--- /dev/null
+From ef9ce66fab959c66d270bbee7ca79b92ee957893 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Tue, 3 Nov 2020 15:40:35 +0800
+Subject: ALSA: hda/realtek - Enable headphone for ASUS TM420
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit ef9ce66fab959c66d270bbee7ca79b92ee957893 upstream.
+
+ASUS TM420 had depop circuit for headphone.
+It need to turn on by COEF bit.
+
+[ fixed the missing enum definition by tiwai ]
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/3d6177d7023b4783bf2793861c577ada@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6300,6 +6300,7 @@ enum {
+ ALC255_FIXUP_XIAOMI_HEADSET_MIC,
+ ALC274_FIXUP_HP_MIC,
+ ALC274_FIXUP_HP_HEADSET_MIC,
++ ALC256_FIXUP_ASUS_HPE,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -7693,6 +7694,17 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC274_FIXUP_HP_MIC
+ },
++ [ALC256_FIXUP_ASUS_HPE] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Set EAPD high */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x0f },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x7778 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7876,6 +7888,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
++ SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE),
+ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS),
--- /dev/null
+From 8a8de09cb2adc119104f35044d1a840dd47aa9d8 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Tue, 27 Oct 2020 16:46:38 +0800
+Subject: ALSA: hda/realtek - Fixed HP headset Mic can't be detected
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit 8a8de09cb2adc119104f35044d1a840dd47aa9d8 upstream.
+
+System boot with plugged headset. It will not detect headset Mic.
+It will happen on cold boot restart resume state.
+Quirk by SSID change to quirk by pin verb.
+
+Fixes: 13468bfa8c58 ("ALSA: hda/realtek - set mic to auto detect on a HP AIO machine")
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/f42ae1ede1cf47029ae2bef1a42caf03@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 54 +++++++++++++++++++++++++++++++++---------
+ 1 file changed, 43 insertions(+), 11 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6008,6 +6008,27 @@ static void alc285_fixup_invalidate_dacs
+ snd_hda_override_wcaps(codec, 0x03, 0);
+ }
+
++static void alc_combo_jack_hp_jd_restart(struct hda_codec *codec)
++{
++ switch (codec->core.vendor_id) {
++ case 0x10ec0274:
++ case 0x10ec0294:
++ case 0x10ec0225:
++ case 0x10ec0295:
++ case 0x10ec0299:
++ alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */
++ alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15);
++ break;
++ case 0x10ec0235:
++ case 0x10ec0236:
++ case 0x10ec0255:
++ case 0x10ec0256:
++ alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */
++ alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15);
++ break;
++ }
++}
++
+ static void alc295_fixup_chromebook(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -6018,16 +6039,7 @@ static void alc295_fixup_chromebook(stru
+ spec->ultra_low_power = true;
+ break;
+ case HDA_FIXUP_ACT_INIT:
+- switch (codec->core.vendor_id) {
+- case 0x10ec0295:
+- alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */
+- alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15);
+- break;
+- case 0x10ec0236:
+- alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */
+- alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15);
+- break;
+- }
++ alc_combo_jack_hp_jd_restart(codec);
+ break;
+ }
+ }
+@@ -6083,6 +6095,16 @@ static void alc285_fixup_hp_gpio_amp_in
+ alc_write_coef_idx(codec, 0x65, 0x0);
+ }
+
++static void alc274_fixup_hp_headset_mic(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ switch (action) {
++ case HDA_FIXUP_ACT_INIT:
++ alc_combo_jack_hp_jd_restart(codec);
++ break;
++ }
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+
+@@ -6277,6 +6299,7 @@ enum {
+ ALC256_FIXUP_INTEL_NUC8_RUGGED,
+ ALC255_FIXUP_XIAOMI_HEADSET_MIC,
+ ALC274_FIXUP_HP_MIC,
++ ALC274_FIXUP_HP_HEADSET_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -7664,6 +7687,12 @@ static const struct hda_fixup alc269_fix
+ { }
+ },
+ },
++ [ALC274_FIXUP_HP_HEADSET_MIC] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc274_fixup_hp_headset_mic,
++ .chained = true,
++ .chain_id = ALC274_FIXUP_HP_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7815,7 +7844,6 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+- SND_PCI_QUIRK(0x103c, 0x874e, "HP", ALC274_FIXUP_HP_MIC),
+ SND_PCI_QUIRK(0x103c, 0x8760, "HP", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+@@ -8339,6 +8367,10 @@ static const struct snd_hda_pin_quirk al
+ {0x1a, 0x90a70130},
+ {0x1b, 0x90170110},
+ {0x21, 0x03211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x103c, "HP", ALC274_FIXUP_HP_HEADSET_MIC,
++ {0x17, 0x90170110},
++ {0x19, 0x03a11030},
++ {0x21, 0x03211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
+ {0x12, 0x90a60130},
+ {0x14, 0x90170110},
--- /dev/null
+From 26201ddc1373c99b2a67c5774da2f0eecd749b93 Mon Sep 17 00:00:00 2001
+From: "Geoffrey D. Bennett" <g@b4.vu>
+Date: Wed, 4 Nov 2020 22:37:05 +1030
+Subject: ALSA: usb-audio: Add implicit feedback quirk for MODX
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+commit 26201ddc1373c99b2a67c5774da2f0eecd749b93 upstream.
+
+This patch fixes audio distortion on playback for the Yamaha MODX.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Tested-by: Frank Slotta <frank.slotta@posteo.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201104120705.GA19126@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -346,6 +346,7 @@ static int set_sync_ep_implicit_fb_quirk
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x2466, 0x8003): /* Fractal Audio Axe-Fx II */
++ case USB_ID(0x0499, 0x172a): /* Yamaha MODX */
+ ep = 0x86;
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
--- /dev/null
+From 0938ecae432e7ac8b01080c35dd81d50a1e43033 Mon Sep 17 00:00:00 2001
+From: "Geoffrey D. Bennett" <g@b4.vu>
+Date: Wed, 4 Nov 2020 22:27:17 +1030
+Subject: ALSA: usb-audio: Add implicit feedback quirk for Qu-16
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+commit 0938ecae432e7ac8b01080c35dd81d50a1e43033 upstream.
