) {
+ 		struct ata_port *ap = host->ports[i];
+ 
+ 		if (ppi[j])
diff --git a/0021-quota-Prevent-memory-allocation-recursion-while-hold.patch b/0021-quota-Prevent-memory-allocation-recursion-while-hold.patch
new file mode 100644
index 000000000000..962d80015363
--- /dev/null
+++ b/0021-quota-Prevent-memory-allocation-recursion-while-hold.patch
@@ -0,0 +1,93 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
+Date: Sun, 5 Jun 2022 15:38:13 +0100
+Subject: [PATCH] quota: Prevent memory allocation recursion while holding
+ dq_lock
+
+[ Upstream commit 537e11cdc7a6b3ce94fa25ed41306193df9677b7 ]
+
+As described in commit 02117b8ae9c0 ("f2fs: Set GF_NOFS in
+read_cache_page_gfp while doing f2fs_quota_read"), we must not enter
+filesystem reclaim while holding the dq_lock.  Prevent this more generally
+by using memalloc_nofs_save() while holding the lock.
+
+Link: https://lore.kernel.org/r/20220605143815.2330891-2-willy@infradead.org
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index a74aef99bd3d6105b07da8ee90f07f1ff15d0c69..09d1307959d085720769839b95f5c99f0478de78 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -79,6 +79,7 @@
+ #include <linux/capability.h>
+ #include <linux/quotaops.h>
+ #include <linux/blkdev.h>
++#include <linux/sched/mm.h>
+ #include "../internal.h" /* ugh */
+ 
+ #include <linux/uaccess.h>
+@@ -425,9 +426,11 @@ EXPORT_SYMBOL(mark_info_dirty);
+ int dquot_acquire(struct dquot *dquot)
+ {
+ 	int ret = 0, ret2 = 0;
++	unsigned int memalloc;
+ 	struct quota_info *dqopt = sb_dqopt(dquot->dq_sb);
+ 
+ 	mutex_lock(&dquot->dq_lock);
++	memalloc = memalloc_nofs_save();
+ 	if (!test_bit(DQ_READ_B, &dquot->dq_flags)) {
+ 		ret = dqopt->ops[dquot->dq_id.type]->read_dqblk(dquot);
+ 		if (ret < 0)
+@@ -458,6 +461,7 @@ int dquot_acquire(struct dquot *dquot)
+ 	smp_mb__before_atomic();
+ 	set_bit(DQ_ACTIVE_B, &dquot->dq_flags);
+ out_iolock:
++	memalloc_nofs_restore(memalloc);
+ 	mutex_unlock(&dquot->dq_lock);
+ 	return ret;
+ }
+@@ -469,9 +473,11 @@ EXPORT_SYMBOL(dquot_acquire);
+ int dquot_commit(struct dquot *dquot)
+ {
+ 	int ret = 0;
++	unsigned int memalloc;
+ 	struct quota_info *dqopt = sb_dqopt(dquot->dq_sb);
+ 
+ 	mutex_lock(&dquot->dq_lock);
++	memalloc = memalloc_nofs_save();
+ 	if (!clear_dquot_dirty(dquot))
+ 		goto out_lock;
+ 	/* Inactive dquot can be only if there was error during read/init
+@@ -481,6 +487,7 @@ int dquot_commit(struct dquot *dquot)
+ 	else
+ 		ret = -EIO;
+ out_lock:
++	memalloc_nofs_restore(memalloc);
+ 	mutex_unlock(&dquot->dq_lock);
+ 	return ret;
+ }
+@@ -492,9 +499,11 @@ EXPORT_SYMBOL(dquot_commit);
+ int dquot_release(struct dquot *dquot)
+ {
+ 	int ret = 0, ret2 = 0;
++	unsigned int memalloc;
+ 	struct quota_info *dqopt = sb_dqopt(dquot->dq_sb);
+ 
+ 	mutex_lock(&dquot->dq_lock);
++	memalloc = memalloc_nofs_save();
+ 	/* Check whether we are not racing with some other dqget() */
+ 	if (dquot_is_busy(dquot))
+ 		goto out_dqlock;
+@@ -510,6 +519,7 @@ int dquot_release(struct dquot *dquot)
+ 	}
+ 	clear_bit(DQ_ACTIVE_B, &dquot->dq_flags);
+ out_dqlock:
++	memalloc_nofs_restore(memalloc);
+ 	mutex_unlock(&dquot->dq_lock);
+ 	return ret;
+ }
diff --git a/0022-ASoC-wm8962-Fix-suspend-while-playing-music.patch b/0022-ASoC-wm8962-Fix-suspend-while-playing-music.patch
new file mode 100644
index 000000000000..9493288b8525
--- /dev/null
+++ b/0022-ASoC-wm8962-Fix-suspend-while-playing-music.patch
@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Adam Ford <aford173@gmail.com>
+Date: Thu, 26 May 2022 13:21:28 -0500
+Subject: [PATCH] ASoC: wm8962: Fix suspend while playing music
+
+[ Upstream commit d1f5272c0f7d2e53c6f2480f46725442776f5f78 ]
+
+If the audio CODEC is playing sound when the system is suspended,
+it can be left in a state which throws the following error:
+
+wm8962 3-001a: ASoC: error at soc_component_read_no_lock on wm8962.3-001a: -16
+
+Once this error has occurred, the audio will not work again until rebooted.
+
+Fix this by configuring SET_SYSTEM_SLEEP_PM_OPS.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220526182129.538472-1-aford173@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 2c41d31956aa888188eb22832154371e38899381..f622a6bbd2fb3e6149855672c93a765bd7a06e4a 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -3871,6 +3871,7 @@ static int wm8962_runtime_suspend(struct device *dev)
+ #endif
+ 
+ static const struct dev_pm_ops wm8962_pm = {
++	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
+ 	SET_RUNTIME_PM_OPS(wm8962_runtime_suspend, wm8962_runtime_resume, NULL)
+ };
+ 
diff --git a/0023-ASoC-es8328-Fix-event-generation-for-deemphasis-cont.patch b/0023-ASoC-es8328-Fix-event-generation-for-deemphasis-cont.patch
new file mode 100644
index 000000000000..e83d7d668dfe
--- /dev/null
+++ b/0023-ASoC-es8328-Fix-event-generation-for-deemphasis-cont.patch
@@ -0,0 +1,42 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@kernel.org>
+Date: Fri, 3 Jun 2022 14:39:37 +0200
+Subject: [PATCH] ASoC: es8328: Fix event generation for deemphasis control
+
+[ Upstream commit 8259610c2ec01c5cbfb61882ae176aabacac9c19 ]
+
+Currently the put() method for the deemphasis control returns 0 when a new
+value is written to the control even if the value changed, meaning events
+are not generated. Fix this, skip the work of updating the value when it is
+unchanged and then return 1 after having done so.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20220603123937.4013603-1-broonie@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index 3f00ead97006e714abe3dbdf7cc6777fd3083458..dd53dfd87b04ee0c28d9a2419898be5fb9565567 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -161,13 +161,16 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol,
+ 	if (deemph > 1)
+ 		return -EINVAL;
+ 
++	if (es8328->deemph == deemph)
++		return 0;
++
+ 	ret = es8328_set_deemph(component);
+ 	if (ret < 0)
+ 		return ret;
+ 
+ 	es8328->deemph = deemph;
+ 
+-	return 0;
++	return 1;
+ }
+ 
+ 
diff --git a/0024-ASoC-wm_adsp-Fix-event-generation-for-wm_adsp_fw_put.patch b/0024-ASoC-wm_adsp-Fix-event-generation-for-wm_adsp_fw_put.patch
new file mode 100644
index 000000000000..1069a486ce47
--- /dev/null
+++ b/0024-ASoC-wm_adsp-Fix-event-generation-for-wm_adsp_fw_put.patch
@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@kernel.org>
+Date: Fri, 3 Jun 2022 13:50:03 +0200
+Subject: [PATCH] ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put()
+
+[ Upstream commit 2abdf9f80019e8244d3806ed0e1c9f725e50b452 ]
+
+Currently wm_adsp_fw_put() returns 0 rather than 1 when updating the value
+of the control, meaning that no event is generated to userspace. Fix this
+by setting the default return value to 1, the code already exits early with
+a return value of 0 if the value is unchanged.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220603115003.3865834-1-broonie@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm_adsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index e32c8ded181d390bfb41cf1d3743f5b7dfbbd9e3..9cfd4f18493fbe985055220da94544f0d262f9e4 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -333,7 +333,7 @@ int wm_adsp_fw_put(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+ 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
+ 	struct wm_adsp *dsp = snd_soc_component_get_drvdata(component);
+-	int ret = 0;
++	int ret = 1;
+ 
+ 	if (ucontrol->value.enumerated.item[0] == dsp[e->shift_l].fw)
+ 		return 0;
diff --git a/0025-ALSA-hda-MTL-add-HD-Audio-PCI-ID-and-HDMI-codec-vend.patch b/0025-ALSA-hda-MTL-add-HD-Audio-PCI-ID-and-HDMI-codec-vend.patch
new file mode 100644
index 000000000000..76d7ec8e97a2
--- /dev/null
+++ b/0025-ALSA-hda-MTL-add-HD-Audio-PCI-ID-and-HDMI-codec-vend.patch
@@ -0,0 +1,48 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Yong Zhi <yong.zhi@intel.com>
+Date: Mon, 6 Jun 2022 15:42:32 -0500
+Subject: [PATCH] ALSA: hda: MTL: add HD Audio PCI ID and HDMI codec vendor ID
+
+[ Upstream commit 2e45f2185283a2d927ef2cdbdc246cd65740c8df ]
+
+Add HD Audio PCI ID for Intel Meteorlake platform.
+
+[ corrected the hex number to lower letters by tiwai ]
+
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Yong Zhi <yong.zhi@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220606204232.144296-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c  | 3 +++
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 0a83eb6b88b1f8298a9d472c8fd6777557f7390a..a77165bd92a983c35bfa56e6f0ca4407b1ff7aa1 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2525,6 +2525,9 @@ static const struct pci_device_id azx_ids[] = {
+ 	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
+ 	{ PCI_DEVICE(0x8086, 0x51cf),
+ 	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
++	/* Meteorlake-P */
++	{ PCI_DEVICE(0x8086, 0x7e28),
++	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
+ 	/* Broxton-P(Apollolake) */
+ 	{ PCI_DEVICE(0x8086, 0x5a98),
+ 	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON },
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 31fe41795571280ef6d6c29c637157edb0f321d5..6c209cd26c0cab1ed9e835e118e6bcfaf37a7f05 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -4554,6 +4554,7 @@ HDA_CODEC_ENTRY(0x8086281a, "Jasperlake HDMI",	patch_i915_icl_hdmi),
+ HDA_CODEC_ENTRY(0x8086281b, "Elkhartlake HDMI",	patch_i915_icl_hdmi),
+ HDA_CODEC_ENTRY(0x8086281c, "Alderlake-P HDMI", patch_i915_adlp_hdmi),
+ HDA_CODEC_ENTRY(0x8086281f, "Raptorlake-P HDMI",	patch_i915_adlp_hdmi),
++HDA_CODEC_ENTRY(0x8086281d, "Meteorlake HDMI",	patch_i915_adlp_hdmi),
+ HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI",	patch_generic_hdmi),
+ HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI",	patch_i915_byt_hdmi),
+ HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI",	patch_i915_byt_hdmi),
diff --git a/0026-Input-soc_button_array-also-add-Lenovo-Yoga-Tablet2-.patch b/0026-Input-soc_button_array-also-add-Lenovo-Yoga-Tablet2-.patch
new file mode 100644
index 000000000000..5fef99eb4e74
--- /dev/null
+++ b/0026-Input-soc_button_array-also-add-Lenovo-Yoga-Tablet2-.patch
@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marius Hoch <mail@mariushoch.de>
+Date: Tue, 7 Jun 2022 12:10:52 -0700
+Subject: [PATCH] Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F
+ to dmi_use_low_level_irq
+
+[ Upstream commit 6ab2e51898cd4343bbdf8587af8ce8fbabddbcb5 ]
+
+Commit 223f61b8c5ad ("Input: soc_button_array - add Lenovo Yoga Tablet2
+1051L to the dmi_use_low_level_irq list") added the 1051L to this list
+already, but the same problem applies to the 1051F. As there are no
+further 1051 variants (just the F/L), we can just DMI match 1051.
+
+Tested on a Lenovo Yoga Tablet2 1051F: Without this patch the
+home-button stops working after a wakeup from suspend.
+
+Signed-off-by: Marius Hoch <mail@mariushoch.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20220603120246.3065-1-mail@mariushoch.de
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/soc_button_array.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
+index cbb1599a520e602cafb1e8ef8c96253bf718ef9d..480476121c0105dde875a1902a8a5531fa539762 100644
+--- a/drivers/input/misc/soc_button_array.c
++++ b/drivers/input/misc/soc_button_array.c
+@@ -85,13 +85,13 @@ static const struct dmi_system_id dmi_use_low_level_irq[] = {
+ 	},
+ 	{
+ 		/*
+-		 * Lenovo Yoga Tab2 1051L, something messes with the home-button
++		 * Lenovo Yoga Tab2 1051F/1051L, something messes with the home-button
+ 		 * IRQ settings, leading to a non working home-button.
+ 		 */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "60073"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "1051L"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "1051"),
+ 		},
+ 	},
+ 	{} /* Terminating entry */
diff --git a/0027-scsi-vmw_pvscsi-Expand-vcpuHint-to-16-bits.patch b/0027-scsi-vmw_pvscsi-Expand-vcpuHint-to-16-bits.patch
new file mode 100644
index 000000000000..4a110c174d03
--- /dev/null
+++ b/0027-scsi-vmw_pvscsi-Expand-vcpuHint-to-16-bits.patch
@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Wentao Wang <wwentao@vmware.com>
+Date: Thu, 2 Jun 2022 08:57:00 +0000
+Subject: [PATCH] scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
+
+[ Upstream commit cf71d59c2eceadfcde0fb52e237990a0909880d7 ]
+
+vcpuHint has been expanded to 16 bit on host to enable routing to more
+CPUs. Guest side should align with the change. This change has been tested
+with hosts with 8-bit and 16-bit vcpuHint, on both platforms host side can
+get correct value.
+
+Link: https://lore.kernel.org/r/EF35F4D5-5DCC-42C5-BCC4-29DF1729B24C@vmware.com
+Signed-off-by: Wentao Wang <wwentao@vmware.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/vmw_pvscsi.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h
+index 51a82f7803d3c7ede3643dc2ea04fee0cc387989..9d16cf925483744813ab5804f573a1d464673f4a 100644
+--- a/drivers/scsi/vmw_pvscsi.h
++++ b/drivers/scsi/vmw_pvscsi.h
+@@ -331,8 +331,8 @@ struct PVSCSIRingReqDesc {
+ 	u8	tag;
+ 	u8	bus;
+ 	u8	target;
+-	u8	vcpuHint;
+-	u8	unused[59];
++	u16	vcpuHint;
++	u8	unused[58];
+ } __packed;
+ 
+ /*
diff --git a/0028-scsi-lpfc-Resolve-NULL-ptr-dereference-after-an-ELS-.patch b/0028-scsi-lpfc-Resolve-NULL-ptr-dereference-after-an-ELS-.patch
new file mode 100644
index 000000000000..9a8f2487cb23
--- /dev/null
+++ b/0028-scsi-lpfc-Resolve-NULL-ptr-dereference-after-an-ELS-.patch
@@ -0,0 +1,74 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: James Smart <jsmart2021@gmail.com>
+Date: Fri, 3 Jun 2022 10:43:25 -0700
+Subject: [PATCH] scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is
+ aborted
+
+[ Upstream commit b1b3440f437b75fb2a9b0cfe58df461e40eca474 ]
+
+A use-after-free crash can occur after an ELS LOGO is aborted.
+
+Specifically, a nodelist structure is freed and then
+ndlp->vport->cfg_log_verbose is dereferenced in lpfc_nlp_get() when the
+discovery state machine is mistakenly called a second time with
+NLP_EVT_DEVICE_RM argument.
+
+Rework lpfc_cmpl_els_logo() to prevent the duplicate calls to release a
+nodelist structure.
+
+Link: https://lore.kernel.org/r/20220603174329.63777-6-jsmart2021@gmail.com
+Co-developed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 892b3da1ba4508e3f06c8b48bd4cdc09764db642..9e389958003900896224066091d8f2cec8a942af 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -3035,18 +3035,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 		spin_unlock_irq(&ndlp->lock);
+ 		lpfc_disc_state_machine(vport, ndlp, cmdiocb,
+ 					NLP_EVT_DEVICE_RM);
+-		lpfc_els_free_iocb(phba, cmdiocb);
+-		lpfc_nlp_put(ndlp);
+-
+-		/* Presume the node was released. */
+-		return;
++		goto out_rsrc_free;
+ 	}
+ 
+ out:
+-	/* Driver is done with the IO.  */
+-	lpfc_els_free_iocb(phba, cmdiocb);
+-	lpfc_nlp_put(ndlp);
+-
+ 	/* At this point, the LOGO processing is complete. NOTE: For a
+ 	 * pt2pt topology, we are assuming the NPortID will only change
+ 	 * on link up processing. For a LOGO / PLOGI initiated by the
+@@ -3073,6 +3065,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 				 ndlp->nlp_DID, ulp_status,
+ 				 ulp_word4, tmo,
+ 				 vport->num_disc_nodes);
++
++		lpfc_els_free_iocb(phba, cmdiocb);
++		lpfc_nlp_put(ndlp);
++
+ 		lpfc_disc_start(vport);
+ 		return;
+ 	}
+@@ -3089,6 +3085,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 		lpfc_disc_state_machine(vport, ndlp, cmdiocb,
+ 					NLP_EVT_DEVICE_RM);
+ 	}
++out_rsrc_free:
++	/* Driver is done with the I/O. */
++	lpfc_els_free_iocb(phba, cmdiocb);
++	lpfc_nlp_put(ndlp);
+ }
+ 
+ /**
diff --git a/0029-scsi-lpfc-Fix-port-stuck-in-bypassed-state-after-LIP.patch b/0029-scsi-lpfc-Fix-port-stuck-in-bypassed-state-after-LIP.patch
new file mode 100644
index 000000000000..00a1a8b49f7f
--- /dev/null
+++ b/0029-scsi-lpfc-Fix-port-stuck-in-bypassed-state-after-LIP.patch
@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: James Smart <jsmart2021@gmail.com>
+Date: Fri, 3 Jun 2022 10:43:26 -0700
+Subject: [PATCH] scsi: lpfc: Fix port stuck in bypassed state after LIP in
+ PT2PT topology
+
+[ Upstream commit 336d63615466b4c06b9401c987813fd19bdde39b ]
+
+After issuing a LIP, a specific target vendor does not ACC the FLOGI that
+lpfc sends.  However, it does send its own FLOGI that lpfc ACCs.  The
+target then establishes the port IDs by sending a PLOGI.  lpfc PLOGI_ACCs
+and starts the RPI registration for DID 0x000001.  The target then sends a
+LOGO to the fabric DID.  lpfc is currently treating the LOGO from the
+fabric DID as a link down and cleans up all the ndlps.  The ndlp for DID
+0x000001 is put back into NPR and discovery stops, leaving the port in
+stuck in bypassed mode.
+
+Change lpfc behavior such that if a LOGO is received for the fabric DID in
+PT2PT topology skip the lpfc_linkdown_port() routine and just move the
+fabric DID back to NPR.
+
+Link: https://lore.kernel.org/r/20220603174329.63777-7-jsmart2021@gmail.com
+Co-developed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_nportdisc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index 4b065c51ee1b0ccdd59d87f7783e9b18baadde2d..f5de88877ffe745ceb00c86649e0ea366fa41467 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -835,7 +835,8 @@ lpfc_rcv_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ 		lpfc_nvmet_invalidate_host(phba, ndlp);
+ 
+ 	if (ndlp->nlp_DID == Fabric_DID) {
+-		if (vport->port_state <= LPFC_FDISC)
++		if (vport->port_state <= LPFC_FDISC ||
++		    vport->fc_flag & FC_PT2PT)
+ 			goto out;
+ 		lpfc_linkdown_port(vport);
+ 		spin_lock_irq(shost->host_lock);
diff --git a/0030-scsi-lpfc-Allow-reduced-polling-rate-for-nvme_admin_.patch b/0030-scsi-lpfc-Allow-reduced-polling-rate-for-nvme_admin_.patch
new file mode 100644
index 000000000000..a8479a0d64d7
--- /dev/null
+++ b/0030-scsi-lpfc-Allow-reduced-polling-rate-for-nvme_admin_.patch
@@ -0,0 +1,69 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: James Smart <jsmart2021@gmail.com>
+Date: Fri, 3 Jun 2022 10:43:28 -0700
+Subject: [PATCH] scsi: lpfc: Allow reduced polling rate for
+ nvme_admin_async_event cmd completion
+
+[ Upstream commit 2e7e9c0c1ec05f18d320ecc8a31eec59d2af1af9 ]
+
+NVMe Asynchronous Event Request commands have no command timeout value per
+specifications.
+
+Set WQE option to allow a reduced FLUSH polling rate for I/O error
+detection specifically for nvme_admin_async_event commands.
+
+Link: https://lore.kernel.org/r/20220603174329.63777-9-jsmart2021@gmail.com
+Co-developed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_hw4.h  |  3 +++
+ drivers/scsi/lpfc/lpfc_nvme.c | 11 +++++++++--
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
+index 02e230ed62802474efa61ff9223b693448822186..e7daef5500952165be70e5646b3943476d35e2dc 100644
+--- a/drivers/scsi/lpfc/lpfc_hw4.h
++++ b/drivers/scsi/lpfc/lpfc_hw4.h
+@@ -4488,6 +4488,9 @@ struct wqe_common {
+ #define wqe_sup_SHIFT         6
+ #define wqe_sup_MASK          0x00000001
+ #define wqe_sup_WORD          word11
++#define wqe_ffrq_SHIFT         6
++#define wqe_ffrq_MASK          0x00000001
++#define wqe_ffrq_WORD          word11
+ #define wqe_wqec_SHIFT        7
+ #define wqe_wqec_MASK         0x00000001
+ #define wqe_wqec_WORD         word11
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index d3a542466e9817a9c226860a6cfa075ef0588a7c..49f44d9d04ea73c01abe54cf7a952c436614d76f 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -1194,7 +1194,8 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport,
+ {
+ 	struct lpfc_hba *phba = vport->phba;
+ 	struct nvmefc_fcp_req *nCmd = lpfc_ncmd->nvmeCmd;
+-	struct lpfc_iocbq *pwqeq = &(lpfc_ncmd->cur_iocbq);
++	struct nvme_common_command *sqe;
++	struct lpfc_iocbq *pwqeq = &lpfc_ncmd->cur_iocbq;
+ 	union lpfc_wqe128 *wqe = &pwqeq->wqe;
+ 	uint32_t req_len;
+ 
+@@ -1251,8 +1252,14 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport,
+ 		cstat->control_requests++;
+ 	}
+ 
+-	if (pnode->nlp_nvme_info & NLP_NVME_NSLER)
++	if (pnode->nlp_nvme_info & NLP_NVME_NSLER) {
+ 		bf_set(wqe_erp, &wqe->generic.wqe_com, 1);
++		sqe = &((struct nvme_fc_cmd_iu *)
++			nCmd->cmdaddr)->sqe.common;
++		if (sqe->opcode == nvme_admin_async_event)
++			bf_set(wqe_ffrq, &wqe->generic.wqe_com, 1);
++	}
++
+ 	/*
+ 	 * Finish initializing those WQE fields that are independent
+ 	 * of the nvme_cmnd request_buffer
diff --git a/0031-scsi-mpt3sas-Fix-out-of-bounds-compiler-warning.patch b/0031-scsi-mpt3sas-Fix-out-of-bounds-compiler-warning.patch
new file mode 100644
index 000000000000..5fe32e4fc9df
--- /dev/null
+++ b/0031-scsi-mpt3sas-Fix-out-of-bounds-compiler-warning.patch
@@ -0,0 +1,89 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Tue, 31 May 2022 22:09:27 +0200
+Subject: [PATCH] scsi: mpt3sas: Fix out-of-bounds compiler warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 120f1d95efb1cdb6fe023c84e38ba06d8f78cd03 ]
+
+I'm facing this warning when building for the parisc64 architecture:
+
+drivers/scsi/mpt3sas/mpt3sas_base.c: In function ‘_base_make_ioc_operational’:
+drivers/scsi/mpt3sas/mpt3sas_base.c:5396:40: warning: array subscript ‘Mpi2SasIOUnitPage1_t {aka struct _MPI2_CONFIG_PAGE_SASIOUNIT_1}[0]’ is partly outside array bounds of ‘unsigned char[20]’ [-Warray-bounds]
+ 5396 |             (le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth)) ?
+drivers/scsi/mpt3sas/mpt3sas_base.c:5382:26: note: referencing an object of size 20 allocated by ‘kzalloc’
+ 5382 |         sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL);
+      |                          ^~~~~~~~~~~~~~~~~~~~~~~
+
+The problem is, that only 20 bytes are allocated with kmalloc(), which is
+sufficient to hold the bytes which are needed.  Nevertheless, gcc complains
+because the whole Mpi2SasIOUnitPage1_t struct is 32 bytes in size and thus
+doesn't fit into those 20 bytes.
+
+This patch simply allocates all 32 bytes (instead of 20) and thus avoids
+the warning. There is no functional change introduced by this patch.
+
+While touching the code I cleaned up to calculation of max_wideport_qd,
+max_narrowport_qd and max_sata_qd to make it easier readable.
+
+Test successfully tested on a HP C8000 PA-RISC workstation with 64-bit
+kernel.
+
+Link: https://lore.kernel.org/r/YpZ197iZdDZSCzrT@p100
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 538d2c0cd971303865eeace130c3eb5d95af4168..aa142052ebe45307b94d6a2caf90d3f3ba57f911 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -5368,6 +5368,7 @@ static int _base_assign_fw_reported_qd(struct MPT3SAS_ADAPTER *ioc)
+ 	Mpi2ConfigReply_t mpi_reply;
+ 	Mpi2SasIOUnitPage1_t *sas_iounit_pg1 = NULL;
+ 	Mpi26PCIeIOUnitPage1_t pcie_iounit_pg1;
++	u16 depth;
+ 	int sz;
+ 	int rc = 0;
+ 
+@@ -5379,7 +5380,7 @@ static int _base_assign_fw_reported_qd(struct MPT3SAS_ADAPTER *ioc)
+ 		goto out;
+ 	/* sas iounit page 1 */
+ 	sz = offsetof(Mpi2SasIOUnitPage1_t, PhyData);
+-	sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL);
++	sas_iounit_pg1 = kzalloc(sizeof(Mpi2SasIOUnitPage1_t), GFP_KERNEL);
+ 	if (!sas_iounit_pg1) {
+ 		pr_err("%s: failure at %s:%d/%s()!\n",
+ 		    ioc->name, __FILE__, __LINE__, __func__);
+@@ -5392,16 +5393,16 @@ static int _base_assign_fw_reported_qd(struct MPT3SAS_ADAPTER *ioc)
+ 		    ioc->name, __FILE__, __LINE__, __func__);
+ 		goto out;
+ 	}
+-	ioc->max_wideport_qd =
+-	    (le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth)) ?
+-	    le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth) :
+-	    MPT3SAS_SAS_QUEUE_DEPTH;
+-	ioc->max_narrowport_qd =
+-	    (le16_to_cpu(sas_iounit_pg1->SASNarrowMaxQueueDepth)) ?
+-	    le16_to_cpu(sas_iounit_pg1->SASNarrowMaxQueueDepth) :
+-	    MPT3SAS_SAS_QUEUE_DEPTH;
+-	ioc->max_sata_qd = (sas_iounit_pg1->SATAMaxQDepth) ?
+-	    sas_iounit_pg1->SATAMaxQDepth : MPT3SAS_SATA_QUEUE_DEPTH;
++
++	depth = le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth);
++	ioc->max_wideport_qd = (depth ? depth : MPT3SAS_SAS_QUEUE_DEPTH);
++
++	depth = le16_to_cpu(sas_iounit_pg1->SASNarrowMaxQueueDepth);
++	ioc->max_narrowport_qd = (depth ? depth : MPT3SAS_SAS_QUEUE_DEPTH);
++
++	depth = sas_iounit_pg1->SATAMaxQDepth;
++	ioc->max_sata_qd = (depth ? depth : MPT3SAS_SATA_QUEUE_DEPTH);
++
+ 	/* pcie iounit page 1 */
+ 	rc = mpt3sas_config_get_pcie_iounit_pg1(ioc, &mpi_reply,
+ 	    &pcie_iounit_pg1, sizeof(Mpi26PCIeIOUnitPage1_t));
diff --git a/0032-scsi-ipr-Fix-missing-incorrect-resource-cleanup-in-e.patch b/0032-scsi-ipr-Fix-missing-incorrect-resource-cleanup-in-e.patch
new file mode 100644
index 000000000000..da8b70d243af
--- /dev/null
+++ b/0032-scsi-ipr-Fix-missing-incorrect-resource-cleanup-in-e.patch
@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Chengguang Xu <cgxu519@mykernel.net>
+Date: Sun, 29 May 2022 23:34:53 +0800
+Subject: [PATCH] scsi: ipr: Fix missing/incorrect resource cleanup in error
+ case
+
+[ Upstream commit d64c491911322af1dcada98e5b9ee0d87e8c8fee ]
+
+Fix missing resource cleanup (when '(--i) == 0') for error case in
+ipr_alloc_mem() and skip incorrect resource cleanup (when '(--i) == 0') for
+error case in ipr_request_other_msi_irqs() because variable i started from
+1.
+
+Link: https://lore.kernel.org/r/20220529153456.4183738-4-cgxu519@mykernel.net
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: Chengguang Xu <cgxu519@mykernel.net>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ipr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 104bee9b3a9dc80bfe171bebd8d96c9cb9d3aa27..00593d8953f1095dfcabb4faa8707f12758626cc 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -9795,7 +9795,7 @@ static int ipr_alloc_mem(struct ipr_ioa_cfg *ioa_cfg)
+ 					GFP_KERNEL);
+ 
+ 		if (!ioa_cfg->hrrq[i].host_rrq)  {
+-			while (--i > 0)
++			while (--i >= 0)
+ 				dma_free_coherent(&pdev->dev,
+ 					sizeof(u32) * ioa_cfg->hrrq[i].size,
+ 					ioa_cfg->hrrq[i].host_rrq,
+@@ -10068,7 +10068,7 @@ static int ipr_request_other_msi_irqs(struct ipr_ioa_cfg *ioa_cfg,
+ 			ioa_cfg->vectors_info[i].desc,
+ 			&ioa_cfg->hrrq[i]);
+ 		if (rc) {
+-			while (--i >= 0)
++			while (--i > 0)
+ 				free_irq(pci_irq_vector(pdev, i),
+ 					&ioa_cfg->hrrq[i]);
+ 			return rc;
diff --git a/0033-scsi-pmcraid-Fix-missing-resource-cleanup-in-error-c.patch b/0033-scsi-pmcraid-Fix-missing-resource-cleanup-in-error-c.patch
new file mode 100644
index 000000000000..e0b1f6cf3f43
--- /dev/null
+++ b/0033-scsi-pmcraid-Fix-missing-resource-cleanup-in-error-c.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Chengguang Xu <cgxu519@mykernel.net>
+Date: Sun, 29 May 2022 23:34:55 +0800
+Subject: [PATCH] scsi: pmcraid: Fix missing resource cleanup in error case
+
+[ Upstream commit ec1e8adcbdf661c57c395bca342945f4f815add7 ]
+
+Fix missing resource cleanup (when '(--i) == 0') for error case in
+pmcraid_register_interrupt_handler().
+
+Link: https://lore.kernel.org/r/20220529153456.4183738-6-cgxu519@mykernel.net
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Chengguang Xu <cgxu519@mykernel.net>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pmcraid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
+index fd674ed1febed1c549859301545da4be19c91717..6d94837c90493b232852a358d504ad9dbe85108d 100644
+--- a/drivers/scsi/pmcraid.c
++++ b/drivers/scsi/pmcraid.c
+@@ -4031,7 +4031,7 @@ pmcraid_register_interrupt_handler(struct pmcraid_instance *pinstance)
+ 	return 0;
+ 
+ out_unwind:
+-	while (--i > 0)
++	while (--i >= 0)
+ 		free_irq(pci_irq_vector(pdev, i), &pinstance->hrrq_vector[i]);
+ 	pci_free_irq_vectors(pdev);
+ 	return rc;
diff --git a/0034-ALSA-hda-realtek-Add-HW8326-support.patch b/0034-ALSA-hda-realtek-Add-HW8326-support.patch
new file mode 100644
index 000000000000..241b436fd162
--- /dev/null
+++ b/0034-ALSA-hda-realtek-Add-HW8326-support.patch
@@ -0,0 +1,147 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: huangwenhui <huangwenhuia@uniontech.com>
+Date: Wed, 8 Jun 2022 16:23:57 +0800
+Subject: [PATCH] ALSA: hda/realtek - Add HW8326 support
+
+[ Upstream commit 527f4643e03c298c1e3321cfa27866b1374a55e1 ]
+
+Added the support of new Huawei codec HW8326. The HW8326 is developed
+by Huawei with Realtek's IP Core, and it's compatible with ALC256.
+
+Signed-off-by: huangwenhui <huangwenhuia@uniontech.com>
+Link: https://lore.kernel.org/r/20220608082357.26898-1-huangwenhuia@uniontech.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/hdac_device.c       |  1 +
+ sound/pci/hda/patch_realtek.c | 14 ++++++++++++++
+ 2 files changed, 15 insertions(+)
+
+diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c
+index 3e9e9ac804f629813b55de6d84cc8e092e0c4e4c..b7e5032b61c97cf7f245a21461263efa6c596271 100644
+--- a/sound/hda/hdac_device.c
++++ b/sound/hda/hdac_device.c
+@@ -660,6 +660,7 @@ static const struct hda_vendor_id hda_vendor_ids[] = {
+ 	{ 0x14f1, "Conexant" },
+ 	{ 0x17e8, "Chrontel" },
+ 	{ 0x1854, "LG" },
++	{ 0x19e5, "Huawei" },
+ 	{ 0x1aec, "Wolfson Microelectronics" },
+ 	{ 0x1af4, "QEMU" },
+ 	{ 0x434d, "C-Media" },
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 8d2d29880716f633d0903c79a8e00693e8665f6e..588d4a59c8d9287dae5f12a05652b7949c6ececb 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -443,6 +443,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ 	case 0x10ec0245:
+ 	case 0x10ec0255:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 	case 0x10ec0257:
+ 	case 0x10ec0282:
+ 	case 0x10ec0283:
+@@ -580,6 +581,7 @@ static void alc_shutup_pins(struct hda_codec *codec)
+ 	switch (codec->core.vendor_id) {
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 	case 0x10ec0283:
+ 	case 0x10ec0286:
+ 	case 0x10ec0288:
+@@ -3247,6 +3249,7 @@ static void alc_disable_headset_jack_key(struct hda_codec *codec)
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_write_coef_idx(codec, 0x48, 0x0);
+ 		alc_update_coef_idx(codec, 0x49, 0x0045, 0x0);
+ 		break;
+@@ -3275,6 +3278,7 @@ static void alc_enable_headset_jack_key(struct hda_codec *codec)
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_write_coef_idx(codec, 0x48, 0xd011);
+ 		alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045);
+ 		break;
+@@ -4910,6 +4914,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_process_coef_fw(codec, coef0256);
+ 		break;
+ 	case 0x10ec0234:
+@@ -5025,6 +5030,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_write_coef_idx(codec, 0x45, 0xc489);
+ 		snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
+ 		alc_process_coef_fw(codec, coef0256);
+@@ -5175,6 +5181,7 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_write_coef_idx(codec, 0x1b, 0x0e4b);
+ 		alc_write_coef_idx(codec, 0x45, 0xc089);
+ 		msleep(50);
+@@ -5274,6 +5281,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_process_coef_fw(codec, coef0256);
+ 		break;
+ 	case 0x10ec0234:
+@@ -5388,6 +5396,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_process_coef_fw(codec, coef0256);
+ 		break;
+ 	case 0x10ec0234:
+@@ -5489,6 +5498,7 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_write_coef_idx(codec, 0x1b, 0x0e4b);
+ 		alc_write_coef_idx(codec, 0x06, 0x6104);
+ 		alc_write_coefex_idx(codec, 0x57, 0x3, 0x09a3);
+@@ -5783,6 +5793,7 @@ static void alc255_set_default_jack_type(struct hda_codec *codec)
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_process_coef_fw(codec, alc256fw);
+ 		break;
+ 	}
+@@ -6385,6 +6396,7 @@ static void alc_combo_jack_hp_jd_restart(struct hda_codec *codec)
+ 	case 0x10ec0236:
+ 	case 0x10ec0255:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */
+ 		alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15);
+ 		break;
+@@ -10149,6 +10161,7 @@ static int patch_alc269(struct hda_codec *codec)
+ 	case 0x10ec0230:
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
++	case 0x19e58326:
+ 		spec->codec_variant = ALC269_TYPE_ALC256;
+ 		spec->shutup = alc256_shutup;
+ 		spec->init_hook = alc256_init;
+@@ -11599,6 +11612,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ 	HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882),
+ 	HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882),
+ 	HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882),
++	HDA_CODEC_ENTRY(0x19e58326, "HW8326", patch_alc269),
+ 	{} /* terminator */
+ };
+ MODULE_DEVICE_TABLE(hdaudio, snd_hda_id_realtek);
diff --git a/0035-virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch b/0035-virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch
new file mode 100644
index 000000000000..c25d841d6972
--- /dev/null
+++ b/0035-virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: chengkaitao <pilgrimtao@gmail.com>
+Date: Thu, 2 Jun 2022 08:55:42 +0800
+Subject: [PATCH] virtio-mmio: fix missing put_device() when vm_cmdline_parent
+ registration failed
+
+[ Upstream commit a58a7f97ba11391d2d0d408e0b24f38d86ae748e ]
+
+The reference must be released when device_register(&vm_cmdline_parent)
+failed. Add the corresponding 'put_device()' in the error handling path.
+
+Signed-off-by: chengkaitao <pilgrimtao@gmail.com>
+Message-Id: <20220602005542.16489-1-chengkaitao@didiglobal.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_mmio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
+index 56128b9c46ebaabe1c1dcd872d11d664cd75d1dd..1dd396d4bebb26f05836bd9de9b1a9762d822734 100644
+--- a/drivers/virtio/virtio_mmio.c
++++ b/drivers/virtio/virtio_mmio.c
+@@ -688,6 +688,7 @@ static int vm_cmdline_set(const char *device,
+ 	if (!vm_cmdline_parent_registered) {
+ 		err = device_register(&vm_cmdline_parent);
+ 		if (err) {
++			put_device(&vm_cmdline_parent);
+ 			pr_err("Failed to register parent device!\n");
+ 			return err;
+ 		}
diff --git a/0036-nfc-nfcmrvl-Fix-memory-leak-in-nfcmrvl_play_deferred.patch b/0036-nfc-nfcmrvl-Fix-memory-leak-in-nfcmrvl_play_deferred.patch
new file mode 100644
index 000000000000..012236f84dc4
--- /dev/null
+++ b/0036-nfc-nfcmrvl-Fix-memory-leak-in-nfcmrvl_play_deferred.patch
@@ -0,0 +1,61 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Xiaohui Zhang <xiaohuizhang@ruc.edu.cn>
+Date: Tue, 7 Jun 2022 16:32:30 +0800
+Subject: [PATCH] nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
+
+[ Upstream commit 8a4d480702b71184fabcf379b80bf7539716752e ]
+
+Similar to the handling of play_deferred in commit 19cfe912c37b
+("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought
+a patch might be needed here as well.
+
+Currently usb_submit_urb is called directly to submit deferred tx
+urbs after unanchor them.
+
+So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb
+and cause memory leak.
+
+Put those urbs in tx_anchor to avoid the leak, and also fix the error
+handling.
+
+Signed-off-by: Xiaohui Zhang <xiaohuizhang@ruc.edu.cn>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20220607083230.6182-1-xiaohuizhang@ruc.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nfcmrvl/usb.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
+index a99aedff795dc6745a5a4692a9a69715133d52d0..ea7309453096890304c2d5aba42c9a590a9c88f0 100644
+--- a/drivers/nfc/nfcmrvl/usb.c
++++ b/drivers/nfc/nfcmrvl/usb.c
+@@ -388,13 +388,25 @@ static void nfcmrvl_play_deferred(struct nfcmrvl_usb_drv_data *drv_data)
+ 	int err;
+ 
+ 	while ((urb = usb_get_from_anchor(&drv_data->deferred))) {
++		usb_anchor_urb(urb, &drv_data->tx_anchor);
++
+ 		err = usb_submit_urb(urb, GFP_ATOMIC);
+-		if (err)
++		if (err) {
++			kfree(urb->setup_packet);
++			usb_unanchor_urb(urb);
++			usb_free_urb(urb);
+ 			break;
++		}
+ 
+ 		drv_data->tx_in_flight++;
++		usb_free_urb(urb);
++	}
++
++	/* Cleanup the rest deferred urbs. */
++	while ((urb = usb_get_from_anchor(&drv_data->deferred))) {
++		kfree(urb->setup_packet);
++		usb_free_urb(urb);
+ 	}
+-	usb_scuttle_anchored_urbs(&drv_data->deferred);
+ }
+ 
+ static int nfcmrvl_resume(struct usb_interface *intf)
diff --git a/0037-ipv6-Fix-signed-integer-overflow-in-__ip6_append_dat.patch b/0037-ipv6-Fix-signed-integer-overflow-in-__ip6_append_dat.patch
new file mode 100644
index 000000000000..1e7a975d7ec6
--- /dev/null
+++ b/0037-ipv6-Fix-signed-integer-overflow-in-__ip6_append_dat.patch
@@ -0,0 +1,109 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Wang Yufen <wangyufen@huawei.com>
+Date: Tue, 7 Jun 2022 20:00:27 +0800
+Subject: [PATCH] ipv6: Fix signed integer overflow in __ip6_append_data
+
+[ Upstream commit f93431c86b631bbca5614c66f966bf3ddb3c2803 ]
+
+Resurrect ubsan overflow checks and ubsan report this warning,
+fix it by change the variable [length] type to size_t.
+
+UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19
+2147479552 + 8567 cannot be represented in type 'int'
+CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1
+Hardware name: linux,dummy-virt (DT)
+Call trace:
+  dump_backtrace+0x214/0x230
+  show_stack+0x30/0x78
+  dump_stack_lvl+0xf8/0x118
+  dump_stack+0x18/0x30
+  ubsan_epilogue+0x18/0x60
+  handle_overflow+0xd0/0xf0
+  __ubsan_handle_add_overflow+0x34/0x44
+  __ip6_append_data.isra.48+0x1598/0x1688
+  ip6_append_data+0x128/0x260
+  udpv6_sendmsg+0x680/0xdd0
+  inet6_sendmsg+0x54/0x90
+  sock_sendmsg+0x70/0x88
+  ____sys_sendmsg+0xe8/0x368
+  ___sys_sendmsg+0x98/0xe0
+  __sys_sendmmsg+0xf4/0x3b8
+  __arm64_sys_sendmmsg+0x34/0x48
+  invoke_syscall+0x64/0x160
+  el0_svc_common.constprop.4+0x124/0x300
+  do_el0_svc+0x44/0xc8
+  el0_svc+0x3c/0x1e8
+  el0t_64_sync_handler+0x88/0xb0
+  el0t_64_sync+0x16c/0x170
+
+Changes since v1:
+-Change the variable [length] type to unsigned, as Eric Dumazet suggested.
+Changes since v2:
+-Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested.
+Changes since v3:
+-Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as
+Jakub Kicinski suggested.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Link: https://lore.kernel.org/r/20220607120028.845916-1-wangyufen@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ipv6.h    | 4 ++--
+ net/ipv6/ip6_output.c | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 213612f1680c7c39f4c07f0c05b4e6cf34a7878e..023435ce16062a5885e8e61ccf9612375f6e9ac3 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -1019,7 +1019,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr);
+ int ip6_append_data(struct sock *sk,
+ 		    int getfrag(void *from, char *to, int offset, int len,
+ 				int odd, struct sk_buff *skb),
+-		    void *from, int length, int transhdrlen,
++		    void *from, size_t length, int transhdrlen,
+ 		    struct ipcm6_cookie *ipc6, struct flowi6 *fl6,
+ 		    struct rt6_info *rt, unsigned int flags);
+ 
+@@ -1035,7 +1035,7 @@ struct sk_buff *__ip6_make_skb(struct sock *sk, struct sk_buff_head *queue,
+ struct sk_buff *ip6_make_skb(struct sock *sk,
+ 			     int getfrag(void *from, char *to, int offset,
+ 					 int len, int odd, struct sk_buff *skb),
+-			     void *from, int length, int transhdrlen,
++			     void *from, size_t length, int transhdrlen,
+ 			     struct ipcm6_cookie *ipc6,
+ 			     struct rt6_info *rt, unsigned int flags,
+ 			     struct inet_cork_full *cork);
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index fa63ef2bd99cca97aff455d4b39d267f69365b35..87067e0ddaa39ceebadc36a03bb1a803cb030094 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1428,7 +1428,7 @@ static int __ip6_append_data(struct sock *sk,
+ 			     struct page_frag *pfrag,
+ 			     int getfrag(void *from, char *to, int offset,
+ 					 int len, int odd, struct sk_buff *skb),
+-			     void *from, int length, int transhdrlen,
++			     void *from, size_t length, int transhdrlen,
+ 			     unsigned int flags, struct ipcm6_cookie *ipc6)
+ {
+ 	struct sk_buff *skb, *skb_prev = NULL;
+@@ -1776,7 +1776,7 @@ static int __ip6_append_data(struct sock *sk,
+ int ip6_append_data(struct sock *sk,
+ 		    int getfrag(void *from, char *to, int offset, int len,
+ 				int odd, struct sk_buff *skb),
+-		    void *from, int length, int transhdrlen,
++		    void *from, size_t length, int transhdrlen,
+ 		    struct ipcm6_cookie *ipc6, struct flowi6 *fl6,
+ 		    struct rt6_info *rt, unsigned int flags)
+ {
+@@ -1973,7 +1973,7 @@ EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
+ struct sk_buff *ip6_make_skb(struct sock *sk,
+ 			     int getfrag(void *from, char *to, int offset,
+ 					 int len, int odd, struct sk_buff *skb),
+-			     void *from, int length, int transhdrlen,
++			     void *from, size_t length, int transhdrlen,
+ 			     struct ipcm6_cookie *ipc6, struct rt6_info *rt,
+ 			     unsigned int flags, struct inet_cork_full *cork)
+ {
diff --git a/0038-ipv6-Fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch b/0038-ipv6-Fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch
new file mode 100644
index 000000000000..9b97d4a050b7
--- /dev/null
+++ b/0038-ipv6-Fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch
@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Wang Yufen <wangyufen@huawei.com>
+Date: Tue, 7 Jun 2022 20:00:28 +0800
+Subject: [PATCH] ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
+
+[ Upstream commit f638a84afef3dfe10554c51820c16e39a278c915 ]
+
+When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be
+overflow. To fix, we can follow what udpv6 does and subtract the
+transhdrlen from the max.
+
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Link: https://lore.kernel.org/r/20220607120028.845916-2-wangyufen@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/l2tp/l2tp_ip6.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index 96f975777438f7f03614dbfa0c1a978822b0687b..d54dbd01d86f1e949c9a564221849caeeca0bfd5 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -502,14 +502,15 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ 	struct ipcm6_cookie ipc6;
+ 	int addr_len = msg->msg_namelen;
+ 	int transhdrlen = 4; /* zero session-id */
+-	int ulen = len + transhdrlen;
++	int ulen;
+ 	int err;
+ 
+ 	/* Rough check on arithmetic overflow,
+ 	 * better check is made in ip6_append_data().
+ 	 */
+-	if (len > INT_MAX)
++	if (len > INT_MAX - transhdrlen)
+ 		return -EMSGSIZE;
++	ulen = len + transhdrlen;
+ 
+ 	/* Mirror BSD error message compatibility */
+ 	if (msg->msg_flags & MSG_OOB)
diff --git a/0039-net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch b/0039-net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch
new file mode 100644
index 000000000000..31fb68d414f1
--- /dev/null
+++ b/0039-net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch
@@ -0,0 +1,69 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Chen Lin <chen45464546@163.com>
+Date: Wed, 8 Jun 2022 20:46:53 +0800
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface
+ netdev[napi]_alloc_frag
+
+[ Upstream commit 2f2c0d2919a14002760f89f4e02960c735a316d2 ]
+
+When rx_flag == MTK_RX_FLAGS_HWLRO,
+rx_data_len = MTK_MAX_LRO_RX_LENGTH(4096 * 3) > PAGE_SIZE.
+netdev_alloc_frag is for alloction of page fragment only.
+Reference to other drivers and Documentation/vm/page_frags.rst
+
+Branch to use __get_free_pages when ring->frag_size > PAGE_SIZE.
+
+Signed-off-by: Chen Lin <chen45464546@163.com>
+Link: https://lore.kernel.org/r/1654692413-2598-1-git-send-email-chen45464546@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index a50090e62c8f970bdb20b29fc57ac36e9273f6b1..c075670bc5625bf4b71684c5f8e1adc0c594c173 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -778,6 +778,17 @@ static inline bool mtk_rx_get_desc(struct mtk_rx_dma *rxd,
+ 	return true;
+ }
+ 
++static void *mtk_max_lro_buf_alloc(gfp_t gfp_mask)
++{
++	unsigned int size = mtk_max_frag_size(MTK_MAX_LRO_RX_LENGTH);
++	unsigned long data;
++
++	data = __get_free_pages(gfp_mask | __GFP_COMP | __GFP_NOWARN,
++				get_order(size));
++
++	return (void *)data;
++}
++
+ /* the qdma core needs scratch memory to be setup */
+ static int mtk_init_fq_dma(struct mtk_eth *eth)
+ {
+@@ -1269,7 +1280,10 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
+ 			goto release_desc;
+ 
+ 		/* alloc new buffer */
+-		new_data = napi_alloc_frag(ring->frag_size);
++		if (ring->frag_size <= PAGE_SIZE)
++			new_data = napi_alloc_frag(ring->frag_size);
++		else
++			new_data = mtk_max_lro_buf_alloc(GFP_ATOMIC);
+ 		if (unlikely(!new_data)) {
+ 			netdev->stats.rx_dropped++;
+ 			goto release_desc;
+@@ -1683,7 +1697,10 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag)
+ 		return -ENOMEM;
+ 
+ 	for (i = 0; i < rx_dma_size; i++) {
+-		ring->data[i] = netdev_alloc_frag(ring->frag_size);
++		if (ring->frag_size <= PAGE_SIZE)
++			ring->data[i] = netdev_alloc_frag(ring->frag_size);
++		else
++			ring->data[i] = mtk_max_lro_buf_alloc(GFP_KERNEL);
+ 		if (!ring->data[i])
+ 			return -ENOMEM;
+ 	}
diff --git a/0040-gcc-12-disable-Wdangling-pointer-warning-for-now.patch b/0040-gcc-12-disable-Wdangling-pointer-warning-for-now.patch
new file mode 100644
index 000000000000..acfb87a1eabe
--- /dev/null
+++ b/0040-gcc-12-disable-Wdangling-pointer-warning-for-now.patch
@@ -0,0 +1,64 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 9 Jun 2022 09:41:42 -0700
+Subject: [PATCH] gcc-12: disable '-Wdangling-pointer' warning for now
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 49beadbd47c270a00754c107a837b4f29df4c822 ]
+
+While the concept of checking for dangling pointers to local variables
+at function exit is really interesting, the gcc-12 implementation is not
+compatible with reality, and results in false positives.
+
+For example, gcc sees us putting things on a local list head allocated
+on the stack, which involves exactly those kinds of pointers to the
+local stack entry:
+
+  In function ‘__list_add’,
+      inlined from ‘list_add_tail’ at include/linux/list.h:102:2,
+      inlined from ‘rebuild_snap_realms’ at fs/ceph/snap.c:434:2:
+  include/linux/list.h:74:19: warning: storing the address of local variable ‘realm_queue’ in ‘*&realm_27(D)->rebuild_item.prev’ [-Wdangling-pointer=]
+     74 |         new->prev = prev;
+        |         ~~~~~~~~~~^~~~~~
+
+But then gcc - understandably - doesn't really understand the big
+picture how the doubly linked list works, so doesn't see how we then end
+up emptying said list head in a loop and the pointer we added has been
+removed.
+
+Gcc also complains about us (intentionally) using this as a way to store
+a kind of fake stack trace, eg
+
+  drivers/acpi/acpica/utdebug.c:40:38: warning: storing the address of local variable ‘current_sp’ in ‘acpi_gbl_entry_stack_pointer’ [-Wdangling-pointer=]
+     40 |         acpi_gbl_entry_stack_pointer = &current_sp;
+        |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~
+
+which is entirely reasonable from a compiler standpoint, and we may want
+to change those kinds of patterns, but not not.
+
+So this is one of those "it would be lovely if the compiler were to
+complain about us leaving dangling pointers to the stack", but not this
+way.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Makefile b/Makefile
+index 34bfb76d633325600560f15b3ad9b237e3bd31bf..476cbe751b175df24795eb7ae23bc0cac2e80a46 100644
+--- a/Makefile
++++ b/Makefile
+@@ -804,6 +804,9 @@ endif
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
+ 
++# These result in bogus false positives
++KBUILD_CFLAGS += $(call cc-disable-warning, dangling-pointer)
++
+ ifdef CONFIG_FRAME_POINTER
+ KBUILD_CFLAGS	+= -fno-omit-frame-pointer -fno-optimize-sibling-calls
+ else
diff --git a/0041-mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch b/0041-mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch
new file mode 100644
index 000000000000..ca28360e17cf
--- /dev/null
+++ b/0041-mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch
@@ -0,0 +1,48 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 9 Jun 2022 10:03:28 -0700
+Subject: [PATCH] mellanox: mlx5: avoid uninitialized variable warning with
+ gcc-12
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 842c3b3ddc5f4d17275edbaa09e23d712bf8b915 ]
+
+gcc-12 started warning about 'tracker' being used uninitialized:
+
+  drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c: In function ‘mlx5_do_bond’:
+  drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c:786:28: warning: ‘tracker’ is used uninitialized [-Wuninitialized]
+    786 |         struct lag_tracker tracker;
+        |                            ^~~~~~~
+
+which seems to be because it doesn't track how the use (and
+initialization) is bound by the 'do_bond' flag.
+
+But admittedly that 'do_bond' usage is fairly complicated, and involves
+passing it around as an argument to helper functions, so it's somewhat
+understandable that gcc doesn't see how that all works.
+
+This function could be rewritten to make the use of that tracker
+variable more obviously safe, but for now I'm just adding the forced
+initialization of it.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
+index a8b98242edb16b55980c04ad88a34bd87af559a9..a1e9d305153329c7a7e71c50e3a9e4b339f3bd6b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
+@@ -561,7 +561,7 @@ static void mlx5_do_bond(struct mlx5_lag *ldev)
+ {
+ 	struct mlx5_core_dev *dev0 = ldev->pf[MLX5_LAG_P1].dev;
+ 	struct mlx5_core_dev *dev1 = ldev->pf[MLX5_LAG_P2].dev;
+-	struct lag_tracker tracker;
++	struct lag_tracker tracker = { };
+ 	bool do_bond, roce_lag;
+ 	int err;
+ 
diff --git a/0042-gcc-12-disable-Warray-bounds-universally-for-now.patch b/0042-gcc-12-disable-Warray-bounds-universally-for-now.patch
new file mode 100644
index 000000000000..e36e64029e76
--- /dev/null
+++ b/0042-gcc-12-disable-Warray-bounds-universally-for-now.patch
@@ -0,0 +1,115 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 9 Jun 2022 10:11:12 -0700
+Subject: [PATCH] gcc-12: disable '-Warray-bounds' universally for now
+
+[ Upstream commit f0be87c42cbd341d436d06da4792e6b0c83c3aeb ]
+
+In commit 8b202ee21839 ("s390: disable -Warray-bounds") the s390 people
+disabled the '-Warray-bounds' warning for gcc-12, because the new logic
+in gcc would cause warnings for their use of the S390_lowcore macro,
+which accesses absolute pointers.
+
+It turns out gcc-12 has many other issues in this area, so this takes
+that s390 warning disable logic, and turns it into a kernel build config
+entry instead.
+
+Part of the intent is that we can make this all much more targeted, and
+use this conflig flag to disable it in only particular configurations
+that cause problems, with the s390 case as an example:
+
+        select GCC12_NO_ARRAY_BOUNDS
+
+and we could do that for other configuration cases that cause issues.
+
+Or we could possibly use the CONFIG_CC_NO_ARRAY_BOUNDS thing in a more
+targeted way, and disable the warning only for particular uses: again
+the s390 case as an example:
+
+  KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_CC_NO_ARRAY_BOUNDS),-Wno-array-bounds)
+
+but this ends up just doing it globally in the top-level Makefile, since
+the current issues are spread fairly widely all over:
+
+  KBUILD_CFLAGS-$(CONFIG_CC_NO_ARRAY_BOUNDS) += -Wno-array-bounds
+
+We'll try to limit this later, since the gcc-12 problems are rare enough
+that *much* of the kernel can be built with it without disabling this
+warning.
+
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile           |  1 +
+ arch/s390/Kconfig  |  1 +
+ arch/s390/Makefile | 10 +---------
+ init/Kconfig       |  9 +++++++++
+ 4 files changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 476cbe751b175df24795eb7ae23bc0cac2e80a46..d19e3b425bd68656015fcafb0ff008e3e3491578 100644
+--- a/Makefile
++++ b/Makefile
+@@ -787,6 +787,7 @@ stackp-flags-$(CONFIG_STACKPROTECTOR_STRONG)      := -fstack-protector-strong
+ KBUILD_CFLAGS += $(stackp-flags-y)
+ 
+ KBUILD_CFLAGS-$(CONFIG_WERROR) += -Werror
++KBUILD_CFLAGS-$(CONFIG_CC_NO_ARRAY_BOUNDS) += -Wno-array-bounds
+ KBUILD_CFLAGS += $(KBUILD_CFLAGS-y) $(CONFIG_CC_IMPLICIT_FALLTHROUGH)
+ 
+ ifdef CONFIG_CC_IS_CLANG
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index e084c72104f86f55dad91577800b8952366494c2..359b0cc0dc35d935a79b68ff520dbebf882b7734 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -125,6 +125,7 @@ config S390
+ 	select CLONE_BACKWARDS2
+ 	select DMA_OPS if PCI
+ 	select DYNAMIC_FTRACE if FUNCTION_TRACER
++	select GCC12_NO_ARRAY_BOUNDS
+ 	select GENERIC_ALLOCATOR
+ 	select GENERIC_CPU_AUTOPROBE
+ 	select GENERIC_CPU_VULNERABILITIES
+diff --git a/arch/s390/Makefile b/arch/s390/Makefile
+index df325eacf62d261b8b0f97711120cf4ae7acc73f..eba70d585cb2c09381ffbd9ff28b0884dc00c92c 100644
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -30,15 +30,7 @@ KBUILD_CFLAGS_DECOMPRESSOR += -fno-stack-protector
+ KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, address-of-packed-member)
+ KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),-g)
+ KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO_DWARF4), $(call cc-option, -gdwarf-4,))
+-
+-ifdef CONFIG_CC_IS_GCC
+-	ifeq ($(call cc-ifversion, -ge, 1200, y), y)
+-		ifeq ($(call cc-ifversion, -lt, 1300, y), y)
+-			KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds)
+-			KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, array-bounds)
+-		endif
+-	endif
+-endif
++KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_CC_NO_ARRAY_BOUNDS),-Wno-array-bounds)
+ 
+ UTS_MACHINE	:= s390x
+ STACK_SIZE	:= $(if $(CONFIG_KASAN),65536,16384)
+diff --git a/init/Kconfig b/init/Kconfig
+index b19e2eeaae80370702bbf24f789ab664d8886bcb..fa63cc019ebfce73729fa5f970dd1b01fe6b1f3a 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -899,6 +899,15 @@ config CC_IMPLICIT_FALLTHROUGH
+ 	default "-Wimplicit-fallthrough=5" if CC_IS_GCC && $(cc-option,-Wimplicit-fallthrough=5)
+ 	default "-Wimplicit-fallthrough" if CC_IS_CLANG && $(cc-option,-Wunreachable-code-fallthrough)
+ 
++# Currently, disable gcc-12 array-bounds globally.
++# We may want to target only particular configurations some day.
++config GCC12_NO_ARRAY_BOUNDS
++	def_bool y
++
++config CC_NO_ARRAY_BOUNDS
++	bool
++	default y if CC_IS_GCC && GCC_VERSION >= 120000 && GCC_VERSION < 130000 && GCC12_NO_ARRAY_BOUNDS
++
+ #
+ # For architectures that know their GCC __int128 support is sound
+ #
diff --git a/0043-netfs-gcc-12-temporarily-disable-Wattribute-warning-.patch b/0043-netfs-gcc-12-temporarily-disable-Wattribute-warning-.patch
new file mode 100644
index 000000000000..d577472d1bba
--- /dev/null
+++ b/0043-netfs-gcc-12-temporarily-disable-Wattribute-warning-.patch
@@ -0,0 +1,106 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 9 Jun 2022 11:29:36 -0700
+Subject: [PATCH] netfs: gcc-12: temporarily disable '-Wattribute-warning' for
+ now
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 507160f46c55913955d272ebf559d63809a8e560 ]
+
+This is a pure band-aid so that I can continue merging stuff from people
+while some of the gcc-12 fallout gets sorted out.
+
+In particular, gcc-12 is very unhappy about the kinds of pointer
+arithmetic tricks that netfs does, and that makes the fortify checks
+trigger in afs and ceph:
+
+  In function ‘fortify_memset_chk’,
+      inlined from ‘netfs_i_context_init’ at include/linux/netfs.h:327:2,
+      inlined from ‘afs_set_netfs_context’ at fs/afs/inode.c:61:2,
+      inlined from ‘afs_root_iget’ at fs/afs/inode.c:543:2:
+  include/linux/fortify-string.h:258:25: warning: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
+    258 |                         __write_overflow_field(p_size_field, size);
+        |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+and the reason is that netfs_i_context_init() is passed a 'struct inode'
+pointer, and then it does
+
+        struct netfs_i_context *ctx = netfs_i_context(inode);
+
+        memset(ctx, 0, sizeof(*ctx));
+
+where that netfs_i_context() function just does pointer arithmetic on
+the inode pointer, knowing that the netfs_i_context is laid out
+immediately after it in memory.
+
+This is all truly disgusting, since the whole "netfs_i_context is laid
+out immediately after it in memory" is not actually remotely true in
+general, but is just made to be that way for afs and ceph.
+
+See for example fs/cifs/cifsglob.h:
+
+  struct cifsInodeInfo {
+        struct {
+                /* These must be contiguous */
+                struct inode    vfs_inode;      /* the VFS's inode record */
+                struct netfs_i_context netfs_ctx; /* Netfslib context */
+        };
+	[...]
+
+and realize that this is all entirely wrong, and the pointer arithmetic
+that netfs_i_context() is doing is also very very wrong and wouldn't
+give the right answer if netfs_ctx had different alignment rules from a
+'struct inode', for example).
+
+Anyway, that's just a long-winded way to say "the gcc-12 warning is
+actually quite reasonable, and our code happens to work but is pretty
+disgusting".
+
+This is getting fixed properly, but for now I made the mistake of
+thinking "the week right after the merge window tends to be calm for me
+as people take a breather" and I did a sustem upgrade.  And I got gcc-12
+as a result, so to continue merging fixes from people and not have the
+end result drown in warnings, I am fixing all these gcc-12 issues I hit.
+
+Including with these kinds of temporary fixes.
+
+Cc: Kees Cook <keescook@chromium.org>
+Cc: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/all/AEEBCF5D-8402-441D-940B-105AA718C71F@chromium.org/
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/inode.c  | 3 +++
+ fs/ceph/inode.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 30b066299d39f70a450539823dbe75602427e81a..65b439cd53d29c78701fa62f98433f5058907166 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -25,6 +25,9 @@
+ #include "internal.h"
+ #include "afs_fs.h"
+ 
++// Temporary: netfs does disgusting things with inode pointers
++#pragma GCC diagnostic ignored "-Wattribute-warning"
++
+ static const struct inode_operations afs_symlink_inode_operations = {
+ 	.get_link	= page_get_link,
+ };
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 63113e2a4890763e255048c31a0b228cdba13a22..83739dae52687d94837d2e0babb5c7852d31686f 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -20,6 +20,9 @@
+ #include "cache.h"
+ #include <linux/ceph/decode.h>
+ 
++// Temporary: netfs does disgusting things with inode pointers
++#pragma GCC diagnostic ignored "-Wattribute-warning"
++
+ /*
+  * Ceph inode operations
+  *
diff --git a/0044-MIPS-Loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch b/0044-MIPS-Loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch
new file mode 100644
index 000000000000..bb416e96c23f
--- /dev/null
+++ b/0044-MIPS-Loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch
@@ -0,0 +1,51 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Yupeng Li <liyupeng@zbhlos.com>
+Date: Wed, 8 Jun 2022 09:12:29 +0800
+Subject: [PATCH] MIPS: Loongson-3: fix compile mips cpu_hwmon as module build
+ error.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 41e456400212803704e82691716e1d7b0865114a ]
+
+  set cpu_hwmon as a module build with loongson_sysconf, loongson_chiptemp
+  undefined error,fix cpu_hwmon compile options to be bool.Some kernel
+  compilation error information is as follows:
+
+  Checking missing-syscalls for N32
+  CALL    scripts/checksyscalls.sh
+  Checking missing-syscalls for O32
+  CALL    scripts/checksyscalls.sh
+  CALL    scripts/checksyscalls.sh
+  CHK     include/generated/compile.h
+  CC [M]  drivers/platform/mips/cpu_hwmon.o
+  Building modules, stage 2.
+  MODPOST 200 modules
+ERROR: "loongson_sysconf" [drivers/platform/mips/cpu_hwmon.ko] undefined!
+ERROR: "loongson_chiptemp" [drivers/platform/mips/cpu_hwmon.ko] undefined!
+make[1]: *** [scripts/Makefile.modpost:92：__modpost] 错误 1
+make: *** [Makefile:1261：modules] 错误 2
+
+Signed-off-by: Yupeng Li <liyupeng@zbhlos.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Huacai Chen <chenhuacai@kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mips/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/mips/Kconfig b/drivers/platform/mips/Kconfig
+index d421e148239579182230c03ac1447588e47b8fd9..6b51ad01f79151dc2b15e8f287283e93b361f9da 100644
+--- a/drivers/platform/mips/Kconfig
++++ b/drivers/platform/mips/Kconfig
+@@ -17,7 +17,7 @@ menuconfig MIPS_PLATFORM_DEVICES
+ if MIPS_PLATFORM_DEVICES
+ 
+ config CPU_HWMON
+-	tristate "Loongson-3 CPU HWMon Driver"
++	bool "Loongson-3 CPU HWMon Driver"
+ 	depends on MACH_LOONGSON64
+ 	select HWMON
+ 	default y
diff --git a/0045-random-credit-cpu-and-bootloader-seeds-by-default.patch b/0045-random-credit-cpu-and-bootloader-seeds-by-default.patch
new file mode 100644
index 000000000000..ca384a8c9535
--- /dev/null
+++ b/0045-random-credit-cpu-and-bootloader-seeds-by-default.patch
@@ -0,0 +1,195 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Sun, 5 Jun 2022 18:30:46 +0200
+Subject: [PATCH] random: credit cpu and bootloader seeds by default
+
+[ Upstream commit 846bb97e131d7938847963cca00657c995b1fce1 ]
+
+This commit changes the default Kconfig values of RANDOM_TRUST_CPU and
+RANDOM_TRUST_BOOTLOADER to be Y by default. It does not change any
+existing configs or change any kernel behavior. The reason for this is
+several fold.
