--- /dev/null
+From 3864fd3e782962c2ef83fad929946c3dae6bfeb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Sep 2021 18:30:03 +0800
+Subject: ASoC: fsl_esai: register platform component before registering cpu
+ dai
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit f12ce92e98b21c1fc669cd74e12c54a0fe3bc2eb ]
+
+There is no defer probe when adding platform component to
+snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
+
+snd_soc_register_card()
+ -> snd_soc_bind_card()
+ -> snd_soc_add_pcm_runtime()
+ -> adding cpu dai
+ -> adding codec dai
+ -> adding platform component.
+
+So if the platform component is not ready at that time, then the
+sound card still registered successfully, but platform component
+is empty, the sound card can't be used.
+
+As there is defer probe checking for cpu dai component, then register
+platform component before cpu dai to avoid such issue.
+
+Fixes: 43d24e76b698 ("ASoC: fsl_esai: Add ESAI CPU DAI driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1630665006-31437-3-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_esai.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
+index a961f837cd09..bda66b30e063 100644
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -1073,6 +1073,16 @@ static int fsl_esai_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto err_pm_get_sync;
+
++ /*
++ * Register platform component before registering cpu dai for there
++ * is not defer probe for platform component in snd_soc_add_pcm_runtime().
++ */
++ ret = imx_pcm_dma_init(pdev, IMX_ESAI_DMABUF_SIZE);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to init imx pcm dma: %d\n", ret);
++ goto err_pm_get_sync;
++ }
++
+ ret = devm_snd_soc_register_component(&pdev->dev, &fsl_esai_component,
+ &fsl_esai_dai, 1);
+ if (ret) {
+@@ -1082,12 +1092,6 @@ static int fsl_esai_probe(struct platform_device *pdev)
+
+ INIT_WORK(&esai_priv->work, fsl_esai_hw_reset);
+
+- ret = imx_pcm_dma_init(pdev, IMX_ESAI_DMABUF_SIZE);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to init imx pcm dma: %d\n", ret);
+- goto err_pm_get_sync;
+- }
+-
+ return ret;
+
+ err_pm_get_sync:
+--
+2.33.0
+
--- /dev/null
+From bae2fc1301a5c2efa440340668d4ddf909096729 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Sep 2021 18:30:04 +0800
+Subject: ASoC: fsl_micfil: register platform component before registering cpu
+ dai
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0adf292069dcca8bab76a603251fcaabf77468ca ]
+
+There is no defer probe when adding platform component to
+snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
+
+snd_soc_register_card()
+ -> snd_soc_bind_card()
+ -> snd_soc_add_pcm_runtime()
+ -> adding cpu dai
+ -> adding codec dai
+ -> adding platform component.
+
+So if the platform component is not ready at that time, then the
+sound card still registered successfully, but platform component
+is empty, the sound card can't be used.
+
+As there is defer probe checking for cpu dai component, then register
+platform component before cpu dai to avoid such issue.
+
+Fixes: 47a70e6fc9a8 ("ASoC: Add MICFIL SoC Digital Audio Interface driver.")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1630665006-31437-4-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_micfil.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c
+index 8c0c75ce9490..9f90989ac59a 100644
+--- a/sound/soc/fsl/fsl_micfil.c
++++ b/sound/soc/fsl/fsl_micfil.c
+@@ -737,18 +737,23 @@ static int fsl_micfil_probe(struct platform_device *pdev)
+ pm_runtime_enable(&pdev->dev);
+ regcache_cache_only(micfil->regmap, true);
+
++ /*
++ * Register platform component before registering cpu dai for there
++ * is not defer probe for platform component in snd_soc_add_pcm_runtime().
++ */
++ ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to pcm register\n");
++ return ret;
++ }
++
+ ret = devm_snd_soc_register_component(&pdev->dev, &fsl_micfil_component,
+ &fsl_micfil_dai, 1);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to register component %s\n",
+ fsl_micfil_component.name);
+- return ret;
+ }
+
+- ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
+- if (ret)
+- dev_err(&pdev->dev, "failed to pcm register\n");
+-
+ return ret;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 8454ebfb746549dafccca41c4137e7410cfd5cfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Sep 2021 18:30:02 +0800
+Subject: ASoC: fsl_sai: register platform component before registering cpu dai
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 9c3ad33b5a412d8bc0a377e7cd9baa53ed52f22d ]
+
+There is no defer probe when adding platform component to
+snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
+
+snd_soc_register_card()
+ -> snd_soc_bind_card()
+ -> snd_soc_add_pcm_runtime()
+ -> adding cpu dai
+ -> adding codec dai
+ -> adding platform component.
+
+So if the platform component is not ready at that time, then the
+sound card still registered successfully, but platform component
+is empty, the sound card can't be used.
+
+As there is defer probe checking for cpu dai component, then register
+platform component before cpu dai to avoid such issue.
+
+Fixes: 435508214942 ("ASoC: Add SAI SoC Digital Audio Interface driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1630665006-31437-2-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 223fcd15bfcc..38f6362099d5 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -1152,11 +1152,10 @@ static int fsl_sai_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto err_pm_get_sync;
+
+- ret = devm_snd_soc_register_component(&pdev->dev, &fsl_component,
+- &sai->cpu_dai_drv, 1);
+- if (ret)
+- goto err_pm_get_sync;
+-
++ /*
++ * Register platform component before registering cpu dai for there
++ * is not defer probe for platform component in snd_soc_add_pcm_runtime().
++ */
+ if (sai->soc_data->use_imx_pcm) {
+ ret = imx_pcm_dma_init(pdev, IMX_SAI_DMABUF_SIZE);
+ if (ret)
+@@ -1167,6 +1166,11 @@ static int fsl_sai_probe(struct platform_device *pdev)
+ goto err_pm_get_sync;
+ }
+
++ ret = devm_snd_soc_register_component(&pdev->dev, &fsl_component,
++ &sai->cpu_dai_drv, 1);
++ if (ret)
++ goto err_pm_get_sync;
++
+ return ret;
+
+ err_pm_get_sync:
+--
+2.33.0
+
--- /dev/null
+From 59e13c2f5a04667c9218fa988c02e442f36d416f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Sep 2021 18:30:05 +0800
+Subject: ASoC: fsl_spdif: register platform component before registering cpu
+ dai
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit ee8ccc2eb5840e34fce088bdb174fd5329153ef0 ]
+
+There is no defer probe when adding platform component to
+snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
+
+snd_soc_register_card()
+ -> snd_soc_bind_card()
+ -> snd_soc_add_pcm_runtime()
+ -> adding cpu dai
+ -> adding codec dai
+ -> adding platform component.
+
+So if the platform component is not ready at that time, then the
+sound card still registered successfully, but platform component
+is empty, the sound card can't be used.
+
+As there is defer probe checking for cpu dai component, then register
+platform component before cpu dai to avoid such issue.
+
+Fixes: a2388a498ad2 ("ASoC: fsl: Add S/PDIF CPU DAI driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1630665006-31437-5-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_spdif.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c
+index 8ffb1a6048d6..1c53719bb61e 100644
+--- a/sound/soc/fsl/fsl_spdif.c
++++ b/sound/soc/fsl/fsl_spdif.c
+@@ -1434,16 +1434,20 @@ static int fsl_spdif_probe(struct platform_device *pdev)
+ pm_runtime_enable(&pdev->dev);
+ regcache_cache_only(spdif_priv->regmap, true);
+
+- ret = devm_snd_soc_register_component(&pdev->dev, &fsl_spdif_component,
+- &spdif_priv->cpu_dai_drv, 1);
++ /*
++ * Register platform component before registering cpu dai for there
++ * is not defer probe for platform component in snd_soc_add_pcm_runtime().
++ */
++ ret = imx_pcm_dma_init(pdev, IMX_SPDIF_DMABUF_SIZE);
+ if (ret) {
+- dev_err(&pdev->dev, "failed to register DAI: %d\n", ret);
++ dev_err_probe(&pdev->dev, ret, "imx_pcm_dma_init failed\n");
+ goto err_pm_disable;
+ }
+
+- ret = imx_pcm_dma_init(pdev, IMX_SPDIF_DMABUF_SIZE);
++ ret = devm_snd_soc_register_component(&pdev->dev, &fsl_spdif_component,
++ &spdif_priv->cpu_dai_drv, 1);
+ if (ret) {
+- dev_err_probe(&pdev->dev, ret, "imx_pcm_dma_init failed\n");
++ dev_err(&pdev->dev, "failed to register DAI: %d\n", ret);
+ goto err_pm_disable;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 0abf88f7c40886a1a8749af7c4ded561a0fed0d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Sep 2021 18:30:06 +0800
+Subject: ASoC: fsl_xcvr: register platform component before registering cpu
+ dai
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit c590fa80b39287a91abeb487829f3190e7ae775f ]
+
+There is no defer probe when adding platform component to
+snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
+
+snd_soc_register_card()
+ -> snd_soc_bind_card()
+ -> snd_soc_add_pcm_runtime()
+ -> adding cpu dai
+ -> adding codec dai
+ -> adding platform component.
+
+So if the platform component is not ready at that time, then the
+sound card still registered successfully, but platform component
+is empty, the sound card can't be used.
+
+As there is defer probe checking for cpu dai component, then register
+platform component before cpu dai to avoid such issue.
+
+Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1630665006-31437-6-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_xcvr.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
+index fb7c29fc39d7..477d16713e72 100644
+--- a/sound/soc/fsl/fsl_xcvr.c
++++ b/sound/soc/fsl/fsl_xcvr.c
+@@ -1217,18 +1217,23 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
+ pm_runtime_enable(dev);
+ regcache_cache_only(xcvr->regmap, true);
+
++ /*
++ * Register platform component before registering cpu dai for there
++ * is not defer probe for platform component in snd_soc_add_pcm_runtime().
++ */
++ ret = devm_snd_dmaengine_pcm_register(dev, NULL, 0);
++ if (ret) {
++ dev_err(dev, "failed to pcm register\n");
++ return ret;
++ }
++
+ ret = devm_snd_soc_register_component(dev, &fsl_xcvr_comp,
+ &fsl_xcvr_dai, 1);
+ if (ret) {
+ dev_err(dev, "failed to register component %s\n",
+ fsl_xcvr_comp.name);
+- return ret;
+ }
+
+- ret = devm_snd_dmaengine_pcm_register(dev, NULL, 0);
+- if (ret)
+- dev_err(dev, "failed to pcm register\n");
+-
+ return ret;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 6d426d2bcd2ba1d8651bec5b792bb6f16e30017d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Sep 2021 17:26:13 +0800
+Subject: ASoC: mediatek: common: handle NULL case in suspend/resume function
+
+From: Trevor Wu <trevor.wu@mediatek.com>
+
+[ Upstream commit 1dd038522615b70f5f8945c5631e9e2fa5bd58b1 ]
+
+When memory allocation for afe->reg_back_up fails, reg_back_up can't
+be used.
+Keep the suspend/resume flow but skip register backup when
+afe->reg_back_up is NULL, in case illegal memory access happens.
+
+Fixes: 283b612429a2 ("ASoC: mediatek: implement mediatek common structure")
+Signed-off-by: Trevor Wu <trevor.wu@mediatek.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20210910092613.30188-1-trevor.wu@mediatek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/common/mtk-afe-fe-dai.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/mediatek/common/mtk-afe-fe-dai.c b/sound/soc/mediatek/common/mtk-afe-fe-dai.c
+index 3cb2adf420bb..ab7bbd53bb01 100644
+--- a/sound/soc/mediatek/common/mtk-afe-fe-dai.c
++++ b/sound/soc/mediatek/common/mtk-afe-fe-dai.c
+@@ -334,9 +334,11 @@ int mtk_afe_suspend(struct snd_soc_component *component)
+ devm_kcalloc(dev, afe->reg_back_up_list_num,
+ sizeof(unsigned int), GFP_KERNEL);
+
+- for (i = 0; i < afe->reg_back_up_list_num; i++)
+- regmap_read(regmap, afe->reg_back_up_list[i],
+- &afe->reg_back_up[i]);
++ if (afe->reg_back_up) {
++ for (i = 0; i < afe->reg_back_up_list_num; i++)
++ regmap_read(regmap, afe->reg_back_up_list[i],
++ &afe->reg_back_up[i]);
++ }
+
+ afe->suspended = true;
+ afe->runtime_suspend(dev);
+@@ -356,12 +358,13 @@ int mtk_afe_resume(struct snd_soc_component *component)
+
+ afe->runtime_resume(dev);
+
+- if (!afe->reg_back_up)
++ if (!afe->reg_back_up) {
+ dev_dbg(dev, "%s no reg_backup\n", __func__);
+-
+- for (i = 0; i < afe->reg_back_up_list_num; i++)
+- mtk_regmap_write(regmap, afe->reg_back_up_list[i],
+- afe->reg_back_up[i]);
++ } else {
++ for (i = 0; i < afe->reg_back_up_list_num; i++)
++ mtk_regmap_write(regmap, afe->reg_back_up_list[i],
++ afe->reg_back_up[i]);
++ }
+
+ afe->suspended = false;
+ return 0;
+--
+2.33.0
+
--- /dev/null
+From 824b6ae2603eadbb8705644b2537e925f8c9dedc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 09:32:30 +0300
+Subject: ASoC: SOF: Fix DSP oops stack dump output contents
+
+From: Yong Zhi <yong.zhi@intel.com>
+
+[ Upstream commit ac4dfccb96571ca03af7cac64b7a0b2952c97f3a ]
+
+Fix @buf arg given to hex_dump_to_buffer() and stack address used
+in dump error output.