+
+This patch fixes audio distortion on playback for the Allen&Heath
+Qu-16.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201104115717.GA19046@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -336,6 +336,7 @@ static int set_sync_ep_implicit_fb_quirk
+ switch (subs->stream->chip->usb_id) {
+ case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */
+ case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */
++ case USB_ID(0x22f0, 0x0006): /* Allen&Heath Qu-16 */
+ ep = 0x81;
+ ifnum = 3;
+ goto add_sync_ep_from_ifnum;
--- /dev/null
+From f15cfca818d756dd1c9492530091dfd583359db3 Mon Sep 17 00:00:00 2001
+From: Keith Winstein <keithw@cs.stanford.edu>
+Date: Sun, 25 Oct 2020 22:05:47 -0700
+Subject: ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2
+
+From: Keith Winstein <keithw@cs.stanford.edu>
+
+commit f15cfca818d756dd1c9492530091dfd583359db3 upstream.
+
+The Zoom UAC-2 USB audio interface provides an async playback endpoint
+("1 OUT (ASYNC)") and capture endpoint ("2 IN (ASYNC)"), both with
+2-channel S32_LE in 44.1, 48, 88.2, 96, 176.4, or 192
+kilosamples/s. The device provides explicit feedback to adjust the
+host's playback rate, but the feedback appears unstable and biased
+relative to the device's capture rate.
+
+"alsaloop -t 1000" experiences playback underruns and tries to
+resample the captured audio to match the varying playback
+rate. Forcing the kernel to use implicit feedback appears to
+produce more stable results. This causes the host to transmit one
+playback sample for each capture sample received. (Zoom North America
+has been notified of this change.)
+
+Signed-off-by: Keith Winstein <keithw@cs.stanford.edu>
+Tested-by: Keith Winstein <keithw@cs.stanford.edu>
+Cc: <stable@vger.kernel.org>
+BugLink: https://lore.kernel.org/r/20201027071841.GA164525@trolley.csail.mit.edu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -352,6 +352,10 @@ static int set_sync_ep_implicit_fb_quirk
+ ep = 0x81;
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
++ case USB_ID(0x1686, 0xf029): /* Zoom UAC-2 */
++ ep = 0x82;
++ ifnum = 2;
++ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x1397, 0x0001): /* Behringer UFX1604 */
+ case USB_ID(0x1397, 0x0002): /* Behringer UFX1204 */
+ ep = 0x81;
--- /dev/null
+From 07815a2b3501adeaae6384a25b9c4a9c81dae59f Mon Sep 17 00:00:00 2001
+From: Artem Lapkin <art@khadas.com>
+Date: Tue, 3 Nov 2020 18:08:09 +0800
+Subject: ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices
+
+From: Artem Lapkin <art@khadas.com>
+
+commit 07815a2b3501adeaae6384a25b9c4a9c81dae59f upstream.
+
+Khadas audio devices ( USB_ID_VENDOR 0x3353 )
+have DSD-capable implementations from XMOS
+need add new usb vendor id for recognition
+
+Signed-off-by: Artem Lapkin <art@khadas.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201103103311.5435-1-art@khadas.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1806,6 +1806,7 @@ u64 snd_usb_interface_dsd_format_quirks(
+ case 0x278b: /* Rotel? */
+ case 0x292b: /* Gustard/Ess based devices */
+ case 0x2ab6: /* T+A devices */
++ case 0x3353: /* Khadas devices */
+ case 0x3842: /* EVGA */
+ case 0xc502: /* HiBy devices */
+ if (fp->dsd_raw)
--- /dev/null
+From 26f4fd6d87cbf72376ee4f6a9dca1c95a3143563 Mon Sep 17 00:00:00 2001
+From: John Clements <john.clements@amd.com>
+Date: Tue, 3 Nov 2020 16:19:44 +0800
+Subject: drm/amdgpu: resolved ASD loading issue on sienna
+
+From: John Clements <john.clements@amd.com>
+
+commit 26f4fd6d87cbf72376ee4f6a9dca1c95a3143563 upstream.
+
+updated fw header v2 parser to set asd fw memory
+
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: John Clements <john.clements@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 5.9.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -2322,6 +2322,7 @@ int parse_ta_bin_descriptor(struct psp_c
+ psp->asd_feature_version = le32_to_cpu(desc->fw_version);
+ psp->asd_ucode_size = le32_to_cpu(desc->size_bytes);
+ psp->asd_start_addr = ucode_start_addr;
++ psp->asd_fw = psp->ta_fw;
+ break;
+ case TA_FW_TYPE_PSP_XGMI:
+ psp->ta_xgmi_ucode_version = le32_to_cpu(desc->fw_version);
--- /dev/null
+From a2404fd4823053db08d82582f4361e0978a98a24 Mon Sep 17 00:00:00 2001
+From: Likun Gao <Likun.Gao@amd.com>
+Date: Fri, 30 Oct 2020 14:22:03 +0800
+Subject: drm/amdgpu: update golden setting for sienna_cichlid
+
+From: Likun Gao <Likun.Gao@amd.com>
+
+commit a2404fd4823053db08d82582f4361e0978a98a24 upstream.
+
+Update golden setting for sienna_cichlid.
+
+Signed-off-by: Likun Gao <Likun.Gao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -128,6 +128,9 @@
+ #define PA_SC_ENHANCE_3__FORCE_PBB_WORKLOAD_MODE_TO_ZERO__SHIFT 0x3
+ #define PA_SC_ENHANCE_3__FORCE_PBB_WORKLOAD_MODE_TO_ZERO_MASK 0x00000008L
+
++#define mmCGTT_SPI_CS_CLK_CTRL 0x507c
++#define mmCGTT_SPI_CS_CLK_CTRL_BASE_IDX 1
++
+ MODULE_FIRMWARE("amdgpu/navi10_ce.bin");
+ MODULE_FIRMWARE("amdgpu/navi10_pfp.bin");
+ MODULE_FIRMWARE("amdgpu/navi10_me.bin");
+@@ -3094,6 +3097,7 @@ static const struct soc15_reg_golden gol
+
+ static const struct soc15_reg_golden golden_settings_gc_10_3[] =
+ {
++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_CS_CLK_CTRL, 0x78000000, 0x78000100),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_PS_CLK_CTRL, 0xff7f0fff, 0x78000100),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_RA0_CLK_CTRL, 0xff7f0fff, 0x30000100),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_RA1_CLK_CTRL, 0xff7f0fff, 0x7e000100),
--- /dev/null
+From d7787cc04e0a1f2043264d1550465081096bd065 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Tue, 29 Sep 2020 18:31:32 -0400
+Subject: drm/nouveau/kms/nv50-: Fix clock checking algorithm in nv50_dp_mode_valid()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit d7787cc04e0a1f2043264d1550465081096bd065 upstream.