+
+As background, I recently had an email thread with the kernel
+maintainers of Fedora/RHEL, Debian, Ubuntu, Gentoo, Arch, NixOS, Alpine,
+SUSE, and Void as recipients. I noted that some distros trust RDRAND,
+some trust EFI, and some trust both, and I asked why or why not. There
+wasn't really much of a "debate" but rather an interesting discussion of
+what the historical reasons have been for this, and it came up that some
+distros just missed the introduction of the bootloader Kconfig knob,
+while another didn't want to enable it until there was a boot time
+switch to turn it off for more concerned users (which has since been
+added). The result of the rather uneventful discussion is that every
+major Linux distro enables these two options by default.
+
+While I didn't have really too strong of an opinion going into this
+thread -- and I mostly wanted to learn what the distros' thinking was
+one way or another -- ultimately I think their choice was a decent
+enough one for a default option (which can be disabled at boot time).
+I'll try to summarize the pros and cons:
+
+Pros:
+
+- The RNG machinery gets initialized super quickly, and there's no
+  messing around with subsequent blocking behavior.
+
+- The bootloader mechanism is used by kexec in order for the prior
+  kernel to initialize the RNG of the next kernel, which increases
+  the entropy available to early boot daemons of the next kernel.
+
+- Previous objections related to backdoors centered around
+  Dual_EC_DRBG-like kleptographic systems, in which observing some
+  amount of the output stream enables an adversary holding the right key
+  to determine the entire output stream.
+
+  This used to be a partially justified concern, because RDRAND output
+  was mixed into the output stream in varying ways, some of which may
+  have lacked pre-image resistance (e.g. XOR or an LFSR).
+
+  But this is no longer the case. Now, all usage of RDRAND and
+  bootloader seeds go through a cryptographic hash function. This means
+  that the CPU would have to compute a hash pre-image, which is not
+  considered to be feasible (otherwise the hash function would be
+  terribly broken).
+
+- More generally, if the CPU is backdoored, the RNG is probably not the
+  realistic vector of choice for an attacker.
+
+- These CPU or bootloader seeds are far from being the only source of
+  entropy. Rather, there is generally a pretty huge amount of entropy,
+  not all of which is credited, especially on CPUs that support
+  instructions like RDRAND. In other words, assuming RDRAND outputs all
+  zeros, an attacker would *still* have to accurately model every single
+  other entropy source also in use.
+
+- The RNG now reseeds itself quite rapidly during boot, starting at 2
+  seconds, then 4, then 8, then 16, and so forth, so that other sources
+  of entropy get used without much delay.
+
+- Paranoid users can set random.trust_{cpu,bootloader}=no in the kernel
+  command line, and paranoid system builders can set the Kconfig options
+  to N, so there's no reduction or restriction of optionality.
+
+- It's a practical default.
+
+- All the distros have it set this way. Microsoft and Apple trust it
+  too. Bandwagon.
+
+Cons:
+
+- RDRAND *could* still be backdoored with something like a fixed key or
+  limited space serial number seed or another indexable scheme like
+  that. (However, it's hard to imagine threat models where the CPU is
+  backdoored like this, yet people are still okay making *any*
+  computations with it or connecting it to networks, etc.)
+
+- RDRAND *could* be defective, rather than backdoored, and produce
+  garbage that is in one way or another insufficient for crypto.
+
+- Suggesting a *reduction* in paranoia, as this commit effectively does,
+  may cause some to question my personal integrity as a "security
+  person".
+
+- Bootloader seeds and RDRAND are generally very difficult if not all
+  together impossible to audit.
+
+Keep in mind that this doesn't actually change any behavior. This
+is just a change in the default Kconfig value. The distros already are
+shipping kernels that set things this way.
+
+Ard made an additional argument in [1]:
+
+    We're at the mercy of firmware and micro-architecture anyway, given
+    that we are also relying on it to ensure that every instruction in
+    the kernel's executable image has been faithfully copied to memory,
+    and that the CPU implements those instructions as documented. So I
+    don't think firmware or ISA bugs related to RNGs deserve special
+    treatment - if they are broken, we should quirk around them like we
+    usually do. So enabling these by default is a step in the right
+    direction IMHO.
+
+In [2], Phil pointed out that having this disabled masked a bug that CI
+otherwise would have caught:
+
+    A clean 5.15.45 boots cleanly, whereas a downstream kernel shows the
+    static key warning (but it does go on to boot). The significant
+    difference is that our defconfigs set CONFIG_RANDOM_TRUST_BOOTLOADER=y
+    defining that on top of multi_v7_defconfig demonstrates the issue on
+    a clean 5.15.45. Conversely, not setting that option in a
+    downstream kernel build avoids the warning
+
+[1] https://lore.kernel.org/lkml/CAMj1kXGi+ieviFjXv9zQBSaGyyzeGW_VpMpTLJK8PJb2QHEQ-w@mail.gmail.com/
+[2] https://lore.kernel.org/lkml/c47c42e3-1d56-5859-a6ad-976a1a3381c6@raspberrypi.com/
+
+Cc: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/Kconfig | 50 +++++++++++++++++++++++++++-----------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index 55f48375e3fe5487d8ebb47a250b75dafa9ec61c..d454428f4981d1bb1e6af87f245a9644b8b5dbc3 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -428,28 +428,40 @@ config ADI
+ 	  driver include crash and makedumpfile.
+ 
+ config RANDOM_TRUST_CPU
+-	bool "Trust the CPU manufacturer to initialize Linux's CRNG"
++	bool "Initialize RNG using CPU RNG instructions"
++	default y
+ 	depends on ARCH_RANDOM
+-	default n
+ 	help
+-	Assume that CPU manufacturer (e.g., Intel or AMD for RDSEED or
+-	RDRAND, IBM for the S390 and Power PC architectures) is trustworthy
+-	for the purposes of initializing Linux's CRNG.  Since this is not
+-	something that can be independently audited, this amounts to trusting
+-	that CPU manufacturer (perhaps with the insistence or mandate
+-	of a Nation State's intelligence or law enforcement agencies)
+-	has not installed a hidden back door to compromise the CPU's
+-	random number generation facilities. This can also be configured
+-	at boot with "random.trust_cpu=on/off".
++	  Initialize the RNG using random numbers supplied by the CPU's
++	  RNG instructions (e.g. RDRAND), if supported and available. These
++	  random numbers are never used directly, but are rather hashed into
++	  the main input pool, and this happens regardless of whether or not
++	  this option is enabled. Instead, this option controls whether the
++	  they are credited and hence can initialize the RNG. Additionally,
++	  other sources of randomness are always used, regardless of this
++	  setting.  Enabling this implies trusting that the CPU can supply high
++	  quality and non-backdoored random numbers.
++
++	  Say Y here unless you have reason to mistrust your CPU or believe
++	  its RNG facilities may be faulty. This may also be configured at
++	  boot time with "random.trust_cpu=on/off".
+ 
+ config RANDOM_TRUST_BOOTLOADER
+-	bool "Trust the bootloader to initialize Linux's CRNG"
+-	help
+-	Some bootloaders can provide entropy to increase the kernel's initial
+-	device randomness. Say Y here to assume the entropy provided by the
+-	booloader is trustworthy so it will be added to the kernel's entropy
+-	pool. Otherwise, say N here so it will be regarded as device input that
+-	only mixes the entropy pool. This can also be configured at boot with
+-	"random.trust_bootloader=on/off".
++	bool "Initialize RNG using bootloader-supplied seed"
++	default y
++	help
++	  Initialize the RNG using a seed supplied by the bootloader or boot
++	  environment (e.g. EFI or a bootloader-generated device tree). This
++	  seed is not used directly, but is rather hashed into the main input
++	  pool, and this happens regardless of whether or not this option is
++	  enabled. Instead, this option controls whether the seed is credited
++	  and hence can initialize the RNG. Additionally, other sources of
++	  randomness are always used, regardless of this setting. Enabling
++	  this implies trusting that the bootloader can supply high quality and
++	  non-backdoored seeds.
++
++	  Say Y here unless you have reason to mistrust your bootloader or
++	  believe its RNG facilities may be faulty. This may also be configured
++	  at boot time with "random.trust_bootloader=on/off".
+ 
+ endmenu
diff --git a/0046-gpio-dwapb-Don-t-print-error-on-EPROBE_DEFER.patch b/0046-gpio-dwapb-Don-t-print-error-on-EPROBE_DEFER.patch
new file mode 100644
index 000000000000..22678becb0a5
--- /dev/null
+++ b/0046-gpio-dwapb-Don-t-print-error-on-EPROBE_DEFER.patch
@@ -0,0 +1,42 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Date: Fri, 10 Jun 2022 13:45:00 +0300
+Subject: [PATCH] gpio: dwapb: Don't print error on -EPROBE_DEFER
+
+[ Upstream commit 77006f6edc0e0f58617eb25e53731f78641e820d ]
+
+Currently if the APB or Debounce clocks aren't yet ready to be requested
+the DW GPIO driver will correctly handle that by deferring the probe
+procedure, but the error is still printed to the system log. It needlessly
+pollutes the log since there was no real error but a request to postpone
+the clock request procedure since the clocks subsystem hasn't been fully
+initialized yet. Let's fix that by using the dev_err_probe method to print
+the APB/clock request error status. It will correctly handle the deferred
+probe situation and print the error if it actually happens.
+
+Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-dwapb.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c
+index b0f3aca61974c1d16708ebd64c43d052faaddf44..9467d695a33e220f585434011fad963896caa44a 100644
+--- a/drivers/gpio/gpio-dwapb.c
++++ b/drivers/gpio/gpio-dwapb.c
+@@ -652,10 +652,9 @@ static int dwapb_get_clks(struct dwapb_gpio *gpio)
+ 	gpio->clks[1].id = "db";
+ 	err = devm_clk_bulk_get_optional(gpio->dev, DWAPB_NR_CLOCKS,
+ 					 gpio->clks);
+-	if (err) {
+-		dev_err(gpio->dev, "Cannot get APB/Debounce clocks\n");
+-		return err;
+-	}
++	if (err)
++		return dev_err_probe(gpio->dev, err,
++				     "Cannot get APB/Debounce clocks\n");
+ 
+ 	err = clk_bulk_prepare_enable(DWAPB_NR_CLOCKS, gpio->clks);
+ 	if (err) {
diff --git a/0047-platform-x86-intel-Fix-pmt_crashlog-array-reference.patch b/0047-platform-x86-intel-Fix-pmt_crashlog-array-reference.patch
new file mode 100644
index 000000000000..0052fcd02386
--- /dev/null
+++ b/0047-platform-x86-intel-Fix-pmt_crashlog-array-reference.patch
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: David Arcari <darcari@redhat.com>
+Date: Thu, 26 May 2022 16:31:40 -0400
+Subject: [PATCH] platform/x86/intel: Fix pmt_crashlog array reference
+
+[ Upstream commit 66cb3a2d7ad0d0e9af4d3430a4f2a32ffb9ac098 ]
+
+The probe function pmt_crashlog_probe() may incorrectly reference
+the 'priv->entry array' as it uses 'i' to reference the array instead
+of 'priv->num_entries' as it should.  This is similar to the problem
+that was addressed in pmt_telemetry_probe via commit 2cdfa0c20d58
+("platform/x86/intel: Fix 'rmmod pmt_telemetry' panic").
+
+Cc: "David E. Box" <david.e.box@linux.intel.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Mark Gross <markgross@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: David Arcari <darcari@redhat.com>
+Reviewed-by: David E. Box <david.e.box@linux.intel.com>
+Link: https://lore.kernel.org/r/20220526203140.339120-1-darcari@redhat.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/pmt/crashlog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/pmt/crashlog.c b/drivers/platform/x86/intel/pmt/crashlog.c
+index 34daf9df168b11c3b0aeee100ba5a749cbd56a35..ace1239bc0a0bfd5e091d91f500c4f46c82503ce 100644
+--- a/drivers/platform/x86/intel/pmt/crashlog.c
++++ b/drivers/platform/x86/intel/pmt/crashlog.c
+@@ -282,7 +282,7 @@ static int pmt_crashlog_probe(struct auxiliary_device *auxdev,
+ 	auxiliary_set_drvdata(auxdev, priv);
+ 
+ 	for (i = 0; i < intel_vsec_dev->num_resources; i++) {
+-		struct intel_pmt_entry *entry = &priv->entry[i].entry;
++		struct intel_pmt_entry *entry = &priv->entry[priv->num_entries].entry;
+ 
+ 		ret = intel_pmt_dev_create(entry, &pmt_crashlog_ns, intel_vsec_dev, i);
+ 		if (ret < 0)
diff --git a/0048-platform-x86-intel-pmc-Support-Intel-Raptorlake-P.patch b/0048-platform-x86-intel-pmc-Support-Intel-Raptorlake-P.patch
new file mode 100644
index 000000000000..dd6e3340cfe5
--- /dev/null
+++ b/0048-platform-x86-intel-pmc-Support-Intel-Raptorlake-P.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: George D Sworo <george.d.sworo@intel.com>
+Date: Wed, 1 Jun 2022 18:26:17 -0700
+Subject: [PATCH] platform/x86/intel: pmc: Support Intel Raptorlake P
+
+[ Upstream commit 552f3b801de6eb062b225a76e140995483a0609c ]
+
+Add Raptorlake P to the list of the platforms that intel_pmc_core driver
+supports for pmc_core device. Raptorlake P PCH is based on Alderlake P
+PCH.
+
+Signed-off-by: George D Sworo <george.d.sworo@intel.com>
+Reviewed-by: David E. Box <david.e.box@linux.intel.com>
+Link: https://lore.kernel.org/r/20220602012617.20100-1-george.d.sworo@intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/pmc/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/intel/pmc/core.c b/drivers/platform/x86/intel/pmc/core.c
+index ac19fcc9abbf5721844122ed1b5fb3607ac0aeed..8ee15a7252c717bd6b0dbc9eb2daaa918ff81b0a 100644
+--- a/drivers/platform/x86/intel/pmc/core.c
++++ b/drivers/platform/x86/intel/pmc/core.c
+@@ -1912,6 +1912,7 @@ static const struct x86_cpu_id intel_pmc_core_ids[] = {
+ 	X86_MATCH_INTEL_FAM6_MODEL(ROCKETLAKE,		&tgl_reg_map),
+ 	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L,		&tgl_reg_map),
+ 	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE,		&adl_reg_map),
++	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P,        &tgl_reg_map),
+ 	{}
+ };
+ 
diff --git a/0049-platform-x86-gigabyte-wmi-Add-Z690M-AORUS-ELITE-AX-D.patch b/0049-platform-x86-gigabyte-wmi-Add-Z690M-AORUS-ELITE-AX-D.patch
new file mode 100644
index 000000000000..79cafdf7335a
--- /dev/null
+++ b/0049-platform-x86-gigabyte-wmi-Add-Z690M-AORUS-ELITE-AX-D.patch
@@ -0,0 +1,31 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Piotr Chmura <chmooreck@gmail.com>
+Date: Mon, 6 Jun 2022 19:15:13 +0200
+Subject: [PATCH] platform/x86: gigabyte-wmi: Add Z690M AORUS ELITE AX DDR4
+ support
+
+[ Upstream commit 8a041afe3e774bedd3e0a9b96f65e48a1299a595 ]
+
+Add dmi_system_id of Gigabyte Z690M AORUS ELITE AX DDR4 board.
+Tested on my PC.
+
+Signed-off-by: Piotr Chmura <chmooreck@gmail.com>
+Link: https://lore.kernel.org/r/bd83567e-ebf5-0b31-074b-5f6dc7f7c147@gmail.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/gigabyte-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c
+index e87a931eab1e72c1c864fd0edf038eb03077e8bd..05588a47ac3845c7dd39f97c236957f205a42670 100644
+--- a/drivers/platform/x86/gigabyte-wmi.c
++++ b/drivers/platform/x86/gigabyte-wmi.c
+@@ -154,6 +154,7 @@ static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = {
+ 	DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 GAMING X"),
+ 	DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 I AORUS PRO WIFI"),
+ 	DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 UD"),
++	DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("Z690M AORUS ELITE AX DDR4"),
+ 	{ }
+ };
+ 
diff --git a/0050-platform-x86-gigabyte-wmi-Add-support-for-B450M-DS3H.patch b/0050-platform-x86-gigabyte-wmi-Add-support-for-B450M-DS3H.patch
new file mode 100644
index 000000000000..b36d9f12bb19
--- /dev/null
+++ b/0050-platform-x86-gigabyte-wmi-Add-support-for-B450M-DS3H.patch
@@ -0,0 +1,29 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: August Wikerfors <git@augustwikerfors.se>
+Date: Wed, 8 Jun 2022 23:20:28 +0200
+Subject: [PATCH] platform/x86: gigabyte-wmi: Add support for B450M DS3H-CF
+
+[ Upstream commit c6bc7e8ee90845556a90faf8b043cbefd77b8903 ]
+
+Tested and works on my system.
+
+Signed-off-by: August Wikerfors <git@augustwikerfors.se>
+Link: https://lore.kernel.org/r/20220608212028.28307-1-git@augustwikerfors.se
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/gigabyte-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c
+index 05588a47ac3845c7dd39f97c236957f205a42670..78446b1953f7ca993f33aaa542832e1f66da0d9c 100644
+--- a/drivers/platform/x86/gigabyte-wmi.c
++++ b/drivers/platform/x86/gigabyte-wmi.c
+@@ -140,6 +140,7 @@ static u8 gigabyte_wmi_detect_sensor_usability(struct wmi_device *wdev)
+ 	}}
+ 
+ static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = {
++	DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M DS3H-CF"),
+ 	DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M S2H V2"),
+ 	DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE AX V2"),
+ 	DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE"),
diff --git a/0051-platform-x86-intel-hid-Add-Surface-Go-to-VGBS-allow-.patch b/0051-platform-x86-intel-hid-Add-Surface-Go-to-VGBS-allow-.patch
new file mode 100644
index 000000000000..c9af0b9b7d00
--- /dev/null
+++ b/0051-platform-x86-intel-hid-Add-Surface-Go-to-VGBS-allow-.patch
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Duke Lee <krnhotwings@gmail.com>
+Date: Tue, 7 Jun 2022 14:36:54 -0700
+Subject: [PATCH] platform/x86/intel: hid: Add Surface Go to VGBS allow list
+
+[ Upstream commit d4fe9cc4ff8656704b58cfd9363d7c3c9d65e519 ]
+
+The Surface Go reports Chassis Type 9 (Laptop,) so the device needs to be
+added to dmi_vgbs_allow_list to enable tablet mode when an attached Type
+Cover is folded back.
+
+BugLink: https://github.com/linux-surface/linux-surface/issues/837
+Signed-off-by: Duke Lee <krnhotwings@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20220607213654.5567-1-krnhotwings@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index 216d31e3403dde4fb8ed842e4be09df6c1a8c8cc..79cff1fc675c2006ffedd35dfcf08b5cac5d1cdc 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -122,6 +122,12 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x360 Convertible 15-df0xxx"),
+ 		},
+ 	},
++	{
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go"),
++		},
++	},
+ 	{ }
+ };
+ 
diff --git a/0052-staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch b/0052-staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch
new file mode 100644
index 000000000000..622518cfdf59
--- /dev/null
+++ b/0052-staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch
@@ -0,0 +1,67 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Phillip Potter <phil@philpotter.co.uk>
+Date: Sat, 21 May 2022 21:47:41 +0100
+Subject: [PATCH] staging: r8188eu: fix rtw_alloc_hwxmits error detection for
+ now
+
+[ Upstream commit 5b7419ae1d208cab1e2826d473d8dab045aa75c7 ]
+
+In _rtw_init_xmit_priv, we use the res variable to store the error
+return from the newly converted rtw_alloc_hwxmits function. Sadly, the
+calling function interprets res using _SUCCESS and _FAIL still, meaning
+we change the semantics of the variable, even in the success case.
+
+This leads to the following on boot:
+r8188eu 1-2:1.0: _rtw_init_xmit_priv failed
+
+In the long term, we should reverse these semantics, but for now, this
+fixes the driver. Also, inside rtw_alloc_hwxmits remove the if blocks,
+as HWXMIT_ENTRY is always 4.
+
+Fixes: f94b47c6bde6 ("staging: r8188eu: add check for kzalloc")
+Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
+Link: https://lore.kernel.org/r/20220521204741.921-1-phil@philpotter.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/r8188eu/core/rtw_xmit.c | 20 +++++---------------
+ 1 file changed, 5 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/staging/r8188eu/core/rtw_xmit.c b/drivers/staging/r8188eu/core/rtw_xmit.c
+index 2ee92bbe66a08d99e23c7a2c28dd6031dde46455..ea5c88904961d2d887c3ee2d83cd786cad08c6f5 100644
+--- a/drivers/staging/r8188eu/core/rtw_xmit.c
++++ b/drivers/staging/r8188eu/core/rtw_xmit.c
+@@ -178,8 +178,7 @@ s32	_rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
+ 
+ 	pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf;
+ 
+-	res = rtw_alloc_hwxmits(padapter);
+-	if (res) {
++	if (rtw_alloc_hwxmits(padapter)) {
+ 		res = _FAIL;
+ 		goto exit;
+ 	}
+@@ -1492,19 +1491,10 @@ int rtw_alloc_hwxmits(struct adapter *padapter)
+ 
+ 	hwxmits = pxmitpriv->hwxmits;
+ 
+-	if (pxmitpriv->hwxmit_entry == 5) {
+-		hwxmits[0] .sta_queue = &pxmitpriv->bm_pending;
+-		hwxmits[1] .sta_queue = &pxmitpriv->vo_pending;
+-		hwxmits[2] .sta_queue = &pxmitpriv->vi_pending;
+-		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
+-		hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
+-	} else if (pxmitpriv->hwxmit_entry == 4) {
+-		hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
+-		hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
+-		hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
+-		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
+-	} else {
+-	}
++	hwxmits[0].sta_queue = &pxmitpriv->vo_pending;
++	hwxmits[1].sta_queue = &pxmitpriv->vi_pending;
++	hwxmits[2].sta_queue = &pxmitpriv->be_pending;
++	hwxmits[3].sta_queue = &pxmitpriv->bk_pending;
+ 
+ 	return 0;
+ }
diff --git a/0053-staging-r8188eu-Fix-warning-of-array-overflow-in-ioc.patch b/0053-staging-r8188eu-Fix-warning-of-array-overflow-in-ioc.patch
new file mode 100644
index 000000000000..55361e64a1c3
--- /dev/null
+++ b/0053-staging-r8188eu-Fix-warning-of-array-overflow-in-ioc.patch
@@ -0,0 +1,66 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 30 May 2022 20:31:03 -0500
+Subject: [PATCH] staging: r8188eu: Fix warning of array overflow in
+ ioctl_linux.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 96f0a54e8e65a765b3a4ad4b53751581f23279f3 ]
+
+Building with -Warray-bounds results in the following warning plus others
+related to the same problem:
+
+CC [M]  drivers/staging/r8188eu/os_dep/ioctl_linux.o
+In function ‘wpa_set_encryption’,
+    inlined from ‘rtw_wx_set_enc_ext’ at drivers/staging/r8188eu/os_dep/ioctl_linux.c:1868:9:
+drivers/staging/r8188eu/os_dep/ioctl_linux.c:412:41: warning: array subscript ‘struct ndis_802_11_wep[0]’ is partly outside array bounds of ‘void[25]’ [-Warray-bounds]
+  412 |                         pwep->KeyLength = wep_key_len;
+      |                         ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~
+In file included from drivers/staging/r8188eu/os_dep/../include/osdep_service.h:19,
+                 from drivers/staging/r8188eu/os_dep/ioctl_linux.c:4:
+In function ‘kmalloc’,
+    inlined from ‘kzalloc’ at ./include/linux/slab.h:733:9,
+    inlined from ‘wpa_set_encryption’ at drivers/staging/r8188eu/os_dep/ioctl_linux.c:408:11,
+    inlined from ‘rtw_wx_set_enc_ext’ at drivers/staging/r8188eu/os_dep/ioctl_linux.c:1868:9:
+./include/linux/slab.h:605:16: note: object of size [17, 25] allocated by ‘__kmalloc’
+  605 |         return __kmalloc(size, flags);
+      |                ^~~~~~~~~~~~~~~~~~~~~~
+./include/linux/slab.h:600:24: note: object of size [17, 25] allocated by ‘kmem_cache_alloc_trace’
+  600 |                 return kmem_cache_alloc_trace(
+      |                        ^~~~~~~~~~~~~~~~~~~~~~~
+  601 |                                 kmalloc_caches[kmalloc_type(flags)][index],
+      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  602 |                                 flags, size);
+      |                                 ~~~~~~~~~~~~
+
+Although it is unlikely that anyone is still using WEP encryption, the
+size of the allocation needs to be increased just in case.
+
+Fixes commit 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
+
+Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Phillip Potter <phil@philpotter.co.uk>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20220531013103.2175-3-Larry.Finger@lwfinger.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/r8188eu/os_dep/ioctl_linux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+index 60bd1cc2b3afda1afe1e5cea106d3e6313e22a8b..607c5e1eb32050c7aa77942f631caa16be09570d 100644
+--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+@@ -404,7 +404,7 @@ static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param,
+ 
+ 		if (wep_key_len > 0) {
+ 			wep_key_len = wep_key_len <= 5 ? 5 : 13;
+-			wep_total_len = wep_key_len + FIELD_OFFSET(struct ndis_802_11_wep, KeyMaterial);
++			wep_total_len = wep_key_len + sizeof(*pwep);
+ 			pwep = kzalloc(wep_total_len, GFP_KERNEL);
+ 			if (!pwep)
+ 				goto exit;
diff --git a/0054-pNFS-Don-t-keep-retrying-if-the-server-replied-NFS4E.patch b/0054-pNFS-Don-t-keep-retrying-if-the-server-replied-NFS4E.patch
new file mode 100644
index 000000000000..53de9307fff8
--- /dev/null
+++ b/0054-pNFS-Don-t-keep-retrying-if-the-server-replied-NFS4E.patch
@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Tue, 31 May 2022 11:03:06 -0400
+Subject: [PATCH] pNFS: Don't keep retrying if the server replied
+ NFS4ERR_LAYOUTUNAVAILABLE
+
+[ Upstream commit fe44fb23d6ccde4c914c44ef74ab8d9d9ba02bea ]
+
+If the server tells us that a pNFS layout is not available for a
+specific file, then we should not keep pounding it with further
+layoutget requests.
+
+Fixes: 183d9e7b112a ("pnfs: rework LAYOUTGET retry handling")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 68a87be3e6f96fb4e8ab7a038d1f2bc789c05a7e..4609e641710e4da02f05a162e8bbe49bc51e3b89 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2152,6 +2152,12 @@ pnfs_update_layout(struct inode *ino,
+ 		case -ERECALLCONFLICT:
+ 		case -EAGAIN:
+ 			break;
++		case -ENODATA:
++			/* The server returned NFS4ERR_LAYOUTUNAVAILABLE */
++			pnfs_layout_set_fail_bit(
++				lo, pnfs_iomode_to_fail_bit(iomode));
++			lseg = NULL;
++			goto out_put_layout_hdr;
+ 		default:
+ 			if (!nfs_error_is_fatal(PTR_ERR(lseg))) {
+ 				pnfs_layout_clear_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode));
diff --git a/0055-pNFS-Avoid-a-live-lock-condition-in-pnfs_update_layo.patch b/0055-pNFS-Avoid-a-live-lock-condition-in-pnfs_update_layo.patch
new file mode 100644
index 000000000000..01340ab4dafa
--- /dev/null
+++ b/0055-pNFS-Avoid-a-live-lock-condition-in-pnfs_update_layo.patch
@@ -0,0 +1,101 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Tue, 31 May 2022 11:03:07 -0400
+Subject: [PATCH] pNFS: Avoid a live lock condition in pnfs_update_layout()
+
+[ Upstream commit 880265c77ac415090090d1fe72a188fee71cb458 ]
+
+If we're about to send the first layoutget for an empty layout, we want
+to make sure that we drain out the existing pending layoutget calls
+first. The reason is that these layouts may have been already implicitly
+returned to the server by a recall to which the client gave a
+NFS4ERR_NOMATCHING_LAYOUT response.
+
+The problem is that wait_var_event_killable() could in principle see the
+plh_outstanding count go back to '1' when the first process to wake up
+starts sending a new layoutget. If it fails to get a layout, then this
+loop can continue ad infinitum...
+
+Fixes: 0b77f97a7e42 ("NFSv4/pnfs: Fix layoutget behaviour after invalidation")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/callback_proc.c |  1 +
+ fs/nfs/pnfs.c          | 15 +++++++++------
+ fs/nfs/pnfs.h          |  1 +
+ 3 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index c8520284dda788562eb0888db508c63b841307ea..c1eda73254e16f938a551a42e1594cd05a90af96 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -288,6 +288,7 @@ static u32 initiate_file_draining(struct nfs_client *clp,
+ 		rv = NFS4_OK;
+ 		break;
+ 	case -ENOENT:
++		set_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags);
+ 		/* Embrace your forgetfulness! */
+ 		rv = NFS4ERR_NOMATCHING_LAYOUT;
+ 
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 4609e641710e4da02f05a162e8bbe49bc51e3b89..41a9b6b58fb9fa15c9f162fa8dfa267a1c16e049 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -469,6 +469,7 @@ pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo,
+ 		pnfs_clear_lseg_state(lseg, lseg_list);
+ 	pnfs_clear_layoutreturn_info(lo);
+ 	pnfs_free_returned_lsegs(lo, lseg_list, &range, 0);
++	set_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags);
+ 	if (test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags) &&
+ 	    !test_and_set_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags))
+ 		pnfs_clear_layoutreturn_waitbit(lo);
+@@ -1917,8 +1918,9 @@ static void nfs_layoutget_begin(struct pnfs_layout_hdr *lo)
+ 
+ static void nfs_layoutget_end(struct pnfs_layout_hdr *lo)
+ {
+-	if (atomic_dec_and_test(&lo->plh_outstanding))
+-		wake_up_var(&lo->plh_outstanding);
++	if (atomic_dec_and_test(&lo->plh_outstanding) &&
++	    test_and_clear_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags))
++		wake_up_bit(&lo->plh_flags, NFS_LAYOUT_DRAIN);
+ }
+ 
+ static bool pnfs_is_first_layoutget(struct pnfs_layout_hdr *lo)
+@@ -2025,11 +2027,11 @@ pnfs_update_layout(struct inode *ino,
+ 	 * If the layout segment list is empty, but there are outstanding
+ 	 * layoutget calls, then they might be subject to a layoutrecall.
+ 	 */
+-	if ((list_empty(&lo->plh_segs) || !pnfs_layout_is_valid(lo)) &&
++	if (test_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags) &&
+ 	    atomic_read(&lo->plh_outstanding) != 0) {
+ 		spin_unlock(&ino->i_lock);
+-		lseg = ERR_PTR(wait_var_event_killable(&lo->plh_outstanding,
+-					!atomic_read(&lo->plh_outstanding)));
++		lseg = ERR_PTR(wait_on_bit(&lo->plh_flags, NFS_LAYOUT_DRAIN,
++					   TASK_KILLABLE));
+ 		if (IS_ERR(lseg))
+ 			goto out_put_layout_hdr;
+ 		pnfs_put_layout_hdr(lo);
+@@ -2413,7 +2415,8 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
+ 		goto out_forget;
+ 	}
+ 
+-	if (!pnfs_layout_is_valid(lo) && !pnfs_is_first_layoutget(lo))
++	if (test_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags) &&
++	    !pnfs_is_first_layoutget(lo))
+ 		goto out_forget;
+ 
+ 	if (nfs4_stateid_match_other(&lo->plh_stateid, &res->stateid)) {
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 07f11489e4e9f0cb447dbc3378357cc8bc835aad..f331f067691b0854c7806d2099fabf8932c920a9 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -105,6 +105,7 @@ enum {
+ 	NFS_LAYOUT_FIRST_LAYOUTGET,	/* Serialize first layoutget */
+ 	NFS_LAYOUT_INODE_FREEING,	/* The inode is being freed */
+ 	NFS_LAYOUT_HASHED,		/* The layout visible */
++	NFS_LAYOUT_DRAIN,
+ };
+ 
+ enum layoutdriver_policy_flags {
diff --git a/0056-sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch b/0056-sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch
new file mode 100644
index 000000000000..c9720de48888
--- /dev/null
+++ b/0056-sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch
@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Scott Mayhew <smayhew@redhat.com>
+Date: Wed, 1 Jun 2022 13:34:49 -0400
+Subject: [PATCH] sunrpc: set cl_max_connect when cloning an rpc_clnt
+
+[ Upstream commit 304791255a2dc1c9be7e7c8a6cbdb31b6847b0e5 ]
+
+If the initial attempt at trunking detection using the krb5i auth flavor
+fails with -EACCES, -NFS4ERR_CLID_INUSE, or -NFS4ERR_WRONGSEC, then the
+NFS client tries again using auth_sys, cloning the rpc_clnt in the
+process.  If this second attempt at trunking detection succeeds, then
+the resulting nfs_client->cl_rpcclient winds up having cl_max_connect=0
+and subsequent attempts to add additional transport connections to the
+rpc_clnt will fail with a message similar to the following being logged:
+
+[502044.312640] SUNRPC: reached max allowed number (0) did not add
+transport to server: 192.168.122.3
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Fixes: dc48e0abee24 ("SUNRPC enforce creation of no more than max_connect xprts")
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/clnt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index e2c6eca0271b364c05c4136a9e9ea4eb1e23602b..b6781ada3aa8d7bfe20978b7f2238e2c888ec5a4 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -651,6 +651,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
+ 	new->cl_discrtry = clnt->cl_discrtry;
+ 	new->cl_chatty = clnt->cl_chatty;
+ 	new->cl_principal = clnt->cl_principal;
++	new->cl_max_connect = clnt->cl_max_connect;
+ 	return new;
+ 
+ out_err:
diff --git a/0057-clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch b/0057-clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch
new file mode 100644
index 000000000000..d12fabec4c54
--- /dev/null
+++ b/0057-clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch
@@ -0,0 +1,48 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <masahiroy@kernel.org>
+Date: Mon, 6 Jun 2022 14:02:38 +0900
+Subject: [PATCH] clocksource: hyper-v: unexport __init-annotated
+ hv_init_clocksource()
+
+[ Upstream commit 245b993d8f6c4e25f19191edfbd8080b645e12b1 ]
+
+EXPORT_SYMBOL and __init is a bad combination because the .init.text
+section is freed up after the initialization. Hence, modules cannot
+use symbols annotated __init. The access to a freed symbol may end up
+with kernel panic.
+
+modpost used to detect it, but it has been broken for a decade.
+
+Recently, I fixed modpost so it started to warn it again, then this
+showed up in linux-next builds.
+
+There are two ways to fix it:
+
+  - Remove __init
+  - Remove EXPORT_SYMBOL
+
+I chose the latter for this case because the only in-tree call-site,
+arch/x86/kernel/cpu/mshyperv.c is never compiled as modular.
+(CONFIG_HYPERVISOR_GUEST is boolean)
+
+Fixes: dd2cb348613b ("clocksource/drivers: Continue making Hyper-V clocksource ISA agnostic")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Link: https://lore.kernel.org/r/20220606050238.4162200-1-masahiroy@kernel.org
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/hyperv_timer.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/clocksource/hyperv_timer.c b/drivers/clocksource/hyperv_timer.c
+index ff188ab68496e0d646f5e15ea8c5b0ef2e321c83..bb47610bbd1c4ddee413a626cf8a6eed333b451a 100644
+--- a/drivers/clocksource/hyperv_timer.c
++++ b/drivers/clocksource/hyperv_timer.c
+@@ -565,4 +565,3 @@ void __init hv_init_clocksource(void)
+ 	hv_sched_clock_offset = hv_read_reference_counter();
+ 	hv_setup_sched_clock(read_hv_sched_clock_msr);
+ }
+-EXPORT_SYMBOL_GPL(hv_init_clocksource);
diff --git a/0058-i40e-Fix-adding-ADQ-filter-to-TC0.patch b/0058-i40e-Fix-adding-ADQ-filter-to-TC0.patch
new file mode 100644
index 000000000000..e8e256e7f572
--- /dev/null
+++ b/0058-i40e-Fix-adding-ADQ-filter-to-TC0.patch
@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Date: Fri, 29 Apr 2022 14:27:08 +0200
+Subject: [PATCH] i40e: Fix adding ADQ filter to TC0
+
+[ Upstream commit c3238d36c3a2be0a29a9d848d6c51e1b14be6692 ]
+
+Procedure of configure tc flower filters erroneously allows to create
+filters on TC0 where unfiltered packets are also directed by default.
+Issue was caused by insufficient checks of hw_tc parameter specifying
+the hardware traffic class to pass matching packets to.
+
+Fix checking hw_tc parameter which blocks creation of filters on TC0.
+
+Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower")
+Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Tested-by: Bharathi Sreenivas <bharathi.sreenivas@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 98871f01499469332b03b38a278e89d1532ccff0..46bb1169a004d9a404706d797befa25d5640c221 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -8537,6 +8537,11 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi,
+ 		return -EOPNOTSUPP;
+ 	}
+ 
++	if (!tc) {
++		dev_err(&pf->pdev->dev, "Unable to add filter because of invalid destination");
++		return -EINVAL;
++	}
++
+ 	if (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state) ||
+ 	    test_bit(__I40E_RESET_INTR_RECEIVED, pf->state))
+ 		return -EBUSY;
diff --git a/0059-i40e-Fix-calculating-the-number-of-queue-pairs.patch b/0059-i40e-Fix-calculating-the-number-of-queue-pairs.patch
new file mode 100644
index 000000000000..7d5d06b0a727
--- /dev/null
+++ b/0059-i40e-Fix-calculating-the-number-of-queue-pairs.patch
@@ -0,0 +1,36 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Date: Fri, 29 Apr 2022 14:40:23 +0200
+Subject: [PATCH] i40e: Fix calculating the number of queue pairs
+
+[ Upstream commit 0bb050670ac90a167ecfa3f9590f92966c9a3677 ]
+
+If ADQ is enabled for a VF, then actual number of queue pair
+is a number of currently available traffic classes for this VF.
+
+Without this change the configuration of the Rx/Tx queues
+fails with error.
+
+Fixes: d29e0d233e0d ("i40e: missing input validation on VF message handling by the PF")
+Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Tested-by: Bharathi Sreenivas <bharathi.sreenivas@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 2606e8f0f19be4764d48ec0cbe28850e3735d5d3..033ea71763e3de4437800fc83a5e9366107ef7da 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2282,7 +2282,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg)
+ 	}
+ 
+ 	if (vf->adq_enabled) {
+-		for (i = 0; i < I40E_MAX_VF_VSI; i++)
++		for (i = 0; i < vf->num_tc; i++)
+ 			num_qps_all += vf->ch[i].num_qps;
+ 		if (num_qps_all != qci->num_queue_pairs) {
+ 			aq_ret = I40E_ERR_PARAM;
diff --git a/0060-i40e-Fix-call-trace-in-setup_tx_descriptors.patch b/0060-i40e-Fix-call-trace-in-setup_tx_descriptors.patch
new file mode 100644
index 000000000000..49fa852b354c
--- /dev/null
+++ b/0060-i40e-Fix-call-trace-in-setup_tx_descriptors.patch
@@ -0,0 +1,78 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Date: Thu, 19 May 2022 16:01:45 +0200
+Subject: [PATCH] i40e: Fix call trace in setup_tx_descriptors
+
+[ Upstream commit fd5855e6b1358e816710afee68a1d2bc685176ca ]
+
+After PF reset and ethtool -t there was call trace in dmesg
+sometimes leading to panic. When there was some time, around 5
+seconds, between reset and test there were no errors.
+
+Problem was that pf reset calls i40e_vsi_close in prep_for_reset
+and ethtool -t calls i40e_vsi_close in diag_test. If there was not
+enough time between those commands the second i40e_vsi_close starts
+before previous i40e_vsi_close was done which leads to crash.
+
+Add check to diag_test if pf is in reset and don't start offline
+tests if it is true.
+Add netif_info("testing failed") into unhappy path of i40e_diag_test()
+
+Fixes: e17bc411aea8 ("i40e: Disable offline diagnostics if VFs are enabled")
+Fixes: 510efb2682b3 ("i40e: Fix ethtool offline diagnostic with netqueues")
+Signed-off-by: Michal Jaron <michalx.jaron@intel.com>
+Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/i40e/i40e_ethtool.c    | 25 +++++++++++++------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index e48499624d22c6a4565c74295c0cda2e955835af..06c05a6b8b71fd32885ea91f56b90fe1c2635023 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -2584,15 +2584,16 @@ static void i40e_diag_test(struct net_device *netdev,
+ 
+ 		set_bit(__I40E_TESTING, pf->state);
+ 
++		if (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state) ||
++		    test_bit(__I40E_RESET_INTR_RECEIVED, pf->state)) {
++			dev_warn(&pf->pdev->dev,
++				 "Cannot start offline testing when PF is in reset state.\n");
++			goto skip_ol_tests;
++		}
++
+ 		if (i40e_active_vfs(pf) || i40e_active_vmdqs(pf)) {
+ 			dev_warn(&pf->pdev->dev,
+ 				 "Please take active VFs and Netqueues offline and restart the adapter before running NIC diagnostics\n");
+-			data[I40E_ETH_TEST_REG]		= 1;
+-			data[I40E_ETH_TEST_EEPROM]	= 1;
+-			data[I40E_ETH_TEST_INTR]	= 1;
+-			data[I40E_ETH_TEST_LINK]	= 1;
+-			eth_test->flags |= ETH_TEST_FL_FAILED;
+-			clear_bit(__I40E_TESTING, pf->state);
+ 			goto skip_ol_tests;
+ 		}
+ 
+@@ -2639,9 +2640,17 @@ static void i40e_diag_test(struct net_device *netdev,
+ 		data[I40E_ETH_TEST_INTR] = 0;
+ 	}
+ 
+-skip_ol_tests:
+-
+ 	netif_info(pf, drv, netdev, "testing finished\n");
++	return;
++
++skip_ol_tests:
++	data[I40E_ETH_TEST_REG]		= 1;
++	data[I40E_ETH_TEST_EEPROM]	= 1;
++	data[I40E_ETH_TEST_INTR]	= 1;
++	data[I40E_ETH_TEST_LINK]	= 1;
++	eth_test->flags |= ETH_TEST_FL_FAILED;
++	clear_bit(__I40E_TESTING, pf->state);
++	netif_info(pf, drv, netdev, "testing failed\n");
+ }
+ 
+ static void i40e_get_wol(struct net_device *netdev,
diff --git a/0061-iavf-Fix-issue-with-MAC-address-of-VF-shown-as-zero.patch b/0061-iavf-Fix-issue-with-MAC-address-of-VF-shown-as-zero.patch
new file mode 100644
index 000000000000..49e16f7960fe
--- /dev/null
+++ b/0061-iavf-Fix-issue-with-MAC-address-of-VF-shown-as-zero.patch
@@ -0,0 +1,49 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michal Wilczynski <michal.wilczynski@intel.com>
+Date: Fri, 20 May 2022 13:19:27 +0200
+Subject: [PATCH] iavf: Fix issue with MAC address of VF shown as zero
+
+[ Upstream commit 645603844270b69175899268be68b871295764fe ]
+
+After reinitialization of iavf, ice driver gets VIRTCHNL_OP_ADD_ETH_ADDR
+message with incorrectly set type of MAC address. Hardware address should
+have is_primary flag set as true. This way ice driver knows what it has
+to set as a MAC address.
+
+Check if the address is primary in iavf_add_filter function and set flag
+accordingly.
+
+To test set all-zero MAC on a VF. This triggers iavf re-initialization
+and VIRTCHNL_OP_ADD_ETH_ADDR message gets sent to PF.
+For example:
+
+ip link set dev ens785 vf 0 mac 00:00:00:00:00:00
+
+This triggers re-initialization of iavf. New MAC should be assigned.
+Now check if MAC is non-zero:
+
+ip link show dev ens785
+
+Fixes: a3e839d539e0 ("iavf: Add usage of new virtchnl format to set default MAC")
+Signed-off-by: Michal Wilczynski <michal.wilczynski@intel.com>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 7dfcf78b57fb54dbe67a69ecf1ac8be9acf8b339..f3ecb3bca33dde77895c7742861940c9675e9249 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -984,7 +984,7 @@ struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter,
+ 		list_add_tail(&f->list, &adapter->mac_filter_list);
+ 		f->add = true;
+ 		f->is_new_mac = true;
+-		f->is_primary = false;
++		f->is_primary = ether_addr_equal(macaddr, adapter->hw.mac.addr);
+ 		adapter->aq_required |= IAVF_FLAG_AQ_ADD_MAC_FILTER;
+ 	} else {
+ 		f->remove = false;
diff --git a/0062-Drivers-hv-vmbus-Release-cpu-lock-in-error-case.patch b/0062-Drivers-hv-vmbus-Release-cpu-lock-in-error-case.patch
new file mode 100644
index 000000000000..4f7947404f20
--- /dev/null
+++ b/0062-Drivers-hv-vmbus-Release-cpu-lock-in-error-case.patch
@@ -0,0 +1,31 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Saurabh Sengar <ssengar@linux.microsoft.com>
+Date: Thu, 9 Jun 2022 10:16:36 -0700
+Subject: [PATCH] Drivers: hv: vmbus: Release cpu lock in error case
+
+[ Upstream commit 656c5ba50b7172a0ea25dc1b37606bd51d01fe8d ]
+
+In case of invalid sub channel, release cpu lock before returning.
+
+Fixes: a949e86c0d780 ("Drivers: hv: vmbus: Resolve race between init_vp_index() and CPU hotplug")
+Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Link: https://lore.kernel.org/r/1654794996-13244-1-git-send-email-ssengar@linux.microsoft.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/channel_mgmt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 85a2142c9384007d2bc43a1f072ceb7b96b0c53b..073ff9b6f5352dfc2540a0a53bd180d1b459a9e2 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -637,6 +637,7 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
+ 		 */
+ 		if (newchannel->offermsg.offer.sub_channel_index == 0) {
+ 			mutex_unlock(&vmbus_connection.channel_mutex);
++			cpus_read_unlock();
+ 			/*
+ 			 * Don't call free_channel(), because newchannel->kobj
+ 			 * is not initialized yet.
diff --git a/0063-tty-goldfish-Fix-free_irq-on-remove.patch b/0063-tty-goldfish-Fix-free_irq-on-remove.patch
new file mode 100644
index 000000000000..90eaf18c0e20
--- /dev/null
+++ b/0063-tty-goldfish-Fix-free_irq-on-remove.patch
@@ -0,0 +1,46 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Date: Thu, 9 Jun 2022 16:17:04 +0200
+Subject: [PATCH] tty: goldfish: Fix free_irq() on remove
+
+[ Upstream commit 499e13aac6c762e1e828172b0f0f5275651d6512 ]
+
+Pass the correct dev_id to free_irq() to fix this splat when the driver
+is unbound:
+
+ WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq
+ Trying to free already-free IRQ 65
+ Call Trace:
+  warn_slowpath_fmt
+  free_irq
+  goldfish_tty_remove
+  platform_remove
+  device_remove
+  device_release_driver_internal
+  device_driver_detach
+  unbind_store
+  drv_attr_store
+  ...
+
+Fixes: 465893e18878e119 ("tty: goldfish: support platform_device with id -1")
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Link: https://lore.kernel.org/r/20220609141704.1080024-1-vincent.whitchurch@axis.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/goldfish.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c
+index c7968aecd8702ef34c208d8bdbe528fd039a6d03..d02de3f0326fbbc2fa588cdc890e3f5a2b4cf4e6 100644
+--- a/drivers/tty/goldfish.c
++++ b/drivers/tty/goldfish.c
+@@ -426,7 +426,7 @@ static int goldfish_tty_remove(struct platform_device *pdev)
+ 	tty_unregister_device(goldfish_tty_driver, qtty->console.index);
+ 	iounmap(qtty->base);
+ 	qtty->base = NULL;
+-	free_irq(qtty->irq, pdev);
++	free_irq(qtty->irq, qtty);
+ 	tty_port_destroy(&qtty->port);
+ 	goldfish_tty_current_line_count--;
+ 	if (goldfish_tty_current_line_count == 0)
diff --git a/0064-misc-atmel-ssc-Fix-IRQ-check-in-ssc_probe.patch b/0064-misc-atmel-ssc-Fix-IRQ-check-in-ssc_probe.patch
new file mode 100644
index 000000000000..78985ba91901
--- /dev/null
+++ b/0064-misc-atmel-ssc-Fix-IRQ-check-in-ssc_probe.patch
@@ -0,0 +1,42 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 1 Jun 2022 16:30:26 +0400
+Subject: [PATCH] misc: atmel-ssc: Fix IRQ check in ssc_probe
+
+[ Upstream commit 1c245358ce0b13669f6d1625f7a4e05c41f28980 ]
+
+platform_get_irq() returns negative error number instead 0 on failure.
+And the doc of platform_get_irq() provides a usage example:
+
+    int irq = platform_get_irq(pdev, 0);
+    if (irq < 0)
+        return irq;
+
+Fix the check of return value to catch errors correctly.
+
+Fixes: eb1f2930609b ("Driver for the Atmel on-chip SSC on AT32AP and AT91")
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220601123026.7119-1-linmq006@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/atmel-ssc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
+index d6cd5537126c69bc76b5c019b17d0b01bb4a7eab..69f9b0336410d7e8da32ca0c7f0c2396eff942b2 100644
+--- a/drivers/misc/atmel-ssc.c
++++ b/drivers/misc/atmel-ssc.c
+@@ -232,9 +232,9 @@ static int ssc_probe(struct platform_device *pdev)
+ 	clk_disable_unprepare(ssc->clk);
+ 
+ 	ssc->irq = platform_get_irq(pdev, 0);
+-	if (!ssc->irq) {
++	if (ssc->irq < 0) {
+ 		dev_dbg(&pdev->dev, "could not get irq\n");
+-		return -ENXIO;
++		return ssc->irq;
+ 	}
+ 
+ 	mutex_lock(&user_lock);
diff --git a/0065-riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch b/0065-riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch
new file mode 100644
index 000000000000..6b1dbf08c77a
--- /dev/null
+++ b/0065-riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Conor Dooley <conor.dooley@microchip.com>
+Date: Fri, 3 Jun 2022 09:38:26 +0100
+Subject: [PATCH] riscv: dts: microchip: re-add pdma to mpfs device tree
+
+[ Upstream commit 5e757deddd918edb8cb2fdb56eb79656ffc6dade ]
+
+PolarFire SoC /does/ have a SiFive pdma, despite what I suggested as a
+conflict resolution to Zong. Somehow the entry fell through the cracks
+between versions of my dt patches, so re-add it with Zong's updated
+compatible & dma-channels property.
+
+Fixes: c5094f371008 ("riscv: dts: microchip: refactor icicle kit device tree")
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi b/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi
+index cf2f55e1dcb679776bf0e1aa84e67fab4064577d..f44fce1fe080c460f9b109b688b7594a6914c7cd 100644
+--- a/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi
++++ b/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi
+@@ -188,6 +188,15 @@ plic: interrupt-controller@c000000 {
+ 			riscv,ndev = <186>;
+ 		};
+ 
++		pdma: dma-controller@3000000 {
++			compatible = "sifive,fu540-c000-pdma", "sifive,pdma0";
++			reg = <0x0 0x3000000 0x0 0x8000>;
++			interrupt-parent = <&plic>;
++			interrupts = <5 6>, <7 8>, <9 10>, <11 12>;
++			dma-channels = <4>;
++			#dma-cells = <1>;
++		};
++
+ 		clkcfg: clkcfg@20002000 {
+ 			compatible = "microchip,mpfs-clkcfg";
+ 			reg = <0x0 0x20002000 0x0 0x1000>, <0x0 0x3E001000 0x0 0x1000>;
diff --git a/0066-io_uring-fix-races-with-file-table-unregister.patch b/0066-io_uring-fix-races-with-file-table-unregister.patch
new file mode 100644
index 000000000000..d4287b4b96bd
--- /dev/null
+++ b/0066-io_uring-fix-races-with-file-table-unregister.patch
@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Mon, 13 Jun 2022 06:32:44 +0100
+Subject: [PATCH] io_uring: fix races with file table unregister
+
+[ Upstream commit b0380bf6dad4601d92025841e2b7a135d566c6e3 ]
+
+Fixed file table quiesce might unlock ->uring_lock, potentially letting
+new requests to be submitted, don't allow those requests to use the
+table as they will race with unregistration.
+
+Reported-and-tested-by: van fantasy <g1042620637@gmail.com>
+Fixes: 05f3fb3c53975 ("io_uring: avoid ring quiesce for fixed file set unregister and update")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 3582db014aadfd76ee8c6e7e36c3c2edeed87c23..0a9f9000fc802cdf44c465e1f9064b1f3916e6a2 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8508,11 +8508,19 @@ static void __io_sqe_files_unregister(struct io_ring_ctx *ctx)
+ 
+ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
+ {
++	unsigned nr = ctx->nr_user_files;
+ 	int ret;
+ 
+ 	if (!ctx->file_data)
+ 		return -ENXIO;
++
++	/*
++	 * Quiesce may unlock ->uring_lock, and while it's not held
++	 * prevent new requests using the table.
++	 */
++	ctx->nr_user_files = 0;
+ 	ret = io_rsrc_ref_quiesce(ctx->file_data, ctx);
++	ctx->nr_user_files = nr;
+ 	if (!ret)
+ 		__io_sqe_files_unregister(ctx);
+ 	return ret;
diff --git a/0067-io_uring-fix-races-with-buffer-table-unregister.patch b/0067-io_uring-fix-races-with-buffer-table-unregister.patch
new file mode 100644
index 000000000000..4de2c6cb62fd
--- /dev/null
+++ b/0067-io_uring-fix-races-with-buffer-table-unregister.patch
@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Mon, 13 Jun 2022 06:30:06 +0100
+Subject: [PATCH] io_uring: fix races with buffer table unregister
+
+[ Upstream commit d11d31fc5d8a96f707facee0babdcffaafa38de2 ]
+
+Fixed buffer table quiesce might unlock ->uring_lock, potentially
+letting new requests to be submitted, don't allow those requests to
+use the table as they will race with unregistration.
+
+Reported-and-tested-by: van fantasy <g1042620637@gmail.com>
+Fixes: bd54b6fe3316ec ("io_uring: implement fixed buffers registration similar to fixed files")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 0a9f9000fc802cdf44c465e1f9064b1f3916e6a2..3d123ca028c974dfe4e52a1c9c3c904c472f31ea 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -9495,12 +9495,19 @@ static void __io_sqe_buffers_unregister(struct io_ring_ctx *ctx)
+ 
+ static int io_sqe_buffers_unregister(struct io_ring_ctx *ctx)
+ {
++	unsigned nr = ctx->nr_user_bufs;
+ 	int ret;
+ 
+ 	if (!ctx->buf_data)
+ 		return -ENXIO;
+ 
++	/*
++	 * Quiesce may unlock ->uring_lock, and while it's not held
++	 * prevent new requests using the table.
++	 */
++	ctx->nr_user_bufs = 0;
+ 	ret = io_rsrc_ref_quiesce(ctx->buf_data, ctx);
++	ctx->nr_user_bufs = nr;
+ 	if (!ret)
+ 		__io_sqe_buffers_unregister(ctx);
+ 	return ret;
diff --git a/0068-drm-i915-reset-Fix-error_state_read-ptr-offset-use.patch b/0068-drm-i915-reset-Fix-error_state_read-ptr-offset-use.patch
new file mode 100644
index 000000000000..fe4f62c54270
--- /dev/null
+++ b/0068-drm-i915-reset-Fix-error_state_read-ptr-offset-use.patch
@@ -0,0 +1,139 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alan Previn <alan.previn.teres.alexis@intel.com>
+Date: Thu, 10 Mar 2022 16:43:11 -0800
+Subject: [PATCH] drm/i915/reset: Fix error_state_read ptr + offset use
+
+[ Upstream commit c9b576d0c7bf55aeae1a736da7974fa202c4394d ]
+
+Fix our pointer offset usage in error_state_read
+when there is no i915_gpu_coredump but buf offset
+is non-zero.
+
+This fixes a kernel page fault can happen when
+multiple tests are running concurrently in a loop
+and one is producing engine resets and consuming
+the i915 error_state dump while the other is
+forcing full GT resets. (takes a while to trigger).
+
+The dmesg call trace:
+
+[ 5590.803000] BUG: unable to handle page fault for address:
+               ffffffffa0b0e000
+[ 5590.803009] #PF: supervisor read access in kernel mode
+[ 5590.803013] #PF: error_code(0x0000) - not-present page
+[ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067
+               PTE 0
+[ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI
+[ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U
+                    5.17.0-rc5-ups69-guc-err-capt-rev6+ #136
+[ 5590.803033] Hardware name: Intel Corporation Alder Lake Client
+                    Platform/AlderLake-M LP4x RVP, BIOS ADLPFWI1.R00.
+                    3031.A02.2201171222	01/17/2022
+[ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10
+[ 5590.803045] Code: fe ff ff cc eb 1e 0f 1f 00 48 89 f8 48 89 d1
+                     48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3
+                     66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4
+                     c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20
+                     72 7e 40 38 fe
+[ 5590.803054] RSP: 0018:ffffc90003a8fdf0 EFLAGS: 00010282
+[ 5590.803057] RAX: ffff888107ee9000 RBX: ffff888108cb1a00
+               RCX: 0000000000000f8f
+[ 5590.803061] RDX: 0000000000001000 RSI: ffffffffa0b0e000
+               RDI: ffff888107ee9071
+[ 5590.803065] RBP: 0000000000000000 R08: 0000000000000001
+               R09: 0000000000000001
+[ 5590.803069] R10: 0000000000000001 R11: 0000000000000002
+               R12: 0000000000000019
+[ 5590.803073] R13: 0000000000174fff R14: 0000000000001000
+               R15: ffff888107ee9000
+[ 5590.803077] FS: 00007f62a99bee80(0000) GS:ffff88849f880000(0000)
+               knlGS:0000000000000000
+[ 5590.803082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5590.803085] CR2: ffffffffa0b0e000 CR3: 000000010a1a8004
+               CR4: 0000000000770ee0
+[ 5590.803089] PKRU: 55555554
+[ 5590.803091] Call Trace:
+[ 5590.803093] <TASK>
+[ 5590.803096] error_state_read+0xa1/0xd0 [i915]
+[ 5590.803175] kernfs_fop_read_iter+0xb2/0x1b0
+[ 5590.803180] new_sync_read+0x116/0x1a0
+[ 5590.803185] vfs_read+0x114/0x1b0
+[ 5590.803189] ksys_read+0x63/0xe0
+[ 5590.803193] do_syscall_64+0x38/0xc0
+[ 5590.803197] entry_SYSCALL_64_after_hwframe+0x44/0xae
+[ 5590.803201] RIP: 0033:0x7f62aaea5912
+[ 5590.803204] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 5a b9 0c 00 e8 05
+                     19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25
+                     18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff
+                     ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24
+[ 5590.803213] RSP: 002b:00007fff5b659ae8 EFLAGS: 00000246
+               ORIG_RAX: 0000000000000000
+[ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000
+               RCX: 00007f62aaea5912
+[ 5590.803221] RDX: 000000000008b000 RSI: 00007f62a8c4000f
+               RDI: 0000000000000006
+[ 5590.803225] RBP: 00007f62a8bcb00f R08: 0000000000200010
+               R09: 0000000000101000
+[ 5590.803229] R10: 0000000000000001 R11: 0000000000000246
+               R12: 0000000000000006
+[ 5590.803233] R13: 0000000000075000 R14: 00007f62a8acb010
+               R15: 0000000000200000
+[ 5590.803238] </TASK>
+[ 5590.803240] Modules linked in: i915 ttm drm_buddy drm_dp_helper
+                        drm_kms_helper syscopyarea sysfillrect sysimgblt
+                        fb_sys_fops prime_numbers nfnetlink br_netfilter
+                        overlay mei_pxp mei_hdcp x86_pkg_temp_thermal
+                        coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel
+                        snd_intel_dspcfg snd_hda_codec snd_hwdep
+                        snd_hda_core snd_pcm mei_me mei fuse ip_tables
+                        x_tables crct10dif_pclmul e1000e crc32_pclmul ptp
+                        i2c_i801 ghash_clmulni_intel i2c_smbus pps_core
+                        [last unloa ded: ttm]
+[ 5590.803277] CR2: ffffffffa0b0e000
+[ 5590.803280] ---[ end trace 0000000000000000 ]---
+
+Fixes: 0e39037b3165 ("drm/i915: Cache the error string")
+Signed-off-by: Alan Previn <alan.previn.teres.alexis@intel.com>
+Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220311004311.514198-2-alan.previn.teres.alexis@intel.com
+(cherry picked from commit 3304033a1e69cd81a2044b4422f0d7e593afb4e6)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_sysfs.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_sysfs.c b/drivers/gpu/drm/i915/i915_sysfs.c
+index a4d1759375b9d307fb5522b2463fe12c9bd5351a..66a8880eaf19ae64fabac183f29d6c0eff5b1b7f 100644
+--- a/drivers/gpu/drm/i915/i915_sysfs.c
++++ b/drivers/gpu/drm/i915/i915_sysfs.c
+@@ -432,7 +432,14 @@ static ssize_t error_state_read(struct file *filp, struct kobject *kobj,
+ 	struct device *kdev = kobj_to_dev(kobj);
+ 	struct drm_i915_private *i915 = kdev_minor_to_i915(kdev);
+ 	struct i915_gpu_coredump *gpu;
+-	ssize_t ret;
++	ssize_t ret = 0;
++
++	/*
++	 * FIXME: Concurrent clients triggering resets and reading + clearing
++	 * dumps can cause inconsistent sysfs reads when a user calls in with a
++	 * non-zero offset to complete a prior partial read but the
++	 * gpu_coredump has been cleared or replaced.
++	 */
+ 
+ 	gpu = i915_first_error_state(i915);
+ 	if (IS_ERR(gpu)) {
+@@ -444,8 +451,10 @@ static ssize_t error_state_read(struct file *filp, struct kobject *kobj,
+ 		const char *str = "No error state collected\n";
+ 		size_t len = strlen(str);
+ 
+-		ret = min_t(size_t, count, len - off);
+-		memcpy(buf, str + off, ret);
++		if (off < len) {
++			ret = min_t(size_t, count, len - off);
++			memcpy(buf, str + off, ret);
++		}
+ 	}
+ 
+ 	return ret;
diff --git a/0069-net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch b/0069-net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch
new file mode 100644
index 000000000000..552687711960
--- /dev/null
+++ b/0069-net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch
@@ -0,0 +1,31 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Guangbin Huang <huangguangbin2@huawei.com>
+Date: Sat, 11 Jun 2022 20:25:24 +0800
+Subject: [PATCH] net: hns3: set port base vlan tbl_sta to false before
+ removing old vlan
+
+[ Upstream commit 9eda7d8bcbdb6909f202edeedff51948f1cad1e5 ]
+
+When modify port base vlan, the port base vlan tbl_sta needs to set to
+false before removing old vlan, to indicate this operation is not finish.
+
+Fixes: c0f46de30c96 ("net: hns3: fix port base vlan add fail when concurrent with reset")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 8cebb180c812f2a795101ad0c293b9e0b4a7a165..5d1615e27a1cf71aa3e4ca411343a45c870d90d6 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -10136,6 +10136,7 @@ static int hclge_modify_port_base_vlan_tag(struct hclge_vport *vport,
+ 	if (ret)
+ 		return ret;
+ 
++	vport->port_base_vlan_cfg.tbl_sta = false;
+ 	/* remove old VLAN tag */
+ 	if (old_info->vlan_tag == 0)
+ 		ret = hclge_set_vf_vlan_common(hdev, vport->vport_id,
diff --git a/0070-net-hns3-don-t-push-link-state-to-VF-if-unalive.patch b/0070-net-hns3-don-t-push-link-state-to-VF-if-unalive.patch
new file mode 100644
index 000000000000..a2bb74de470a
--- /dev/null
+++ b/0070-net-hns3-don-t-push-link-state-to-VF-if-unalive.patch
@@ -0,0 +1,36 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jian Shen <shenjian15@huawei.com>
+Date: Sat, 11 Jun 2022 20:25:25 +0800
+Subject: [PATCH] net: hns3: don't push link state to VF if unalive
+
+[ Upstream commit 283847e3ef6dbf79bf67083b5ce7b8033e8b6f34 ]
+
+It's unnecessary to push link state to unalive VF, and the VF will
+query link state from PF when it being start works.
+
+Fixes: 18b6e31f8bf4 ("net: hns3: PF add support for pushing link status to VFs")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 5d1615e27a1cf71aa3e4ca411343a45c870d90d6..c8c99ab60ec12f8efd9cd06b41528ace69cf4600 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3384,6 +3384,12 @@ static int hclge_set_vf_link_state(struct hnae3_handle *handle, int vf,
+ 	link_state_old = vport->vf_info.link_state;
+ 	vport->vf_info.link_state = link_state;
+ 
++	/* return success directly if the VF is unalive, VF will
++	 * query link state itself when it starts work.
++	 */
++	if (!test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state))
++		return 0;
++
+ 	ret = hclge_push_vf_link_status(vport);
+ 	if (ret) {
+ 		vport->vf_info.link_state = link_state_old;
diff --git a/0071-net-hns3-restore-tm-priority-qset-to-default-setting.patch b/0071-net-hns3-restore-tm-priority-qset-to-default-setting.patch
new file mode 100644
index 000000000000..ae775364bf34
--- /dev/null
+++ b/0071-net-hns3-restore-tm-priority-qset-to-default-setting.patch
@@ -0,0 +1,243 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Guangbin Huang <huangguangbin2@huawei.com>
+Date: Sat, 11 Jun 2022 20:25:27 +0800
+Subject: [PATCH] net: hns3: restore tm priority/qset to default settings when
+ tc disabled
+
+[ Upstream commit e93530ae0e5d8fcf2d908933d206e0c93bc3c09b ]
+
+Currently, settings parameters of schedule mode, dwrr, shaper of tm
+priority or qset of one tc are only be set when tc is enabled, they are
+not restored to the default settings when tc is disabled. It confuses
+users when they cat tm_priority or tm_qset files of debugfs. So this
+patch fixes it.
+
+Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h   |  1 +
+ .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 95 +++++++++++++------
+ 2 files changed, 65 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 79c64f4e67d2b4457442c24a6018dc31f62b37b5..3affcdb34c915f064428aa318ef951f959544eec 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -765,6 +765,7 @@ struct hnae3_tc_info {
+ 	u8 prio_tc[HNAE3_MAX_USER_PRIO]; /* TC indexed by prio */
+ 	u16 tqp_count[HNAE3_MAX_TC];
+ 	u16 tqp_offset[HNAE3_MAX_TC];
++	u8 max_tc; /* Total number of TCs */
+ 	u8 num_tc; /* Total number of enabled TCs */
+ 	bool mqprio_active;
+ };
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 1f87a8a3fe321e4b649b14e8c5c1f01e3db29992..ad53a344732211fe93b79a038a60917f1b447539 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -282,8 +282,8 @@ static int hclge_tm_pg_to_pri_map_cfg(struct hclge_dev *hdev,
+ 	return hclge_cmd_send(&hdev->hw, &desc, 1);
+ }
+ 
+-static int hclge_tm_qs_to_pri_map_cfg(struct hclge_dev *hdev,
+-				      u16 qs_id, u8 pri)
++static int hclge_tm_qs_to_pri_map_cfg(struct hclge_dev *hdev, u16 qs_id, u8 pri,
++				      bool link_vld)
+ {
+ 	struct hclge_qs_to_pri_link_cmd *map;
+ 	struct hclge_desc desc;
+@@ -294,7 +294,7 @@ static int hclge_tm_qs_to_pri_map_cfg(struct hclge_dev *hdev,
+ 
+ 	map->qs_id = cpu_to_le16(qs_id);
+ 	map->priority = pri;
+-	map->link_vld = HCLGE_TM_QS_PRI_LINK_VLD_MSK;
++	map->link_vld = link_vld ? HCLGE_TM_QS_PRI_LINK_VLD_MSK : 0;
+ 
+ 	return hclge_cmd_send(&hdev->hw, &desc, 1);
+ }
+@@ -642,11 +642,13 @@ static void hclge_tm_update_kinfo_rss_size(struct hclge_vport *vport)
+ 	 * one tc for VF for simplicity. VF's vport_id is non zero.