+
+Fixes: e657c18a01c8 ('ASoC: SOF: Add xtensa support')
+Signed-off-by: Yong Zhi <yong.zhi@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@gmail.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20210915063230.29711-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/xtensa/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/xtensa/core.c b/sound/soc/sof/xtensa/core.c
+index bbb9a2282ed9..f6e3411b33cf 100644
+--- a/sound/soc/sof/xtensa/core.c
++++ b/sound/soc/sof/xtensa/core.c
+@@ -122,9 +122,9 @@ static void xtensa_stack(struct snd_sof_dev *sdev, void *oops, u32 *stack,
+ * 0x0049fbb0: 8000f2d0 0049fc00 6f6c6c61 00632e63
+ */
+ for (i = 0; i < stack_words; i += 4) {
+- hex_dump_to_buffer(stack + i * 4, 16, 16, 4,
++ hex_dump_to_buffer(stack + i, 16, 16, 4,
+ buf, sizeof(buf), false);
+- dev_err(sdev->dev, "0x%08x: %s\n", stack_ptr + i, buf);
++ dev_err(sdev->dev, "0x%08x: %s\n", stack_ptr + i * 4, buf);
+ }
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 6b77bb7709ebf42b31ecdd2069877b3819761a39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 15:21:08 +0300
+Subject: ASoC: SOF: imx: imx8: Bar index is only valid for IRAM and SRAM types
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 10d93a98190aec2c3ff98d9472ab1bf0543aa02c ]
+
+i.MX8 only uses SOF_FW_BLK_TYPE_IRAM (1) and SOF_FW_BLK_TYPE_SRAM (3)
+bars, everything else is left as 0 in sdev->bar[] array.
+
+If a broken or purposefully crafted firmware image is loaded with other
+types of FW_BLK_TYPE then a kernel crash can be triggered.
+
+Make sure that only IRAM/SRAM type is converted to bar index.
+
+Fixes: 202acc565a1f0 ("ASoC: SOF: imx: Add i.MX8 HW support")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@gmail.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Link: https://lore.kernel.org/r/20210915122116.18317-5-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/imx/imx8.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/imx/imx8.c b/sound/soc/sof/imx/imx8.c
+index 12fedf0984bd..7e9723a10d02 100644
+--- a/sound/soc/sof/imx/imx8.c
++++ b/sound/soc/sof/imx/imx8.c
+@@ -365,7 +365,14 @@ static int imx8_remove(struct snd_sof_dev *sdev)
+ /* on i.MX8 there is 1 to 1 match between type and BAR idx */
+ static int imx8_get_bar_index(struct snd_sof_dev *sdev, u32 type)
+ {
+- return type;
++ /* Only IRAM and SRAM bars are valid */
++ switch (type) {
++ case SOF_FW_BLK_TYPE_IRAM:
++ case SOF_FW_BLK_TYPE_SRAM:
++ return type;
++ default:
++ return -EINVAL;
++ }
+ }
+
+ static void imx8_ipc_msg_data(struct snd_sof_dev *sdev,
+--
+2.33.0
+
--- /dev/null
+From 25d4fcbcfddea10ce5d0e65f0669d71477d5c83c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 15:21:09 +0300
+Subject: ASoC: SOF: imx: imx8m: Bar index is only valid for IRAM and SRAM
+ types
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit d9be4a88c3627c270bbe032b623dc43f3b764565 ]
+
+i.MX8 only uses SOF_FW_BLK_TYPE_IRAM (1) and SOF_FW_BLK_TYPE_SRAM (3)
+bars, everything else is left as 0 in sdev->bar[] array.
+
+If a broken or purposefully crafted firmware image is loaded with other
+types of FW_BLK_TYPE then a kernel crash can be triggered.
+
+Make sure that only IRAM/SRAM type is converted to bar index.
+
+Fixes: afb93d716533d ("ASoC: SOF: imx: Add i.MX8M HW support")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@gmail.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Link: https://lore.kernel.org/r/20210915122116.18317-6-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/imx/imx8m.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/imx/imx8m.c b/sound/soc/sof/imx/imx8m.c
+index cb822d953767..892e1482f97f 100644
+--- a/sound/soc/sof/imx/imx8m.c
++++ b/sound/soc/sof/imx/imx8m.c
+@@ -228,7 +228,14 @@ static int imx8m_remove(struct snd_sof_dev *sdev)
+ /* on i.MX8 there is 1 to 1 match between type and BAR idx */
+ static int imx8m_get_bar_index(struct snd_sof_dev *sdev, u32 type)
+ {
+- return type;
++ /* Only IRAM and SRAM bars are valid */
++ switch (type) {
++ case SOF_FW_BLK_TYPE_IRAM:
++ case SOF_FW_BLK_TYPE_SRAM:
++ return type;
++ default:
++ return -EINVAL;
++ }
+ }
+
+ static void imx8m_ipc_msg_data(struct snd_sof_dev *sdev,
+--
+2.33.0
+
--- /dev/null
+From 75fd712db437964333f0958e6ab97c8edec858fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Sep 2021 16:56:23 +0000
+Subject: cpufreq: schedutil: Destroy mutex before kobject_put() frees the
+ memory
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit cdef1196608892b9a46caa5f2b64095a7f0be60c ]
+
+Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release()
+method to free sugov_tunables") kobject_put() has kfree()d the
+attr_set before gov_attr_set_put() returns.
+
+kobject_put() isn't the last user of attr_set in gov_attr_set_put(),
+the subsequent mutex_destroy() triggers a use-after-free:
+| BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60
+| Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20
+|
+| CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369
+| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development
+| Platform, BIOS EDK II Jul 30 2018
+| Call trace:
+| dump_backtrace+0x0/0x380
+| show_stack+0x1c/0x30
+| dump_stack_lvl+0x8c/0xb8
+| print_address_description.constprop.0+0x74/0x2b8
+| kasan_report+0x1f4/0x210
+| kasan_check_range+0xfc/0x1a4
+| __kasan_check_read+0x38/0x60
+| mutex_is_locked+0x20/0x60
+| mutex_destroy+0x80/0x100
+| gov_attr_set_put+0xfc/0x150
+| sugov_exit+0x78/0x190
+| cpufreq_offline.isra.0+0x2c0/0x660
+| cpuhp_cpufreq_offline+0x14/0x24
+| cpuhp_invoke_callback+0x430/0x6d0
+| cpuhp_thread_fun+0x1b0/0x624
+| smpboot_thread_fn+0x5e0/0xa6c
+| kthread+0x3a0/0x450
+| ret_from_fork+0x10/0x20
+
+Swap the order of the calls.
+
+Fixes: e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables")
+Cc: 4.7+ <stable@vger.kernel.org> # 4.7+
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c
+index 66b05a326910..a6f365b9cc1a 100644
+--- a/drivers/cpufreq/cpufreq_governor_attr_set.c
++++ b/drivers/cpufreq/cpufreq_governor_attr_set.c
+@@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l
+ if (count)
+ return count;
+
+- kobject_put(&attr_set->kobj);
+ mutex_destroy(&attr_set->update_lock);
++ kobject_put(&attr_set->kobj);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(gov_attr_set_put);
+--
+2.33.0
+
--- /dev/null
+From dd804afecb2dc90b74f1b40c2393ba2160ebb55e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 15:29:17 +0800
+Subject: cpufreq: schedutil: Use kobject release() method to free
+ sugov_tunables
+
+From: Kevin Hao <haokexin@gmail.com>
+
+[ Upstream commit e5c6b312ce3cc97e90ea159446e6bfa06645364d ]
+
+The struct sugov_tunables is protected by the kobject, so we can't free
+it directly. Otherwise we would get a call trace like this:
+ ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30
+ WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100
+ Modules linked in:
+ CPU: 3 PID: 720 Comm: a.sh Tainted: G W 5.14.0-rc1-next-20210715-yocto-standard+ #507
+ Hardware name: Marvell OcteonTX CN96XX board (DT)
+ pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--)
+ pc : debug_print_object+0xb8/0x100
+ lr : debug_print_object+0xb8/0x100
+ sp : ffff80001ecaf910
+ x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80
+ x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000
+ x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20
+ x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010
+ x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365
+ x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69
+ x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0
+ x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001
+ x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000
+ x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000
+ Call trace:
+ debug_print_object+0xb8/0x100
+ __debug_check_no_obj_freed+0x1c0/0x230
+ debug_check_no_obj_freed+0x20/0x88
+ slab_free_freelist_hook+0x154/0x1c8
+ kfree+0x114/0x5d0
+ sugov_exit+0xbc/0xc0
+ cpufreq_exit_governor+0x44/0x90
+ cpufreq_set_policy+0x268/0x4a8
+ store_scaling_governor+0xe0/0x128
+ store+0xc0/0xf0
+ sysfs_kf_write+0x54/0x80
+ kernfs_fop_write_iter+0x128/0x1c0
+ new_sync_write+0xf0/0x190
+ vfs_write+0x2d4/0x478
+ ksys_write+0x74/0x100
+ __arm64_sys_write+0x24/0x30
+ invoke_syscall.constprop.0+0x54/0xe0
+ do_el0_svc+0x64/0x158
+ el0_svc+0x2c/0xb0
+ el0t_64_sync_handler+0xb0/0xb8
+ el0t_64_sync+0x198/0x19c
+ irq event stamp: 5518
+ hardirqs last enabled at (5517): [<ffff8000100cbd7c>] console_unlock+0x554/0x6c8
+ hardirqs last disabled at (5518): [<ffff800010fc0638>] el1_dbg+0x28/0xa0
+ softirqs last enabled at (5504): [<ffff8000100106e0>] __do_softirq+0x4d0/0x6c0
+ softirqs last disabled at (5483): [<ffff800010049548>] irq_exit+0x1b0/0x1b8
+
+So split the original sugov_tunables_free() into two functions,
+sugov_clear_global_tunables() is just used to clear the global_tunables
+and the new sugov_tunables_free() is used as kobj_type::release to
+release the sugov_tunables safely.
+
+Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
+Cc: 4.7+ <stable@vger.kernel.org> # 4.7+
+Signed-off-by: Kevin Hao <haokexin@gmail.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/cpufreq_schedutil.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 57124614363d..e7af18857371 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -537,9 +537,17 @@ static struct attribute *sugov_attrs[] = {
+ };
+ ATTRIBUTE_GROUPS(sugov);
+
++static void sugov_tunables_free(struct kobject *kobj)
++{
++ struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj);
++
++ kfree(to_sugov_tunables(attr_set));
++}
++
+ static struct kobj_type sugov_tunables_ktype = {
+ .default_groups = sugov_groups,
+ .sysfs_ops = &governor_sysfs_ops,
++ .release = &sugov_tunables_free,
+ };
+
+ /********************** cpufreq governor interface *********************/
+@@ -639,12 +647,10 @@ static struct sugov_tunables *sugov_tunables_alloc(struct sugov_policy *sg_polic
+ return tunables;
+ }
+
+-static void sugov_tunables_free(struct sugov_tunables *tunables)
++static void sugov_clear_global_tunables(void)
+ {
+ if (!have_governor_per_policy())
+ global_tunables = NULL;
+-
+- kfree(tunables);
+ }
+
+ static int sugov_init(struct cpufreq_policy *policy)
+@@ -707,7 +713,7 @@ out:
+ fail:
+ kobject_put(&tunables->attr_set.kobj);
+ policy->governor_data = NULL;
+- sugov_tunables_free(tunables);
++ sugov_clear_global_tunables();
+
+ stop_kthread:
+ sugov_kthread_stop(sg_policy);
+@@ -734,7 +740,7 @@ static void sugov_exit(struct cpufreq_policy *policy)
+ count = gov_attr_set_put(&tunables->attr_set, &sg_policy->tunables_hook);
+ policy->governor_data = NULL;
+ if (!count)
+- sugov_tunables_free(tunables);
++ sugov_clear_global_tunables();
+
+ mutex_unlock(&global_tunables_lock);
+
+--
+2.33.0
+
--- /dev/null
+From 6970ec6aabb5232f356d962a7a9c2c94784c3877 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 16:04:27 +0300
+Subject: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 505d9dcb0f7ddf9d075e729523a33d38642ae680 ]
+
+There are three bugs in this code:
+
+1) If we ccp_init_data() fails for &src then we need to free aad.
+ Use goto e_aad instead of goto e_ctx.
+2) The label to free the &final_wa was named incorrectly as "e_tag" but
+ it should have been "e_final_wa". One error path leaked &final_wa.
+3) The &tag was leaked on one error path. In that case, I added a free
+ before the goto because the resource was local to that block.
+
+Fixes: 36cf515b9bbe ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
+Reported-by: "minihanshen(沈明航)" <minihanshen@tencent.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: John Allen <john.allen@amd.com>
+Tested-by: John Allen <john.allen@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-ops.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index bb88198c874e..aa4e1a500691 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -778,7 +778,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ in_place ? DMA_BIDIRECTIONAL
+ : DMA_TO_DEVICE);
+ if (ret)
+- goto e_ctx;
++ goto e_aad;
+
+ if (in_place) {
+ dst = src;
+@@ -863,7 +863,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ op.u.aes.size = 0;
+ ret = cmd_q->ccp->vdata->perform->aes(&op);
+ if (ret)
+- goto e_dst;
++ goto e_final_wa;
+
+ if (aes->action == CCP_AES_ACTION_ENCRYPT) {
+ /* Put the ciphered tag after the ciphertext. */
+@@ -873,17 +873,19 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ ret = ccp_init_dm_workarea(&tag, cmd_q, authsize,
+ DMA_BIDIRECTIONAL);
+ if (ret)
+- goto e_tag;
++ goto e_final_wa;
+ ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize);
+- if (ret)
+- goto e_tag;
++ if (ret) {
++ ccp_dm_free(&tag);
++ goto e_final_wa;
++ }
+
+ ret = crypto_memneq(tag.address, final_wa.address,
+ authsize) ? -EBADMSG : 0;
+ ccp_dm_free(&tag);
+ }
+
+-e_tag:
++e_final_wa:
+ ccp_dm_free(&final_wa);
+
+ e_dst:
+--
+2.33.0
+
--- /dev/null
+From fc22e871b7ceac78bfd6ca1cc62e4aff3b51c6fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 17:17:52 +0800
+Subject: drm/amdgpu: adjust fence driver enable sequence
+
+From: Likun Gao <Likun.Gao@amd.com>
+
+[ Upstream commit 8d35a2596164c1c9d34d4656fd42b445cd1e247f ]
+
+Fence driver was enabled per ring when sw init on per IP block before.