+
+While I thought I had this correct (since it actually did reject modes
+like I expected during testing), Ville Syrjala from Intel pointed out
+that the logic here isn't correct. max_clock refers to the max data rate
+supported by the DP encoder. So, limiting it to the output of ds_clock (which
+refers to the maximum dotclock of the downstream DP device) doesn't make any
+sense. Additionally, since we're using the connector's bpc as the canonical BPC
+we should use this in mode_valid until we support dynamically setting the bpp
+based on bandwidth constraints.
+
+https://lists.freedesktop.org/archives/dri-devel/2020-September/280276.html
+
+For more info.
+
+So, let's rewrite this using Ville's advice.
+
+v2:
+* Ville pointed out I mixed up the dotclock and the link rate. So fix that...
+* ...and also rename all the variables in this function to be more appropriately
+ labeled so I stop mixing them up.
+* Reuse the bpp from the connector for now until we have dynamic bpp selection.
+* Use use DIV_ROUND_UP for calculating the mode rate like i915 does, which we
+ should also have been doing from the start
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 409d38139b42 ("drm/nouveau/kms/nv50-: Use downstream DP clock limits for mode validation")
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Lyude Paul <lyude@redhat.com>
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/gpu/drm/nouveau/nouveau_dp.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_dp.c
++++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
+@@ -114,7 +114,8 @@ nv50_dp_mode_valid(struct drm_connector
+ unsigned *out_clock)
+ {
+ const unsigned min_clock = 25000;
+- unsigned max_clock, clock = mode->clock;
++ unsigned int max_rate, mode_rate, clock = mode->clock;
++ const u8 bpp = connector->display_info.bpc * 3;
+
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE && !outp->caps.dp_interlace)
+ return MODE_NO_INTERLACE;
+@@ -122,12 +123,13 @@ nv50_dp_mode_valid(struct drm_connector
+ if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == DRM_MODE_FLAG_3D_FRAME_PACKING)
+ clock *= 2;
+
+- max_clock = outp->dp.link_nr * outp->dp.link_bw;
+- clock = mode->clock * (connector->display_info.bpc * 3) / 10;
++ max_rate = outp->dp.link_nr * outp->dp.link_bw;
++ mode_rate = DIV_ROUND_UP(clock * bpp, 8);
++ if (mode_rate > max_rate)
++ return MODE_CLOCK_HIGH;
++
+ if (clock < min_clock)
+ return MODE_CLOCK_LOW;
+- if (clock > max_clock)
+- return MODE_CLOCK_HIGH;
+
+ if (out_clock)
+ *out_clock = clock;
--- /dev/null
+From 2d831155cf0607566e43d8465da33774b2dc7221 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Tue, 29 Sep 2020 18:31:31 -0400
+Subject: drm/nouveau/kms/nv50-: Get rid of bogus nouveau_conn_mode_valid()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 2d831155cf0607566e43d8465da33774b2dc7221 upstream.
+
+Ville also pointed out that I got a lot of the logic here wrong as well, whoops.
+While I don't think anyone's likely using 3D output with nouveau, the next patch
+will make nouveau_conn_mode_valid() make a lot less sense. So, let's just get
+rid of it and open-code it like before, while taking care to move the 3D frame
+packing calculations on the dot clock into the right place.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: d6a9efece724 ("drm/nouveau/kms/nv50-: Share DP SST mode_valid() handling with MST")
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.8+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_connector.c | 36 +++++++---------------------
+ drivers/gpu/drm/nouveau/nouveau_dp.c | 15 +++++++----
+ 2 files changed, 20 insertions(+), 31 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -1035,29 +1035,6 @@ get_tmds_link_bandwidth(struct drm_conne
+ return 112000 * duallink_scale;
+ }
+
+-enum drm_mode_status
+-nouveau_conn_mode_clock_valid(const struct drm_display_mode *mode,
+- const unsigned min_clock,
+- const unsigned max_clock,
+- unsigned int *clock_out)
+-{
+- unsigned int clock = mode->clock;
+-
+- if ((mode->flags & DRM_MODE_FLAG_3D_MASK) ==
+- DRM_MODE_FLAG_3D_FRAME_PACKING)
+- clock *= 2;
+-
+- if (clock < min_clock)
+- return MODE_CLOCK_LOW;
+- if (clock > max_clock)
+- return MODE_CLOCK_HIGH;
+-
+- if (clock_out)
+- *clock_out = clock;
+-
+- return MODE_OK;
+-}
+-
+ static enum drm_mode_status
+ nouveau_connector_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+@@ -1065,7 +1042,7 @@ nouveau_connector_mode_valid(struct drm_
+ struct nouveau_connector *nv_connector = nouveau_connector(connector);
+ struct nouveau_encoder *nv_encoder = nv_connector->detected_encoder;
+ struct drm_encoder *encoder = to_drm_encoder(nv_encoder);
+- unsigned min_clock = 25000, max_clock = min_clock;
++ unsigned int min_clock = 25000, max_clock = min_clock, clock = mode->clock;
+
+ switch (nv_encoder->dcb->type) {
+ case DCB_OUTPUT_LVDS:
+@@ -1094,8 +1071,15 @@ nouveau_connector_mode_valid(struct drm_
+ return MODE_BAD;
+ }
+
+- return nouveau_conn_mode_clock_valid(mode, min_clock, max_clock,
+- NULL);
++ if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == DRM_MODE_FLAG_3D_FRAME_PACKING)
++ clock *= 2;
++
++ if (clock < min_clock)
++ return MODE_CLOCK_LOW;
++ if (clock > max_clock)
++ return MODE_CLOCK_HIGH;
++
++ return MODE_OK;
+ }
+
+ static struct drm_encoder *
+--- a/drivers/gpu/drm/nouveau/nouveau_dp.c
++++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
+@@ -114,18 +114,23 @@ nv50_dp_mode_valid(struct drm_connector
+ unsigned *out_clock)
+ {
+ const unsigned min_clock = 25000;
+- unsigned max_clock, clock;
+- enum drm_mode_status ret;
++ unsigned max_clock, clock = mode->clock;
+
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE && !outp->caps.dp_interlace)
+ return MODE_NO_INTERLACE;
+
++ if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == DRM_MODE_FLAG_3D_FRAME_PACKING)
++ clock *= 2;
++
+ max_clock = outp->dp.link_nr * outp->dp.link_bw;
+ clock = mode->clock * (connector->display_info.bpc * 3) / 10;
++ if (clock < min_clock)
++ return MODE_CLOCK_LOW;
++ if (clock > max_clock)
++ return MODE_CLOCK_HIGH;
+
+- ret = nouveau_conn_mode_clock_valid(mode, min_clock, max_clock,
+- &clock);
+ if (out_clock)
+ *out_clock = clock;
+- return ret;
++
++ return MODE_OK;
+ }
--- /dev/null
+From 9522750c66c689b739e151fcdf895420dc81efc0 Mon Sep 17 00:00:00 2001
+From: Lee Jones <lee.jones@linaro.org>
+Date: Mon, 2 Nov 2020 13:32:42 -0500
+Subject: Fonts: Replace discarded const qualifier
+
+From: Lee Jones <lee.jones@linaro.org>
+
+commit 9522750c66c689b739e151fcdf895420dc81efc0 upstream.