+ 	 */
+ 	if (vport->vport_id) {
++		kinfo->tc_info.max_tc = 1;
+ 		kinfo->tc_info.num_tc = 1;
+ 		vport->qs_offset = HNAE3_MAX_TC +
+ 				   vport->vport_id - HCLGE_VF_VPORT_START_NUM;
+ 		vport_max_rss_size = hdev->vf_rss_size_max;
+ 	} else {
++		kinfo->tc_info.max_tc = hdev->tc_max;
+ 		kinfo->tc_info.num_tc =
+ 			min_t(u16, vport->alloc_tqps, hdev->tm_info.num_tc);
+ 		vport->qs_offset = 0;
+@@ -714,14 +716,22 @@ static void hclge_tm_vport_info_update(struct hclge_dev *hdev)
+ 
+ static void hclge_tm_tc_info_init(struct hclge_dev *hdev)
+ {
+-	u8 i;
++	u8 i, tc_sch_mode;
++	u32 bw_limit;
++
++	for (i = 0; i < hdev->tc_max; i++) {
++		if (i < hdev->tm_info.num_tc) {
++			tc_sch_mode = HCLGE_SCH_MODE_DWRR;
++			bw_limit = hdev->tm_info.pg_info[0].bw_limit;
++		} else {
++			tc_sch_mode = HCLGE_SCH_MODE_SP;
++			bw_limit = 0;
++		}
+ 
+-	for (i = 0; i < hdev->tm_info.num_tc; i++) {
+ 		hdev->tm_info.tc_info[i].tc_id = i;
+-		hdev->tm_info.tc_info[i].tc_sch_mode = HCLGE_SCH_MODE_DWRR;
++		hdev->tm_info.tc_info[i].tc_sch_mode = tc_sch_mode;
+ 		hdev->tm_info.tc_info[i].pgid = 0;
+-		hdev->tm_info.tc_info[i].bw_limit =
+-			hdev->tm_info.pg_info[0].bw_limit;
++		hdev->tm_info.tc_info[i].bw_limit = bw_limit;
+ 	}
+ 
+ 	for (i = 0; i < HNAE3_MAX_USER_PRIO; i++)
+@@ -926,10 +936,13 @@ static int hclge_tm_pri_q_qs_cfg_tc_base(struct hclge_dev *hdev)
+ 	for (k = 0; k < hdev->num_alloc_vport; k++) {
+ 		struct hnae3_knic_private_info *kinfo = &vport[k].nic.kinfo;
+ 
+-		for (i = 0; i < kinfo->tc_info.num_tc; i++) {
++		for (i = 0; i < kinfo->tc_info.max_tc; i++) {
++			u8 pri = i < kinfo->tc_info.num_tc ? i : 0;
++			bool link_vld = i < kinfo->tc_info.num_tc;
++
+ 			ret = hclge_tm_qs_to_pri_map_cfg(hdev,
+ 							 vport[k].qs_offset + i,
+-							 i);
++							 pri, link_vld);
+ 			if (ret)
+ 				return ret;
+ 		}
+@@ -949,7 +962,7 @@ static int hclge_tm_pri_q_qs_cfg_vnet_base(struct hclge_dev *hdev)
+ 		for (i = 0; i < HNAE3_MAX_TC; i++) {
+ 			ret = hclge_tm_qs_to_pri_map_cfg(hdev,
+ 							 vport[k].qs_offset + i,
+-							 k);
++							 k, true);
+ 			if (ret)
+ 				return ret;
+ 		}
+@@ -989,33 +1002,39 @@ static int hclge_tm_pri_tc_base_shaper_cfg(struct hclge_dev *hdev)
+ {
+ 	u32 max_tm_rate = hdev->ae_dev->dev_specs.max_tm_rate;
+ 	struct hclge_shaper_ir_para ir_para;
+-	u32 shaper_para;
++	u32 shaper_para_c, shaper_para_p;
+ 	int ret;
+ 	u32 i;
+ 
+-	for (i = 0; i < hdev->tm_info.num_tc; i++) {
++	for (i = 0; i < hdev->tc_max; i++) {
+ 		u32 rate = hdev->tm_info.tc_info[i].bw_limit;
+ 
+-		ret = hclge_shaper_para_calc(rate, HCLGE_SHAPER_LVL_PRI,
+-					     &ir_para, max_tm_rate);
+-		if (ret)
+-			return ret;
++		if (rate) {
++			ret = hclge_shaper_para_calc(rate, HCLGE_SHAPER_LVL_PRI,
++						     &ir_para, max_tm_rate);
++			if (ret)
++				return ret;
++
++			shaper_para_c = hclge_tm_get_shapping_para(0, 0, 0,
++								   HCLGE_SHAPER_BS_U_DEF,
++								   HCLGE_SHAPER_BS_S_DEF);
++			shaper_para_p = hclge_tm_get_shapping_para(ir_para.ir_b,
++								   ir_para.ir_u,
++								   ir_para.ir_s,
++								   HCLGE_SHAPER_BS_U_DEF,
++								   HCLGE_SHAPER_BS_S_DEF);
++		} else {
++			shaper_para_c = 0;
++			shaper_para_p = 0;
++		}
+ 
+-		shaper_para = hclge_tm_get_shapping_para(0, 0, 0,
+-							 HCLGE_SHAPER_BS_U_DEF,
+-							 HCLGE_SHAPER_BS_S_DEF);
+ 		ret = hclge_tm_pri_shapping_cfg(hdev, HCLGE_TM_SHAP_C_BUCKET, i,
+-						shaper_para, rate);
++						shaper_para_c, rate);
+ 		if (ret)
+ 			return ret;
+ 
+-		shaper_para = hclge_tm_get_shapping_para(ir_para.ir_b,
+-							 ir_para.ir_u,
+-							 ir_para.ir_s,
+-							 HCLGE_SHAPER_BS_U_DEF,
+-							 HCLGE_SHAPER_BS_S_DEF);
+ 		ret = hclge_tm_pri_shapping_cfg(hdev, HCLGE_TM_SHAP_P_BUCKET, i,
+-						shaper_para, rate);
++						shaper_para_p, rate);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -1125,7 +1144,7 @@ static int hclge_tm_pri_tc_base_dwrr_cfg(struct hclge_dev *hdev)
+ 	int ret;
+ 	u32 i, k;
+ 
+-	for (i = 0; i < hdev->tm_info.num_tc; i++) {
++	for (i = 0; i < hdev->tc_max; i++) {
+ 		pg_info =
+ 			&hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid];
+ 		dwrr = pg_info->tc_dwrr[i];
+@@ -1135,9 +1154,15 @@ static int hclge_tm_pri_tc_base_dwrr_cfg(struct hclge_dev *hdev)
+ 			return ret;
+ 
+ 		for (k = 0; k < hdev->num_alloc_vport; k++) {
++			struct hnae3_knic_private_info *kinfo = &vport[k].nic.kinfo;
++
++			if (i >= kinfo->tc_info.max_tc)
++				continue;
++
++			dwrr = i < kinfo->tc_info.num_tc ? vport[k].dwrr : 0;
+ 			ret = hclge_tm_qs_weight_cfg(
+ 				hdev, vport[k].qs_offset + i,
+-				vport[k].dwrr);
++				dwrr);
+ 			if (ret)
+ 				return ret;
+ 		}
+@@ -1303,6 +1328,7 @@ static int hclge_tm_schd_mode_tc_base_cfg(struct hclge_dev *hdev, u8 pri_id)
+ {
+ 	struct hclge_vport *vport = hdev->vport;
+ 	int ret;
++	u8 mode;
+ 	u16 i;
+ 
+ 	ret = hclge_tm_pri_schd_mode_cfg(hdev, pri_id);
+@@ -1310,9 +1336,16 @@ static int hclge_tm_schd_mode_tc_base_cfg(struct hclge_dev *hdev, u8 pri_id)
+ 		return ret;
+ 
+ 	for (i = 0; i < hdev->num_alloc_vport; i++) {
++		struct hnae3_knic_private_info *kinfo = &vport[i].nic.kinfo;
++
++		if (pri_id >= kinfo->tc_info.max_tc)
++			continue;
++
++		mode = pri_id < kinfo->tc_info.num_tc ? HCLGE_SCH_MODE_DWRR :
++		       HCLGE_SCH_MODE_SP;
+ 		ret = hclge_tm_qs_schd_mode_cfg(hdev,
+ 						vport[i].qs_offset + pri_id,
+-						HCLGE_SCH_MODE_DWRR);
++						mode);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -1353,7 +1386,7 @@ static int hclge_tm_lvl34_schd_mode_cfg(struct hclge_dev *hdev)
+ 	u8 i;
+ 
+ 	if (hdev->tx_sch_mode == HCLGE_FLAG_TC_BASE_SCH_MODE) {
+-		for (i = 0; i < hdev->tm_info.num_tc; i++) {
++		for (i = 0; i < hdev->tc_max; i++) {
+ 			ret = hclge_tm_schd_mode_tc_base_cfg(hdev, i);
+ 			if (ret)
+ 				return ret;
diff --git a/0072-net-hns3-fix-PF-rss-size-initialization-bug.patch b/0072-net-hns3-fix-PF-rss-size-initialization-bug.patch
new file mode 100644
index 000000000000..05c2d65eb66e
--- /dev/null
+++ b/0072-net-hns3-fix-PF-rss-size-initialization-bug.patch
@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jie Wang <wangjie125@huawei.com>
+Date: Sat, 11 Jun 2022 20:25:28 +0800
+Subject: [PATCH] net: hns3: fix PF rss size initialization bug
+
+[ Upstream commit 71b215f36dca1a3d5d1c576b2099e6d7ea03047e ]
+
+Currently hns3 driver misuses the VF rss size to initialize the PF rss size
+in hclge_tm_vport_tc_info_update. So this patch fix it by checking the
+vport id before initialization.
+
+Fixes: 7347255ea389 ("net: hns3: refactor PF rss get APIs with new common rss get APIs")
+Signed-off-by: Jie Wang <wangjie125@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index ad53a344732211fe93b79a038a60917f1b447539..f5296ff60694480167502345785a37e13e1067c2 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -681,7 +681,9 @@ static void hclge_tm_vport_tc_info_update(struct hclge_vport *vport)
+ 	kinfo->num_tqps = hclge_vport_get_tqp_num(vport);
+ 	vport->dwrr = 100;  /* 100 percent as init */
+ 	vport->bw_limit = hdev->tm_info.pg_info[0].bw_limit;
+-	hdev->rss_cfg.rss_size = kinfo->rss_size;
++
++	if (vport->vport_id == PF_VPORT_ID)
++		hdev->rss_cfg.rss_size = kinfo->rss_size;
+ 
+ 	/* when enable mqprio, the tc_info has been updated. */
+ 	if (kinfo->tc_info.mqprio_active)
diff --git a/0073-net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch b/0073-net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch
new file mode 100644
index 000000000000..2bf7597f7a48
--- /dev/null
+++ b/0073-net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch
@@ -0,0 +1,89 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Guangbin Huang <huangguangbin2@huawei.com>
+Date: Sat, 11 Jun 2022 20:25:29 +0800
+Subject: [PATCH] net: hns3: fix tm port shapping of fibre port is incorrect
+ after driver initialization
+
+[ Upstream commit 12a3670887725df364cc3e030cf3bede6f13b364 ]
+
+Currently in driver initialization process, driver will set shapping
+parameters of tm port to default speed read from firmware. However, the
+speed of SFP module may not be default speed, so shapping parameters of
+tm port may be incorrect.
+
+To fix this problem, driver sets new shapping parameters for tm port
+after getting exact speed of SFP module in this case.
+
+Fixes: 88d10bd6f730 ("net: hns3: add support for multiple media type")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c   | 11 ++++++++---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c |  2 +-
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h |  1 +
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index c8c99ab60ec12f8efd9cd06b41528ace69cf4600..c0b4ff73128fc1b3ca9ded27f9c9ce22f9bec776 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3276,7 +3276,7 @@ static int hclge_tp_port_init(struct hclge_dev *hdev)
+ static int hclge_update_port_info(struct hclge_dev *hdev)
+ {
+ 	struct hclge_mac *mac = &hdev->hw.mac;
+-	int speed = HCLGE_MAC_SPEED_UNKNOWN;
++	int speed;
+ 	int ret;
+ 
+ 	/* get the port info from SFP cmd if not copper port */
+@@ -3287,10 +3287,13 @@ static int hclge_update_port_info(struct hclge_dev *hdev)
+ 	if (!hdev->support_sfp_query)
+ 		return 0;
+ 
+-	if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V2)
++	if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V2) {
++		speed = mac->speed;
+ 		ret = hclge_get_sfp_info(hdev, mac);
+-	else
++	} else {
++		speed = HCLGE_MAC_SPEED_UNKNOWN;
+ 		ret = hclge_get_sfp_speed(hdev, &speed);
++	}
+ 
+ 	if (ret == -EOPNOTSUPP) {
+ 		hdev->support_sfp_query = false;
+@@ -3302,6 +3305,8 @@ static int hclge_update_port_info(struct hclge_dev *hdev)
+ 	if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V2) {
+ 		if (mac->speed_type == QUERY_ACTIVE_SPEED) {
+ 			hclge_update_port_capability(hdev, mac);
++			if (mac->speed != speed)
++				(void)hclge_tm_port_shaper_cfg(hdev);
+ 			return 0;
+ 		}
+ 		return hclge_cfg_mac_speed_dup(hdev, mac->speed,
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index f5296ff60694480167502345785a37e13e1067c2..2f33b036a47a7ece9a99a86a988d50129f7ab2b4 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -420,7 +420,7 @@ static int hclge_tm_pg_shapping_cfg(struct hclge_dev *hdev,
+ 	return hclge_cmd_send(&hdev->hw, &desc, 1);
+ }
+ 
+-static int hclge_tm_port_shaper_cfg(struct hclge_dev *hdev)
++int hclge_tm_port_shaper_cfg(struct hclge_dev *hdev)
+ {
+ 	struct hclge_port_shapping_cmd *shap_cfg_cmd;
+ 	struct hclge_shaper_ir_para ir_para;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
+index 619cc30a2dfcc2804312b6d110818c10599287bd..d943943912f76522ec340f99b32180a07a224c12 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
+@@ -237,6 +237,7 @@ int hclge_pause_addr_cfg(struct hclge_dev *hdev, const u8 *mac_addr);
+ void hclge_pfc_rx_stats_get(struct hclge_dev *hdev, u64 *stats);
+ void hclge_pfc_tx_stats_get(struct hclge_dev *hdev, u64 *stats);
+ int hclge_tm_qs_shaper_cfg(struct hclge_vport *vport, int max_tx_rate);
++int hclge_tm_port_shaper_cfg(struct hclge_dev *hdev);
+ int hclge_tm_get_qset_num(struct hclge_dev *hdev, u16 *qset_num);
+ int hclge_tm_get_pri_num(struct hclge_dev *hdev, u8 *pri_num);
+ int hclge_tm_get_qset_map_pri(struct hclge_dev *hdev, u16 qset_id, u8 *priority,
diff --git a/0074-nvme-add-device-name-to-warning-in-uuid_show.patch b/0074-nvme-add-device-name-to-warning-in-uuid_show.patch
new file mode 100644
index 000000000000..a3c41bd81774
--- /dev/null
+++ b/0074-nvme-add-device-name-to-warning-in-uuid_show.patch
@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <linux@weissschuh.net>
+Date: Tue, 7 Jun 2022 17:55:55 +0200
+Subject: [PATCH] nvme: add device name to warning in uuid_show()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 1fc766b5c08417248e0008bca14c3572ac0f1c26 ]
+
+This provides more context to users.
+
+Old message:
+
+[   00.000000] No UUID available providing old NGUID
+
+New message:
+
+[   00.000000] block nvme0n1: No UUID available providing old NGUID
+
+Fixes: d934f9848a77 ("nvme: provide UUID value to userspace")
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 2d6a01853109ba4b0f0edbf1ef01c7e77757bb19..1ea85c88d7951748d42f75a8cba0e6da790a9996 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3226,8 +3226,8 @@ static ssize_t uuid_show(struct device *dev, struct device_attribute *attr,
+ 	 * we have no UUID set
+ 	 */
+ 	if (uuid_is_null(&ids->uuid)) {
+-		printk_ratelimited(KERN_WARNING
+-				   "No UUID available providing old NGUID\n");
++		dev_warn_ratelimited(dev,
++			"No UUID available providing old NGUID\n");
+ 		return sysfs_emit(buf, "%pU\n", ids->nguid);
+ 	}
+ 	return sysfs_emit(buf, "%pU\n", &ids->uuid);
diff --git a/0075-mlxsw-spectrum_cnt-Reorder-counter-pools.patch b/0075-mlxsw-spectrum_cnt-Reorder-counter-pools.patch
new file mode 100644
index 000000000000..8074d21359a8
--- /dev/null
+++ b/0075-mlxsw-spectrum_cnt-Reorder-counter-pools.patch
@@ -0,0 +1,46 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Petr Machata <petrm@nvidia.com>
+Date: Mon, 13 Jun 2022 15:50:17 +0300
+Subject: [PATCH] mlxsw: spectrum_cnt: Reorder counter pools
+
+[ Upstream commit 4b7a632ac4e7101ceefee8484d5c2ca505d347b3 ]
+
+Both RIF and ACL flow counters use a 24-bit SW-managed counter address to
+communicate which counter they want to bind.
+
+In a number of Spectrum FW releases, binding a RIF counter is broken and
+slices the counter index to 16 bits. As a result, on Spectrum-2 and above,
+no more than about 410 RIF counters can be effectively used. This
+translates to 205 netdevices for which L3 HW stats can be enabled. (This
+does not happen on Spectrum-1, because there are fewer counters available
+overall and the counter index never exceeds 16 bits.)
+
+Binding counters to ACLs does not have this issue. Therefore reorder the
+counter allocation scheme so that RIF counters come first and therefore get
+lower indices that are below the 16-bit barrier.
+
+Fixes: 98e60dce4da1 ("Merge branch 'mlxsw-Introduce-initial-Spectrum-2-support'")
+Reported-by: Maksym Yaremchuk <maksymy@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://lore.kernel.org/r/20220613125017.2018162-1-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h
+index a68d931090dd5824f3a865c24d6bf6748c0c0b95..15c8d4de83508a591ae6108a93758a648442c6fc 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h
+@@ -8,8 +8,8 @@
+ #include "spectrum.h"
+ 
+ enum mlxsw_sp_counter_sub_pool_id {
+-	MLXSW_SP_COUNTER_SUB_POOL_FLOW,
+ 	MLXSW_SP_COUNTER_SUB_POOL_RIF,
++	MLXSW_SP_COUNTER_SUB_POOL_FLOW,
+ };
+ 
+ int mlxsw_sp_counter_alloc(struct mlxsw_sp *mlxsw_sp,
diff --git a/0076-ice-Fix-PTP-TX-timestamp-offset-calculation.patch b/0076-ice-Fix-PTP-TX-timestamp-offset-calculation.patch
new file mode 100644
index 000000000000..70ed76ac92c1
--- /dev/null
+++ b/0076-ice-Fix-PTP-TX-timestamp-offset-calculation.patch
@@ -0,0 +1,84 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michal Michalik <michal.michalik@intel.com>
+Date: Tue, 10 May 2022 13:03:43 +0200
+Subject: [PATCH] ice: Fix PTP TX timestamp offset calculation
+
+[ Upstream commit 71a579f0d3777a704355e6f1572dfba92a9b58b2 ]
+
+The offset was being incorrectly calculated for E822 - that led to
+collisions in choosing TX timestamp register location when more than
+one port was trying to use timestamping mechanism.
+
+In E822 one quad is being logically split between ports, so quad 0 is
+having trackers for ports 0-3, quad 1 ports 4-7 etc. Each port should
+have separate memory location for tracking timestamps. Due to error for
+example ports 1 and 2 had been assigned to quad 0 with same offset (0),
+while port 1 should have offset 0 and 1 offset 16.
+
+Fix it by correctly calculating quad offset.
+
+Fixes: 3a7496234d17 ("ice: implement basic E822 PTP support")
+Signed-off-by: Michal Michalik <michal.michalik@intel.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ptp.c |  2 +-
+ drivers/net/ethernet/intel/ice/ice_ptp.h | 31 ++++++++++++++++++++++++
+ 2 files changed, 32 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
+index 662947c882e8b1c84439eec7310a55c4893395ea..ef9344ef0d8e46654aae8b46b3e1cf6fb58a9222 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
+@@ -2271,7 +2271,7 @@ static int
+ ice_ptp_init_tx_e822(struct ice_pf *pf, struct ice_ptp_tx *tx, u8 port)
+ {
+ 	tx->quad = port / ICE_PORTS_PER_QUAD;
+-	tx->quad_offset = tx->quad * INDEX_PER_PORT;
++	tx->quad_offset = (port % ICE_PORTS_PER_QUAD) * INDEX_PER_PORT;
+ 	tx->len = INDEX_PER_PORT;
+ 
+ 	return ice_ptp_alloc_tx_tracker(tx);
+diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.h b/drivers/net/ethernet/intel/ice/ice_ptp.h
+index afd048d699598170cc5850e21cb80e5206710ae5..10e396abf13094cc633b5baf8a05124b94a18534 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.h
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.h
+@@ -49,6 +49,37 @@ struct ice_perout_channel {
+  * To allow multiple ports to access the shared register block independently,
+  * the blocks are split up so that indexes are assigned to each port based on
+  * hardware logical port number.
++ *
++ * The timestamp blocks are handled differently for E810- and E822-based
++ * devices. In E810 devices, each port has its own block of timestamps, while in
++ * E822 there is a need to logically break the block of registers into smaller
++ * chunks based on the port number to avoid collisions.
++ *
++ * Example for port 5 in E810:
++ *  +--------+--------+--------+--------+--------+--------+--------+--------+
++ *  |register|register|register|register|register|register|register|register|
++ *  | block  | block  | block  | block  | block  | block  | block  | block  |
++ *  |  for   |  for   |  for   |  for   |  for   |  for   |  for   |  for   |
++ *  | port 0 | port 1 | port 2 | port 3 | port 4 | port 5 | port 6 | port 7 |
++ *  +--------+--------+--------+--------+--------+--------+--------+--------+
++ *                                               ^^
++ *                                               ||
++ *                                               |---  quad offset is always 0
++ *                                               ---- quad number
++ *
++ * Example for port 5 in E822:
++ * +-----------------------------+-----------------------------+
++ * |  register block for quad 0  |  register block for quad 1  |
++ * |+------+------+------+------+|+------+------+------+------+|
++ * ||port 0|port 1|port 2|port 3|||port 0|port 1|port 2|port 3||
++ * |+------+------+------+------+|+------+------+------+------+|
++ * +-----------------------------+-------^---------------------+
++ *                                ^      |
++ *                                |      --- quad offset*
++ *                                ---- quad number
++ *
++ *   * PHY port 5 is port 1 in quad 1
++ *
+  */
+ 
+ /**
diff --git a/0077-ice-Sync-VLAN-filtering-features-for-DVM.patch b/0077-ice-Sync-VLAN-filtering-features-for-DVM.patch
new file mode 100644
index 000000000000..877ccf0c3919
--- /dev/null
+++ b/0077-ice-Sync-VLAN-filtering-features-for-DVM.patch
@@ -0,0 +1,85 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Roman Storozhenko <roman.storozhenko@intel.com>
+Date: Tue, 7 Jun 2022 08:54:57 +0200
+Subject: [PATCH] ice: Sync VLAN filtering features for DVM
+
+[ Upstream commit 9542ef4fba8c73e176b8aa18a8adf04aecb889e5 ]
+
+VLAN filtering features, that is C-Tag and S-Tag, in DVM mode must be
+both enabled or disabled.
+In case of turning off/on only one of the features, another feature must
+be turned off/on automatically with issuing an appropriate message to
+the kernel log.
+
+Fixes: 1babaf77f49d ("ice: Advertise 802.1ad VLAN filtering and offloads for PF netdev")
+Signed-off-by: Roman Storozhenko <roman.storozhenko@intel.com>
+Co-developed-by: Anatolii Gerasymenko <anatolii.gerasymenko@intel.com>
+Signed-off-by: Anatolii Gerasymenko <anatolii.gerasymenko@intel.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 49 ++++++++++++++---------
+ 1 file changed, 31 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 963a5f40e071b5bb68e15e357e500fc54948051d..d069b19f9bf7faf58ce9da225c5aed54be2b663a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -5746,25 +5746,38 @@ static netdev_features_t
+ ice_fix_features(struct net_device *netdev, netdev_features_t features)
+ {
+ 	struct ice_netdev_priv *np = netdev_priv(netdev);
+-	netdev_features_t supported_vlan_filtering;
+-	netdev_features_t requested_vlan_filtering;
+-	struct ice_vsi *vsi = np->vsi;
+-
+-	requested_vlan_filtering = features & NETIF_VLAN_FILTERING_FEATURES;
+-
+-	/* make sure supported_vlan_filtering works for both SVM and DVM */
+-	supported_vlan_filtering = NETIF_F_HW_VLAN_CTAG_FILTER;
+-	if (ice_is_dvm_ena(&vsi->back->hw))
+-		supported_vlan_filtering |= NETIF_F_HW_VLAN_STAG_FILTER;
+-
+-	if (requested_vlan_filtering &&
+-	    requested_vlan_filtering != supported_vlan_filtering) {
+-		if (requested_vlan_filtering & NETIF_F_HW_VLAN_CTAG_FILTER) {
+-			netdev_warn(netdev, "cannot support requested VLAN filtering settings, enabling all supported VLAN filtering settings\n");
+-			features |= supported_vlan_filtering;
++	netdev_features_t req_vlan_fltr, cur_vlan_fltr;
++	bool cur_ctag, cur_stag, req_ctag, req_stag;
++
++	cur_vlan_fltr = netdev->features & NETIF_VLAN_FILTERING_FEATURES;
++	cur_ctag = cur_vlan_fltr & NETIF_F_HW_VLAN_CTAG_FILTER;
++	cur_stag = cur_vlan_fltr & NETIF_F_HW_VLAN_STAG_FILTER;
++
++	req_vlan_fltr = features & NETIF_VLAN_FILTERING_FEATURES;
++	req_ctag = req_vlan_fltr & NETIF_F_HW_VLAN_CTAG_FILTER;
++	req_stag = req_vlan_fltr & NETIF_F_HW_VLAN_STAG_FILTER;
++
++	if (req_vlan_fltr != cur_vlan_fltr) {
++		if (ice_is_dvm_ena(&np->vsi->back->hw)) {
++			if (req_ctag && req_stag) {
++				features |= NETIF_VLAN_FILTERING_FEATURES;
++			} else if (!req_ctag && !req_stag) {
++				features &= ~NETIF_VLAN_FILTERING_FEATURES;
++			} else if ((!cur_ctag && req_ctag && !cur_stag) ||
++				   (!cur_stag && req_stag && !cur_ctag)) {
++				features |= NETIF_VLAN_FILTERING_FEATURES;
++				netdev_warn(netdev,  "802.1Q and 802.1ad VLAN filtering must be either both on or both off. VLAN filtering has been enabled for both types.\n");
++			} else if ((cur_ctag && !req_ctag && cur_stag) ||
++				   (cur_stag && !req_stag && cur_ctag)) {
++				features &= ~NETIF_VLAN_FILTERING_FEATURES;
++				netdev_warn(netdev,  "802.1Q and 802.1ad VLAN filtering must be either both on or both off. VLAN filtering has been disabled for both types.\n");
++			}
+ 		} else {
+-			netdev_warn(netdev, "cannot support requested VLAN filtering settings, clearing all supported VLAN filtering settings\n");
+-			features &= ~supported_vlan_filtering;
++			if (req_vlan_fltr & NETIF_F_HW_VLAN_STAG_FILTER)
++				netdev_warn(netdev, "cannot support requested 802.1ad filtering setting in SVM mode\n");
++
++			if (req_vlan_fltr & NETIF_F_HW_VLAN_CTAG_FILTER)
++				features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+ 		}
+ 	}
+ 
diff --git a/0078-ice-Fix-queue-config-fail-handling.patch b/0078-ice-Fix-queue-config-fail-handling.patch
new file mode 100644
index 000000000000..9502a044d2cc
--- /dev/null
+++ b/0078-ice-Fix-queue-config-fail-handling.patch
@@ -0,0 +1,160 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Date: Thu, 2 Jun 2022 12:09:04 +0200
+Subject: [PATCH] ice: Fix queue config fail handling
+
+[ Upstream commit be2af71496a54a7195ac62caba6fab49cfe5006c ]
+
+Disable VF's RX/TX queues, when VIRTCHNL_OP_CONFIG_VSI_QUEUES fail.
+Not disabling them might lead to scenario, where PF driver leaves VF
+queues enabled, when VF's VSI failed queue config.
+In this scenario VF should not have RX/TX queues enabled. If PF failed
+to set up VF's queues, VF will reset due to TX timeouts in VF driver.
+Initialize iterator 'i' to -1, so if error happens prior to configuring
+queues then error path code will not disable queue 0. Loop that
+configures queues will is using same iterator, so error path code will
+only disable queues that were configured.
+
+Fixes: 77ca27c41705 ("ice: add support for virtchnl_queue_select.[tx|rx]_queues bitmap")
+Suggested-by: Slawomir Laba <slawomirx.laba@intel.com>
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_virtchnl.c | 53 +++++++++----------
+ 1 file changed, 26 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+index 5405a0e752cf72d6bbcc77136a479e91ecb32265..da7c5ce15be0d0fcf3003f4ef9fc444356bdfad7 100644
+--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c
++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+@@ -1587,35 +1587,27 @@ static int ice_vc_cfg_irq_map_msg(struct ice_vf *vf, u8 *msg)
+  */
+ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ {
+-	enum virtchnl_status_code v_ret = VIRTCHNL_STATUS_SUCCESS;
+ 	struct virtchnl_vsi_queue_config_info *qci =
+ 	    (struct virtchnl_vsi_queue_config_info *)msg;
+ 	struct virtchnl_queue_pair_info *qpi;
+ 	struct ice_pf *pf = vf->pf;
+ 	struct ice_vsi *vsi;
+-	int i, q_idx;
++	int i = -1, q_idx;
+ 
+-	if (!test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) {
+-		v_ret = VIRTCHNL_STATUS_ERR_PARAM;
++	if (!test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states))
+ 		goto error_param;
+-	}
+ 
+-	if (!ice_vc_isvalid_vsi_id(vf, qci->vsi_id)) {
+-		v_ret = VIRTCHNL_STATUS_ERR_PARAM;
++	if (!ice_vc_isvalid_vsi_id(vf, qci->vsi_id))
+ 		goto error_param;
+-	}
+ 
+ 	vsi = ice_get_vf_vsi(vf);
+-	if (!vsi) {
+-		v_ret = VIRTCHNL_STATUS_ERR_PARAM;
++	if (!vsi)
+ 		goto error_param;
+-	}
+ 
+ 	if (qci->num_queue_pairs > ICE_MAX_RSS_QS_PER_VF ||
+ 	    qci->num_queue_pairs > min_t(u16, vsi->alloc_txq, vsi->alloc_rxq)) {
+ 		dev_err(ice_pf_to_dev(pf), "VF-%d requesting more than supported number of queues: %d\n",
+ 			vf->vf_id, min_t(u16, vsi->alloc_txq, vsi->alloc_rxq));
+-		v_ret = VIRTCHNL_STATUS_ERR_PARAM;
+ 		goto error_param;
+ 	}
+ 
+@@ -1628,7 +1620,6 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 		    !ice_vc_isvalid_ring_len(qpi->txq.ring_len) ||
+ 		    !ice_vc_isvalid_ring_len(qpi->rxq.ring_len) ||
+ 		    !ice_vc_isvalid_q_id(vf, qci->vsi_id, qpi->txq.queue_id)) {
+-			v_ret = VIRTCHNL_STATUS_ERR_PARAM;
+ 			goto error_param;
+ 		}
+ 
+@@ -1638,7 +1629,6 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 		 * for selected "vsi"
+ 		 */
+ 		if (q_idx >= vsi->alloc_txq || q_idx >= vsi->alloc_rxq) {
+-			v_ret = VIRTCHNL_STATUS_ERR_PARAM;
+ 			goto error_param;
+ 		}
+ 
+@@ -1648,14 +1638,13 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 			vsi->tx_rings[i]->count = qpi->txq.ring_len;
+ 
+ 			/* Disable any existing queue first */
+-			if (ice_vf_vsi_dis_single_txq(vf, vsi, q_idx)) {
+-				v_ret = VIRTCHNL_STATUS_ERR_PARAM;
++			if (ice_vf_vsi_dis_single_txq(vf, vsi, q_idx))
+ 				goto error_param;
+-			}
+ 
+ 			/* Configure a queue with the requested settings */
+ 			if (ice_vsi_cfg_single_txq(vsi, vsi->tx_rings, q_idx)) {
+-				v_ret = VIRTCHNL_STATUS_ERR_PARAM;
++				dev_warn(ice_pf_to_dev(pf), "VF-%d failed to configure TX queue %d\n",
++					 vf->vf_id, i);
+ 				goto error_param;
+ 			}
+ 		}
+@@ -1669,17 +1658,13 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 
+ 			if (qpi->rxq.databuffer_size != 0 &&
+ 			    (qpi->rxq.databuffer_size > ((16 * 1024) - 128) ||
+-			     qpi->rxq.databuffer_size < 1024)) {
+-				v_ret = VIRTCHNL_STATUS_ERR_PARAM;
++			     qpi->rxq.databuffer_size < 1024))
+ 				goto error_param;
+-			}
+ 			vsi->rx_buf_len = qpi->rxq.databuffer_size;
+ 			vsi->rx_rings[i]->rx_buf_len = vsi->rx_buf_len;
+ 			if (qpi->rxq.max_pkt_size > max_frame_size ||
+-			    qpi->rxq.max_pkt_size < 64) {
+-				v_ret = VIRTCHNL_STATUS_ERR_PARAM;
++			    qpi->rxq.max_pkt_size < 64)
+ 				goto error_param;
+-			}
+ 
+ 			vsi->max_frame = qpi->rxq.max_pkt_size;
+ 			/* add space for the port VLAN since the VF driver is
+@@ -1690,16 +1675,30 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 				vsi->max_frame += VLAN_HLEN;
+ 
+ 			if (ice_vsi_cfg_single_rxq(vsi, q_idx)) {
+-				v_ret = VIRTCHNL_STATUS_ERR_PARAM;
++				dev_warn(ice_pf_to_dev(pf), "VF-%d failed to configure RX queue %d\n",
++					 vf->vf_id, i);
+ 				goto error_param;
+ 			}
+ 		}
+ 	}
+ 
++	/* send the response to the VF */
++	return ice_vc_send_msg_to_vf(vf, VIRTCHNL_OP_CONFIG_VSI_QUEUES,
++				     VIRTCHNL_STATUS_SUCCESS, NULL, 0);
+ error_param:
++	/* disable whatever we can */
++	for (; i >= 0; i--) {
++		if (ice_vsi_ctrl_one_rx_ring(vsi, false, i, true))
++			dev_err(ice_pf_to_dev(pf), "VF-%d could not disable RX queue %d\n",
++				vf->vf_id, i);
++		if (ice_vf_vsi_dis_single_txq(vf, vsi, i))
++			dev_err(ice_pf_to_dev(pf), "VF-%d could not disable TX queue %d\n",
++				vf->vf_id, i);
++	}
++
+ 	/* send the response to the VF */
+-	return ice_vc_send_msg_to_vf(vf, VIRTCHNL_OP_CONFIG_VSI_QUEUES, v_ret,
+-				     NULL, 0);
++	return ice_vc_send_msg_to_vf(vf, VIRTCHNL_OP_CONFIG_VSI_QUEUES,
++				     VIRTCHNL_STATUS_ERR_PARAM, NULL, 0);
+ }
+ 
+ /**
diff --git a/0079-ice-Fix-memory-corruption-in-VF-driver.patch b/0079-ice-Fix-memory-corruption-in-VF-driver.patch
new file mode 100644
index 000000000000..133210f551d4
--- /dev/null
+++ b/0079-ice-Fix-memory-corruption-in-VF-driver.patch
@@ -0,0 +1,79 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Date: Thu, 2 Jun 2022 12:09:17 +0200
+Subject: [PATCH] ice: Fix memory corruption in VF driver
+
+[ Upstream commit efe41860008e57fb6b69855b4b93fdf34bc42798 ]
+
+Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled,
+when it requests a reset. If PF driver assumes that VF is disabled,
+while VF still has queues configured, VF may unmap DMA resources.
+In such scenario device still can map packets to memory, which ends up
+silently corrupting it.
+Previously, VF driver could experience memory corruption, which lead to
+crash:
+[ 5119.170157] BUG: unable to handle kernel paging request at 00001b9780003237
+[ 5119.170166] PGD 0 P4D 0
+[ 5119.170173] Oops: 0002 [#1] PREEMPT_RT SMP PTI
+[ 5119.170181] CPU: 30 PID: 427592 Comm: kworker/u96:2 Kdump: loaded Tainted: G        W I      --------- -  - 4.18.0-372.9.1.rt7.166.el8.x86_64 #1
+[ 5119.170189] Hardware name: Dell Inc. PowerEdge R740/014X06, BIOS 2.3.10 08/15/2019
+[ 5119.170193] Workqueue: iavf iavf_adminq_task [iavf]
+[ 5119.170219] RIP: 0010:__page_frag_cache_drain+0x5/0x30
+[ 5119.170238] Code: 0f 0f b6 77 51 85 f6 74 07 31 d2 e9 05 df ff ff e9 90 fe ff ff 48 8b 05 49 db 33 01 eb b4 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <f0> 29 77 34 74 01 c3 48 8b 07 f6 c4 80 74 0f 0f b6 77 51 85 f6 74
+[ 5119.170244] RSP: 0018:ffffa43b0bdcfd78 EFLAGS: 00010282
+[ 5119.170250] RAX: ffffffff896b3e40 RBX: ffff8fb282524000 RCX: 0000000000000002
+[ 5119.170254] RDX: 0000000049000000 RSI: 0000000000000000 RDI: 00001b9780003203
+[ 5119.170259] RBP: ffff8fb248217b00 R08: 0000000000000022 R09: 0000000000000009
+[ 5119.170262] R10: 2b849d6300000000 R11: 0000000000000020 R12: 0000000000000000
+[ 5119.170265] R13: 0000000000001000 R14: 0000000000000009 R15: 0000000000000000
+[ 5119.170269] FS:  0000000000000000(0000) GS:ffff8fb1201c0000(0000) knlGS:0000000000000000
+[ 5119.170274] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5119.170279] CR2: 00001b9780003237 CR3: 00000008f3e1a003 CR4: 00000000007726e0
+[ 5119.170283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 5119.170286] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 5119.170290] PKRU: 55555554
+[ 5119.170292] Call Trace:
+[ 5119.170298]  iavf_clean_rx_ring+0xad/0x110 [iavf]
+[ 5119.170324]  iavf_free_rx_resources+0xe/0x50 [iavf]
+[ 5119.170342]  iavf_free_all_rx_resources.part.51+0x30/0x40 [iavf]
+[ 5119.170358]  iavf_virtchnl_completion+0xd8a/0x15b0 [iavf]
+[ 5119.170377]  ? iavf_clean_arq_element+0x210/0x280 [iavf]
+[ 5119.170397]  iavf_adminq_task+0x126/0x2e0 [iavf]
+[ 5119.170416]  process_one_work+0x18f/0x420
+[ 5119.170429]  worker_thread+0x30/0x370
+[ 5119.170437]  ? process_one_work+0x420/0x420
+[ 5119.170445]  kthread+0x151/0x170
+[ 5119.170452]  ? set_kthread_struct+0x40/0x40
+[ 5119.170460]  ret_from_fork+0x35/0x40
+[ 5119.170477] Modules linked in: iavf sctp ip6_udp_tunnel udp_tunnel mlx4_en mlx4_core nfp tls vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache sunrpc intel_rapl_msr iTCO_wdt iTCO_vendor_support dell_smbios wmi_bmof dell_wmi_descriptor dcdbas kvm_intel kvm irqbypass intel_rapl_common isst_if_common skx_edac irdma nfit libnvdimm x86_pkg_temp_thermal i40e intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ib_uverbs rapl ipmi_ssif intel_cstate intel_uncore mei_me pcspkr acpi_ipmi ib_core mei lpc_ich i2c_i801 ipmi_si ipmi_devintf wmi ipmi_msghandler acpi_power_meter xfs libcrc32c sd_mod t10_pi sg mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ice ahci drm libahci crc32c_intel libata tg3 megaraid_sas
+[ 5119.170613]  i2c_algo_bit dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: iavf]
+[ 5119.170627] CR2: 00001b9780003237
+
+Fixes: ec4f5a436bdf ("ice: Check if VF is disabled for Opcode and other operations")
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Co-developed-by: Slawomir Laba <slawomirx.laba@intel.com>
+Signed-off-by: Slawomir Laba <slawomirx.laba@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_vf_lib.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
+index aefd66a4db80da8267fbf2121ae22173d6cb26e2..9790df872c2ae922dccda5bf7793edbb56fa8365 100644
+--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
+@@ -504,6 +504,11 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags)
+ 	}
+ 
+ 	if (ice_is_vf_disabled(vf)) {
++		vsi = ice_get_vf_vsi(vf);
++		if (WARN_ON(!vsi))
++			return -EINVAL;
++		ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, vf->vf_id);
++		ice_vsi_stop_all_rx_rings(vsi);
+ 		dev_dbg(dev, "VF is already disabled, there is no need for resetting it, telling VM, all is fine %d\n",
+ 			vf->vf_id);
+ 		return 0;
diff --git a/0080-net-bgmac-Fix-an-erroneous-kfree-in-bgmac_remove.patch b/0080-net-bgmac-Fix-an-erroneous-kfree-in-bgmac_remove.patch
new file mode 100644
index 000000000000..1689f12245a9
--- /dev/null
+++ b/0080-net-bgmac-Fix-an-erroneous-kfree-in-bgmac_remove.patch
@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Mon, 13 Jun 2022 22:53:50 +0200
+Subject: [PATCH] net: bgmac: Fix an erroneous kfree() in bgmac_remove()
+
+[ Upstream commit d7dd6eccfbc95ac47a12396f84e7e1b361db654b ]
+
+'bgmac' is part of a managed resource allocated with bgmac_alloc(). It
+should not be freed explicitly.
+
+Remove the erroneous kfree() from the .remove() function.
+
+Fixes: 34a5102c3235 ("net: bgmac: allocate struct bgmac just once & don't copy it")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/a026153108dd21239036a032b95c25b5cece253b.1655153616.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bgmac-bcma.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+index e6f48786949c0fb5ed7db717df15db4fb622feb2..02bd3cf9a260e2342558dc7b559dd4df4db0afd4 100644
+--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+@@ -332,7 +332,6 @@ static void bgmac_remove(struct bcma_device *core)
+ 	bcma_mdio_mii_unregister(bgmac->mii_bus);
+ 	bgmac_enet_remove(bgmac);
+ 	bcma_set_drvdata(core, NULL);
+-	kfree(bgmac);
+ }
+ 
+ static struct bcma_driver bgmac_bcma_driver = {
diff --git a/0081-net-remove-noblock-parameter-from-skb_recv_datagram.patch b/0081-net-remove-noblock-parameter-from-skb_recv_datagram.patch
new file mode 100644
index 000000000000..4a5e5a367153
--- /dev/null
+++ b/0081-net-remove-noblock-parameter-from-skb_recv_datagram.patch
@@ -0,0 +1,711 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Mon, 4 Apr 2022 18:30:22 +0200
+Subject: [PATCH] net: remove noblock parameter from skb_recv_datagram()
+
+[ Upstream commit f4b41f062c424209e3939a81e6da022e049a45f2 ]
+
+skb_recv_datagram() has two parameters 'flags' and 'noblock' that are
+merged inside skb_recv_datagram() by 'flags | (noblock ? MSG_DONTWAIT : 0)'
+
+As 'flags' may contain MSG_DONTWAIT as value most callers split the 'flags'
+into 'flags' and 'noblock' with finally obsolete bit operations like this:
+
+skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &rc);
+
+And this is not even done consistently with the 'flags' parameter.
+
+This patch removes the obsolete and costly splitting into two parameters
+and only performs bit operations when really needed on the caller side.
+
+One missing conversion thankfully reported by kernel test robot. I missed
+to enable kunit tests to build the mctp code.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/mISDN/socket.c    | 2 +-
+ drivers/net/ppp/pppoe.c        | 3 +--
+ include/linux/skbuff.h         | 3 +--
+ net/appletalk/ddp.c            | 3 +--
+ net/atm/common.c               | 2 +-
+ net/ax25/af_ax25.c             | 3 +--
+ net/bluetooth/af_bluetooth.c   | 3 +--
+ net/bluetooth/hci_sock.c       | 3 +--
+ net/caif/caif_socket.c         | 2 +-
+ net/can/bcm.c                  | 5 +----
+ net/can/isotp.c                | 4 +---
+ net/can/j1939/socket.c         | 2 +-
+ net/can/raw.c                  | 6 +-----
+ net/core/datagram.c            | 5 ++---
+ net/ieee802154/socket.c        | 6 ++++--
+ net/ipv4/ping.c                | 3 ++-
+ net/ipv4/raw.c                 | 3 ++-
+ net/ipv6/raw.c                 | 3 ++-
+ net/iucv/af_iucv.c             | 3 +--
+ net/key/af_key.c               | 2 +-
+ net/l2tp/l2tp_ip.c             | 3 ++-
+ net/l2tp/l2tp_ip6.c            | 3 ++-
+ net/l2tp/l2tp_ppp.c            | 3 +--
+ net/mctp/af_mctp.c             | 2 +-
+ net/mctp/test/route-test.c     | 8 ++++----
+ net/netlink/af_netlink.c       | 3 +--
+ net/netrom/af_netrom.c         | 3 ++-
+ net/nfc/llcp_sock.c            | 3 +--
+ net/nfc/rawsock.c              | 3 +--
+ net/packet/af_packet.c         | 2 +-
+ net/phonet/datagram.c          | 3 ++-
+ net/phonet/pep.c               | 6 ++++--
+ net/qrtr/af_qrtr.c             | 3 +--
+ net/rose/af_rose.c             | 3 ++-
+ net/unix/af_unix.c             | 5 +++--
+ net/vmw_vsock/vmci_transport.c | 5 +----
+ net/x25/af_x25.c               | 3 +--
+ 37 files changed, 57 insertions(+), 70 deletions(-)
+
+diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
+index a6606736d8c5033aeccf48d2692e63832796a9fc..2776ca5fc33f39019062b3d9fb8f02547a5e4139 100644
+--- a/drivers/isdn/mISDN/socket.c
++++ b/drivers/isdn/mISDN/socket.c
+@@ -121,7 +121,7 @@ mISDN_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 	if (sk->sk_state == MISDN_CLOSED)
+ 		return 0;
+ 
+-	skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		return err;
+ 
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index e172743948ed777d4672b85f3584e1f03ba3bd53..ce2cbb5903d7bc9ae490fc1cc290556f631d1e33 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -1012,8 +1012,7 @@ static int pppoe_recvmsg(struct socket *sock, struct msghdr *m,
+ 		goto end;
+ 	}
+ 
+-	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
+-				flags & MSG_DONTWAIT, &error);
++	skb = skb_recv_datagram(sk, flags, &error);
+ 	if (error < 0)
+ 		goto end;
+ 
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 3a30cae8b0a55da8657b060bdddee6ad9e853f66..2394441fa3dd5e256e66ca2d424f30b0a47263ae 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -3836,8 +3836,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk,
+ struct sk_buff *__skb_recv_datagram(struct sock *sk,
+ 				    struct sk_buff_head *sk_queue,
+ 				    unsigned int flags, int *off, int *err);
+-struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock,
+-				  int *err);
++struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned int flags, int *err);
+ __poll_t datagram_poll(struct file *file, struct socket *sock,
+ 			   struct poll_table_struct *wait);
+ int skb_copy_datagram_iter(const struct sk_buff *from, int offset,
+diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
+index bf5736c1d4584ec977586eae44d36db0042f7132..a06f4d4a6f476a651abe9c1ad67eac0cb8a0264f 100644
+--- a/net/appletalk/ddp.c
++++ b/net/appletalk/ddp.c
+@@ -1753,8 +1753,7 @@ static int atalk_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	int err = 0;
+ 	struct sk_buff *skb;
+ 
+-	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
+-						flags & MSG_DONTWAIT, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	lock_sock(sk);
+ 
+ 	if (!skb)
+diff --git a/net/atm/common.c b/net/atm/common.c
+index 1cfa9bf1d18713afc7191ddecb256bfb3844154e..d0c8ab7ff8f6a8eaef31d2626739f3225ac59ad5 100644
+--- a/net/atm/common.c
++++ b/net/atm/common.c
+@@ -540,7 +540,7 @@ int vcc_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	    !test_bit(ATM_VF_READY, &vcc->flags))
+ 		return 0;
+ 
+-	skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &error);
++	skb = skb_recv_datagram(sk, flags, &error);
+ 	if (!skb)
+ 		return error;
+ 
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 289f355e18531e4a7ab954b1e2f45138dbf7b1bd..95393bb2760b3e322d531679451c81e2a3877b29 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -1676,8 +1676,7 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	}
+ 
+ 	/* Now we can treat all alike */
+-	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
+-				flags & MSG_DONTWAIT, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (skb == NULL)
+ 		goto out;
+ 
+diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
+index a0cb2e3da8d4c05b5c0198da2dce3c270109ce26..62705734343b61a03c1669286d6adc4bf2856ec4 100644
+--- a/net/bluetooth/af_bluetooth.c
++++ b/net/bluetooth/af_bluetooth.c
+@@ -251,7 +251,6 @@ EXPORT_SYMBOL(bt_accept_dequeue);
+ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 		    int flags)
+ {
+-	int noblock = flags & MSG_DONTWAIT;
+ 	struct sock *sk = sock->sk;
+ 	struct sk_buff *skb;
+ 	size_t copied;
+@@ -263,7 +262,7 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_OOB)
+ 		return -EOPNOTSUPP;
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb) {
+ 		if (sk->sk_shutdown & RCV_SHUTDOWN)
+ 			return 0;
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index 33b3c0ffc3399dbb6eab07a7b378b9441647116d..189e3115c8c62c947872d62b8b0744d8b96d8620 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -1453,7 +1453,6 @@ static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
+ static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 			    size_t len, int flags)
+ {
+-	int noblock = flags & MSG_DONTWAIT;
+ 	struct sock *sk = sock->sk;
+ 	struct sk_buff *skb;
+ 	int copied, err;
+@@ -1470,7 +1469,7 @@ static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 	if (sk->sk_state == BT_CLOSED)
+ 		return 0;
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		return err;
+ 
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 2b8892d502f7f67fd140c5b40da28b749359fb4d..251e666ba9a28d0f4f480995dec252592d481b97 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -282,7 +282,7 @@ static int caif_seqpkt_recvmsg(struct socket *sock, struct msghdr *m,
+ 	if (flags & MSG_OOB)
+ 		goto read_error;
+ 
+-	skb = skb_recv_datagram(sk, flags, 0 , &ret);
++	skb = skb_recv_datagram(sk, flags, &ret);
+ 	if (!skb)
+ 		goto read_error;
+ 	copylen = skb->len;
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 95d209b52e6a6df1b3df9504afc2c486c8271961..64c07e650bb412cf11ebb4a9cdcefa00f4e9fcc8 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -1632,12 +1632,9 @@ static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	struct sock *sk = sock->sk;
+ 	struct sk_buff *skb;
+ 	int error = 0;
+-	int noblock;
+ 	int err;
+ 
+-	noblock =  flags & MSG_DONTWAIT;
+-	flags   &= ~MSG_DONTWAIT;
+-	skb = skb_recv_datagram(sk, flags, noblock, &error);
++	skb = skb_recv_datagram(sk, flags, &error);
+ 	if (!skb)
+ 		return error;
+ 
+diff --git a/net/can/isotp.c b/net/can/isotp.c
+index 1e7c6a460ef9a39d2c313c8cbb964b73585f2fbf..35a1ae61744ca0564a0e0cd1046eb573d991ac56 100644
+--- a/net/can/isotp.c
++++ b/net/can/isotp.c
+@@ -1055,7 +1055,6 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	struct sock *sk = sock->sk;
+ 	struct sk_buff *skb;
+ 	struct isotp_sock *so = isotp_sk(sk);
+-	int noblock = flags & MSG_DONTWAIT;
+ 	int ret = 0;
+ 
+ 	if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK))
+@@ -1064,8 +1063,7 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	if (!so->bound)
+ 		return -EADDRNOTAVAIL;
+ 
+-	flags &= ~MSG_DONTWAIT;
+-	skb = skb_recv_datagram(sk, flags, noblock, &ret);
++	skb = skb_recv_datagram(sk, flags, &ret);
+ 	if (!skb)
+ 		return ret;
+ 
+diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
+index 6dff4510687a49791a4e6c01f3f5fe12669d8153..0bb4fd3f6264d64b5872baa35f8c2535fe22eaa5 100644
+--- a/net/can/j1939/socket.c
++++ b/net/can/j1939/socket.c
+@@ -802,7 +802,7 @@ static int j1939_sk_recvmsg(struct socket *sock, struct msghdr *msg,
+ 		return sock_recv_errqueue(sock->sk, msg, size, SOL_CAN_J1939,
+ 					  SCM_J1939_ERRQUEUE);
+ 
+-	skb = skb_recv_datagram(sk, flags, 0, &ret);
++	skb = skb_recv_datagram(sk, flags, &ret);
+ 	if (!skb)
+ 		return ret;
+ 
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 7105fa4824e4b4f48b30186828126c59fd5f2938..0cf728dcff36f1f75dfb6f97943a15f8e4f5fb45 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -846,16 +846,12 @@ static int raw_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	struct sock *sk = sock->sk;
+ 	struct sk_buff *skb;
+ 	int err = 0;
+-	int noblock;
+-
+-	noblock = flags & MSG_DONTWAIT;
+-	flags &= ~MSG_DONTWAIT;
+ 
+ 	if (flags & MSG_ERRQUEUE)
+ 		return sock_recv_errqueue(sk, msg, size,
+ 					  SOL_CAN_RAW, SCM_CAN_RAW_ERRQUEUE);
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		return err;
+ 
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index ee290776c661d02fd65aaa38ed9d5b5c2b6bb946..70126d15ca6e0cba07675d3441da277b0ee48660 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -310,12 +310,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk,
+ EXPORT_SYMBOL(__skb_recv_datagram);
+ 
+ struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned int flags,
+-				  int noblock, int *err)
++				  int *err)
+ {
+ 	int off = 0;
+ 
+-	return __skb_recv_datagram(sk, &sk->sk_receive_queue,
+-				   flags | (noblock ? MSG_DONTWAIT : 0),
++	return __skb_recv_datagram(sk, &sk->sk_receive_queue, flags,
+ 				   &off, err);
+ }
+ EXPORT_SYMBOL(skb_recv_datagram);
+diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
+index 3b2366a88c3ccbae787669c58a2827048aa4552c..a725dd9bbda8bc66a1c65182ac9b707d62ac1152 100644
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -314,7 +314,8 @@ static int raw_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	int err = -EOPNOTSUPP;
+ 	struct sk_buff *skb;
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	flags |= (noblock ? MSG_DONTWAIT : 0);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		goto out;
+ 
+@@ -703,7 +704,8 @@ static int dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	struct dgram_sock *ro = dgram_sk(sk);
+ 	DECLARE_SOCKADDR(struct sockaddr_ieee802154 *, saddr, msg->msg_name);
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	flags |= (noblock ? MSG_DONTWAIT : 0);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		goto out;
+ 
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index aa9a11b20d18e9a11dd36199217ff670227a92f9..4e5ceca7ff7f9b6e52fdfd4867e9e8fd7096b660 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -871,7 +871,8 @@ int ping_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return inet_recv_error(sk, msg, len, addr_len);
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	flags |= (noblock ? MSG_DONTWAIT : 0);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		goto out;
+ 
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index 9f97b9cbf7b37e41648cbc98fb994adeb63f43cb..c9dd9603f2e733873109ddf1d7a23695b0bca100 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -769,7 +769,8 @@ static int raw_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 		goto out;
+ 	}
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	flags |= (noblock ? MSG_DONTWAIT : 0);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		goto out;
+ 
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index c51d5ce3711c2e61e9ea2c1b22cb5ec4ee95ae7b..8bb41f3b246a9728dd6e738b76389a9cf8b56097 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -477,7 +477,8 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	flags |= (noblock ? MSG_DONTWAIT : 0);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		goto out;
+ 
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index a1760add5bf1e758975aba33a051b8cf1542c6dd..a0385ddbffcfc775b74768d5a889fcf7cbec1ee8 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1223,7 +1223,6 @@ static void iucv_process_message_q(struct sock *sk)
+ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 			     size_t len, int flags)
+ {
+-	int noblock = flags & MSG_DONTWAIT;
+ 	struct sock *sk = sock->sk;
+ 	struct iucv_sock *iucv = iucv_sk(sk);
+ 	unsigned int copied, rlen;
+@@ -1242,7 +1241,7 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 
+ 	/* receive/dequeue next skb:
+ 	 * the function understands MSG_PEEK and, thus, does not dequeue skb */
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb) {
+ 		if (sk->sk_shutdown & RCV_SHUTDOWN)
+ 			return 0;
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index d93bde65735937804b2722721a1d0c303c1e3279..c249b84efbb20ed931947b869e259913b54c5533 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -3700,7 +3700,7 @@ static int pfkey_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 	if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
+ 		goto out;
+ 
+-	skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (skb == NULL)
+ 		goto out;
+ 
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index b3edafa5fba4a3cc8b01b5a66e37ee198f31eea1..c6a5cc2d88e72d02cf82d07fa683983f8cac4552 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -526,7 +526,8 @@ static int l2tp_ip_recvmsg(struct sock *sk, struct msghdr *msg,
+ 	if (flags & MSG_OOB)
+ 		goto out;
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	flags |= (noblock ? MSG_DONTWAIT : 0);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		goto out;
+ 
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index d54dbd01d86f1e949c9a564221849caeeca0bfd5..8f76e647adbbd0f344127d48d31479a42562d4bd 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -672,7 +672,8 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	flags |= (noblock ? MSG_DONTWAIT : 0);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		goto out;
+ 
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index bf35710127dd082370ecdaecdd9edff7315f3b8f..8be1fdc68a0bbdc8ee6ef1186f278dc6badd325a 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -191,8 +191,7 @@ static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
+ 		goto end;
+ 
+ 	err = 0;
+-	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
+-				flags & MSG_DONTWAIT, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb)
+ 		goto end;
+ 
+diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c
+index e22b0cbb2f35385c7111a63c935b643ace11b6e4..221863afc4b1248c7afa179518abc2931c7f9191 100644
+--- a/net/mctp/af_mctp.c
++++ b/net/mctp/af_mctp.c
+@@ -216,7 +216,7 @@ static int mctp_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 	if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK))
+ 		return -EOPNOTSUPP;
+ 
+-	skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &rc);
++	skb = skb_recv_datagram(sk, flags, &rc);
+ 	if (!skb)
+ 		return rc;
+ 
+diff --git a/net/mctp/test/route-test.c b/net/mctp/test/route-test.c
+index 61205cf4007465a01c2d7b3def1c413a5666df35..24df29e135ed6fbfc1637b7ab87822d19d20527b 100644
+--- a/net/mctp/test/route-test.c
++++ b/net/mctp/test/route-test.c
+@@ -352,7 +352,7 @@ static void mctp_test_route_input_sk(struct kunit *test)
+ 	if (params->deliver) {
+ 		KUNIT_EXPECT_EQ(test, rc, 0);
+ 
+-		skb2 = skb_recv_datagram(sock->sk, 0, 1, &rc);
++		skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
+ 		KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2);
+ 		KUNIT_EXPECT_EQ(test, skb->len, 1);
+ 
+@@ -360,7 +360,7 @@ static void mctp_test_route_input_sk(struct kunit *test)
+ 
+ 	} else {
+ 		KUNIT_EXPECT_NE(test, rc, 0);
+-		skb2 = skb_recv_datagram(sock->sk, 0, 1, &rc);
++		skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
+ 		KUNIT_EXPECT_PTR_EQ(test, skb2, NULL);
+ 	}
+ 
+@@ -423,7 +423,7 @@ static void mctp_test_route_input_sk_reasm(struct kunit *test)
+ 		rc = mctp_route_input(&rt->rt, skb);
+ 	}
+ 
+-	skb2 = skb_recv_datagram(sock->sk, 0, 1, &rc);
++	skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
+ 
+ 	if (params->rx_len) {
+ 		KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2);
+@@ -582,7 +582,7 @@ static void mctp_test_route_input_sk_keys(struct kunit *test)
+ 	rc = mctp_route_input(&rt->rt, skb);
+ 
+ 	/* (potentially) receive message */
+-	skb2 = skb_recv_datagram(sock->sk, 0, 1, &rc);
++	skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
+ 
+ 	if (params->deliver)
+ 		KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2);
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 73e9c0a9c187674cced15dbec079734489c3329f..0cd91f813a3bd16da13d139e779a54217b563d22 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1931,7 +1931,6 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 	struct scm_cookie scm;
+ 	struct sock *sk = sock->sk;
+ 	struct netlink_sock *nlk = nlk_sk(sk);
+-	int noblock = flags & MSG_DONTWAIT;
+ 	size_t copied;
+ 	struct sk_buff *skb, *data_skb;
+ 	int err, ret;
+@@ -1941,7 +1940,7 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 
+ 	copied = 0;
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (skb == NULL)
+ 		goto out;
+ 
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index fa9dc2ba39418b06bd1915e05dd8f2af5ec00ca2..6f7f4392cffb1bd382a89ebe925a7cad2d730b44 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -1159,7 +1159,8 @@ static int nr_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	}
+ 
+ 	/* Now we can treat all alike */
+-	if ((skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &er)) == NULL) {
++	skb = skb_recv_datagram(sk, flags, &er);
++	if (!skb) {
+ 		release_sock(sk);
+ 		return er;
+ 	}
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index 4ca35791c93b734f0b1bc32a82bfca1c9b3740ed..77642d18a3b437ea3c733fadce93ec463a900498 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -821,7 +821,6 @@ static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ static int llcp_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 			     size_t len, int flags)
+ {
+-	int noblock = flags & MSG_DONTWAIT;
+ 	struct sock *sk = sock->sk;
+ 	unsigned int copied, rlen;
+ 	struct sk_buff *skb, *cskb;
+@@ -842,7 +841,7 @@ static int llcp_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 	if (flags & (MSG_OOB))
+ 		return -EOPNOTSUPP;
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb) {
+ 		pr_err("Recv datagram failed state %d %d %d",
+ 		       sk->sk_state, err, sock_error(sk));
+diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
+index 0ca214ab5aeff97f7bdc166537c4aafe37dd807f..8dd569765f96e9c5ff851515dc5f2823dfa804f2 100644
+--- a/net/nfc/rawsock.c
++++ b/net/nfc/rawsock.c
+@@ -238,7 +238,6 @@ static int rawsock_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ static int rawsock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 			   int flags)
+ {
+-	int noblock = flags & MSG_DONTWAIT;
+ 	struct sock *sk = sock->sk;
+ 	struct sk_buff *skb;
+ 	int copied;
+@@ -246,7 +245,7 @@ static int rawsock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 
+ 	pr_debug("sock=%p sk=%p len=%zu flags=%d\n", sock, sk, len, flags);
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &rc);
++	skb = skb_recv_datagram(sk, flags, &rc);
+ 	if (!skb)
+ 		return rc;
+ 
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 002d2b9c69dd1f95f234fe38f87dbf3a9481b0da..243566129784a8f06e86483a735307c81442ac21 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3426,7 +3426,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 	 *	but then it will block.
+ 	 */
+ 
+-	skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 
+ 	/*
+ 	 *	An error occurred so return it. Because skb_recv_datagram()
+diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
+index 393e6aa7a5927d4b8ef61a35d99d41c4cad8c815..3f2e62b63dd4293a11ba88ca294050829461361a 100644
+--- a/net/phonet/datagram.c
++++ b/net/phonet/datagram.c
+@@ -123,7 +123,8 @@ static int pn_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 			MSG_CMSG_COMPAT))
+ 		goto out_nofree;
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &rval);
++	flags |= (noblock ? MSG_DONTWAIT : 0);
++	skb = skb_recv_datagram(sk, flags, &rval);
+ 	if (skb == NULL)
+ 		goto out_nofree;
+ 
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index 65d463ad87707782a44152014fa760798554145f..441a267065923bcd80e7fef8536976c9c8a8c515 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -772,7 +772,8 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,
+ 	u8 pipe_handle, enabled, n_sb;
+ 	u8 aligned = 0;
+ 
+-	skb = skb_recv_datagram(sk, 0, flags & O_NONBLOCK, errp);
++	skb = skb_recv_datagram(sk, (flags & O_NONBLOCK) ? MSG_DONTWAIT : 0,
++				errp);
+ 	if (!skb)
+ 		return NULL;
+ 
+@@ -1267,7 +1268,8 @@ static int pep_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 			return -EINVAL;
+ 	}
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	flags |= (noblock ? MSG_DONTWAIT : 0);
++	skb = skb_recv_datagram(sk, flags, &err);
+ 	lock_sock(sk);
+ 	if (skb == NULL) {
+ 		if (err == -ENOTCONN && sk->sk_state == TCP_CLOSE_WAIT)
+diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
+index ec2322529727820d60e1fa13e1422d6ed8431608..5c2fb992803b7acbeed3d712104d45d7e0b3c68f 100644
+--- a/net/qrtr/af_qrtr.c
++++ b/net/qrtr/af_qrtr.c
+@@ -1035,8 +1035,7 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg,
+ 		return -EADDRNOTAVAIL;
+ 	}
+ 
+-	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
+-				flags & MSG_DONTWAIT, &rc);
++	skb = skb_recv_datagram(sk, flags, &rc);
+ 	if (!skb) {
+ 		release_sock(sk);
+ 		return rc;
+diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
+index 30a1cf4c16c6737d2acc587eadb853274caf5219..bf2d986a6bc392a9d830b1dfa7fbaa3bca969aa3 100644
+--- a/net/rose/af_rose.c
++++ b/net/rose/af_rose.c
+@@ -1230,7 +1230,8 @@ static int rose_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 		return -ENOTCONN;
+ 
+ 	/* Now we can treat all alike */
+-	if ((skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &er)) == NULL)
++	skb = skb_recv_datagram(sk, flags, &er);
++	if (!skb)
+ 		return er;
+ 
+ 	qbit = (skb->data[0] & ROSE_Q_BIT) == ROSE_Q_BIT;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 4aed12e94221ad1663a79836f08c6d778e00d032..6114d69b8a2daf6d3b0b1a05d7e7fc7d609a131e 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1643,7 +1643,8 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags,
+ 	 * so that no locks are necessary.