+Change to enable all the fence driver at the same time after
+amdgpu_device_ip_init finished.
+Rename some function related to fence to make it reasonable for read.
+
+Signed-off-by: Likun Gao <Likun.Gao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 10 +++--
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 44 +++-------------------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 7 ++--
+ 3 files changed, 14 insertions(+), 47 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 7b42636fc7dc..112add12707d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3631,6 +3631,8 @@ fence_driver_init:
+ goto release_ras_con;
+ }
+
++ amdgpu_fence_driver_hw_init(adev);
++
+ dev_info(adev->dev,
+ "SE %d, SH per SE %d, CU per SH %d, active_cu_number %d\n",
+ adev->gfx.config.max_shader_engines,
+@@ -3798,7 +3800,7 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev)
+ else
+ drm_atomic_helper_shutdown(adev_to_drm(adev));
+ }
+- amdgpu_fence_driver_fini_hw(adev);
++ amdgpu_fence_driver_hw_fini(adev);
+
+ if (adev->pm_sysfs_en)
+ amdgpu_pm_sysfs_fini(adev);
+@@ -3820,7 +3822,7 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev)
+ void amdgpu_device_fini_sw(struct amdgpu_device *adev)
+ {
+ amdgpu_device_ip_fini(adev);
+- amdgpu_fence_driver_fini_sw(adev);
++ amdgpu_fence_driver_sw_fini(adev);
+ release_firmware(adev->firmware.gpu_info_fw);
+ adev->firmware.gpu_info_fw = NULL;
+ adev->accel_working = false;
+@@ -3895,7 +3897,7 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon)
+ /* evict vram memory */
+ amdgpu_bo_evict_vram(adev);
+
+- amdgpu_fence_driver_suspend(adev);
++ amdgpu_fence_driver_hw_fini(adev);
+
+ amdgpu_device_ip_suspend_phase2(adev);
+ /* evict remaining vram memory
+@@ -3940,7 +3942,7 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon)
+ dev_err(adev->dev, "amdgpu_device_ip_resume failed (%d).\n", r);
+ return r;
+ }
+- amdgpu_fence_driver_resume(adev);
++ amdgpu_fence_driver_hw_init(adev);
+
+
+ r = amdgpu_device_ip_late_init(adev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+index 72d9b92b1754..49c5c7331c53 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+@@ -417,9 +417,6 @@ int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring,
+ }
+ amdgpu_fence_write(ring, atomic_read(&ring->fence_drv.last_seq));
+
+- if (irq_src)
+- amdgpu_irq_get(adev, irq_src, irq_type);
+-
+ ring->fence_drv.irq_src = irq_src;
+ ring->fence_drv.irq_type = irq_type;
+ ring->fence_drv.initialized = true;
+@@ -525,7 +522,7 @@ int amdgpu_fence_driver_init(struct amdgpu_device *adev)
+ *
+ * Tear down the fence driver for all possible rings (all asics).
+ */
+-void amdgpu_fence_driver_fini_hw(struct amdgpu_device *adev)
++void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev)
+ {
+ int i, r;
+
+@@ -553,7 +550,7 @@ void amdgpu_fence_driver_fini_hw(struct amdgpu_device *adev)
+ }
+ }
+
+-void amdgpu_fence_driver_fini_sw(struct amdgpu_device *adev)
++void amdgpu_fence_driver_sw_fini(struct amdgpu_device *adev)
+ {
+ unsigned int i, j;
+
+@@ -572,49 +569,18 @@ void amdgpu_fence_driver_fini_sw(struct amdgpu_device *adev)
+ }
+
+ /**
+- * amdgpu_fence_driver_suspend - suspend the fence driver
+- * for all possible rings.
+- *
+- * @adev: amdgpu device pointer
+- *
+- * Suspend the fence driver for all possible rings (all asics).
+- */
+-void amdgpu_fence_driver_suspend(struct amdgpu_device *adev)
+-{
+- int i, r;
+-
+- for (i = 0; i < AMDGPU_MAX_RINGS; i++) {
+- struct amdgpu_ring *ring = adev->rings[i];
+- if (!ring || !ring->fence_drv.initialized)
+- continue;
+-
+- /* wait for gpu to finish processing current batch */
+- r = amdgpu_fence_wait_empty(ring);
+- if (r) {
+- /* delay GPU reset to resume */
+- amdgpu_fence_driver_force_completion(ring);
+- }
+-
+- /* disable the interrupt */
+- if (ring->fence_drv.irq_src)
+- amdgpu_irq_put(adev, ring->fence_drv.irq_src,
+- ring->fence_drv.irq_type);
+- }
+-}
+-
+-/**
+- * amdgpu_fence_driver_resume - resume the fence driver
++ * amdgpu_fence_driver_hw_init - enable the fence driver
+ * for all possible rings.
+ *
+ * @adev: amdgpu device pointer
+ *
+- * Resume the fence driver for all possible rings (all asics).
++ * Enable the fence driver for all possible rings (all asics).
+ * Not all asics have all rings, so each asic will only
+ * start the fence driver on the rings it has using
+ * amdgpu_fence_driver_start_ring().
+ * Returns 0 for success.
+ */
+-void amdgpu_fence_driver_resume(struct amdgpu_device *adev)
++void amdgpu_fence_driver_hw_init(struct amdgpu_device *adev)
+ {
+ int i;
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+index e7d3d0dbdd96..27adffa7658d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+@@ -107,8 +107,6 @@ struct amdgpu_fence_driver {
+ };
+
+ int amdgpu_fence_driver_init(struct amdgpu_device *adev);
+-void amdgpu_fence_driver_fini_hw(struct amdgpu_device *adev);
+-void amdgpu_fence_driver_fini_sw(struct amdgpu_device *adev);
+ void amdgpu_fence_driver_force_completion(struct amdgpu_ring *ring);
+
+ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,
+@@ -117,8 +115,9 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,
+ int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring,
+ struct amdgpu_irq_src *irq_src,
+ unsigned irq_type);
+-void amdgpu_fence_driver_suspend(struct amdgpu_device *adev);
+-void amdgpu_fence_driver_resume(struct amdgpu_device *adev);
++void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev);
++void amdgpu_fence_driver_sw_fini(struct amdgpu_device *adev);
++void amdgpu_fence_driver_hw_init(struct amdgpu_device *adev);
+ int amdgpu_fence_emit(struct amdgpu_ring *ring, struct dma_fence **fence,
+ unsigned flags);
+ int amdgpu_fence_emit_polling(struct amdgpu_ring *ring, uint32_t *s,
+--
+2.33.0
+
--- /dev/null
+From 4a5748ca6c16030f63bb990e76087442f39525ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 18:35:13 +0800
+Subject: drm/amdgpu: avoid over-handle of fence driver fini in s3 test (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guchun Chen <guchun.chen@amd.com>
+
+[ Upstream commit 067f44c8b4590c3f24d21a037578a478590f2175 ]
+
+In amdgpu_fence_driver_hw_fini, no need to call drm_sched_fini to stop
+scheduler in s3 test, otherwise, fence related failure will arrive
+after resume. To fix this and for a better clean up, move drm_sched_fini
+from fence_hw_fini to fence_sw_fini, as it's part of driver shutdown, and
+should never be called in hw_fini.
+
+v2: rename amdgpu_fence_driver_init to amdgpu_fence_driver_sw_init,
+to keep sw_init and sw_fini paired.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1668
+Fixes: 8d35a2596164c1 ("drm/amdgpu: adjust fence driver enable sequence")
+Suggested-by: Christian König <christian.koenig@amd.com>
+Tested-by: Mike Lothian <mike@fireburn.co.uk>
+Signed-off-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 ++---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 12 +++++++-----
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 4 ++--
+ 3 files changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 112add12707d..d3247a5cceb4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3602,9 +3602,9 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+
+ fence_driver_init:
+ /* Fence driver */
+- r = amdgpu_fence_driver_init(adev);
++ r = amdgpu_fence_driver_sw_init(adev);
+ if (r) {
+- dev_err(adev->dev, "amdgpu_fence_driver_init failed\n");
++ dev_err(adev->dev, "amdgpu_fence_driver_sw_init failed\n");
+ amdgpu_vf_error_put(adev, AMDGIM_ERROR_VF_FENCE_INIT_FAIL, 0, 0);
+ goto failed;
+ }
+@@ -3944,7 +3944,6 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon)
+ }
+ amdgpu_fence_driver_hw_init(adev);
+
+-
+ r = amdgpu_device_ip_late_init(adev);
+ if (r)
+ return r;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+index 49c5c7331c53..7495911516c2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+@@ -498,7 +498,7 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,
+ }
+
+ /**
+- * amdgpu_fence_driver_init - init the fence driver
++ * amdgpu_fence_driver_sw_init - init the fence driver
+ * for all possible rings.
+ *
+ * @adev: amdgpu device pointer
+@@ -509,13 +509,13 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,
+ * amdgpu_fence_driver_start_ring().
+ * Returns 0 for success.
+ */
+-int amdgpu_fence_driver_init(struct amdgpu_device *adev)
++int amdgpu_fence_driver_sw_init(struct amdgpu_device *adev)
+ {
+ return 0;
+ }
+
+ /**
+- * amdgpu_fence_driver_fini - tear down the fence driver
++ * amdgpu_fence_driver_hw_fini - tear down the fence driver
+ * for all possible rings.
+ *
+ * @adev: amdgpu device pointer
+@@ -531,8 +531,7 @@ void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev)
+
+ if (!ring || !ring->fence_drv.initialized)
+ continue;
+- if (!ring->no_scheduler)
+- drm_sched_fini(&ring->sched);
++
+ /* You can't wait for HW to signal if it's gone */
+ if (!drm_dev_is_unplugged(&adev->ddev))
+ r = amdgpu_fence_wait_empty(ring);
+@@ -560,6 +559,9 @@ void amdgpu_fence_driver_sw_fini(struct amdgpu_device *adev)
+ if (!ring || !ring->fence_drv.initialized)
+ continue;
+
++ if (!ring->no_scheduler)
++ drm_sched_fini(&ring->sched);
++
+ for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j)
+ dma_fence_put(ring->fence_drv.fences[j]);
+ kfree(ring->fence_drv.fences);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+index 27adffa7658d..9c11ced4312c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+@@ -106,7 +106,6 @@ struct amdgpu_fence_driver {
+ struct dma_fence **fences;
+ };
+
+-int amdgpu_fence_driver_init(struct amdgpu_device *adev);
+ void amdgpu_fence_driver_force_completion(struct amdgpu_ring *ring);
+
+ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,
+@@ -115,9 +114,10 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,
+ int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring,
+ struct amdgpu_irq_src *irq_src,
+ unsigned irq_type);
++void amdgpu_fence_driver_hw_init(struct amdgpu_device *adev);
+ void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev);
++int amdgpu_fence_driver_sw_init(struct amdgpu_device *adev);
+ void amdgpu_fence_driver_sw_fini(struct amdgpu_device *adev);
+-void amdgpu_fence_driver_hw_init(struct amdgpu_device *adev);
+ int amdgpu_fence_emit(struct amdgpu_ring *ring, struct dma_fence **fence,
+ unsigned flags);
+ int amdgpu_fence_emit_polling(struct amdgpu_ring *ring, uint32_t *s,
+--
+2.33.0
+
--- /dev/null
+From 3d7bc1870c3c6e10cc1860a3b4993663388e0cc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 18:31:41 +0800
+Subject: drm/amdgpu: stop scheduler when calling hw_fini (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guchun Chen <guchun.chen@amd.com>
+
+[ Upstream commit f7d6779df642720e22bffd449e683bb8690bd3bf ]
+
+This gurantees no more work on the ring can be submitted
+to hardware in suspend/resume case, otherwise a potential
+race will occur and the ring will get no chance to stay
+empty before suspend.
+
+v2: Call drm_sched_resubmit_job before drm_sched_start to
+restart jobs from the pending list.