+
+Commit 6735b4632def ("Fonts: Support FONT_EXTRA_WORDS macros for built-in
+fonts") introduced the following error when building rpc_defconfig (only
+this build appears to be affected):
+
+ `acorndata_8x8' referenced in section `.text' of arch/arm/boot/compressed/ll_char_wr.o:
+ defined in discarded section `.data' of arch/arm/boot/compressed/font.o
+ `acorndata_8x8' referenced in section `.data.rel.ro' of arch/arm/boot/compressed/font.o:
+ defined in discarded section `.data' of arch/arm/boot/compressed/font.o
+ make[3]: *** [/scratch/linux/arch/arm/boot/compressed/Makefile:191: arch/arm/boot/compressed/vmlinux] Error 1
+ make[2]: *** [/scratch/linux/arch/arm/boot/Makefile:61: arch/arm/boot/compressed/vmlinux] Error 2
+ make[1]: *** [/scratch/linux/arch/arm/Makefile:317: zImage] Error 2
+
+The .data section is discarded at link time. Reinstating acorndata_8x8 as
+const ensures it is still available after linking. Do the same for the
+other 12 built-in fonts as well, for consistency purposes.
+
+Cc: <stable@vger.kernel.org>
+Cc: Russell King <linux@armlinux.org.uk>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Fixes: 6735b4632def ("Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts")
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Co-developed-by: Peilin Ye <yepeilin.cs@gmail.com>
+Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201102183242.2031659-1-yepeilin.cs@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/fonts/font_10x18.c | 2 +-
+ lib/fonts/font_6x10.c | 2 +-
+ lib/fonts/font_6x11.c | 2 +-
+ lib/fonts/font_7x14.c | 2 +-
+ lib/fonts/font_8x16.c | 2 +-
+ lib/fonts/font_8x8.c | 2 +-
+ lib/fonts/font_acorn_8x8.c | 2 +-
+ lib/fonts/font_mini_4x6.c | 2 +-
+ lib/fonts/font_pearl_8x8.c | 2 +-
+ lib/fonts/font_sun12x22.c | 2 +-
+ lib/fonts/font_sun8x16.c | 2 +-
+ lib/fonts/font_ter16x32.c | 2 +-
+ 12 files changed, 12 insertions(+), 12 deletions(-)
+
+--- a/lib/fonts/font_10x18.c
++++ b/lib/fonts/font_10x18.c
+@@ -8,7 +8,7 @@
+
+ #define FONTDATAMAX 9216
+
+-static struct font_data fontdata_10x18 = {
++static const struct font_data fontdata_10x18 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, 0x00, /* 0000000000 */
+--- a/lib/fonts/font_6x10.c
++++ b/lib/fonts/font_6x10.c
+@@ -3,7 +3,7 @@
+
+ #define FONTDATAMAX 2560
+
+-static struct font_data fontdata_6x10 = {
++static const struct font_data fontdata_6x10 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+--- a/lib/fonts/font_6x11.c
++++ b/lib/fonts/font_6x11.c
+@@ -9,7 +9,7 @@
+
+ #define FONTDATAMAX (11*256)
+
+-static struct font_data fontdata_6x11 = {
++static const struct font_data fontdata_6x11 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+--- a/lib/fonts/font_7x14.c
++++ b/lib/fonts/font_7x14.c
+@@ -8,7 +8,7 @@
+
+ #define FONTDATAMAX 3584
+
+-static struct font_data fontdata_7x14 = {
++static const struct font_data fontdata_7x14 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 0000000 */
+--- a/lib/fonts/font_8x16.c
++++ b/lib/fonts/font_8x16.c
+@@ -10,7 +10,7 @@
+
+ #define FONTDATAMAX 4096
+
+-static struct font_data fontdata_8x16 = {
++static const struct font_data fontdata_8x16 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+--- a/lib/fonts/font_8x8.c
++++ b/lib/fonts/font_8x8.c
+@@ -9,7 +9,7 @@
+
+ #define FONTDATAMAX 2048
+
+-static struct font_data fontdata_8x8 = {
++static const struct font_data fontdata_8x8 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+--- a/lib/fonts/font_acorn_8x8.c
++++ b/lib/fonts/font_acorn_8x8.c
+@@ -5,7 +5,7 @@
+
+ #define FONTDATAMAX 2048
+
+-static struct font_data acorndata_8x8 = {
++static const struct font_data acorndata_8x8 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
+ /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
+--- a/lib/fonts/font_mini_4x6.c
++++ b/lib/fonts/font_mini_4x6.c
+@@ -43,7 +43,7 @@ __END__;
+
+ #define FONTDATAMAX 1536
+
+-static struct font_data fontdata_mini_4x6 = {
++static const struct font_data fontdata_mini_4x6 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /*{*/
+ /* Char 0: ' ' */
+--- a/lib/fonts/font_pearl_8x8.c
++++ b/lib/fonts/font_pearl_8x8.c
+@@ -14,7 +14,7 @@
+
+ #define FONTDATAMAX 2048
+
+-static struct font_data fontdata_pearl8x8 = {
++static const struct font_data fontdata_pearl8x8 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+--- a/lib/fonts/font_sun12x22.c
++++ b/lib/fonts/font_sun12x22.c
+@@ -3,7 +3,7 @@
+
+ #define FONTDATAMAX 11264
+
+-static struct font_data fontdata_sun12x22 = {
++static const struct font_data fontdata_sun12x22 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, 0x00, /* 000000000000 */
+--- a/lib/fonts/font_sun8x16.c
++++ b/lib/fonts/font_sun8x16.c
+@@ -3,7 +3,7 @@
+
+ #define FONTDATAMAX 4096
+
+-static struct font_data fontdata_sun8x16 = {
++static const struct font_data fontdata_sun8x16 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00,
+--- a/lib/fonts/font_ter16x32.c
++++ b/lib/fonts/font_ter16x32.c
+@@ -4,7 +4,7 @@
+
+ #define FONTDATAMAX 16384
+
+-static struct font_data fontdata_ter16x32 = {
++static const struct font_data fontdata_ter16x32 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x7f, 0xfc, 0x7f, 0xfc,
--- /dev/null
+From 6bd1c7bd4ee7b17980cdc347522dcb76feac9b98 Mon Sep 17 00:00:00 2001
+From: Andreas Gruenbacher <agruenba@redhat.com>
+Date: Mon, 2 Nov 2020 21:11:30 +0100
+Subject: gfs2: Don't call cancel_delayed_work_sync from within delete work function
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+commit 6bd1c7bd4ee7b17980cdc347522dcb76feac9b98 upstream.