+ 	 */
+ 
+-	skb = skb_recv_datagram(sk, 0, flags&O_NONBLOCK, &err);
++	skb = skb_recv_datagram(sk, (flags & O_NONBLOCK) ? MSG_DONTWAIT : 0,
++				&err);
+ 	if (!skb) {
+ 		/* This means receive shutdown. */
+ 		if (err == 0)
+@@ -2500,7 +2501,7 @@ static int unix_read_sock(struct sock *sk, read_descriptor_t *desc,
+ 		int used, err;
+ 
+ 		mutex_lock(&u->iolock);
+-		skb = skb_recv_datagram(sk, 0, 1, &err);
++		skb = skb_recv_datagram(sk, MSG_DONTWAIT, &err);
+ 		mutex_unlock(&u->iolock);
+ 		if (!skb)
+ 			return err;
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index b17dc9745188e4f1840881209017a23f00c65af9..b14f0ed7427bc4f35307fc28de6e4908ae659448 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -1732,19 +1732,16 @@ static int vmci_transport_dgram_dequeue(struct vsock_sock *vsk,
+ 					int flags)
+ {
+ 	int err;
+-	int noblock;
+ 	struct vmci_datagram *dg;
+ 	size_t payload_len;
+ 	struct sk_buff *skb;
+ 
+-	noblock = flags & MSG_DONTWAIT;
+-
+ 	if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
+ 		return -EOPNOTSUPP;
+ 
+ 	/* Retrieve the head sk_buff from the socket's receive queue. */
+ 	err = 0;
+-	skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
++	skb = skb_recv_datagram(&vsk->sk, flags, &err);
+ 	if (!skb)
+ 		return err;
+ 
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 3a171828638b1a01c4d76189b832a87843de5e4e..6bc2ac8d8146dcfe9dd7fdfe4f7031ca2ef54266 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1315,8 +1315,7 @@ static int x25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	} else {
+ 		/* Now we can treat all alike */
+ 		release_sock(sk);
+-		skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
+-					flags & MSG_DONTWAIT, &rc);
++		skb = skb_recv_datagram(sk, flags, &rc);
+ 		lock_sock(sk);
+ 		if (!skb)
+ 			goto out;
diff --git a/0082-net-ax25-Fix-deadlock-caused-by-skb_recv_datagram-in.patch b/0082-net-ax25-Fix-deadlock-caused-by-skb_recv_datagram-in.patch
new file mode 100644
index 000000000000..4710f2b829e5
--- /dev/null
+++ b/0082-net-ax25-Fix-deadlock-caused-by-skb_recv_datagram-in.patch
@@ -0,0 +1,120 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Duoming Zhou <duoming@zju.edu.cn>
+Date: Tue, 14 Jun 2022 17:25:57 +0800
+Subject: [PATCH] net: ax25: Fix deadlock caused by skb_recv_datagram in
+ ax25_recvmsg
+
+[ Upstream commit 219b51a6f040fa5367adadd7d58c4dda0896a01d ]
+
+The skb_recv_datagram() in ax25_recvmsg() will hold lock_sock
+and block until it receives a packet from the remote. If the client
+doesn`t connect to server and calls read() directly, it will not
+receive any packets forever. As a result, the deadlock will happen.
+
+The fail log caused by deadlock is shown below:
+
+[  369.606973] INFO: task ax25_deadlock:157 blocked for more than 245 seconds.
+[  369.608919] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[  369.613058] Call Trace:
+[  369.613315]  <TASK>
+[  369.614072]  __schedule+0x2f9/0xb20
+[  369.615029]  schedule+0x49/0xb0
+[  369.615734]  __lock_sock+0x92/0x100
+[  369.616763]  ? destroy_sched_domains_rcu+0x20/0x20
+[  369.617941]  lock_sock_nested+0x6e/0x70
+[  369.618809]  ax25_bind+0xaa/0x210
+[  369.619736]  __sys_bind+0xca/0xf0
+[  369.620039]  ? do_futex+0xae/0x1b0
+[  369.620387]  ? __x64_sys_futex+0x7c/0x1c0
+[  369.620601]  ? fpregs_assert_state_consistent+0x19/0x40
+[  369.620613]  __x64_sys_bind+0x11/0x20
+[  369.621791]  do_syscall_64+0x3b/0x90
+[  369.622423]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[  369.623319] RIP: 0033:0x7f43c8aa8af7
+[  369.624301] RSP: 002b:00007f43c8197ef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031
+[  369.625756] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f43c8aa8af7
+[  369.626724] RDX: 0000000000000010 RSI: 000055768e2021d0 RDI: 0000000000000005
+[  369.628569] RBP: 00007f43c8197f00 R08: 0000000000000011 R09: 00007f43c8198700
+[  369.630208] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff845e6afe
+[  369.632240] R13: 00007fff845e6aff R14: 00007f43c8197fc0 R15: 00007f43c8198700
+
+This patch replaces skb_recv_datagram() with an open-coded variant of it
+releasing the socket lock before the __skb_wait_for_more_packets() call
+and re-acquiring it after such call in order that other functions that
+need socket lock could be executed.
+
+what's more, the socket lock will be released only when recvmsg() will
+block and that should produce nicer overall behavior.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Suggested-by: Thomas Osterried <thomas@osterried.de>
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Reported-by: Thomas Habets <thomas@@habets.se>
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ax25/af_ax25.c | 33 ++++++++++++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 95393bb2760b3e322d531679451c81e2a3877b29..4c7030ed8d3319448f6cb158417c650308e341b8 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -1661,9 +1661,12 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 			int flags)
+ {
+ 	struct sock *sk = sock->sk;
+-	struct sk_buff *skb;
++	struct sk_buff *skb, *last;
++	struct sk_buff_head *sk_queue;
+ 	int copied;
+ 	int err = 0;
++	int off = 0;
++	long timeo;
+ 
+ 	lock_sock(sk);
+ 	/*
+@@ -1675,10 +1678,29 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 		goto out;
+ 	}
+ 
+-	/* Now we can treat all alike */
+-	skb = skb_recv_datagram(sk, flags, &err);
+-	if (skb == NULL)
+-		goto out;
++	/*  We need support for non-blocking reads. */
++	sk_queue = &sk->sk_receive_queue;
++	skb = __skb_try_recv_datagram(sk, sk_queue, flags, &off, &err, &last);
++	/* If no packet is available, release_sock(sk) and try again. */
++	if (!skb) {
++		if (err != -EAGAIN)
++			goto out;
++		release_sock(sk);
++		timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
++		while (timeo && !__skb_wait_for_more_packets(sk, sk_queue, &err,
++							     &timeo, last)) {
++			skb = __skb_try_recv_datagram(sk, sk_queue, flags, &off,
++						      &err, &last);
++			if (skb)
++				break;
++
++			if (err != -EAGAIN)
++				goto done;
++		}
++		if (!skb)
++			goto done;
++		lock_sock(sk);
++	}
+ 
+ 	if (!sk_to_ax25(sk)->pidincl)
+ 		skb_pull(skb, 1);		/* Remove PID */
+@@ -1725,6 +1747,7 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ out:
+ 	release_sock(sk);
+ 
++done:
+ 	return err;
+ }
+ 
diff --git a/0083-arm64-ftrace-fix-branch-range-checks.patch b/0083-arm64-ftrace-fix-branch-range-checks.patch
new file mode 100644
index 000000000000..d2b3a265a8da
--- /dev/null
+++ b/0083-arm64-ftrace-fix-branch-range-checks.patch
@@ -0,0 +1,81 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 14 Jun 2022 09:09:42 +0100
+Subject: [PATCH] arm64: ftrace: fix branch range checks
+
+[ Upstream commit 3eefdf9d1e406f3da47470b2854347009ffcb6fa ]
+
+The branch range checks in ftrace_make_call() and ftrace_make_nop() are
+incorrect, erroneously permitting a forwards branch of 128M and
+erroneously rejecting a backwards branch of 128M.
+
+This is because both functions calculate the offset backwards,
+calculating the offset *from* the target *to* the branch, rather than
+the other way around as the later comparisons expect.
+
+If an out-of-range branch were erroeously permitted, this would later be
+rejected by aarch64_insn_gen_branch_imm() as branch_imm_common() checks
+the bounds correctly, resulting in warnings and the placement of a BRK
+instruction. Note that this can only happen for a forwards branch of
+exactly 128M, and so the caller would need to be exactly 128M bytes
+below the relevant ftrace trampoline.
+
+If an in-range branch were erroeously rejected, then:
+
+* For modules when CONFIG_ARM64_MODULE_PLTS=y, this would result in the
+  use of a PLT entry, which is benign.
+
+  Note that this is the common case, as this is selected by
+  CONFIG_RANDOMIZE_BASE (and therefore RANDOMIZE_MODULE_REGION_FULL),
+  which distributions typically seelct. This is also selected by
+  CONFIG_ARM64_ERRATUM_843419.
+
+* For modules when CONFIG_ARM64_MODULE_PLTS=n, this would result in
+  internal ftrace failures.
+
+* For core kernel text, this would result in internal ftrace failues.
+
+  Note that for this to happen, the kernel text would need to be at
+  least 128M bytes in size, and typical configurations are smaller tha
+  this.
+
+Fix this by calculating the offset *from* the branch *to* the target in
+both functions.
+
+Fixes: f8af0b364e24 ("arm64: ftrace: don't validate branch via PLT in ftrace_make_nop()")
+Fixes: e71a4e1bebaf ("arm64: ftrace: add support for far branches to dynamic ftrace")
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Tested-by: "Ivan T. Ivanov" <iivanov@suse.de>
+Reviewed-by: Chengming Zhou <zhouchengming@bytedance.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Link: https://lore.kernel.org/r/20220614080944.1349146-2-mark.rutland@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/ftrace.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
+index 4506c4a90ac10fbe7910da0d95e9bdaf50ac3945..d9e3eda419ec5ee726c77dbc438972179c8a0142 100644
+--- a/arch/arm64/kernel/ftrace.c
++++ b/arch/arm64/kernel/ftrace.c
+@@ -84,7 +84,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+ {
+ 	unsigned long pc = rec->ip;
+ 	u32 old, new;
+-	long offset = (long)pc - (long)addr;
++	long offset = (long)addr - (long)pc;
+ 
+ 	if (offset < -SZ_128M || offset >= SZ_128M) {
+ 		struct module *mod;
+@@ -183,7 +183,7 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
+ 	unsigned long pc = rec->ip;
+ 	bool validate = true;
+ 	u32 old = 0, new;
+-	long offset = (long)pc - (long)addr;
++	long offset = (long)addr - (long)pc;
+ 
+ 	if (offset < -SZ_128M || offset >= SZ_128M) {
+ 		u32 replaced;
diff --git a/0084-arm64-ftrace-consistently-handle-PLTs.patch b/0084-arm64-ftrace-consistently-handle-PLTs.patch
new file mode 100644
index 000000000000..d7da86cc7716
--- /dev/null
+++ b/0084-arm64-ftrace-consistently-handle-PLTs.patch
@@ -0,0 +1,300 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 14 Jun 2022 09:09:43 +0100
+Subject: [PATCH] arm64: ftrace: consistently handle PLTs.
+
+[ Upstream commit a6253579977e4c6f7818eeb05bf2bc65678a7187 ]
+
+Sometimes it is necessary to use a PLT entry to call an ftrace
+trampoline. This is handled by ftrace_make_call() and ftrace_make_nop(),
+with each having *almost* identical logic, but this is not handled by
+ftrace_modify_call() since its introduction in commit:
+
+  3b23e4991fb66f6d ("arm64: implement ftrace with regs")
+
+Due to this, if we ever were to call ftrace_modify_call() for a callsite
+which requires a PLT entry for a trampoline, then either:
+
+a) If the old addr requires a trampoline, ftrace_modify_call() will use
+   an out-of-range address to generate the 'old' branch instruction.
+   This will result in warnings from aarch64_insn_gen_branch_imm() and
+   ftrace_modify_code(), and no instructions will be modified. As
+   ftrace_modify_call() will return an error, this will result in
+   subsequent internal ftrace errors.
+
+b) If the old addr does not require a trampoline, but the new addr does,
+   ftrace_modify_call() will use an out-of-range address to generate the
+   'new' branch instruction. This will result in warnings from
+   aarch64_insn_gen_branch_imm(), and ftrace_modify_code() will replace
+   the 'old' branch with a BRK. This will result in a kernel panic when
+   this BRK is later executed.
+
+Practically speaking, case (a) is vastly more likely than case (b), and
+typically this will result in internal ftrace errors that don't
+necessarily affect the rest of the system. This can be demonstrated with
+an out-of-tree test module which triggers ftrace_modify_call(), e.g.
+
+| # insmod test_ftrace.ko
+| test_ftrace: Function test_function raw=0xffffb3749399201c, callsite=0xffffb37493992024
+| branch_imm_common: offset out of range
+| branch_imm_common: offset out of range
+| ------------[ ftrace bug ]------------
+| ftrace failed to modify
+| [<ffffb37493992024>] test_function+0x8/0x38 [test_ftrace]
+|  actual:   1d:00:00:94
+| Updating ftrace call site to call a different ftrace function
+| ftrace record flags: e0000002
+|  (2) R
+|  expected tramp: ffffb374ae42ed54
+| ------------[ cut here ]------------
+| WARNING: CPU: 0 PID: 165 at kernel/trace/ftrace.c:2085 ftrace_bug+0x280/0x2b0
+| Modules linked in: test_ftrace(+)
+| CPU: 0 PID: 165 Comm: insmod Not tainted 5.19.0-rc2-00002-g4d9ead8b45ce #13
+| Hardware name: linux,dummy-virt (DT)
+| pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+| pc : ftrace_bug+0x280/0x2b0
+| lr : ftrace_bug+0x280/0x2b0
+| sp : ffff80000839ba00
+| x29: ffff80000839ba00 x28: 0000000000000000 x27: ffff80000839bcf0
+| x26: ffffb37493994180 x25: ffffb374b0991c28 x24: ffffb374b0d70000
+| x23: 00000000ffffffea x22: ffffb374afcc33b0 x21: ffffb374b08f9cc8
+| x20: ffff572b8462c000 x19: ffffb374b08f9000 x18: ffffffffffffffff
+| x17: 6c6c6163202c6331 x16: ffffb374ae5ad110 x15: ffffb374b0d51ee4
+| x14: 0000000000000000 x13: 3435646532346561 x12: 3437336266666666
+| x11: 203a706d61727420 x10: 6465746365707865 x9 : ffffb374ae5149e8
+| x8 : 336266666666203a x7 : 706d617274206465 x6 : 00000000fffff167
+| x5 : ffff572bffbc4a08 x4 : 00000000fffff167 x3 : 0000000000000000
+| x2 : 0000000000000000 x1 : ffff572b84461e00 x0 : 0000000000000022
+| Call trace:
+|  ftrace_bug+0x280/0x2b0
+|  ftrace_replace_code+0x98/0xa0
+|  ftrace_modify_all_code+0xe0/0x144
+|  arch_ftrace_update_code+0x14/0x20
+|  ftrace_startup+0xf8/0x1b0
+|  register_ftrace_function+0x38/0x90
+|  test_ftrace_init+0xd0/0x1000 [test_ftrace]
+|  do_one_initcall+0x50/0x2b0
+|  do_init_module+0x50/0x1f0
+|  load_module+0x17c8/0x1d64
+|  __do_sys_finit_module+0xa8/0x100
+|  __arm64_sys_finit_module+0x2c/0x3c
+|  invoke_syscall+0x50/0x120
+|  el0_svc_common.constprop.0+0xdc/0x100
+|  do_el0_svc+0x3c/0xd0
+|  el0_svc+0x34/0xb0
+|  el0t_64_sync_handler+0xbc/0x140
+|  el0t_64_sync+0x18c/0x190
+| ---[ end trace 0000000000000000 ]---
+
+We can solve this by consistently determining whether to use a PLT entry
+for an address.
+
+Note that since (the earlier) commit:
+
+  f1a54ae9af0da4d7 ("arm64: module/ftrace: intialize PLT at load time")
+
+... we can consistently determine the PLT address that a given callsite
+will use, and therefore ftrace_make_nop() does not need to skip
+validation when a PLT is in use.
+
+This patch factors the existing logic out of ftrace_make_call() and
+ftrace_make_nop() into a common ftrace_find_callable_addr() helper
+function, which is used by ftrace_make_call(), ftrace_make_nop(), and
+ftrace_modify_call(). In ftrace_make_nop() the patching is consistently
+validated by ftrace_modify_code() as we can always determine what the
+old instruction should have been.
+
+Fixes: 3b23e4991fb6 ("arm64: implement ftrace with regs")
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Tested-by: "Ivan T. Ivanov" <iivanov@suse.de>
+Reviewed-by: Chengming Zhou <zhouchengming@bytedance.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Link: https://lore.kernel.org/r/20220614080944.1349146-3-mark.rutland@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/ftrace.c | 137 ++++++++++++++++++-------------------
+ 1 file changed, 66 insertions(+), 71 deletions(-)
+
+diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
+index d9e3eda419ec5ee726c77dbc438972179c8a0142..f3184cd81b1909c5048401f0e47c9af00e0f5756 100644
+--- a/arch/arm64/kernel/ftrace.c
++++ b/arch/arm64/kernel/ftrace.c
+@@ -78,47 +78,76 @@ static struct plt_entry *get_ftrace_plt(struct module *mod, unsigned long addr)
+ }
+ 
+ /*
+- * Turn on the call to ftrace_caller() in instrumented function
++ * Find the address the callsite must branch to in order to reach '*addr'.
++ *
++ * Due to the limited range of 'BL' instructions, modules may be placed too far
++ * away to branch directly and must use a PLT.
++ *
++ * Returns true when '*addr' contains a reachable target address, or has been
++ * modified to contain a PLT address. Returns false otherwise.
+  */
+-int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
++static bool ftrace_find_callable_addr(struct dyn_ftrace *rec,
++				      struct module *mod,
++				      unsigned long *addr)
+ {
+ 	unsigned long pc = rec->ip;
+-	u32 old, new;
+-	long offset = (long)addr - (long)pc;
++	long offset = (long)*addr - (long)pc;
++	struct plt_entry *plt;
+ 
+-	if (offset < -SZ_128M || offset >= SZ_128M) {
+-		struct module *mod;
+-		struct plt_entry *plt;
++	/*
++	 * When the target is within range of the 'BL' instruction, use 'addr'
++	 * as-is and branch to that directly.
++	 */
++	if (offset >= -SZ_128M && offset < SZ_128M)
++		return true;
+ 
+-		if (!IS_ENABLED(CONFIG_ARM64_MODULE_PLTS))
+-			return -EINVAL;
++	/*
++	 * When the target is outside of the range of a 'BL' instruction, we
++	 * must use a PLT to reach it. We can only place PLTs for modules, and
++	 * only when module PLT support is built-in.
++	 */
++	if (!IS_ENABLED(CONFIG_ARM64_MODULE_PLTS))
++		return false;
+ 
+-		/*
+-		 * On kernels that support module PLTs, the offset between the
+-		 * branch instruction and its target may legally exceed the
+-		 * range of an ordinary relative 'bl' opcode. In this case, we
+-		 * need to branch via a trampoline in the module.
+-		 *
+-		 * NOTE: __module_text_address() must be called with preemption
+-		 * disabled, but we can rely on ftrace_lock to ensure that 'mod'
+-		 * retains its validity throughout the remainder of this code.
+-		 */
++	/*
++	 * 'mod' is only set at module load time, but if we end up
++	 * dealing with an out-of-range condition, we can assume it
++	 * is due to a module being loaded far away from the kernel.
++	 *
++	 * NOTE: __module_text_address() must be called with preemption
++	 * disabled, but we can rely on ftrace_lock to ensure that 'mod'
++	 * retains its validity throughout the remainder of this code.
++	 */
++	if (!mod) {
+ 		preempt_disable();
+ 		mod = __module_text_address(pc);
+ 		preempt_enable();
++	}
+ 
+-		if (WARN_ON(!mod))
+-			return -EINVAL;
++	if (WARN_ON(!mod))
++		return false;
+ 
+-		plt = get_ftrace_plt(mod, addr);
+-		if (!plt) {
+-			pr_err("ftrace: no module PLT for %ps\n", (void *)addr);
+-			return -EINVAL;
+-		}
+-
+-		addr = (unsigned long)plt;
++	plt = get_ftrace_plt(mod, *addr);
++	if (!plt) {
++		pr_err("ftrace: no module PLT for %ps\n", (void *)*addr);
++		return false;
+ 	}
+ 
++	*addr = (unsigned long)plt;
++	return true;
++}
++
++/*
++ * Turn on the call to ftrace_caller() in instrumented function
++ */
++int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
++{
++	unsigned long pc = rec->ip;
++	u32 old, new;
++
++	if (!ftrace_find_callable_addr(rec, NULL, &addr))
++		return -EINVAL;
++
+ 	old = aarch64_insn_gen_nop();
+ 	new = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK);
+ 
+@@ -132,6 +161,11 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
+ 	unsigned long pc = rec->ip;
+ 	u32 old, new;
+ 
++	if (!ftrace_find_callable_addr(rec, NULL, &old_addr))
++		return -EINVAL;
++	if (!ftrace_find_callable_addr(rec, NULL, &addr))
++		return -EINVAL;
++
+ 	old = aarch64_insn_gen_branch_imm(pc, old_addr,
+ 					  AARCH64_INSN_BRANCH_LINK);
+ 	new = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK);
+@@ -181,54 +215,15 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
+ 		    unsigned long addr)
+ {
+ 	unsigned long pc = rec->ip;
+-	bool validate = true;
+ 	u32 old = 0, new;
+-	long offset = (long)addr - (long)pc;
+ 
+-	if (offset < -SZ_128M || offset >= SZ_128M) {
+-		u32 replaced;
+-
+-		if (!IS_ENABLED(CONFIG_ARM64_MODULE_PLTS))
+-			return -EINVAL;
+-
+-		/*
+-		 * 'mod' is only set at module load time, but if we end up
+-		 * dealing with an out-of-range condition, we can assume it
+-		 * is due to a module being loaded far away from the kernel.
+-		 */
+-		if (!mod) {
+-			preempt_disable();
+-			mod = __module_text_address(pc);
+-			preempt_enable();
+-
+-			if (WARN_ON(!mod))
+-				return -EINVAL;
+-		}
+-
+-		/*
+-		 * The instruction we are about to patch may be a branch and
+-		 * link instruction that was redirected via a PLT entry. In
+-		 * this case, the normal validation will fail, but we can at
+-		 * least check that we are dealing with a branch and link
+-		 * instruction that points into the right module.
+-		 */
+-		if (aarch64_insn_read((void *)pc, &replaced))
+-			return -EFAULT;
+-
+-		if (!aarch64_insn_is_bl(replaced) ||
+-		    !within_module(pc + aarch64_get_branch_offset(replaced),
+-				   mod))
+-			return -EINVAL;
+-
+-		validate = false;
+-	} else {
+-		old = aarch64_insn_gen_branch_imm(pc, addr,
+-						  AARCH64_INSN_BRANCH_LINK);
+-	}
++	if (!ftrace_find_callable_addr(rec, mod, &addr))
++		return -EINVAL;
+ 
++	old = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK);
+ 	new = aarch64_insn_gen_nop();
+ 
+-	return ftrace_modify_code(pc, old, new, validate);
++	return ftrace_modify_code(pc, old, new, true);
+ }
+ 
+ void arch_ftrace_update_code(int command)
diff --git a/0085-certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch b/0085-certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch
new file mode 100644
index 000000000000..eb5a37cf1a1c
--- /dev/null
+++ b/0085-certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch
@@ -0,0 +1,48 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <masahiroy@kernel.org>
+Date: Sun, 12 Jun 2022 02:22:30 +0900
+Subject: [PATCH] certs/blacklist_hashes.c: fix const confusion in certs
+ blacklist
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 6a1c3767d82ed8233de1263aa7da81595e176087 ]
+
+This file fails to compile as follows:
+
+  CC      certs/blacklist_hashes.o
+certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes]
+    4 | const char __initdata *const blacklist_hashes[] = {
+      | ^~~~~
+In file included from certs/blacklist_hashes.c:2:
+certs/blacklist.h:5:38: note: previous declaration here
+    5 | extern const char __initconst *const blacklist_hashes[];
+      |                                      ^~~~~~~~~~~~~~~~
+
+Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c:
+fix const confusion in certs blacklist").
+
+Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ certs/blacklist_hashes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
+index 344892337be0797cc713877ad64014b8cacaec20..d5961aa3d3380c5fdfadd6bff49dddd97c41060d 100644
+--- a/certs/blacklist_hashes.c
++++ b/certs/blacklist_hashes.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include "blacklist.h"
+ 
+-const char __initdata *const blacklist_hashes[] = {
++const char __initconst *const blacklist_hashes[] = {
+ #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
+ 	, NULL
+ };
diff --git a/0086-init-Initialize-noop_backing_dev_info-early.patch b/0086-init-Initialize-noop_backing_dev_info-early.patch
new file mode 100644
index 000000000000..90ce5c84c11c
--- /dev/null
+++ b/0086-init-Initialize-noop_backing_dev_info-early.patch
@@ -0,0 +1,97 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 15 Jun 2022 15:22:29 +0200
+Subject: [PATCH] init: Initialize noop_backing_dev_info early
+
+[ Upstream commit 4bca7e80b6455772b4bf3f536dcbc19aac424d6a ]
+
+noop_backing_dev_info is used by superblocks of various
+pseudofilesystems such as kdevtmpfs. After commit 10e14073107d
+("writeback: Fix inode->i_io_list not be protected by inode->i_lock
+error") this broke because __mark_inode_dirty() started to access more
+fields from noop_backing_dev_info and this led to crashes inside
+locked_inode_to_wb_and_lock_list() called from __mark_inode_dirty().
+Fix the problem by initializing noop_backing_dev_info before the
+filesystems get mounted.
+
+Fixes: 10e14073107d ("writeback: Fix inode->i_io_list not be protected by inode->i_lock error")
+Reported-and-tested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Reported-and-tested-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Reported-and-tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/init.c         |  2 ++
+ include/linux/backing-dev.h |  2 ++
+ mm/backing-dev.c            | 11 ++---------
+ 3 files changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/base/init.c b/drivers/base/init.c
+index d8d0fe687111a0e0cec44c388a470df8708bdf44..397eb9880cecb8ed39914880bf64e879a8c94b32 100644
+--- a/drivers/base/init.c
++++ b/drivers/base/init.c
+@@ -8,6 +8,7 @@
+ #include <linux/init.h>
+ #include <linux/memory.h>
+ #include <linux/of.h>
++#include <linux/backing-dev.h>
+ 
+ #include "base.h"
+ 
+@@ -20,6 +21,7 @@
+ void __init driver_init(void)
+ {
+ 	/* These are the core pieces */
++	bdi_init(&noop_backing_dev_info);
+ 	devtmpfs_init();
+ 	devices_init();
+ 	buses_init();
+diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
+index 87ce24d238f3459e3174805282b7cf37e38624df..8c2eed1b69c177b245d04fd43ff801df14da1b9f 100644
+--- a/include/linux/backing-dev.h
++++ b/include/linux/backing-dev.h
+@@ -121,6 +121,8 @@ int bdi_set_max_ratio(struct backing_dev_info *bdi, unsigned int max_ratio);
+ 
+ extern struct backing_dev_info noop_backing_dev_info;
+ 
++int bdi_init(struct backing_dev_info *bdi);
++
+ /**
+  * writeback_in_progress - determine whether there is writeback in progress
+  * @wb: bdi_writeback of interest
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index 7176af65b103a4500fda68dc62028fb37794d3a0..e262739a0a2388d0d9de18dbcee0e5672665dad4 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -230,20 +230,13 @@ static __init int bdi_class_init(void)
+ }
+ postcore_initcall(bdi_class_init);
+ 
+-static int bdi_init(struct backing_dev_info *bdi);
+-
+ static int __init default_bdi_init(void)
+ {
+-	int err;
+-
+ 	bdi_wq = alloc_workqueue("writeback", WQ_MEM_RECLAIM | WQ_UNBOUND |
+ 				 WQ_SYSFS, 0);
+ 	if (!bdi_wq)
+ 		return -ENOMEM;
+-
+-	err = bdi_init(&noop_backing_dev_info);
+-
+-	return err;
++	return 0;
+ }
+ subsys_initcall(default_bdi_init);
+ 
+@@ -782,7 +775,7 @@ static void cgwb_remove_from_bdi_list(struct bdi_writeback *wb)
+ 
+ #endif	/* CONFIG_CGROUP_WRITEBACK */
+ 
+-static int bdi_init(struct backing_dev_info *bdi)
++int bdi_init(struct backing_dev_info *bdi)
+ {
+ 	int ret;
+ 
diff --git a/0087-block-Fix-handling-of-offline-queues-in-blk_mq_alloc.patch b/0087-block-Fix-handling-of-offline-queues-in-blk_mq_alloc.patch
new file mode 100644
index 000000000000..5fef6211ae6d
--- /dev/null
+++ b/0087-block-Fix-handling-of-offline-queues-in-blk_mq_alloc.patch
@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 15 Jun 2022 14:00:04 -0700
+Subject: [PATCH] block: Fix handling of offline queues in
+ blk_mq_alloc_request_hctx()
+
+[ Upstream commit 14dc7a18abbe4176f5626c13c333670da8e06aa1 ]
+
+This patch prevents that test nvme/004 triggers the following:
+
+UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9
+index 512 is out of range for type 'long unsigned int [512]'
+Call Trace:
+ show_stack+0x52/0x58
+ dump_stack_lvl+0x49/0x5e
+ dump_stack+0x10/0x12
+ ubsan_epilogue+0x9/0x3b
+ __ubsan_handle_out_of_bounds.cold+0x44/0x49
+ blk_mq_alloc_request_hctx+0x304/0x310
+ __nvme_submit_sync_cmd+0x70/0x200 [nvme_core]
+ nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics]
+ nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop]
+ nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop]
+ nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics]
+ nvmf_dev_write+0xae/0x111 [nvme_fabrics]
+ vfs_write+0x144/0x560
+ ksys_write+0xb7/0x140
+ __x64_sys_write+0x42/0x50
+ do_syscall_64+0x35/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Ming Lei <ming.lei@redhat.com>
+Fixes: 20e4d8139319 ("blk-mq: simplify queue mapping & schedule with each possisble CPU")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20220615210004.1031820-1-bvanassche@acm.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index de7fc69572718a6b8cab6134442d971be3b44920..631fb87b4976f7638eb97af143a7351c5878eae1 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -579,6 +579,8 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
+ 	if (!blk_mq_hw_queue_mapped(data.hctx))
+ 		goto out_queue_exit;
+ 	cpu = cpumask_first_and(data.hctx->cpumask, cpu_online_mask);
++	if (cpu >= nr_cpu_ids)
++		goto out_queue_exit;
+ 	data.ctx = __blk_mq_get_ctx(q, cpu);
+ 
+ 	if (!q->elevator)
diff --git a/0088-faddr2line-Fix-overlapping-text-section-failures-the.patch b/0088-faddr2line-Fix-overlapping-text-section-failures-the.patch
new file mode 100644
index 000000000000..3c636ebda7c7
--- /dev/null
+++ b/0088-faddr2line-Fix-overlapping-text-section-failures-the.patch
@@ -0,0 +1,134 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+Date: Wed, 1 Jun 2022 17:42:22 -0700
+Subject: [PATCH] faddr2line: Fix overlapping text section failures, the sequel
+
+[ Upstream commit dcea997beed694cbd8705100ca1a6eb0d886de69 ]
+
+If a function lives in a section other than .text, but .text also exists
+in the object, faddr2line may wrongly assume .text.  This can result in
+comically wrong output.  For example:
+
+  $ scripts/faddr2line vmlinux.o enter_from_user_mode+0x1c
+  enter_from_user_mode+0x1c/0x30:
+  find_next_bit at /home/jpoimboe/git/linux/./include/linux/find.h:40
+  (inlined by) perf_clear_dirty_counters at /home/jpoimboe/git/linux/arch/x86/events/core.c:2504
+
+Fix it by passing the section name to addr2line, unless the object file
+is vmlinux, in which case the symbol table uses absolute addresses.
+
+Fixes: 1d1a0e7c5100 ("scripts/faddr2line: Fix overlapping text section failures")
+Reported-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Link: https://lore.kernel.org/r/7d25bc1408bd3a750ac26e60d2f2815a5f4a8363.1654130536.git.jpoimboe@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/faddr2line | 45 ++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 34 insertions(+), 11 deletions(-)
+
+diff --git a/scripts/faddr2line b/scripts/faddr2line
+index 0e6268d598835e7a6eec49474af1b5a2e3673745..94ed98dd899f3041c8ee5583ffa225f2f0eacc36 100755
+--- a/scripts/faddr2line
++++ b/scripts/faddr2line
+@@ -95,17 +95,25 @@ __faddr2line() {
+ 	local print_warnings=$4
+ 
+ 	local sym_name=${func_addr%+*}
+-	local offset=${func_addr#*+}
+-	offset=${offset%/*}
++	local func_offset=${func_addr#*+}
++	func_offset=${func_offset%/*}
+ 	local user_size=
++	local file_type
++	local is_vmlinux=0
+ 	[[ $func_addr =~ "/" ]] && user_size=${func_addr#*/}
+ 
+-	if [[ -z $sym_name ]] || [[ -z $offset ]] || [[ $sym_name = $func_addr ]]; then
++	if [[ -z $sym_name ]] || [[ -z $func_offset ]] || [[ $sym_name = $func_addr ]]; then
+ 		warn "bad func+offset $func_addr"
+ 		DONE=1
+ 		return
+ 	fi
+ 
++	# vmlinux uses absolute addresses in the section table rather than
++	# section offsets.
++	local file_type=$(${READELF} --file-header $objfile |
++		${AWK} '$1 == "Type:" { print $2; exit }')
++	[[ $file_type = "EXEC" ]] && is_vmlinux=1
++
+ 	# Go through each of the object's symbols which match the func name.
+ 	# In rare cases there might be duplicates, in which case we print all
+ 	# matches.
+@@ -114,9 +122,11 @@ __faddr2line() {
+ 		local sym_addr=0x${fields[1]}
+ 		local sym_elf_size=${fields[2]}
+ 		local sym_sec=${fields[6]}
++		local sec_size
++		local sec_name
+ 
+ 		# Get the section size:
+-		local sec_size=$(${READELF} --section-headers --wide $objfile |
++		sec_size=$(${READELF} --section-headers --wide $objfile |
+ 			sed 's/\[ /\[/' |
+ 			${AWK} -v sec=$sym_sec '$1 == "[" sec "]" { print "0x" $6; exit }')
+ 
+@@ -126,6 +136,17 @@ __faddr2line() {
+ 			return
+ 		fi
+ 
++		# Get the section name:
++		sec_name=$(${READELF} --section-headers --wide $objfile |
++			sed 's/\[ /\[/' |
++			${AWK} -v sec=$sym_sec '$1 == "[" sec "]" { print $2; exit }')
++
++		if [[ -z $sec_name ]]; then
++			warn "bad section name: section: $sym_sec"
++			DONE=1
++			return
++		fi
++
+ 		# Calculate the symbol size.
+ 		#
+ 		# Unfortunately we can't use the ELF size, because kallsyms
+@@ -174,10 +195,10 @@ __faddr2line() {
+ 
+ 		sym_size=0x$(printf %x $sym_size)
+ 
+-		# Calculate the section address from user-supplied offset:
+-		local addr=$(($sym_addr + $offset))
++		# Calculate the address from user-supplied offset:
++		local addr=$(($sym_addr + $func_offset))
+ 		if [[ -z $addr ]] || [[ $addr = 0 ]]; then
+-			warn "bad address: $sym_addr + $offset"
++			warn "bad address: $sym_addr + $func_offset"
+ 			DONE=1
+ 			return
+ 		fi
+@@ -191,9 +212,9 @@ __faddr2line() {
+ 		fi
+ 
+ 		# Make sure the provided offset is within the symbol's range:
+-		if [[ $offset -gt $sym_size ]]; then
++		if [[ $func_offset -gt $sym_size ]]; then
+ 			[[ $print_warnings = 1 ]] &&
+-				echo "skipping $sym_name address at $addr due to size mismatch ($offset > $sym_size)"
++				echo "skipping $sym_name address at $addr due to size mismatch ($func_offset > $sym_size)"
+ 			continue
+ 		fi
+ 
+@@ -202,11 +223,13 @@ __faddr2line() {
+ 		[[ $FIRST = 0 ]] && echo
+ 		FIRST=0
+ 
+-		echo "$sym_name+$offset/$sym_size:"
++		echo "$sym_name+$func_offset/$sym_size:"
+ 
+ 		# Pass section address to addr2line and strip absolute paths
+ 		# from the output:
+-		local output=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;")
++		local args="--functions --pretty-print --inlines --exe=$objfile"
++		[[ $is_vmlinux = 0 ]] && args="$args --section=$sec_name"
++		local output=$(${ADDR2LINE} $args $addr | sed "s; $dir_prefix\(\./\)*; ;")
+ 		[[ -z $output ]] && continue
+ 
+ 		# Default output (non --list):
diff --git a/0089-x86-ftrace-Remove-OBJECT_FILES_NON_STANDARD-usage.patch b/0089-x86-ftrace-Remove-OBJECT_FILES_NON_STANDARD-usage.patch
new file mode 100644
index 000000000000..dc788b81ff6b
--- /dev/null
+++ b/0089-x86-ftrace-Remove-OBJECT_FILES_NON_STANDARD-usage.patch
@@ -0,0 +1,136 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+Date: Fri, 3 Jun 2022 08:04:44 -0700
+Subject: [PATCH] x86/ftrace: Remove OBJECT_FILES_NON_STANDARD usage
+
+[ Upstream commit 7b6c7a877cc616bc7dc9cd39646fe454acbed48b ]
+
+The file-wide OBJECT_FILES_NON_STANDARD annotation is used with
+CONFIG_FRAME_POINTER to tell objtool to skip the entire file when frame
+pointers are enabled.  However that annotation is now deprecated because
+it doesn't work with IBT, where objtool runs on vmlinux.o instead of
+individual translation units.
+
+Instead, use more fine-grained function-specific annotations:
+
+- The 'save_mcount_regs' macro does funny things with the frame pointer.
+  Use STACK_FRAME_NON_STANDARD_FP to tell objtool to ignore the
+  functions using it.
+
+- The return_to_handler() "function" isn't actually a callable function.
+  Instead of being called, it's returned to.  The real return address
+  isn't on the stack, so unwinding is already doomed no matter which
+  unwinder is used.  So just remove the STT_FUNC annotation, telling
+  objtool to ignore it.  That also removes the implicit
+  ANNOTATE_NOENDBR, which now needs to be made explicit.
+
+Fixes the following warning:
+
+  vmlinux.o: warning: objtool: __fentry__+0x16: return with modified stack frame
+
+Fixes: ed53a0d97192 ("x86/alternative: Use .ibt_endbr_seal to seal indirect calls")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Link: https://lore.kernel.org/r/b7a7a42fe306aca37826043dac89e113a1acdbac.1654268610.git.jpoimboe@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/Makefile      |  4 ----
+ arch/x86/kernel/ftrace_64.S   | 11 ++++++++---
+ include/linux/objtool.h       |  6 ++++++
+ tools/include/linux/objtool.h |  6 ++++++
+ 4 files changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
+index c41ef42adbe8a3b13d10442b3d3b590b1ac40836..25828e4c62375007b3efd2fa392604b8c85636a4 100644
+--- a/arch/x86/kernel/Makefile
++++ b/arch/x86/kernel/Makefile
+@@ -36,10 +36,6 @@ KCSAN_SANITIZE := n
+ 
+ OBJECT_FILES_NON_STANDARD_test_nx.o			:= y
+ 
+-ifdef CONFIG_FRAME_POINTER
+-OBJECT_FILES_NON_STANDARD_ftrace_$(BITS).o		:= y
+-endif
+-
+ # If instrumentation of this dir is enabled, boot hangs during first second.
+ # Probably could be more selective here, but note that files related to irqs,
+ # boot, dumpstack/stacktrace, etc are either non-interesting or can lead to
+diff --git a/arch/x86/kernel/ftrace_64.S b/arch/x86/kernel/ftrace_64.S
+index 4ec13608d3c62bd8acae0d897b264cde3eb41e14..dfeb227de5617c6d55ad6ace1f321b7ac87b6a70 100644
+--- a/arch/x86/kernel/ftrace_64.S
++++ b/arch/x86/kernel/ftrace_64.S
+@@ -175,6 +175,7 @@ SYM_INNER_LABEL(ftrace_caller_end, SYM_L_GLOBAL)
+ 
+ 	jmp ftrace_epilogue
+ SYM_FUNC_END(ftrace_caller);
++STACK_FRAME_NON_STANDARD_FP(ftrace_caller)
+ 
+ SYM_FUNC_START(ftrace_epilogue)
+ /*
+@@ -282,6 +283,7 @@ SYM_INNER_LABEL(ftrace_regs_caller_end, SYM_L_GLOBAL)
+ 	jmp	ftrace_epilogue
+ 
+ SYM_FUNC_END(ftrace_regs_caller)
++STACK_FRAME_NON_STANDARD_FP(ftrace_regs_caller)
+ 
+ 
+ #else /* ! CONFIG_DYNAMIC_FTRACE */
+@@ -311,10 +313,14 @@ trace:
+ 	jmp ftrace_stub
+ SYM_FUNC_END(__fentry__)
+ EXPORT_SYMBOL(__fentry__)
++STACK_FRAME_NON_STANDARD_FP(__fentry__)
++
+ #endif /* CONFIG_DYNAMIC_FTRACE */
+ 
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+-SYM_FUNC_START(return_to_handler)
++SYM_CODE_START(return_to_handler)
++	UNWIND_HINT_EMPTY
++	ANNOTATE_NOENDBR
+ 	subq  $16, %rsp
+ 
+ 	/* Save the return values */
+@@ -339,7 +345,6 @@ SYM_FUNC_START(return_to_handler)
+ 	int3
+ .Ldo_rop:
+ 	mov %rdi, (%rsp)
+-	UNWIND_HINT_FUNC
+ 	RET
+-SYM_FUNC_END(return_to_handler)
++SYM_CODE_END(return_to_handler)
+ #endif
+diff --git a/include/linux/objtool.h b/include/linux/objtool.h
+index 586d35720f135f62b9d7434beccacb2e22a5bd2d..c81ea2264ad8a74b765f5649f81ee1198d7704dd 100644
+--- a/include/linux/objtool.h
++++ b/include/linux/objtool.h
+@@ -141,6 +141,12 @@ struct unwind_hint {
+ 	.popsection
+ .endm
+ 
++.macro STACK_FRAME_NON_STANDARD_FP func:req
++#ifdef CONFIG_FRAME_POINTER
++	STACK_FRAME_NON_STANDARD \func
++#endif
++.endm
++
+ .macro ANNOTATE_NOENDBR
+ .Lhere_\@:
+ 	.pushsection .discard.noendbr
+diff --git a/tools/include/linux/objtool.h b/tools/include/linux/objtool.h
+index 586d35720f135f62b9d7434beccacb2e22a5bd2d..c81ea2264ad8a74b765f5649f81ee1198d7704dd 100644
+--- a/tools/include/linux/objtool.h
++++ b/tools/include/linux/objtool.h
+@@ -141,6 +141,12 @@ struct unwind_hint {
+ 	.popsection
+ .endm
+ 
++.macro STACK_FRAME_NON_STANDARD_FP func:req
++#ifdef CONFIG_FRAME_POINTER
++	STACK_FRAME_NON_STANDARD \func
++#endif
++.endm
++
+ .macro ANNOTATE_NOENDBR
+ .Lhere_\@:
+ 	.pushsection .discard.noendbr
diff --git a/0090-i2c-npcm7xx-Add-check-for-platform_driver_register.patch b/0090-i2c-npcm7xx-Add-check-for-platform_driver_register.patch
new file mode 100644
index 000000000000..7c961025b9f9
--- /dev/null
+++ b/0090-i2c-npcm7xx-Add-check-for-platform_driver_register.patch
@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Date: Thu, 26 May 2022 17:41:00 +0800
+Subject: [PATCH] i2c: npcm7xx: Add check for platform_driver_register
+
+[ Upstream commit 6ba12b56b9b844b83ed54fb7ed59fb0eb41e4045 ]
+
+As platform_driver_register() could fail, it should be better
+to deal with the return value in order to maintain the code
+consisitency.
+
+Fixes: 56a1485b102e ("i2c: npcm7xx: Add Nuvoton NPCM I2C controller driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Tali Perry <tali.perry1@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-npcm7xx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c
+index c638f2efb97c7b1aeaa8646b934ecec20fefd0ba..743ac20a405c26f121778804ecc86f3f193d70bb 100644
+--- a/drivers/i2c/busses/i2c-npcm7xx.c
++++ b/drivers/i2c/busses/i2c-npcm7xx.c
+@@ -2369,8 +2369,7 @@ static struct platform_driver npcm_i2c_bus_driver = {
+ static int __init npcm_i2c_init(void)
+ {
+ 	npcm_i2c_debugfs_dir = debugfs_create_dir("npcm_i2c", NULL);
+-	platform_driver_register(&npcm_i2c_bus_driver);
+-	return 0;
++	return platform_driver_register(&npcm_i2c_bus_driver);
+ }
+ module_init(npcm_i2c_init);
+ 
diff --git a/0091-irqchip-gic-realview-Fix-refcount-leak-in-realview_g.patch b/0091-irqchip-gic-realview-Fix-refcount-leak-in-realview_g.patch
new file mode 100644
index 000000000000..ae5871d97fd9
--- /dev/null
+++ b/0091-irqchip-gic-realview-Fix-refcount-leak-in-realview_g.patch
@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 1 Jun 2022 12:09:25 +0400
+Subject: [PATCH] irqchip/gic/realview: Fix refcount leak in
+ realview_gic_of_init
+
+[ Upstream commit f4b98e314888cc51486421bcf6d52852452ea48b ]
+
+of_find_matching_node_and_match() returns a node pointer with refcount
+incremented, we should use of_node_put() on it when not need anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: 82b0a434b436 ("irqchip/gic/realview: Support more RealView DCC variants")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220601080930.31005-2-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-realview.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-gic-realview.c b/drivers/irqchip/irq-gic-realview.c
+index b4c1924f0255453937d11204f879a71d48068abc..38fab02ffe9d05e2a89cb6ca7159ce9b685efad9 100644
+--- a/drivers/irqchip/irq-gic-realview.c
++++ b/drivers/irqchip/irq-gic-realview.c
+@@ -57,6 +57,7 @@ realview_gic_of_init(struct device_node *node, struct device_node *parent)
+ 
+ 	/* The PB11MPCore GIC needs to be configured in the syscon */
+ 	map = syscon_node_to_regmap(np);
++	of_node_put(np);
+ 	if (!IS_ERR(map)) {
+ 		/* new irq mode with no DCC */
+ 		regmap_write(map, REALVIEW_SYS_LOCK_OFFSET,
diff --git a/0092-irqchip-apple-aic-Fix-refcount-leak-in-build_fiq_aff.patch b/0092-irqchip-apple-aic-Fix-refcount-leak-in-build_fiq_aff.patch
new file mode 100644
index 000000000000..4d1661d1a470
--- /dev/null
+++ b/0092-irqchip-apple-aic-Fix-refcount-leak-in-build_fiq_aff.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 1 Jun 2022 12:09:26 +0400
+Subject: [PATCH] irqchip/apple-aic: Fix refcount leak in build_fiq_affinity
+
+[ Upstream commit b1ac803f47cb1615468f35cf1ccb553c52087301 ]
+
+of_find_node_by_phandle() returns a node pointer with refcount
+incremented, we should use of_node_put() on it when not need anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: a5e8801202b3 ("irqchip/apple-aic: Parse FIQ affinities from device-tree")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220601080930.31005-3-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-apple-aic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-apple-aic.c b/drivers/irqchip/irq-apple-aic.c
+index 12dd48727a15f6ea87a2d04a8656b438e5575eff..478d0af16d9fa95f7e5d58260c0f1e369b82d0ed 100644
+--- a/drivers/irqchip/irq-apple-aic.c
++++ b/drivers/irqchip/irq-apple-aic.c
+@@ -1035,6 +1035,7 @@ static void build_fiq_affinity(struct aic_irq_chip *ic, struct device_node *aff)
+ 			continue;
+ 
+ 		cpu = of_cpu_node_to_id(cpu_node);
++		of_node_put(cpu_node);
+ 		if (WARN_ON(cpu < 0))
+ 			continue;
+ 
diff --git a/0093-irqchip-apple-aic-Fix-refcount-leak-in-aic_of_ic_ini.patch b/0093-irqchip-apple-aic-Fix-refcount-leak-in-aic_of_ic_ini.patch
new file mode 100644
index 000000000000..05a329dc2134
--- /dev/null
+++ b/0093-irqchip-apple-aic-Fix-refcount-leak-in-aic_of_ic_ini.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 1 Jun 2022 12:09:27 +0400
+Subject: [PATCH] irqchip/apple-aic: Fix refcount leak in aic_of_ic_init
+
+[ Upstream commit 3d45670fab3c25a7452721e4588cc95c51cda134 ]
+
+of_get_child_by_name() returns a node pointer with refcount
+incremented, we should use of_node_put() on it when not need anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: a5e8801202b3 ("irqchip/apple-aic: Parse FIQ affinities from device-tree")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220601080930.31005-4-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-apple-aic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-apple-aic.c b/drivers/irqchip/irq-apple-aic.c
+index 478d0af16d9fa95f7e5d58260c0f1e369b82d0ed..5ac83185ff4794f0af825cdd4d96bcc624630b07 100644
+--- a/drivers/irqchip/irq-apple-aic.c
++++ b/drivers/irqchip/irq-apple-aic.c
+@@ -1144,6 +1144,7 @@ static int __init aic_of_ic_init(struct device_node *node, struct device_node *p
+ 		for_each_child_of_node(affs, chld)
+ 			build_fiq_affinity(irqc, chld);
+ 	}
++	of_node_put(affs);
+ 
+ 	set_handle_irq(aic_handle_irq);
+ 	set_handle_fiq(aic_handle_fiq);
diff --git a/0094-irqchip-gic-v3-Fix-error-handling-in-gic_populate_pp.patch b/0094-irqchip-gic-v3-Fix-error-handling-in-gic_populate_pp.patch
new file mode 100644
index 000000000000..301ada32f2db
--- /dev/null
+++ b/0094-irqchip-gic-v3-Fix-error-handling-in-gic_populate_pp.patch
@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 1 Jun 2022 12:09:28 +0400
+Subject: [PATCH] irqchip/gic-v3: Fix error handling in
+ gic_populate_ppi_partitions
+
+[ Upstream commit ec8401a429ffee34ccf38cebf3443f8d5ae6cb0d ]
+
+of_get_child_by_name() returns a node pointer with refcount
+incremented, we should use of_node_put() on it when not need anymore.
+When kcalloc fails, it missing of_node_put() and results in refcount
+leak. Fix this by goto out_put_node label.
+
+Fixes: 52085d3f2028 ("irqchip/gic-v3: Dynamically allocate PPI partition descriptors")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220601080930.31005-5-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 1af2b50f36f3e508bdf990b47ab334ca93930e5e..7855a2d7499ef738a93d7a1be0619859e0962af8 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1922,7 +1922,7 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
+ 
+ 	gic_data.ppi_descs = kcalloc(gic_data.ppi_nr, sizeof(*gic_data.ppi_descs), GFP_KERNEL);
+ 	if (!gic_data.ppi_descs)
+-		return;
++		goto out_put_node;
+ 
+ 	nr_parts = of_get_child_count(parts_node);
+ 
diff --git a/0095-irqchip-gic-v3-Fix-refcount-leak-in-gic_populate_ppi.patch b/0095-irqchip-gic-v3-Fix-refcount-leak-in-gic_populate_ppi.patch
new file mode 100644
index 000000000000..b3574cfad9b3
--- /dev/null
+++ b/0095-irqchip-gic-v3-Fix-refcount-leak-in-gic_populate_ppi.patch
@@ -0,0 +1,42 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 1 Jun 2022 12:09:29 +0400
+Subject: [PATCH] irqchip/gic-v3: Fix refcount leak in
+ gic_populate_ppi_partitions
+
+[ Upstream commit fa1ad9d4cc47ca2470cd904ad4519f05d7e43a2b ]
+
+of_find_node_by_phandle() returns a node pointer with refcount
+incremented, we should use of_node_put() on it when not need anymore.
+Add missing of_node_put() to avoid refcount leak.
+
+Fixes: e3825ba1af3a ("irqchip/gic-v3: Add support for partitioned PPIs")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220601080930.31005-6-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 7855a2d7499ef738a93d7a1be0619859e0962af8..d5420f9d6219f40a5f1f1b5dffd7d4cd9c3efe26 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1963,12 +1963,15 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
+ 				continue;
+ 
+ 			cpu = of_cpu_node_to_id(cpu_node);
+-			if (WARN_ON(cpu < 0))
++			if (WARN_ON(cpu < 0)) {
++				of_node_put(cpu_node);
+ 				continue;
++			}
+ 
+ 			pr_cont("%pOF[%d] ", cpu_node, cpu);
+ 
+ 			cpumask_set_cpu(cpu, &part->mask);
++			of_node_put(cpu_node);
+ 		}
+ 
+ 		pr_cont("}\n");
diff --git a/0096-irqchip-realtek-rtl-Fix-refcount-leak-in-map_interru.patch b/0096-irqchip-realtek-rtl-Fix-refcount-leak-in-map_interru.patch
new file mode 100644
index 000000000000..4f8a2b767263
--- /dev/null
+++ b/0096-irqchip-realtek-rtl-Fix-refcount-leak-in-map_interru.patch
@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 1 Jun 2022 12:09:30 +0400
+Subject: [PATCH] irqchip/realtek-rtl: Fix refcount leak in map_interrupts
+
+[ Upstream commit eff4780f83d0ae3e5b6c02ff5d999dc4c1c5c8ce ]
+
+of_find_node_by_phandle() returns a node pointer with refcount
+incremented, we should use of_node_put() on it when not need anymore.
+This function doesn't call of_node_put() in error path.
+Call of_node_put() directly after of_property_read_u32() to cover
+both normal path and error path.
+
+Fixes: 9f3a0f34b84a ("irqchip: Add support for Realtek RTL838x/RTL839x interrupt controller")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220601080930.31005-7-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-realtek-rtl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-realtek-rtl.c b/drivers/irqchip/irq-realtek-rtl.c
+index 50a56820c99bcf70b2bac17ad32ea37651dc11a5..56bf502d9c6739d60af8c5ae7b0c667bf10de4ba 100644
+--- a/drivers/irqchip/irq-realtek-rtl.c
++++ b/drivers/irqchip/irq-realtek-rtl.c
+@@ -134,9 +134,9 @@ static int __init map_interrupts(struct device_node *node, struct irq_domain *do
+ 		if (!cpu_ictl)
+ 			return -EINVAL;
+ 		ret = of_property_read_u32(cpu_ictl, "#interrupt-cells", &tmp);
++		of_node_put(cpu_ictl);
+ 		if (ret || tmp != 1)
+ 			return -EINVAL;
+-		of_node_put(cpu_ictl);
+ 
+ 		cpu_int = be32_to_cpup(imap + 2);
+ 		if (cpu_int > 7 || cpu_int < 2)
diff --git a/0097-sched-Fix-balance_push-vs-__sched_setscheduler.patch b/0097-sched-Fix-balance_push-vs-__sched_setscheduler.patch
new file mode 100644
index 000000000000..fd0154d76ef5
--- /dev/null
+++ b/0097-sched-Fix-balance_push-vs-__sched_setscheduler.patch
@@ -0,0 +1,115 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Tue, 7 Jun 2022 22:41:55 +0200
+Subject: [PATCH] sched: Fix balance_push() vs __sched_setscheduler()
+
+[ Upstream commit 04193d590b390ec7a0592630f46d559ec6564ba1 ]
+
+The purpose of balance_push() is to act as a filter on task selection
+in the case of CPU hotplug, specifically when taking the CPU out.
+
+It does this by (ab)using the balance callback infrastructure, with
+the express purpose of keeping all the unlikely/odd cases in a single
+place.
+
+In order to serve its purpose, the balance_push_callback needs to be
+(exclusively) on the callback list at all times (noting that the
+callback always places itself back on the list the moment it runs,
+also noting that when the CPU goes down, regular balancing concerns
+are moot, so ignoring them is fine).
+
+And here-in lies the problem, __sched_setscheduler()'s use of
+splice_balance_callbacks() takes the callbacks off the list across a
+lock-break, making it possible for, an interleaving, __schedule() to
+see an empty list and not get filtered.
+
+Fixes: ae7927023243 ("sched: Optimize finish_lock_switch()")
+Reported-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
+Link: https://lkml.kernel.org/r/20220519134706.GH2578@worktop.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c  | 36 +++++++++++++++++++++++++++++++++---
+ kernel/sched/sched.h |  5 +++++
+ 2 files changed, 38 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index e58d894df207468d93cf87d3ef8b786c0a3f6209..dd11daa7a84b1b7b21251e4f8b788ceb80b11634 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4755,25 +4755,55 @@ static void do_balance_callbacks(struct rq *rq, struct callback_head *head)
+ 
+ static void balance_push(struct rq *rq);
+ 
++/*
++ * balance_push_callback is a right abuse of the callback interface and plays
++ * by significantly different rules.
++ *
++ * Where the normal balance_callback's purpose is to be ran in the same context
++ * that queued it (only later, when it's safe to drop rq->lock again),
++ * balance_push_callback is specifically targeted at __schedule().
++ *
++ * This abuse is tolerated because it places all the unlikely/odd cases behind
++ * a single test, namely: rq->balance_callback == NULL.
++ */
+ struct callback_head balance_push_callback = {
+ 	.next = NULL,
+ 	.func = (void (*)(struct callback_head *))balance_push,
+ };
+ 
+-static inline struct callback_head *splice_balance_callbacks(struct rq *rq)
++static inline struct callback_head *
++__splice_balance_callbacks(struct rq *rq, bool split)
+ {
+ 	struct callback_head *head = rq->balance_callback;
+ 
++	if (likely(!head))
++		return NULL;
++
+ 	lockdep_assert_rq_held(rq);
+-	if (head)
++	/*
++	 * Must not take balance_push_callback off the list when
++	 * splice_balance_callbacks() and balance_callbacks() are not
++	 * in the same rq->lock section.
++	 *
++	 * In that case it would be possible for __schedule() to interleave
++	 * and observe the list empty.
++	 */
++	if (split && head == &balance_push_callback)
++		head = NULL;
++	else
+ 		rq->balance_callback = NULL;
+ 
+ 	return head;
+ }
+ 
++static inline struct callback_head *splice_balance_callbacks(struct rq *rq)
++{
++	return __splice_balance_callbacks(rq, true);
++}
++
+ static void __balance_callbacks(struct rq *rq)
+ {
+-	do_balance_callbacks(rq, splice_balance_callbacks(rq));
++	do_balance_callbacks(rq, __splice_balance_callbacks(rq, false));
+ }
+ 
+ static inline void balance_callbacks(struct rq *rq, struct callback_head *head)
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 0d2b6b758f324043d2f975a620b9f51ee3dc803d..84bba67c92dc6a962ec6be66ecc18806439a9f42 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1686,6 +1686,11 @@ queue_balance_callback(struct rq *rq,
+ {
+ 	lockdep_assert_rq_held(rq);
+ 
++	/*
++	 * Don't (re)queue an already queued item; nor queue anything when
++	 * balance_push() is active, see the comment with
++	 * balance_push_callback.
++	 */
+ 	if (unlikely(head->next || rq->balance_callback == &balance_push_callback))
+ 		return;
+ 
diff --git a/0098-i2c-designware-Use-standard-optional-ref-clock-imple.patch b/0098-i2c-designware-Use-standard-optional-ref-clock-imple.patch
new file mode 100644
index 000000000000..90add044f51c
--- /dev/null
+++ b/0098-i2c-designware-Use-standard-optional-ref-clock-imple.patch
@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Date: Fri, 10 Jun 2022 10:42:33 +0300
+Subject: [PATCH] i2c: designware: Use standard optional ref clock
+ implementation
+
+[ Upstream commit 27071b5cbca59d8e8f8750c199a6cbf8c9799963 ]
+
+Even though the DW I2C controller reference clock source is requested by
+the method devm_clk_get() with non-optional clock requirement the way the
+clock handler is used afterwards has a pure optional clock semantic
+(though in some circumstances we can get a warning about the clock missing
+printed in the system console). There is no point in reimplementing that
+functionality seeing the kernel clock framework already supports the
+optional interface from scratch. Thus let's convert the platform driver to
+using it.
+
+Note by providing this commit we get to fix two problems. The first one
+was introduced in commit c62ebb3d5f0d ("i2c: designware: Add support for
+an interface clock"). It causes not having the interface clock (pclk)
+enabled/disabled in case if the reference clock isn't provided. The second
+problem was first introduced in commit b33af11de236 ("i2c: designware: Do
+not require clock when SSCN and FFCN are provided"). Since that
+modification the deferred probe procedure has been unsupported in case if
+the interface clock isn't ready.
+
+Fixes: c62ebb3d5f0d ("i2c: designware: Add support for an interface clock")
+Fixes: b33af11de236 ("i2c: designware: Do not require clock when SSCN and FFCN are provided")
+Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-common.c  |  3 ---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 13 +++++++++++--
+ 2 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c
+index 9f8574320eb2dfe3b4bf51bac51b9664e61afa4b..b08e5bc2b64ccca5cf069cbd605e63bff08cb945 100644
+--- a/drivers/i2c/busses/i2c-designware-common.c
++++ b/drivers/i2c/busses/i2c-designware-common.c
+@@ -477,9 +477,6 @@ int i2c_dw_prepare_clk(struct dw_i2c_dev *dev, bool prepare)
+ {
+ 	int ret;
+ 
+-	if (IS_ERR(dev->clk))
+-		return PTR_ERR(dev->clk);
+-
+ 	if (prepare) {
+ 		/* Optional interface clock */
+ 		ret = clk_prepare_enable(dev->pclk);
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 70ade5306e458fdcdfaf53472195ecc24fafe40b..ba043b5473936b67f135b0d34c24efa2518cc12e 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -320,8 +320,17 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+ 		goto exit_reset;
+ 	}
+ 
+-	dev->clk = devm_clk_get(&pdev->dev, NULL);
+-	if (!i2c_dw_prepare_clk(dev, true)) {
++	dev->clk = devm_clk_get_optional(&pdev->dev, NULL);
++	if (IS_ERR(dev->clk)) {
++		ret = PTR_ERR(dev->clk);
++		goto exit_reset;
++	}
++
++	ret = i2c_dw_prepare_clk(dev, true);
++	if (ret)
++		goto exit_reset;
++
++	if (dev->clk) {
+ 		u64 clk_khz;
+ 
+ 		dev->get_clk_rate_khz = i2c_dw_get_clk_rate_khz;
diff --git a/0099-i2c-mediatek-Fix-an-error-handling-path-in-mtk_i2c_p.patch b/0099-i2c-mediatek-Fix-an-error-handling-path-in-mtk_i2c_p.patch
new file mode 100644
index 000000000000..703550da3403
--- /dev/null
+++ b/0099-i2c-mediatek-Fix-an-error-handling-path-in-mtk_i2c_p.patch
@@ -0,0 +1,52 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 22 May 2022 14:22:07 +0200
+Subject: [PATCH] i2c: mediatek: Fix an error handling path in mtk_i2c_probe()
+
+[ Upstream commit de87b603b0919e31578c8fa312a3541f1fb37e1c ]
+
+The clsk are prepared, enabled, then disabled. So if an error occurs after
+the disable step, they are still prepared.
+
+Add an error handling path to unprepare the clks in such a case, as already
+done in the .remove function.
+
+Fixes: 8b4fc246c3ff ("i2c: mediatek: Optimize master_xfer() and avoid circular locking")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index bdecb78bfc26d20871ed488a420a39ded5086332..8e6985354fd59f88df2d2b39f883953a24488e05 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1420,17 +1420,22 @@ static int mtk_i2c_probe(struct platform_device *pdev)
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev,
+ 			"Request I2C IRQ %d fail\n", irq);
+-		return ret;
++		goto err_bulk_unprepare;
+ 	}
+ 
+ 	i2c_set_adapdata(&i2c->adap, i2c);
+ 	ret = i2c_add_adapter(&i2c->adap);
+ 	if (ret)
+-		return ret;
++		goto err_bulk_unprepare;
+ 
+ 	platform_set_drvdata(pdev, i2c);
+ 
+ 	return 0;
++
++err_bulk_unprepare:
++	clk_bulk_unprepare(I2C_MT65XX_CLK_MAX, i2c->clocks);
++
++	return ret;
+ }
+ 
+ static int mtk_i2c_remove(struct platform_device *pdev)
diff --git a/0100-mei-hbm-drop-capability-response-on-early-shutdown.patch b/0100-mei-hbm-drop-capability-response-on-early-shutdown.patch
new file mode 100644
index 000000000000..4dabbd203c53
--- /dev/null
+++ b/0100-mei-hbm-drop-capability-response-on-early-shutdown.patch
@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Mon, 6 Jun 2022 17:42:24 +0300
+Subject: [PATCH] mei: hbm: drop capability response on early shutdown
+
+commit 68553650bc9c57c7e530c84e5b2945e9dfe1a560 upstream.
+
+Drop HBM responses also in the early shutdown phase where
+the usual traffic is allowed.
+Extend the rule that drop HBM responses received during the shutdown
+phase by also in MEI_DEV_POWERING_DOWN state.
+This resolves the stall if the driver is stopping in the middle
+of the link initialization or link reset.
+
+Drop the capabilities response on early shutdown.
+
+Fixes: 6d7163f2c49f ("mei: hbm: drop hbm responses on early shutdown")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20220606144225.282375-2-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/hbm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
+index cebcca6d6d3ef8f61932699caacc61d63ecab88f..cf2b8261da1444470a310f80c4cdc9e9cd4afeb5 100644
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -1351,7 +1351,8 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
+ 
+ 		if (dev->dev_state != MEI_DEV_INIT_CLIENTS ||
+ 		    dev->hbm_state != MEI_HBM_CAP_SETUP) {
+-			if (dev->dev_state == MEI_DEV_POWER_DOWN) {
++			if (dev->dev_state == MEI_DEV_POWER_DOWN ||
++			    dev->dev_state == MEI_DEV_POWERING_DOWN) {
+ 				dev_dbg(dev->dev, "hbm: capabilities response: on shutdown, ignoring\n");
+ 				return 0;
+ 			}
diff --git a/0101-mei-me-add-raptor-lake-point-S-DID.patch b/0101-mei-me-add-raptor-lake-point-S-DID.patch
new file mode 100644
index 000000000000..636870edc09f
--- /dev/null
+++ b/0101-mei-me-add-raptor-lake-point-S-DID.patch
@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Mon, 6 Jun 2022 17:42:25 +0300
+Subject: [PATCH] mei: me: add raptor lake point S DID
+
+commit 3ed8c7d39cfef831fe508fc1308f146912fa72e6 upstream.
+
+Add Raptor (Point) Lake S device id.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20220606144225.282375-3-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/hw-me-regs.h | 2 ++
+ drivers/misc/mei/pci-me.c     | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index 64ce3f830262b8618c2ee139dee4956619be964f..15e8e2b322b1a398678555f0a07091c7a1fe84b3 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -109,6 +109,8 @@
+ #define MEI_DEV_ID_ADP_P      0x51E0  /* Alder Lake Point P */
+ #define MEI_DEV_ID_ADP_N      0x54E0  /* Alder Lake Point N */
+ 
++#define MEI_DEV_ID_RPL_S      0x7A68  /* Raptor Lake Point S */
++
+ /*
+  * MEI HW Section
+  */
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 33e58821e478558c8b39b23a6b9bf43be1a4290e..5435604327a71e9077d242c30386af505905f9e3 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -116,6 +116,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_ADP_P, MEI_ME_PCH15_CFG)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_ADP_N, MEI_ME_PCH15_CFG)},
+ 
++	{MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)},
++
+ 	/* required last entry */
+ 	{0, }
+ };
diff --git a/0102-comedi-vmk80xx-fix-expression-for-tx-buffer-size.patch b/0102-comedi-vmk80xx-fix-expression-for-tx-buffer-size.patch
new file mode 100644
index 000000000000..b996e08cbfa9
--- /dev/null
+++ b/0102-comedi-vmk80xx-fix-expression-for-tx-buffer-size.patch
@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Tue, 7 Jun 2022 18:18:19 +0100
+Subject: [PATCH] comedi: vmk80xx: fix expression for tx buffer size
+
+commit 242439f7e279d86b3f73b5de724bc67b2f8aeb07 upstream.
+
+The expression for setting the size of the allocated bulk TX buffer
+(`devpriv->usb_tx_buf`) is calling `usb_endpoint_maxp(devpriv->ep_rx)`,
+which is using the wrong endpoint (should be `devpriv->ep_tx`).  Fix it.