+
+Suggested-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Suggested-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+index 7495911516c2..49884069226a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+@@ -532,6 +532,9 @@ void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev)
+ if (!ring || !ring->fence_drv.initialized)
+ continue;
+
++ if (!ring->no_scheduler)
++ drm_sched_stop(&ring->sched, NULL);
++
+ /* You can't wait for HW to signal if it's gone */
+ if (!drm_dev_is_unplugged(&adev->ddev))
+ r = amdgpu_fence_wait_empty(ring);
+@@ -591,6 +594,11 @@ void amdgpu_fence_driver_hw_init(struct amdgpu_device *adev)
+ if (!ring || !ring->fence_drv.initialized)
+ continue;
+
++ if (!ring->no_scheduler) {
++ drm_sched_resubmit_jobs(&ring->sched);
++ drm_sched_start(&ring->sched, true);
++ }
++
+ /* enable the interrupt */
+ if (ring->fence_drv.irq_src)
+ amdgpu_irq_get(adev, ring->fence_drv.irq_src,
+--
+2.33.0
+
--- /dev/null
+From 28f388a7a15160fe20aee1c1e57b473dcdc8d21c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jun 2021 19:38:01 +0300
+Subject: HID: amd_sfh: Fix potential NULL pointer dereference
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit d46ef750ed58cbeeba2d9a55c99231c30a172764 ]
+
+devm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at
+registration that will cause NULL pointer dereference since
+corresponding data is not initialized yet. The patch moves
+initialization of data before devm_add_action_or_reset().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+[jkosina@suse.cz: rebase]
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+index 8d68796aa905..4069b813c6c3 100644
+--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+@@ -235,6 +235,10 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
+ return rc;
+ }
+
++ rc = amd_sfh_hid_client_init(privdata);
++ if (rc)
++ return rc;
++
+ privdata->cl_data = devm_kzalloc(&pdev->dev, sizeof(struct amdtp_cl_data), GFP_KERNEL);
+ if (!privdata->cl_data)
+ return -ENOMEM;
+@@ -245,7 +249,7 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
+
+ mp2_select_ops(privdata);
+
+- return amd_sfh_hid_client_init(privdata);
++ return 0;
+ }
+
+ static const struct pci_device_id amd_mp2_pci_tbl[] = {
+--
+2.33.0
+
--- /dev/null
+From fa1364e84880e92d3be96254bf29e7e6b7b2913b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Sep 2021 14:05:47 -0700
+Subject: igc: fix build errors for PTP
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 87758511075ec961486fe78d7548dd709b524433 ]
+
+When IGC=y and PTP_1588_CLOCK=m, the ptp_*() interface family is
+not available to the igc driver. Make this driver depend on
+PTP_1588_CLOCK_OPTIONAL so that it will build without errors.
+
+Various igc commits have used ptp_*() functions without checking
+that PTP_1588_CLOCK is enabled. Fix all of these here.
+
+Fixes these build errors:
+
+ld: drivers/net/ethernet/intel/igc/igc_main.o: in function `igc_msix_other':
+igc_main.c:(.text+0x6494): undefined reference to `ptp_clock_event'
+ld: igc_main.c:(.text+0x64ef): undefined reference to `ptp_clock_event'
+ld: igc_main.c:(.text+0x6559): undefined reference to `ptp_clock_event'
+ld: drivers/net/ethernet/intel/igc/igc_ethtool.o: in function `igc_ethtool_get_ts_info':
+igc_ethtool.c:(.text+0xc7a): undefined reference to `ptp_clock_index'
+ld: drivers/net/ethernet/intel/igc/igc_ptp.o: in function `igc_ptp_feature_enable_i225':
+igc_ptp.c:(.text+0x330): undefined reference to `ptp_find_pin'
+ld: igc_ptp.c:(.text+0x36f): undefined reference to `ptp_find_pin'
+ld: drivers/net/ethernet/intel/igc/igc_ptp.o: in function `igc_ptp_init':
+igc_ptp.c:(.text+0x11cd): undefined reference to `ptp_clock_register'
+ld: drivers/net/ethernet/intel/igc/igc_ptp.o: in function `igc_ptp_stop':
+igc_ptp.c:(.text+0x12dd): undefined reference to `ptp_clock_unregister'
+ld: drivers/platform/x86/dell/dell-wmi-privacy.o: in function `dell_privacy_wmi_probe':
+
+Fixes: 64433e5bf40ab ("igc: Enable internal i225 PPS")
+Fixes: 60dbede0c4f3d ("igc: Add support for ethtool GET_TS_INFO command")
+Fixes: 87938851b6efb ("igc: enable auxiliary PHC functions for the i225")
+Fixes: 5f2958052c582 ("igc: Add basic skeleton for PTP")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Ederson de Souza <ederson.desouza@intel.com>
+Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
+Cc: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Cc: intel-wired-lan@lists.osuosl.org
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
+index 82744a7501c7..c11d974a62d8 100644
+--- a/drivers/net/ethernet/intel/Kconfig
++++ b/drivers/net/ethernet/intel/Kconfig
+@@ -335,6 +335,7 @@ config IGC
+ tristate "Intel(R) Ethernet Controller I225-LM/I225-V support"
+ default n
+ depends on PCI
++ depends on PTP_1588_CLOCK_OPTIONAL
+ help
+ This driver supports Intel(R) Ethernet Controller I225-LM/I225-V
+ family of adapters.
+--
+2.33.0
+
--- /dev/null
+From eb904617153332cbf158926e2bebea941a4b247e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 15:43:23 -0700
+Subject: kasan: fix Kconfig check of CC_HAS_WORKING_NOSANITIZE_ADDRESS
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit fa360beac4b62d54879a88b182afef4b369c9700 ]
+
+In the main KASAN config option CC_HAS_WORKING_NOSANITIZE_ADDRESS is
+checked for instrumentation-based modes. However, if
+HAVE_ARCH_KASAN_HW_TAGS is true all modes may still be selected.
+
+To fix, also make the software modes depend on
+CC_HAS_WORKING_NOSANITIZE_ADDRESS.
+
+Link: https://lkml.kernel.org/r/20210910084240.1215803-1-elver@google.com
+Fixes: 6a63a63ff1ac ("kasan: introduce CONFIG_KASAN_HW_TAGS")
+Signed-off-by: Marco Elver <elver@google.com>
+Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Aleksandr Nogikh <nogikh@google.com>
+Cc: Taras Madan <tarasmadan@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/Kconfig.kasan | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
+index 1e2d10f86011..cdc842d090db 100644
+--- a/lib/Kconfig.kasan
++++ b/lib/Kconfig.kasan
+@@ -66,6 +66,7 @@ choice
+ config KASAN_GENERIC
+ bool "Generic mode"
+ depends on HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC
++ depends on CC_HAS_WORKING_NOSANITIZE_ADDRESS
+ select SLUB_DEBUG if SLUB
+ select CONSTRUCTORS
+ help
+@@ -86,6 +87,7 @@ config KASAN_GENERIC
+ config KASAN_SW_TAGS
+ bool "Software tag-based mode"
+ depends on HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS
++ depends on CC_HAS_WORKING_NOSANITIZE_ADDRESS
+ select SLUB_DEBUG if SLUB
+ select CONSTRUCTORS
+ help
+--
+2.33.0
+
--- /dev/null
+From d42a99f0adfb3f26c4bcc6c0c4a54837d07cfa66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jul 2021 17:19:45 +0000
+Subject: m68k: Update ->thread.esp0 before calling syscall_trace() in
+ ret_from_signal
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 50e43a57334400668952f8e551c9d87d3ed2dfef ]
+
+We get there when sigreturn has performed obscene acts on kernel stack;
+in particular, the location of pt_regs has shifted. We are about to call
+syscall_trace(), which might stop for tracer. If that happens, we'd better
+have task_pt_regs() returning correct result...
+
+Fucked-up-by: Al Viro <viro@zeniv.linux.org.uk>
+Fixes: bd6f56a75bb2 ("m68k: Missing syscall_trace() on sigreturn")
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Reviewed-by: Michael Schmitz <schmitzmic@gmail.com>
+Tested-by: Finn Thain <fthain@linux-m68k.org>
+Link: https://lore.kernel.org/r/YP2dMWeV1LkHiOpr@zeniv-ca.linux.org.uk
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/kernel/entry.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
+index 9dd76fbb7c6b..ff9e842cec0f 100644
+--- a/arch/m68k/kernel/entry.S
++++ b/arch/m68k/kernel/entry.S
+@@ -186,6 +186,8 @@ ENTRY(ret_from_signal)
+ movel %curptr@(TASK_STACK),%a1
+ tstb %a1@(TINFO_FLAGS+2)
+ jge 1f
++ lea %sp@(SWITCH_STACK_SIZE),%a1
++ movel %a1,%curptr@(TASK_THREAD+THREAD_ESP0)
+ jbsr syscall_trace
+ 1: RESTORE_SWITCH_STACK
+ addql #4,%sp
+--
+2.33.0
+
--- /dev/null
+From c83c5c7bb48af1177f0320d944fee9b4f5cba49f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 16:00:09 +0200
+Subject: media: cedrus: Fix SUNXI tile size calculation
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 132c88614f2b3548cd3c8979a434609019db4151 ]
+
+Tiled formats requires full rows being allocated (even for Chroma
+planes). When the number of Luma tiles is odd, we need to round up
+to twice the tile width in order to roundup the number of Chroma
+tiles.
+
+This was notice with a crash running BA1_FT_C compliance test using
+sunxi tiles using GStreamer. Cedrus driver would allocate 9 rows for
+Luma, but only 4.5 rows for Chroma, causing userspace to crash.
+
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Fixes: 50e761516f2b8 ("media: platform: Add Cedrus VPU decoder driver")
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus_video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_video.c b/drivers/staging/media/sunxi/cedrus/cedrus_video.c
+index 32c13ecb22d8..a8168ac2fbd0 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_video.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_video.c
+@@ -135,7 +135,7 @@ void cedrus_prepare_format(struct v4l2_pix_format *pix_fmt)
+ sizeimage = bytesperline * height;
+
+ /* Chroma plane size. */
+- sizeimage += bytesperline * height / 2;
++ sizeimage += bytesperline * ALIGN(height, 64) / 2;
+
+ break;
+
+--
+2.33.0
+
--- /dev/null
+From 729a44bf7fd3f26028a0e23bfb3c25f91179c123 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 21:04:16 +0200
+Subject: media: hantro: Fix check for single irq
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 31692ab9a9ef0119959f66838de74eeb37490c8d ]
+
+Some cores use only one interrupt and in such case interrupt name in DT
+is not needed. Driver supposedly accounted that, but due to the wrong
+field check it never worked. Fix that.
+
+Fixes: 18d6c8b7b4c9 ("media: hantro: add fallback handling for single irq/clk")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/hantro/hantro_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/hantro/hantro_drv.c b/drivers/staging/media/hantro/hantro_drv.c
+index 31d8449ca1d2..fc769c52c6d3 100644
+--- a/drivers/staging/media/hantro/hantro_drv.c
++++ b/drivers/staging/media/hantro/hantro_drv.c
+@@ -918,7 +918,7 @@ static int hantro_probe(struct platform_device *pdev)
+ if (!vpu->variant->irqs[i].handler)
+ continue;
+
+- if (vpu->variant->num_clocks > 1) {
++ if (vpu->variant->num_irqs > 1) {
+ irq_name = vpu->variant->irqs[i].name;
+ irq = platform_get_irq_byname(vpu->pdev, irq_name);
+ } else {
+--
+2.33.0
+
--- /dev/null
+From 8ee555a7f96a43ba4242f38d3b8e8694d174320c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Sep 2021 06:40:22 +0200
+Subject: media: s5p-jpeg: rename JPEG marker constants to prevent build
+ warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 3ad02c27d89d72b3b49ac51899144b7d0942f05f ]
+
+The use of a macro named 'RST' conflicts with one of the same name
+in arch/mips/include/asm/mach-rc32434/rb.h. This causes build
+warnings on some MIPS builds.
+
+Change the names of the JPEG marker constants to be in their own
+namespace to fix these build warnings and to prevent other similar
+problems in the future.
+
+Fixes these build warnings:
+
+In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c:14:
+../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined
+ 43 | #define RST 0xd0
+ |
+../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition
+ 13 | #define RST (1 << 15)
+
+In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-s5p.c:13:
+../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined
+ 43 | #define RST 0xd0
+../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition
+ 13 | #define RST (1 << 15)
+
+In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-exynos4.c:12:
+../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined
+ 43 | #define RST 0xd0
+../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition
+ 13 | #define RST (1 << 15)
+
+In file included from ../drivers/media/platform/s5p-jpeg/jpeg-core.c:31:
+../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined
+ 43 | #define RST 0xd0
+../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition
+ 13 | #define RST (1 << 15)
+
+Also update the kernel-doc so that the word "marker" is not
+repeated.