+
+Right now, we can end up calling cancel_delayed_work_sync from within
+delete_work_func via gfs2_lookup_by_inum -> gfs2_inode_lookup ->
+gfs2_cancel_delete_work. When that happens, it will result in a
+deadlock. Instead, gfs2_inode_lookup should skip the call to
+gfs2_cancel_delete_work when called from delete_work_func (blktype ==
+GFS2_BLKST_UNLINKED).
+
+Reported-by: Alexander Ahring Oder Aring <aahringo@redhat.com>
+Fixes: a0e3cc65fa29 ("gfs2: Turn gl_delete into a delayed work")
+Cc: stable@vger.kernel.org # v5.8+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/inode.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -180,7 +180,8 @@ struct inode *gfs2_inode_lookup(struct s
+ error = gfs2_glock_nq_init(io_gl, LM_ST_SHARED, GL_EXACT, &ip->i_iopen_gh);
+ if (unlikely(error))
+ goto fail;
+- gfs2_cancel_delete_work(ip->i_iopen_gh.gh_gl);
++ if (blktype != GFS2_BLKST_UNLINKED)
++ gfs2_cancel_delete_work(ip->i_iopen_gh.gh_gl);
+ glock_set_object(ip->i_iopen_gh.gh_gl, ip);
+ gfs2_glock_put(io_gl);
+ io_gl = NULL;
--- /dev/null
+From da7d554f7c62d0c17c1ac3cc2586473c2d99f0bd Mon Sep 17 00:00:00 2001
+From: Alexander Aring <aahringo@redhat.com>
+Date: Mon, 26 Oct 2020 10:52:29 -0400
+Subject: gfs2: Wake up when sd_glock_disposal becomes zero
+
+From: Alexander Aring <aahringo@redhat.com>
+
+commit da7d554f7c62d0c17c1ac3cc2586473c2d99f0bd upstream.
+
+Commit fc0e38dae645 ("GFS2: Fix glock deallocation race") fixed a
+sd_glock_disposal accounting bug by adding a missing atomic_dec
+statement, but it failed to wake up sd_glock_wait when that decrement
+causes sd_glock_disposal to reach zero. As a consequence,
+gfs2_gl_hash_clear can now run into a 10-minute timeout instead of
+being woken up. Add the missing wakeup.
+
+Fixes: fc0e38dae645 ("GFS2: Fix glock deallocation race")
+Cc: stable@vger.kernel.org # v2.6.39+
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/glock.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -1081,7 +1081,8 @@ int gfs2_glock_get(struct gfs2_sbd *sdp,
+ out_free:
+ kfree(gl->gl_lksb.sb_lvbptr);
+ kmem_cache_free(cachep, gl);
+- atomic_dec(&sdp->sd_glock_disposal);
++ if (atomic_dec_and_test(&sdp->sd_glock_disposal))
++ wake_up(&sdp->sd_glock_wait);
+
+ out:
+ return ret;
--- /dev/null
+From 79aa925bf239c234be8586780e482872dc4690dd Mon Sep 17 00:00:00 2001
+From: Mike Kravetz <mike.kravetz@oracle.com>
+Date: Sun, 1 Nov 2020 17:07:27 -0800
+Subject: hugetlb_cgroup: fix reservation accounting
+
+From: Mike Kravetz <mike.kravetz@oracle.com>
+
+commit 79aa925bf239c234be8586780e482872dc4690dd upstream.
+
+Michal Privoznik was using "free page reporting" in QEMU/virtio-balloon
+with hugetlbfs and hit the warning below. QEMU with free page hinting
+uses fallocate(FALLOC_FL_PUNCH_HOLE) to discard pages that are reported
+as free by a VM. The reporting granularity is in pageblock granularity.
+So when the guest reports 2M chunks, we fallocate(FALLOC_FL_PUNCH_HOLE)
+one huge page in QEMU.
+
+ WARNING: CPU: 7 PID: 6636 at mm/page_counter.c:57 page_counter_uncharge+0x4b/0x50
+ Modules linked in: ...
+ CPU: 7 PID: 6636 Comm: qemu-system-x86 Not tainted 5.9.0 #137
+ Hardware name: Gigabyte Technology Co., Ltd. X570 AORUS PRO/X570 AORUS PRO, BIOS F21 07/31/2020
+ RIP: 0010:page_counter_uncharge+0x4b/0x50
+ ...
+ Call Trace:
+ hugetlb_cgroup_uncharge_file_region+0x4b/0x80
+ region_del+0x1d3/0x300
+ hugetlb_unreserve_pages+0x39/0xb0
+ remove_inode_hugepages+0x1a8/0x3d0
+ hugetlbfs_fallocate+0x3c4/0x5c0
+ vfs_fallocate+0x146/0x290
+ __x64_sys_fallocate+0x3e/0x70
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Investigation of the issue uncovered bugs in hugetlb cgroup reservation
+accounting. This patch addresses the found issues.