+
+Fixes: a23461c47482 ("comedi: vmk80xx: fix transfer-buffer overflow")
+Cc: Johan Hovold <johan@kernel.org>
+Cc: stable@vger.kernel.org # 4.9+
+Reviewed-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://lore.kernel.org/r/20220607171819.4121-1-abbotti@mev.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/comedi/drivers/vmk80xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/comedi/drivers/vmk80xx.c b/drivers/comedi/drivers/vmk80xx.c
+index 46023adc539585aaf5e081234845ebe1907c5b4d..4536ed43f65b2763ec4612a000eb4dae70875c17 100644
+--- a/drivers/comedi/drivers/vmk80xx.c
++++ b/drivers/comedi/drivers/vmk80xx.c
+@@ -684,7 +684,7 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
+ 	if (!devpriv->usb_rx_buf)
+ 		return -ENOMEM;
+ 
+-	size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
++	size = max(usb_endpoint_maxp(devpriv->ep_tx), MIN_BUF_SIZE);
+ 	devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
+ 	if (!devpriv->usb_tx_buf)
+ 		return -ENOMEM;
diff --git a/0103-crypto-memneq-move-into-lib.patch b/0103-crypto-memneq-move-into-lib.patch
new file mode 100644
index 000000000000..0b340d40d149
--- /dev/null
+++ b/0103-crypto-memneq-move-into-lib.patch
@@ -0,0 +1,105 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Sat, 28 May 2022 12:24:29 +0200
+Subject: [PATCH] crypto: memneq - move into lib/
+
+commit abfed87e2a12bd246047d78c01d81eb9529f1d06 upstream.
+
+This is used by code that doesn't need CONFIG_CRYPTO, so move this into
+lib/ with a Kconfig option so that it can be selected by whatever needs
+it.
+
+This fixes a linker error Zheng pointed out when
+CRYPTO_MANAGER_DISABLE_TESTS!=y and CRYPTO=m:
+
+  lib/crypto/curve25519-selftest.o: In function `curve25519_selftest':
+  curve25519-selftest.c:(.init.text+0x60): undefined reference to `__crypto_memneq'
+  curve25519-selftest.c:(.init.text+0xec): undefined reference to `__crypto_memneq'
+  curve25519-selftest.c:(.init.text+0x114): undefined reference to `__crypto_memneq'
+  curve25519-selftest.c:(.init.text+0x154): undefined reference to `__crypto_memneq'
+
+Reported-by: Zheng Bin <zhengbin13@huawei.com>
+Cc: Eric Biggers <ebiggers@kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: aa127963f1ca ("crypto: lib/curve25519 - re-add selftests")
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/Kconfig           | 1 +
+ crypto/Makefile          | 2 +-
+ lib/Kconfig              | 3 +++
+ lib/Makefile             | 1 +
+ lib/crypto/Kconfig       | 1 +
+ {crypto => lib}/memneq.c | 0
+ 6 files changed, 7 insertions(+), 1 deletion(-)
+ rename {crypto => lib}/memneq.c (100%)
+
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index 41068811fd0e1d8facff621a9116b7d1e1b59ef7..b4e00a7a046b95158d8490f9c0fa2fd28416e0f3 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -15,6 +15,7 @@ source "crypto/async_tx/Kconfig"
+ #
+ menuconfig CRYPTO
+ 	tristate "Cryptographic API"
++	select LIB_MEMNEQ
+ 	help
+ 	  This option provides the core Cryptographic API.
+ 
+diff --git a/crypto/Makefile b/crypto/Makefile
+index f754c4d17d6bdb5df40e2b9e697623a9d95d0745..a40e6d5fb2c83346439d843d72f11297a600143a 100644
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -4,7 +4,7 @@
+ #
+ 
+ obj-$(CONFIG_CRYPTO) += crypto.o
+-crypto-y := api.o cipher.o compress.o memneq.o
++crypto-y := api.o cipher.o compress.o
+ 
+ obj-$(CONFIG_CRYPTO_ENGINE) += crypto_engine.o
+ obj-$(CONFIG_CRYPTO_FIPS) += fips.o
+diff --git a/lib/Kconfig b/lib/Kconfig
+index 087e06b4cdfdeb08dbe832a6b98a1f22e8d57483..55f0bba8f8c00928dc222164436f32d42ebb4275 100644
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -120,6 +120,9 @@ config INDIRECT_IOMEM_FALLBACK
+ 
+ source "lib/crypto/Kconfig"
+ 
++config LIB_MEMNEQ
++	bool
++
+ config CRC_CCITT
+ 	tristate "CRC-CCITT functions"
+ 	help
+diff --git a/lib/Makefile b/lib/Makefile
+index 08053df16c7c878d0b3c8f011ff22c1960466cfd..60843ab661ba67b89f48da500bef2ba8b8736d81 100644
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -251,6 +251,7 @@ obj-$(CONFIG_DIMLIB) += dim/
+ obj-$(CONFIG_SIGNATURE) += digsig.o
+ 
+ lib-$(CONFIG_CLZ_TAB) += clz_tab.o
++lib-$(CONFIG_LIB_MEMNEQ) += memneq.o
+ 
+ obj-$(CONFIG_GENERIC_STRNCPY_FROM_USER) += strncpy_from_user.o
+ obj-$(CONFIG_GENERIC_STRNLEN_USER) += strnlen_user.o
+diff --git a/lib/crypto/Kconfig b/lib/crypto/Kconfig
+index 379a66d7f504cf2bc6e8a0c6478d5420a1703a7f..017cba12538659ee6c1dc01e41216ce6a49df883 100644
+--- a/lib/crypto/Kconfig
++++ b/lib/crypto/Kconfig
+@@ -71,6 +71,7 @@ config CRYPTO_LIB_CURVE25519
+ 	tristate "Curve25519 scalar multiplication library"
+ 	depends on CRYPTO_ARCH_HAVE_LIB_CURVE25519 || !CRYPTO_ARCH_HAVE_LIB_CURVE25519
+ 	select CRYPTO_LIB_CURVE25519_GENERIC if CRYPTO_ARCH_HAVE_LIB_CURVE25519=n
++	select LIB_MEMNEQ
+ 	help
+ 	  Enable the Curve25519 library interface. This interface may be
+ 	  fulfilled by either the generic implementation or an arch-specific
+diff --git a/crypto/memneq.c b/lib/memneq.c
+similarity index 100%
+rename from crypto/memneq.c
+rename to lib/memneq.c
diff --git a/0104-USB-serial-option-add-support-for-Cinterion-MV31-wit.patch b/0104-USB-serial-option-add-support-for-Cinterion-MV31-wit.patch
new file mode 100644
index 000000000000..fd91e57bf5ea
--- /dev/null
+++ b/0104-USB-serial-option-add-support-for-Cinterion-MV31-wit.patch
@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Slark Xiao <slark_xiao@163.com>
+Date: Wed, 1 Jun 2022 11:47:40 +0800
+Subject: [PATCH] USB: serial: option: add support for Cinterion MV31 with new
+ baseline
+
+commit 158f7585bfcea4aae0ad4128d032a80fec550df1 upstream.
+
+Adding support for Cinterion device MV31 with Qualcomm
+new baseline. Use different PIDs to separate it from
+previous base line products.
+All interfaces settings keep same as previous.
+
+Below is test evidence:
+T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  6 Spd=480 MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=1e2d ProdID=00b8 Rev=04.14
+S:  Manufacturer=Cinterion
+S:  Product=Cinterion PID 0x00B8 USB Mobile Broadband
+S:  SerialNumber=90418e79
+C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:  If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I:  If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+I:  If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
+I:  If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+
+T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  7 Spd=480 MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=1e2d ProdID=00b9 Rev=04.14
+S:  Manufacturer=Cinterion
+S:  Product=Cinterion PID 0x00B9 USB Mobile Broadband
+S:  SerialNumber=90418e79
+C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:  If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
+I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+
+For PID 00b8, interface 3 is GNSS port which don't use serial driver.
+
+Signed-off-by: Slark Xiao <slark_xiao@163.com>
+Link: https://lore.kernel.org/r/20220601034740.5438-1-slark_xiao@163.com
+[ johan: rename defines using a "2" infix ]
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index e60425bbf5376481bc5f9063a36223f3b1b2e43b..ed1e50d83ccab1cf460ff538489f2463861fc0a6 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -432,6 +432,8 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_CLS8			0x00b0
+ #define CINTERION_PRODUCT_MV31_MBIM		0x00b3
+ #define CINTERION_PRODUCT_MV31_RMNET		0x00b7
++#define CINTERION_PRODUCT_MV31_2_MBIM		0x00b8
++#define CINTERION_PRODUCT_MV31_2_RMNET		0x00b9
+ #define CINTERION_PRODUCT_MV32_WA		0x00f1
+ #define CINTERION_PRODUCT_MV32_WB		0x00f2
+ 
+@@ -1979,6 +1981,10 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = RSVD(3)},
+ 	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_RMNET, 0xff),
+ 	  .driver_info = RSVD(0)},
++	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_2_MBIM, 0xff),
++	  .driver_info = RSVD(3)},
++	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_2_RMNET, 0xff),
++	  .driver_info = RSVD(0)},
+ 	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff),
+ 	  .driver_info = RSVD(3)},
+ 	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff),
diff --git a/0105-USB-serial-io_ti-add-Agilent-E5805A-support.patch b/0105-USB-serial-io_ti-add-Agilent-E5805A-support.patch
new file mode 100644
index 000000000000..f6545b1ce50c
--- /dev/null
+++ b/0105-USB-serial-io_ti-add-Agilent-E5805A-support.patch
@@ -0,0 +1,51 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Robert Eckelmann <longnoserob@gmail.com>
+Date: Sat, 21 May 2022 23:08:08 +0900
+Subject: [PATCH] USB: serial: io_ti: add Agilent E5805A support
+
+commit 908e698f2149c3d6a67d9ae15c75545a3f392559 upstream.
+
+Add support for Agilent E5805A (rebranded ION Edgeport/4) to io_ti.
+
+Signed-off-by: Robert Eckelmann <longnoserob@gmail.com>
+Link: https://lore.kernel.org/r/20220521230808.30931eca@octoberrain
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/io_ti.c      | 2 ++
+ drivers/usb/serial/io_usbvend.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index a7b3c15957ba937f39767b94ed694b69ef21fc85..feba2a8d1233a902f20886f1d7050f5ede11fa2f 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -166,6 +166,7 @@ static const struct usb_device_id edgeport_2port_id_table[] = {
+ 	{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_8S) },
+ 	{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_416) },
+ 	{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_416B) },
++	{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_E5805A) },
+ 	{ }
+ };
+ 
+@@ -204,6 +205,7 @@ static const struct usb_device_id id_table_combined[] = {
+ 	{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_8S) },
+ 	{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_416) },
+ 	{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_416B) },
++	{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_E5805A) },
+ 	{ }
+ };
+ 
+diff --git a/drivers/usb/serial/io_usbvend.h b/drivers/usb/serial/io_usbvend.h
+index 52cbc353051feddb45b7b546aefbfe8dac25c1a4..9a6f742ad3abd032b8c481c216049dcf32f2ebf0 100644
+--- a/drivers/usb/serial/io_usbvend.h
++++ b/drivers/usb/serial/io_usbvend.h
+@@ -212,6 +212,7 @@
+ //
+ // Definitions for other product IDs
+ #define ION_DEVICE_ID_MT4X56USB			0x1403	// OEM device
++#define ION_DEVICE_ID_E5805A			0x1A01  // OEM device (rebranded Edgeport/4)
+ 
+ 
+ #define	GENERATION_ID_FROM_USB_PRODUCT_ID(ProductId)				\
diff --git a/0106-arm64-mm-Don-t-invalidate-FROM_DEVICE-buffers-at-sta.patch b/0106-arm64-mm-Don-t-invalidate-FROM_DEVICE-buffers-at-sta.patch
new file mode 100644
index 000000000000..a803b1f45a97
--- /dev/null
+++ b/0106-arm64-mm-Don-t-invalidate-FROM_DEVICE-buffers-at-sta.patch
@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Fri, 10 Jun 2022 16:12:27 +0100
+Subject: [PATCH] arm64: mm: Don't invalidate FROM_DEVICE buffers at start of
+ DMA transfer
+
+commit c50f11c6196f45c92ca48b16a5071615d4ae0572 upstream.
+
+Invalidating the buffer memory in arch_sync_dma_for_device() for
+FROM_DEVICE transfers
+
+When using the streaming DMA API to map a buffer prior to inbound
+non-coherent DMA (i.e. DMA_FROM_DEVICE), we invalidate any dirty CPU
+cachelines so that they will not be written back during the transfer and
+corrupt the buffer contents written by the DMA. This, however, poses two
+potential problems:
+
+  (1) If the DMA transfer does not write to every byte in the buffer,
+      then the unwritten bytes will contain stale data once the transfer
+      has completed.
+
+  (2) If the buffer has a virtual alias in userspace, then stale data
+      may be visible via this alias during the period between performing
+      the cache invalidation and the DMA writes landing in memory.
+
+Address both of these issues by cleaning (aka writing-back) the dirty
+lines in arch_sync_dma_for_device(DMA_FROM_DEVICE) instead of discarding
+them using invalidation.
+
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220606152150.GA31568@willie-the-truck
+Signed-off-by: Will Deacon <will@kernel.org>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Link: https://lore.kernel.org/r/20220610151228.4562-2-will@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/mm/cache.S | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S
+index 0ea6cc25dc66356de86d262cc3d48bb993ec3cd0..21c907987080f60d4b25ef70f438332a6c1c24cc 100644
+--- a/arch/arm64/mm/cache.S
++++ b/arch/arm64/mm/cache.S
+@@ -218,8 +218,6 @@ SYM_FUNC_ALIAS(__dma_flush_area, __pi___dma_flush_area)
+  */
+ SYM_FUNC_START(__pi___dma_map_area)
+ 	add	x1, x0, x1
+-	cmp	w2, #DMA_FROM_DEVICE
+-	b.eq	__pi_dcache_inval_poc
+ 	b	__pi_dcache_clean_poc
+ SYM_FUNC_END(__pi___dma_map_area)
+ SYM_FUNC_ALIAS(__dma_map_area, __pi___dma_map_area)
diff --git a/0107-usb-dwc2-Fix-memory-leak-in-dwc2_hcd_init.patch b/0107-usb-dwc2-Fix-memory-leak-in-dwc2_hcd_init.patch
new file mode 100644
index 000000000000..9be262fcc437
--- /dev/null
+++ b/0107-usb-dwc2-Fix-memory-leak-in-dwc2_hcd_init.patch
@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Mon, 30 May 2022 12:54:12 +0400
+Subject: [PATCH] usb: dwc2: Fix memory leak in dwc2_hcd_init
+
+commit 3755278f078460b021cd0384562977bf2039a57a upstream.
+
+usb_create_hcd will alloc memory for hcd, and we should
+call usb_put_hcd to free it when platform_get_resource()
+fails to prevent memory leak.
+goto error2 label instead error1 to fix this.
+
+Fixes: 856e6e8e0f93 ("usb: dwc2: check return value after calling platform_get_resource()")
+Cc: stable <stable@kernel.org>
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220530085413.44068-1-linmq006@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index f63a27d11fac8d91fd456074d7a181cdddb882ee..3f107a06817d86e088bd30a87dfc8597d7e15b97 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5190,7 +5190,7 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	if (!res) {
+ 		retval = -EINVAL;
+-		goto error1;
++		goto error2;
+ 	}
+ 	hcd->rsrc_start = res->start;
+ 	hcd->rsrc_len = resource_size(res);
diff --git a/0108-usb-cdnsp-Fixed-setting-last_trb-incorrectly.patch b/0108-usb-cdnsp-Fixed-setting-last_trb-incorrectly.patch
new file mode 100644
index 000000000000..7f43a7e7dad3
--- /dev/null
+++ b/0108-usb-cdnsp-Fixed-setting-last_trb-incorrectly.patch
@@ -0,0 +1,58 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jing Leng <jleng@ambarella.com>
+Date: Thu, 9 Jun 2022 10:11:34 +0800
+Subject: [PATCH] usb: cdnsp: Fixed setting last_trb incorrectly
+
+commit 5c7578c39c3fffe85b7d15ca1cf8cf7ac38ec0c1 upstream.
+
+When ZLP occurs in bulk transmission, currently cdnsp will set last_trb
+for the last two TRBs, it will trigger an error "ERROR Transfer event TRB
+DMA ptr not part of current TD ...".
+
+Fixes: e913aada0683 ("usb: cdnsp: Fixed issue with ZLP")
+Cc: stable <stable@kernel.org>
+Acked-by: Pawel Laszczak <pawell@cadence.com>
+Signed-off-by: Jing Leng <jleng@ambarella.com>
+Link: https://lore.kernel.org/r/20220609021134.1606-1-3090101217@zju.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdnsp-ring.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c
+index e45c3d6e1536cf6dba325fef8ce925c35f0eb9e8..794e413800ae8239ac8ce2d92de8ddb8c6620345 100644
+--- a/drivers/usb/cdns3/cdnsp-ring.c
++++ b/drivers/usb/cdns3/cdnsp-ring.c
+@@ -1941,13 +1941,16 @@ int cdnsp_queue_bulk_tx(struct cdnsp_device *pdev, struct cdnsp_request *preq)
+ 		}
+ 
+ 		if (enqd_len + trb_buff_len >= full_len) {
+-			if (need_zero_pkt)
+-				zero_len_trb = !zero_len_trb;
+-
+-			field &= ~TRB_CHAIN;
+-			field |= TRB_IOC;
+-			more_trbs_coming = false;
+-			preq->td.last_trb = ring->enqueue;
++			if (need_zero_pkt && !zero_len_trb) {
++				zero_len_trb = true;
++			} else {
++				zero_len_trb = false;
++				field &= ~TRB_CHAIN;
++				field |= TRB_IOC;
++				more_trbs_coming = false;
++				need_zero_pkt = false;
++				preq->td.last_trb = ring->enqueue;
++			}
+ 		}
+ 
+ 		/* Only set interrupt on short packet for OUT endpoints. */
+@@ -1962,7 +1965,7 @@ int cdnsp_queue_bulk_tx(struct cdnsp_device *pdev, struct cdnsp_request *preq)
+ 		length_field = TRB_LEN(trb_buff_len) | TRB_TD_SIZE(remainder) |
+ 			TRB_INTR_TARGET(0);
+ 
+-		cdnsp_queue_trb(pdev, ring, more_trbs_coming | zero_len_trb,
++		cdnsp_queue_trb(pdev, ring, more_trbs_coming,
+ 				lower_32_bits(send_addr),
+ 				upper_32_bits(send_addr),
+ 				length_field,
diff --git a/0109-usb-dwc3-gadget-Fix-IN-endpoint-max-packet-size-allo.patch b/0109-usb-dwc3-gadget-Fix-IN-endpoint-max-packet-size-allo.patch
new file mode 100644
index 000000000000..7332fac9a1f5
--- /dev/null
+++ b/0109-usb-dwc3-gadget-Fix-IN-endpoint-max-packet-size-allo.patch
@@ -0,0 +1,79 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <quic_wcheng@quicinc.com>
+Date: Mon, 23 May 2022 14:39:48 -0700
+Subject: [PATCH] usb: dwc3: gadget: Fix IN endpoint max packet size allocation
+
+commit 9c1e916960c1192e746bf615e4dae25423473a64 upstream.
+
+The current logic to assign the max packet limit for IN endpoints attempts
+to take the default HW value and apply the optimal endpoint settings based
+on it.  However, if the default value reports a TxFIFO size large enough
+for only one max packet, it will divide the value and assign a smaller ep
+max packet limit.
+
+For example, if the default TxFIFO size fits 1024B, current logic will
+assign 1024/3 = 341B to ep max packet size.  If function drivers attempt to
+request for an endpoint with a wMaxPacketSize of 1024B (SS BULK max packet
+size) then it will fail, as the gadget is unable to find an endpoint which
+can fit the requested size.
+
+Functionally, if the TxFIFO has enough space to fit one max packet, it will
+be sufficient, at least when initializing the endpoints.
+
+Fixes: d94ea5319813 ("usb: dwc3: gadget: Properly set maxpacket limit")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
+Link: https://lore.kernel.org/r/20220523213948.22142-1-quic_wcheng@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index bf2eaa09d73c828e593cb178d136546565956aed..0a6633e7edce22a221f83f1782ae7f5f6ef83dd7 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2984,6 +2984,7 @@ static int dwc3_gadget_init_in_endpoint(struct dwc3_ep *dep)
+ 	struct dwc3 *dwc = dep->dwc;
+ 	u32 mdwidth;
+ 	int size;
++	int maxpacket;
+ 
+ 	mdwidth = dwc3_mdwidth(dwc);
+ 
+@@ -2996,21 +2997,24 @@ static int dwc3_gadget_init_in_endpoint(struct dwc3_ep *dep)
+ 	else
+ 		size = DWC31_GTXFIFOSIZ_TXFDEP(size);
+ 
+-	/* FIFO Depth is in MDWDITH bytes. Multiply */
+-	size *= mdwidth;
+-
+ 	/*
+-	 * To meet performance requirement, a minimum TxFIFO size of 3x
+-	 * MaxPacketSize is recommended for endpoints that support burst and a
+-	 * minimum TxFIFO size of 2x MaxPacketSize for endpoints that don't
+-	 * support burst. Use those numbers and we can calculate the max packet
+-	 * limit as below.
++	 * maxpacket size is determined as part of the following, after assuming
++	 * a mult value of one maxpacket:
++	 * DWC3 revision 280A and prior:
++	 * fifo_size = mult * (max_packet / mdwidth) + 1;
++	 * maxpacket = mdwidth * (fifo_size - 1);
++	 *
++	 * DWC3 revision 290A and onwards:
++	 * fifo_size = mult * ((max_packet + mdwidth)/mdwidth + 1) + 1
++	 * maxpacket = mdwidth * ((fifo_size - 1) - 1) - mdwidth;
+ 	 */
+-	if (dwc->maximum_speed >= USB_SPEED_SUPER)
+-		size /= 3;
++	if (DWC3_VER_IS_PRIOR(DWC3, 290A))
++		maxpacket = mdwidth * (size - 1);
+ 	else
+-		size /= 2;
++		maxpacket = mdwidth * ((size - 1) - 1) - mdwidth;
+ 
++	/* Functionally, space for one max packet is sufficient */
++	size = min_t(int, maxpacket, 1024);
+ 	usb_ep_set_maxpacket_limit(&dep->endpoint, size);
+ 
+ 	dep->endpoint.max_streams = 16;
diff --git a/0110-usb-dwc3-pci-Restore-line-lost-in-merge-conflict-res.patch b/0110-usb-dwc3-pci-Restore-line-lost-in-merge-conflict-res.patch
new file mode 100644
index 000000000000..e6ef836a5f1b
--- /dev/null
+++ b/0110-usb-dwc3-pci-Restore-line-lost-in-merge-conflict-res.patch
@@ -0,0 +1,42 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stephan Gerhold <stephan@gerhold.net>
+Date: Sat, 28 May 2022 19:09:13 +0200
+Subject: [PATCH] usb: dwc3: pci: Restore line lost in merge conflict
+ resolution
+
+commit 7ddda2614d62ef7fdef7fd85f5151cdf665b22d8 upstream.
+
+Commit 582ab24e096f ("usb: dwc3: pci: Set "linux,phy_charger_detect"
+property on some Bay Trail boards") added a new swnode similar to the
+existing ones for boards where the PHY handles charger detection.
+
+Unfortunately, the "linux,sysdev_is_parent" property got lost in the
+merge conflict resolution of commit ca9400ef7f67 ("Merge 5.17-rc6 into
+usb-next"). Now dwc3_pci_intel_phy_charger_detect_properties is the
+only swnode in dwc3-pci that is missing "linux,sysdev_is_parent".
+
+It does not seem to cause any obvious functional issues, but it's
+certainly unintended so restore the line to make the properties
+consistent again.
+
+Fixes: ca9400ef7f67 ("Merge 5.17-rc6 into usb-next")
+Cc: stable@vger.kernel.org
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Link: https://lore.kernel.org/r/20220528170913.9240-1-stephan@gerhold.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index ba51de7dd7605cf725119ec0ff6abfa434510cc3..6b018048fe2e15b9a11aa907db76773771c32b28 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -127,6 +127,7 @@ static const struct property_entry dwc3_pci_intel_phy_charger_detect_properties[
+ 	PROPERTY_ENTRY_STRING("dr_mode", "peripheral"),
+ 	PROPERTY_ENTRY_BOOL("snps,dis_u2_susphy_quirk"),
+ 	PROPERTY_ENTRY_BOOL("linux,phy_charger_detect"),
++	PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"),
+ 	{}
+ };
+ 
diff --git a/0111-usb-gadget-u_ether-fix-regression-in-setting-fixed-M.patch b/0111-usb-gadget-u_ether-fix-regression-in-setting-fixed-M.patch
new file mode 100644
index 000000000000..956e6081a7a3
--- /dev/null
+++ b/0111-usb-gadget-u_ether-fix-regression-in-setting-fixed-M.patch
@@ -0,0 +1,81 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marian Postevca <posteuca@mutex.one>
+Date: Fri, 3 Jun 2022 18:34:59 +0300
+Subject: [PATCH] usb: gadget: u_ether: fix regression in setting fixed MAC
+ address
+
+commit b337af3a4d6147000b7ca6b3438bf5c820849b37 upstream.
+
+In systemd systems setting a fixed MAC address through
+the "dev_addr" module argument fails systematically.
+When checking the MAC address after the interface is created
+it always has the same but different MAC address to the one
+supplied as argument.
+
+This is partially caused by systemd which by default will
+set an internally generated permanent MAC address for interfaces
+that are marked as having a randomly generated address.
+
+Commit 890d5b40908bfd1a ("usb: gadget: u_ether: fix race in
+setting MAC address in setup phase") didn't take into account
+the fact that the interface must be marked as having a set
+MAC address when it's set as module argument.
+
+Fixed by marking the interface with NET_ADDR_SET when
+the "dev_addr" module argument is supplied.
+
+Fixes: 890d5b40908bfd1a ("usb: gadget: u_ether: fix race in setting MAC address in setup phase")
+Cc: stable@vger.kernel.org
+Signed-off-by: Marian Postevca <posteuca@mutex.one>
+Link: https://lore.kernel.org/r/20220603153459.32722-1-posteuca@mutex.one
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/u_ether.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 6f5d45ef2e39a8caeab230cd42111477e387195a..f51694f29de92bb3d882d75d8c845ea42117aa3f 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -775,9 +775,13 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g,
+ 	dev->qmult = qmult;
+ 	snprintf(net->name, sizeof(net->name), "%s%%d", netname);
+ 
+-	if (get_ether_addr(dev_addr, addr))
++	if (get_ether_addr(dev_addr, addr)) {
++		net->addr_assign_type = NET_ADDR_RANDOM;
+ 		dev_warn(&g->dev,
+ 			"using random %s ethernet address\n", "self");
++	} else {
++		net->addr_assign_type = NET_ADDR_SET;
++	}
+ 	eth_hw_addr_set(net, addr);
+ 	if (get_ether_addr(host_addr, dev->host_mac))
+ 		dev_warn(&g->dev,
+@@ -844,6 +848,10 @@ struct net_device *gether_setup_name_default(const char *netname)
+ 
+ 	eth_random_addr(dev->dev_mac);
+ 	pr_warn("using random %s ethernet address\n", "self");
++
++	/* by default we always have a random MAC address */
++	net->addr_assign_type = NET_ADDR_RANDOM;
++
+ 	eth_random_addr(dev->host_mac);
+ 	pr_warn("using random %s ethernet address\n", "host");
+ 
+@@ -871,7 +879,6 @@ int gether_register_netdev(struct net_device *net)
+ 	dev = netdev_priv(net);
+ 	g = dev->gadget;
+ 
+-	net->addr_assign_type = NET_ADDR_RANDOM;
+ 	eth_hw_addr_set(net, dev->dev_mac);
+ 
+ 	status = register_netdev(net);
+@@ -912,6 +919,7 @@ int gether_set_dev_addr(struct net_device *net, const char *dev_addr)
+ 	if (get_ether_addr(dev_addr, new_addr))
+ 		return -EINVAL;
+ 	memcpy(dev->dev_mac, new_addr, ETH_ALEN);
++	net->addr_assign_type = NET_ADDR_SET;
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(gether_set_dev_addr);
diff --git a/0112-usb-gadget-lpc32xx_udc-Fix-refcount-leak-in-lpc32xx_.patch b/0112-usb-gadget-lpc32xx_udc-Fix-refcount-leak-in-lpc32xx_.patch
new file mode 100644
index 000000000000..ef437484622f
--- /dev/null
+++ b/0112-usb-gadget-lpc32xx_udc-Fix-refcount-leak-in-lpc32xx_.patch
@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Fri, 3 Jun 2022 18:02:44 +0400
+Subject: [PATCH] usb: gadget: lpc32xx_udc: Fix refcount leak in
+ lpc32xx_udc_probe
+
+commit 4757c9ade34178b351580133771f510b5ffcf9c8 upstream.
+
+of_parse_phandle() returns a node pointer with refcount
+incremented, we should use of_node_put() on it when not need anymore.
+Add missing of_node_put() to avoid refcount leak.
+of_node_put() will check NULL pointer.
+
+Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220603140246.64529-1-linmq006@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/lpc32xx_udc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
+index 6117ae8e7242beac495279574a05716e3fdee294..cea10cdb83ae502ccc15ed5eabf74577e9120eee 100644
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -3016,6 +3016,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	udc->isp1301_i2c_client = isp1301_get_client(isp1301_node);
++	of_node_put(isp1301_node);
+ 	if (!udc->isp1301_i2c_client) {
+ 		return -EPROBE_DEFER;
+ 	}
diff --git a/0113-usb-gadget-f_fs-change-ep-status-safe-in-ffs_epfile_.patch b/0113-usb-gadget-f_fs-change-ep-status-safe-in-ffs_epfile_.patch
new file mode 100644
index 000000000000..2d212deb2b64
--- /dev/null
+++ b/0113-usb-gadget-f_fs-change-ep-status-safe-in-ffs_epfile_.patch
@@ -0,0 +1,119 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Linyu Yuan <quic_linyyuan@quicinc.com>
+Date: Fri, 10 Jun 2022 20:17:57 +0800
+Subject: [PATCH] usb: gadget: f_fs: change ep->status safe in ffs_epfile_io()
+
+commit fb1f16d74e263baa4ad11e31e28b68f144aa55ed upstream.
+
+If a task read/write data in blocking mode, it will wait the completion
+in ffs_epfile_io(), if function unbind occurs, ffs_func_unbind() will
+kfree ffs ep, once the task wake up, it still dereference the ffs ep to
+obtain the request status.
+
+Fix it by moving the request status to io_data which is stack-safe.
+
+Cc: <stable@vger.kernel.org> # 5.15
+Reported-by: Michael Wu <michael@allwinnertech.com>
+Tested-by: Michael Wu <michael@allwinnertech.com>
+Reviewed-by: John Keeping <john@metanate.com>
+Signed-off-by: Linyu Yuan <quic_linyyuan@quicinc.com>
+Link: https://lore.kernel.org/r/1654863478-26228-2-git-send-email-quic_linyyuan@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 34 +++++++++++++++++-------------
+ 1 file changed, 19 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 4585ee3a444a8322880c180235a6ce173e60a9f3..e1fcd8bc80a14c01361f34d4ce9c641c7a5a1106 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -122,8 +122,6 @@ struct ffs_ep {
+ 	struct usb_endpoint_descriptor	*descs[3];
+ 
+ 	u8				num;
+-
+-	int				status;	/* P: epfile->mutex */
+ };
+ 
+ struct ffs_epfile {
+@@ -227,6 +225,9 @@ struct ffs_io_data {
+ 	bool use_sg;
+ 
+ 	struct ffs_data *ffs;
++
++	int status;
++	struct completion done;
+ };
+ 
+ struct ffs_desc_helper {
+@@ -707,12 +708,15 @@ static const struct file_operations ffs_ep0_operations = {
+ 
+ static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
+ {
++	struct ffs_io_data *io_data = req->context;
++
+ 	ENTER();
+-	if (req->context) {
+-		struct ffs_ep *ep = _ep->driver_data;
+-		ep->status = req->status ? req->status : req->actual;
+-		complete(req->context);
+-	}
++	if (req->status)
++		io_data->status = req->status;
++	else
++		io_data->status = req->actual;
++
++	complete(&io_data->done);
+ }
+ 
+ static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter)
+@@ -1050,7 +1054,6 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+ 		WARN(1, "%s: data_len == -EINVAL\n", __func__);
+ 		ret = -EINVAL;
+ 	} else if (!io_data->aio) {
+-		DECLARE_COMPLETION_ONSTACK(done);
+ 		bool interrupted = false;
+ 
+ 		req = ep->req;
+@@ -1066,7 +1069,8 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+ 
+ 		io_data->buf = data;
+ 
+-		req->context  = &done;
++		init_completion(&io_data->done);
++		req->context  = io_data;
+ 		req->complete = ffs_epfile_io_complete;
+ 
+ 		ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
+@@ -1075,7 +1079,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+ 
+ 		spin_unlock_irq(&epfile->ffs->eps_lock);
+ 
+-		if (wait_for_completion_interruptible(&done)) {
++		if (wait_for_completion_interruptible(&io_data->done)) {
+ 			/*
+ 			 * To avoid race condition with ffs_epfile_io_complete,
+ 			 * dequeue the request first then check
+@@ -1083,17 +1087,17 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+ 			 * condition with req->complete callback.
+ 			 */
+ 			usb_ep_dequeue(ep->ep, req);
+-			wait_for_completion(&done);
+-			interrupted = ep->status < 0;
++			wait_for_completion(&io_data->done);
++			interrupted = io_data->status < 0;
+ 		}
+ 
+ 		if (interrupted)
+ 			ret = -EINTR;
+-		else if (io_data->read && ep->status > 0)
+-			ret = __ffs_epfile_read_data(epfile, data, ep->status,
++		else if (io_data->read && io_data->status > 0)
++			ret = __ffs_epfile_read_data(epfile, data, io_data->status,
+ 						     &io_data->data);
+ 		else
+-			ret = ep->status;
++			ret = io_data->status;
+ 		goto error_mutex;
+ 	} else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) {
+ 		ret = -ENOMEM;
diff --git a/0114-usb-gadget-f_fs-change-ep-ep-safe-in-ffs_epfile_io.patch b/0114-usb-gadget-f_fs-change-ep-ep-safe-in-ffs_epfile_io.patch
new file mode 100644
index 000000000000..302ed630cd40
--- /dev/null
+++ b/0114-usb-gadget-f_fs-change-ep-ep-safe-in-ffs_epfile_io.patch
@@ -0,0 +1,50 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Linyu Yuan <quic_linyyuan@quicinc.com>
+Date: Fri, 10 Jun 2022 20:17:58 +0800
+Subject: [PATCH] usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io()
+
+commit 0698f0209d8032e8869525aeb68f65ee7fde12ad upstream.
+
+In ffs_epfile_io(), when read/write data in blocking mode, it will wait
+the completion in interruptible mode, if task receive a signal, it will
+terminate the wait, at same time, if function unbind occurs,
+ffs_func_unbind() will kfree all eps, ffs_epfile_io() still try to
+dequeue request by dereferencing ep which may become invalid.
+
+Fix it by add ep spinlock and will not dereference ep if it is not valid.
+
+Cc: <stable@vger.kernel.org> # 5.15
+Reported-by: Michael Wu <michael@allwinnertech.com>
+Tested-by: Michael Wu <michael@allwinnertech.com>
+Reviewed-by: John Keeping <john@metanate.com>
+Signed-off-by: Linyu Yuan <quic_linyyuan@quicinc.com>
+Link: https://lore.kernel.org/r/1654863478-26228-3-git-send-email-quic_linyyuan@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index e1fcd8bc80a14c01361f34d4ce9c641c7a5a1106..e0fa4b186ec6d21e037eeb76737b49c09c3ee88a 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1080,6 +1080,11 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+ 		spin_unlock_irq(&epfile->ffs->eps_lock);
+ 
+ 		if (wait_for_completion_interruptible(&io_data->done)) {
++			spin_lock_irq(&epfile->ffs->eps_lock);
++			if (epfile->ep != ep) {
++				ret = -ESHUTDOWN;
++				goto error_lock;
++			}
+ 			/*
+ 			 * To avoid race condition with ffs_epfile_io_complete,
+ 			 * dequeue the request first then check
+@@ -1087,6 +1092,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+ 			 * condition with req->complete callback.
+ 			 */
+ 			usb_ep_dequeue(ep->ep, req);
++			spin_unlock_irq(&epfile->ffs->eps_lock);
+ 			wait_for_completion(&io_data->done);
+ 			interrupted = io_data->status < 0;
+ 		}
diff --git a/0115-tty-n_gsm-Debug-output-allocation-must-use-GFP_ATOMI.patch b/0115-tty-n_gsm-Debug-output-allocation-must-use-GFP_ATOMI.patch
new file mode 100644
index 000000000000..58258db27c54
--- /dev/null
+++ b/0115-tty-n_gsm-Debug-output-allocation-must-use-GFP_ATOMI.patch
@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 23 May 2022 18:50:52 +0300
+Subject: [PATCH] tty: n_gsm: Debug output allocation must use GFP_ATOMIC
+
+commit e74024b2eccbb784824a0f9feaeaaa3b47514b79 upstream.
+
+Dan Carpenter <dan.carpenter@oracle.com> reported the following Smatch
+warning:
+
+drivers/tty/n_gsm.c:720 gsm_data_kick()
+warn: sleeping in atomic context
+
+This is because gsm_control_message() is holding a spin lock so
+gsm_hex_dump_bytes() needs to use GFP_ATOMIC instead of GFP_KERNEL.
+
+Fixes: 925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output")
+Cc: stable <stable@kernel.org>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20220523155052.57129-1-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/n_gsm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index ea5381dedb07ca257cb473c78049ba7efd464389..9f2a8c0e1e3345033f6831633aef80523d50562c 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -455,7 +455,7 @@ static void gsm_hex_dump_bytes(const char *fname, const u8 *data,
+ 		return;
+ 	}
+ 
+-	prefix = kasprintf(GFP_KERNEL, "%s: ", fname);
++	prefix = kasprintf(GFP_ATOMIC, "%s: ", fname);
+ 	if (!prefix)
+ 		return;
+ 	print_hex_dump(KERN_INFO, prefix, DUMP_PREFIX_OFFSET, 16, 1, data, len,
diff --git a/0116-serial-8250-Store-to-lsr_save_flags-after-lsr-read.patch b/0116-serial-8250-Store-to-lsr_save_flags-after-lsr-read.patch
new file mode 100644
index 000000000000..2f679e64923a
--- /dev/null
+++ b/0116-serial-8250-Store-to-lsr_save_flags-after-lsr-read.patch
@@ -0,0 +1,46 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Fri, 20 May 2022 13:35:41 +0300
+Subject: [PATCH] serial: 8250: Store to lsr_save_flags after lsr read
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit be03b0651ffd8bab69dfd574c6818b446c0753ce upstream.
+
+Not all LSR register flags are preserved across reads. Therefore, LSR
+readers must store the non-preserved bits into lsr_save_flags.
+
+This fix was initially mixed into feature commit f6f586102add ("serial:
+8250: Handle UART without interrupt on TEMT using em485"). However,
+that feature change had a flaw and it was reverted to make room for
+simpler approach providing the same feature. The embedded fix got
+reverted with the feature change.
+
+Re-add the lsr_save_flags fix and properly mark it's a fix.
+
+Link: https://lore.kernel.org/all/1d6c31d-d194-9e6a-ddf9-5f29af829f3@linux.intel.com/T/#m1737eef986bd20cf19593e344cebd7b0244945fc
+Fixes: e490c9144cfa ("tty: Add software emulated RS485 support for 8250")
+Cc: stable <stable@kernel.org>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@penugtronix.de>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/f4d774be-1437-a550-8334-19d8722ab98c@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 1fbd5bf264bec9ed8c3f43f3f05b85641da0e163..7e295d2701b287180aa46675d0d8ccabf863fdf1 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1535,6 +1535,8 @@ static inline void __stop_tx(struct uart_8250_port *p)
+ 
+ 	if (em485) {
+ 		unsigned char lsr = serial_in(p, UART_LSR);
++		p->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
++
+ 		/*
+ 		 * To provide required timeing and allow FIFO transfer,
+ 		 * __stop_tx_rs485() must be called only when both FIFO and
diff --git a/0117-bus-fsl-mc-bus-fix-KASAN-use-after-free-in-fsl_mc_bu.patch b/0117-bus-fsl-mc-bus-fix-KASAN-use-after-free-in-fsl_mc_bu.patch
new file mode 100644
index 000000000000..379267d6b8a4
--- /dev/null
+++ b/0117-bus-fsl-mc-bus-fix-KASAN-use-after-free-in-fsl_mc_bu.patch
@@ -0,0 +1,48 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Date: Wed, 1 Jun 2022 19:51:59 +0900
+Subject: [PATCH] bus: fsl-mc-bus: fix KASAN use-after-free in
+ fsl_mc_bus_remove()
+
+commit 928ea98252ad75118950941683893cf904541da9 upstream.
+
+In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to
+fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in
+fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io
+triggers KASAN use-after-free. To avoid the use-after-free, keep the
+reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to
+fsl_destroy_mc_io().
+
+This patch needs rework to apply to kernels older than v5.15.
+
+Fixes: f93627146f0e ("staging: fsl-mc: fix asymmetry in destroy of mc_io")
+Cc: stable@vger.kernel.org # v5.15+
+Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
+index 8fd4a356a86ec0b1cff2b830c6c1bf78924682f0..74593a1722fe0898fffbf19eb34673b10bd64ca3 100644
+--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
+@@ -1236,14 +1236,14 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
+ static int fsl_mc_bus_remove(struct platform_device *pdev)
+ {
+ 	struct fsl_mc *mc = platform_get_drvdata(pdev);
++	struct fsl_mc_io *mc_io;
+ 
+ 	if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev))
+ 		return -EINVAL;
+ 
++	mc_io = mc->root_mc_bus_dev->mc_io;
+ 	fsl_mc_device_remove(mc->root_mc_bus_dev);
+-
+-	fsl_destroy_mc_io(mc->root_mc_bus_dev->mc_io);
+-	mc->root_mc_bus_dev->mc_io = NULL;
++	fsl_destroy_mc_io(mc_io);
+ 
+ 	bus_unregister_notifier(&fsl_mc_bus_type, &fsl_mc_nb);
+ 
diff --git a/0118-md-raid5-ppl-Fix-argument-order-in-bio_alloc_bioset.patch b/0118-md-raid5-ppl-Fix-argument-order-in-bio_alloc_bioset.patch
new file mode 100644
index 000000000000..29bd531196b7
--- /dev/null
+++ b/0118-md-raid5-ppl-Fix-argument-order-in-bio_alloc_bioset.patch
@@ -0,0 +1,52 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Logan Gunthorpe <logang@deltatee.com>
+Date: Wed, 8 Jun 2022 10:27:46 -0600
+Subject: [PATCH] md/raid5-ppl: Fix argument order in bio_alloc_bioset()
+
+commit f34fdcd4a0e7a0b92340ad7e48e7bcff9393fab5 upstream.
+
+bio_alloc_bioset() takes a block device, number of vectors, the
+OP flags, the GFP mask and the bio set. However when the prototype
+was changed, the callisite in ppl_do_flush() had the OP flags and
+the GFP flags reversed. This introduced some sparse error:
+
+  drivers/md/raid5-ppl.c:632:57: warning: incorrect type in argument 3
+				    (different base types)
+  drivers/md/raid5-ppl.c:632:57:    expected unsigned int opf
+  drivers/md/raid5-ppl.c:632:57:    got restricted gfp_t [usertype]
+  drivers/md/raid5-ppl.c:633:61: warning: incorrect type in argument 4
+  				    (different base types)
+  drivers/md/raid5-ppl.c:633:61:    expected restricted gfp_t [usertype]
+				    gfp_mask
+  drivers/md/raid5-ppl.c:633:61:    got unsigned long long
+
+The sparse error introduction may not have been reported correctly by
+0day due to other work that was cleaning up other sparse errors in this
+area.
+
+Fixes: 609be1066731 ("block: pass a block_device and opf to bio_alloc_bioset")
+Cc: stable@vger.kernel.org # 5.18+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid5-ppl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
+index d3962d92df18a02b2531340901227a7d9a14ef04..18acbbed8f0c4c4c96df168a0dff93fb6f308d21 100644
+--- a/drivers/md/raid5-ppl.c
++++ b/drivers/md/raid5-ppl.c
+@@ -629,9 +629,9 @@ static void ppl_do_flush(struct ppl_io_unit *io)
+ 		if (bdev) {
+ 			struct bio *bio;
+ 
+-			bio = bio_alloc_bioset(bdev, 0, GFP_NOIO,
++			bio = bio_alloc_bioset(bdev, 0,
+ 					       REQ_OP_WRITE | REQ_PREFLUSH,
+-					       &ppl_conf->flush_bs);
++					       GFP_NOIO, &ppl_conf->flush_bs);
+ 			bio->bi_private = io;
+ 			bio->bi_end_io = ppl_flush_endio;
+ 
diff --git a/0119-dm-fix-race-in-dm_start_io_acct.patch b/0119-dm-fix-race-in-dm_start_io_acct.patch
new file mode 100644
index 000000000000..2f4af6a7c4b7
--- /dev/null
+++ b/0119-dm-fix-race-in-dm_start_io_acct.patch
@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Benjamin Marzinski <bmarzins@redhat.com>
+Date: Tue, 14 Jun 2022 11:10:28 -0500
+Subject: [PATCH] dm: fix race in dm_start_io_acct
+
+commit 10eb3a0d517fcc83eeea4242c149461205675eb4 upstream.
+
+After commit 82f6cdcc3676c ("dm: switch dm_io booleans over to proper
+flags") dm_start_io_acct stopped atomically checking and setting
+was_accounted, which turned into the DM_IO_ACCOUNTED flag. This opened
+the possibility for a race where IO accounting is started twice for
+duplicate bios. To remove the race, check the flag while holding the
+io->lock.
+
+Fixes: 82f6cdcc3676c ("dm: switch dm_io booleans over to proper flags")
+Cc: stable@vger.kernel.org
+Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 82957bd460e894556fed5eed0b991c14f3c0713b..a68316f96350d0af64c1db865c48d1e97fbf95ca 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -551,6 +551,10 @@ static void dm_start_io_acct(struct dm_io *io, struct bio *clone)
+ 			return;
+ 		/* Can afford locking given DM_TIO_IS_DUPLICATE_BIO */
+ 		spin_lock_irqsave(&io->lock, flags);
++		if (dm_io_flagged(io, DM_IO_ACCOUNTED)) {
++			spin_unlock_irqrestore(&io->lock, flags);
++			return;
++		}
+ 		dm_io_set_flag(io, DM_IO_ACCOUNTED);
+ 		spin_unlock_irqrestore(&io->lock, flags);
+ 	}
diff --git a/0120-dm-mirror-log-round-up-region-bitmap-size-to-BITS_PE.patch b/0120-dm-mirror-log-round-up-region-bitmap-size-to-BITS_PE.patch
new file mode 100644
index 000000000000..ed341d0b9425
--- /dev/null
+++ b/0120-dm-mirror-log-round-up-region-bitmap-size-to-BITS_PE.patch
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 16 Jun 2022 13:28:57 -0400
+Subject: [PATCH] dm mirror log: round up region bitmap size to BITS_PER_LONG
+
+commit 85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0 upstream.
+
+The code in dm-log rounds up bitset_size to 32 bits. It then uses
+find_next_zero_bit_le on the allocated region. find_next_zero_bit_le
+accesses the bitmap using unsigned long pointers. So, on 64-bit
+architectures, it may access 4 bytes beyond the allocated size.
+
+Fix this bug by rounding up bitset_size to BITS_PER_LONG.
+
+This bug was found by running the lvm2 testsuite with kasan.
+
+Fixes: 29121bd0b00e ("[PATCH] dm mirror log: bitset_size fix")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-log.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
+index 06f328928a7f52948eb3ac0c895cd2014faa503b..2dda05aada2312509f3aba6658e7d9d9f7fad22e 100644
+--- a/drivers/md/dm-log.c
++++ b/drivers/md/dm-log.c
+@@ -415,8 +415,7 @@ static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
+ 	/*
+ 	 * Work out how many "unsigned long"s we need to hold the bitset.
+ 	 */
+-	bitset_size = dm_round_up(region_count,
+-				  sizeof(*lc->clean_bits) << BYTE_SHIFT);
++	bitset_size = dm_round_up(region_count, BITS_PER_LONG);
+ 	bitset_size >>= BYTE_SHIFT;
+ 
+ 	lc->bitset_uint32_count = bitset_size / sizeof(*lc->clean_bits);
diff --git a/0121-drm-amdgpu-Fix-GTT-size-reporting-in-amdgpu_ioctl.patch b/0121-drm-amdgpu-Fix-GTT-size-reporting-in-amdgpu_ioctl.patch
new file mode 100644
index 000000000000..7ce82daf4b5d
--- /dev/null
+++ b/0121-drm-amdgpu-Fix-GTT-size-reporting-in-amdgpu_ioctl.patch
@@ -0,0 +1,48 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
+Date: Fri, 10 Jun 2022 15:54:26 +0200
+Subject: [PATCH] drm/amdgpu: Fix GTT size reporting in amdgpu_ioctl
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit c904e3acbab3fd97649cd4ab1ff7f1521ad3a255 upstream.
+
+The commit below changed the TTM manager size unit from pages to
+bytes, but failed to adjust the corresponding calculations in
+amdgpu_ioctl.
+
+Fixes: dfa714b88eb0 ("drm/amdgpu: remove GTT accounting v2")
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1930
+Bug: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6642
+Tested-by: Martin Roukala <martin.roukala@mupuf.org>
+Tested-by: Mike Lothian <mike@fireburn.co.uk>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 5.18.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 6b626c293e724319780c20b20e63f88feb8ca609..49c55d82cba80ec889c5915fefb861d657c8e67f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -634,7 +634,6 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ 			    atomic64_read(&adev->visible_pin_size),
+ 			    vram_gtt.vram_size);
+ 		vram_gtt.gtt_size = ttm_manager_type(&adev->mman.bdev, TTM_PL_TT)->size;
+-		vram_gtt.gtt_size *= PAGE_SIZE;
+ 		vram_gtt.gtt_size -= atomic64_read(&adev->gart_pin_size);
+ 		return copy_to_user(out, &vram_gtt,
+ 				    min((size_t)size, sizeof(vram_gtt))) ? -EFAULT : 0;
+@@ -667,7 +666,6 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ 			mem.cpu_accessible_vram.usable_heap_size * 3 / 4;
+ 
+ 		mem.gtt.total_heap_size = gtt_man->size;
+-		mem.gtt.total_heap_size *= PAGE_SIZE;
+ 		mem.gtt.usable_heap_size = mem.gtt.total_heap_size -
+ 			atomic64_read(&adev->gart_pin_size);
+ 		mem.gtt.heap_usage = ttm_resource_manager_usage(gtt_man);
diff --git a/0122-drm-amd-display-Cap-OLED-brightness-per-max-frame-av.patch b/0122-drm-amd-display-Cap-OLED-brightness-per-max-frame-av.patch
new file mode 100644
index 000000000000..4744ea230d2d
--- /dev/null
+++ b/0122-drm-amd-display-Cap-OLED-brightness-per-max-frame-av.patch
@@ -0,0 +1,64 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Roman Li <roman.li@amd.com>
+Date: Thu, 19 May 2022 14:41:16 -0400
+Subject: [PATCH] drm/amd/display: Cap OLED brightness per max frame-average
+ luminance
+
+commit 4fd17f2ac0aa4e48823ac2ede5b050fb70300bf4 upstream.
+
+[Why]
+For OLED eDP the Display Manager uses max_cll value as a limit
+for brightness control.
+max_cll defines the content light luminance for individual pixel.
+Whereas max_fall defines frame-average level luminance.
+The user may not observe the difference in brightness in between
+max_fall and max_cll.
+That negatively impacts the user experience.
+
+[How]
+Use max_fall value instead of max_cll as a limit for brightness control.
+
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 8dd03de7c27757f36d1afe5c0cf1721932b8d048..78a38c3b7d664e7ee3167d22ace54017b281fda6 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2835,7 +2835,7 @@ static struct drm_mode_config_helper_funcs amdgpu_dm_mode_config_helperfuncs = {
+ 
+ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector)
+ {
+-	u32 max_cll, min_cll, max, min, q, r;
++	u32 max_avg, min_cll, max, min, q, r;
+ 	struct amdgpu_dm_backlight_caps *caps;
+ 	struct amdgpu_display_manager *dm;
+ 	struct drm_connector *conn_base;
+@@ -2865,7 +2865,7 @@ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector)
+ 	caps = &dm->backlight_caps[i];
+ 	caps->ext_caps = &aconnector->dc_link->dpcd_sink_ext_caps;
+ 	caps->aux_support = false;
+-	max_cll = conn_base->hdr_sink_metadata.hdmi_type1.max_cll;
++	max_avg = conn_base->hdr_sink_metadata.hdmi_type1.max_fall;
+ 	min_cll = conn_base->hdr_sink_metadata.hdmi_type1.min_cll;
+ 
+ 	if (caps->ext_caps->bits.oled == 1 /*||
+@@ -2893,8 +2893,8 @@ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector)
+ 	 * The results of the above expressions can be verified at
+ 	 * pre_computed_values.
+ 	 */
+-	q = max_cll >> 5;
+-	r = max_cll % 32;
++	q = max_avg >> 5;
++	r = max_avg % 32;
+ 	max = (1 << q) * pre_computed_values[r];
+ 
+ 	// min luminance: maxLum * (CV/255)^2 / 100
diff --git a/0123-audit-free-module-name.patch b/0123-audit-free-module-name.patch
new file mode 100644
index 000000000000..215701f2627f
--- /dev/null
+++ b/0123-audit-free-module-name.patch
@@ -0,0 +1,50 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Wed, 15 Jun 2022 17:44:31 +0200
+Subject: [PATCH] audit: free module name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit ef79c396c664be99d0c5660dc75fe863c1e20315 upstream.
+
+Reset the type of the record last as the helper `audit_free_module()`
+depends on it.
+
+    unreferenced object 0xffff888153b707f0 (size 16):
+      comm "modprobe", pid 1319, jiffies 4295110033 (age 1083.016s)
+      hex dump (first 16 bytes):
+        62 69 6e 66 6d 74 5f 6d 69 73 63 00 6b 6b 6b a5  binfmt_misc.kkk.
+      backtrace:
+        [<ffffffffa07dbf9b>] kstrdup+0x2b/0x50
+        [<ffffffffa04b0a9d>] __audit_log_kern_module+0x4d/0xf0
+        [<ffffffffa03b6664>] load_module+0x9d4/0x2e10
+        [<ffffffffa03b8f44>] __do_sys_finit_module+0x114/0x1b0
+        [<ffffffffa1f47124>] do_syscall_64+0x34/0x80
+        [<ffffffffa200007e>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Cc: stable@vger.kernel.org
+Fixes: 12c5e81d3fd0 ("audit: prepare audit_context for use in calling contexts beyond syscalls")
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/auditsc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index f3a2abd6d1a1922c8e19e44e3b26a49064e0f521..3a8c9d744800a8d84cc88a52fc0bb6dd4e5e28cb 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1014,10 +1014,10 @@ static void audit_reset_context(struct audit_context *ctx)
+ 	ctx->target_comm[0] = '\0';
+ 	unroll_tree_refs(ctx, NULL, 0);
+ 	WARN_ON(!list_empty(&ctx->killed_trees));
+-	ctx->type = 0;
+ 	audit_free_module(ctx);
+ 	ctx->fds[0] = -1;
+ 	audit_proctitle_free(ctx);
++	ctx->type = 0; /* reset last for audit_free_*() */
+ }
+ 
+ static inline struct audit_context *audit_alloc_context(enum audit_state state)
diff --git a/0124-cfi-Fix-__cfi_slowpath_diag-RCU-usage-with-cpuidle.patch b/0124-cfi-Fix-__cfi_slowpath_diag-RCU-usage-with-cpuidle.patch
new file mode 100644
index 000000000000..e1e9c7eb0481
--- /dev/null
+++ b/0124-cfi-Fix-__cfi_slowpath_diag-RCU-usage-with-cpuidle.patch
@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Sami Tolvanen <samitolvanen@google.com>
+Date: Tue, 31 May 2022 10:59:10 -0700
+Subject: [PATCH] cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle
+
+commit 57cd6d157eb479f0a8e820fd36b7240845c8a937 upstream.
+
+RCU_NONIDLE usage during __cfi_slowpath_diag can result in an invalid
+RCU state in the cpuidle code path:
+
+  WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:613 rcu_eqs_enter+0xe4/0x138
+  ...
+  Call trace:
+    rcu_eqs_enter+0xe4/0x138
+    rcu_idle_enter+0xa8/0x100
+    cpuidle_enter_state+0x154/0x3a8
+    cpuidle_enter+0x3c/0x58
+    do_idle.llvm.6590768638138871020+0x1f4/0x2ec
+    cpu_startup_entry+0x28/0x2c
+    secondary_start_kernel+0x1b8/0x220
+    __secondary_switched+0x94/0x98
+
+Instead, call rcu_irq_enter/exit to wake up RCU only when needed and
+disable interrupts for the entire CFI shadow/module check when we do.
+
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Link: https://lore.kernel.org/r/20220531175910.890307-1-samitolvanen@google.com
+Fixes: cf68fffb66d6 ("add support for Clang CFI")
+Cc: stable@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cfi.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/cfi.c b/kernel/cfi.c
+index 9594cfd1cf2cf7ea7be1a44ad048d3b25b624acc..08102d19ec15a2e402c10ad8d22743caafe47d68 100644
+--- a/kernel/cfi.c
++++ b/kernel/cfi.c
+@@ -281,6 +281,8 @@ static inline cfi_check_fn find_module_check_fn(unsigned long ptr)
+ static inline cfi_check_fn find_check_fn(unsigned long ptr)
+ {
+ 	cfi_check_fn fn = NULL;
++	unsigned long flags;
++	bool rcu_idle;
+ 
+ 	if (is_kernel_text(ptr))
+ 		return __cfi_check;
+@@ -290,13 +292,21 @@ static inline cfi_check_fn find_check_fn(unsigned long ptr)
+ 	 * the shadow and __module_address use RCU, so we need to wake it
+ 	 * up if necessary.
+ 	 */
+-	RCU_NONIDLE({
+-		if (IS_ENABLED(CONFIG_CFI_CLANG_SHADOW))
+-			fn = find_shadow_check_fn(ptr);
++	rcu_idle = !rcu_is_watching();
++	if (rcu_idle) {
++		local_irq_save(flags);
++		rcu_irq_enter();
++	}
++
++	if (IS_ENABLED(CONFIG_CFI_CLANG_SHADOW))
++		fn = find_shadow_check_fn(ptr);
++	if (!fn)
++		fn = find_module_check_fn(ptr);
+ 
+-		if (!fn)
+-			fn = find_module_check_fn(ptr);
+-	});
++	if (rcu_idle) {
++		rcu_irq_exit();
++		local_irq_restore(flags);
++	}
+ 
+ 	return fn;
+ }
diff --git a/0125-fs-account-for-group-membership.patch b/0125-fs-account-for-group-membership.patch
new file mode 100644
index 000000000000..221a4f1ba18b
--- /dev/null
+++ b/0125-fs-account-for-group-membership.patch
@@ -0,0 +1,110 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Christian Brauner <brauner@kernel.org>
+Date: Mon, 13 Jun 2022 13:15:17 +0200
+Subject: [PATCH] fs: account for group membership
+
+commit 168f912893407a5acb798a4a58613b5f1f98c717 upstream.
+
+When calling setattr_prepare() to determine the validity of the
+attributes the ia_{g,u}id fields contain the value that will be written
+to inode->i_{g,u}id. This is exactly the same for idmapped and
+non-idmapped mounts and allows callers to pass in the values they want
+to see written to inode->i_{g,u}id.
+
+When group ownership is changed a caller whose fsuid owns the inode can
+change the group of the inode to any group they are a member of. When
+searching through the caller's groups we need to use the gid mapped
+according to the idmapped mount otherwise we will fail to change
+ownership for unprivileged users.
+
+Consider a caller running with fsuid and fsgid 1000 using an idmapped
+mount that maps id 65534 to 1000 and 65535 to 1001. Consequently, a file
+owned by 65534:65535 in the filesystem will be owned by 1000:1001 in the
+idmapped mount.
+
+The caller now requests the gid of the file to be changed to 1000 going
+through the idmapped mount. In the vfs we will immediately map the
+requested gid to the value that will need to be written to inode->i_gid
+and place it in attr->ia_gid. Since this idmapped mount maps 65534 to
+1000 we place 65534 in attr->ia_gid.
+
+When we check whether the caller is allowed to change group ownership we
+first validate that their fsuid matches the inode's uid. The
+inode->i_uid is 65534 which is mapped to uid 1000 in the idmapped mount.
+Since the caller's fsuid is 1000 we pass the check.
+
+We now check whether the caller is allowed to change inode->i_gid to the
+requested gid by calling in_group_p(). This will compare the passed in
+gid to the caller's fsgid and search the caller's additional groups.
+
+Since we're dealing with an idmapped mount we need to pass in the gid
+mapped according to the idmapped mount. This is akin to checking whether
+a caller is privileged over the future group the inode is owned by. And
+that needs to take the idmapped mount into account. Note, all helpers
+are nops without idmapped mounts.
+
+New regression test sent to xfstests.
+
+Link: https://github.com/lxc/lxd/issues/10537
+Link: https://lore.kernel.org/r/20220613111517.2186646-1-brauner@kernel.org
+Fixes: 2f221d6f7b88 ("attr: handle idmapped mounts")
+Cc: Seth Forshee <sforshee@digitalocean.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Aleksa Sarai <cyphar@cyphar.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: stable@vger.kernel.org # 5.15+
+CC: linux-fsdevel@vger.kernel.org
+Reviewed-by: Seth Forshee <sforshee@digitalocean.com>
+Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/attr.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/fs/attr.c b/fs/attr.c
+index 66899b6e9bd86117f4330a3add56399d888dfa05..dbe996b0dedfcf78a91c077b9ee51d132a73d8d1 100644
+--- a/fs/attr.c
++++ b/fs/attr.c
+@@ -61,9 +61,15 @@ static bool chgrp_ok(struct user_namespace *mnt_userns,
+ 		     const struct inode *inode, kgid_t gid)
+ {
+ 	kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
+-	if (uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode)) &&
+-	    (in_group_p(gid) || gid_eq(gid, inode->i_gid)))
+-		return true;
++	if (uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode))) {
++		kgid_t mapped_gid;
++
++		if (gid_eq(gid, inode->i_gid))
++			return true;
++		mapped_gid = mapped_kgid_fs(mnt_userns, i_user_ns(inode), gid);
++		if (in_group_p(mapped_gid))
++			return true;
++	}
+ 	if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
+ 		return true;
+ 	if (gid_eq(kgid, INVALID_GID) &&
+@@ -123,12 +129,20 @@ int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry,
+ 
+ 	/* Make sure a caller can chmod. */
+ 	if (ia_valid & ATTR_MODE) {
++		kgid_t mapped_gid;
++
+ 		if (!inode_owner_or_capable(mnt_userns, inode))
+ 			return -EPERM;
++
++		if (ia_valid & ATTR_GID)
++			mapped_gid = mapped_kgid_fs(mnt_userns,
++						i_user_ns(inode), attr->ia_gid);
++		else
++			mapped_gid = i_gid_into_mnt(mnt_userns, inode);
++
+ 		/* Also check the setgid bit! */
+-               if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
+-                                i_gid_into_mnt(mnt_userns, inode)) &&
+-                    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
++		if (!in_group_p(mapped_gid) &&
++		    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
+ 			attr->ia_mode &= ~S_ISGID;
+ 	}
+ 
diff --git a/0126-selinux-free-contexts-previously-transferred-in-seli.patch b/0126-selinux-free-contexts-previously-transferred-in-seli.patch
new file mode 100644
index 000000000000..22a3ac28453b
--- /dev/null
+++ b/0126-selinux-free-contexts-previously-transferred-in-seli.patch
@@ -0,0 +1,86 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Wed, 15 Jun 2022 17:38:39 +0200
+Subject: [PATCH] selinux: free contexts previously transferred in
+ selinux_add_opt()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit cad140d00899e7a9cb6fe93b282051df589e671c upstream.
+
+`selinux_add_opt()` stopped taking ownership of the passed context since
+commit 70f4169ab421 ("selinux: parse contexts for mount options early").
+
+    unreferenced object 0xffff888114dfd140 (size 64):
+      comm "mount", pid 15182, jiffies 4295687028 (age 796.340s)
+      hex dump (first 32 bytes):
+        73 79 73 74 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f  system_u:object_
+        72 3a 74 65 73 74 5f 66 69 6c 65 73 79 73 74 65  r:test_filesyste
+      backtrace:
+        [<ffffffffa07dbef4>] kmemdup_nul+0x24/0x80
+        [<ffffffffa0d34253>] selinux_sb_eat_lsm_opts+0x293/0x560
+        [<ffffffffa0d13f08>] security_sb_eat_lsm_opts+0x58/0x80
+        [<ffffffffa0af1eb2>] generic_parse_monolithic+0x82/0x180
+        [<ffffffffa0a9c1a5>] do_new_mount+0x1f5/0x550
+        [<ffffffffa0a9eccb>] path_mount+0x2ab/0x1570
+        [<ffffffffa0aa019e>] __x64_sys_mount+0x20e/0x280
+        [<ffffffffa1f47124>] do_syscall_64+0x34/0x80
+        [<ffffffffa200007e>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+    unreferenced object 0xffff888108e71640 (size 64):
+      comm "fsmount", pid 7607, jiffies 4295044974 (age 1601.016s)
+      hex dump (first 32 bytes):
+        73 79 73 74 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f  system_u:object_
+        72 3a 74 65 73 74 5f 66 69 6c 65 73 79 73 74 65  r:test_filesyste
+      backtrace:
+        [<ffffffff861dc2b1>] memdup_user+0x21/0x90
+        [<ffffffff861dc367>] strndup_user+0x47/0xa0
+        [<ffffffff864f6965>] __do_sys_fsconfig+0x485/0x9f0
+        [<ffffffff87940124>] do_syscall_64+0x34/0x80
+        [<ffffffff87a0007e>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Cc: stable@vger.kernel.org
+Fixes: 70f4169ab421 ("selinux: parse contexts for mount options early")
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/selinux/hooks.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index e9e959343de98db83a35d8b0592fe4129dc5a0c1..cac9368be4ce54d0bb4bcb43060a7144aab5af37 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -2600,8 +2600,9 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
+ 				}
+ 			}
+ 			rc = selinux_add_opt(token, arg, mnt_opts);
++			kfree(arg);
++			arg = NULL;
+ 			if (unlikely(rc)) {
+-				kfree(arg);
+ 				goto free_opt;
+ 			}
+ 		} else {
+@@ -2792,17 +2793,13 @@ static int selinux_fs_context_parse_param(struct fs_context *fc,
+ 					  struct fs_parameter *param)
+ {
+ 	struct fs_parse_result result;
+-	int opt, rc;
++	int opt;
+ 
+ 	opt = fs_parse(fc, selinux_fs_parameters, param, &result);
+ 	if (opt < 0)
+ 		return opt;
+ 
+-	rc = selinux_add_opt(opt, param->string, &fc->security);
+-	if (!rc)
+-		param->string = NULL;
+-
+-	return rc;
++	return selinux_add_opt(opt, param->string, &fc->security);
+ }
+ 
+ /* inode security operations */
diff --git a/0127-ext4-fix-super-block-checksum-incorrect-after-mount.patch b/0127-ext4-fix-super-block-checksum-incorrect-after-mount.patch
new file mode 100644
index 000000000000..603c332f8e2b
--- /dev/null
+++ b/0127-ext4-fix-super-block-checksum-incorrect-after-mount.patch
@@ -0,0 +1,73 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ye Bin <yebin10@huawei.com>
+Date: Wed, 25 May 2022 09:29:04 +0800
+Subject: [PATCH] ext4: fix super block checksum incorrect after mount
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 9b6641dd95a0c441b277dd72ba22fed8d61f76ad upstream.
+
+We got issue as follows:
+[home]# mount  /dev/sda  test
+EXT4-fs (sda): warning: mounting fs with errors, running e2fsck is recommended
+[home]# dmesg
+EXT4-fs (sda): warning: mounting fs with errors, running e2fsck is recommended
+EXT4-fs (sda): Errors on filesystem, clearing orphan list.