+
+Link: https://lore.kernel.org/linux-media/20210907044022.30602-1-rdunlap@infradead.org
+Fixes: bb677f3ac434 ("[media] Exynos4 JPEG codec v4l2 driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Andrzej Pietrasiewicz <andrzejtp2010@gmail.com>
+Cc: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/s5p-jpeg/jpeg-core.c | 18 ++++++-------
+ drivers/media/platform/s5p-jpeg/jpeg-core.h | 28 ++++++++++-----------
+ 2 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+index d402e456f27d..7d0ab19c38bb 100644
+--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+@@ -1140,8 +1140,8 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result,
+ continue;
+ length = 0;
+ switch (c) {
+- /* SOF0: baseline JPEG */
+- case SOF0:
++ /* JPEG_MARKER_SOF0: baseline JPEG */
++ case JPEG_MARKER_SOF0:
+ if (get_word_be(&jpeg_buffer, &word))
+ break;
+ length = (long)word - 2;
+@@ -1172,7 +1172,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result,
+ notfound = 0;
+ break;
+
+- case DQT:
++ case JPEG_MARKER_DQT:
+ if (get_word_be(&jpeg_buffer, &word))
+ break;
+ length = (long)word - 2;
+@@ -1185,7 +1185,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result,
+ skip(&jpeg_buffer, length);
+ break;
+
+- case DHT:
++ case JPEG_MARKER_DHT:
+ if (get_word_be(&jpeg_buffer, &word))
+ break;
+ length = (long)word - 2;
+@@ -1198,15 +1198,15 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result,
+ skip(&jpeg_buffer, length);
+ break;
+
+- case SOS:
++ case JPEG_MARKER_SOS:
+ sos = jpeg_buffer.curr - 2; /* 0xffda */
+ break;
+
+ /* skip payload-less markers */
+- case RST ... RST + 7:
+- case SOI:
+- case EOI:
+- case TEM:
++ case JPEG_MARKER_RST ... JPEG_MARKER_RST + 7:
++ case JPEG_MARKER_SOI:
++ case JPEG_MARKER_EOI:
++ case JPEG_MARKER_TEM:
+ break;
+
+ /* skip uninteresting payload markers */
+diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.h b/drivers/media/platform/s5p-jpeg/jpeg-core.h
+index a77d93c098ce..8473a019bb5f 100644
+--- a/drivers/media/platform/s5p-jpeg/jpeg-core.h
++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.h
+@@ -37,15 +37,15 @@
+ #define EXYNOS3250_IRQ_TIMEOUT 0x10000000
+
+ /* a selection of JPEG markers */
+-#define TEM 0x01
+-#define SOF0 0xc0
+-#define DHT 0xc4
+-#define RST 0xd0
+-#define SOI 0xd8
+-#define EOI 0xd9
+-#define SOS 0xda
+-#define DQT 0xdb
+-#define DHP 0xde
++#define JPEG_MARKER_TEM 0x01
++#define JPEG_MARKER_SOF0 0xc0
++#define JPEG_MARKER_DHT 0xc4
++#define JPEG_MARKER_RST 0xd0
++#define JPEG_MARKER_SOI 0xd8
++#define JPEG_MARKER_EOI 0xd9
++#define JPEG_MARKER_SOS 0xda
++#define JPEG_MARKER_DQT 0xdb
++#define JPEG_MARKER_DHP 0xde
+
+ /* Flags that indicate a format can be used for capture/output */
+ #define SJPEG_FMT_FLAG_ENC_CAPTURE (1 << 0)
+@@ -187,11 +187,11 @@ struct s5p_jpeg_marker {
+ * @fmt: driver-specific format of this queue
+ * @w: image width
+ * @h: image height
+- * @sos: SOS marker's position relative to the buffer beginning
+- * @dht: DHT markers' positions relative to the buffer beginning
+- * @dqt: DQT markers' positions relative to the buffer beginning
+- * @sof: SOF0 marker's position relative to the buffer beginning
+- * @sof_len: SOF0 marker's payload length (without length field itself)
++ * @sos: JPEG_MARKER_SOS's position relative to the buffer beginning
++ * @dht: JPEG_MARKER_DHT' positions relative to the buffer beginning
++ * @dqt: JPEG_MARKER_DQT' positions relative to the buffer beginning
++ * @sof: JPEG_MARKER_SOF0's position relative to the buffer beginning
++ * @sof_len: JPEG_MARKER_SOF0's payload length (without length field itself)
+ * @size: image buffer size in bytes
+ */
+ struct s5p_jpeg_q_data {
+--
+2.33.0
+
--- /dev/null
+From a350dd3b2be40df87d72d11aa1713e225d57d704 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Sep 2021 14:55:45 +0300
+Subject: net/mlx4_en: Resolve bad operstate value
+
+From: Lama Kayal <lkayal@nvidia.com>
+
+[ Upstream commit 72a3c58d18fd780eecd80178bb2132ce741a0a74 ]
+
+Any link state change that's done prior to net device registration
+isn't reflected on the state, thus the operational state is left
+obsolete, with 'UNKNOWN' status.
+
+To resolve the issue, query link state from FW upon open operations
+to ensure operational state is updated.
+
+Fixes: c27a02cd94d6 ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC")
+Signed-off-by: Lama Kayal <lkayal@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx4/en_netdev.c | 47 ++++++++++++-------
+ drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 -
+ 2 files changed, 29 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 1e672bc36c4d..a6878e5f922a 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1272,7 +1272,6 @@ static void mlx4_en_do_set_rx_mode(struct work_struct *work)
+ if (!netif_carrier_ok(dev)) {
+ if (!mlx4_en_QUERY_PORT(mdev, priv->port)) {
+ if (priv->port_state.link_state) {
+- priv->last_link_state = MLX4_DEV_EVENT_PORT_UP;
+ netif_carrier_on(dev);
+ en_dbg(LINK, priv, "Link Up\n");
+ }
+@@ -1560,26 +1559,36 @@ static void mlx4_en_service_task(struct work_struct *work)
+ mutex_unlock(&mdev->state_lock);
+ }
+
+-static void mlx4_en_linkstate(struct work_struct *work)
++static void mlx4_en_linkstate(struct mlx4_en_priv *priv)
++{
++ struct mlx4_en_port_state *port_state = &priv->port_state;
++ struct mlx4_en_dev *mdev = priv->mdev;
++ struct net_device *dev = priv->dev;
++ bool up;
++
++ if (mlx4_en_QUERY_PORT(mdev, priv->port))
++ port_state->link_state = MLX4_PORT_STATE_DEV_EVENT_PORT_DOWN;
++
++ up = port_state->link_state == MLX4_PORT_STATE_DEV_EVENT_PORT_UP;
++ if (up == netif_carrier_ok(dev))
++ netif_carrier_event(dev);
++ if (!up) {
++ en_info(priv, "Link Down\n");
++ netif_carrier_off(dev);
++ } else {
++ en_info(priv, "Link Up\n");
++ netif_carrier_on(dev);
++ }
++}
++
++static void mlx4_en_linkstate_work(struct work_struct *work)
+ {
+ struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
+ linkstate_task);
+ struct mlx4_en_dev *mdev = priv->mdev;
+- int linkstate = priv->link_state;
+
+ mutex_lock(&mdev->state_lock);
+- /* If observable port state changed set carrier state and
+- * report to system log */
+- if (priv->last_link_state != linkstate) {
+- if (linkstate == MLX4_DEV_EVENT_PORT_DOWN) {
+- en_info(priv, "Link Down\n");
+- netif_carrier_off(priv->dev);
+- } else {
+- en_info(priv, "Link Up\n");
+- netif_carrier_on(priv->dev);
+- }
+- }
+- priv->last_link_state = linkstate;
++ mlx4_en_linkstate(priv);
+ mutex_unlock(&mdev->state_lock);
+ }
+
+@@ -2082,9 +2091,11 @@ static int mlx4_en_open(struct net_device *dev)
+ mlx4_en_clear_stats(dev);
+
+ err = mlx4_en_start_port(dev);
+- if (err)
++ if (err) {
+ en_err(priv, "Failed starting port:%d\n", priv->port);
+-
++ goto out;
++ }
++ mlx4_en_linkstate(priv);
+ out:
+ mutex_unlock(&mdev->state_lock);
+ return err;
+@@ -3171,7 +3182,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ spin_lock_init(&priv->stats_lock);
+ INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode);
+ INIT_WORK(&priv->restart_task, mlx4_en_restart);
+- INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate);
++ INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate_work);
+ INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats);
+ INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task);
+ #ifdef CONFIG_RFS_ACCEL
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index f3d1a20201ef..6bf558c5ec10 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -552,7 +552,6 @@ struct mlx4_en_priv {
+
+ struct mlx4_hwq_resources res;
+ int link_state;
+- int last_link_state;
+ bool port_up;
+ int port;
+ int registered;
+--
+2.33.0
+
--- /dev/null
+From fb6d58180d4f15d8ec1f87d16d52a8505d228ab8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Sep 2021 17:29:39 -0700
+Subject: NIOS2: fix kconfig unmet dependency warning for SERIAL_CORE_CONSOLE
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit adfc8f9d2f9fefd880abc82cfbf62cbfe6539c97 ]
+
+SERIAL_CORE_CONSOLE depends on TTY so EARLY_PRINTK should also
+depend on TTY so that it does not select SERIAL_CORE_CONSOLE
+inadvertently.
+
+WARNING: unmet direct dependencies detected for SERIAL_CORE_CONSOLE
+ Depends on [n]: TTY [=n] && HAS_IOMEM [=y]
+ Selected by [y]:
+ - EARLY_PRINTK [=y]
+
+Fixes: e8bf5bc776ed ("nios2: add early printk support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/Kconfig.debug | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/nios2/Kconfig.debug b/arch/nios2/Kconfig.debug
+index a8bc06e96ef5..ca1beb87f987 100644
+--- a/arch/nios2/Kconfig.debug
++++ b/arch/nios2/Kconfig.debug
+@@ -3,9 +3,10 @@
+ config EARLY_PRINTK
+ bool "Activate early kernel debugging"
+ default y
++ depends on TTY
+ select SERIAL_CORE_CONSOLE
+ help
+- Enable early printk on console
++ Enable early printk on console.
+ This is useful for kernel debugging when your machine crashes very
+ early before the console code is initialized.
+ You should normally say N here, unless you want to debug such a crash.
+--
+2.33.0
+
--- /dev/null
+From 5585c4d0a8e30d020c17bdbab6f8c071f1c8bc0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Sep 2021 16:11:15 +0800
+Subject: perf iostat: Fix Segmentation fault from NULL 'struct
+ perf_counts_values *'
+
+From: Like Xu <likexu@tencent.com>
+
+[ Upstream commit 4da8b121884d84476f3d50d46a471471af1aa9df ]
+
+If the 'perf iostat' user specifies two or more iio_root_ports and also
+specifies the cpu(s) by -C which is not *connected to all* the above iio
+ports, the iostat_print_metric() will run into trouble:
+
+For example:
+
+ $ perf iostat list
+ S0-uncore_iio_0<0000:16>
+ S1-uncore_iio_0<0000:97> # <--- CPU 1 is located in the socket S0
+
+ $ perf iostat 0000:16,0000:97 -C 1 -- ls
+ port Inbound Read(MB) Inbound Write(MB) Outbound Read(MB) Outbound
+ Write(MB) ../perf-iostat: line 12: 104418 Segmentation fault
+ (core dumped) perf stat --iostat$DELIMITER$*
+
+The core-dump stack says, in the above corner case, the returned
+(struct perf_counts_values *) count will be NULL, and the caller
+iostat_print_metric() apparently doesn't not handle this case.
+
+ 433 struct perf_counts_values *count = perf_counts(evsel->counts, die, 0);
+ 434
+ 435 if (count->run && count->ena) {
+ (gdb) p count
+ $1 = (struct perf_counts_values *) 0x0
+
+The deeper reason is that there are actually no statistics from the user
+specified pair "iostat 0000:X, -C (disconnected) Y ", but let's fix it with
+minimum cost by adding a NULL check in the user space.
+
+Fixes: f9ed693e8bc0e7de ("perf stat: Enable iostat mode for x86 platforms")
+Signed-off-by: Like Xu <likexu@tencent.com>
+Cc: Alexander Antonov <alexander.antonov@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lore.kernel.org/lkml/20210927081115.39568-2-likexu@tencent.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/arch/x86/util/iostat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/arch/x86/util/iostat.c b/tools/perf/arch/x86/util/iostat.c
+index eeafe97b8105..792cd75ade33 100644
+--- a/tools/perf/arch/x86/util/iostat.c
++++ b/tools/perf/arch/x86/util/iostat.c
+@@ -432,7 +432,7 @@ void iostat_print_metric(struct perf_stat_config *config, struct evsel *evsel,
+ u8 die = ((struct iio_root_port *)evsel->priv)->die;
+ struct perf_counts_values *count = perf_counts(evsel->counts, die, 0);
+
+- if (count->run && count->ena) {
++ if (count && count->run && count->ena) {
+ if (evsel->prev_raw_counts && !out->force_header) {
+ struct perf_counts_values *prev_count =
+ perf_counts(evsel->prev_raw_counts, die, 0);
+--
+2.33.0
+
--- /dev/null
+From f21ba66b4f36a3e6eb6b7a2756d096048684a1ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Sep 2021 16:11:14 +0800
+Subject: perf iostat: Use system-wide mode if the target cpu_list is
+ unspecified
+
+From: Like Xu <likexu@tencent.com>
+
+[ Upstream commit e4fe5d7349e0b1c0d3da5b6b3e1efce591e85bd2 ]
+
+An iostate use case like "perf iostat 0000:16,0000:97 -- ls" should be
+implemented to work in system-wide mode to ensure that the output from
+print_header() is consistent with the user documentation perf-iostat.txt,
+rather than incorrectly assuming that the kernel does not support it:
+
+ Error:
+ The sys_perf_event_open() syscall returned with 22 (Invalid argument) \
+ for event (uncore_iio_0/event=0x83,umask=0x04,ch_mask=0xF,fc_mask=0x07/).
+ /bin/dmesg | grep -i perf may provide additional information.
+
+This error is easily fixed by assigning system-wide mode by default
+for IOSTAT_RUN only when the target cpu_list is unspecified.
+
+Fixes: f07952b179697771 ("perf stat: Basic support for iostat in perf")
+Signed-off-by: Like Xu <likexu@tencent.com>
+Cc: Alexander Antonov <alexander.antonov@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lore.kernel.org/lkml/20210927081115.39568-1-likexu@tencent.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-stat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 634375937db9..36033a7372f9 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -2406,6 +2406,8 @@ int cmd_stat(int argc, const char **argv)
+ goto out;
+ } else if (verbose)
+ iostat_list(evsel_list, &stat_config);
++ if (iostat_mode == IOSTAT_RUN && !target__has_cpu(&target))
++ target.system_wide = true;
+ }
+
+ if (add_default_attributes())
+--
+2.33.0
+
--- /dev/null
+From f8c0521aa428c00575dd282fcd3aca76cf65c95e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Sep 2021 10:38:12 -0700
+Subject: perf test: Fix DWARF unwind for optimized builds.
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 5c34aea341b16e29fde6e6c8d4b18866cd99754d ]
+
+To ensure the stack frames are on the stack tail calls optimizations
+need to be inhibited. If your compiler supports an attribute use it,
+otherwise use an asm volatile barrier.
+
+The barrier fix was suggested here:
+https://lore.kernel.org/lkml/20201028081123.GT2628@hirez.programming.kicks-ass.net/
+Tested with an optimized clang build and by forcing the asm barrier
+route with an optimized clang build.