+
+Fixes: 075a61d07a8e ("hugetlb_cgroup: add accounting for shared mappings")
+Reported-by: Michal Privoznik <mprivozn@redhat.com>
+Co-developed-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Tested-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Cc: <stable@vger.kernel.org>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Muchun Song <songmuchun@bytedance.com>
+Cc: "Aneesh Kumar K . V" <aneesh.kumar@linux.vnet.ibm.com>
+Cc: Tejun Heo <tj@kernel.org>
+Link: https://lkml.kernel.org/r/20201021204426.36069-1-mike.kravetz@oracle.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -655,6 +655,8 @@ retry:
+ }
+
+ del += t - f;
++ hugetlb_cgroup_uncharge_file_region(
++ resv, rg, t - f);
+
+ /* New entry for end of split region */
+ nrg->from = t;
+@@ -667,9 +669,6 @@ retry:
+ /* Original entry is trimmed */
+ rg->to = f;
+
+- hugetlb_cgroup_uncharge_file_region(
+- resv, rg, nrg->to - nrg->from);
+-
+ list_add(&nrg->link, &rg->link);
+ nrg = NULL;
+ break;
+@@ -685,17 +684,17 @@ retry:
+ }
+
+ if (f <= rg->from) { /* Trim beginning of region */
+- del += t - rg->from;
+- rg->from = t;
+-
+ hugetlb_cgroup_uncharge_file_region(resv, rg,
+ t - rg->from);
+- } else { /* Trim end of region */
+- del += rg->to - f;
+- rg->to = f;
+
++ del += t - rg->from;
++ rg->from = t;
++ } else { /* Trim end of region */
+ hugetlb_cgroup_uncharge_file_region(resv, rg,
+ rg->to - f);
++
++ del += rg->to - f;
++ rg->to = f;
+ }
+ }
+
+@@ -2454,6 +2453,9 @@ struct page *alloc_huge_page(struct vm_a
+
+ rsv_adjust = hugepage_subpool_put_pages(spool, 1);
+ hugetlb_acct_memory(h, -rsv_adjust);
++ if (deferred_reserve)
++ hugetlb_cgroup_uncharge_page_rsvd(hstate_index(h),
++ pages_per_huge_page(h), page);
+ }
+ return page;
+
--- /dev/null
+From 6993d0fdbee0eb38bfac350aa016f65ad11ed3b1 Mon Sep 17 00:00:00 2001
+From: Zqiang <qiang.zhang@windriver.com>
+Date: Sun, 1 Nov 2020 17:07:53 -0800
+Subject: kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled
+
+From: Zqiang <qiang.zhang@windriver.com>
+
+commit 6993d0fdbee0eb38bfac350aa016f65ad11ed3b1 upstream.
+
+There is a small race window when a delayed work is being canceled and
+the work still might be queued from the timer_fn:
+
+ CPU0 CPU1
+kthread_cancel_delayed_work_sync()
+ __kthread_cancel_work_sync()
+ __kthread_cancel_work()
+ work->canceling++;
+ kthread_delayed_work_timer_fn()
+ kthread_insert_work();
+
+BUG: kthread_insert_work() should not get called when work->canceling is
+set.
+
+Signed-off-by: Zqiang <qiang.zhang@windriver.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/20201014083030.16895-1-qiang.zhang@windriver.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/kthread.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -897,7 +897,8 @@ void kthread_delayed_work_timer_fn(struc
+ /* Move the work from worker->delayed_work_list. */
+ WARN_ON_ONCE(list_empty(&work->node));
+ list_del_init(&work->node);
+- kthread_insert_work(worker, work, &worker->work_list);
++ if (!work->canceling)
++ kthread_insert_work(worker, work, &worker->work_list);
+
+ raw_spin_unlock_irqrestore(&worker->lock, flags);
+ }
--- /dev/null
+From aa4e460f0976351fddd2f5ac6e08b74320c277a1 Mon Sep 17 00:00:00 2001
+From: Vasily Gorbik <gor@linux.ibm.com>
+Date: Sun, 1 Nov 2020 17:07:47 -0800
+Subject: lib/crc32test: remove extra local_irq_disable/enable
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+commit aa4e460f0976351fddd2f5ac6e08b74320c277a1 upstream.
+
+Commit 4d004099a668 ("lockdep: Fix lockdep recursion") uncovered the
+following issue in lib/crc32test reported on s390:
+
+ BUG: using __this_cpu_read() in preemptible [00000000] code: swapper/0/1
+ caller is lockdep_hardirqs_on_prepare+0x48/0x270
+ CPU: 6 PID: 1 Comm: swapper/0 Not tainted 5.9.0-next-20201015-15164-g03d992bd2de6 #19
+ Hardware name: IBM 3906 M04 704 (LPAR)
+ Call Trace:
+ lockdep_hardirqs_on_prepare+0x48/0x270
+ trace_hardirqs_on+0x9c/0x1b8
+ crc32_test.isra.0+0x170/0x1c0
+ crc32test_init+0x1c/0x40
+ do_one_initcall+0x40/0x130
+ do_initcalls+0x126/0x150
+ kernel_init_freeable+0x1f6/0x230
+ kernel_init+0x22/0x150
+ ret_from_fork+0x24/0x2c
+ no locks held by swapper/0/1.
+
+Remove extra local_irq_disable/local_irq_enable helpers calls.
+
+Fixes: 5fb7f87408f1 ("lib: add module support to crc32 tests")
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://lkml.kernel.org/r/patch.git-4369da00c06e.your-ad-here.call-01602859837-ext-1679@work.hours
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/crc32test.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/lib/crc32test.c
++++ b/lib/crc32test.c
+@@ -683,7 +683,6 @@ static int __init crc32c_test(void)
+
+ /* reduce OS noise */
+ local_irq_save(flags);
+- local_irq_disable();
+
+ nsec = ktime_get_ns();
+ for (i = 0; i < 100; i++) {
+@@ -694,7 +693,6 @@ static int __init crc32c_test(void)
+ nsec = ktime_get_ns() - nsec;
+
+ local_irq_restore(flags);
+- local_irq_enable();
+
+ pr_info("crc32c: CRC_LE_BITS = %d\n", CRC_LE_BITS);
+
+@@ -768,7 +766,6 @@ static int __init crc32_test(void)
+
+ /* reduce OS noise */
+ local_irq_save(flags);
+- local_irq_disable();
+
+ nsec = ktime_get_ns();
+ for (i = 0; i < 100; i++) {
+@@ -783,7 +780,6 @@ static int __init crc32_test(void)
+ nsec = ktime_get_ns() - nsec;
+
+ local_irq_restore(flags);
+- local_irq_enable();
+
+ pr_info("crc32: CRC_LE_BITS = %d, CRC_BE BITS = %d\n",
+ CRC_LE_BITS, CRC_BE_BITS);
--- /dev/null
+From f8f6ae5d077a9bdaf5cbf2ac960a5d1a04b47482 Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@nvidia.com>
+Date: Sun, 1 Nov 2020 17:08:00 -0800
+Subject: mm: always have io_remap_pfn_range() set pgprot_decrypted()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+commit f8f6ae5d077a9bdaf5cbf2ac960a5d1a04b47482 upstream.
+
+The purpose of io_remap_pfn_range() is to map IO memory, such as a
+memory mapped IO exposed through a PCI BAR. IO devices do not
+understand encryption, so this memory must always be decrypted.
+Automatically call pgprot_decrypted() as part of the generic
+implementation.
+
+This fixes a bug where enabling AMD SME causes subsystems, such as RDMA,
+using io_remap_pfn_range() to expose BAR pages to user space to fail.
+The CPU will encrypt access to those BAR pages instead of passing
+unencrypted IO directly to the device.
+
+Places not mapping IO should use remap_pfn_range().