+EXT4-fs (sda): recovery complete
+EXT4-fs (sda): mounted filesystem with ordered data mode. Quota mode: none.
+[home]# debugfs /dev/sda
+debugfs 1.46.5 (30-Dec-2021)
+Checksum errors in superblock!  Retrying...
+
+Reason is ext4_orphan_cleanup will reset ‘s_last_orphan’ but not update
+super block checksum.
+
+To solve above issue, defer update super block checksum after
+ext4_orphan_cleanup.
+
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Cc: stable@kernel.org
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Ritesh Harjani <ritesh.list@gmail.com>
+Link: https://lore.kernel.org/r/20220525012904.1604737-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/super.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index a0c79304f92ff6e7ca319122d867e654439bd113..552285de2c7b0161838f7d34a7c9bfee20e51d5f 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5422,14 +5422,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ 		err = percpu_counter_init(&sbi->s_freeinodes_counter, freei,
+ 					  GFP_KERNEL);
+ 	}
+-	/*
+-	 * Update the checksum after updating free space/inode
+-	 * counters.  Otherwise the superblock can have an incorrect
+-	 * checksum in the buffer cache until it is written out and
+-	 * e2fsprogs programs trying to open a file system immediately
+-	 * after it is mounted can fail.
+-	 */
+-	ext4_superblock_csum_set(sb);
+ 	if (!err)
+ 		err = percpu_counter_init(&sbi->s_dirs_counter,
+ 					  ext4_count_dirs(sb), GFP_KERNEL);
+@@ -5487,6 +5479,14 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ 	EXT4_SB(sb)->s_mount_state |= EXT4_ORPHAN_FS;
+ 	ext4_orphan_cleanup(sb, es);
+ 	EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS;
++	/*
++	 * Update the checksum after updating free space/inode counters and
++	 * ext4_orphan_cleanup. Otherwise the superblock can have an incorrect
++	 * checksum in the buffer cache until it is written out and
++	 * e2fsprogs programs trying to open a file system immediately
++	 * after it is mounted can fail.
++	 */
++	ext4_superblock_csum_set(sb);
+ 	if (needs_recovery) {
+ 		ext4_msg(sb, KERN_INFO, "recovery complete");
+ 		err = ext4_mark_recovery_complete(sb, es);
diff --git a/0128-ext4-fix-bug_on-ext4_mb_use_inode_pa.patch b/0128-ext4-fix-bug_on-ext4_mb_use_inode_pa.patch
new file mode 100644
index 000000000000..8432c0ace9cd
--- /dev/null
+++ b/0128-ext4-fix-bug_on-ext4_mb_use_inode_pa.patch
@@ -0,0 +1,97 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Baokun Li <libaokun1@huawei.com>
+Date: Sat, 28 May 2022 19:00:15 +0800
+Subject: [PATCH] ext4: fix bug_on ext4_mb_use_inode_pa
+
+commit a08f789d2ab5242c07e716baf9a835725046be89 upstream.
+
+Hulk Robot reported a BUG_ON:
+==================================================================
+kernel BUG at fs/ext4/mballoc.c:3211!
+[...]
+RIP: 0010:ext4_mb_mark_diskspace_used.cold+0x85/0x136f
+[...]
+Call Trace:
+ ext4_mb_new_blocks+0x9df/0x5d30
+ ext4_ext_map_blocks+0x1803/0x4d80
+ ext4_map_blocks+0x3a4/0x1a10
+ ext4_writepages+0x126d/0x2c30
+ do_writepages+0x7f/0x1b0
+ __filemap_fdatawrite_range+0x285/0x3b0
+ file_write_and_wait_range+0xb1/0x140
+ ext4_sync_file+0x1aa/0xca0
+ vfs_fsync_range+0xfb/0x260
+ do_fsync+0x48/0xa0
+[...]
+==================================================================
+
+Above issue may happen as follows:
+-------------------------------------
+do_fsync
+ vfs_fsync_range
+  ext4_sync_file
+   file_write_and_wait_range
+    __filemap_fdatawrite_range
+     do_writepages
+      ext4_writepages
+       mpage_map_and_submit_extent
+        mpage_map_one_extent
+         ext4_map_blocks
+          ext4_mb_new_blocks
+           ext4_mb_normalize_request
+            >>> start + size <= ac->ac_o_ex.fe_logical
+           ext4_mb_regular_allocator
+            ext4_mb_simple_scan_group
+             ext4_mb_use_best_found
+              ext4_mb_new_preallocation
+               ext4_mb_new_inode_pa
+                ext4_mb_use_inode_pa
+                 >>> set ac->ac_b_ex.fe_len <= 0
+           ext4_mb_mark_diskspace_used
+            >>> BUG_ON(ac->ac_b_ex.fe_len <= 0);
+
+we can easily reproduce this problem with the following commands:
+	`fallocate -l100M disk`
+	`mkfs.ext4 -b 1024 -g 256 disk`
+	`mount disk /mnt`
+	`fsstress -d /mnt -l 0 -n 1000 -p 1`
+
+The size must be smaller than or equal to EXT4_BLOCKS_PER_GROUP.
+Therefore, "start + size <= ac->ac_o_ex.fe_logical" may occur
+when the size is truncated. So start should be the start position of
+the group where ac_o_ex.fe_logical is located after alignment.
+In addition, when the value of fe_logical or EXT4_BLOCKS_PER_GROUP
+is very large, the value calculated by start_off is more accurate.
+
+Cc: stable@kernel.org
+Fixes: cd648b8a8fd5 ("ext4: trim allocation requests to group size")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Ritesh Harjani <ritesh.list@gmail.com>
+Link: https://lore.kernel.org/r/20220528110017.354175-2-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/mballoc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 87d85ce04d58bdf0d0350e6c378765a631b04899..816448041db877a20b3e44fbd4259945705f0d65 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -4107,6 +4107,15 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
+ 	size = size >> bsbits;
+ 	start = start_off >> bsbits;
+ 
++	/*
++	 * For tiny groups (smaller than 8MB) the chosen allocation
++	 * alignment may be larger than group size. Make sure the
++	 * alignment does not move allocation to a different group which
++	 * makes mballoc fail assertions later.
++	 */
++	start = max(start, rounddown(ac->ac_o_ex.fe_logical,
++			(ext4_lblk_t)EXT4_BLOCKS_PER_GROUP(ac->ac_sb)));
++
+ 	/* don't cover already allocated blocks in selected range */
+ 	if (ar->pleft && start <= ar->lleft) {
+ 		size -= ar->lleft + 1 - start;
diff --git a/0129-ext4-make-variable-count-signed.patch b/0129-ext4-make-variable-count-signed.patch
new file mode 100644
index 000000000000..d9d3bfb9d5e5
--- /dev/null
+++ b/0129-ext4-make-variable-count-signed.patch
@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ding Xiang <dingxiang@cmss.chinamobile.com>
+Date: Mon, 30 May 2022 18:00:47 +0800
+Subject: [PATCH] ext4: make variable "count" signed
+
+commit bc75a6eb856cb1507fa907bf6c1eda91b3fef52f upstream.
+
+Since dx_make_map() may return -EFSCORRUPTED now, so change "count" to
+be a signed integer so we can correctly check for an error code returned
+by dx_make_map().
+
+Fixes: 46c116b920eb ("ext4: verify dir block before splitting it")
+Cc: stable@kernel.org
+Signed-off-by: Ding Xiang <dingxiang@cmss.chinamobile.com>
+Link: https://lore.kernel.org/r/20220530100047.537598-1-dingxiang@cmss.chinamobile.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/namei.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index e9cba12e5e1282e48044ca03ef3d8726a801e8d6..4f0420b1ff3ecc6889dbf7ecbfd2debc4d4b4cb6 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1929,7 +1929,8 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
+ 			struct dx_hash_info *hinfo)
+ {
+ 	unsigned blocksize = dir->i_sb->s_blocksize;
+-	unsigned count, continued;
++	unsigned continued;
++	int count;
+ 	struct buffer_head *bh2;
+ 	ext4_lblk_t newblock;
+ 	u32 hash2;
diff --git a/0130-ext4-add-reserved-GDT-blocks-check.patch b/0130-ext4-add-reserved-GDT-blocks-check.patch
new file mode 100644
index 000000000000..4c2a6459138b
--- /dev/null
+++ b/0130-ext4-add-reserved-GDT-blocks-check.patch
@@ -0,0 +1,74 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Zhang Yi <yi.zhang@huawei.com>
+Date: Wed, 1 Jun 2022 17:27:17 +0800
+Subject: [PATCH] ext4: add reserved GDT blocks check
+
+commit b55c3cd102a6f48b90e61c44f7f3dda8c290c694 upstream.
+
+We capture a NULL pointer issue when resizing a corrupt ext4 image which
+is freshly clear resize_inode feature (not run e2fsck). It could be
+simply reproduced by following steps. The problem is because of the
+resize_inode feature was cleared, and it will convert the filesystem to
+meta_bg mode in ext4_resize_fs(), but the es->s_reserved_gdt_blocks was
+not reduced to zero, so could we mistakenly call reserve_backup_gdb()
+and passing an uninitialized resize_inode to it when adding new group
+descriptors.
+
+ mkfs.ext4 /dev/sda 3G
+ tune2fs -O ^resize_inode /dev/sda #forget to run requested e2fsck
+ mount /dev/sda /mnt
+ resize2fs /dev/sda 8G
+
+ ========
+ BUG: kernel NULL pointer dereference, address: 0000000000000028
+ CPU: 19 PID: 3243 Comm: resize2fs Not tainted 5.18.0-rc7-00001-gfde086c5ebfd #748
+ ...
+ RIP: 0010:ext4_flex_group_add+0xe08/0x2570
+ ...
+ Call Trace:
+  <TASK>
+  ext4_resize_fs+0xbec/0x1660
+  __ext4_ioctl+0x1749/0x24e0
+  ext4_ioctl+0x12/0x20
+  __x64_sys_ioctl+0xa6/0x110
+  do_syscall_64+0x3b/0x90
+  entry_SYSCALL_64_after_hwframe+0x44/0xae
+ RIP: 0033:0x7f2dd739617b
+ ========
+
+The fix is simple, add a check in ext4_resize_begin() to make sure that
+the es->s_reserved_gdt_blocks is zero when the resize_inode feature is
+disabled.
+
+Cc: stable@kernel.org
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Ritesh Harjani <ritesh.list@gmail.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220601092717.763694-1-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/resize.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 90a941d20dfff0d2634027c945eaa8859201266f..8b70a470129314f2c5af9b5768c0ec56379b2f1e 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -53,6 +53,16 @@ int ext4_resize_begin(struct super_block *sb)
+ 	if (!capable(CAP_SYS_RESOURCE))
+ 		return -EPERM;
+ 
++	/*
++	 * If the reserved GDT blocks is non-zero, the resize_inode feature
++	 * should always be set.
++	 */
++	if (EXT4_SB(sb)->s_es->s_reserved_gdt_blocks &&
++	    !ext4_has_feature_resize_inode(sb)) {
++		ext4_error(sb, "resize_inode disabled but reserved GDT blocks non-zero");
++		return -EFSCORRUPTED;
++	}
++
+ 	/*
+ 	 * If we are not using the primary superblock/GDT copy don't resize,
+          * because the user tools have no way of handling this.  Probably a
diff --git a/0131-KVM-arm64-Always-start-with-clearing-SVE-flag-on-loa.patch b/0131-KVM-arm64-Always-start-with-clearing-SVE-flag-on-loa.patch
new file mode 100644
index 000000000000..d9cf4691203a
--- /dev/null
+++ b/0131-KVM-arm64-Always-start-with-clearing-SVE-flag-on-loa.patch
@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Sat, 28 May 2022 12:38:11 +0100
+Subject: [PATCH] KVM: arm64: Always start with clearing SVE flag on load
+
+commit d52d165d67c5aa26c8c89909003c94a66492d23d upstream.
+
+On each vcpu load, we set the KVM_ARM64_HOST_SVE_ENABLED
+flag if SVE is enabled for EL0 on the host. This is used to restore
+the correct state on vpcu put.
+
+However, it appears that nothing ever clears this flag. Once
+set, it will stick until the vcpu is destroyed, which has the
+potential to spuriously enable SVE for userspace.
+
+We probably never saw the issue because no VMM uses SVE, but
+that's still pretty bad. Unconditionally clearing the flag
+on vcpu load addresses the issue.
+
+Fixes: 8383741ab2e7 ("KVM: arm64: Get rid of host SVE tracking/saving")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Cc: stable@vger.kernel.org
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20220528113829.1043361-2-maz@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/fpsimd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c
+index 397fdac75cb1231e27fe696a084a960b282c0c72..7fe29bf6d193821001e69bd62995cdf58fb24ce3 100644
+--- a/arch/arm64/kvm/fpsimd.c
++++ b/arch/arm64/kvm/fpsimd.c
+@@ -80,6 +80,7 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu)
+ 	vcpu->arch.flags &= ~KVM_ARM64_FP_ENABLED;
+ 	vcpu->arch.flags |= KVM_ARM64_FP_HOST;
+ 
++	vcpu->arch.flags &= ~KVM_ARM64_HOST_SVE_ENABLED;
+ 	if (read_sysreg(cpacr_el1) & CPACR_EL1_ZEN_EL0EN)
+ 		vcpu->arch.flags |= KVM_ARM64_HOST_SVE_ENABLED;
+ }
diff --git a/0132-KVM-arm64-Don-t-read-a-HW-interrupt-pending-state-in.patch b/0132-KVM-arm64-Don-t-read-a-HW-interrupt-pending-state-in.patch
new file mode 100644
index 000000000000..3a258159ae11
--- /dev/null
+++ b/0132-KVM-arm64-Don-t-read-a-HW-interrupt-pending-state-in.patch
@@ -0,0 +1,111 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Tue, 7 Jun 2022 14:14:25 +0100
+Subject: [PATCH] KVM: arm64: Don't read a HW interrupt pending state in user
+ context
+
+commit 2cdea19a34c2340b3aa69508804efe4e3750fcec upstream.
+
+Since 5bfa685e62e9 ("KVM: arm64: vgic: Read HW interrupt pending state
+from the HW"), we're able to source the pending bit for an interrupt
+that is stored either on the physical distributor or on a device.
+
+However, this state is only available when the vcpu is loaded,
+and is not intended to be accessed from userspace. Unfortunately,
+the GICv2 emulation doesn't provide specific userspace accessors,
+and we fallback with the ones that are intended for the guest,
+with fatal consequences.
+
+Add a new vgic_uaccess_read_pending() accessor for userspace
+to use, build on top of the existing vgic_mmio_read_pending().
+
+Reported-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Fixes: 5bfa685e62e9 ("KVM: arm64: vgic: Read HW interrupt pending state from the HW")
+Link: https://lore.kernel.org/r/20220607131427.1164881-2-maz@kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/vgic/vgic-mmio-v2.c |  4 ++--
+ arch/arm64/kvm/vgic/vgic-mmio.c    | 19 ++++++++++++++++---
+ arch/arm64/kvm/vgic/vgic-mmio.h    |  3 +++
+ 3 files changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v2.c b/arch/arm64/kvm/vgic/vgic-mmio-v2.c
+index 12e4c223e6b8cdfa86d395d19b4b64a4f7ea36b6..54167fcfb60531d7c06d29e86b27e3122e29fc3a 100644
+--- a/arch/arm64/kvm/vgic/vgic-mmio-v2.c
++++ b/arch/arm64/kvm/vgic/vgic-mmio-v2.c
+@@ -417,11 +417,11 @@ static const struct vgic_register_region vgic_v2_dist_registers[] = {
+ 		VGIC_ACCESS_32bit),
+ 	REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PENDING_SET,
+ 		vgic_mmio_read_pending, vgic_mmio_write_spending,
+-		NULL, vgic_uaccess_write_spending, 1,
++		vgic_uaccess_read_pending, vgic_uaccess_write_spending, 1,
+ 		VGIC_ACCESS_32bit),
+ 	REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PENDING_CLEAR,
+ 		vgic_mmio_read_pending, vgic_mmio_write_cpending,
+-		NULL, vgic_uaccess_write_cpending, 1,
++		vgic_uaccess_read_pending, vgic_uaccess_write_cpending, 1,
+ 		VGIC_ACCESS_32bit),
+ 	REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_ACTIVE_SET,
+ 		vgic_mmio_read_active, vgic_mmio_write_sactive,
+diff --git a/arch/arm64/kvm/vgic/vgic-mmio.c b/arch/arm64/kvm/vgic/vgic-mmio.c
+index 49837d3a3ef5625ba0c5e4d2fed57e362b55ffc0..dc8c52487e470ef130a8e6b1084599b325d55f65 100644
+--- a/arch/arm64/kvm/vgic/vgic-mmio.c
++++ b/arch/arm64/kvm/vgic/vgic-mmio.c
+@@ -226,8 +226,9 @@ int vgic_uaccess_write_cenable(struct kvm_vcpu *vcpu,
+ 	return 0;
+ }
+ 
+-unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu,
+-				     gpa_t addr, unsigned int len)
++static unsigned long __read_pending(struct kvm_vcpu *vcpu,
++				    gpa_t addr, unsigned int len,
++				    bool is_user)
+ {
+ 	u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
+ 	u32 value = 0;
+@@ -248,7 +249,7 @@ unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu,
+ 						    IRQCHIP_STATE_PENDING,
+ 						    &val);
+ 			WARN_RATELIMIT(err, "IRQ %d", irq->host_irq);
+-		} else if (vgic_irq_is_mapped_level(irq)) {
++		} else if (!is_user && vgic_irq_is_mapped_level(irq)) {
+ 			val = vgic_get_phys_line_level(irq);
+ 		} else {
+ 			val = irq_is_pending(irq);
+@@ -263,6 +264,18 @@ unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu,
+ 	return value;
+ }
+ 
++unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu,
++				     gpa_t addr, unsigned int len)
++{
++	return __read_pending(vcpu, addr, len, false);
++}
++
++unsigned long vgic_uaccess_read_pending(struct kvm_vcpu *vcpu,
++					gpa_t addr, unsigned int len)
++{
++	return __read_pending(vcpu, addr, len, true);
++}
++
+ static bool is_vgic_v2_sgi(struct kvm_vcpu *vcpu, struct vgic_irq *irq)
+ {
+ 	return (vgic_irq_is_sgi(irq->intid) &&
+diff --git a/arch/arm64/kvm/vgic/vgic-mmio.h b/arch/arm64/kvm/vgic/vgic-mmio.h
+index 3fa696f198a37ab9aad81832db4b76d61bcf1ece..6082d4b66d3983495967dc02f63db8d72106b77c 100644
+--- a/arch/arm64/kvm/vgic/vgic-mmio.h
++++ b/arch/arm64/kvm/vgic/vgic-mmio.h
+@@ -149,6 +149,9 @@ int vgic_uaccess_write_cenable(struct kvm_vcpu *vcpu,
+ unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu,
+ 				     gpa_t addr, unsigned int len);
+ 
++unsigned long vgic_uaccess_read_pending(struct kvm_vcpu *vcpu,
++					gpa_t addr, unsigned int len);
++
+ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
+ 			      gpa_t addr, unsigned int len,
+ 			      unsigned long val);
diff --git a/0133-virtio-pci-Remove-wrong-address-verification-in-vp_d.patch b/0133-virtio-pci-Remove-wrong-address-verification-in-vp_d.patch
new file mode 100644
index 000000000000..1f0527600bbe
--- /dev/null
+++ b/0133-virtio-pci-Remove-wrong-address-verification-in-vp_d.patch
@@ -0,0 +1,52 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Murilo Opsfelder Araujo <muriloo@linux.ibm.com>
+Date: Thu, 14 Apr 2022 23:30:02 -0300
+Subject: [PATCH] virtio-pci: Remove wrong address verification in vp_del_vqs()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 7e415282b41bf0d15c6e0fe268f822d9b083f2f7 upstream.
+
+GCC 12 enhanced -Waddress when comparing array address to null [0],
+which warns:
+
+    drivers/virtio/virtio_pci_common.c: In function ‘vp_del_vqs’:
+    drivers/virtio/virtio_pci_common.c:257:29: warning: the comparison will always evaluate as ‘true’ for the pointer operand in ‘vp_dev->msix_affinity_masks + (sizetype)((long unsigned int)i * 256)’ must not be NULL [-Waddress]
+      257 |                         if (vp_dev->msix_affinity_masks[i])
+          |                             ^~~~~~
+
+In fact, the verification is comparing the result of a pointer
+arithmetic, the address "msix_affinity_masks + i", which will always
+evaluate to true.
+
+Under the hood, free_cpumask_var() calls kfree(), which is safe to pass
+NULL, not requiring non-null verification.  So remove the verification
+to make compiler happy (happy compiler, happy life).
+
+[0] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102103
+
+Signed-off-by: Murilo Opsfelder Araujo <muriloo@linux.ibm.com>
+Message-Id: <20220415023002.49805-1-muriloo@linux.ibm.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Christophe de Dinechin <dinechin@redhat.com>
+Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/virtio/virtio_pci_common.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index d724f676608ba34a973803eb8643bf3bba604262..5046efcffb4c042cb62d6c9c5ae4e0163b3202ae 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -254,8 +254,7 @@ void vp_del_vqs(struct virtio_device *vdev)
+ 
+ 	if (vp_dev->msix_affinity_masks) {
+ 		for (i = 0; i < vp_dev->msix_vectors; i++)
+-			if (vp_dev->msix_affinity_masks[i])
+-				free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++			free_cpumask_var(vp_dev->msix_affinity_masks[i]);
+ 	}
+ 
+ 	if (vp_dev->msix_enabled) {
diff --git a/0134-netfs-Fix-gcc-12-warning-by-embedding-vfs-inode-in-n.patch b/0134-netfs-Fix-gcc-12-warning-by-embedding-vfs-inode-in-n.patch
new file mode 100644
index 000000000000..488601e42951
--- /dev/null
+++ b/0134-netfs-Fix-gcc-12-warning-by-embedding-vfs-inode-in-n.patch
@@ -0,0 +1,2035 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 9 Jun 2022 21:46:04 +0100
+Subject: [PATCH] netfs: Fix gcc-12 warning by embedding vfs inode in
+ netfs_i_context
+
+commit 874c8ca1e60b2c564a48f7e7acc40d328d5c8733 upstream.
+
+While randstruct was satisfied with using an open-coded "void *" offset
+cast for the netfs_i_context <-> inode casting, __builtin_object_size() as
+used by FORTIFY_SOURCE was not as easily fooled.  This was causing the
+following complaint[1] from gcc v12:
+
+  In file included from include/linux/string.h:253,
+                   from include/linux/ceph/ceph_debug.h:7,
+                   from fs/ceph/inode.c:2:
+  In function 'fortify_memset_chk',
+      inlined from 'netfs_i_context_init' at include/linux/netfs.h:326:2,
+      inlined from 'ceph_alloc_inode' at fs/ceph/inode.c:463:2:
+  include/linux/fortify-string.h:242:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
+    242 |                         __write_overflow_field(p_size_field, size);
+        |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fix this by embedding a struct inode into struct netfs_i_context (which
+should perhaps be renamed to struct netfs_inode).  The struct inode
+vfs_inode fields are then removed from the 9p, afs, ceph and cifs inode
+structs and vfs_inode is then simply changed to "netfs.inode" in those
+filesystems.
+
+Further, rename netfs_i_context to netfs_inode, get rid of the
+netfs_inode() function that converted a netfs_i_context pointer to an
+inode pointer (that can now be done with &ctx->inode) and rename the
+netfs_i_context() function to netfs_inode() (which is now a wrapper
+around container_of()).
+
+Most of the changes were done with:
+
+  perl -p -i -e 's/vfs_inode/netfs.inode/'g \
+        `git grep -l 'vfs_inode' -- fs/{9p,afs,ceph,cifs}/*.[ch]`
+
+Kees suggested doing it with a pair structure[2] and a special
+declarator to insert that into the network filesystem's inode
+wrapper[3], but I think it's cleaner to embed it - and then it doesn't
+matter if struct randomisation reorders things.
+
+Dave Chinner suggested using a filesystem-specific VFS_I() function in
+each filesystem to convert that filesystem's own inode wrapper struct
+into the VFS inode struct[4].
+
+Version #2:
+ - Fix a couple of missed name changes due to a disabled cifs option.
+ - Rename nfs_i_context to nfs_inode
+ - Use "netfs" instead of "nic" as the member name in per-fs inode wrapper
+   structs.
+
+[ This also undoes commit 507160f46c55 ("netfs: gcc-12: temporarily
+  disable '-Wattribute-warning' for now") that is no longer needed ]
+
+Fixes: bc899ee1c898 ("netfs: Add a netfs inode context")
+Reported-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Xiubo Li <xiubli@redhat.com>
+cc: Jonathan Corbet <corbet@lwn.net>
+cc: Eric Van Hensbergen <ericvh@gmail.com>
+cc: Latchesar Ionkov <lucho@ionkov.net>
+cc: Dominique Martinet <asmadeus@codewreck.org>
+cc: Christian Schoenebeck <linux_oss@crudebyte.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Ilya Dryomov <idryomov@gmail.com>
+cc: Steve French <smfrench@gmail.com>
+cc: William Kucharski <william.kucharski@oracle.com>
+cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
+cc: Dave Chinner <david@fromorbit.com>
+cc: linux-doc@vger.kernel.org
+cc: v9fs-developer@lists.sourceforge.net
+cc: linux-afs@lists.infradead.org
+cc: ceph-devel@vger.kernel.org
+cc: linux-cifs@vger.kernel.org
+cc: samba-technical@lists.samba.org
+cc: linux-fsdevel@vger.kernel.org
+cc: linux-hardening@vger.kernel.org
+Link: https://lore.kernel.org/r/d2ad3a3d7bdd794c6efb562d2f2b655fb67756b9.camel@kernel.org/ [1]
+Link: https://lore.kernel.org/r/20220517210230.864239-1-keescook@chromium.org/ [2]
+Link: https://lore.kernel.org/r/20220518202212.2322058-1-keescook@chromium.org/ [3]
+Link: https://lore.kernel.org/r/20220524101205.GI2306852@dread.disaster.area/ [4]
+Link: https://lore.kernel.org/r/165296786831.3591209.12111293034669289733.stgit@warthog.procyon.org.uk/ # v1
+Link: https://lore.kernel.org/r/165305805651.4094995.7763502506786714216.stgit@warthog.procyon.org.uk # v2
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/filesystems/netfs_library.rst |  37 ++++---
+ fs/9p/cache.c                               |   4 +-
+ fs/9p/v9fs.c                                |   2 +-
+ fs/9p/v9fs.h                                |  10 +-
+ fs/9p/vfs_addr.c                            |   2 +-
+ fs/9p/vfs_inode.c                           |   4 +-
+ fs/afs/callback.c                           |   2 +-
+ fs/afs/dir.c                                |  32 +++---
+ fs/afs/dir_edit.c                           |  10 +-
+ fs/afs/dir_silly.c                          |   4 +-
+ fs/afs/dynroot.c                            |   2 +-
+ fs/afs/file.c                               |   4 +-
+ fs/afs/fs_operation.c                       |   6 +-
+ fs/afs/inode.c                              |  41 ++++----
+ fs/afs/internal.h                           |  23 ++---
+ fs/afs/super.c                              |   6 +-
+ fs/afs/write.c                              |  21 ++--
+ fs/ceph/addr.c                              |   4 +-
+ fs/ceph/cache.c                             |   4 +-
+ fs/ceph/cache.h                             |   2 +-
+ fs/ceph/caps.c                              | 104 ++++++++++----------
+ fs/ceph/file.c                              |   2 +-
+ fs/ceph/inode.c                             |  13 +--
+ fs/ceph/mds_client.c                        |   4 +-
+ fs/ceph/snap.c                              |   8 +-
+ fs/ceph/super.c                             |   2 +-
+ fs/ceph/super.h                             |  10 +-
+ fs/ceph/xattr.c                             |  14 +--
+ fs/cifs/cifsfs.c                            |   8 +-
+ fs/cifs/cifsglob.h                          |  12 +--
+ fs/cifs/file.c                              |   8 +-
+ fs/cifs/fscache.c                           |   8 +-
+ fs/cifs/fscache.h                           |   8 +-
+ fs/cifs/inode.c                             |   4 +-
+ fs/cifs/misc.c                              |   4 +-
+ fs/cifs/smb2ops.c                           |   8 +-
+ fs/netfs/buffered_read.c                    |   6 +-
+ fs/netfs/internal.h                         |   2 +-
+ fs/netfs/objects.c                          |   2 +-
+ include/linux/netfs.h                       |  41 +++-----
+ 40 files changed, 227 insertions(+), 261 deletions(-)
+
+diff --git a/Documentation/filesystems/netfs_library.rst b/Documentation/filesystems/netfs_library.rst
+index 69f00179fdfeb60bb113a5582bb2cfb8a234a5e3..0483abcafcb012eeae0c668707477ce42b8e930b 100644
+--- a/Documentation/filesystems/netfs_library.rst
++++ b/Documentation/filesystems/netfs_library.rst
+@@ -37,30 +37,31 @@ The network filesystem helper library needs a place to store a bit of state for
+ its use on each netfs inode it is helping to manage.  To this end, a context
+ structure is defined::
+ 
+-	struct netfs_i_context {
++	struct netfs_inode {
++		struct inode inode;
+ 		const struct netfs_request_ops *ops;
+-		struct fscache_cookie	*cache;
++		struct fscache_cookie *cache;
+ 	};
+ 
+-A network filesystem that wants to use netfs lib must place one of these
+-directly after the VFS ``struct inode`` it allocates, usually as part of its
+-own struct.  This can be done in a way similar to the following::
++A network filesystem that wants to use netfs lib must place one of these in its
++inode wrapper struct instead of the VFS ``struct inode``.  This can be done in
++a way similar to the following::
+ 
+ 	struct my_inode {
+-		struct {
+-			/* These must be contiguous */
+-			struct inode		vfs_inode;
+-			struct netfs_i_context  netfs_ctx;
+-		};
++		struct netfs_inode netfs; /* Netfslib context and vfs inode */
+ 		...
+ 	};
+ 
+-This allows netfslib to find its state by simple offset from the inode pointer,
+-thereby allowing the netfslib helper functions to be pointed to directly by the
+-VFS/VM operation tables.
++This allows netfslib to find its state by using ``container_of()`` from the
++inode pointer, thereby allowing the netfslib helper functions to be pointed to
++directly by the VFS/VM operation tables.
+ 
+ The structure contains the following fields:
+ 
++ * ``inode``
++
++   The VFS inode structure.
++
+  * ``ops``
+ 
+    The set of operations provided by the network filesystem to netfslib.
+@@ -78,14 +79,12 @@ To help deal with the per-inode context, a number helper functions are
+ provided.  Firstly, a function to perform basic initialisation on a context and
+ set the operations table pointer::
+ 
+-	void netfs_i_context_init(struct inode *inode,
+-				  const struct netfs_request_ops *ops);
++	void netfs_inode_init(struct inode *inode,
++			      const struct netfs_request_ops *ops);
+ 
+-then two functions to cast between the VFS inode structure and the netfs
+-context::
++then a function to cast from the VFS inode structure to the netfs context::
+ 
+-	struct netfs_i_context *netfs_i_context(struct inode *inode);
+-	struct inode *netfs_inode(struct netfs_i_context *ctx);
++	struct netfs_inode *netfs_node(struct inode *inode);
+ 
+ and finally, a function to get the cache cookie pointer from the context
+ attached to an inode (or NULL if fscache is disabled)::
+diff --git a/fs/9p/cache.c b/fs/9p/cache.c
+index 1c8dc696d516fc925fa93f1f0d33095bd9316eec..cebba4eaa0b575af6305faa19363d18593133ea4 100644
+--- a/fs/9p/cache.c
++++ b/fs/9p/cache.c
+@@ -62,12 +62,12 @@ void v9fs_cache_inode_get_cookie(struct inode *inode)
+ 	version = cpu_to_le32(v9inode->qid.version);
+ 	path = cpu_to_le64(v9inode->qid.path);
+ 	v9ses = v9fs_inode2v9ses(inode);
+-	v9inode->netfs_ctx.cache =
++	v9inode->netfs.cache =
+ 		fscache_acquire_cookie(v9fs_session_cache(v9ses),
+ 				       0,
+ 				       &path, sizeof(path),
+ 				       &version, sizeof(version),
+-				       i_size_read(&v9inode->vfs_inode));
++				       i_size_read(&v9inode->netfs.inode));
+ 
+ 	p9_debug(P9_DEBUG_FSC, "inode %p get cookie %p\n",
+ 		 inode, v9fs_inode_cookie(v9inode));
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index e28ddf763b3b92e3cfecabffa424a97a0731f3cd..0129de2ea31ae514007428c2c9e71188ee405dbf 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -625,7 +625,7 @@ static void v9fs_inode_init_once(void *foo)
+ 	struct v9fs_inode *v9inode = (struct v9fs_inode *)foo;
+ 
+ 	memset(&v9inode->qid, 0, sizeof(v9inode->qid));
+-	inode_init_once(&v9inode->vfs_inode);
++	inode_init_once(&v9inode->netfs.inode);
+ }
+ 
+ /**
+diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h
+index ec0e8df3b2eb27b1337c5259c635bdf3598205d2..1b219c21d15ebc80e087f59daeba2739b87490fe 100644
+--- a/fs/9p/v9fs.h
++++ b/fs/9p/v9fs.h
+@@ -109,11 +109,7 @@ struct v9fs_session_info {
+ #define V9FS_INO_INVALID_ATTR 0x01
+ 
+ struct v9fs_inode {
+-	struct {
+-		/* These must be contiguous */
+-		struct inode	vfs_inode;	/* the VFS's inode record */
+-		struct netfs_i_context netfs_ctx; /* Netfslib context */
+-	};
++	struct netfs_inode netfs; /* Netfslib context and vfs inode */
+ 	struct p9_qid qid;
+ 	unsigned int cache_validity;
+ 	struct p9_fid *writeback_fid;
+@@ -122,13 +118,13 @@ struct v9fs_inode {
+ 
+ static inline struct v9fs_inode *V9FS_I(const struct inode *inode)
+ {
+-	return container_of(inode, struct v9fs_inode, vfs_inode);
++	return container_of(inode, struct v9fs_inode, netfs.inode);
+ }
+ 
+ static inline struct fscache_cookie *v9fs_inode_cookie(struct v9fs_inode *v9inode)
+ {
+ #ifdef CONFIG_9P_FSCACHE
+-	return netfs_i_cookie(&v9inode->vfs_inode);
++	return netfs_i_cookie(&v9inode->netfs.inode);
+ #else
+ 	return NULL;
+ #endif
+diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
+index 5011281883432dc9111ef498a6d5abc55f14a1e3..595875228672f36c462aaf912d92e836a0c247b1 100644
+--- a/fs/9p/vfs_addr.c
++++ b/fs/9p/vfs_addr.c
+@@ -141,7 +141,7 @@ static void v9fs_write_to_cache_done(void *priv, ssize_t transferred_or_error,
+ 	    transferred_or_error != -ENOBUFS) {
+ 		version = cpu_to_le32(v9inode->qid.version);
+ 		fscache_invalidate(v9fs_inode_cookie(v9inode), &version,
+-				   i_size_read(&v9inode->vfs_inode), 0);
++				   i_size_read(&v9inode->netfs.inode), 0);
+ 	}
+ }
+ 
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 55367ecb9442e0129fe2e9b89778b063d48fc9fa..e660c6348b9da21b6e0112c958e0dd36ce0968cd 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -234,7 +234,7 @@ struct inode *v9fs_alloc_inode(struct super_block *sb)
+ 	v9inode->writeback_fid = NULL;
+ 	v9inode->cache_validity = 0;
+ 	mutex_init(&v9inode->v_mutex);
+-	return &v9inode->vfs_inode;
++	return &v9inode->netfs.inode;
+ }
+ 
+ /**
+@@ -252,7 +252,7 @@ void v9fs_free_inode(struct inode *inode)
+  */
+ static void v9fs_set_netfs_context(struct inode *inode)
+ {
+-	netfs_i_context_init(inode, &v9fs_req_ops);
++	netfs_inode_init(inode, &v9fs_req_ops);
+ }
+ 
+ int v9fs_init_inode(struct v9fs_session_info *v9ses,
+diff --git a/fs/afs/callback.c b/fs/afs/callback.c
+index 1b4d5809808d0d232d6a66d1c4a2b74d8bd980f7..a484fa6428081ab6d34bad627bb5d468793a0708 100644
+--- a/fs/afs/callback.c
++++ b/fs/afs/callback.c
+@@ -30,7 +30,7 @@ void afs_invalidate_mmap_work(struct work_struct *work)
+ {
+ 	struct afs_vnode *vnode = container_of(work, struct afs_vnode, cb_work);
+ 
+-	unmap_mapping_pages(vnode->vfs_inode.i_mapping, 0, 0, false);
++	unmap_mapping_pages(vnode->netfs.inode.i_mapping, 0, 0, false);
+ }
+ 
+ void afs_server_init_callback_work(struct work_struct *work)
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index bdac73554e6e5ad8b9448247fc18a2d7e6e5f6e2..5cbb5234f7ce8af8f3deabf7d4c9b05fd1f43397 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -109,7 +109,7 @@ struct afs_lookup_cookie {
+  */
+ static void afs_dir_read_cleanup(struct afs_read *req)
+ {
+-	struct address_space *mapping = req->vnode->vfs_inode.i_mapping;
++	struct address_space *mapping = req->vnode->netfs.inode.i_mapping;
+ 	struct folio *folio;
+ 	pgoff_t last = req->nr_pages - 1;
+ 
+@@ -153,7 +153,7 @@ static bool afs_dir_check_folio(struct afs_vnode *dvnode, struct folio *folio,
+ 		block = kmap_local_folio(folio, offset);
+ 		if (block->hdr.magic != AFS_DIR_MAGIC) {
+ 			printk("kAFS: %s(%lx): [%llx] bad magic %zx/%zx is %04hx\n",
+-			       __func__, dvnode->vfs_inode.i_ino,
++			       __func__, dvnode->netfs.inode.i_ino,
+ 			       pos, offset, size, ntohs(block->hdr.magic));
+ 			trace_afs_dir_check_failed(dvnode, pos + offset, i_size);
+ 			kunmap_local(block);
+@@ -183,7 +183,7 @@ static bool afs_dir_check_folio(struct afs_vnode *dvnode, struct folio *folio,
+ static void afs_dir_dump(struct afs_vnode *dvnode, struct afs_read *req)
+ {
+ 	union afs_xdr_dir_block *block;
+-	struct address_space *mapping = dvnode->vfs_inode.i_mapping;
++	struct address_space *mapping = dvnode->netfs.inode.i_mapping;
+ 	struct folio *folio;
+ 	pgoff_t last = req->nr_pages - 1;
+ 	size_t offset, size;
+@@ -217,7 +217,7 @@ static void afs_dir_dump(struct afs_vnode *dvnode, struct afs_read *req)
+  */
+ static int afs_dir_check(struct afs_vnode *dvnode, struct afs_read *req)
+ {
+-	struct address_space *mapping = dvnode->vfs_inode.i_mapping;
++	struct address_space *mapping = dvnode->netfs.inode.i_mapping;
+ 	struct folio *folio;
+ 	pgoff_t last = req->nr_pages - 1;
+ 	int ret = 0;
+@@ -269,7 +269,7 @@ static int afs_dir_open(struct inode *inode, struct file *file)
+ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key)
+ 	__acquires(&dvnode->validate_lock)
+ {
+-	struct address_space *mapping = dvnode->vfs_inode.i_mapping;
++	struct address_space *mapping = dvnode->netfs.inode.i_mapping;
+ 	struct afs_read *req;
+ 	loff_t i_size;
+ 	int nr_pages, i;
+@@ -287,7 +287,7 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key)
+ 	req->cleanup = afs_dir_read_cleanup;
+ 
+ expand:
+-	i_size = i_size_read(&dvnode->vfs_inode);
++	i_size = i_size_read(&dvnode->netfs.inode);
+ 	if (i_size < 2048) {
+ 		ret = afs_bad(dvnode, afs_file_error_dir_small);
+ 		goto error;
+@@ -305,7 +305,7 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key)
+ 	req->actual_len = i_size; /* May change */
+ 	req->len = nr_pages * PAGE_SIZE; /* We can ask for more than there is */
+ 	req->data_version = dvnode->status.data_version; /* May change */
+-	iov_iter_xarray(&req->def_iter, READ, &dvnode->vfs_inode.i_mapping->i_pages,
++	iov_iter_xarray(&req->def_iter, READ, &dvnode->netfs.inode.i_mapping->i_pages,
+ 			0, i_size);
+ 	req->iter = &req->def_iter;
+ 
+@@ -897,7 +897,7 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry,
+ 
+ out_op:
+ 	if (op->error == 0) {
+-		inode = &op->file[1].vnode->vfs_inode;
++		inode = &op->file[1].vnode->netfs.inode;
+ 		op->file[1].vnode = NULL;
+ 	}
+ 
+@@ -1139,7 +1139,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ 	afs_stat_v(dir, n_reval);
+ 
+ 	/* search the directory for this vnode */
+-	ret = afs_do_lookup_one(&dir->vfs_inode, dentry, &fid, key, &dir_version);
++	ret = afs_do_lookup_one(&dir->netfs.inode, dentry, &fid, key, &dir_version);
+ 	switch (ret) {
+ 	case 0:
+ 		/* the filename maps to something */
+@@ -1170,7 +1170,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ 			_debug("%pd: file deleted (uq %u -> %u I:%u)",
+ 			       dentry, fid.unique,
+ 			       vnode->fid.unique,
+-			       vnode->vfs_inode.i_generation);
++			       vnode->netfs.inode.i_generation);
+ 			goto not_found;
+ 		}
+ 		goto out_valid;
+@@ -1368,7 +1368,7 @@ static void afs_dir_remove_subdir(struct dentry *dentry)
+ 	if (d_really_is_positive(dentry)) {
+ 		struct afs_vnode *vnode = AFS_FS_I(d_inode(dentry));
+ 
+-		clear_nlink(&vnode->vfs_inode);
++		clear_nlink(&vnode->netfs.inode);
+ 		set_bit(AFS_VNODE_DELETED, &vnode->flags);
+ 		clear_bit(AFS_VNODE_CB_PROMISED, &vnode->flags);
+ 		clear_bit(AFS_VNODE_DIR_VALID, &vnode->flags);
+@@ -1487,8 +1487,8 @@ static void afs_dir_remove_link(struct afs_operation *op)
+ 		/* Already done */
+ 	} else if (test_bit(AFS_VNODE_DIR_VALID, &dvnode->flags)) {
+ 		write_seqlock(&vnode->cb_lock);
+-		drop_nlink(&vnode->vfs_inode);
+-		if (vnode->vfs_inode.i_nlink == 0) {
++		drop_nlink(&vnode->netfs.inode);
++		if (vnode->netfs.inode.i_nlink == 0) {
+ 			set_bit(AFS_VNODE_DELETED, &vnode->flags);
+ 			__afs_break_callback(vnode, afs_cb_break_for_unlink);
+ 		}
+@@ -1504,7 +1504,7 @@ static void afs_dir_remove_link(struct afs_operation *op)
+ 			op->error = ret;
+ 	}
+ 
+-	_debug("nlink %d [val %d]", vnode->vfs_inode.i_nlink, op->error);
++	_debug("nlink %d [val %d]", vnode->netfs.inode.i_nlink, op->error);
+ }
+ 
+ static void afs_unlink_success(struct afs_operation *op)
+@@ -1680,8 +1680,8 @@ static void afs_link_success(struct afs_operation *op)
+ 	afs_update_dentry_version(op, dvp, op->dentry);
+ 	if (op->dentry_2->d_parent == op->dentry->d_parent)
+ 		afs_update_dentry_version(op, dvp, op->dentry_2);
+-	ihold(&vp->vnode->vfs_inode);
+-	d_instantiate(op->dentry, &vp->vnode->vfs_inode);
++	ihold(&vp->vnode->netfs.inode);
++	d_instantiate(op->dentry, &vp->vnode->netfs.inode);
+ }
+ 
+ static void afs_link_put(struct afs_operation *op)
+diff --git a/fs/afs/dir_edit.c b/fs/afs/dir_edit.c
+index d98e109ecee9a3ef6d9c7a04e801f8f39b791078..0ab7752d1b758e7bd593bfe44faf04bf43951f0b 100644
+--- a/fs/afs/dir_edit.c
++++ b/fs/afs/dir_edit.c
+@@ -109,7 +109,7 @@ static void afs_clear_contig_bits(union afs_xdr_dir_block *block,
+  */
+ static struct folio *afs_dir_get_folio(struct afs_vnode *vnode, pgoff_t index)
+ {
+-	struct address_space *mapping = vnode->vfs_inode.i_mapping;
++	struct address_space *mapping = vnode->netfs.inode.i_mapping;
+ 	struct folio *folio;
+ 
+ 	folio = __filemap_get_folio(mapping, index,
+@@ -216,7 +216,7 @@ void afs_edit_dir_add(struct afs_vnode *vnode,
+ 
+ 	_enter(",,{%d,%s},", name->len, name->name);
+ 
+-	i_size = i_size_read(&vnode->vfs_inode);
++	i_size = i_size_read(&vnode->netfs.inode);
+ 	if (i_size > AFS_DIR_BLOCK_SIZE * AFS_DIR_MAX_BLOCKS ||
+ 	    (i_size & (AFS_DIR_BLOCK_SIZE - 1))) {
+ 		clear_bit(AFS_VNODE_DIR_VALID, &vnode->flags);
+@@ -336,7 +336,7 @@ void afs_edit_dir_add(struct afs_vnode *vnode,
+ 	if (b < AFS_DIR_BLOCKS_WITH_CTR)
+ 		meta->meta.alloc_ctrs[b] -= need_slots;
+ 
+-	inode_inc_iversion_raw(&vnode->vfs_inode);
++	inode_inc_iversion_raw(&vnode->netfs.inode);
+ 	afs_stat_v(vnode, n_dir_cr);
+ 	_debug("Insert %s in %u[%u]", name->name, b, slot);
+ 
+@@ -383,7 +383,7 @@ void afs_edit_dir_remove(struct afs_vnode *vnode,
+ 
+ 	_enter(",,{%d,%s},", name->len, name->name);
+ 
+-	i_size = i_size_read(&vnode->vfs_inode);
++	i_size = i_size_read(&vnode->netfs.inode);
+ 	if (i_size < AFS_DIR_BLOCK_SIZE ||
+ 	    i_size > AFS_DIR_BLOCK_SIZE * AFS_DIR_MAX_BLOCKS ||
+ 	    (i_size & (AFS_DIR_BLOCK_SIZE - 1))) {
+@@ -463,7 +463,7 @@ void afs_edit_dir_remove(struct afs_vnode *vnode,
+ 	if (b < AFS_DIR_BLOCKS_WITH_CTR)
+ 		meta->meta.alloc_ctrs[b] += need_slots;
+ 
+-	inode_set_iversion_raw(&vnode->vfs_inode, vnode->status.data_version);
++	inode_set_iversion_raw(&vnode->netfs.inode, vnode->status.data_version);
+ 	afs_stat_v(vnode, n_dir_rm);
+ 	_debug("Remove %s from %u[%u]", name->name, b, slot);
+ 
+diff --git a/fs/afs/dir_silly.c b/fs/afs/dir_silly.c
+index 45cfd50a95210b95375f1df9a44db34aabc3bb0c..bb5807e87fa4c430d6be36f6e1754aa62f5c11b9 100644
+--- a/fs/afs/dir_silly.c
++++ b/fs/afs/dir_silly.c
+@@ -131,7 +131,7 @@ int afs_sillyrename(struct afs_vnode *dvnode, struct afs_vnode *vnode,
+ 			goto out;
+ 	} while (!d_is_negative(sdentry));
+ 
+-	ihold(&vnode->vfs_inode);
++	ihold(&vnode->netfs.inode);
+ 
+ 	ret = afs_do_silly_rename(dvnode, vnode, dentry, sdentry, key);
+ 	switch (ret) {
+@@ -148,7 +148,7 @@ int afs_sillyrename(struct afs_vnode *dvnode, struct afs_vnode *vnode,
+ 		d_drop(sdentry);
+ 	}
+ 
+-	iput(&vnode->vfs_inode);
++	iput(&vnode->netfs.inode);
+ 	dput(sdentry);
+ out:
+ 	_leave(" = %d", ret);
+diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
+index f120bcb8bf738d6434179bd0dfa7da1fd4fef243..3a5bbffdf053461045a728ffbda1dc8e7fb06da7 100644
+--- a/fs/afs/dynroot.c
++++ b/fs/afs/dynroot.c
+@@ -76,7 +76,7 @@ struct inode *afs_iget_pseudo_dir(struct super_block *sb, bool root)
+ 	/* there shouldn't be an existing inode */
+ 	BUG_ON(!(inode->i_state & I_NEW));
+ 
+-	netfs_i_context_init(inode, NULL);
++	netfs_inode_init(inode, NULL);
+ 	inode->i_size		= 0;
+ 	inode->i_mode		= S_IFDIR | S_IRUGO | S_IXUGO;
+ 	if (root) {
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index 26292a110a8f9abf03471a402fdf567a4a6bfcc0..fab8324833ba09eca97c58e41ef078b91196b254 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -194,7 +194,7 @@ int afs_release(struct inode *inode, struct file *file)
+ 		afs_put_wb_key(af->wb);
+ 
+ 	if ((file->f_mode & FMODE_WRITE)) {
+-		i_size = i_size_read(&vnode->vfs_inode);
++		i_size = i_size_read(&vnode->netfs.inode);
+ 		afs_set_cache_aux(vnode, &aux);
+ 		fscache_unuse_cookie(afs_vnode_cache(vnode), &aux, &i_size);
+ 	} else {
+@@ -325,7 +325,7 @@ static void afs_issue_read(struct netfs_io_subrequest *subreq)
+ 	fsreq->iter	= &fsreq->def_iter;
+ 
+ 	iov_iter_xarray(&fsreq->def_iter, READ,
+-			&fsreq->vnode->vfs_inode.i_mapping->i_pages,
++			&fsreq->vnode->netfs.inode.i_mapping->i_pages,
+ 			fsreq->pos, fsreq->len);
+ 
+ 	afs_fetch_data(fsreq->vnode, fsreq);
+diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c
+index d222dfbe976be58af90743bf8367db8c3ee63608..7a3803ce3a22970786699436763bc0925144cfb9 100644
+--- a/fs/afs/fs_operation.c
++++ b/fs/afs/fs_operation.c
+@@ -232,14 +232,14 @@ int afs_put_operation(struct afs_operation *op)
+ 	if (op->file[1].modification && op->file[1].vnode != op->file[0].vnode)
+ 		clear_bit(AFS_VNODE_MODIFYING, &op->file[1].vnode->flags);
+ 	if (op->file[0].put_vnode)
+-		iput(&op->file[0].vnode->vfs_inode);
++		iput(&op->file[0].vnode->netfs.inode);
+ 	if (op->file[1].put_vnode)
+-		iput(&op->file[1].vnode->vfs_inode);
++		iput(&op->file[1].vnode->netfs.inode);
+ 
+ 	if (op->more_files) {
+ 		for (i = 0; i < op->nr_files - 2; i++)
+ 			if (op->more_files[i].put_vnode)
+-				iput(&op->more_files[i].vnode->vfs_inode);
++				iput(&op->more_files[i].vnode->netfs.inode);
+ 		kfree(op->more_files);
+ 	}
+ 
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 65b439cd53d29c78701fa62f98433f5058907166..22811e9eacf58015b5fc1f123d3944c8ba88da1c 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -25,9 +25,6 @@
+ #include "internal.h"
+ #include "afs_fs.h"
+ 
+-// Temporary: netfs does disgusting things with inode pointers
+-#pragma GCC diagnostic ignored "-Wattribute-warning"
+-
+ static const struct inode_operations afs_symlink_inode_operations = {
+ 	.get_link	= page_get_link,
+ };
+@@ -61,7 +58,7 @@ static noinline void dump_vnode(struct afs_vnode *vnode, struct afs_vnode *paren
+  */
+ static void afs_set_netfs_context(struct afs_vnode *vnode)
+ {
+-	netfs_i_context_init(&vnode->vfs_inode, &afs_req_ops);
++	netfs_inode_init(&vnode->netfs.inode, &afs_req_ops);
+ }
+ 
+ /*
+@@ -99,7 +96,7 @@ static int afs_inode_init_from_status(struct afs_operation *op,
+ 	inode->i_flags |= S_NOATIME;
+ 	inode->i_uid = make_kuid(&init_user_ns, status->owner);
+ 	inode->i_gid = make_kgid(&init_user_ns, status->group);
+-	set_nlink(&vnode->vfs_inode, status->nlink);
++	set_nlink(&vnode->netfs.inode, status->nlink);
+ 
+ 	switch (status->type) {
+ 	case AFS_FTYPE_FILE:
+@@ -142,7 +139,7 @@ static int afs_inode_init_from_status(struct afs_operation *op,
+ 	afs_set_netfs_context(vnode);
+ 
+ 	vnode->invalid_before	= status->data_version;
+-	inode_set_iversion_raw(&vnode->vfs_inode, status->data_version);
++	inode_set_iversion_raw(&vnode->netfs.inode, status->data_version);
+ 
+ 	if (!vp->scb.have_cb) {
+ 		/* it's a symlink we just created (the fileserver
+@@ -166,7 +163,7 @@ static void afs_apply_status(struct afs_operation *op,
+ {
+ 	struct afs_file_status *status = &vp->scb.status;
+ 	struct afs_vnode *vnode = vp->vnode;
+-	struct inode *inode = &vnode->vfs_inode;
++	struct inode *inode = &vnode->netfs.inode;
+ 	struct timespec64 t;
+ 	umode_t mode;
+ 	bool data_changed = false;
+@@ -249,7 +246,7 @@ static void afs_apply_status(struct afs_operation *op,
+ 		 * idea of what the size should be that's not the same as
+ 		 * what's on the server.
+ 		 */
+-		vnode->netfs_ctx.remote_i_size = status->size;
++		vnode->netfs.remote_i_size = status->size;
+ 		if (change_size) {
+ 			afs_set_i_size(vnode, status->size);
+ 			inode->i_ctime = t;
+@@ -292,7 +289,7 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v
+ 		 */
+ 		if (vp->scb.status.abort_code == VNOVNODE) {
+ 			set_bit(AFS_VNODE_DELETED, &vnode->flags);
+-			clear_nlink(&vnode->vfs_inode);
++			clear_nlink(&vnode->netfs.inode);
+ 			__afs_break_callback(vnode, afs_cb_break_for_deleted);
+ 			op->flags &= ~AFS_OPERATION_DIR_CONFLICT;
+ 		}
+@@ -309,8 +306,8 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v
+ 		if (vp->scb.have_cb)
+ 			afs_apply_callback(op, vp);
+ 	} else if (vp->op_unlinked && !(op->flags & AFS_OPERATION_DIR_CONFLICT)) {
+-		drop_nlink(&vnode->vfs_inode);
+-		if (vnode->vfs_inode.i_nlink == 0) {
++		drop_nlink(&vnode->netfs.inode);
++		if (vnode->netfs.inode.i_nlink == 0) {
+ 			set_bit(AFS_VNODE_DELETED, &vnode->flags);
+ 			__afs_break_callback(vnode, afs_cb_break_for_deleted);
+ 		}
+@@ -329,7 +326,7 @@ static void afs_fetch_status_success(struct afs_operation *op)
+ 	struct afs_vnode *vnode = vp->vnode;
+ 	int ret;
+ 
+-	if (vnode->vfs_inode.i_state & I_NEW) {
++	if (vnode->netfs.inode.i_state & I_NEW) {
+ 		ret = afs_inode_init_from_status(op, vp, vnode);
+ 		op->error = ret;
+ 		if (ret == 0)
+@@ -433,7 +430,7 @@ static void afs_get_inode_cache(struct afs_vnode *vnode)
+ 	struct afs_vnode_cache_aux aux;
+ 
+ 	if (vnode->status.type != AFS_FTYPE_FILE) {
+-		vnode->netfs_ctx.cache = NULL;
++		vnode->netfs.cache = NULL;
+ 		return;
+ 	}
+ 
+@@ -460,7 +457,7 @@ static void afs_get_inode_cache(struct afs_vnode *vnode)
+ struct inode *afs_iget(struct afs_operation *op, struct afs_vnode_param *vp)
+ {
+ 	struct afs_vnode_param *dvp = &op->file[0];
+-	struct super_block *sb = dvp->vnode->vfs_inode.i_sb;
++	struct super_block *sb = dvp->vnode->netfs.inode.i_sb;
+ 	struct afs_vnode *vnode;
+ 	struct inode *inode;
+ 	int ret;
+@@ -585,10 +582,10 @@ static void afs_zap_data(struct afs_vnode *vnode)
+ 	/* nuke all the non-dirty pages that aren't locked, mapped or being
+ 	 * written back in a regular file and completely discard the pages in a
+ 	 * directory or symlink */
+-	if (S_ISREG(vnode->vfs_inode.i_mode))
+-		invalidate_remote_inode(&vnode->vfs_inode);
++	if (S_ISREG(vnode->netfs.inode.i_mode))
++		invalidate_remote_inode(&vnode->netfs.inode);
+ 	else
+-		invalidate_inode_pages2(vnode->vfs_inode.i_mapping);
++		invalidate_inode_pages2(vnode->netfs.inode.i_mapping);
+ }
+ 
+ /*
+@@ -686,8 +683,8 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ 	       key_serial(key));
+ 
+ 	if (unlikely(test_bit(AFS_VNODE_DELETED, &vnode->flags))) {
+-		if (vnode->vfs_inode.i_nlink)
+-			clear_nlink(&vnode->vfs_inode);
++		if (vnode->netfs.inode.i_nlink)
++			clear_nlink(&vnode->netfs.inode);
+ 		goto valid;
+ 	}
+ 
+@@ -829,7 +826,7 @@ void afs_evict_inode(struct inode *inode)
+ static void afs_setattr_success(struct afs_operation *op)
+ {
+ 	struct afs_vnode_param *vp = &op->file[0];
+-	struct inode *inode = &vp->vnode->vfs_inode;
++	struct inode *inode = &vp->vnode->netfs.inode;
+ 	loff_t old_i_size = i_size_read(inode);
+ 
+ 	op->setattr.old_i_size = old_i_size;
+@@ -846,7 +843,7 @@ static void afs_setattr_success(struct afs_operation *op)
+ static void afs_setattr_edit_file(struct afs_operation *op)
+ {
+ 	struct afs_vnode_param *vp = &op->file[0];
+-	struct inode *inode = &vp->vnode->vfs_inode;
++	struct inode *inode = &vp->vnode->netfs.inode;
+ 
+ 	if (op->setattr.attr->ia_valid & ATTR_SIZE) {
+ 		loff_t size = op->setattr.attr->ia_size;
+@@ -878,7 +875,7 @@ int afs_setattr(struct user_namespace *mnt_userns, struct dentry *dentry,
+ 		ATTR_MTIME | ATTR_MTIME_SET | ATTR_TIMES_SET | ATTR_TOUCH;
+ 	struct afs_operation *op;
+ 	struct afs_vnode *vnode = AFS_FS_I(d_inode(dentry));
+-	struct inode *inode = &vnode->vfs_inode;
++	struct inode *inode = &vnode->netfs.inode;
+ 	loff_t i_size;
+ 	int ret;
+ 
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index 7b7ef945dc78e460aa4580b16ab38bcd24cc90eb..40518b58576093ffa6844d93bf2a4816865fc3a6 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -619,12 +619,7 @@ enum afs_lock_state {
+  * leak from one inode to another.
+  */
+ struct afs_vnode {
+-	struct {
+-		/* These must be contiguous */
+-		struct inode	vfs_inode;	/* the VFS's inode record */
+-		struct netfs_i_context netfs_ctx; /* Netfslib context */
+-	};
+-
++	struct netfs_inode	netfs;		/* Netfslib context and vfs inode */
+ 	struct afs_volume	*volume;	/* volume on which vnode resides */
+ 	struct afs_fid		fid;		/* the file identifier for this inode */
+ 	struct afs_file_status	status;		/* AFS status info for this file */
+@@ -675,7 +670,7 @@ struct afs_vnode {
+ static inline struct fscache_cookie *afs_vnode_cache(struct afs_vnode *vnode)
+ {
+ #ifdef CONFIG_AFS_FSCACHE
+-	return netfs_i_cookie(&vnode->vfs_inode);
++	return netfs_i_cookie(&vnode->netfs.inode);
+ #else
+ 	return NULL;
+ #endif
+@@ -685,7 +680,7 @@ static inline void afs_vnode_set_cache(struct afs_vnode *vnode,
+ 				       struct fscache_cookie *cookie)
+ {
+ #ifdef CONFIG_AFS_FSCACHE
+-	vnode->netfs_ctx.cache = cookie;
++	vnode->netfs.cache = cookie;
+ #endif
+ }
+ 
+@@ -892,7 +887,7 @@ static inline void afs_invalidate_cache(struct afs_vnode *vnode, unsigned int fl
+ 
+ 	afs_set_cache_aux(vnode, &aux);
+ 	fscache_invalidate(afs_vnode_cache(vnode), &aux,
+-			   i_size_read(&vnode->vfs_inode), flags);
++			   i_size_read(&vnode->netfs.inode), flags);
+ }
+ 
+ /*
+@@ -1217,7 +1212,7 @@ static inline struct afs_net *afs_i2net(struct inode *inode)
+ 
+ static inline struct afs_net *afs_v2net(struct afs_vnode *vnode)
+ {
+-	return afs_i2net(&vnode->vfs_inode);
++	return afs_i2net(&vnode->netfs.inode);
+ }
+ 
+ static inline struct afs_net *afs_sock2net(struct sock *sk)
+@@ -1593,12 +1588,12 @@ extern void yfs_fs_store_opaque_acl2(struct afs_operation *);
+  */
+ static inline struct afs_vnode *AFS_FS_I(struct inode *inode)
+ {
+-	return container_of(inode, struct afs_vnode, vfs_inode);
++	return container_of(inode, struct afs_vnode, netfs.inode);
+ }
+ 
+ static inline struct inode *AFS_VNODE_TO_I(struct afs_vnode *vnode)
+ {
+-	return &vnode->vfs_inode;
++	return &vnode->netfs.inode;
+ }
+ 
+ /*
+@@ -1621,8 +1616,8 @@ static inline void afs_update_dentry_version(struct afs_operation *op,
+  */
+ static inline void afs_set_i_size(struct afs_vnode *vnode, u64 size)
+ {
+-	i_size_write(&vnode->vfs_inode, size);
+-	vnode->vfs_inode.i_blocks = ((size + 1023) >> 10) << 1;
++	i_size_write(&vnode->netfs.inode, size);
++	vnode->netfs.inode.i_blocks = ((size + 1023) >> 10) << 1;
+ }
+ 
+ /*
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index 1fea195b0b2750d7d5282dddff4b80c7b96ef720..95d713074dc8130125e55da2cd4e19b693682f8f 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -659,7 +659,7 @@ static void afs_i_init_once(void *_vnode)
+ 	struct afs_vnode *vnode = _vnode;
+ 
+ 	memset(vnode, 0, sizeof(*vnode));
+-	inode_init_once(&vnode->vfs_inode);
++	inode_init_once(&vnode->netfs.inode);
+ 	mutex_init(&vnode->io_lock);
+ 	init_rwsem(&vnode->validate_lock);
+ 	spin_lock_init(&vnode->wb_lock);
+@@ -700,8 +700,8 @@ static struct inode *afs_alloc_inode(struct super_block *sb)
+ 	init_rwsem(&vnode->rmdir_lock);
+ 	INIT_WORK(&vnode->cb_work, afs_invalidate_mmap_work);
+ 
+-	_leave(" = %p", &vnode->vfs_inode);
+-	return &vnode->vfs_inode;
++	_leave(" = %p", &vnode->netfs.inode);
++	return &vnode->netfs.inode;
+ }
+ 
+ static void afs_free_inode(struct inode *inode)
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index c1bc52ac7de1119ebaa395c22e2952acc1dc63e2..270e41ac9af4fbc9b916ba3b216fb31e415eabee 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -146,10 +146,10 @@ int afs_write_end(struct file *file, struct address_space *mapping,
+ 
+ 	write_end_pos = pos + copied;
+ 
+-	i_size = i_size_read(&vnode->vfs_inode);
++	i_size = i_size_read(&vnode->netfs.inode);
+ 	if (write_end_pos > i_size) {
+ 		write_seqlock(&vnode->cb_lock);
+-		i_size = i_size_read(&vnode->vfs_inode);
++		i_size = i_size_read(&vnode->netfs.inode);
+ 		if (write_end_pos > i_size)
+ 			afs_set_i_size(vnode, write_end_pos);
+ 		write_sequnlock(&vnode->cb_lock);
+@@ -257,7 +257,7 @@ static void afs_redirty_pages(struct writeback_control *wbc,
+  */
+ static void afs_pages_written_back(struct afs_vnode *vnode, loff_t start, unsigned int len)
+ {
+-	struct address_space *mapping = vnode->vfs_inode.i_mapping;
++	struct address_space *mapping = vnode->netfs.inode.i_mapping;
+ 	struct folio *folio;
+ 	pgoff_t end;
+ 
+@@ -354,7 +354,6 @@ static const struct afs_operation_ops afs_store_data_operation = {
+ static int afs_store_data(struct afs_vnode *vnode, struct iov_iter *iter, loff_t pos,
+ 			  bool laundering)
+ {
+-	struct netfs_i_context *ictx = &vnode->netfs_ctx;
+ 	struct afs_operation *op;
+ 	struct afs_wb_key *wbk = NULL;
+ 	loff_t size = iov_iter_count(iter);
+@@ -385,9 +384,9 @@ static int afs_store_data(struct afs_vnode *vnode, struct iov_iter *iter, loff_t
+ 	op->store.write_iter = iter;
+ 	op->store.pos = pos;
+ 	op->store.size = size;
+-	op->store.i_size = max(pos + size, ictx->remote_i_size);
++	op->store.i_size = max(pos + size, vnode->netfs.remote_i_size);
+ 	op->store.laundering = laundering;
+-	op->mtime = vnode->vfs_inode.i_mtime;
++	op->mtime = vnode->netfs.inode.i_mtime;
+ 	op->flags |= AFS_OPERATION_UNINTR;
+ 	op->ops = &afs_store_data_operation;
+ 
+@@ -554,7 +553,7 @@ static ssize_t afs_write_back_from_locked_folio(struct address_space *mapping,
+ 	struct iov_iter iter;
+ 	unsigned long priv;
+ 	unsigned int offset, to, len, max_len;
+-	loff_t i_size = i_size_read(&vnode->vfs_inode);
++	loff_t i_size = i_size_read(&vnode->netfs.inode);
+ 	bool new_content = test_bit(AFS_VNODE_NEW_CONTENT, &vnode->flags);
+ 	bool caching = fscache_cookie_enabled(afs_vnode_cache(vnode));
+ 	long count = wbc->nr_to_write;
+@@ -845,7 +844,7 @@ ssize_t afs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ 	_enter("{%llx:%llu},{%zu},",
+ 	       vnode->fid.vid, vnode->fid.vnode, count);
+ 
+-	if (IS_SWAPFILE(&vnode->vfs_inode)) {
++	if (IS_SWAPFILE(&vnode->netfs.inode)) {
+ 		printk(KERN_INFO
+ 		       "AFS: Attempt to write to active swap file!\n");
+ 		return -EBUSY;
+@@ -958,8 +957,8 @@ void afs_prune_wb_keys(struct afs_vnode *vnode)
+ 	/* Discard unused keys */
+ 	spin_lock(&vnode->wb_lock);
+ 
+-	if (!mapping_tagged(&vnode->vfs_inode.i_data, PAGECACHE_TAG_WRITEBACK) &&
+-	    !mapping_tagged(&vnode->vfs_inode.i_data, PAGECACHE_TAG_DIRTY)) {
++	if (!mapping_tagged(&vnode->netfs.inode.i_data, PAGECACHE_TAG_WRITEBACK) &&
++	    !mapping_tagged(&vnode->netfs.inode.i_data, PAGECACHE_TAG_DIRTY)) {
+ 		list_for_each_entry_safe(wbk, tmp, &vnode->wb_keys, vnode_link) {
+ 			if (refcount_read(&wbk->usage) == 1)
+ 				list_move(&wbk->vnode_link, &graveyard);
+@@ -1034,6 +1033,6 @@ static void afs_write_to_cache(struct afs_vnode *vnode,
+ 			       bool caching)
+ {
+ 	fscache_write_to_cache(afs_vnode_cache(vnode),
+-			       vnode->vfs_inode.i_mapping, start, len, i_size,
++			       vnode->netfs.inode.i_mapping, start, len, i_size,
+ 			       afs_write_to_cache_done, vnode, caching);
+ }
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index adef10a6e5c7b6d32aa4f39c54179f83ae98595e..11dbb1133a21e50eaa8574443ed1214017f3f479 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -1795,7 +1795,7 @@ enum {
+ static int __ceph_pool_perm_get(struct ceph_inode_info *ci,
+ 				s64 pool, struct ceph_string *pool_ns)
+ {
+-	struct ceph_fs_client *fsc = ceph_inode_to_client(&ci->vfs_inode);
++	struct ceph_fs_client *fsc = ceph_inode_to_client(&ci->netfs.inode);
+ 	struct ceph_mds_client *mdsc = fsc->mdsc;
+ 	struct ceph_osd_request *rd_req = NULL, *wr_req = NULL;
+ 	struct rb_node **p, *parent;
+@@ -1910,7 +1910,7 @@ static int __ceph_pool_perm_get(struct ceph_inode_info *ci,
+ 				     0, false, true);
+ 	err = ceph_osdc_start_request(&fsc->client->osdc, rd_req, false);
+ 
+-	wr_req->r_mtime = ci->vfs_inode.i_mtime;
++	wr_req->r_mtime = ci->netfs.inode.i_mtime;
+ 	err2 = ceph_osdc_start_request(&fsc->client->osdc, wr_req, false);
+ 
+ 	if (!err)
+diff --git a/fs/ceph/cache.c b/fs/ceph/cache.c
+index ddea999220739aaf49770c1cb1e7bc77ee2358fa..177d8e8d73fe424a412be19635e1f99b37b2e1b3 100644
+--- a/fs/ceph/cache.c
++++ b/fs/ceph/cache.c
+@@ -29,9 +29,9 @@ void ceph_fscache_register_inode_cookie(struct inode *inode)
+ 	if (!(inode->i_state & I_NEW))
+ 		return;
+ 
+-	WARN_ON_ONCE(ci->netfs_ctx.cache);
++	WARN_ON_ONCE(ci->netfs.cache);
+ 
+-	ci->netfs_ctx.cache =
++	ci->netfs.cache =
+ 		fscache_acquire_cookie(fsc->fscache, 0,
+ 				       &ci->i_vino, sizeof(ci->i_vino),
+ 				       &ci->i_version, sizeof(ci->i_version),
+diff --git a/fs/ceph/cache.h b/fs/ceph/cache.h
+index 7255b790a4c1c579827223d4b5493f204a24e053..26c6ae06e2f41dceb83ba523726dde14b6295703 100644
+--- a/fs/ceph/cache.h
++++ b/fs/ceph/cache.h
+@@ -28,7 +28,7 @@ void ceph_fscache_invalidate(struct inode *inode, bool dio_write);
+ 
+ static inline struct fscache_cookie *ceph_fscache_cookie(struct ceph_inode_info *ci)
+ {
+-	return netfs_i_cookie(&ci->vfs_inode);
++	return netfs_i_cookie(&ci->netfs.inode);
+ }
+ 
+ static inline void ceph_fscache_resize(struct inode *inode, loff_t to)
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 5c14ef04e474247e3d98fbdacfef017c5950d217..a0467bca39fa7ecd8838446acb4c7e973a3731d2 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -492,7 +492,7 @@ static void __cap_set_timeouts(struct ceph_mds_client *mdsc,
+ 	struct ceph_mount_options *opt = mdsc->fsc->mount_options;
+ 	ci->i_hold_caps_max = round_jiffies(jiffies +
+ 					    opt->caps_wanted_delay_max * HZ);
+-	dout("__cap_set_timeouts %p %lu\n", &ci->vfs_inode,
++	dout("__cap_set_timeouts %p %lu\n", &ci->netfs.inode,
+ 	     ci->i_hold_caps_max - jiffies);
+ }
+ 
+@@ -507,7 +507,7 @@ static void __cap_set_timeouts(struct ceph_mds_client *mdsc,
+ static void __cap_delay_requeue(struct ceph_mds_client *mdsc,
+ 				struct ceph_inode_info *ci)
+ {
+-	dout("__cap_delay_requeue %p flags 0x%lx at %lu\n", &ci->vfs_inode,
++	dout("__cap_delay_requeue %p flags 0x%lx at %lu\n", &ci->netfs.inode,
+ 	     ci->i_ceph_flags, ci->i_hold_caps_max);
+ 	if (!mdsc->stopping) {
+ 		spin_lock(&mdsc->cap_delay_lock);
+@@ -531,7 +531,7 @@ static void __cap_delay_requeue(struct ceph_mds_client *mdsc,
+ static void __cap_delay_requeue_front(struct ceph_mds_client *mdsc,
+ 				      struct ceph_inode_info *ci)
+ {
+-	dout("__cap_delay_requeue_front %p\n", &ci->vfs_inode);
++	dout("__cap_delay_requeue_front %p\n", &ci->netfs.inode);
+ 	spin_lock(&mdsc->cap_delay_lock);
+ 	ci->i_ceph_flags |= CEPH_I_FLUSH;
+ 	if (!list_empty(&ci->i_cap_delay_list))
+@@ -548,7 +548,7 @@ static void __cap_delay_requeue_front(struct ceph_mds_client *mdsc,
+ static void __cap_delay_cancel(struct ceph_mds_client *mdsc,
+ 			       struct ceph_inode_info *ci)
+ {
+-	dout("__cap_delay_cancel %p\n", &ci->vfs_inode);
++	dout("__cap_delay_cancel %p\n", &ci->netfs.inode);
+ 	if (list_empty(&ci->i_cap_delay_list))
+ 		return;
+ 	spin_lock(&mdsc->cap_delay_lock);
+@@ -568,7 +568,7 @@ static void __check_cap_issue(struct ceph_inode_info *ci, struct ceph_cap *cap,
+ 	 * Each time we receive FILE_CACHE anew, we increment
+ 	 * i_rdcache_gen.