+
+A GCC bug tracking a proper disable_tail_calls is:
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97831
+
+Fixes: 9ae1e990f1ab ("perf tools: Remove broken __no_tail_call
+ attribute")
+
+v2. is a rebase. The original fix patch generated quite a lot of
+ discussion over the right place for the fix:
+ https://lore.kernel.org/lkml/20201114000803.909530-1-irogers@google.com/
+ The patch reflects my preference of it being near the use, so that
+ future code cleanups don't break this somewhat special usage.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Miguel Ojeda <ojeda@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: clang-built-linux@googlegroups.com
+Link: http://lore.kernel.org/lkml/20210922173812.456348-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/dwarf-unwind.c | 39 +++++++++++++++++++++++++++------
+ 1 file changed, 32 insertions(+), 7 deletions(-)
+
+diff --git a/tools/perf/tests/dwarf-unwind.c b/tools/perf/tests/dwarf-unwind.c
+index a288035eb362..c756284b3b13 100644
+--- a/tools/perf/tests/dwarf-unwind.c
++++ b/tools/perf/tests/dwarf-unwind.c
+@@ -20,6 +20,23 @@
+ /* For bsearch. We try to unwind functions in shared object. */
+ #include <stdlib.h>
+
++/*
++ * The test will assert frames are on the stack but tail call optimizations lose
++ * the frame of the caller. Clang can disable this optimization on a called
++ * function but GCC currently (11/2020) lacks this attribute. The barrier is
++ * used to inhibit tail calls in these cases.
++ */
++#ifdef __has_attribute
++#if __has_attribute(disable_tail_calls)
++#define NO_TAIL_CALL_ATTRIBUTE __attribute__((disable_tail_calls))
++#define NO_TAIL_CALL_BARRIER
++#endif
++#endif
++#ifndef NO_TAIL_CALL_ATTRIBUTE
++#define NO_TAIL_CALL_ATTRIBUTE
++#define NO_TAIL_CALL_BARRIER __asm__ __volatile__("" : : : "memory");
++#endif
++
+ static int mmap_handler(struct perf_tool *tool __maybe_unused,
+ union perf_event *event,
+ struct perf_sample *sample,
+@@ -91,7 +108,7 @@ static int unwind_entry(struct unwind_entry *entry, void *arg)
+ return strcmp((const char *) symbol, funcs[idx]);
+ }
+
+-noinline int test_dwarf_unwind__thread(struct thread *thread)
++NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__thread(struct thread *thread)
+ {
+ struct perf_sample sample;
+ unsigned long cnt = 0;
+@@ -122,7 +139,7 @@ noinline int test_dwarf_unwind__thread(struct thread *thread)
+
+ static int global_unwind_retval = -INT_MAX;
+
+-noinline int test_dwarf_unwind__compare(void *p1, void *p2)
++NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__compare(void *p1, void *p2)
+ {
+ /* Any possible value should be 'thread' */
+ struct thread *thread = *(struct thread **)p1;
+@@ -141,7 +158,7 @@ noinline int test_dwarf_unwind__compare(void *p1, void *p2)
+ return p1 - p2;
+ }
+
+-noinline int test_dwarf_unwind__krava_3(struct thread *thread)
++NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__krava_3(struct thread *thread)
+ {
+ struct thread *array[2] = {thread, thread};
+ void *fp = &bsearch;
+@@ -160,14 +177,22 @@ noinline int test_dwarf_unwind__krava_3(struct thread *thread)
+ return global_unwind_retval;
+ }
+
+-noinline int test_dwarf_unwind__krava_2(struct thread *thread)
++NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__krava_2(struct thread *thread)
+ {
+- return test_dwarf_unwind__krava_3(thread);
++ int ret;
++
++ ret = test_dwarf_unwind__krava_3(thread);
++ NO_TAIL_CALL_BARRIER;
++ return ret;
+ }
+
+-noinline int test_dwarf_unwind__krava_1(struct thread *thread)
++NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__krava_1(struct thread *thread)
+ {
+- return test_dwarf_unwind__krava_2(thread);
++ int ret;
++
++ ret = test_dwarf_unwind__krava_2(thread);
++ NO_TAIL_CALL_BARRIER;
++ return ret;
+ }
+
+ int test__dwarf_unwind(struct test *test __maybe_unused, int subtest __maybe_unused)
+--
+2.33.0
+
--- /dev/null
+From 8eb3c70874a656442e1d74a15bfaa37abeac0be4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 18:51:37 +0530
+Subject: pinctrl: qcom: spmi-gpio: correct parent irqspec translation
+
+From: David Collins <collinsd@codeaurora.org>
+
+[ Upstream commit d36a97736b2cc9b13db0dfdf6f32b115ec193614 ]
+
+pmic_gpio_child_to_parent_hwirq() and
+gpiochip_populate_parent_fwspec_fourcell() translate a pinctrl-
+spmi-gpio irqspec to an SPMI controller irqspec. When they do
+this, they use a fixed SPMI slave ID of 0 and a fixed GPIO
+peripheral offset of 0xC0 (corresponding to SPMI address 0xC000).
+This translation results in an incorrect irqspec for secondary
+PMICs that don't have a slave ID of 0 as well as for PMIC chips
+which have GPIO peripherals located at a base address other than
+0xC000.
+
+Correct this issue by passing the slave ID of the pinctrl-spmi-
+gpio device's parent in the SPMI controller irqspec and by
+calculating the peripheral ID base from the device tree 'reg'
+property of the pinctrl-spmi-gpio device.
+
+Signed-off-by: David Collins <collinsd@codeaurora.org>
+Signed-off-by: satya priya <skakit@codeaurora.org>
+Fixes: ca69e2d165eb ("qcom: spmi-gpio: add support for hierarchical IRQ chip")
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1631798498-10864-2-git-send-email-skakit@codeaurora.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 37 ++++++++++++++++++++++--
+ 1 file changed, 34 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+index a89d24a040af..9b524969eff7 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2012-2014, 2016-2021 The Linux Foundation. All rights reserved.
+ */
+
+ #include <linux/gpio/driver.h>
+@@ -14,6 +14,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/regmap.h>
+ #include <linux/slab.h>
++#include <linux/spmi.h>
+ #include <linux/types.h>
+
+ #include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
+@@ -171,6 +172,8 @@ struct pmic_gpio_state {
+ struct pinctrl_dev *ctrl;
+ struct gpio_chip chip;
+ struct irq_chip irq;
++ u8 usid;
++ u8 pid_base;
+ };
+
+ static const struct pinconf_generic_params pmic_gpio_bindings[] = {
+@@ -949,12 +952,36 @@ static int pmic_gpio_child_to_parent_hwirq(struct gpio_chip *chip,
+ unsigned int *parent_hwirq,
+ unsigned int *parent_type)
+ {
+- *parent_hwirq = child_hwirq + 0xc0;
++ struct pmic_gpio_state *state = gpiochip_get_data(chip);
++
++ *parent_hwirq = child_hwirq + state->pid_base;
+ *parent_type = child_type;
+
+ return 0;
+ }
+
++static void *pmic_gpio_populate_parent_fwspec(struct gpio_chip *chip,
++ unsigned int parent_hwirq,
++ unsigned int parent_type)
++{
++ struct pmic_gpio_state *state = gpiochip_get_data(chip);
++ struct irq_fwspec *fwspec;
++
++ fwspec = kzalloc(sizeof(*fwspec), GFP_KERNEL);
++ if (!fwspec)
++ return NULL;
++
++ fwspec->fwnode = chip->irq.parent_domain->fwnode;
++
++ fwspec->param_count = 4;
++ fwspec->param[0] = state->usid;
++ fwspec->param[1] = parent_hwirq;
++ /* param[2] must be left as 0 */
++ fwspec->param[3] = parent_type;
++
++ return fwspec;
++}
++
+ static int pmic_gpio_probe(struct platform_device *pdev)
+ {
+ struct irq_domain *parent_domain;
+@@ -965,6 +992,7 @@ static int pmic_gpio_probe(struct platform_device *pdev)
+ struct pmic_gpio_pad *pad, *pads;
+ struct pmic_gpio_state *state;
+ struct gpio_irq_chip *girq;
++ const struct spmi_device *parent_spmi_dev;
+ int ret, npins, i;
+ u32 reg;
+
+@@ -984,6 +1012,9 @@ static int pmic_gpio_probe(struct platform_device *pdev)
+
+ state->dev = &pdev->dev;
+ state->map = dev_get_regmap(dev->parent, NULL);
++ parent_spmi_dev = to_spmi_device(dev->parent);
++ state->usid = parent_spmi_dev->usid;
++ state->pid_base = reg >> 8;
+
+ pindesc = devm_kcalloc(dev, npins, sizeof(*pindesc), GFP_KERNEL);
+ if (!pindesc)
+@@ -1059,7 +1090,7 @@ static int pmic_gpio_probe(struct platform_device *pdev)
+ girq->fwnode = of_node_to_fwnode(state->dev->of_node);
+ girq->parent_domain = parent_domain;
+ girq->child_to_parent_hwirq = pmic_gpio_child_to_parent_hwirq;
+- girq->populate_parent_alloc_arg = gpiochip_populate_parent_fwspec_fourcell;
++ girq->populate_parent_alloc_arg = pmic_gpio_populate_parent_fwspec;
+ girq->child_offset_to_irq = pmic_gpio_child_offset_to_irq;
+ girq->child_irq_domain_ops.translate = pmic_gpio_domain_translate;
+
+--
+2.33.0
+
--- /dev/null
+From ea0ee1aa2b11f726f3ff38a4e724b09f4455ef8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 16:52:17 +0200
+Subject: s390/qeth: fix deadlock during failing recovery
+
+From: Alexandra Winter <wintera@linux.ibm.com>
+
+[ Upstream commit d2b59bd4b06d84a4eadb520b0f71c62fe8ec0a62 ]
+
+Commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") removed
+taking discipline_mutex inside qeth_do_reset(), fixing potential
+deadlocks. An error path was missed though, that still takes
+discipline_mutex and thus has the original deadlock potential.
+
+Intermittent deadlocks were seen when a qeth channel path is configured
+offline, causing a race between qeth_do_reset and ccwgroup_remove.
+Call qeth_set_offline() directly in the qeth_do_reset() error case and
+then a new variant of ccwgroup_set_offline(), without taking
+discipline_mutex.
+
+Fixes: b41b554c1ee7 ("s390/qeth: fix locking for discipline setup / removal")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/ccwgroup.h | 2 +-
+ drivers/s390/cio/ccwgroup.c | 10 ++++++++--
+ drivers/s390/net/qeth_core_main.c | 3 ++-
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/arch/s390/include/asm/ccwgroup.h b/arch/s390/include/asm/ccwgroup.h
+index 20f169b6db4e..d97301d9d0b8 100644
+--- a/arch/s390/include/asm/ccwgroup.h
++++ b/arch/s390/include/asm/ccwgroup.h
+@@ -57,7 +57,7 @@ struct ccwgroup_device *get_ccwgroupdev_by_busid(struct ccwgroup_driver *gdrv,
+ char *bus_id);
+
+ extern int ccwgroup_set_online(struct ccwgroup_device *gdev);
+-extern int ccwgroup_set_offline(struct ccwgroup_device *gdev);
++int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv);
+
+ extern int ccwgroup_probe_ccwdev(struct ccw_device *cdev);
+ extern void ccwgroup_remove_ccwdev(struct ccw_device *cdev);
+diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
+index 9748165e08e9..f19f02e75115 100644
+--- a/drivers/s390/cio/ccwgroup.c
++++ b/drivers/s390/cio/ccwgroup.c
+@@ -77,12 +77,13 @@ EXPORT_SYMBOL(ccwgroup_set_online);
+ /**
+ * ccwgroup_set_offline() - disable a ccwgroup device
+ * @gdev: target ccwgroup device
++ * @call_gdrv: Call the registered gdrv set_offline function
+ *
+ * This function attempts to put the ccwgroup device into the offline state.
+ * Returns:
+ * %0 on success and a negative error value on failure.
+ */
+-int ccwgroup_set_offline(struct ccwgroup_device *gdev)
++int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv)
+ {
+ struct ccwgroup_driver *gdrv = to_ccwgroupdrv(gdev->dev.driver);
+ int ret = -EINVAL;
+@@ -91,11 +92,16 @@ int ccwgroup_set_offline(struct ccwgroup_device *gdev)
+ return -EAGAIN;
+ if (gdev->state == CCWGROUP_OFFLINE)
+ goto out;
++ if (!call_gdrv) {
++ ret = 0;
++ goto offline;
++ }
+ if (gdrv->set_offline)
+ ret = gdrv->set_offline(gdev);
+ if (ret)
+ goto out;
+
++offline:
+ gdev->state = CCWGROUP_OFFLINE;
+ out:
+ atomic_set(&gdev->onoff, 0);
+@@ -124,7 +130,7 @@ static ssize_t ccwgroup_online_store(struct device *dev,
+ if (value == 1)
+ ret = ccwgroup_set_online(gdev);
+ else if (value == 0)
+- ret = ccwgroup_set_offline(gdev);
++ ret = ccwgroup_set_offline(gdev, true);
+ else
+ ret = -EINVAL;
+ out:
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index dba3b345218f..f5bad10f3f44 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -5548,7 +5548,8 @@ static int qeth_do_reset(void *data)
+ dev_info(&card->gdev->dev,
+ "Device successfully recovered!\n");
+ } else {
+- ccwgroup_set_offline(card->gdev);
++ qeth_set_offline(card, disc, true);
++ ccwgroup_set_offline(card->gdev, false);
+ dev_warn(&card->gdev->dev,
+ "The qeth device driver failed to recover an error on the device\n");
+ }
+--
+2.33.0
+
--- /dev/null
+From 44775b8358cdd3c9a88bfe6034c2daf27feef5c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 16:52:16 +0200
+Subject: s390/qeth: Fix deadlock in remove_discipline
+
+From: Alexandra Winter <wintera@linux.ibm.com>
+
+[ Upstream commit ee909d0b1dac8632eeb78cbf17661d6c7674bbd0 ]
+
+Problem: qeth_close_dev_handler is a worker that tries to acquire
+card->discipline_mutex via drv->set_offline() in ccwgroup_set_offline().
+Since commit b41b554c1ee7
+("s390/qeth: fix locking for discipline setup / removal")
+qeth_remove_discipline() is called under card->discipline_mutex and
+cancels the work and waits for it to finish.
+
+STOPLAN reception with reason code IPA_RC_VEPA_TO_VEB_TRANSITION is the
+only situation that schedules close_dev_work. In that situation scheduling
+qeth recovery will also result in an offline interface, when resetting the
+isolation mode fails, if the external switch is still set to VEB.
+And since commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery")
+qeth recovery does not aquire card->discipline_mutex anymore.
+
+So we accept the longer pathlength of qeth_schedule_recovery in this
+error situation and re-use the existing function.
+
+As a side-benefit this changes the hwtrap to behave like during recovery
+instead of like during a user-triggered set_offline.
+
+Fixes: b41b554c1ee7 ("s390/qeth: fix locking for discipline setup / removal")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Acked-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core.h | 1 -
+ drivers/s390/net/qeth_core_main.c | 16 ++++------------
+ drivers/s390/net/qeth_l2_main.c | 1 -
+ drivers/s390/net/qeth_l3_main.c | 1 -
+ 4 files changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index f4d554ea0c93..52bdb2c8c085 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -877,7 +877,6 @@ struct qeth_card {
+ struct napi_struct napi;
+ struct qeth_rx rx;
+ struct delayed_work buffer_reclaim_work;
+- struct work_struct close_dev_work;
+ };
+
+ static inline bool qeth_card_hw_is_reachable(struct qeth_card *card)
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 51f7f4e680c3..dba3b345218f 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -71,15 +71,6 @@ static void qeth_issue_next_read_cb(struct qeth_card *card,
+ static int qeth_qdio_establish(struct qeth_card *);
+ static void qeth_free_qdio_queues(struct qeth_card *card);
+
+-static void qeth_close_dev_handler(struct work_struct *work)
+-{
+- struct qeth_card *card;
+-
+- card = container_of(work, struct qeth_card, close_dev_work);
+- QETH_CARD_TEXT(card, 2, "cldevhdl");
+- ccwgroup_set_offline(card->gdev);
+-}
+-
+ static const char *qeth_get_cardname(struct qeth_card *card)
+ {
+ if (IS_VM_NIC(card)) {
+@@ -797,10 +788,12 @@ static struct qeth_ipa_cmd *qeth_check_ipa_data(struct qeth_card *card,
+ case IPA_CMD_STOPLAN:
+ if (cmd->hdr.return_code == IPA_RC_VEPA_TO_VEB_TRANSITION) {
+ dev_err(&card->gdev->dev,
+- "Interface %s is down because the adjacent port is no longer in reflective relay mode\n",
++ "Adjacent port of interface %s is no longer in reflective relay mode, trigger recovery\n",
+ netdev_name(card->dev));
+- schedule_work(&card->close_dev_work);
++ /* Set offline, then probably fail to set online: */
++ qeth_schedule_recovery(card);
+ } else {
++ /* stay online for subsequent STARTLAN */
+ dev_warn(&card->gdev->dev,
+ "The link for interface %s on CHPID 0x%X failed\n",
+ netdev_name(card->dev), card->info.chpid);
+@@ -1559,7 +1552,6 @@ static void qeth_setup_card(struct qeth_card *card)
+ INIT_LIST_HEAD(&card->ipato.entries);
+ qeth_init_qdio_info(card);
+ INIT_DELAYED_WORK(&card->buffer_reclaim_work, qeth_buffer_reclaim_work);
+- INIT_WORK(&card->close_dev_work, qeth_close_dev_handler);
+ hash_init(card->rx_mode_addrs);
+ hash_init(card->local_addrs4);
+ hash_init(card->local_addrs6);
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index d7cdd9cfe485..3dbe592ca97a 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -2218,7 +2218,6 @@ static void qeth_l2_remove_device(struct ccwgroup_device *gdev)
+ if (gdev->state == CCWGROUP_ONLINE)
+ qeth_set_offline(card, card->discipline, false);
+
+- cancel_work_sync(&card->close_dev_work);
+ if (card->dev->reg_state == NETREG_REGISTERED)
+ unregister_netdev(card->dev);
+ }
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index f0d6f205c53c..5ba38499e3e2 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -1965,7 +1965,6 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
+ if (cgdev->state == CCWGROUP_ONLINE)
+ qeth_set_offline(card, card->discipline, false);
+
+- cancel_work_sync(&card->close_dev_work);
+ if (card->dev->reg_state == NETREG_REGISTERED)
+ unregister_netdev(card->dev);
+
+--
+2.33.0
+
--- /dev/null
+From 52a822f92583da3c50633925f82954bc1a0288fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 16:10:50 -0700
+Subject: scsi: elx: efct: Fix void-pointer-to-enum-cast warning for
+ efc_nport_topology
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 96fafe7c6523886308605d30ec92c7936abe7c2c ]
+
+The kernel test robot flagged an warning for ".../efc_device.c:932:6:
+warning: cast to smaller integer type 'enum efc_nport_topology' from 'void
+*'"
+
+For the topology events, the "arg" field is generically defined as a void *
+and is used to pass different arguments. Most of the arguments are pointers
+to data structures. But for the EFC_EVT_NPORT_TOPOLOGY_NOTIFY event, the
+argument is an enum value, and the code is typecasting the void * to an
+enum generating the warning.
+
+Fix by converting the EFC_EVT_NPORT_TOPOLOGY_NOTIFY event to pass a pointer
+to the enum, thus it's a straight-forward pointer dereference in the event
+handler.
+
+Link: https://lore.kernel.org/r/20210830231050.5951-1-jsmart2021@gmail.com
+Fixes: 202bfdffae27 ("scsi: elx: libefc: FC node ELS and state handling")
+Reported-by: kernel test robot <lkp@intel.com>
+Co-developed-by: Ram Vegesna <ram.vegesna@broadcom.com>
+Signed-off-by: Ram Vegesna <ram.vegesna@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/elx/libefc/efc_device.c | 7 +++----
+ drivers/scsi/elx/libefc/efc_fabric.c | 3 +--
+ 2 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/elx/libefc/efc_device.c b/drivers/scsi/elx/libefc/efc_device.c
+index 725ca2a23fb2..52be01333c6e 100644
+--- a/drivers/scsi/elx/libefc/efc_device.c
++++ b/drivers/scsi/elx/libefc/efc_device.c
+@@ -928,22 +928,21 @@ __efc_d_wait_topology_notify(struct efc_sm_ctx *ctx,
+ break;
+
+ case EFC_EVT_NPORT_TOPOLOGY_NOTIFY: {
+- enum efc_nport_topology topology =
+- (enum efc_nport_topology)arg;
++ enum efc_nport_topology *topology = arg;
+
+ WARN_ON(node->nport->domain->attached);
+
+ WARN_ON(node->send_ls_acc != EFC_NODE_SEND_LS_ACC_PLOGI);
+
+ node_printf(node, "topology notification, topology=%d\n",
+- topology);
++ *topology);
+
+ /* At the time the PLOGI was received, the topology was unknown,
+ * so we didn't know which node would perform the domain attach:
+ * 1. The node from which the PLOGI was sent (p2p) or
+ * 2. The node to which the FLOGI was sent (fabric).
+ */
+- if (topology == EFC_NPORT_TOPO_P2P) {
++ if (*topology == EFC_NPORT_TOPO_P2P) {
+ /* if this is p2p, need to attach to the domain using
+ * the d_id from the PLOGI received
+ */
+diff --git a/drivers/scsi/elx/libefc/efc_fabric.c b/drivers/scsi/elx/libefc/efc_fabric.c
+index d397220d9e54..3270ce40196c 100644
+--- a/drivers/scsi/elx/libefc/efc_fabric.c
++++ b/drivers/scsi/elx/libefc/efc_fabric.c
+@@ -107,7 +107,6 @@ void
+ efc_fabric_notify_topology(struct efc_node *node)
+ {
+ struct efc_node *tmp_node;
+- enum efc_nport_topology topology = node->nport->topology;
+ unsigned long index;
+
+ /*
+@@ -118,7 +117,7 @@ efc_fabric_notify_topology(struct efc_node *node)
+ if (tmp_node != node) {
+ efc_node_post_event(tmp_node,
+ EFC_EVT_NPORT_TOPOLOGY_NOTIFY,
+- (void *)topology);
++ &node->nport->topology);
+ }
+ }
+ }
+--
+2.33.0
+
--- /dev/null
+From 5ff5b696c56be4fa91a0cf17411dcc46c62d6a05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 21:37:18 -0700
+Subject: scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS
+
+From: Saurav Kashyap <skashyap@marvell.com>
+
+[ Upstream commit 4a0a542fe5e4273baf9228459ef3f75c29490cba ]
+
+The MSI-X and MSI calls fails in kdump kernel. Because of this
+qla2xxx_create_qpair() fails leading to .create_queue callback failure.
+The fix is to return existing qpair instead of allocating new one and
+allocate a single hw queue.
+
+[ 19.975838] qla2xxx [0000:d8:00.1]-00c7:11: MSI-X: Failed to enable support,
+giving up -- 16/-28.
+[ 19.984885] qla2xxx [0000:d8:00.1]-0037:11: Falling back-to MSI mode --
+ret=-28.
+[ 19.992278] qla2xxx [0000:d8:00.1]-0039:11: Falling back-to INTa mode --
+ret=-28.
+..
+..
+..
+[ 21.141518] qla2xxx [0000:d8:00.0]-2104:2: qla_nvme_alloc_queue: handle
+00000000e7ee499d, idx =1, qsize 32
+[ 21.151166] qla2xxx [0000:d8:00.0]-0181:2: FW/Driver is not multi-queue capable.
+[ 21.158558] qla2xxx [0000:d8:00.0]-2122:2: Failed to allocate qpair
+[ 21.164824] nvme nvme0: NVME-FC{0}: reset: Reconnect attempt failed (-22)
+[ 21.171612] nvme nvme0: NVME-FC{0}: Reconnect attempt in 2 seconds
+
+Link: https://lore.kernel.org/r/20210810043720.1137-13-njavali@marvell.com
+Cc: stable@vger.kernel.org
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 1 -
+ drivers/scsi/qla2xxx/qla_isr.c | 2 ++
+ drivers/scsi/qla2xxx/qla_nvme.c | 40 +++++++++++++++------------------
+ 3 files changed, 20 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index 2f67ec1df3e6..82b6f4c2eb4a 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -3935,7 +3935,6 @@ struct qla_hw_data {
+ uint32_t scm_supported_f:1;
+ /* Enabled in Driver */
+ uint32_t scm_enabled:1;
+- uint32_t max_req_queue_warned:1;
+ uint32_t plogi_template_valid:1;
+ uint32_t port_isolated:1;
+ } flags;
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index d9fb093a60a1..2aa8f519aae6 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -4201,6 +4201,8 @@ skip_msi:
+ ql_dbg(ql_dbg_init, vha, 0x0125,
+ "INTa mode: Enabled.\n");
+ ha->flags.mr_intr_valid = 1;
++ /* Set max_qpair to 0, as MSI-X and MSI in not enabled */
++ ha->max_qpairs = 0;
+ }
+
+ clear_risc_ints:
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index a7259733e470..9316d7d91e2a 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -109,19 +109,24 @@ static int qla_nvme_alloc_queue(struct nvme_fc_local_port *lport,
+ return -EINVAL;
+ }
+
+- if (ha->queue_pair_map[qidx]) {
+- *handle = ha->queue_pair_map[qidx];
+- ql_log(ql_log_info, vha, 0x2121,
+- "Returning existing qpair of %p for idx=%x\n",
+- *handle, qidx);
+- return 0;
+- }
++ /* Use base qpair if max_qpairs is 0 */
++ if (!ha->max_qpairs) {
++ qpair = ha->base_qpair;
++ } else {
++ if (ha->queue_pair_map[qidx]) {
++ *handle = ha->queue_pair_map[qidx];
++ ql_log(ql_log_info, vha, 0x2121,
++ "Returning existing qpair of %p for idx=%x\n",
++ *handle, qidx);
++ return 0;
++ }
+
+- qpair = qla2xxx_create_qpair(vha, 5, vha->vp_idx, true);
+- if (qpair == NULL) {
+- ql_log(ql_log_warn, vha, 0x2122,
+- "Failed to allocate qpair\n");
+- return -EINVAL;
++ qpair = qla2xxx_create_qpair(vha, 5, vha->vp_idx, true);
++ if (!qpair) {
++ ql_log(ql_log_warn, vha, 0x2122,
++ "Failed to allocate qpair\n");
++ return -EINVAL;
++ }
+ }
+ *handle = qpair;
+
+@@ -728,18 +733,9 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha)
+
+ WARN_ON(vha->nvme_local_port);
+
+- if (ha->max_req_queues < 3) {
+- if (!ha->flags.max_req_queue_warned)
+- ql_log(ql_log_info, vha, 0x2120,
+- "%s: Disabling FC-NVME due to lack of free queue pairs (%d).\n",
+- __func__, ha->max_req_queues);
+- ha->flags.max_req_queue_warned = 1;
+- return ret;
+- }
+-
+ qla_nvme_fc_transport.max_hw_queues =
+ min((uint8_t)(qla_nvme_fc_transport.max_hw_queues),
+- (uint8_t)(ha->max_req_queues - 2));
++ (uint8_t)(ha->max_qpairs ? ha->max_qpairs : 1));
+
+ pinfo.node_name = wwn_to_u64(vha->node_name);
+ pinfo.port_name = wwn_to_u64(vha->port_name);
+--
+2.33.0
+
--- /dev/null
+From beb2f41f12554ea4eb4a2b16c0b16efc26dcf0f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Sep 2021 16:36:01 +0300
+Subject: scsi: ufs: ufs-pci: Fix Intel LKF link stability
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 1cbc9ad3eecd492be33b727b4606ae75bc880676 upstream.