+
+Fixes: aca20d546214 ("x86/mm: Add support to make use of Secure Memory Encryption")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brijesh Singh <brijesh.singh@amd.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: "Dave Young" <dyoung@redhat.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Larry Woodman <lwoodman@redhat.com>
+Cc: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Toshimitsu Kani <toshi.kani@hpe.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/0-v1-025d64bdf6c4+e-amd_sme_fix_jgg@nvidia.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mm.h | 9 +++++++++
+ include/linux/pgtable.h | 4 ----
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -2735,6 +2735,15 @@ static inline vm_fault_t vmf_insert_page
+ return VM_FAULT_NOPAGE;
+ }
+
++#ifndef io_remap_pfn_range
++static inline int io_remap_pfn_range(struct vm_area_struct *vma,
++ unsigned long addr, unsigned long pfn,
++ unsigned long size, pgprot_t prot)
++{
++ return remap_pfn_range(vma, addr, pfn, size, pgprot_decrypted(prot));
++}
++#endif
++
+ static inline vm_fault_t vmf_error(int err)
+ {
+ if (err == -ENOMEM)
+--- a/include/linux/pgtable.h
++++ b/include/linux/pgtable.h
+@@ -1399,10 +1399,6 @@ typedef unsigned int pgtbl_mod_mask;
+
+ #endif /* !__ASSEMBLY__ */
+
+-#ifndef io_remap_pfn_range
+-#define io_remap_pfn_range remap_pfn_range
+-#endif
+-
+ #ifndef has_transparent_hugepage
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ #define has_transparent_hugepage() 1
--- /dev/null
+From 3f08842098e842c51e3b97d0dcdebf810b32558e Mon Sep 17 00:00:00 2001
+From: Shijie Luo <luoshijie1@huawei.com>
+Date: Sun, 1 Nov 2020 17:07:40 -0800
+Subject: mm: mempolicy: fix potential pte_unmap_unlock pte error
+
+From: Shijie Luo <luoshijie1@huawei.com>
+
+commit 3f08842098e842c51e3b97d0dcdebf810b32558e upstream.
+
+When flags in queue_pages_pte_range don't have MPOL_MF_MOVE or
+MPOL_MF_MOVE_ALL bits, code breaks and passing origin pte - 1 to
+pte_unmap_unlock seems like not a good idea.
+
+queue_pages_pte_range can run in MPOL_MF_MOVE_ALL mode which doesn't
+migrate misplaced pages but returns with EIO when encountering such a
+page. Since commit a7f40cfe3b7a ("mm: mempolicy: make mbind() return
+-EIO when MPOL_MF_STRICT is specified") and early break on the first pte
+in the range results in pte_unmap_unlock on an underflow pte. This can
+lead to lockups later on when somebody tries to lock the pte resp.
+page_table_lock again..
+
+Fixes: a7f40cfe3b7a ("mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified")
+Signed-off-by: Shijie Luo <luoshijie1@huawei.com>
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Feilong Lin <linfeilong@huawei.com>
+Cc: Shijie Luo <luoshijie1@huawei.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/20201019074853.50856-1-luoshijie1@huawei.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/mempolicy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -525,7 +525,7 @@ static int queue_pages_pte_range(pmd_t *
+ unsigned long flags = qp->flags;
+ int ret;
+ bool has_unmovable = false;
+- pte_t *pte;
++ pte_t *pte, *mapped_pte;
+ spinlock_t *ptl;
+
+ ptl = pmd_trans_huge_lock(pmd, vma);
+@@ -539,7 +539,7 @@ static int queue_pages_pte_range(pmd_t *
+ if (pmd_trans_unstable(pmd))
+ return 0;
+
+- pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
++ mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+ for (; addr != end; pte++, addr += PAGE_SIZE) {
+ if (!pte_present(*pte))
+ continue;
+@@ -571,7 +571,7 @@ static int queue_pages_pte_range(pmd_t *
+ } else
+ break;
+ }
+- pte_unmap_unlock(pte - 1, ptl);
++ pte_unmap_unlock(mapped_pte, ptl);
+ cond_resched();
+
+ if (has_unmovable)
--- /dev/null
+From 86449b12f626a65d2a2ecfada1e024488471f9e2 Mon Sep 17 00:00:00 2001
+From: Song Liu <songliubraving@fb.com>
+Date: Fri, 30 Oct 2020 16:54:31 -0700
+Subject: perf hists browser: Increase size of 'buf' in perf_evsel__hists_browse()
+
+From: Song Liu <songliubraving@fb.com>
+
+commit 86449b12f626a65d2a2ecfada1e024488471f9e2 upstream.
+
+Making perf with gcc-9.1.1 generates the following warning:
+
+ CC ui/browsers/hists.o
+ ui/browsers/hists.c: In function 'perf_evsel__hists_browse':
+ ui/browsers/hists.c:3078:61: error: '%d' directive output may be \
+ truncated writing between 1 and 11 bytes into a region of size \
+ between 2 and 12 [-Werror=format-truncation=]
+
+ 3078 | "Max event group index to sort is %d (index from 0 to %d)",
+ | ^~
+ ui/browsers/hists.c:3078:7: note: directive argument in the range [-2147483648, 8]
+ 3078 | "Max event group index to sort is %d (index from 0 to %d)",
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ In file included from /usr/include/stdio.h:937,
+ from ui/browsers/hists.c:5:
+
+IOW, the string in line 3078 might be too long for buf[] of 64 bytes.
+
+Fix this by increasing the size of buf[] to 128.
+
+Fixes: dbddf1747441 ("perf report/top TUI: Support hotkeys to let user select any event for sorting")
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: stable@vger.kernel.org # v5.7+
+Link: http://lore.kernel.org/lkml/20201030235431.534417-1-songliubraving@fb.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/ui/browsers/hists.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -2963,7 +2963,7 @@ static int perf_evsel__hists_browse(stru
+ struct popup_action actions[MAX_OPTIONS];
+ int nr_options = 0;
+ int key = -1;
+- char buf[64];
++ char buf[128];
+ int delay_secs = hbt ? hbt->refresh : 0;
+
+ #define HIST_BROWSER_HELP_COMMON \
--- /dev/null
+From b02414c8f045ab3b9afc816c3735bc98c5c3d262 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Mon, 2 Nov 2020 15:31:27 -0500
+Subject: ring-buffer: Fix recursion protection transitions between interrupt context
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit b02414c8f045ab3b9afc816c3735bc98c5c3d262 upstream.
+
+The recursion protection of the ring buffer depends on preempt_count() to be
+correct. But it is possible that the ring buffer gets called after an
+interrupt comes in but before it updates the preempt_count(). This will
+trigger a false positive in the recursion code.