+ 	 */
+-	if (S_ISREG(ci->vfs_inode.i_mode) &&
++	if (S_ISREG(ci->netfs.inode.i_mode) &&
+ 	    (issued & (CEPH_CAP_FILE_CACHE|CEPH_CAP_FILE_LAZYIO)) &&
+ 	    (had & (CEPH_CAP_FILE_CACHE|CEPH_CAP_FILE_LAZYIO)) == 0) {
+ 		ci->i_rdcache_gen++;
+@@ -583,14 +583,14 @@ static void __check_cap_issue(struct ceph_inode_info *ci, struct ceph_cap *cap,
+ 	if ((issued & CEPH_CAP_FILE_SHARED) != (had & CEPH_CAP_FILE_SHARED)) {
+ 		if (issued & CEPH_CAP_FILE_SHARED)
+ 			atomic_inc(&ci->i_shared_gen);
+-		if (S_ISDIR(ci->vfs_inode.i_mode)) {
+-			dout(" marking %p NOT complete\n", &ci->vfs_inode);
++		if (S_ISDIR(ci->netfs.inode.i_mode)) {
++			dout(" marking %p NOT complete\n", &ci->netfs.inode);
+ 			__ceph_dir_clear_complete(ci);
+ 		}
+ 	}
+ 
+ 	/* Wipe saved layout if we're losing DIR_CREATE caps */
+-	if (S_ISDIR(ci->vfs_inode.i_mode) && (had & CEPH_CAP_DIR_CREATE) &&
++	if (S_ISDIR(ci->netfs.inode.i_mode) && (had & CEPH_CAP_DIR_CREATE) &&
+ 		!(issued & CEPH_CAP_DIR_CREATE)) {
+ 	     ceph_put_string(rcu_dereference_raw(ci->i_cached_layout.pool_ns));
+ 	     memset(&ci->i_cached_layout, 0, sizeof(ci->i_cached_layout));
+@@ -771,7 +771,7 @@ static int __cap_is_valid(struct ceph_cap *cap)
+ 
+ 	if (cap->cap_gen < gen || time_after_eq(jiffies, ttl)) {
+ 		dout("__cap_is_valid %p cap %p issued %s "
+-		     "but STALE (gen %u vs %u)\n", &cap->ci->vfs_inode,
++		     "but STALE (gen %u vs %u)\n", &cap->ci->netfs.inode,
+ 		     cap, ceph_cap_string(cap->issued), cap->cap_gen, gen);
+ 		return 0;
+ 	}
+@@ -797,7 +797,7 @@ int __ceph_caps_issued(struct ceph_inode_info *ci, int *implemented)
+ 		if (!__cap_is_valid(cap))
+ 			continue;
+ 		dout("__ceph_caps_issued %p cap %p issued %s\n",
+-		     &ci->vfs_inode, cap, ceph_cap_string(cap->issued));
++		     &ci->netfs.inode, cap, ceph_cap_string(cap->issued));
+ 		have |= cap->issued;
+ 		if (implemented)
+ 			*implemented |= cap->implemented;
+@@ -844,12 +844,12 @@ static void __touch_cap(struct ceph_cap *cap)
+ 
+ 	spin_lock(&s->s_cap_lock);
+ 	if (!s->s_cap_iterator) {
+-		dout("__touch_cap %p cap %p mds%d\n", &cap->ci->vfs_inode, cap,
++		dout("__touch_cap %p cap %p mds%d\n", &cap->ci->netfs.inode, cap,
+ 		     s->s_mds);
+ 		list_move_tail(&cap->session_caps, &s->s_caps);
+ 	} else {
+ 		dout("__touch_cap %p cap %p mds%d NOP, iterating over caps\n",
+-		     &cap->ci->vfs_inode, cap, s->s_mds);
++		     &cap->ci->netfs.inode, cap, s->s_mds);
+ 	}
+ 	spin_unlock(&s->s_cap_lock);
+ }
+@@ -867,7 +867,7 @@ int __ceph_caps_issued_mask(struct ceph_inode_info *ci, int mask, int touch)
+ 
+ 	if ((have & mask) == mask) {
+ 		dout("__ceph_caps_issued_mask ino 0x%llx snap issued %s"
+-		     " (mask %s)\n", ceph_ino(&ci->vfs_inode),
++		     " (mask %s)\n", ceph_ino(&ci->netfs.inode),
+ 		     ceph_cap_string(have),
+ 		     ceph_cap_string(mask));
+ 		return 1;
+@@ -879,7 +879,7 @@ int __ceph_caps_issued_mask(struct ceph_inode_info *ci, int mask, int touch)
+ 			continue;
+ 		if ((cap->issued & mask) == mask) {
+ 			dout("__ceph_caps_issued_mask ino 0x%llx cap %p issued %s"
+-			     " (mask %s)\n", ceph_ino(&ci->vfs_inode), cap,
++			     " (mask %s)\n", ceph_ino(&ci->netfs.inode), cap,
+ 			     ceph_cap_string(cap->issued),
+ 			     ceph_cap_string(mask));
+ 			if (touch)
+@@ -891,7 +891,7 @@ int __ceph_caps_issued_mask(struct ceph_inode_info *ci, int mask, int touch)
+ 		have |= cap->issued;
+ 		if ((have & mask) == mask) {
+ 			dout("__ceph_caps_issued_mask ino 0x%llx combo issued %s"
+-			     " (mask %s)\n", ceph_ino(&ci->vfs_inode),
++			     " (mask %s)\n", ceph_ino(&ci->netfs.inode),
+ 			     ceph_cap_string(cap->issued),
+ 			     ceph_cap_string(mask));
+ 			if (touch) {
+@@ -919,7 +919,7 @@ int __ceph_caps_issued_mask(struct ceph_inode_info *ci, int mask, int touch)
+ int __ceph_caps_issued_mask_metric(struct ceph_inode_info *ci, int mask,
+ 				   int touch)
+ {
+-	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->vfs_inode.i_sb);
++	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->netfs.inode.i_sb);
+ 	int r;
+ 
+ 	r = __ceph_caps_issued_mask(ci, mask, touch);
+@@ -950,7 +950,7 @@ int __ceph_caps_revoking_other(struct ceph_inode_info *ci,
+ 
+ int ceph_caps_revoking(struct ceph_inode_info *ci, int mask)
+ {
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	int ret;
+ 
+ 	spin_lock(&ci->i_ceph_lock);
+@@ -969,8 +969,8 @@ int __ceph_caps_used(struct ceph_inode_info *ci)
+ 	if (ci->i_rd_ref)
+ 		used |= CEPH_CAP_FILE_RD;
+ 	if (ci->i_rdcache_ref ||
+-	    (S_ISREG(ci->vfs_inode.i_mode) &&
+-	     ci->vfs_inode.i_data.nrpages))
++	    (S_ISREG(ci->netfs.inode.i_mode) &&
++	     ci->netfs.inode.i_data.nrpages))
+ 		used |= CEPH_CAP_FILE_CACHE;
+ 	if (ci->i_wr_ref)
+ 		used |= CEPH_CAP_FILE_WR;
+@@ -993,11 +993,11 @@ int __ceph_caps_file_wanted(struct ceph_inode_info *ci)
+ 	const int WR_SHIFT = ffs(CEPH_FILE_MODE_WR);
+ 	const int LAZY_SHIFT = ffs(CEPH_FILE_MODE_LAZY);
+ 	struct ceph_mount_options *opt =
+-		ceph_inode_to_client(&ci->vfs_inode)->mount_options;
++		ceph_inode_to_client(&ci->netfs.inode)->mount_options;
+ 	unsigned long used_cutoff = jiffies - opt->caps_wanted_delay_max * HZ;
+ 	unsigned long idle_cutoff = jiffies - opt->caps_wanted_delay_min * HZ;
+ 
+-	if (S_ISDIR(ci->vfs_inode.i_mode)) {
++	if (S_ISDIR(ci->netfs.inode.i_mode)) {
+ 		int want = 0;
+ 
+ 		/* use used_cutoff here, to keep dir's wanted caps longer */
+@@ -1050,7 +1050,7 @@ int __ceph_caps_file_wanted(struct ceph_inode_info *ci)
+ int __ceph_caps_wanted(struct ceph_inode_info *ci)
+ {
+ 	int w = __ceph_caps_file_wanted(ci) | __ceph_caps_used(ci);
+-	if (S_ISDIR(ci->vfs_inode.i_mode)) {
++	if (S_ISDIR(ci->netfs.inode.i_mode)) {
+ 		/* we want EXCL if holding caps of dir ops */
+ 		if (w & CEPH_CAP_ANY_DIR_OPS)
+ 			w |= CEPH_CAP_FILE_EXCL;
+@@ -1116,9 +1116,9 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
+ 
+ 	lockdep_assert_held(&ci->i_ceph_lock);
+ 
+-	dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
++	dout("__ceph_remove_cap %p from %p\n", cap, &ci->netfs.inode);
+ 
+-	mdsc = ceph_inode_to_client(&ci->vfs_inode)->mdsc;
++	mdsc = ceph_inode_to_client(&ci->netfs.inode)->mdsc;
+ 
+ 	/* remove from inode's cap rbtree, and clear auth cap */
+ 	rb_erase(&cap->ci_node, &ci->i_caps);
+@@ -1169,7 +1169,7 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
+ 		 * keep i_snap_realm.
+ 		 */
+ 		if (ci->i_wr_ref == 0 && ci->i_snap_realm)
+-			ceph_change_snap_realm(&ci->vfs_inode, NULL);
++			ceph_change_snap_realm(&ci->netfs.inode, NULL);
+ 
+ 		__cap_delay_cancel(mdsc, ci);
+ 	}
+@@ -1188,11 +1188,11 @@ void ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
+ 
+ 	lockdep_assert_held(&ci->i_ceph_lock);
+ 
+-	fsc = ceph_inode_to_client(&ci->vfs_inode);
++	fsc = ceph_inode_to_client(&ci->netfs.inode);
+ 	WARN_ON_ONCE(ci->i_auth_cap == cap &&
+ 		     !list_empty(&ci->i_dirty_item) &&
+ 		     !fsc->blocklisted &&
+-		     !ceph_inode_is_shutdown(&ci->vfs_inode));
++		     !ceph_inode_is_shutdown(&ci->netfs.inode));
+ 
+ 	__ceph_remove_cap(cap, queue_release);
+ }
+@@ -1343,7 +1343,7 @@ static void __prep_cap(struct cap_msg_args *arg, struct ceph_cap *cap,
+ 		       int flushing, u64 flush_tid, u64 oldest_flush_tid)
+ {
+ 	struct ceph_inode_info *ci = cap->ci;
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	int held, revoking;
+ 
+ 	lockdep_assert_held(&ci->i_ceph_lock);
+@@ -1440,7 +1440,7 @@ static void __prep_cap(struct cap_msg_args *arg, struct ceph_cap *cap,
+ static void __send_cap(struct cap_msg_args *arg, struct ceph_inode_info *ci)
+ {
+ 	struct ceph_msg *msg;
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 
+ 	msg = ceph_msg_new(CEPH_MSG_CLIENT_CAPS, CAP_MSG_SIZE, GFP_NOFS, false);
+ 	if (!msg) {
+@@ -1528,7 +1528,7 @@ static void __ceph_flush_snaps(struct ceph_inode_info *ci,
+ 		__releases(ci->i_ceph_lock)
+ 		__acquires(ci->i_ceph_lock)
+ {
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	struct ceph_mds_client *mdsc = session->s_mdsc;
+ 	struct ceph_cap_snap *capsnap;
+ 	u64 oldest_flush_tid = 0;
+@@ -1621,7 +1621,7 @@ static void __ceph_flush_snaps(struct ceph_inode_info *ci,
+ void ceph_flush_snaps(struct ceph_inode_info *ci,
+ 		      struct ceph_mds_session **psession)
+ {
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	struct ceph_mds_client *mdsc = ceph_inode_to_client(inode)->mdsc;
+ 	struct ceph_mds_session *session = NULL;
+ 	int mds;
+@@ -1681,8 +1681,8 @@ int __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask,
+ 			   struct ceph_cap_flush **pcf)
+ {
+ 	struct ceph_mds_client *mdsc =
+-		ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc;
+-	struct inode *inode = &ci->vfs_inode;
++		ceph_sb_to_client(ci->netfs.inode.i_sb)->mdsc;
++	struct inode *inode = &ci->netfs.inode;
+ 	int was = ci->i_dirty_caps;
+ 	int dirty = 0;
+ 
+@@ -1695,7 +1695,7 @@ int __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask,
+ 		return 0;
+ 	}
+ 
+-	dout("__mark_dirty_caps %p %s dirty %s -> %s\n", &ci->vfs_inode,
++	dout("__mark_dirty_caps %p %s dirty %s -> %s\n", &ci->netfs.inode,
+ 	     ceph_cap_string(mask), ceph_cap_string(was),
+ 	     ceph_cap_string(was | mask));
+ 	ci->i_dirty_caps |= mask;
+@@ -1711,7 +1711,7 @@ int __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask,
+ 				ci->i_snap_realm->cached_context);
+ 		}
+ 		dout(" inode %p now dirty snapc %p auth cap %p\n",
+-		     &ci->vfs_inode, ci->i_head_snapc, ci->i_auth_cap);
++		     &ci->netfs.inode, ci->i_head_snapc, ci->i_auth_cap);
+ 		BUG_ON(!list_empty(&ci->i_dirty_item));
+ 		spin_lock(&mdsc->cap_dirty_lock);
+ 		list_add(&ci->i_dirty_item, &session->s_cap_dirty);
+@@ -1874,7 +1874,7 @@ static int try_nonblocking_invalidate(struct inode *inode)
+ 
+ bool __ceph_should_report_size(struct ceph_inode_info *ci)
+ {
+-	loff_t size = i_size_read(&ci->vfs_inode);
++	loff_t size = i_size_read(&ci->netfs.inode);
+ 	/* mds will adjust max size according to the reported size */
+ 	if (ci->i_flushing_caps & CEPH_CAP_FILE_WR)
+ 		return false;
+@@ -1899,7 +1899,7 @@ bool __ceph_should_report_size(struct ceph_inode_info *ci)
+ void ceph_check_caps(struct ceph_inode_info *ci, int flags,
+ 		     struct ceph_mds_session *session)
+ {
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb);
+ 	struct ceph_cap *cap;
+ 	u64 flush_tid, oldest_flush_tid;
+@@ -2446,7 +2446,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc,
+ 	__releases(ci->i_ceph_lock)
+ 	__acquires(ci->i_ceph_lock)
+ {
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	struct ceph_cap *cap;
+ 	struct ceph_cap_flush *cf;
+ 	int ret;
+@@ -2539,7 +2539,7 @@ void ceph_early_kick_flushing_caps(struct ceph_mds_client *mdsc,
+ 		cap = ci->i_auth_cap;
+ 		if (!(cap && cap->session == session)) {
+ 			pr_err("%p auth cap %p not mds%d ???\n",
+-				&ci->vfs_inode, cap, session->s_mds);
++				&ci->netfs.inode, cap, session->s_mds);
+ 			spin_unlock(&ci->i_ceph_lock);
+ 			continue;
+ 		}
+@@ -2589,7 +2589,7 @@ void ceph_kick_flushing_caps(struct ceph_mds_client *mdsc,
+ 		cap = ci->i_auth_cap;
+ 		if (!(cap && cap->session == session)) {
+ 			pr_err("%p auth cap %p not mds%d ???\n",
+-				&ci->vfs_inode, cap, session->s_mds);
++				&ci->netfs.inode, cap, session->s_mds);
+ 			spin_unlock(&ci->i_ceph_lock);
+ 			continue;
+ 		}
+@@ -2609,7 +2609,7 @@ void ceph_kick_flushing_inode_caps(struct ceph_mds_session *session,
+ 
+ 	lockdep_assert_held(&ci->i_ceph_lock);
+ 
+-	dout("%s %p flushing %s\n", __func__, &ci->vfs_inode,
++	dout("%s %p flushing %s\n", __func__, &ci->netfs.inode,
+ 	     ceph_cap_string(ci->i_flushing_caps));
+ 
+ 	if (!list_empty(&ci->i_cap_flush_list)) {
+@@ -2652,10 +2652,10 @@ void ceph_take_cap_refs(struct ceph_inode_info *ci, int got,
+ 	}
+ 	if (got & CEPH_CAP_FILE_BUFFER) {
+ 		if (ci->i_wb_ref == 0)
+-			ihold(&ci->vfs_inode);
++			ihold(&ci->netfs.inode);
+ 		ci->i_wb_ref++;
+ 		dout("%s %p wb %d -> %d (?)\n", __func__,
+-		     &ci->vfs_inode, ci->i_wb_ref-1, ci->i_wb_ref);
++		     &ci->netfs.inode, ci->i_wb_ref-1, ci->i_wb_ref);
+ 	}
+ }
+ 
+@@ -2983,7 +2983,7 @@ int ceph_get_caps(struct file *filp, int need, int want, loff_t endoff, int *got
+ 			return ret;
+ 		}
+ 
+-		if (S_ISREG(ci->vfs_inode.i_mode) &&
++		if (S_ISREG(ci->netfs.inode.i_mode) &&
+ 		    ci->i_inline_version != CEPH_INLINE_NONE &&
+ 		    (_got & (CEPH_CAP_FILE_CACHE|CEPH_CAP_FILE_LAZYIO)) &&
+ 		    i_size_read(inode) > 0) {
+@@ -3073,7 +3073,7 @@ enum put_cap_refs_mode {
+ static void __ceph_put_cap_refs(struct ceph_inode_info *ci, int had,
+ 				enum put_cap_refs_mode mode)
+ {
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	int last = 0, put = 0, flushsnaps = 0, wake = 0;
+ 	bool check_flushsnaps = false;
+ 
+@@ -3181,7 +3181,7 @@ void ceph_put_cap_refs_no_check_caps(struct ceph_inode_info *ci, int had)
+ void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
+ 				struct ceph_snap_context *snapc)
+ {
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	struct ceph_cap_snap *capsnap = NULL;
+ 	int put = 0;
+ 	bool last = false;
+@@ -3678,7 +3678,7 @@ static void handle_cap_flush_ack(struct inode *inode, u64 flush_tid,
+ 				     session->s_mds,
+ 				     &list_first_entry(&session->s_cap_flushing,
+ 						struct ceph_inode_info,
+-						i_flushing_item)->vfs_inode);
++						i_flushing_item)->netfs.inode);
+ 			}
+ 		}
+ 		mdsc->num_cap_flushing--;
+@@ -4326,7 +4326,7 @@ unsigned long ceph_check_delayed_caps(struct ceph_mds_client *mdsc)
+ 			break;
+ 		list_del_init(&ci->i_cap_delay_list);
+ 
+-		inode = igrab(&ci->vfs_inode);
++		inode = igrab(&ci->netfs.inode);
+ 		if (inode) {
+ 			spin_unlock(&mdsc->cap_delay_lock);
+ 			dout("check_delayed_caps on %p\n", inode);
+@@ -4354,7 +4354,7 @@ static void flush_dirty_session_caps(struct ceph_mds_session *s)
+ 	while (!list_empty(&s->s_cap_dirty)) {
+ 		ci = list_first_entry(&s->s_cap_dirty, struct ceph_inode_info,
+ 				      i_dirty_item);
+-		inode = &ci->vfs_inode;
++		inode = &ci->netfs.inode;
+ 		ihold(inode);
+ 		dout("flush_dirty_caps %llx.%llx\n", ceph_vinop(inode));
+ 		spin_unlock(&mdsc->cap_dirty_lock);
+@@ -4388,7 +4388,7 @@ void __ceph_touch_fmode(struct ceph_inode_info *ci,
+ 
+ void ceph_get_fmode(struct ceph_inode_info *ci, int fmode, int count)
+ {
+-	struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(ci->vfs_inode.i_sb);
++	struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(ci->netfs.inode.i_sb);
+ 	int bits = (fmode << 1) | 1;
+ 	bool already_opened = false;
+ 	int i;
+@@ -4422,7 +4422,7 @@ void ceph_get_fmode(struct ceph_inode_info *ci, int fmode, int count)
+  */
+ void ceph_put_fmode(struct ceph_inode_info *ci, int fmode, int count)
+ {
+-	struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(ci->vfs_inode.i_sb);
++	struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(ci->netfs.inode.i_sb);
+ 	int bits = (fmode << 1) | 1;
+ 	bool is_closed = true;
+ 	int i;
+@@ -4637,7 +4637,7 @@ int ceph_purge_inode_cap(struct inode *inode, struct ceph_cap *cap, bool *invali
+ 	lockdep_assert_held(&ci->i_ceph_lock);
+ 
+ 	dout("removing cap %p, ci is %p, inode is %p\n",
+-	     cap, ci, &ci->vfs_inode);
++	     cap, ci, &ci->netfs.inode);
+ 
+ 	is_auth = (cap == ci->i_auth_cap);
+ 	__ceph_remove_cap(cap, false);
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 8c8226c0feaccce31395d349d2bc266b6497b033..da59e836a06eb7502c84ff0bb9d7a0f9e49a7b31 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -205,7 +205,7 @@ static int ceph_init_file_info(struct inode *inode, struct file *file,
+ {
+ 	struct ceph_inode_info *ci = ceph_inode(inode);
+ 	struct ceph_mount_options *opt =
+-		ceph_inode_to_client(&ci->vfs_inode)->mount_options;
++		ceph_inode_to_client(&ci->netfs.inode)->mount_options;
+ 	struct ceph_file_info *fi;
+ 	int ret;
+ 
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 83739dae52687d94837d2e0babb5c7852d31686f..f7a99a7e53c287361f0283f9ec94d2b80944f300 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -20,9 +20,6 @@
+ #include "cache.h"
+ #include <linux/ceph/decode.h>
+ 
+-// Temporary: netfs does disgusting things with inode pointers
+-#pragma GCC diagnostic ignored "-Wattribute-warning"
+-
+ /*
+  * Ceph inode operations
+  *
+@@ -179,7 +176,7 @@ static struct ceph_inode_frag *__get_or_create_frag(struct ceph_inode_info *ci,
+ 	rb_insert_color(&frag->node, &ci->i_fragtree);
+ 
+ 	dout("get_or_create_frag added %llx.%llx frag %x\n",
+-	     ceph_vinop(&ci->vfs_inode), f);
++	     ceph_vinop(&ci->netfs.inode), f);
+ 	return frag;
+ }
+ 
+@@ -460,10 +457,10 @@ struct inode *ceph_alloc_inode(struct super_block *sb)
+ 	if (!ci)
+ 		return NULL;
+ 
+-	dout("alloc_inode %p\n", &ci->vfs_inode);
++	dout("alloc_inode %p\n", &ci->netfs.inode);
+ 
+ 	/* Set parameters for the netfs library */
+-	netfs_i_context_init(&ci->vfs_inode, &ceph_netfs_ops);
++	netfs_inode_init(&ci->netfs.inode, &ceph_netfs_ops);
+ 
+ 	spin_lock_init(&ci->i_ceph_lock);
+ 
+@@ -550,7 +547,7 @@ struct inode *ceph_alloc_inode(struct super_block *sb)
+ 	INIT_WORK(&ci->i_work, ceph_inode_work);
+ 	ci->i_work_mask = 0;
+ 	memset(&ci->i_btime, '\0', sizeof(ci->i_btime));
+-	return &ci->vfs_inode;
++	return &ci->netfs.inode;
+ }
+ 
+ void ceph_free_inode(struct inode *inode)
+@@ -1980,7 +1977,7 @@ static void ceph_inode_work(struct work_struct *work)
+ {
+ 	struct ceph_inode_info *ci = container_of(work, struct ceph_inode_info,
+ 						 i_work);
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 
+ 	if (test_and_clear_bit(CEPH_I_WORK_WRITEBACK, &ci->i_work_mask)) {
+ 		dout("writeback %p\n", inode);
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 8c249511344da4c0af1d04f839ac852bd61170d1..3f72ba137ff8e7a585473120538cd28f1216fbaf 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -1564,7 +1564,7 @@ int ceph_iterate_session_caps(struct ceph_mds_session *session,
+ 	p = session->s_caps.next;
+ 	while (p != &session->s_caps) {
+ 		cap = list_entry(p, struct ceph_cap, session_caps);
+-		inode = igrab(&cap->ci->vfs_inode);
++		inode = igrab(&cap->ci->netfs.inode);
+ 		if (!inode) {
+ 			p = p->next;
+ 			continue;
+@@ -1622,7 +1622,7 @@ static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
+ 	int iputs;
+ 
+ 	dout("removing cap %p, ci is %p, inode is %p\n",
+-	     cap, ci, &ci->vfs_inode);
++	     cap, ci, &ci->netfs.inode);
+ 	spin_lock(&ci->i_ceph_lock);
+ 	iputs = ceph_purge_inode_cap(inode, cap, &invalidate);
+ 	spin_unlock(&ci->i_ceph_lock);
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index 322ee5add94261838fd95e2c06caf7fb72ab23c4..864cdaa0d2bd659e43459ddfdecf6f5fd8bcc7b0 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -521,7 +521,7 @@ static bool has_new_snaps(struct ceph_snap_context *o,
+ static void ceph_queue_cap_snap(struct ceph_inode_info *ci,
+ 				struct ceph_cap_snap **pcapsnap)
+ {
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	struct ceph_snap_context *old_snapc, *new_snapc;
+ 	struct ceph_cap_snap *capsnap = *pcapsnap;
+ 	struct ceph_buffer *old_blob = NULL;
+@@ -652,7 +652,7 @@ static void ceph_queue_cap_snap(struct ceph_inode_info *ci,
+ int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
+ 			    struct ceph_cap_snap *capsnap)
+ {
+-	struct inode *inode = &ci->vfs_inode;
++	struct inode *inode = &ci->netfs.inode;
+ 	struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb);
+ 
+ 	BUG_ON(capsnap->writing);
+@@ -712,7 +712,7 @@ static void queue_realm_cap_snaps(struct ceph_snap_realm *realm)
+ 
+ 	spin_lock(&realm->inodes_with_caps_lock);
+ 	list_for_each_entry(ci, &realm->inodes_with_caps, i_snap_realm_item) {
+-		struct inode *inode = igrab(&ci->vfs_inode);
++		struct inode *inode = igrab(&ci->netfs.inode);
+ 		if (!inode)
+ 			continue;
+ 		spin_unlock(&realm->inodes_with_caps_lock);
+@@ -904,7 +904,7 @@ static void flush_snaps(struct ceph_mds_client *mdsc)
+ 	while (!list_empty(&mdsc->snap_flush_list)) {
+ 		ci = list_first_entry(&mdsc->snap_flush_list,
+ 				struct ceph_inode_info, i_snap_flush_item);
+-		inode = &ci->vfs_inode;
++		inode = &ci->netfs.inode;
+ 		ihold(inode);
+ 		spin_unlock(&mdsc->snap_flush_lock);
+ 		ceph_flush_snaps(ci, &session);
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index e6987d295079f3a882dea3715daad55f985dec55..612d8bc73ea96a6067c2de5314d6b51ae241879e 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -876,7 +876,7 @@ mempool_t *ceph_wb_pagevec_pool;
+ static void ceph_inode_init_once(void *foo)
+ {
+ 	struct ceph_inode_info *ci = foo;
+-	inode_init_once(&ci->vfs_inode);
++	inode_init_once(&ci->netfs.inode);
+ }
+ 
+ static int __init init_caches(void)
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 20ceab74e87178ef03acccad052d812fa7d147ce..755a1ad2601695cf3cbd0346b5d4805124281fff 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -316,11 +316,7 @@ struct ceph_inode_xattrs_info {
+  * Ceph inode.
+  */
+ struct ceph_inode_info {
+-	struct {
+-		/* These must be contiguous */
+-		struct inode vfs_inode;
+-		struct netfs_i_context netfs_ctx; /* Netfslib context */
+-	};
++	struct netfs_inode netfs; /* Netfslib context and vfs inode */
+ 	struct ceph_vino i_vino;   /* ceph ino + snap */
+ 
+ 	spinlock_t i_ceph_lock;
+@@ -436,7 +432,7 @@ struct ceph_inode_info {
+ static inline struct ceph_inode_info *
+ ceph_inode(const struct inode *inode)
+ {
+-	return container_of(inode, struct ceph_inode_info, vfs_inode);
++	return container_of(inode, struct ceph_inode_info, netfs.inode);
+ }
+ 
+ static inline struct ceph_fs_client *
+@@ -1295,7 +1291,7 @@ static inline void __ceph_update_quota(struct ceph_inode_info *ci,
+ 	has_quota = __ceph_has_any_quota(ci);
+ 
+ 	if (had_quota != has_quota)
+-		ceph_adjust_quota_realms_count(&ci->vfs_inode, has_quota);
++		ceph_adjust_quota_realms_count(&ci->netfs.inode, has_quota);
+ }
+ 
+ extern void ceph_handle_quota(struct ceph_mds_client *mdsc,
+diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
+index 8c2dc2c762a4ecc688abfe515d6c990dab297a15..f141f5246163db69c3039ac45e2f0b76469c2a78 100644
+--- a/fs/ceph/xattr.c
++++ b/fs/ceph/xattr.c
+@@ -57,7 +57,7 @@ static bool ceph_vxattrcb_layout_exists(struct ceph_inode_info *ci)
+ static ssize_t ceph_vxattrcb_layout(struct ceph_inode_info *ci, char *val,
+ 				    size_t size)
+ {
+-	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->vfs_inode.i_sb);
++	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->netfs.inode.i_sb);
+ 	struct ceph_osd_client *osdc = &fsc->client->osdc;
+ 	struct ceph_string *pool_ns;
+ 	s64 pool = ci->i_layout.pool_id;
+@@ -69,7 +69,7 @@ static ssize_t ceph_vxattrcb_layout(struct ceph_inode_info *ci, char *val,
+ 
+ 	pool_ns = ceph_try_get_string(ci->i_layout.pool_ns);
+ 
+-	dout("ceph_vxattrcb_layout %p\n", &ci->vfs_inode);
++	dout("ceph_vxattrcb_layout %p\n", &ci->netfs.inode);
+ 	down_read(&osdc->lock);
+ 	pool_name = ceph_pg_pool_name_by_id(osdc->osdmap, pool);
+ 	if (pool_name) {
+@@ -161,7 +161,7 @@ static ssize_t ceph_vxattrcb_layout_pool(struct ceph_inode_info *ci,
+ 					 char *val, size_t size)
+ {
+ 	ssize_t ret;
+-	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->vfs_inode.i_sb);
++	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->netfs.inode.i_sb);
+ 	struct ceph_osd_client *osdc = &fsc->client->osdc;
+ 	s64 pool = ci->i_layout.pool_id;
+ 	const char *pool_name;
+@@ -313,7 +313,7 @@ static ssize_t ceph_vxattrcb_snap_btime(struct ceph_inode_info *ci, char *val,
+ static ssize_t ceph_vxattrcb_cluster_fsid(struct ceph_inode_info *ci,
+ 					  char *val, size_t size)
+ {
+-	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->vfs_inode.i_sb);
++	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->netfs.inode.i_sb);
+ 
+ 	return ceph_fmt_xattr(val, size, "%pU", &fsc->client->fsid);
+ }
+@@ -321,7 +321,7 @@ static ssize_t ceph_vxattrcb_cluster_fsid(struct ceph_inode_info *ci,
+ static ssize_t ceph_vxattrcb_client_id(struct ceph_inode_info *ci,
+ 				       char *val, size_t size)
+ {
+-	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->vfs_inode.i_sb);
++	struct ceph_fs_client *fsc = ceph_sb_to_client(ci->netfs.inode.i_sb);
+ 
+ 	return ceph_fmt_xattr(val, size, "client%lld",
+ 			      ceph_client_gid(fsc->client));
+@@ -629,7 +629,7 @@ static int __set_xattr(struct ceph_inode_info *ci,
+ 	}
+ 
+ 	dout("__set_xattr_val added %llx.%llx xattr %p %.*s=%.*s\n",
+-	     ceph_vinop(&ci->vfs_inode), xattr, name_len, name, val_len, val);
++	     ceph_vinop(&ci->netfs.inode), xattr, name_len, name, val_len, val);
+ 
+ 	return 0;
+ }
+@@ -871,7 +871,7 @@ struct ceph_buffer *__ceph_build_xattrs_blob(struct ceph_inode_info *ci)
+ 	struct ceph_buffer *old_blob = NULL;
+ 	void *dest;
+ 
+-	dout("__build_xattrs_blob %p\n", &ci->vfs_inode);
++	dout("__build_xattrs_blob %p\n", &ci->netfs.inode);
+ 	if (ci->i_xattrs.dirty) {
+ 		int need = __get_required_blob_size(ci, 0, 0);
+ 
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 9b4fd7686699628064b099b5ac2966aa2cd84b2c..26f0210d04bda3ff81a127726ff0062f74b2d08c 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -377,7 +377,7 @@ cifs_alloc_inode(struct super_block *sb)
+ 	cifs_inode->flags = 0;
+ 	spin_lock_init(&cifs_inode->writers_lock);
+ 	cifs_inode->writers = 0;
+-	cifs_inode->vfs_inode.i_blkbits = 14;  /* 2**14 = CIFS_MAX_MSGSIZE */
++	cifs_inode->netfs.inode.i_blkbits = 14;  /* 2**14 = CIFS_MAX_MSGSIZE */
+ 	cifs_inode->server_eof = 0;
+ 	cifs_inode->uniqueid = 0;
+ 	cifs_inode->createtime = 0;
+@@ -389,12 +389,12 @@ cifs_alloc_inode(struct super_block *sb)
+ 	 * Can not set i_flags here - they get immediately overwritten to zero
+ 	 * by the VFS.
+ 	 */
+-	/* cifs_inode->vfs_inode.i_flags = S_NOATIME | S_NOCMTIME; */
++	/* cifs_inode->netfs.inode.i_flags = S_NOATIME | S_NOCMTIME; */
+ 	INIT_LIST_HEAD(&cifs_inode->openFileList);
+ 	INIT_LIST_HEAD(&cifs_inode->llist);
+ 	INIT_LIST_HEAD(&cifs_inode->deferred_closes);
+ 	spin_lock_init(&cifs_inode->deferred_lock);
+-	return &cifs_inode->vfs_inode;
++	return &cifs_inode->netfs.inode;
+ }
+ 
+ static void
+@@ -1416,7 +1416,7 @@ cifs_init_once(void *inode)
+ {
+ 	struct cifsInodeInfo *cifsi = inode;
+ 
+-	inode_init_once(&cifsi->vfs_inode);
++	inode_init_once(&cifsi->netfs.inode);
+ 	init_rwsem(&cifsi->lock_sem);
+ }
+ 
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index a6cade2aebd98aa7239bc154cc4c1cbb991381ee..4247910682c465e4da3078c66a5b78ae392be917 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1414,20 +1414,16 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file);
+ #define CIFS_CACHE_RW_FLG	(CIFS_CACHE_READ_FLG | CIFS_CACHE_WRITE_FLG)
+ #define CIFS_CACHE_RHW_FLG	(CIFS_CACHE_RW_FLG | CIFS_CACHE_HANDLE_FLG)
+ 
+-#define CIFS_CACHE_READ(cinode) ((cinode->oplock & CIFS_CACHE_READ_FLG) || (CIFS_SB(cinode->vfs_inode.i_sb)->mnt_cifs_flags & CIFS_MOUNT_RO_CACHE))
++#define CIFS_CACHE_READ(cinode) ((cinode->oplock & CIFS_CACHE_READ_FLG) || (CIFS_SB(cinode->netfs.inode.i_sb)->mnt_cifs_flags & CIFS_MOUNT_RO_CACHE))
+ #define CIFS_CACHE_HANDLE(cinode) (cinode->oplock & CIFS_CACHE_HANDLE_FLG)
+-#define CIFS_CACHE_WRITE(cinode) ((cinode->oplock & CIFS_CACHE_WRITE_FLG) || (CIFS_SB(cinode->vfs_inode.i_sb)->mnt_cifs_flags & CIFS_MOUNT_RW_CACHE))
++#define CIFS_CACHE_WRITE(cinode) ((cinode->oplock & CIFS_CACHE_WRITE_FLG) || (CIFS_SB(cinode->netfs.inode.i_sb)->mnt_cifs_flags & CIFS_MOUNT_RW_CACHE))
+ 
+ /*
+  * One of these for each file inode
+  */
+ 
+ struct cifsInodeInfo {
+-	struct {
+-		/* These must be contiguous */
+-		struct inode	vfs_inode;	/* the VFS's inode record */
+-		struct netfs_i_context netfs_ctx; /* Netfslib context */
+-	};
++	struct netfs_inode netfs; /* Netfslib context and vfs inode */
+ 	bool can_cache_brlcks;
+ 	struct list_head llist;	/* locks helb by this inode */
+ 	/*
+@@ -1466,7 +1462,7 @@ struct cifsInodeInfo {
+ static inline struct cifsInodeInfo *
+ CIFS_I(struct inode *inode)
+ {
+-	return container_of(inode, struct cifsInodeInfo, vfs_inode);
++	return container_of(inode, struct cifsInodeInfo, netfs.inode);
+ }
+ 
+ static inline struct cifs_sb_info *
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index d511a78383c38ec7ce681fc74d2c4800f7b908ad..58dce567ceaf1c3768f556dcf5206a095317ff27 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -2004,7 +2004,7 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
+ 					bool fsuid_only)
+ {
+ 	struct cifsFileInfo *open_file = NULL;
+-	struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
++	struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode->netfs.inode.i_sb);
+ 
+ 	/* only filter by fsuid on multiuser mounts */
+ 	if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
+@@ -2060,7 +2060,7 @@ cifs_get_writable_file(struct cifsInodeInfo *cifs_inode, int flags,
+ 		return rc;
+ 	}
+ 
+-	cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
++	cifs_sb = CIFS_SB(cifs_inode->netfs.inode.i_sb);
+ 
+ 	/* only filter by fsuid on multiuser mounts */
+ 	if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
+@@ -4665,14 +4665,14 @@ bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file)
+ 		/* This inode is open for write at least once */
+ 		struct cifs_sb_info *cifs_sb;
+ 
+-		cifs_sb = CIFS_SB(cifsInode->vfs_inode.i_sb);
++		cifs_sb = CIFS_SB(cifsInode->netfs.inode.i_sb);
+ 		if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DIRECT_IO) {
+ 			/* since no page cache to corrupt on directio
+ 			we can change size safely */
+ 			return true;
+ 		}
+ 
+-		if (i_size_read(&cifsInode->vfs_inode) < end_of_file)
++		if (i_size_read(&cifsInode->netfs.inode) < end_of_file)
+ 			return true;
+ 
+ 		return false;
+diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c
+index a638b29e906201a3128eb91e3170a673ca649df8..23ef56f55ce509d149923ae218d1f6dabd8f1da1 100644
+--- a/fs/cifs/fscache.c
++++ b/fs/cifs/fscache.c
+@@ -101,13 +101,13 @@ void cifs_fscache_get_inode_cookie(struct inode *inode)
+ 	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+ 	struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+ 
+-	cifs_fscache_fill_coherency(&cifsi->vfs_inode, &cd);
++	cifs_fscache_fill_coherency(&cifsi->netfs.inode, &cd);
+ 
+-	cifsi->netfs_ctx.cache =
++	cifsi->netfs.cache =
+ 		fscache_acquire_cookie(tcon->fscache, 0,
+ 				       &cifsi->uniqueid, sizeof(cifsi->uniqueid),
+ 				       &cd, sizeof(cd),
+-				       i_size_read(&cifsi->vfs_inode));
++				       i_size_read(&cifsi->netfs.inode));
+ }
+ 
+ void cifs_fscache_unuse_inode_cookie(struct inode *inode, bool update)
+@@ -131,7 +131,7 @@ void cifs_fscache_release_inode_cookie(struct inode *inode)
+ 	if (cookie) {
+ 		cifs_dbg(FYI, "%s: (0x%p)\n", __func__, cookie);
+ 		fscache_relinquish_cookie(cookie, false);
+-		cifsi->netfs_ctx.cache = NULL;
++		cifsi->netfs.cache = NULL;
+ 	}
+ }
+ 
+diff --git a/fs/cifs/fscache.h b/fs/cifs/fscache.h
+index 52355c0912aee44bb55d9a259ee3f233b07da8a8..ab9a51d0125cd0884a1623b4da35d1f48d34c122 100644
+--- a/fs/cifs/fscache.h
++++ b/fs/cifs/fscache.h
+@@ -52,10 +52,10 @@ void cifs_fscache_fill_coherency(struct inode *inode,
+ 	struct cifsInodeInfo *cifsi = CIFS_I(inode);
+ 
+ 	memset(cd, 0, sizeof(*cd));
+-	cd->last_write_time_sec   = cpu_to_le64(cifsi->vfs_inode.i_mtime.tv_sec);
+-	cd->last_write_time_nsec  = cpu_to_le32(cifsi->vfs_inode.i_mtime.tv_nsec);
+-	cd->last_change_time_sec  = cpu_to_le64(cifsi->vfs_inode.i_ctime.tv_sec);
+-	cd->last_change_time_nsec = cpu_to_le32(cifsi->vfs_inode.i_ctime.tv_nsec);
++	cd->last_write_time_sec   = cpu_to_le64(cifsi->netfs.inode.i_mtime.tv_sec);
++	cd->last_write_time_nsec  = cpu_to_le32(cifsi->netfs.inode.i_mtime.tv_nsec);
++	cd->last_change_time_sec  = cpu_to_le64(cifsi->netfs.inode.i_ctime.tv_sec);
++	cd->last_change_time_nsec = cpu_to_le32(cifsi->netfs.inode.i_ctime.tv_nsec);
+ }
+ 
+ 
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 2f9e7d2f81b6f5bab7866b8ba0fb73d6f1ebfd51..81da81e185538a441be393734ffccbcdb1e1d333 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -115,7 +115,7 @@ cifs_revalidate_cache(struct inode *inode, struct cifs_fattr *fattr)
+ 		 __func__, cifs_i->uniqueid);
+ 	set_bit(CIFS_INO_INVALID_MAPPING, &cifs_i->flags);
+ 	/* Invalidate fscache cookie */
+-	cifs_fscache_fill_coherency(&cifs_i->vfs_inode, &cd);
++	cifs_fscache_fill_coherency(&cifs_i->netfs.inode, &cd);
+ 	fscache_invalidate(cifs_inode_cookie(inode), &cd, i_size_read(inode), 0);
+ }
+ 
+@@ -2499,7 +2499,7 @@ int cifs_fiemap(struct inode *inode, struct fiemap_extent_info *fei, u64 start,
+ 		u64 len)
+ {
+ 	struct cifsInodeInfo *cifs_i = CIFS_I(inode);
+-	struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_i->vfs_inode.i_sb);
++	struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_i->netfs.inode.i_sb);
+ 	struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+ 	struct TCP_Server_Info *server = tcon->ses->server;
+ 	struct cifsFileInfo *cfile;
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 4abf36b3b345025c33c7b3aafebfcca2e96b19d9..14e8dfc83c7e03cb9d5fb624adda662d654f3fbb 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -535,11 +535,11 @@ void cifs_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock)
+ 	if (oplock == OPLOCK_EXCLUSIVE) {
+ 		cinode->oplock = CIFS_CACHE_WRITE_FLG | CIFS_CACHE_READ_FLG;
+ 		cifs_dbg(FYI, "Exclusive Oplock granted on inode %p\n",
+-			 &cinode->vfs_inode);
++			 &cinode->netfs.inode);
+ 	} else if (oplock == OPLOCK_READ) {
+ 		cinode->oplock = CIFS_CACHE_READ_FLG;
+ 		cifs_dbg(FYI, "Level II Oplock granted on inode %p\n",
+-			 &cinode->vfs_inode);
++			 &cinode->netfs.inode);
+ 	} else
+ 		cinode->oplock = 0;
+ }
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 6e26edbffc486eec5be4d48328a1fb5e5d927cdb..19f957785a737a82cae8074a955b5fce3b8fbf8a 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -4241,15 +4241,15 @@ smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
+ 	if (oplock == SMB2_OPLOCK_LEVEL_BATCH) {
+ 		cinode->oplock = CIFS_CACHE_RHW_FLG;
+ 		cifs_dbg(FYI, "Batch Oplock granted on inode %p\n",
+-			 &cinode->vfs_inode);
++			 &cinode->netfs.inode);
+ 	} else if (oplock == SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
+ 		cinode->oplock = CIFS_CACHE_RW_FLG;
+ 		cifs_dbg(FYI, "Exclusive Oplock granted on inode %p\n",
+-			 &cinode->vfs_inode);
++			 &cinode->netfs.inode);
+ 	} else if (oplock == SMB2_OPLOCK_LEVEL_II) {
+ 		cinode->oplock = CIFS_CACHE_READ_FLG;
+ 		cifs_dbg(FYI, "Level II Oplock granted on inode %p\n",
+-			 &cinode->vfs_inode);
++			 &cinode->netfs.inode);
+ 	} else
+ 		cinode->oplock = 0;
+ }
+@@ -4288,7 +4288,7 @@ smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
+ 
+ 	cinode->oplock = new_oplock;
+ 	cifs_dbg(FYI, "%s Lease granted on inode %p\n", message,
+-		 &cinode->vfs_inode);
++		 &cinode->netfs.inode);
+ }
+ 
+ static void
+diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c
+index 281a88a5b8dcd4c27450cf4ef0dcf73a102d326b..e8e3359a4c5471bfd4e2bdd109d9ff7eb72a907e 100644
+--- a/fs/netfs/buffered_read.c
++++ b/fs/netfs/buffered_read.c
+@@ -155,7 +155,7 @@ static void netfs_rreq_expand(struct netfs_io_request *rreq,
+ void netfs_readahead(struct readahead_control *ractl)
+ {
+ 	struct netfs_io_request *rreq;
+-	struct netfs_i_context *ctx = netfs_i_context(ractl->mapping->host);
++	struct netfs_inode *ctx = netfs_inode(ractl->mapping->host);
+ 	int ret;
+ 
+ 	_enter("%lx,%x", readahead_index(ractl), readahead_count(ractl));
+@@ -216,7 +216,7 @@ int netfs_readpage(struct file *file, struct page *subpage)
+ 	struct folio *folio = page_folio(subpage);
+ 	struct address_space *mapping = folio_file_mapping(folio);
+ 	struct netfs_io_request *rreq;
+-	struct netfs_i_context *ctx = netfs_i_context(mapping->host);
++	struct netfs_inode *ctx = netfs_inode(mapping->host);
+ 	int ret;
+ 
+ 	_enter("%lx", folio_index(folio));
+@@ -333,7 +333,7 @@ int netfs_write_begin(struct file *file, struct address_space *mapping,
+ 		      struct folio **_folio, void **_fsdata)
+ {
+ 	struct netfs_io_request *rreq;
+-	struct netfs_i_context *ctx = netfs_i_context(file_inode(file ));
++	struct netfs_inode *ctx = netfs_inode(file_inode(file ));
+ 	struct folio *folio;
+ 	unsigned int fgp_flags;
+ 	pgoff_t index = pos >> PAGE_SHIFT;
+diff --git a/fs/netfs/internal.h b/fs/netfs/internal.h
+index b7b0e3d18d9e8583d9b2bceb6e9661e8768f3ac6..43fac1b14e40cd1351cbac875d1886b0a9256835 100644
+--- a/fs/netfs/internal.h
++++ b/fs/netfs/internal.h
+@@ -91,7 +91,7 @@ static inline void netfs_stat_d(atomic_t *stat)
+ /*
+  * Miscellaneous functions.
+  */
+-static inline bool netfs_is_cache_enabled(struct netfs_i_context *ctx)
++static inline bool netfs_is_cache_enabled(struct netfs_inode *ctx)
+ {
+ #if IS_ENABLED(CONFIG_FSCACHE)
+ 	struct fscache_cookie *cookie = ctx->cache;
+diff --git a/fs/netfs/objects.c b/fs/netfs/objects.c
+index e86107b30ba443ba783ac28eb66126ce61488e93..c6afa605b63b84d5a1628cb73dd562310caa20ab 100644
+--- a/fs/netfs/objects.c
++++ b/fs/netfs/objects.c
+@@ -18,7 +18,7 @@ struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,
+ {
+ 	static atomic_t debug_ids;
+ 	struct inode *inode = file ? file_inode(file) : mapping->host;
+-	struct netfs_i_context *ctx = netfs_i_context(inode);
++	struct netfs_inode *ctx = netfs_inode(inode);
+ 	struct netfs_io_request *rreq;
+ 	int ret;
+ 
+diff --git a/include/linux/netfs.h b/include/linux/netfs.h
+index c7bf1eaf51d5aaa71c60a52006de277b94177a1f..a9c6f73877ecbbdae7c275cfa022c5ce487982a3 100644
+--- a/include/linux/netfs.h
++++ b/include/linux/netfs.h
+@@ -119,9 +119,10 @@ typedef void (*netfs_io_terminated_t)(void *priv, ssize_t transferred_or_error,
+ 				      bool was_async);
+ 
+ /*
+- * Per-inode description.  This must be directly after the inode struct.
++ * Per-inode context.  This wraps the VFS inode.
+  */
+-struct netfs_i_context {
++struct netfs_inode {
++	struct inode		inode;		/* The VFS inode */
+ 	const struct netfs_request_ops *ops;
+ #if IS_ENABLED(CONFIG_FSCACHE)
+ 	struct fscache_cookie	*cache;
+@@ -255,7 +256,7 @@ struct netfs_cache_ops {
+ 	 * boundary as appropriate.
+ 	 */
+ 	enum netfs_io_source (*prepare_read)(struct netfs_io_subrequest *subreq,
+-					       loff_t i_size);
++					     loff_t i_size);
+ 
+ 	/* Prepare a write operation, working out what part of the write we can
+ 	 * actually do.
+@@ -287,45 +288,35 @@ extern void netfs_put_subrequest(struct netfs_io_subrequest *subreq,
+ extern void netfs_stats_show(struct seq_file *);
+ 
+ /**
+- * netfs_i_context - Get the netfs inode context from the inode
++ * netfs_inode - Get the netfs inode context from the inode
+  * @inode: The inode to query
+  *
+  * Get the netfs lib inode context from the network filesystem's inode.  The
+  * context struct is expected to directly follow on from the VFS inode struct.
+  */
+-static inline struct netfs_i_context *netfs_i_context(struct inode *inode)
++static inline struct netfs_inode *netfs_inode(struct inode *inode)
+ {
+-	return (struct netfs_i_context *)(inode + 1);
++	return container_of(inode, struct netfs_inode, inode);
+ }
+ 
+ /**
+- * netfs_inode - Get the netfs inode from the inode context
+- * @ctx: The context to query
+- *
+- * Get the netfs inode from the netfs library's inode context.  The VFS inode
+- * is expected to directly precede the context struct.
+- */
+-static inline struct inode *netfs_inode(struct netfs_i_context *ctx)
+-{
+-	return ((struct inode *)ctx) - 1;
+-}
+-
+-/**
+- * netfs_i_context_init - Initialise a netfs lib context
++ * netfs_inode_init - Initialise a netfslib inode context
+  * @inode: The inode with which the context is associated
+  * @ops: The netfs's operations list
+  *
+  * Initialise the netfs library context struct.  This is expected to follow on
+  * directly from the VFS inode struct.
+  */
+-static inline void netfs_i_context_init(struct inode *inode,
+-					const struct netfs_request_ops *ops)
++static inline void netfs_inode_init(struct inode *inode,
++				    const struct netfs_request_ops *ops)
+ {
+-	struct netfs_i_context *ctx = netfs_i_context(inode);
++	struct netfs_inode *ctx = netfs_inode(inode);
+ 
+-	memset(ctx, 0, sizeof(*ctx));
+ 	ctx->ops = ops;
+ 	ctx->remote_i_size = i_size_read(inode);
++#if IS_ENABLED(CONFIG_FSCACHE)
++	ctx->cache = NULL;
++#endif
+ }
+ 
+ /**
+@@ -337,7 +328,7 @@ static inline void netfs_i_context_init(struct inode *inode,
+  */
+ static inline void netfs_resize_file(struct inode *inode, loff_t new_i_size)
+ {
+-	struct netfs_i_context *ctx = netfs_i_context(inode);
++	struct netfs_inode *ctx = netfs_inode(inode);
+ 
+ 	ctx->remote_i_size = new_i_size;
+ }
+@@ -351,7 +342,7 @@ static inline void netfs_resize_file(struct inode *inode, loff_t new_i_size)
+ static inline struct fscache_cookie *netfs_i_cookie(struct inode *inode)
+ {
+ #if IS_ENABLED(CONFIG_FSCACHE)
+-	struct netfs_i_context *ctx = netfs_i_context(inode);
++	struct netfs_inode *ctx = netfs_inode(inode);
+ 	return ctx->cache;
+ #else
+ 	return NULL;
diff --git a/0135-drm-i915-uc-remove-accidental-static-from-a-local-va.patch b/0135-drm-i915-uc-remove-accidental-static-from-a-local-va.patch
new file mode 100644
index 000000000000..01192ba8d461
--- /dev/null
+++ b/0135-drm-i915-uc-remove-accidental-static-from-a-local-va.patch
@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Wed, 11 May 2022 12:46:19 +0300
+Subject: [PATCH] drm/i915/uc: remove accidental static from a local variable
+
+commit 2636e008112465ca54559ac4898da5a2515e118a upstream.
+
+The arrays are static const, but the pointer shouldn't be static.
+
+Fixes: 3d832f370d16 ("drm/i915/uc: Allow platforms to have GuC but not HuC")
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220511094619.27889-1-jani.nikula@intel.com
+(cherry picked from commit 5821a0bbb4c39960975d29d6b58ae290088db0ed)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
+index c881130444948ec37bfca7101c34a5efd756de56..9b6fbad4764652d9670d82daabee8a1274a1da16 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
+@@ -154,7 +154,7 @@ __uc_fw_auto_select(struct drm_i915_private *i915, struct intel_uc_fw *uc_fw)
+ 		[INTEL_UC_FW_TYPE_GUC] = { blobs_guc, ARRAY_SIZE(blobs_guc) },
+ 		[INTEL_UC_FW_TYPE_HUC] = { blobs_huc, ARRAY_SIZE(blobs_huc) },
+ 	};
+-	static const struct uc_fw_platform_requirement *fw_blobs;
++	const struct uc_fw_platform_requirement *fw_blobs;
+ 	enum intel_platform p = INTEL_INFO(i915)->platform;
+ 	u32 fw_count;
+ 	u8 rev = INTEL_REVID(i915);
diff --git a/0136-bpf-Use-safer-kvmalloc_array-where-possible.patch b/0136-bpf-Use-safer-kvmalloc_array-where-possible.patch
new file mode 100644
index 000000000000..c08d0bd1a99c
--- /dev/null
+++ b/0136-bpf-Use-safer-kvmalloc_array-where-possible.patch
@@ -0,0 +1,44 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 26 May 2022 13:24:05 +0300
+Subject: [PATCH] bpf: Use safer kvmalloc_array() where possible
+
+commit fd58f7df2415ef747782e01f94880fefad1247cf upstream.
+
+The kvmalloc_array() function is safer because it has a check for
+integer overflows.  These sizes come from the user and I was not
+able to see any bounds checking so an integer overflow seems like a
+realistic concern.
+
+Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/Yo9VRVMeHbALyjUH@kili
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/bpf_trace.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 6b58fc6813dfc3347d3462dab4c074a38b9a2688..41d0d9657fa196e3a038dc6dfe0a744f5ff9909e 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2433,7 +2433,7 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
+ 		return -EINVAL;
+ 
+ 	size = cnt * sizeof(*addrs);
+-	addrs = kvmalloc(size, GFP_KERNEL);
++	addrs = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);
+ 	if (!addrs)
+ 		return -ENOMEM;
+ 
+@@ -2450,7 +2450,7 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
+ 
+ 	ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies);
+ 	if (ucookies) {
+-		cookies = kvmalloc(size, GFP_KERNEL);
++		cookies = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);
+ 		if (!cookies) {
+ 			err = -ENOMEM;
+ 			goto error;
diff --git a/0137-powerpc-book3e-get-rid-of-include-generated-compile..patch b/0137-powerpc-book3e-get-rid-of-include-generated-compile..patch
new file mode 100644
index 000000000000..82eb90dff51a
--- /dev/null
+++ b/0137-powerpc-book3e-get-rid-of-include-generated-compile..patch
@@ -0,0 +1,68 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <masahiroy@kernel.org>
+Date: Sat, 4 Jun 2022 17:50:50 +0900
+Subject: [PATCH] powerpc/book3e: get rid of #include <generated/compile.h>
+
+commit 7ad4bd887d27c6b6ffbef216f19c19f8fe2b8f52 upstream.
+
+You cannot include <generated/compile.h> here because it is generated
+in init/Makefile but there is no guarantee that it happens before
+arch/powerpc/mm/nohash/kaslr_booke.c is compiled for parallel builds.
+
+The places where you can reliably include <generated/compile.h> are:
+
+  - init/          (because init/Makefile can specify the dependency)
+  - arch/*/boot/   (because it is compiled after vmlinux)
+
+Commit f231e4333312 ("hexagon: get rid of #include <generated/compile.h>")
+fixed the last breakage at that time, but powerpc re-added this.
+
+<generated/compile.h> was unneeded because 'build_str' is almost the
+same as 'linux_banner' defined in init/version.c
+
+Let's copy the solution from MIPS.
+(get_random_boot() in arch/mips/kernel/relocate.c)
+
+Fixes: 6a38ea1d7b94 ("powerpc/fsl_booke/32: randomize the kernel image offset")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Acked-by: Scott Wood <oss@buserror.net>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220604085050.4078927-1-masahiroy@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/nohash/kaslr_booke.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c b/arch/powerpc/mm/nohash/kaslr_booke.c
+index 96c38f971603fc5adbeb956629dc31f70760f310..5f81c076621f208ad717cdca5aea33a5f1851377 100644
+--- a/arch/powerpc/mm/nohash/kaslr_booke.c
++++ b/arch/powerpc/mm/nohash/kaslr_booke.c
+@@ -18,7 +18,6 @@
+ #include <asm/prom.h>
+ #include <asm/kdump.h>
+ #include <mm/mmu_decl.h>
+-#include <generated/compile.h>
+ #include <generated/utsrelease.h>
+ 
+ struct regions {
+@@ -36,10 +35,6 @@ struct regions {
+ 	int reserved_mem_size_cells;
+ };
+ 
+-/* Simplified build-specific string for starting entropy. */
+-static const char build_str[] = UTS_RELEASE " (" LINUX_COMPILE_BY "@"
+-		LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION;
+-
+ struct regions __initdata regions;
+ 
+ static __init void kaslr_get_cmdline(void *fdt)
+@@ -70,7 +65,8 @@ static unsigned long __init get_boot_seed(void *fdt)
+ {
+ 	unsigned long hash = 0;
+ 
+-	hash = rotate_xor(hash, build_str, sizeof(build_str));
++	/* build-specific string for starting entropy. */
++	hash = rotate_xor(hash, linux_banner, strlen(linux_banner));
+ 	hash = rotate_xor(hash, fdt, fdt_totalsize(fdt));
+ 
+ 	return hash;
diff --git a/0138-dt-bindings-mfd-bd9571mwv-update-rohm-bd9571mwv.yaml.patch b/0138-dt-bindings-mfd-bd9571mwv-update-rohm-bd9571mwv.yaml.patch
new file mode 100644
index 000000000000..7b75d6a73a42
--- /dev/null
+++ b/0138-dt-bindings-mfd-bd9571mwv-update-rohm-bd9571mwv.yaml.patch
@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@kernel.org>
+Date: Mon, 6 Jun 2022 16:25:23 +0100
+Subject: [PATCH] dt-bindings: mfd: bd9571mwv: update rohm,bd9571mwv.yaml
+ reference
+
+commit e0b5c5984d4810733b7c24a3d16c904fffc086d2 upstream.
+
+Changeset 983b62975e90 ("dt-bindings: mfd: bd9571mwv: Convert to json-schema")
+renamed: Documentation/devicetree/bindings/mfd/bd9571mwv.txt
+to: Documentation/devicetree/bindings/mfd/rohm,bd9571mwv.yaml.
+
+Update its cross-reference accordingly.
+
+Fixes: 983b62975e90 ("dt-bindings: mfd: bd9571mwv: Convert to json-schema")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/1906a4d935eab57c10ce09358eae02175ce4abb7.1654529011.git.mchehab@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator b/Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator
+index 42214b4ff14a1372dcbf9822c8c192725366ed56..90596d8bb51c0ad7c866f60fb9b6d5cf46093e0d 100644
+--- a/Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator
++++ b/Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator
+@@ -26,6 +26,6 @@ Description:	Read/write the current state of DDR Backup Mode, which controls
+ 		     DDR Backup Mode must be explicitly enabled by the user,
+ 		     to invoke step 1.
+ 
+-		See also Documentation/devicetree/bindings/mfd/bd9571mwv.txt.
++		See also Documentation/devicetree/bindings/mfd/rohm,bd9571mwv.yaml.
+ Users:		User space applications for embedded boards equipped with a
+ 		BD9571MWV PMIC.
diff --git a/0139-dt-bindings-interrupt-controller-update-brcm-l2-intc.patch b/0139-dt-bindings-interrupt-controller-update-brcm-l2-intc.patch
new file mode 100644
index 000000000000..f8ad58a7a2f5
--- /dev/null
+++ b/0139-dt-bindings-interrupt-controller-update-brcm-l2-intc.patch
@@ -0,0 +1,36 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@kernel.org>
+Date: Mon, 6 Jun 2022 16:25:24 +0100
+Subject: [PATCH] dt-bindings: interrupt-controller: update brcm,l2-intc.yaml
+ reference
+
+commit 7e40381d8a33e41e347cea5bdd000091653000c6 upstream.
+
+Changeset 539d25b21fe8 ("dt-bindings: interrupt-controller: Convert Broadcom STB L2 to YAML")
+renamed: Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.txt
+to: Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.yaml.
+
+Update its cross-reference accordingly.