+
+Intel LKF can experience link errors. Make fixes to increase link
+stability, especially when switching to high speed modes.
+
+Link: https://lore.kernel.org/r/20210831145317.26306-1-adrian.hunter@intel.com
+Fixes: b2c57925df1f ("scsi: ufs: ufs-pci: Add support for Intel LKF")
+Cc: stable@vger.kernel.org
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd-pci.c | 78 +++++++++++++++++++++++++++++++++++
+ drivers/scsi/ufs/ufshcd.c | 3 +-
+ drivers/scsi/ufs/ufshcd.h | 1 +
+ 3 files changed, 81 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd-pci.c b/drivers/scsi/ufs/ufshcd-pci.c
+index e6c334bfb4c2..40acca04d03b 100644
+--- a/drivers/scsi/ufs/ufshcd-pci.c
++++ b/drivers/scsi/ufs/ufshcd-pci.c
+@@ -128,6 +128,81 @@ static int ufs_intel_link_startup_notify(struct ufs_hba *hba,
+ return err;
+ }
+
++static int ufs_intel_set_lanes(struct ufs_hba *hba, u32 lanes)
++{
++ struct ufs_pa_layer_attr pwr_info = hba->pwr_info;
++ int ret;
++
++ pwr_info.lane_rx = lanes;
++ pwr_info.lane_tx = lanes;
++ ret = ufshcd_config_pwr_mode(hba, &pwr_info);
++ if (ret)
++ dev_err(hba->dev, "%s: Setting %u lanes, err = %d\n",
++ __func__, lanes, ret);
++ return ret;
++}
++
++static int ufs_intel_lkf_pwr_change_notify(struct ufs_hba *hba,
++ enum ufs_notify_change_status status,
++ struct ufs_pa_layer_attr *dev_max_params,
++ struct ufs_pa_layer_attr *dev_req_params)
++{
++ int err = 0;
++
++ switch (status) {
++ case PRE_CHANGE:
++ if (ufshcd_is_hs_mode(dev_max_params) &&
++ (hba->pwr_info.lane_rx != 2 || hba->pwr_info.lane_tx != 2))
++ ufs_intel_set_lanes(hba, 2);
++ memcpy(dev_req_params, dev_max_params, sizeof(*dev_req_params));
++ break;
++ case POST_CHANGE:
++ if (ufshcd_is_hs_mode(dev_req_params)) {
++ u32 peer_granularity;
++
++ usleep_range(1000, 1250);
++ err = ufshcd_dme_peer_get(hba, UIC_ARG_MIB(PA_GRANULARITY),
++ &peer_granularity);
++ }
++ break;
++ default:
++ break;
++ }
++
++ return err;
++}
++
++static int ufs_intel_lkf_apply_dev_quirks(struct ufs_hba *hba)
++{
++ u32 granularity, peer_granularity;
++ u32 pa_tactivate, peer_pa_tactivate;
++ int ret;
++
++ ret = ufshcd_dme_get(hba, UIC_ARG_MIB(PA_GRANULARITY), &granularity);
++ if (ret)
++ goto out;
++
++ ret = ufshcd_dme_peer_get(hba, UIC_ARG_MIB(PA_GRANULARITY), &peer_granularity);
++ if (ret)
++ goto out;
++
++ ret = ufshcd_dme_get(hba, UIC_ARG_MIB(PA_TACTIVATE), &pa_tactivate);
++ if (ret)
++ goto out;
++
++ ret = ufshcd_dme_peer_get(hba, UIC_ARG_MIB(PA_TACTIVATE), &peer_pa_tactivate);
++ if (ret)
++ goto out;
++
++ if (granularity == peer_granularity) {
++ u32 new_peer_pa_tactivate = pa_tactivate + 2;
++
++ ret = ufshcd_dme_peer_set(hba, UIC_ARG_MIB(PA_TACTIVATE), new_peer_pa_tactivate);
++ }
++out:
++ return ret;
++}
++
+ #define INTEL_ACTIVELTR 0x804
+ #define INTEL_IDLELTR 0x808
+
+@@ -351,6 +426,7 @@ static int ufs_intel_lkf_init(struct ufs_hba *hba)
+ struct ufs_host *ufs_host;
+ int err;
+
++ hba->nop_out_timeout = 200;
+ hba->quirks |= UFSHCD_QUIRK_BROKEN_AUTO_HIBERN8;
+ hba->caps |= UFSHCD_CAP_CRYPTO;
+ err = ufs_intel_common_init(hba);
+@@ -381,6 +457,8 @@ static struct ufs_hba_variant_ops ufs_intel_lkf_hba_vops = {
+ .exit = ufs_intel_common_exit,
+ .hce_enable_notify = ufs_intel_hce_enable_notify,
+ .link_startup_notify = ufs_intel_link_startup_notify,
++ .pwr_change_notify = ufs_intel_lkf_pwr_change_notify,
++ .apply_dev_quirks = ufs_intel_lkf_apply_dev_quirks,
+ .resume = ufs_intel_resume,
+ .device_reset = ufs_intel_device_reset,
+ };
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 3a204324151a..bfc13f646d7b 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -4767,7 +4767,7 @@ static int ufshcd_verify_dev_init(struct ufs_hba *hba)
+ mutex_lock(&hba->dev_cmd.lock);
+ for (retries = NOP_OUT_RETRIES; retries > 0; retries--) {
+ err = ufshcd_exec_dev_cmd(hba, DEV_CMD_TYPE_NOP,
+- NOP_OUT_TIMEOUT);
++ hba->nop_out_timeout);
+
+ if (!err || err == -ETIMEDOUT)
+ break;
+@@ -9403,6 +9403,7 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
+ hba->dev = dev;
+ *hba_handle = hba;
+ hba->dev_ref_clk_freq = REF_CLK_FREQ_INVAL;
++ hba->nop_out_timeout = NOP_OUT_TIMEOUT;
+
+ INIT_LIST_HEAD(&hba->clk_list_head);
+
+diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
+index 86d4765a17b8..aa95deffb873 100644
+--- a/drivers/scsi/ufs/ufshcd.h
++++ b/drivers/scsi/ufs/ufshcd.h
+@@ -814,6 +814,7 @@ struct ufs_hba {
+ /* Device management request data */
+ struct ufs_dev_cmd dev_cmd;
+ ktime_t last_dme_cmd_tstamp;
++ int nop_out_timeout;
+
+ /* Keeps information of the UFS device connected to this host */
+ struct ufs_dev_info dev_info;
+--
+2.33.0
+
--- /dev/null
+media-hantro-fix-check-for-single-irq.patch
+media-cedrus-fix-sunxi-tile-size-calculation.patch
+media-s5p-jpeg-rename-jpeg-marker-constants-to-preve.patch
+asoc-fsl_sai-register-platform-component-before-regi.patch
+asoc-fsl_esai-register-platform-component-before-reg.patch
+asoc-fsl_micfil-register-platform-component-before-r.patch
+asoc-fsl_spdif-register-platform-component-before-re.patch
+asoc-fsl_xcvr-register-platform-component-before-reg.patch
+asoc-mediatek-common-handle-null-case-in-suspend-res.patch
+scsi-elx-efct-fix-void-pointer-to-enum-cast-warning-.patch
+asoc-sof-fix-dsp-oops-stack-dump-output-contents.patch
+asoc-sof-imx-imx8-bar-index-is-only-valid-for-iram-a.patch
+asoc-sof-imx-imx8m-bar-index-is-only-valid-for-iram-.patch
+pinctrl-qcom-spmi-gpio-correct-parent-irqspec-transl.patch
+igc-fix-build-errors-for-ptp.patch
+net-mlx4_en-resolve-bad-operstate-value.patch
+s390-qeth-fix-deadlock-in-remove_discipline.patch
+s390-qeth-fix-deadlock-during-failing-recovery.patch
+crypto-ccp-fix-resource-leaks-in-ccp_run_aes_gcm_cmd.patch
+m68k-update-thread.esp0-before-calling-syscall_trace.patch
+nios2-fix-kconfig-unmet-dependency-warning-for-seria.patch
+kasan-fix-kconfig-check-of-cc_has_working_nosanitize.patch
+hid-amd_sfh-fix-potential-null-pointer-dereference.patch
+perf-test-fix-dwarf-unwind-for-optimized-builds.patch
+perf-iostat-use-system-wide-mode-if-the-target-cpu_l.patch
+perf-iostat-fix-segmentation-fault-from-null-struct-.patch
+watchdog-sb_watchdog-fix-compilation-problem-due-to-.patch
+tty-fix-out-of-bound-vmalloc-access-in-imageblit.patch
+cpufreq-schedutil-use-kobject-release-method-to-free.patch
+scsi-qla2xxx-changes-to-support-kdump-kernel-for-nvm.patch
+drm-amdgpu-adjust-fence-driver-enable-sequence.patch
+drm-amdgpu-avoid-over-handle-of-fence-driver-fini-in.patch
+drm-amdgpu-stop-scheduler-when-calling-hw_fini-v2.patch
+cpufreq-schedutil-destroy-mutex-before-kobject_put-f.patch
+scsi-ufs-ufs-pci-fix-intel-lkf-link-stability.patch
--- /dev/null
+From 31a372d671958f5ec367c49df21290947b6b58c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jun 2021 10:45:09 -0300
+Subject: tty: Fix out-of-bound vmalloc access in imageblit
+
+From: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
+
+[ Upstream commit 3b0c406124719b625b1aba431659f5cdc24a982c ]
+
+This issue happens when a userspace program does an ioctl
+FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct
+containing only the fields xres, yres, and bits_per_pixel
+with values.
+
+If this struct is the same as the previous ioctl, the
+vc_resize() detects it and doesn't call the resize_screen(),
+leaving the fb_var_screeninfo incomplete. And this leads to
+the updatescrollmode() calculates a wrong value to
+fbcon_display->vrows, which makes the real_y() return a
+wrong value of y, and that value, eventually, causes
+the imageblit to access an out-of-bound address value.
+
+To solve this issue I made the resize_screen() be called
+even if the screen does not need any resizing, so it will
+"fix and fill" the fb_var_screeninfo independently.
+
+Cc: stable <stable@vger.kernel.org> # after 5.15-rc2 is out, give it time to bake
+Reported-and-tested-by: syzbot+858dc7a2f7ef07c2c219@syzkaller.appspotmail.com
+Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
+Link: https://lore.kernel.org/r/20210628134509.15895-1-igormtorrente@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/vt.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index cb72393f92d3..153d4a88ec9a 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1219,8 +1219,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ new_row_size = new_cols << 1;
+ new_screen_size = new_row_size * new_rows;
+
+- if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
+- return 0;
++ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) {
++ /*
++ * This function is being called here to cover the case
++ * where the userspace calls the FBIOPUT_VSCREENINFO twice,
++ * passing the same fb_var_screeninfo containing the fields
++ * yres/xres equal to a number non-multiple of vc_font.height
++ * and yres_virtual/xres_virtual equal to number lesser than the
++ * vc_font.height and yres/xres.
++ * In the second call, the struct fb_var_screeninfo isn't
++ * being modified by the underlying driver because of the
++ * if above, and this causes the fbcon_display->vrows to become
++ * negative and it eventually leads to out-of-bound
++ * access by the imageblit function.
++ * To give the correct values to the struct and to not have
++ * to deal with possible errors from the code below, we call
++ * the resize_screen here as well.
++ */
++ return resize_screen(vc, new_cols, new_rows, user);
++ }
+
+ if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size)
+ return -EINVAL;
+--
+2.33.0
+
--- /dev/null
+From 02024332805c64f7a5897b81a9592a5c5a8d339b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Sep 2021 15:32:20 +0800
+Subject: watchdog/sb_watchdog: fix compilation problem due to COMPILE_TEST
+
+From: Jackie Liu <liuyun01@kylinos.cn>
+
+[ Upstream commit c388a18957efdf31db8e97ec4d2d4b7dc1ca9a44 ]
+
+Compiling sb_watchdog needs to clearly define SIBYTE_HDR_FEATURES.
+In arch/mips/sibyte/Platform like:
+
+ cflags-$(CONFIG_SIBYTE_BCM112X) += \
+ -I$(srctree)/arch/mips/include/asm/mach-sibyte \
+ -DSIBYTE_HDR_FEATURES=SIBYTE_HDR_FMASK_1250_112x_ALL
+
+Otherwise, SIBYTE_HDR_FEATURES is SIBYTE_HDR_FMASK_ALL.
+SIBYTE_HDR_FMASK_ALL is mean:
+
+ #define SIBYTE_HDR_FMASK_ALL SIBYTE_HDR_FMASK_1250_ALL | SIBYTE_HDR_FMASK_112x_ALL \
+ | SIBYTE_HDR_FMASK_1480_ALL)
+
+So, If not limited to CPU_SB1, we will get such an error:
+
+ arch/mips/include/asm/sibyte/bcm1480_scd.h:261: error: "M_SPC_CFG_CLEAR" redefined [-Werror]
+ arch/mips/include/asm/sibyte/bcm1480_scd.h:262: error: "M_SPC_CFG_ENABLE" redefined [-Werror]
+
+Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
+Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index 546dfc1e2349..71cf3f503f16 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -1677,7 +1677,7 @@ config WDT_MTX1
+
+ config SIBYTE_WDOG
+ tristate "Sibyte SoC hardware watchdog"
+- depends on CPU_SB1 || (MIPS && COMPILE_TEST)
++ depends on CPU_SB1
+ help
+ Watchdog driver for the built in watchdog hardware in Sibyte
+ SoC processors. There are apparently two watchdog timers
+--
+2.33.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