+
+Use the same trick from the ftrace function callback recursion code which
+uses a "transition" bit that gets set, to allow for a single recursion for
+to handle transitions between contexts.
+
+Cc: stable@vger.kernel.org
+Fixes: 567cd4da54ff4 ("ring-buffer: User context bit recursion checking")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 58 +++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 46 insertions(+), 12 deletions(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -438,14 +438,16 @@ enum {
+ };
+ /*
+ * Used for which event context the event is in.
+- * NMI = 0
+- * IRQ = 1
+- * SOFTIRQ = 2
+- * NORMAL = 3
++ * TRANSITION = 0
++ * NMI = 1
++ * IRQ = 2
++ * SOFTIRQ = 3
++ * NORMAL = 4
+ *
+ * See trace_recursive_lock() comment below for more details.
+ */
+ enum {
++ RB_CTX_TRANSITION,
+ RB_CTX_NMI,
+ RB_CTX_IRQ,
+ RB_CTX_SOFTIRQ,
+@@ -3014,10 +3016,10 @@ rb_wakeups(struct trace_buffer *buffer,
+ * a bit of overhead in something as critical as function tracing,
+ * we use a bitmask trick.
+ *
+- * bit 0 = NMI context
+- * bit 1 = IRQ context
+- * bit 2 = SoftIRQ context
+- * bit 3 = normal context.
++ * bit 1 = NMI context
++ * bit 2 = IRQ context
++ * bit 3 = SoftIRQ context
++ * bit 4 = normal context.
+ *
+ * This works because this is the order of contexts that can
+ * preempt other contexts. A SoftIRQ never preempts an IRQ
+@@ -3040,6 +3042,30 @@ rb_wakeups(struct trace_buffer *buffer,
+ * The least significant bit can be cleared this way, and it
+ * just so happens that it is the same bit corresponding to
+ * the current context.
++ *
++ * Now the TRANSITION bit breaks the above slightly. The TRANSITION bit
++ * is set when a recursion is detected at the current context, and if
++ * the TRANSITION bit is already set, it will fail the recursion.
++ * This is needed because there's a lag between the changing of
++ * interrupt context and updating the preempt count. In this case,
++ * a false positive will be found. To handle this, one extra recursion
++ * is allowed, and this is done by the TRANSITION bit. If the TRANSITION
++ * bit is already set, then it is considered a recursion and the function
++ * ends. Otherwise, the TRANSITION bit is set, and that bit is returned.
++ *
++ * On the trace_recursive_unlock(), the TRANSITION bit will be the first
++ * to be cleared. Even if it wasn't the context that set it. That is,
++ * if an interrupt comes in while NORMAL bit is set and the ring buffer
++ * is called before preempt_count() is updated, since the check will
++ * be on the NORMAL bit, the TRANSITION bit will then be set. If an
++ * NMI then comes in, it will set the NMI bit, but when the NMI code
++ * does the trace_recursive_unlock() it will clear the TRANSTION bit
++ * and leave the NMI bit set. But this is fine, because the interrupt
++ * code that set the TRANSITION bit will then clear the NMI bit when it
++ * calls trace_recursive_unlock(). If another NMI comes in, it will
++ * set the TRANSITION bit and continue.
++ *
++ * Note: The TRANSITION bit only handles a single transition between context.
+ */
+
+ static __always_inline int
+@@ -3055,8 +3081,16 @@ trace_recursive_lock(struct ring_buffer_
+ bit = pc & NMI_MASK ? RB_CTX_NMI :
+ pc & HARDIRQ_MASK ? RB_CTX_IRQ : RB_CTX_SOFTIRQ;
+
+- if (unlikely(val & (1 << (bit + cpu_buffer->nest))))
+- return 1;
++ if (unlikely(val & (1 << (bit + cpu_buffer->nest)))) {
++ /*
++ * It is possible that this was called by transitioning
++ * between interrupt context, and preempt_count() has not
++ * been updated yet. In this case, use the TRANSITION bit.
++ */
++ bit = RB_CTX_TRANSITION;
++ if (val & (1 << (bit + cpu_buffer->nest)))
++ return 1;
++ }
+
+ val |= (1 << (bit + cpu_buffer->nest));
+ cpu_buffer->current_context = val;
+@@ -3071,8 +3105,8 @@ trace_recursive_unlock(struct ring_buffe
+ cpu_buffer->current_context - (1 << cpu_buffer->nest);
+ }
+
+-/* The recursive locking above uses 4 bits */
+-#define NESTED_BITS 4
++/* The recursive locking above uses 5 bits */
++#define NESTED_BITS 5
+
+ /**
+ * ring_buffer_nest_start - Allow to trace while nested
net-dsa-qca8k-fix-port-mtu-setting.patch
net-openvswitch-silence-suspicious-rcu-usage-warning.patch
r8169-work-around-short-packet-hw-bug-on-rtl8125.patch
+drm-nouveau-kms-nv50-get-rid-of-bogus-nouveau_conn_mode_valid.patch
+drm-nouveau-kms-nv50-fix-clock-checking-algorithm-in-nv50_dp_mode_valid.patch
+fonts-replace-discarded-const-qualifier.patch
+alsa-hda-realtek-fixed-hp-headset-mic-can-t-be-detected.patch
+alsa-hda-realtek-enable-headphone-for-asus-tm420.patch
+alsa-usb-audio-add-implicit-feedback-quirk-for-zoom-uac-2.patch
+alsa-usb-audio-add-usb-vendor-id-as-dsd-capable-for-khadas-devices.patch
+alsa-usb-audio-add-implicit-feedback-quirk-for-qu-16.patch
+alsa-usb-audio-add-implicit-feedback-quirk-for-modx.patch
+hugetlb_cgroup-fix-reservation-accounting.patch
+mm-mempolicy-fix-potential-pte_unmap_unlock-pte-error.patch
+lib-crc32test-remove-extra-local_irq_disable-enable.patch
+kthread_worker-prevent-queuing-delayed-work-from-timer_fn-when-it-is-being-canceled.patch
+mm-always-have-io_remap_pfn_range-set-pgprot_decrypted.patch
+perf-hists-browser-increase-size-of-buf-in-perf_evsel__hists_browse.patch
+gfs2-wake-up-when-sd_glock_disposal-becomes-zero.patch
+gfs2-don-t-call-cancel_delayed_work_sync-from-within-delete-work-function.patch
+ring-buffer-fix-recursion-protection-transitions-between-interrupt-context.patch
+drm-amdgpu-update-golden-setting-for-sienna_cichlid.patch
+drm-amdgpu-resolved-asd-loading-issue-on-sienna.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