+
+Fixes: 539d25b21fe8 ("dt-bindings: interrupt-controller: Convert Broadcom STB L2 to YAML")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/a40c02a7aaea91ea7b6ce24b6bc574ae5bcf4cf6.1654529011.git.mchehab@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .../devicetree/bindings/cpufreq/brcm,stb-avs-cpu-freq.txt       | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/cpufreq/brcm,stb-avs-cpu-freq.txt b/Documentation/devicetree/bindings/cpufreq/brcm,stb-avs-cpu-freq.txt
+index 73470ecd1f12f282755101bd0460359a815c2904..ce91a919769761c9e6f27dfc6f7019eada48d6df 100644
+--- a/Documentation/devicetree/bindings/cpufreq/brcm,stb-avs-cpu-freq.txt
++++ b/Documentation/devicetree/bindings/cpufreq/brcm,stb-avs-cpu-freq.txt
+@@ -16,7 +16,7 @@ has been processed. See [2] for more information on the brcm,l2-intc node.
+ firmware. On some SoCs, this firmware supports DFS and DVFS in addition to
+ Adaptive Voltage Scaling.
+ 
+-[2] Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.txt
++[2] Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.yaml
+ 
+ 
+ Node brcm,avs-cpu-data-mem
diff --git a/0140-dm-fix-bio_set-allocation.patch b/0140-dm-fix-bio_set-allocation.patch
new file mode 100644
index 000000000000..a3c7dbfedd06
--- /dev/null
+++ b/0140-dm-fix-bio_set-allocation.patch
@@ -0,0 +1,232 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 8 Jun 2022 08:34:06 +0200
+Subject: [PATCH] dm: fix bio_set allocation
+
+commit 29dec90a0f1d961b93f34f910e9319d8cb23edbd upstream.
+
+The use of bioset_init_from_src mean that the pre-allocated pools weren't
+used for anything except parameter passing, and the integrity pool
+creation got completely lost for the actual live mapped_device.  Fix that
+by assigning the actual preallocated dm_md_mempools to the mapped_device
+and using that for I/O instead of creating new mempools.
+
+Fixes: 2a2a4c510b76 ("dm: use bioset_init_from_src() to copy bio_set")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-core.h  | 11 ++++--
+ drivers/md/dm-rq.c    |  2 +-
+ drivers/md/dm-table.c | 11 ------
+ drivers/md/dm.c       | 83 +++++++++++++------------------------------
+ drivers/md/dm.h       |  2 --
+ 5 files changed, 34 insertions(+), 75 deletions(-)
+
+diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
+index 4277853c753515135c90391be507599cd827f573..3cd78f1e82a44fa9416927c5828254e10431b93a 100644
+--- a/drivers/md/dm-core.h
++++ b/drivers/md/dm-core.h
+@@ -32,6 +32,14 @@ struct dm_kobject_holder {
+  * access their members!
+  */
+ 
++/*
++ * For mempools pre-allocation at the table loading time.
++ */
++struct dm_md_mempools {
++	struct bio_set bs;
++	struct bio_set io_bs;
++};
++
+ struct mapped_device {
+ 	struct mutex suspend_lock;
+ 
+@@ -109,8 +117,7 @@ struct mapped_device {
+ 	/*
+ 	 * io objects are allocated from here.
+ 	 */
+-	struct bio_set io_bs;
+-	struct bio_set bs;
++	struct dm_md_mempools *mempools;
+ 
+ 	/* kobject and completion */
+ 	struct dm_kobject_holder kobj_holder;
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 6087cdcaad46df50cb786fdb1f23b41efdf030a6..a83b98a8d2a993e75debd263ebefa369075c4080 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -319,7 +319,7 @@ static int setup_clone(struct request *clone, struct request *rq,
+ {
+ 	int r;
+ 
+-	r = blk_rq_prep_clone(clone, rq, &tio->md->bs, gfp_mask,
++	r = blk_rq_prep_clone(clone, rq, &tio->md->mempools->bs, gfp_mask,
+ 			      dm_rq_bio_constructor, tio);
+ 	if (r)
+ 		return r;
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 03541cfc2317cb0e17780fa8970ab8959d47b171..4b5cf337269950b5332cc1bd7c02f393d098e880 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1030,17 +1030,6 @@ static int dm_table_alloc_md_mempools(struct dm_table *t, struct mapped_device *
+ 	return 0;
+ }
+ 
+-void dm_table_free_md_mempools(struct dm_table *t)
+-{
+-	dm_free_md_mempools(t->mempools);
+-	t->mempools = NULL;
+-}
+-
+-struct dm_md_mempools *dm_table_get_md_mempools(struct dm_table *t)
+-{
+-	return t->mempools;
+-}
+-
+ static int setup_indexes(struct dm_table *t)
+ {
+ 	int i;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index a68316f96350d0af64c1db865c48d1e97fbf95ca..83dd17abf1af95844d85fd405acc0e360890ef43 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -131,14 +131,6 @@ static int get_swap_bios(void)
+ 	return latch;
+ }
+ 
+-/*
+- * For mempools pre-allocation at the table loading time.
+- */
+-struct dm_md_mempools {
+-	struct bio_set bs;
+-	struct bio_set io_bs;
+-};
+-
+ struct table_device {
+ 	struct list_head list;
+ 	refcount_t count;
+@@ -573,7 +565,7 @@ static struct dm_io *alloc_io(struct mapped_device *md, struct bio *bio)
+ 	struct dm_target_io *tio;
+ 	struct bio *clone;
+ 
+-	clone = bio_alloc_clone(bio->bi_bdev, bio, GFP_NOIO, &md->io_bs);
++	clone = bio_alloc_clone(bio->bi_bdev, bio, GFP_NOIO, &md->mempools->io_bs);
+ 
+ 	tio = clone_to_tio(clone);
+ 	tio->flags = 0;
+@@ -615,7 +607,7 @@ static struct bio *alloc_tio(struct clone_info *ci, struct dm_target *ti,
+ 		clone = &tio->clone;
+ 	} else {
+ 		clone = bio_alloc_clone(ci->bio->bi_bdev, ci->bio,
+-					gfp_mask, &ci->io->md->bs);
++					gfp_mask, &ci->io->md->mempools->bs);
+ 		if (!clone)
+ 			return NULL;
+ 
+@@ -1775,8 +1767,7 @@ static void cleanup_mapped_device(struct mapped_device *md)
+ {
+ 	if (md->wq)
+ 		destroy_workqueue(md->wq);
+-	bioset_exit(&md->bs);
+-	bioset_exit(&md->io_bs);
++	dm_free_md_mempools(md->mempools);
+ 
+ 	if (md->dax_dev) {
+ 		dax_remove_host(md->disk);
+@@ -1948,48 +1939,6 @@ static void free_dev(struct mapped_device *md)
+ 	kvfree(md);
+ }
+ 
+-static int __bind_mempools(struct mapped_device *md, struct dm_table *t)
+-{
+-	struct dm_md_mempools *p = dm_table_get_md_mempools(t);
+-	int ret = 0;
+-
+-	if (dm_table_bio_based(t)) {
+-		/*
+-		 * The md may already have mempools that need changing.
+-		 * If so, reload bioset because front_pad may have changed
+-		 * because a different table was loaded.
+-		 */
+-		bioset_exit(&md->bs);
+-		bioset_exit(&md->io_bs);
+-
+-	} else if (bioset_initialized(&md->bs)) {
+-		/*
+-		 * There's no need to reload with request-based dm
+-		 * because the size of front_pad doesn't change.
+-		 * Note for future: If you are to reload bioset,
+-		 * prep-ed requests in the queue may refer
+-		 * to bio from the old bioset, so you must walk
+-		 * through the queue to unprep.
+-		 */
+-		goto out;
+-	}
+-
+-	BUG_ON(!p ||
+-	       bioset_initialized(&md->bs) ||
+-	       bioset_initialized(&md->io_bs));
+-
+-	ret = bioset_init_from_src(&md->bs, &p->bs);
+-	if (ret)
+-		goto out;
+-	ret = bioset_init_from_src(&md->io_bs, &p->io_bs);
+-	if (ret)
+-		bioset_exit(&md->bs);
+-out:
+-	/* mempool bind completed, no longer need any mempools in the table */
+-	dm_table_free_md_mempools(t);
+-	return ret;
+-}
+-
+ /*
+  * Bind a table to the device.
+  */
+@@ -2043,12 +1992,28 @@ static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t,
+ 		 * immutable singletons - used to optimize dm_mq_queue_rq.
+ 		 */
+ 		md->immutable_target = dm_table_get_immutable_target(t);
+-	}
+ 
+-	ret = __bind_mempools(md, t);
+-	if (ret) {
+-		old_map = ERR_PTR(ret);
+-		goto out;
++		/*
++		 * There is no need to reload with request-based dm because the
++		 * size of front_pad doesn't change.
++		 *
++		 * Note for future: If you are to reload bioset, prep-ed
++		 * requests in the queue may refer to bio from the old bioset,
++		 * so you must walk through the queue to unprep.
++		 */
++		if (!md->mempools) {
++			md->mempools = t->mempools;
++			t->mempools = NULL;
++		}
++	} else {
++		/*
++		 * The md may already have mempools that need changing.
++		 * If so, reload bioset because front_pad may have changed
++		 * because a different table was loaded.
++		 */
++		dm_free_md_mempools(md->mempools);
++		md->mempools = t->mempools;
++		t->mempools = NULL;
+ 	}
+ 
+ 	ret = dm_table_set_restrictions(t, md->queue, limits);
+diff --git a/drivers/md/dm.h b/drivers/md/dm.h
+index 9013dc1a7b0028cc98c2e99742ec5be487a753ba..968199b95fd1e216e33fbc2de208da0c9667544a 100644
+--- a/drivers/md/dm.h
++++ b/drivers/md/dm.h
+@@ -71,8 +71,6 @@ struct dm_target *dm_table_get_immutable_target(struct dm_table *t);
+ struct dm_target *dm_table_get_wildcard_target(struct dm_table *t);
+ bool dm_table_bio_based(struct dm_table *t);
+ bool dm_table_request_based(struct dm_table *t);
+-void dm_table_free_md_mempools(struct dm_table *t);
+-struct dm_md_mempools *dm_table_get_md_mempools(struct dm_table *t);
+ 
+ void dm_lock_md_type(struct mapped_device *md);
+ void dm_unlock_md_type(struct mapped_device *md);
diff --git a/0141-clk-imx8mp-fix-usb_root_clk-parent.patch b/0141-clk-imx8mp-fix-usb_root_clk-parent.patch
new file mode 100644
index 000000000000..227f87fb70df
--- /dev/null
+++ b/0141-clk-imx8mp-fix-usb_root_clk-parent.patch
@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Sat, 7 May 2022 20:54:30 +0800
+Subject: [PATCH] clk: imx8mp: fix usb_root_clk parent
+
+commit cf7f3f4fa9e57b8e9f594823e77e6cbb0ce2b254 upstream.
+
+According to reference mannual CCGR77(usb) sources from hsio_axi, fix
+it.
+
+Fixes: 9c140d9926761 ("clk: imx: Add support for i.MX8MP clock driver")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@nxp.com>
+Link: https://lore.kernel.org/r/20220507125430.793287-1-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/imx/clk-imx8mp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
+index 18f5b7c3ca9d878f35f9390de38396165618c977..74dabcdf81aba5937a26d35e979df698d2d27739 100644
+--- a/drivers/clk/imx/clk-imx8mp.c
++++ b/drivers/clk/imx/clk-imx8mp.c
+@@ -659,7 +659,7 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
+ 	hws[IMX8MP_CLK_UART2_ROOT] = imx_clk_hw_gate4("uart2_root_clk", "uart2", ccm_base + 0x44a0, 0);
+ 	hws[IMX8MP_CLK_UART3_ROOT] = imx_clk_hw_gate4("uart3_root_clk", "uart3", ccm_base + 0x44b0, 0);
+ 	hws[IMX8MP_CLK_UART4_ROOT] = imx_clk_hw_gate4("uart4_root_clk", "uart4", ccm_base + 0x44c0, 0);
+-	hws[IMX8MP_CLK_USB_ROOT] = imx_clk_hw_gate4("usb_root_clk", "osc_32k", ccm_base + 0x44d0, 0);
++	hws[IMX8MP_CLK_USB_ROOT] = imx_clk_hw_gate4("usb_root_clk", "hsio_axi", ccm_base + 0x44d0, 0);
+ 	hws[IMX8MP_CLK_USB_PHY_ROOT] = imx_clk_hw_gate4("usb_phy_root_clk", "usb_phy_ref", ccm_base + 0x44f0, 0);
+ 	hws[IMX8MP_CLK_USDHC1_ROOT] = imx_clk_hw_gate4("usdhc1_root_clk", "usdhc1", ccm_base + 0x4510, 0);
+ 	hws[IMX8MP_CLK_USDHC2_ROOT] = imx_clk_hw_gate4("usdhc2_root_clk", "usdhc2", ccm_base + 0x4520, 0);
diff --git a/PKGBUILD b/PKGBUILD
index 1060fd80ac7d..813442d27ce8 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -62,21 +62,21 @@ _minor=18
 _basekernel=${_major}.${_minor}
 _srcname=linux-${_basekernel}
 pkgbase=linux-pf
-_unpatched_sublevel=0
-_pfrel=1
+_unpatched_sublevel=6
+_pfrel=2
 _kernelname=pf
 _pfpatchhome="https://github.com/pfactum/pf-kernel/compare"
 _pfpatchname="v$_major.$_minor...v$_major.$_minor-pf$_pfrel.diff"
 _projectcpatchname=prjc_v5.15-r1.patch
 _CPUSUFFIXES_KBUILD=(
   # AMD
-  MK8 MK8SSE3 MK10 MBARCELONA MBOBCAT MBULLDOZER MPILEDRIVER MSTEAMROLLER MEXCAVATOR MZEN
-  MZEN2 MZEN3
+  K8 K8SSE3 K10 BARCELONA BOBCAT BULLDOZER PILEDRIVER STEAROLLER EXCAVATOR ZEN
+  ZEN2 ZEN3
   # Intel
-  MCORE2 MPSC
-  MATOM MPENTIUMII MPENTIUMIII MPENTIUMM MPENTIUM4 MNEHALEM MSANDYBRIDGE
-  MIVYBRIDGE MHASWELL MBROADWELL MSILVERMONT MSKYLAKE MSKYLAKEX MCANNONLAKE MICELAKE
-  MCASCADELAKE MCOOPERLAKE MTIGERLAKE MSAPPHIRERAPIDS MROCKETLAKE MALDERLAKE
+  CORE2 PSC
+  ATOM PENTIUII PENTIUIII PENTIUM PENTIUM4 NEHALEM SANDYBRIDGE
+  IVYBRIDGE HASWELL BROADWELL SILVERMONT SKYLAKE SKYLAKEX CANNONLAKE ICELAKE
+  CASCADELAKE COOPERLAKE TIGERLAKE SAPPHIRERAPIDS ROCKETLAKE ALDERLAKE
   # Generic
   GENERIC_CPU2 GENERIC_CPU3 GENERIC_CPU4)
 pkgname=('linux-pf')
@@ -127,6 +127,152 @@ source=("https://www.kernel.org/pub/linux/kernel/v${_major}.x/linux-${_basekerne
         0029-ZEN-HID-lenovo-Add-support-for-ThinkPad-TrackPoint-K.patch
         0030-ZEN-dm-crypt-Disable-workqueues-for-crypto-operation.patch
         # ZEN END
+        # MGLRU
+        0015-ZEN-Tune-mgLRU-to-protect-cache-used-in-the-last-sec.patch
+        # MGLRU END
+        # 5.18.6
+        0001-Revert-drm-amd-display-Fix-DCN3-B0-DP-Alt-Mapping.patch
+        0002-arm64-dts-imx8mm-beacon-Enable-RTS-CTS-on-UART3.patch
+        0003-arm64-dts-imx8mn-beacon-Enable-RTS-CTS-on-UART3.patch
+        0004-io_uring-reinstate-the-inflight-tracking.patch
+        0005-powerpc-kasan-Silence-KASAN-warnings-in-__get_wchan.patch
+        0006-ASoC-nau8822-Add-operation-for-internal-PLL-off-and-.patch
+        0007-ASoC-qcom-lpass-platform-Update-VMA-access-permissio.patch
+        0008-drm-amd-display-Read-Golden-Settings-Table-from-VBIO.patch
+        0009-drm-amdgpu-Resolve-RAS-GFX-error-count-issue-after-c.patch
+        0010-drm-amdkfd-Use-mmget_not_zero-in-MMU-notifier.patch
+        0011-dma-debug-make-things-less-spammy-under-memory-press.patch
+        0012-ASoC-Intel-cirrus-common-fix-incorrect-channel-mappi.patch
+        0013-ASoC-cs42l52-Fix-TLV-scales-for-mixer-controls.patch
+        0014-ASoC-cs35l36-Update-digital-volume-TLV.patch
+        0015-ASoC-cs53l30-Correct-number-of-volume-levels-on-SX-c.patch
+        0016-ASoC-cs42l52-Correct-TLV-for-Bypass-Volume.patch
+        0017-ASoC-cs42l56-Correct-typo-in-minimum-level-for-SX-vo.patch
+        0018-ASoC-cs42l51-Correct-minimum-value-for-SX-volume-con.patch
+        0019-drm-amdkfd-add-pinned-BOs-to-kfd_bo_list.patch
+        0020-ata-libata-core-fix-NULL-pointer-deref-in-ata_host_a.patch
+        0021-quota-Prevent-memory-allocation-recursion-while-hold.patch
+        0022-ASoC-wm8962-Fix-suspend-while-playing-music.patch
+        0023-ASoC-es8328-Fix-event-generation-for-deemphasis-cont.patch
+        0024-ASoC-wm_adsp-Fix-event-generation-for-wm_adsp_fw_put.patch
+        0025-ALSA-hda-MTL-add-HD-Audio-PCI-ID-and-HDMI-codec-vend.patch
+        0026-Input-soc_button_array-also-add-Lenovo-Yoga-Tablet2-.patch
+        0027-scsi-vmw_pvscsi-Expand-vcpuHint-to-16-bits.patch
+        0028-scsi-lpfc-Resolve-NULL-ptr-dereference-after-an-ELS-.patch
+        0029-scsi-lpfc-Fix-port-stuck-in-bypassed-state-after-LIP.patch
+        0030-scsi-lpfc-Allow-reduced-polling-rate-for-nvme_admin_.patch
+        0031-scsi-mpt3sas-Fix-out-of-bounds-compiler-warning.patch
+        0032-scsi-ipr-Fix-missing-incorrect-resource-cleanup-in-e.patch
+        0033-scsi-pmcraid-Fix-missing-resource-cleanup-in-error-c.patch
+        0034-ALSA-hda-realtek-Add-HW8326-support.patch
+        0035-virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch
+        0036-nfc-nfcmrvl-Fix-memory-leak-in-nfcmrvl_play_deferred.patch
+        0037-ipv6-Fix-signed-integer-overflow-in-__ip6_append_dat.patch
+        0038-ipv6-Fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch
+        0039-net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch
+        0040-gcc-12-disable-Wdangling-pointer-warning-for-now.patch
+        0041-mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch
+        0042-gcc-12-disable-Warray-bounds-universally-for-now.patch
+        0043-netfs-gcc-12-temporarily-disable-Wattribute-warning-.patch
+        0044-MIPS-Loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch
+        0045-random-credit-cpu-and-bootloader-seeds-by-default.patch
+        0046-gpio-dwapb-Don-t-print-error-on-EPROBE_DEFER.patch
+        0047-platform-x86-intel-Fix-pmt_crashlog-array-reference.patch
+        0048-platform-x86-intel-pmc-Support-Intel-Raptorlake-P.patch
+        0049-platform-x86-gigabyte-wmi-Add-Z690M-AORUS-ELITE-AX-D.patch
+        0050-platform-x86-gigabyte-wmi-Add-support-for-B450M-DS3H.patch
+        0051-platform-x86-intel-hid-Add-Surface-Go-to-VGBS-allow-.patch
+        0052-staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch
+        0053-staging-r8188eu-Fix-warning-of-array-overflow-in-ioc.patch
+        0054-pNFS-Don-t-keep-retrying-if-the-server-replied-NFS4E.patch
+        0055-pNFS-Avoid-a-live-lock-condition-in-pnfs_update_layo.patch
+        0056-sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch
+        0057-clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch
+        0058-i40e-Fix-adding-ADQ-filter-to-TC0.patch
+        0059-i40e-Fix-calculating-the-number-of-queue-pairs.patch
+        0060-i40e-Fix-call-trace-in-setup_tx_descriptors.patch
+        0061-iavf-Fix-issue-with-MAC-address-of-VF-shown-as-zero.patch
+        0062-Drivers-hv-vmbus-Release-cpu-lock-in-error-case.patch
+        0063-tty-goldfish-Fix-free_irq-on-remove.patch
+        0064-misc-atmel-ssc-Fix-IRQ-check-in-ssc_probe.patch
+        0065-riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch
+        0066-io_uring-fix-races-with-file-table-unregister.patch
+        0067-io_uring-fix-races-with-buffer-table-unregister.patch
+        0068-drm-i915-reset-Fix-error_state_read-ptr-offset-use.patch
+        0069-net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch
+        0070-net-hns3-don-t-push-link-state-to-VF-if-unalive.patch
+        0071-net-hns3-restore-tm-priority-qset-to-default-setting.patch
+        0072-net-hns3-fix-PF-rss-size-initialization-bug.patch
+        0073-net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch
+        0074-nvme-add-device-name-to-warning-in-uuid_show.patch
+        0075-mlxsw-spectrum_cnt-Reorder-counter-pools.patch
+        0076-ice-Fix-PTP-TX-timestamp-offset-calculation.patch
+        0077-ice-Sync-VLAN-filtering-features-for-DVM.patch
+        0078-ice-Fix-queue-config-fail-handling.patch
+        0079-ice-Fix-memory-corruption-in-VF-driver.patch
+        0080-net-bgmac-Fix-an-erroneous-kfree-in-bgmac_remove.patch
+        0081-net-remove-noblock-parameter-from-skb_recv_datagram.patch
+        0082-net-ax25-Fix-deadlock-caused-by-skb_recv_datagram-in.patch
+        0083-arm64-ftrace-fix-branch-range-checks.patch
+        0084-arm64-ftrace-consistently-handle-PLTs.patch
+        0085-certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch
+        0086-init-Initialize-noop_backing_dev_info-early.patch
+        0087-block-Fix-handling-of-offline-queues-in-blk_mq_alloc.patch
+        0088-faddr2line-Fix-overlapping-text-section-failures-the.patch
+        0089-x86-ftrace-Remove-OBJECT_FILES_NON_STANDARD-usage.patch
+        0090-i2c-npcm7xx-Add-check-for-platform_driver_register.patch
+        0091-irqchip-gic-realview-Fix-refcount-leak-in-realview_g.patch
+        0092-irqchip-apple-aic-Fix-refcount-leak-in-build_fiq_aff.patch
+        0093-irqchip-apple-aic-Fix-refcount-leak-in-aic_of_ic_ini.patch
+        0094-irqchip-gic-v3-Fix-error-handling-in-gic_populate_pp.patch
+        0095-irqchip-gic-v3-Fix-refcount-leak-in-gic_populate_ppi.patch
+        0096-irqchip-realtek-rtl-Fix-refcount-leak-in-map_interru.patch
+        0097-sched-Fix-balance_push-vs-__sched_setscheduler.patch
+        0098-i2c-designware-Use-standard-optional-ref-clock-imple.patch
+        0099-i2c-mediatek-Fix-an-error-handling-path-in-mtk_i2c_p.patch
+        0100-mei-hbm-drop-capability-response-on-early-shutdown.patch
+        0101-mei-me-add-raptor-lake-point-S-DID.patch
+        0102-comedi-vmk80xx-fix-expression-for-tx-buffer-size.patch
+        0103-crypto-memneq-move-into-lib.patch
+        0104-USB-serial-option-add-support-for-Cinterion-MV31-wit.patch
+        0105-USB-serial-io_ti-add-Agilent-E5805A-support.patch
+        0106-arm64-mm-Don-t-invalidate-FROM_DEVICE-buffers-at-sta.patch
+        0107-usb-dwc2-Fix-memory-leak-in-dwc2_hcd_init.patch
+        0108-usb-cdnsp-Fixed-setting-last_trb-incorrectly.patch
+        0109-usb-dwc3-gadget-Fix-IN-endpoint-max-packet-size-allo.patch
+        0110-usb-dwc3-pci-Restore-line-lost-in-merge-conflict-res.patch
+        0111-usb-gadget-u_ether-fix-regression-in-setting-fixed-M.patch
+        0112-usb-gadget-lpc32xx_udc-Fix-refcount-leak-in-lpc32xx_.patch
+        0113-usb-gadget-f_fs-change-ep-status-safe-in-ffs_epfile_.patch
+        0114-usb-gadget-f_fs-change-ep-ep-safe-in-ffs_epfile_io.patch
+        0115-tty-n_gsm-Debug-output-allocation-must-use-GFP_ATOMI.patch
+        0116-serial-8250-Store-to-lsr_save_flags-after-lsr-read.patch
+        0117-bus-fsl-mc-bus-fix-KASAN-use-after-free-in-fsl_mc_bu.patch
+        0118-md-raid5-ppl-Fix-argument-order-in-bio_alloc_bioset.patch
+        0119-dm-fix-race-in-dm_start_io_acct.patch
+        0120-dm-mirror-log-round-up-region-bitmap-size-to-BITS_PE.patch
+        0121-drm-amdgpu-Fix-GTT-size-reporting-in-amdgpu_ioctl.patch
+        0122-drm-amd-display-Cap-OLED-brightness-per-max-frame-av.patch
+        0123-audit-free-module-name.patch
+        0124-cfi-Fix-__cfi_slowpath_diag-RCU-usage-with-cpuidle.patch
+        0125-fs-account-for-group-membership.patch
+        0126-selinux-free-contexts-previously-transferred-in-seli.patch
+        0127-ext4-fix-super-block-checksum-incorrect-after-mount.patch
+        0128-ext4-fix-bug_on-ext4_mb_use_inode_pa.patch
+        0129-ext4-make-variable-count-signed.patch
+        0130-ext4-add-reserved-GDT-blocks-check.patch
+        0131-KVM-arm64-Always-start-with-clearing-SVE-flag-on-loa.patch
+        0132-KVM-arm64-Don-t-read-a-HW-interrupt-pending-state-in.patch
+        0133-virtio-pci-Remove-wrong-address-verification-in-vp_d.patch
+        0134-netfs-Fix-gcc-12-warning-by-embedding-vfs-inode-in-n.patch
+        0135-drm-i915-uc-remove-accidental-static-from-a-local-va.patch
+        0136-bpf-Use-safer-kvmalloc_array-where-possible.patch
+        0137-powerpc-book3e-get-rid-of-include-generated-compile..patch
+        0138-dt-bindings-mfd-bd9571mwv-update-rohm-bd9571mwv.yaml.patch
+        0139-dt-bindings-interrupt-controller-update-brcm-l2-intc.patch
+        0140-dm-fix-bio_set-allocation.patch
+        0141-clk-imx8mp-fix-usb_root_clk-parent.patch
+        # 5.18.6 END
         # https://bugzilla.kernel.org/show_bug.cgi?id=211005
         'asus_zenith_ii_map.patch::https://bugzilla.kernel.org/attachment.cgi?id=294489'
        )
@@ -172,6 +318,153 @@ prepare() {
   patch -p1 -i ${srcdir}/0029-ZEN-HID-lenovo-Add-support-for-ThinkPad-TrackPoint-K.patch
   patch -p1 -i ${srcdir}/0030-ZEN-dm-crypt-Disable-workqueues-for-crypto-operation.patch
 
+  # MLGRU
+  patch -p1 -i ${srcdir}/0015-ZEN-Tune-mgLRU-to-protect-cache-used-in-the-last-sec.patch
+
+  # 5.18.6
+  patch -p1 -i ${srcdir}/0001-Revert-drm-amd-display-Fix-DCN3-B0-DP-Alt-Mapping.patch
+  patch -p1 -i ${srcdir}/0002-arm64-dts-imx8mm-beacon-Enable-RTS-CTS-on-UART3.patch
+  patch -p1 -i ${srcdir}/0003-arm64-dts-imx8mn-beacon-Enable-RTS-CTS-on-UART3.patch
+  patch -p1 -i ${srcdir}/0004-io_uring-reinstate-the-inflight-tracking.patch
+  patch -p1 -i ${srcdir}/0005-powerpc-kasan-Silence-KASAN-warnings-in-__get_wchan.patch
+  patch -p1 -i ${srcdir}/0006-ASoC-nau8822-Add-operation-for-internal-PLL-off-and-.patch
+  patch -p1 -i ${srcdir}/0007-ASoC-qcom-lpass-platform-Update-VMA-access-permissio.patch
+  patch -p1 -i ${srcdir}/0008-drm-amd-display-Read-Golden-Settings-Table-from-VBIO.patch
+  patch -p1 -i ${srcdir}/0009-drm-amdgpu-Resolve-RAS-GFX-error-count-issue-after-c.patch
+  patch -p1 -i ${srcdir}/0010-drm-amdkfd-Use-mmget_not_zero-in-MMU-notifier.patch
+  patch -p1 -i ${srcdir}/0011-dma-debug-make-things-less-spammy-under-memory-press.patch
+  patch -p1 -i ${srcdir}/0012-ASoC-Intel-cirrus-common-fix-incorrect-channel-mappi.patch
+  patch -p1 -i ${srcdir}/0013-ASoC-cs42l52-Fix-TLV-scales-for-mixer-controls.patch
+  patch -p1 -i ${srcdir}/0014-ASoC-cs35l36-Update-digital-volume-TLV.patch
+  patch -p1 -i ${srcdir}/0015-ASoC-cs53l30-Correct-number-of-volume-levels-on-SX-c.patch
+  patch -p1 -i ${srcdir}/0016-ASoC-cs42l52-Correct-TLV-for-Bypass-Volume.patch
+  patch -p1 -i ${srcdir}/0017-ASoC-cs42l56-Correct-typo-in-minimum-level-for-SX-vo.patch
+  patch -p1 -i ${srcdir}/0018-ASoC-cs42l51-Correct-minimum-value-for-SX-volume-con.patch
+  patch -p1 -i ${srcdir}/0019-drm-amdkfd-add-pinned-BOs-to-kfd_bo_list.patch
+  patch -p1 -i ${srcdir}/0020-ata-libata-core-fix-NULL-pointer-deref-in-ata_host_a.patch
+  patch -p1 -i ${srcdir}/0021-quota-Prevent-memory-allocation-recursion-while-hold.patch
+  patch -p1 -i ${srcdir}/0022-ASoC-wm8962-Fix-suspend-while-playing-music.patch
+  patch -p1 -i ${srcdir}/0023-ASoC-es8328-Fix-event-generation-for-deemphasis-cont.patch
+  patch -p1 -i ${srcdir}/0024-ASoC-wm_adsp-Fix-event-generation-for-wm_adsp_fw_put.patch
+  patch -p1 -i ${srcdir}/0025-ALSA-hda-MTL-add-HD-Audio-PCI-ID-and-HDMI-codec-vend.patch
+  patch -p1 -i ${srcdir}/0026-Input-soc_button_array-also-add-Lenovo-Yoga-Tablet2-.patch
+  patch -p1 -i ${srcdir}/0027-scsi-vmw_pvscsi-Expand-vcpuHint-to-16-bits.patch
+  patch -p1 -i ${srcdir}/0028-scsi-lpfc-Resolve-NULL-ptr-dereference-after-an-ELS-.patch
+  patch -p1 -i ${srcdir}/0029-scsi-lpfc-Fix-port-stuck-in-bypassed-state-after-LIP.patch
+  patch -p1 -i ${srcdir}/0030-scsi-lpfc-Allow-reduced-polling-rate-for-nvme_admin_.patch
+  patch -p1 -i ${srcdir}/0031-scsi-mpt3sas-Fix-out-of-bounds-compiler-warning.patch
+  patch -p1 -i ${srcdir}/0032-scsi-ipr-Fix-missing-incorrect-resource-cleanup-in-e.patch
+  patch -p1 -i ${srcdir}/0033-scsi-pmcraid-Fix-missing-resource-cleanup-in-error-c.patch
+  patch -p1 -i ${srcdir}/0034-ALSA-hda-realtek-Add-HW8326-support.patch
+  patch -p1 -i ${srcdir}/0035-virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch
+  patch -p1 -i ${srcdir}/0036-nfc-nfcmrvl-Fix-memory-leak-in-nfcmrvl_play_deferred.patch
+  patch -p1 -i ${srcdir}/0037-ipv6-Fix-signed-integer-overflow-in-__ip6_append_dat.patch
+  patch -p1 -i ${srcdir}/0038-ipv6-Fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch
+  patch -p1 -i ${srcdir}/0039-net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch
+  patch -p1 -i ${srcdir}/0040-gcc-12-disable-Wdangling-pointer-warning-for-now.patch
+  patch -p1 -i ${srcdir}/0041-mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch
+  patch -p1 -i ${srcdir}/0042-gcc-12-disable-Warray-bounds-universally-for-now.patch
+  patch -p1 -i ${srcdir}/0043-netfs-gcc-12-temporarily-disable-Wattribute-warning-.patch
+  patch -p1 -i ${srcdir}/0044-MIPS-Loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch
+  patch -p1 -i ${srcdir}/0045-random-credit-cpu-and-bootloader-seeds-by-default.patch
+  patch -p1 -i ${srcdir}/0046-gpio-dwapb-Don-t-print-error-on-EPROBE_DEFER.patch
+  patch -p1 -i ${srcdir}/0047-platform-x86-intel-Fix-pmt_crashlog-array-reference.patch
+  patch -p1 -i ${srcdir}/0048-platform-x86-intel-pmc-Support-Intel-Raptorlake-P.patch
+  patch -p1 -i ${srcdir}/0049-platform-x86-gigabyte-wmi-Add-Z690M-AORUS-ELITE-AX-D.patch
+  patch -p1 -i ${srcdir}/0050-platform-x86-gigabyte-wmi-Add-support-for-B450M-DS3H.patch
+  patch -p1 -i ${srcdir}/0051-platform-x86-intel-hid-Add-Surface-Go-to-VGBS-allow-.patch
+  patch -p1 -i ${srcdir}/0052-staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch
+  patch -p1 -i ${srcdir}/0053-staging-r8188eu-Fix-warning-of-array-overflow-in-ioc.patch
+  patch -p1 -i ${srcdir}/0054-pNFS-Don-t-keep-retrying-if-the-server-replied-NFS4E.patch
+  patch -p1 -i ${srcdir}/0055-pNFS-Avoid-a-live-lock-condition-in-pnfs_update_layo.patch
+  patch -p1 -i ${srcdir}/0056-sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch
+  patch -p1 -i ${srcdir}/0057-clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch
+  patch -p1 -i ${srcdir}/0058-i40e-Fix-adding-ADQ-filter-to-TC0.patch
+  patch -p1 -i ${srcdir}/0059-i40e-Fix-calculating-the-number-of-queue-pairs.patch
+  patch -p1 -i ${srcdir}/0060-i40e-Fix-call-trace-in-setup_tx_descriptors.patch
+  patch -p1 -i ${srcdir}/0061-iavf-Fix-issue-with-MAC-address-of-VF-shown-as-zero.patch
+  patch -p1 -i ${srcdir}/0062-Drivers-hv-vmbus-Release-cpu-lock-in-error-case.patch
+  patch -p1 -i ${srcdir}/0063-tty-goldfish-Fix-free_irq-on-remove.patch
+  patch -p1 -i ${srcdir}/0064-misc-atmel-ssc-Fix-IRQ-check-in-ssc_probe.patch
+  patch -p1 -i ${srcdir}/0065-riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch
+  patch -p1 -i ${srcdir}/0066-io_uring-fix-races-with-file-table-unregister.patch
+  patch -p1 -i ${srcdir}/0067-io_uring-fix-races-with-buffer-table-unregister.patch
+  patch -p1 -i ${srcdir}/0068-drm-i915-reset-Fix-error_state_read-ptr-offset-use.patch
+  patch -p1 -i ${srcdir}/0069-net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch
+  patch -p1 -i ${srcdir}/0070-net-hns3-don-t-push-link-state-to-VF-if-unalive.patch
+  patch -p1 -i ${srcdir}/0071-net-hns3-restore-tm-priority-qset-to-default-setting.patch
+  patch -p1 -i ${srcdir}/0072-net-hns3-fix-PF-rss-size-initialization-bug.patch
+  patch -p1 -i ${srcdir}/0073-net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch
+  patch -p1 -i ${srcdir}/0074-nvme-add-device-name-to-warning-in-uuid_show.patch
+  patch -p1 -i ${srcdir}/0075-mlxsw-spectrum_cnt-Reorder-counter-pools.patch
+  patch -p1 -i ${srcdir}/0076-ice-Fix-PTP-TX-timestamp-offset-calculation.patch
+  patch -p1 -i ${srcdir}/0077-ice-Sync-VLAN-filtering-features-for-DVM.patch
+  patch -p1 -i ${srcdir}/0078-ice-Fix-queue-config-fail-handling.patch
+  patch -p1 -i ${srcdir}/0079-ice-Fix-memory-corruption-in-VF-driver.patch
+  patch -p1 -i ${srcdir}/0080-net-bgmac-Fix-an-erroneous-kfree-in-bgmac_remove.patch
+  patch -p1 -i ${srcdir}/0081-net-remove-noblock-parameter-from-skb_recv_datagram.patch
+  patch -p1 -i ${srcdir}/0082-net-ax25-Fix-deadlock-caused-by-skb_recv_datagram-in.patch
+  patch -p1 -i ${srcdir}/0083-arm64-ftrace-fix-branch-range-checks.patch
+  patch -p1 -i ${srcdir}/0084-arm64-ftrace-consistently-handle-PLTs.patch
+  patch -p1 -i ${srcdir}/0085-certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch
+  patch -p1 -i ${srcdir}/0086-init-Initialize-noop_backing_dev_info-early.patch
+  patch -p1 -i ${srcdir}/0087-block-Fix-handling-of-offline-queues-in-blk_mq_alloc.patch
+  patch -p1 -i ${srcdir}/0088-faddr2line-Fix-overlapping-text-section-failures-the.patch
+  patch -p1 -i ${srcdir}/0089-x86-ftrace-Remove-OBJECT_FILES_NON_STANDARD-usage.patch
+  patch -p1 -i ${srcdir}/0090-i2c-npcm7xx-Add-check-for-platform_driver_register.patch
+  patch -p1 -i ${srcdir}/0091-irqchip-gic-realview-Fix-refcount-leak-in-realview_g.patch
+  patch -p1 -i ${srcdir}/0092-irqchip-apple-aic-Fix-refcount-leak-in-build_fiq_aff.patch
+  patch -p1 -i ${srcdir}/0093-irqchip-apple-aic-Fix-refcount-leak-in-aic_of_ic_ini.patch
+  patch -p1 -i ${srcdir}/0094-irqchip-gic-v3-Fix-error-handling-in-gic_populate_pp.patch
+  patch -p1 -i ${srcdir}/0095-irqchip-gic-v3-Fix-refcount-leak-in-gic_populate_ppi.patch
+  patch -p1 -i ${srcdir}/0096-irqchip-realtek-rtl-Fix-refcount-leak-in-map_interru.patch
+  patch -p1 -i ${srcdir}/0097-sched-Fix-balance_push-vs-__sched_setscheduler.patch
+  patch -p1 -i ${srcdir}/0098-i2c-designware-Use-standard-optional-ref-clock-imple.patch
+  patch -p1 -i ${srcdir}/0099-i2c-mediatek-Fix-an-error-handling-path-in-mtk_i2c_p.patch
+  patch -p1 -i ${srcdir}/0100-mei-hbm-drop-capability-response-on-early-shutdown.patch
+  patch -p1 -i ${srcdir}/0101-mei-me-add-raptor-lake-point-S-DID.patch
+  patch -p1 -i ${srcdir}/0102-comedi-vmk80xx-fix-expression-for-tx-buffer-size.patch
+  patch -p1 -i ${srcdir}/0103-crypto-memneq-move-into-lib.patch
+  patch -p1 -i ${srcdir}/0104-USB-serial-option-add-support-for-Cinterion-MV31-wit.patch
+  patch -p1 -i ${srcdir}/0105-USB-serial-io_ti-add-Agilent-E5805A-support.patch
+  patch -p1 -i ${srcdir}/0106-arm64-mm-Don-t-invalidate-FROM_DEVICE-buffers-at-sta.patch
+  patch -p1 -i ${srcdir}/0107-usb-dwc2-Fix-memory-leak-in-dwc2_hcd_init.patch
+  patch -p1 -i ${srcdir}/0108-usb-cdnsp-Fixed-setting-last_trb-incorrectly.patch
+  patch -p1 -i ${srcdir}/0109-usb-dwc3-gadget-Fix-IN-endpoint-max-packet-size-allo.patch
+  patch -p1 -i ${srcdir}/0110-usb-dwc3-pci-Restore-line-lost-in-merge-conflict-res.patch
+  patch -p1 -i ${srcdir}/0111-usb-gadget-u_ether-fix-regression-in-setting-fixed-M.patch
+  patch -p1 -i ${srcdir}/0112-usb-gadget-lpc32xx_udc-Fix-refcount-leak-in-lpc32xx_.patch
+  patch -p1 -i ${srcdir}/0113-usb-gadget-f_fs-change-ep-status-safe-in-ffs_epfile_.patch
+  patch -p1 -i ${srcdir}/0114-usb-gadget-f_fs-change-ep-ep-safe-in-ffs_epfile_io.patch
+  patch -p1 -i ${srcdir}/0115-tty-n_gsm-Debug-output-allocation-must-use-GFP_ATOMI.patch
+  patch -p1 -i ${srcdir}/0116-serial-8250-Store-to-lsr_save_flags-after-lsr-read.patch
+  patch -p1 -i ${srcdir}/0117-bus-fsl-mc-bus-fix-KASAN-use-after-free-in-fsl_mc_bu.patch
+  patch -p1 -i ${srcdir}/0118-md-raid5-ppl-Fix-argument-order-in-bio_alloc_bioset.patch
+  patch -p1 -i ${srcdir}/0119-dm-fix-race-in-dm_start_io_acct.patch
+  patch -p1 -i ${srcdir}/0120-dm-mirror-log-round-up-region-bitmap-size-to-BITS_PE.patch
+  patch -p1 -i ${srcdir}/0121-drm-amdgpu-Fix-GTT-size-reporting-in-amdgpu_ioctl.patch
+  patch -p1 -i ${srcdir}/0122-drm-amd-display-Cap-OLED-brightness-per-max-frame-av.patch
+  patch -p1 -i ${srcdir}/0123-audit-free-module-name.patch
+  patch -p1 -i ${srcdir}/0124-cfi-Fix-__cfi_slowpath_diag-RCU-usage-with-cpuidle.patch
+  patch -p1 -i ${srcdir}/0125-fs-account-for-group-membership.patch
+  patch -p1 -i ${srcdir}/0126-selinux-free-contexts-previously-transferred-in-seli.patch
+  patch -p1 -i ${srcdir}/0127-ext4-fix-super-block-checksum-incorrect-after-mount.patch
+  patch -p1 -i ${srcdir}/0128-ext4-fix-bug_on-ext4_mb_use_inode_pa.patch
+  patch -p1 -i ${srcdir}/0129-ext4-make-variable-count-signed.patch
+  patch -p1 -i ${srcdir}/0130-ext4-add-reserved-GDT-blocks-check.patch
+  patch -p1 -i ${srcdir}/0131-KVM-arm64-Always-start-with-clearing-SVE-flag-on-loa.patch
+  patch -p1 -i ${srcdir}/0132-KVM-arm64-Don-t-read-a-HW-interrupt-pending-state-in.patch
+  patch -p1 -i ${srcdir}/0133-virtio-pci-Remove-wrong-address-verification-in-vp_d.patch
+  patch -p1 -i ${srcdir}/0134-netfs-Fix-gcc-12-warning-by-embedding-vfs-inode-in-n.patch
+  patch -p1 -i ${srcdir}/0135-drm-i915-uc-remove-accidental-static-from-a-local-va.patch
+  patch -p1 -i ${srcdir}/0136-bpf-Use-safer-kvmalloc_array-where-possible.patch
+  patch -p1 -i ${srcdir}/0137-powerpc-book3e-get-rid-of-include-generated-compile..patch
+  patch -p1 -i ${srcdir}/0138-dt-bindings-mfd-bd9571mwv-update-rohm-bd9571mwv.yaml.patch
+  patch -p1 -i ${srcdir}/0139-dt-bindings-interrupt-controller-update-brcm-l2-intc.patch
+  patch -p1 -i ${srcdir}/0140-dm-fix-bio_set-allocation.patch
+  patch -p1 -i ${srcdir}/0141-clk-imx8mp-fix-usb_root_clk-parent.patch
+
+
   # Add port map for ASUS Zenith II
   patch -p1 -i ${srcdir}/asus_zenith_ii_map.patch
 
@@ -331,7 +624,7 @@ build() {
     echo
     if [[ "$CPU" != "GENERIC" ]]; then
       LCPU=$(tr '[:upper:]' '[:lower:]' <<< $CPU)
-      LCPU=$(sed -e "s/entium//" <<<$LCPU)
+      LCPU=$(sed -e "s/entium//" -e "s/^m//" <<<$LCPU)
       echo "=============================================================="
       msg "An non-generic CPU was selected for this kernel."
       echo
@@ -391,46 +684,46 @@ _package() {
       MK8)
         pkgname="${pkgbase}-k8"
         pkgdesc="${pkgdesc} AMD K8 optimized."
-	;;
+	      ;;
       MK10)
         pkgname="${pkgbase}-k10"
-	pkgdesc="§{pkgdesc} AMD K10 optimized"
+	      pkgdesc="§{pkgdesc} AMD K10 optimized"
         ;;
       MBARCELONA)
         pkgname="${pkgbase}-barcelona"
         pkgdesc="${pkgdesc} AMD Barcelona optimized."
-	;;
+	      ;;
       MBOBCAT)
-	pkgname="${pkgbase}-bobcat"
-	pkgdesc="${pkgdesc} AMD Bobcat optimized."
-	;;
+	      pkgname="${pkgbase}-bobcat"
+	      pkgdesc="${pkgdesc} AMD Bobcat optimized."
+	      ;;
       MBULLDOZER)
-	pkgname="${pkgbase}-bulldozer"
-	pkgdesc="${pkgdesc} AMD Bulldozer optimized."
-	;;
+	      pkgname="${pkgbase}-bulldozer"
+	      pkgdesc="${pkgdesc} AMD Bulldozer optimized."
+	      ;;
       MPILEDRIVER)
-	pkgname="${pkgbase}-piledriver"
-	pkgdesc="${pkgdesc} AMD Piledriver optimized."
-	;;
+	      pkgname="${pkgbase}-piledriver"
+	      pkgdesc="${pkgdesc} AMD Piledriver optimized."
+	      ;;
       MSTEAMROLLER)
         pkgname="${pkgbase}-steamroller"
-	pkgdesc="${pkgdesc} AMD Steamroller optimized."
+	      pkgdesc="${pkgdesc} AMD Steamroller optimized."
         ;;
       MEXCAVATOR)
         pkgname="${pkgbase}-excavator"
-	pkgdesc="${pkgdesc} AMD Excavator optimized."
+	      pkgdesc="${pkgdesc} AMD Excavator optimized."
         ;;
       MZEN)
         pkgname="${pkgbase}-zen"
-	pkgdesc="${pkgdesc} AMD Zen optimized".
+	      pkgdesc="${pkgdesc} AMD Zen optimized".
         ;;
       MZEN2)
         pkgname="${pkgbase}-zen2"
-	pkgdesc="${pkgdesc} AMD Zen3 optimized."
+	      pkgdesc="${pkgdesc} AMD Zen3 optimized."
         ;;
       MZEN3)
         pkgname="${pkgbase}-zen3"
-	pkgdesc="${pkgdesc} AMD Zen3 optimized."
+	      pkgdesc="${pkgdesc} AMD Zen3 optimized."
         ;;
       MCORE2)
         pkgname="${pkgbase}-core2"
@@ -461,29 +754,29 @@ _package() {
         pkgdesc="${pkgdesc} Intel Pentium4 optimized."
         ;;
       MNEHALEM)
-	pkgname="${pkgbase}-nehalem"
+	      pkgname="${pkgbase}-nehalem"
         pkgdesc="${pkgdesc} Intel Core Nehalem optimized."
-	;;
+	      ;;
       MSANDYBRIDGE)
         pkgname="${pkgbase}-sandybridge"
         pkgdesc="${pkgdesc} Intel Sandy Bridge optimized."
-	;;
+	      ;;
       MIVYBRIDGE)
         pkgname="${pkgbase}-ivybridge"
         pkgdesc="${pkgdesc} Intel Ivy Bridge optimized."
-	;;
+	      ;;
       MHASWELL)
         pkgname="${pkgbase}-haswell"
         pkgdesc="${pkgdesc} Intel Haswell optimized."
-	;;
+	      ;;
       MBROADWELL)
         pkgname="${pkgbase}-broadwell"
         pkgdesc="${pkgdesc} Intel Broadwell optimized."
-	;;
+	      ;;
       MSILVERMONT)
         pkgname="${pkgbase}-silvermont"
         pkgdesc="${pkgdesc} Intel Silvermont optimized."
-	;;
+	      ;;
       MSKYLAKE)
         pkgname="${pkgbase}-skylake"
         pkgdesc="${pkgdesc} Intel Skylake optimized."
@@ -586,11 +879,16 @@ _package() {
 
   echo "Installing modules..."
   make INSTALL_MOD_PATH="$pkgdir/usr" INSTALL_MOD_STRIP=1 \
-    DEPMOD=/doesnt/exist modules_install  # Suppress depmod
+       DEPMOD=/doesnt/exist modules_install  # Suppress depmod
 
   # remove build and source links
   rm "$modulesdir"/{source,build}
   # end c/p
+
+  # Install here so each kernel optimized flavour can ship it's own System.map,
+  # since bpf symbols can differ bepending on the cflags used during build.
+  # Re: #5
+  install -D -m644 System.map "$modulesdir"/build/System.map
 }
 
 ### package_linux-pf-headers
@@ -616,7 +914,7 @@ _package-headers() {
 
   msg2 "Installing build files..."
   install -dm755 "${_builddir}"
-  install -Dt "${_builddir}" -m644 Makefile .config Module.symvers System.map version \
+  install -Dt "${_builddir}" -m644 Makefile .config Module.symvers version \
           vmlinux localversion.*
   install -Dt "${_builddir}/kernel" -m644 kernel/Makefile
 
@@ -780,7 +1078,7 @@ sha256sums=('51f3f1684a896e797182a0907299cc1f0ff5e5b51dd9a55478ae63a409855cee'
             '93ebf63c9e95a9b8a7ae325ce11508334ca83fd00db9677c483216a6bdef3c68'
             '30566498a4f549e972fcd430d2fc44b2bd643c55bae20096f083f8837d8c43e4'
             '82d660caa11db0cd34fd550a049d7296b4a9dcd28f2a50c81418066d6e598864'
-            '44fb5d030166ba3ac3290751f93c9c08f38c725283efc4a7449ea933993a65d7'
+            '5463b44b2c66657e973bdb157e9507df5a9d4964c3689e0da9fe7c9af395d80e'
             '75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919'
             'ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21'
             '7ef319249df009695b5477e30536e3edb07bcc93a58a76a63e58b012bb7debb1'
@@ -809,5 +1107,147 @@ sha256sums=('51f3f1684a896e797182a0907299cc1f0ff5e5b51dd9a55478ae63a409855cee'
             '93b9b6124929ad689226b055be89cfd13be36ca927d0bed8508b069e080b7149'
             '76c90c2615b431c20d74926c03648dc482b5959951d4a10dddcac1c8cdde1f55'
             'cc78995e6475785477e89733697492b962f3b393ad59dbf49ef34865dc2a073b'
+            '6a7f697265eca470f6ef5129ab2659dd870c6846d492c23f7b9f091086f067c7'
+            'bf4580c6a5a449538f48af19351d2baa7cd0c59ba8df7fcac233ca12a720554c'
+            '3365e896241ae6288b4c0f79cc88934f47feaa9d5c641bcb552d2d7d868d236c'
+            '53bd11efc31e9cdb77a21f911fa04f6850bce064bfcb0632d71605a60e825df2'
+            '7b08d88bc5ced423c6f5170f05411d388f3063b846a8cea0be85a4a8075976be'
+            '71eb6465ba77f36552ff0b377f147f28fa5314ba619e4645dcb42d79abcd9ed8'
+            '67c692171dd86d33b353516d31b1e53abafcda51926368b51b6028a6733fcde0'
+            '8ef046c149530dfcc50da88896098e880a06c994c29a0690beb66c6ab77825ca'
+            '8705b705f9dbcd0545c5b56ab65ca0f7dfe439d1e7fdc1b88cd1afb529591f30'
+            'e7117b3f0c21c235cb4fb5eaff182f4fe311327ca7da178c90a9693f79a0a19a'
+            '1ed244baecf5bafc3e5e274b8afa7900d24081d35205dec013d1b2047b401ffd'
+            '08999ff13ae3bd4f245b62f8a8e5350c9c4876c782928a1a3ee784c8782ce951'
+            'a5fad4dc9a75bb117943c523bc85aa05caac4982f8a4bd1cd525112f57bccf1b'
+            '12e37cf4d04858e25bf17be3d8389deb983623eb460bc87739164aa57cb0ec66'
+            '75ece20fb46fda88b48f399dc8076d271ecaf121b7baf794771432dd9d83e4fc'
+            'db69684922c5891913724a65461b6f35b7b3e4b595c446e4b4193d6d16135302'
+            '51c6655a459f4f5172a31c97231d0f7a0fae9ac4d850104b39dd2dfeffedd31d'
+            '2dcf6e1b0237dce0b37be39f086c74aa95f92ece0bb240045b2abe611e8047df'
+            'd0f45e890e2bbd36c35b80bd6bb8bc657549b9c51726e6d838e468a19bddbb8c'
+            '19b5b7303366f0fcb704de4910c85f831b9e05b249b142e8f0a16ee20e221dc0'
+            '2fdce8053cf8a00db6a6fb01f5e50487758a344664ea16a43d7a107c0535cfeb'
+            '9d8399ed8114e37748ba0657d62cc29ce2f68aa7d63c6ba34b50662536e31bb2'
+            'be666e88314bd620da6b161929780a54b74d6264e48894ed1770008ac4765f10'
+            '541ba90e1aad53e92340b24d02bb9cd4037a8bc6bc4c7c7fbebd35367cf45eb7'
+            'bcda0fa7067ea39b211e64bb7b918546525c2644ea5f4b52d442c6d9f685c551'
+            'e26b7d5ae4682223ed96eddeabafa690979fded479c9770a78207805ff624aa8'
+            'd69f4c5abfce5c63d410fc30b2b75597133b9f638e8cb0ae1a489068507390c6'
+            '6bf12da93f22f2386e6d6f1079f8aca56b5a4319e0a7c438952c0343abe45679'
+            'b2087de63d389f19f4a6c60db66dab114c597a7f3711569ed4690e1c66efd171'
+            'f17f57ad286e82cbd984a005b1336ab87febb9998db2dc871e00610b336c6ee2'
+            'b356d5b82db62d71906cd54e3f47899312da3bc36995320b0caa4bb60cfe6cf3'
+            '26d9b9bcbd45669bfc08b22db5c4b37a416581c1c9f01b5d092b5836699b32b2'
+            '51ae8222e4555be471ea1b200fddccbede3ff4a692db9a2a547af692c05eac7c'
+            '0bc9607ee2f3657535d3a66472935bc84d31f5b1b2c20ce1a120ebdff4438abd'
+            '6241e00ef89e9aa63945cc8d57f8d7cd568d3aabf2780a559f346e641667c8bb'
+            'e75a9dd060a32a9158d5855ed9b8d0e2e0fa96918e42854e135b16c2e68bd71b'
+            '01ac5f362c5aa02615de9249e125d8e341b6de2ae97e68c60eae324021d4d717'
+            '369dda806203e5651333541702697cb83c968fc53d963f688e89cca3c113ad36'
+            '668d1d9c25c0d45611e86008cdd570e30ba37f280a504adc877ebfa26f4eb379'
+            '1a1e7e39c0bec3c254437d60dbdf222e602781df33c7591927cf05963c6ed5e1'
+            'cdfa1893ee96403dfced3a580ba310cba226ad9b10a6dacf2ea5fa58e49d6de0'
+            '68dd95421c509626864dc247d7aee6603657dda71fbf813e8d347337c62e989c'
+            '66e50e6d8dcbfedc23d908ca45317c2954839bbc799033480087ce934fd688c0'
+            'b3e38059db8926a960623c933e16579e95214fd7d60bde52e51b6728982c31d5'
+            '3c4ddf38b20735a9103fc9a1177ade0918c411ab67899088914efadeb43f1fd8'
+            'cf9871daa25a2c36423b0b7809a08d83ba330ee2062d05b87207fb9add7eda94'
+            '306bd4535ce857edd2c127e8af36f06baf962ba89d7f4406165412b1b981d064'
+            'd2dd42a8c9f039b1fd61ac77086619458a418bcac49d0d44097e990289dd04c5'
+            'ca1cc1b9dadb693fcce8f96f814fb9e4f7b2caea877e4483a81df9887905af80'
+            '1a732f0e63212cfde3b2df7e87eaca900216f0fe4d0fd7dd188b83560e3b0239'
+            'fc94de835829b9a9ec00b30c2da9e1b1f43ed5c7e1f8e079bb283205d8afdf1d'
+            'c437a09e97d9c68c69fe24050544315bdaefd67331f94ec13f7d7c5974090f65'
+            '865faa82098b7662955a7ab80ee9607b19578ab3c609da23762b0538b6692faa'
+            'ce82e08ec05a60358d85c2637bb972c9224d89cf9a184f9dcd12aa7f5c2991d4'
+            'a09c756c3e45d7163cc35288bb0ca1179035394015f4a356cd8894fd084c2db2'
+            '07071685514086b64244cba23cbf381c6deac5548d3a6e9aaeb75c0b8eab91fe'
+            '19db960863cd4cf8c024e6f7c2354e18ffe24293003ebd1a321ed6036db259f5'
+            'f9ecf00962a08396be1f90eaa0f35c2052afefd3890701e2178db9f364a495c1'
+            '979652adf95d11ca557d6476cf5ce0c50c25b07c71f1f0f0ee5e1e5b94937d02'
+            'b2fa2bfd38c622d7f3652751d2aded39482331cc22a78d2a6febfde263f1c113'
+            '51e91aa86e3841b69973a98ca204f025134d7d2a045251357da7a9bdca4aaeb0'
+            '58939fc6e93f93e7783a498b6c2620364353ad67a47363d12e4ddbcebe65c22f'
+            '6f32b2a1bcde1e2bc9590d88cd11e0dcdae828da9a34bf6ca9e7e7acffa2c83e'
+            '6b054b28dcefba5385b6f3a018c2bd80844af7658809db6bec4ead3ed3ff797c'
+            'd75293a554a0e572b3fecc89f4b5cd1fcf55d7ccaf198a802d77861a5fde0d8f'
+            '3bcbd547dd5702f9087dccd8dd1122a612b4cd674cb76a9b21556ee8a013abab'
+            'c7b5fb981b6b1981b0922674648b35ae635a7ad7eb4c5b9ce235af715a2164af'
+            '10ca1bdccaa20a069e3a6ad2e4d100a3e65a8a8e1310b0594c1668da73a11c4a'
+            '05f237b1e0a495d4b86099361d4910d415c922e248d96bdb08994d55c29a1172'
+            '912e5e9f77c4221956686faffd57d1124764509b8892ff9cfa9e75d1d8e30790'
+            '26790d65d73bd83575b2c363e5db54c5ab3f02e216eb45115d4ef22b6b680cb6'
+            '38a741e359ce58e71f234f922e729bed7192d7999eebaa9adcaa103cadcd361f'
+            '43629619d333c836497b9ee841430829474931dee557fc487e849f2512815c3d'
+            '11608c0d06eaba285d689539726acbd8a00937d6ac9f61a92b3efaf459c349a3'
+            '36621c6098729b6dcf52b2b714fec51ee1bc12bdc91fb2779203aced02f9401c'
+            '01b581de8a5015a3d6f861b09746d2dc44aba3fa7ddc11efe0c3df621b2ef7d7'
+            'fa7d177441c5a7e9bb92bdcd6b57051e29993f7b43872c20e42b76ffad93328e'
+            '823600f5c92ad995d8a928e99654fa4fed216341de35a9f46426650bbed47982'
+            '03de8897fccbb175336d9da80c8b3e384ca2a366e6948362f70ec7a993b7b045'
+            '79a8a637e0122c46b55902c91d1b09b6cb38d751aa2ec5e3a8f03914563c08d5'
+            'bf0fc3ee3dcbe8c37d60efb17085dd62e642f0e1d79d7b30ed912e43a3eabe81'
+            '3694e1c112183dbf14dbcefdb45b8c1e229f84d484d500601201ded5e3e3ed54'
+            'b792fb3851c35d835579131c77bd7b68069d1faf2cc2f6f6b682b0d31d321864'
+            'e23a544fe8c87d8d9428bbd3e50a7a5d7334ca69d29c2d2564e28a359ff78cab'
+            'd3fc9bd37f17b219e72c4334c8d0269bbfa40af47b0f97a90e6e066a43258ce2'
+            '77fa2f49c5efeb8ee58a02ff686c754b69814f8c82f1d4b31b5514f9b88c7b72'
+            '1b4dd80e9088f00d93226c9e1a7b9aa093f41678e54c49c3c6fbe20845f83f4b'
+            'b4993087a58b3a9433048aa7da414a5514f529072dd1264d6d19d50391e9b15b'
+            'c9c3ff503c228eefbe1d891be962e66a496948dbc2e3113fc8b8f5431f46ddf9'
+            '3d2627d9b23dc2c827e9483baa9a9be8fbfb0ade38ef79deab8af7707d79ad19'
+            'ebbd0323f88f0117a5cf86cbb2c1a0fcae8ea4baa36d231af67f4e272b106b69'
+            '77f1b39b4147c1a30958edf5b88394bc7042f3aa6cf9bc21d4ec400c2ee5cdaf'
+            '88511b4a9ee5966d497a59a93d681e855959ad807c74e0bcbc5b348ad2871e60'
+            '1700f8ef559d1c33cc786348c68f41a1e21f0452c46f5f98b833cc8399965674'
+            '41cf676b9ddc30098fcc01e7abdba4b32e9fe6ae56cb7a91fe92feb178357515'
+            '71591c8ae9c3cf8777f62fe5556d495da67e587e5e59a1c061e3793d00b18877'
+            '5844e0cc18fd9236ed927053b291c5dccae32d13b9a4f57ecdc64fcf13f6af01'
+            '090f2b3c6e942cc54d1c5e9566b27cb16fdf513134310a975309ab80cdcfd3fe'
+            '35db7ea210dd944ec16b55d073882e29e391884a86fbdd648f6d3231723e7d58'
+            '080e1ad70ff51a52437cd68b8e23fa9517b9cbe00686a22919f499c5a0c6b4fa'
+            'ee7c0c865c2095aa3974f16424717860a3fd0ce52f6ad25f7f032ccba1957bf1'
+            'f9df0f6e70019cf49835819769407d0d743473a8ef0d651221281b8df60ed69d'
+            '8aa663ca43059bc22b3d7a8ba5697459119aa96f118b49294568b7dcd6e4b294'
+            '5114d3e0af1ec6f0717a80114b3e5a692453c65ebf7872a66abb6f0815dfd8a4'
+            'fbc72be74c569f3576d4f1fc7486d87c05d7b55c1336aa36d30127a41b0c109c'
+            '1a29371a46dd3e21ad0d2ab5f6690a54b925add1a03559fef38b8acf3a7d4d82'
+            '023628ddf6c8e2c79308301a83768362fb087a408e2a83ccfec31b0e60195435'
+            '395d3b3f51b0e44086d59cd6f397144d4d5e873f784e25087e56c31ce3ea88dc'
+            '57f7c6f4d2a4bd5a32fe58d6fb3dea8ed4cdaa14a82ff2ea0c6a917c2f788a2f'
+            'b0070a98b9276c91c81ed0f6557fb68b5a6ff1697ae8be210408cf4285603db0'
+            '1e1731bbb3661fb5a462165bc3ef15916867d8478356fb21fc42e64bf951e472'
+            '88477af3fda83a4622ebfa05b35b723b6c5ff893a1b92645f15c8ad6e4ecd782'
+            'd614b3659ea67561111dd6fa1a80faefe47dd8738e3a9a0c2c830ee759836d8a'
+            'fa142d6b3e46890fd99dc952c7505ff2ccc8cbbf50a1f22c16cd467a2b274f14'
+            'a6ce9b5dc311240cdf457458d544b01db80d40400244e0ca38804cd6aa5bd56a'
+            'ebc7b84c1e4c29937648ca828f1222c83e13f3bc43f76b4b61b4beaa67646968'
+            'e09bcc3717697cb240e76ea0d1405ec1ce0d4f5eb3d70d745d73f2cf4a51c07b'
+            'ce6f7d1351cd93e6c340dbb69e0f4364d73998ac20b08b532601e7b00c7a2cf1'
+            '82df96ae4ee622865f84acf16937b5230a24194ae501ad6beac674d890f34c13'
+            '669b6b969b2e6f1fee2f3cac8c89e9539b66fe6c5d02b1a5788893c8d0da55f3'
+            '8fd9b5f76987d1c82babd499c95a4e560c3680faadf86a3ec522a59371e04e0d'
+            '17e27847e259ca9042160c7731311d392dee51b5574f50ae3ab4330e1f0c47aa'
+            'b1f2ddb6d951b131409762662c202cbd256e0048bfc22a374689b2cf862fafc9'
+            'b4a17e6c97b486cff2d374c7ac565dea653ad57d6ac98d225aafa1afc4df1c42'
+            '773795ea8f758f5357438fce546e7248064e351b366bcde7d9f109bc70316f8f'
+            'c1c2b81107a171de2bdd7d7db9334bfa2cdf05e107ae398188b68a1efe88b79c'
+            'a7582edae4d0c2eaa761688205e141508ee2aa1e2bb740ba3202bf38d9b7398d'
+            '2846718243cdf93d3ce53325d974d528cbb85f69bff58462b9209e3eef2f2263'
+            '7bf866d152061c0233ee5b776271ff98602504fb8f4b6e9221476f83daab3260'
+            '64baac6bdca3e23abf662bc5ff6df423f23357c1e285b231b2424021542cc23d'
+            'fa2a7a2f14bc687dfb61b8ca577d6ab261c48fa8e22b8fb99d83061926406345'
+            '6ac56bfae9d163fde3bff2182973094e0ca872fe0e10cc8ed05cbe175470ccb6'
+            '291f0070413d973e8b59b94e20f31ff774e3e44cdd2cd98f1771ed504347eff3'
+            '5d76a897001990ce87991f84aef27d135ebbeb3e72ce1c3ec9a54a0edce51844'
+            '6871198575b62efea7779d8cc59cf2ff83ba68001b05b8c943470e1f47ab7a67'
+            '00f78c62d9272b806d1b3f115a94d1a98a57cd572b8ae953a280595b54de730f'
+            'db91de5e9ac10d4ced6e75ad1f21a968bae34ff5d42ef7b060fd76337e085ac1'
+            '028ab44455d2ebc99f0f47bb31a9e1f654acfc6f58d66461e5fdbe0436b6e2b2'
+            '23b6eec5a652a112fb6c294cee71ef15c144eba5ffd0ca0ddf020089ef2463de'
+            '426d9d85d26265ed2583f8c58093e391c8c2ae0552e9af2dd6c595b11f92cda1'
+            'cef8a1f322cf729b0799cdb4b4b8bf454a0ebcff860f013e3d732fa5bef30d2b'
+            '71710e030ab73ce9dd145106b2ab7db4af8ca762f44cbb2e7f18c4ce16ee02ff'
             '67558840c3e1f1de229b23a54342cb126735282353a4d0a8cd10e4d582e6d9d6')
 # vim:set ts=2 sw=2 tw=0 et: