--- /dev/null
+From b93dfa6bda4d4e88e5386490f2b277a26958f9d3 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Wed, 11 Aug 2021 11:53:37 -0700
+Subject: ACPI: NFIT: Fix support for virtual SPA ranges
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit b93dfa6bda4d4e88e5386490f2b277a26958f9d3 upstream.
+
+Fix the NFIT parsing code to treat a 0 index in a SPA Range Structure as
+a special case and not match Region Mapping Structures that use 0 to
+indicate that they are not mapped. Without this fix some platform BIOS
+descriptions of "virtual disk" ranges do not result in the pmem driver
+attaching to the range.
+
+Details:
+In addition to typical persistent memory ranges, the ACPI NFIT may also
+convey "virtual" ranges. These ranges are indicated by a UUID in the SPA
+Range Structure of UUID_VOLATILE_VIRTUAL_DISK, UUID_VOLATILE_VIRTUAL_CD,
+UUID_PERSISTENT_VIRTUAL_DISK, or UUID_PERSISTENT_VIRTUAL_CD. The
+critical difference between virtual ranges and UUID_PERSISTENT_MEMORY,
+is that virtual do not support associations with Region Mapping
+Structures. For this reason the "index" value of virtual SPA Range
+Structures is allowed to be 0. If a platform BIOS decides to represent
+NVDIMMs with disconnected "Region Mapping Structures" (range-index ==
+0), the kernel may falsely associate them with standalone ranges where
+the "SPA Range Structure Index" is also zero. When this happens the
+driver may falsely require labels where "virtual disks" are expected to
+be label-less. I.e. "label-less" is where the namespace-range ==
+region-range and the pmem driver attaches with no user action to create
+a namespace.
+
+Cc: Jacek Zloch <jacek.zloch@intel.com>
+Cc: Lukasz Sobieraj <lukasz.sobieraj@intel.com>
+Cc: "Lee, Chun-Yi" <jlee@suse.com>
+Cc: <stable@vger.kernel.org>
+Fixes: c2f32acdf848 ("acpi, nfit: treat virtual ramdisk SPA as pmem region")
+Reported-by: Krzysztof Rusocki <krzysztof.rusocki@intel.com>
+Reported-by: Damian Bassa <damian.bassa@intel.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Link: https://lore.kernel.org/r/162870796589.2521182.1240403310175570220.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/nfit/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3021,6 +3021,9 @@ static int acpi_nfit_register_region(str
+ struct acpi_nfit_memory_map *memdev = nfit_memdev->memdev;
+ struct nd_mapping_desc *mapping;
+
++ /* range index 0 == unmapped in SPA or invalid-SPA */
++ if (memdev->range_index == 0 || spa->range_index == 0)
++ continue;
+ if (memdev->range_index != spa->range_index)
+ continue;
+ if (count >= ND_MAX_MAPPINGS) {
--- /dev/null
+From 3a715e80400f452b247caa55344f4f60250ffbcf Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Thu, 8 Jul 2021 17:13:48 -0700
+Subject: ARC: fp: set FPU_STATUS.FWE to enable FPU_STATUS update on context switch
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit 3a715e80400f452b247caa55344f4f60250ffbcf upstream.
+
+FPU_STATUS register contains FP exception flags bits which are updated
+by core as side-effect of FP instructions but can also be manually
+wiggled such as by glibc C99 functions fe{raise,clear,test}except() etc.
+To effect the update, the programming model requires OR'ing FWE
+bit (31). This bit is write-only and RAZ, meaning it is effectively
+auto-cleared after write and thus needs to be set everytime: which
+is how glibc implements this.
+
+However there's another usecase of FPU_STATUS update, at the time of
+Linux task switch when incoming task value needs to be programmed into
+the register. This was added as part of f45ba2bd6da0dc ("ARCv2:
+fpu: preserve userspace fpu state") which missed OR'ing FWE bit,
+meaning the new value is effectively not being written at all.
+This patch remedies that.
+
+Interestingly, this snafu was not caught in interm glibc testing as the
+race window which relies on a specific exception bit to be set/clear is
+really small specially when it nvolves context switch.
+Fortunately this was caught by glibc's math/test-fenv-tls test which
+repeatedly set/clear exception flags in a big loop, concurrently in main
+program and also in a thread.
+
+Fixes: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/54
+Fixes: f45ba2bd6da0dc ("ARCv2: fpu: preserve userspace fpu state")
+Cc: stable@vger.kernel.org #5.6+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arc/kernel/fpu.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/arc/kernel/fpu.c
++++ b/arch/arc/kernel/fpu.c
+@@ -57,23 +57,26 @@ void fpu_save_restore(struct task_struct
+
+ void fpu_init_task(struct pt_regs *regs)
+ {
++ const unsigned int fwe = 0x80000000;
++
+ /* default rounding mode */
+ write_aux_reg(ARC_REG_FPU_CTRL, 0x100);
+
+- /* set "Write enable" to allow explicit write to exception flags */
+- write_aux_reg(ARC_REG_FPU_STATUS, 0x80000000);
++ /* Initialize to zero: setting requires FWE be set */
++ write_aux_reg(ARC_REG_FPU_STATUS, fwe);
+ }
+
+ void fpu_save_restore(struct task_struct *prev, struct task_struct *next)
+ {
+ struct arc_fpu *save = &prev->thread.fpu;
+ struct arc_fpu *restore = &next->thread.fpu;
++ const unsigned int fwe = 0x80000000;
+
+ save->ctrl = read_aux_reg(ARC_REG_FPU_CTRL);
+ save->status = read_aux_reg(ARC_REG_FPU_STATUS);
+
+ write_aux_reg(ARC_REG_FPU_CTRL, restore->ctrl);
+- write_aux_reg(ARC_REG_FPU_STATUS, restore->status);
++ write_aux_reg(ARC_REG_FPU_STATUS, (fwe | restore->status));
+ }
+
+ #endif
--- /dev/null
+From 8b5d95313b6d30f642e4ed0125891984c446604e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 31 Jul 2021 10:43:31 +0200
+Subject: ASoC: amd: Fix reference to PCM buffer address
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8b5d95313b6d30f642e4ed0125891984c446604e upstream.
+
+PCM buffers might be allocated dynamically when the buffer
+preallocation failed or a larger buffer is requested, and it's not
+guaranteed that substream->dma_buffer points to the actually used
+buffer. The driver needs to refer to substream->runtime->dma_addr
+instead for the buffer address.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210731084331.32225-1-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/amd/acp-pcm-dma.c | 2 +-
+ sound/soc/amd/raven/acp3x-pcm-dma.c | 2 +-
+ sound/soc/amd/renoir/acp3x-pdm-dma.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/amd/acp-pcm-dma.c
++++ b/sound/soc/amd/acp-pcm-dma.c
+@@ -969,7 +969,7 @@ static int acp_dma_hw_params(struct snd_
+
+ acp_set_sram_bank_state(rtd->acp_mmio, 0, true);
+ /* Save for runtime private data */
+- rtd->dma_addr = substream->dma_buffer.addr;
++ rtd->dma_addr = runtime->dma_addr;
+ rtd->order = get_order(size);
+
+ /* Fill the page table entries in ACP SRAM */
+--- a/sound/soc/amd/raven/acp3x-pcm-dma.c
++++ b/sound/soc/amd/raven/acp3x-pcm-dma.c
+@@ -286,7 +286,7 @@ static int acp3x_dma_hw_params(struct sn
+ pr_err("pinfo failed\n");
+ }
+ size = params_buffer_bytes(params);
+- rtd->dma_addr = substream->dma_buffer.addr;
++ rtd->dma_addr = substream->runtime->dma_addr;
+ rtd->num_pages = (PAGE_ALIGN(size) >> PAGE_SHIFT);
+ config_acp3x_dma(rtd, substream->stream);
+ return 0;
+--- a/sound/soc/amd/renoir/acp3x-pdm-dma.c
++++ b/sound/soc/amd/renoir/acp3x-pdm-dma.c
+@@ -246,7 +246,7 @@ static int acp_pdm_dma_hw_params(struct
+ return -EINVAL;
+ size = params_buffer_bytes(params);
+ period_bytes = params_period_bytes(params);
+- rtd->dma_addr = substream->dma_buffer.addr;
++ rtd->dma_addr = substream->runtime->dma_addr;
+ rtd->num_pages = (PAGE_ALIGN(size) >> PAGE_SHIFT);
+ config_acp_dma(rtd, substream->stream);
+ init_pdm_ring_buffer(MEM_WINDOW_START, size, period_bytes,
--- /dev/null
+From 2e6b836312a477d647a7920b56810a5a25f6c856 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 28 Jul 2021 13:23:50 +0200
+Subject: ASoC: intel: atom: Fix reference to PCM buffer address
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 2e6b836312a477d647a7920b56810a5a25f6c856 upstream.
+
+PCM buffers might be allocated dynamically when the buffer
+preallocation failed or a larger buffer is requested, and it's not
+guaranteed that substream->dma_buffer points to the actually used
+buffer. The address should be retrieved from runtime->dma_addr,
+instead of substream->dma_buffer (and shouldn't use virt_to_phys).
+
+Also, remove the line overriding runtime->dma_area superfluously,
+which was already set up at the PCM buffer allocation.
+
+Cc: Cezary Rojewski <cezary.rojewski@intel.com>
+Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210728112353.6675-3-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/intel/atom/sst-mfld-platform-pcm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+@@ -127,7 +127,7 @@ static void sst_fill_alloc_params(struct
+ snd_pcm_uframes_t period_size;
+ ssize_t periodbytes;
+ ssize_t buffer_bytes = snd_pcm_lib_buffer_bytes(substream);
+- u32 buffer_addr = virt_to_phys(substream->dma_buffer.area);
++ u32 buffer_addr = substream->runtime->dma_addr;
+
+ channels = substream->runtime->channels;
+ period_size = substream->runtime->period_size;
+@@ -233,7 +233,6 @@ static int sst_platform_alloc_stream(str
+ /* set codec params and inform SST driver the same */
+ sst_fill_pcm_params(substream, ¶m);
+ sst_fill_alloc_params(substream, &alloc_params);
+- substream->runtime->dma_area = substream->dma_buffer.area;
+ str_params.sparams = param;
+ str_params.aparams = alloc_params;
+ str_params.codec = SST_CODEC_TYPE_PCM;
--- /dev/null
+From bb6a40fc5a830cae45ddd5cd6cfa151b008522ed Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 28 Jul 2021 13:23:53 +0200
+Subject: ASoC: kirkwood: Fix reference to PCM buffer address
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit bb6a40fc5a830cae45ddd5cd6cfa151b008522ed upstream.
+
+The transition to the managed PCM buffers allowed the dynamically
+buffer allocation, while the driver code still assumes the fixed
+preallocation buffer and sets up the DMA stuff at the open call.
+This needs to be moved to hw_params after the buffer allocation and
+setup. Also, the reference to the buffer address has to be corrected
+to runtime->dma_addr.
+
+Fixes: b3c0ae75f5d3 ("ASoC: kirkwood: Use managed DMA buffer allocation")
+Cc: Lars-Peter Clausen <lars@metafoo.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210728112353.6675-6-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/kirkwood/kirkwood-dma.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/kirkwood/kirkwood-dma.c
++++ b/sound/soc/kirkwood/kirkwood-dma.c
+@@ -104,8 +104,6 @@ static int kirkwood_dma_open(struct snd_
+ int err;
+ struct snd_pcm_runtime *runtime = substream->runtime;
+ struct kirkwood_dma_data *priv = kirkwood_priv(substream);
+- const struct mbus_dram_target_info *dram;
+- unsigned long addr;
+
+ snd_soc_set_runtime_hwparams(substream, &kirkwood_dma_snd_hw);
+
+@@ -142,20 +140,14 @@ static int kirkwood_dma_open(struct snd_
+ writel((unsigned int)-1, priv->io + KIRKWOOD_ERR_MASK);
+ }
+
+- dram = mv_mbus_dram_info();
+- addr = substream->dma_buffer.addr;
+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ if (priv->substream_play)
+ return -EBUSY;
+ priv->substream_play = substream;
+- kirkwood_dma_conf_mbus_windows(priv->io,
+- KIRKWOOD_PLAYBACK_WIN, addr, dram);
+ } else {
+ if (priv->substream_rec)
+ return -EBUSY;
+ priv->substream_rec = substream;
+- kirkwood_dma_conf_mbus_windows(priv->io,
+- KIRKWOOD_RECORD_WIN, addr, dram);
+ }
+
+ return 0;
+@@ -182,6 +174,23 @@ static int kirkwood_dma_close(struct snd
+ return 0;
+ }
+
++static int kirkwood_dma_hw_params(struct snd_soc_component *component,
++ struct snd_pcm_substream *substream,
++ struct snd_pcm_hw_params *params)
++{
++ struct kirkwood_dma_data *priv = kirkwood_priv(substream);
++ const struct mbus_dram_target_info *dram = mv_mbus_dram_info();
++ unsigned long addr = substream->runtime->dma_addr;
++
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++ kirkwood_dma_conf_mbus_windows(priv->io,
++ KIRKWOOD_PLAYBACK_WIN, addr, dram);
++ else
++ kirkwood_dma_conf_mbus_windows(priv->io,
++ KIRKWOOD_RECORD_WIN, addr, dram);
++ return 0;
++}
++
+ static int kirkwood_dma_prepare(struct snd_soc_component *component,
+ struct snd_pcm_substream *substream)
+ {
+@@ -246,6 +255,7 @@ const struct snd_soc_component_driver ki
+ .name = DRV_NAME,
+ .open = kirkwood_dma_open,
+ .close = kirkwood_dma_close,
++ .hw_params = kirkwood_dma_hw_params,
+ .prepare = kirkwood_dma_prepare,
+ .pointer = kirkwood_dma_pointer,
+ .pcm_construct = kirkwood_dma_new,
--- /dev/null
+From 2c39ca6885a2ec03e5c9e7c12a4da2aa8926605a Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@kernel.org>
+Date: Fri, 23 Jul 2021 19:02:00 +0100
+Subject: ASoC: tlv320aic31xx: Fix jack detection after suspend
+
+From: Mark Brown <broonie@kernel.org>
+
+commit 2c39ca6885a2ec03e5c9e7c12a4da2aa8926605a upstream.
+
+The tlv320aic31xx driver relies on regcache_sync() to restore the register
+contents after going to _BIAS_OFF, for example during system suspend. This
+does not work for the jack detection configuration since that is configured
+via the same register that status is read back from so the register is
+volatile and not cached. This can also cause issues during init if the jack
+detection ends up getting set up before the CODEC is initially brought out
+of _BIAS_OFF, we will reset the CODEC and resync the cache as part of that
+process.
+
+Fix this by explicitly reapplying the jack detection configuration after
+resyncing the register cache during power on.
+
+This issue was found by an engineer working off-list on a product
+kernel, I just wrote up the upstream fix.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210723180200.25105-1-broonie@kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/tlv320aic31xx.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/sound/soc/codecs/tlv320aic31xx.c
++++ b/sound/soc/codecs/tlv320aic31xx.c
+@@ -35,6 +35,9 @@
+
+ #include "tlv320aic31xx.h"
+
++static int aic31xx_set_jack(struct snd_soc_component *component,
++ struct snd_soc_jack *jack, void *data);
++
+ static const struct reg_default aic31xx_reg_defaults[] = {
+ { AIC31XX_CLKMUX, 0x00 },
+ { AIC31XX_PLLPR, 0x11 },
+@@ -1256,6 +1259,13 @@ static int aic31xx_power_on(struct snd_s
+ return ret;
+ }
+
++ /*
++ * The jack detection configuration is in the same register
++ * that is used to report jack detect status so is volatile
++ * and not covered by the cache sync, restore it separately.
++ */
++ aic31xx_set_jack(component, aic31xx->jack, NULL);
++
+ return 0;
+ }
+
--- /dev/null
+From 827f3164aaa579eee6fd50c6654861d54f282a11 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 28 Jul 2021 13:23:52 +0200
+Subject: ASoC: uniphier: Fix reference to PCM buffer address
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 827f3164aaa579eee6fd50c6654861d54f282a11 upstream.
+
+Along with the transition to the managed PCM buffers, the driver now
+accepts the dynamically allocated buffer, while it still kept the
+reference to the old preallocated buffer address. This patch corrects
+to the right reference via runtime->dma_addr.
+
+(Although this might have been already buggy before the cleanup with
+the managed buffer, let's put Fixes tag to point that; it's a corner
+case, after all.)
+
+Fixes: d55894bc2763 ("ASoC: uniphier: Use managed buffer allocation")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210728112353.6675-5-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/uniphier/aio-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/uniphier/aio-dma.c
++++ b/sound/soc/uniphier/aio-dma.c
+@@ -198,7 +198,7 @@ static int uniphier_aiodma_mmap(struct s
+ vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+
+ return remap_pfn_range(vma, vma->vm_start,
+- substream->dma_buffer.addr >> PAGE_SHIFT,
++ substream->runtime->dma_addr >> PAGE_SHIFT,
+ vma->vm_end - vma->vm_start, vma->vm_page_prot);
+ }
+
--- /dev/null
+From 42bc62c9f1d3d4880bdc27acb5ab4784209bb0b0 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 28 Jul 2021 13:23:51 +0200
+Subject: ASoC: xilinx: Fix reference to PCM buffer address
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 42bc62c9f1d3d4880bdc27acb5ab4784209bb0b0 upstream.
+
+PCM buffers might be allocated dynamically when the buffer
+preallocation failed or a larger buffer is requested, and it's not
+guaranteed that substream->dma_buffer points to the actually used
+buffer. The driver needs to refer to substream->runtime->dma_addr
+instead for the buffer address.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210728112353.6675-4-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/xilinx/xlnx_formatter_pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/xilinx/xlnx_formatter_pcm.c
++++ b/sound/soc/xilinx/xlnx_formatter_pcm.c
+@@ -452,8 +452,8 @@ static int xlnx_formatter_pcm_hw_params(
+
+ stream_data->buffer_size = size;
+
+- low = lower_32_bits(substream->dma_buffer.addr);
+- high = upper_32_bits(substream->dma_buffer.addr);
++ low = lower_32_bits(runtime->dma_addr);
++ high = upper_32_bits(runtime->dma_addr);
+ writel(low, stream_data->mmio + XLNX_AUD_BUFF_ADDR_LSB);
+ writel(high, stream_data->mmio + XLNX_AUD_BUFF_ADDR_MSB);
+
--- /dev/null
+From bf2ba432213fade50dd39f2e348085b758c0726e Mon Sep 17 00:00:00 2001
+From: Luis Henriques <lhenriques@suse.de>
+Date: Tue, 6 Jul 2021 14:52:41 +0100
+Subject: ceph: reduce contention in ceph_check_delayed_caps()
+
+From: Luis Henriques <lhenriques@suse.de>
+
+commit bf2ba432213fade50dd39f2e348085b758c0726e upstream.
+
+Function ceph_check_delayed_caps() is called from the mdsc->delayed_work
+workqueue and it can be kept looping for quite some time if caps keep
+being added back to the mdsc->cap_delay_list. This may result in the
+watchdog tainting the kernel with the softlockup flag.
+
+This patch breaks this loop if the caps have been recently (i.e. during
+the loop execution). Any new caps added to the list will be handled in
+the next run.
+
+Also, allow schedule_delayed() callers to explicitly set the delay value
+instead of defaulting to 5s, so we can ensure that it runs soon
+afterward if it looks like there is more work.
+
+Cc: stable@vger.kernel.org
+URL: https://tracker.ceph.com/issues/46284
+Signed-off-by: Luis Henriques <lhenriques@suse.de>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/caps.c | 17 ++++++++++++++++-
+ fs/ceph/mds_client.c | 25 ++++++++++++++++---------
+ fs/ceph/super.h | 2 +-
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -4224,11 +4224,19 @@ bad:
+
+ /*
+ * Delayed work handler to process end of delayed cap release LRU list.
++ *
++ * If new caps are added to the list while processing it, these won't get
++ * processed in this run. In this case, the ci->i_hold_caps_max will be
++ * returned so that the work can be scheduled accordingly.
+ */
+-void ceph_check_delayed_caps(struct ceph_mds_client *mdsc)
++unsigned long ceph_check_delayed_caps(struct ceph_mds_client *mdsc)
+ {
+ struct inode *inode;
+ struct ceph_inode_info *ci;
++ struct ceph_mount_options *opt = mdsc->fsc->mount_options;
++ unsigned long delay_max = opt->caps_wanted_delay_max * HZ;
++ unsigned long loop_start = jiffies;
++ unsigned long delay = 0;
+
+ dout("check_delayed_caps\n");
+ spin_lock(&mdsc->cap_delay_lock);
+@@ -4236,6 +4244,11 @@ void ceph_check_delayed_caps(struct ceph
+ ci = list_first_entry(&mdsc->cap_delay_list,
+ struct ceph_inode_info,
+ i_cap_delay_list);
++ if (time_before(loop_start, ci->i_hold_caps_max - delay_max)) {
++ dout("%s caps added recently. Exiting loop", __func__);
++ delay = ci->i_hold_caps_max;
++ break;
++ }
+ if ((ci->i_ceph_flags & CEPH_I_FLUSH) == 0 &&
+ time_before(jiffies, ci->i_hold_caps_max))
+ break;
+@@ -4252,6 +4265,8 @@ void ceph_check_delayed_caps(struct ceph
+ }
+ }
+ spin_unlock(&mdsc->cap_delay_lock);
++
++ return delay;
+ }
+
+ /*
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -4502,22 +4502,29 @@ void inc_session_sequence(struct ceph_md
+ }
+
+ /*
+- * delayed work -- periodically trim expired leases, renew caps with mds
++ * delayed work -- periodically trim expired leases, renew caps with mds. If
++ * the @delay parameter is set to 0 or if it's more than 5 secs, the default
++ * workqueue delay value of 5 secs will be used.
+ */
+-static void schedule_delayed(struct ceph_mds_client *mdsc)
++static void schedule_delayed(struct ceph_mds_client *mdsc, unsigned long delay)
+ {
+- int delay = 5;
+- unsigned hz = round_jiffies_relative(HZ * delay);
+- schedule_delayed_work(&mdsc->delayed_work, hz);
++ unsigned long max_delay = HZ * 5;
++
++ /* 5 secs default delay */
++ if (!delay || (delay > max_delay))
++ delay = max_delay;
++ schedule_delayed_work(&mdsc->delayed_work,
++ round_jiffies_relative(delay));
+ }
+
+ static void delayed_work(struct work_struct *work)
+ {
+- int i;
+ struct ceph_mds_client *mdsc =
+ container_of(work, struct ceph_mds_client, delayed_work.work);
++ unsigned long delay;
+ int renew_interval;
+ int renew_caps;
++ int i;
+
+ dout("mdsc delayed_work\n");
+
+@@ -4557,7 +4564,7 @@ static void delayed_work(struct work_str
+ }
+ mutex_unlock(&mdsc->mutex);
+
+- ceph_check_delayed_caps(mdsc);
++ delay = ceph_check_delayed_caps(mdsc);
+
+ ceph_queue_cap_reclaim_work(mdsc);
+
+@@ -4565,7 +4572,7 @@ static void delayed_work(struct work_str
+
+ maybe_recover_session(mdsc);
+
+- schedule_delayed(mdsc);
++ schedule_delayed(mdsc, delay);
+ }
+
+ int ceph_mdsc_init(struct ceph_fs_client *fsc)
+@@ -5042,7 +5049,7 @@ void ceph_mdsc_handle_mdsmap(struct ceph
+ mdsc->mdsmap->m_epoch);
+
+ mutex_unlock(&mdsc->mutex);
+- schedule_delayed(mdsc);
++ schedule_delayed(mdsc, 0);
+ return;
+
+ bad_unlock:
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -1170,7 +1170,7 @@ extern void ceph_flush_snaps(struct ceph
+ extern bool __ceph_should_report_size(struct ceph_inode_info *ci);
+ extern void ceph_check_caps(struct ceph_inode_info *ci, int flags,
+ struct ceph_mds_session *session);
+-extern void ceph_check_delayed_caps(struct ceph_mds_client *mdsc);
++extern unsigned long ceph_check_delayed_caps(struct ceph_mds_client *mdsc);
+ extern void ceph_flush_dirty_caps(struct ceph_mds_client *mdsc);
+ extern int ceph_drop_caps_for_unlink(struct inode *inode);
+ extern int ceph_encode_inode_release(void **p, struct inode *inode,
--- /dev/null
+From c3df5fb57fe8756d67fd56ed29da65cdfde839f9 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 27 Jul 2021 13:12:20 -1000
+Subject: cgroup: rstat: fix A-A deadlock on 32bit around u64_stats_sync
+
+From: Tejun Heo <tj@kernel.org>
+
+commit c3df5fb57fe8756d67fd56ed29da65cdfde839f9 upstream.
+
+0fa294fb1985 ("cgroup: Replace cgroup_rstat_mutex with a spinlock") added
+cgroup_rstat_flush_irqsafe() allowing flushing to happen from the irq
+context. However, rstat paths use u64_stats_sync to synchronize access to
+64bit stat counters on 32bit machines. u64_stats_sync is implemented using
+seq_lock and trying to read from an irq context can lead to A-A deadlock if
+the irq happens to interrupt the stat update.
+
+Fix it by using the irqsafe variants - u64_stats_update_begin_irqsave() and
+u64_stats_update_end_irqrestore() - in the update paths. Note that none of
+this matters on 64bit machines. All these are just for 32bit SMP setups.
+
+Note that the interface was introduced way back, its first and currently
+only use was recently added by 2d146aa3aa84 ("mm: memcontrol: switch to
+rstat"). Stable tagging targets this commit.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Rik van Riel <riel@surriel.com>
+Fixes: 2d146aa3aa84 ("mm: memcontrol: switch to rstat")
+Cc: stable@vger.kernel.org # v5.13+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-cgroup.c | 14 ++++++++------
+ kernel/cgroup/rstat.c | 19 +++++++++++--------
+ 2 files changed, 19 insertions(+), 14 deletions(-)
+
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -774,6 +774,7 @@ static void blkcg_rstat_flush(struct cgr
+ struct blkcg_gq *parent = blkg->parent;
+ struct blkg_iostat_set *bisc = per_cpu_ptr(blkg->iostat_cpu, cpu);
+ struct blkg_iostat cur, delta;
++ unsigned long flags;
+ unsigned int seq;
+
+ /* fetch the current per-cpu values */
+@@ -783,21 +784,21 @@ static void blkcg_rstat_flush(struct cgr
+ } while (u64_stats_fetch_retry(&bisc->sync, seq));
+
+ /* propagate percpu delta to global */
+- u64_stats_update_begin(&blkg->iostat.sync);
++ flags = u64_stats_update_begin_irqsave(&blkg->iostat.sync);
+ blkg_iostat_set(&delta, &cur);
+ blkg_iostat_sub(&delta, &bisc->last);
+ blkg_iostat_add(&blkg->iostat.cur, &delta);
+ blkg_iostat_add(&bisc->last, &delta);
+- u64_stats_update_end(&blkg->iostat.sync);
++ u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags);
+
+ /* propagate global delta to parent (unless that's root) */
+ if (parent && parent->parent) {
+- u64_stats_update_begin(&parent->iostat.sync);
++ flags = u64_stats_update_begin_irqsave(&parent->iostat.sync);
+ blkg_iostat_set(&delta, &blkg->iostat.cur);
+ blkg_iostat_sub(&delta, &blkg->iostat.last);
+ blkg_iostat_add(&parent->iostat.cur, &delta);
+ blkg_iostat_add(&blkg->iostat.last, &delta);
+- u64_stats_update_end(&parent->iostat.sync);
++ u64_stats_update_end_irqrestore(&parent->iostat.sync, flags);
+ }
+ }
+
+@@ -832,6 +833,7 @@ static void blkcg_fill_root_iostats(void
+ memset(&tmp, 0, sizeof(tmp));
+ for_each_possible_cpu(cpu) {
+ struct disk_stats *cpu_dkstats;
++ unsigned long flags;
+
+ cpu_dkstats = per_cpu_ptr(bdev->bd_stats, cpu);
+ tmp.ios[BLKG_IOSTAT_READ] +=
+@@ -848,9 +850,9 @@ static void blkcg_fill_root_iostats(void
+ tmp.bytes[BLKG_IOSTAT_DISCARD] +=
+ cpu_dkstats->sectors[STAT_DISCARD] << 9;
+
+- u64_stats_update_begin(&blkg->iostat.sync);
++ flags = u64_stats_update_begin_irqsave(&blkg->iostat.sync);
+ blkg_iostat_set(&blkg->iostat.cur, &tmp);
+- u64_stats_update_end(&blkg->iostat.sync);
++ u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags);
+ }
+ }
+ }
+--- a/kernel/cgroup/rstat.c
++++ b/kernel/cgroup/rstat.c
+@@ -347,19 +347,20 @@ static void cgroup_base_stat_flush(struc
+ }
+
+ static struct cgroup_rstat_cpu *
+-cgroup_base_stat_cputime_account_begin(struct cgroup *cgrp)
++cgroup_base_stat_cputime_account_begin(struct cgroup *cgrp, unsigned long *flags)
+ {
+ struct cgroup_rstat_cpu *rstatc;
+
+ rstatc = get_cpu_ptr(cgrp->rstat_cpu);
+- u64_stats_update_begin(&rstatc->bsync);
++ *flags = u64_stats_update_begin_irqsave(&rstatc->bsync);
+ return rstatc;
+ }
+
+ static void cgroup_base_stat_cputime_account_end(struct cgroup *cgrp,
+- struct cgroup_rstat_cpu *rstatc)
++ struct cgroup_rstat_cpu *rstatc,
++ unsigned long flags)
+ {
+- u64_stats_update_end(&rstatc->bsync);
++ u64_stats_update_end_irqrestore(&rstatc->bsync, flags);
+ cgroup_rstat_updated(cgrp, smp_processor_id());
+ put_cpu_ptr(rstatc);
+ }
+@@ -367,18 +368,20 @@ static void cgroup_base_stat_cputime_acc
+ void __cgroup_account_cputime(struct cgroup *cgrp, u64 delta_exec)
+ {
+ struct cgroup_rstat_cpu *rstatc;
++ unsigned long flags;
+
+- rstatc = cgroup_base_stat_cputime_account_begin(cgrp);
++ rstatc = cgroup_base_stat_cputime_account_begin(cgrp, &flags);
+ rstatc->bstat.cputime.sum_exec_runtime += delta_exec;
+- cgroup_base_stat_cputime_account_end(cgrp, rstatc);
++ cgroup_base_stat_cputime_account_end(cgrp, rstatc, flags);
+ }
+
+ void __cgroup_account_cputime_field(struct cgroup *cgrp,
+ enum cpu_usage_stat index, u64 delta_exec)
+ {
+ struct cgroup_rstat_cpu *rstatc;
++ unsigned long flags;
+
+- rstatc = cgroup_base_stat_cputime_account_begin(cgrp);
++ rstatc = cgroup_base_stat_cputime_account_begin(cgrp, &flags);
+
+ switch (index) {
+ case CPUTIME_USER:
+@@ -394,7 +397,7 @@ void __cgroup_account_cputime_field(stru
+ break;
+ }
+
+- cgroup_base_stat_cputime_account_end(cgrp, rstatc);
++ cgroup_base_stat_cputime_account_end(cgrp, rstatc, flags);
+ }
+
+ /*
--- /dev/null
+From 9e992755be8f2d458a0bcbefd19e493483c1dba2 Mon Sep 17 00:00:00 2001
+From: Rohith Surabattula <rohiths@microsoft.com>
+Date: Mon, 9 Aug 2021 09:32:46 +0000
+Subject: cifs: Call close synchronously during unlink/rename/lease break.
+
+From: Rohith Surabattula <rohiths@microsoft.com>
+
+commit 9e992755be8f2d458a0bcbefd19e493483c1dba2 upstream.
+
+During unlink/rename/lease break, deferred work for close is
+scheduled immediately but in an asynchronous manner which might
+lead to race with actual(unlink/rename) commands.
+
+This change will schedule close synchronously which will avoid
+the race conditions with other commands.
+
+Signed-off-by: Rohith Surabattula <rohiths@microsoft.com>
+Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
+Cc: stable@vger.kernel.org # 5.13
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/cifsglob.h | 5 +++++
+ fs/cifs/file.c | 35 +++++++++++++++++------------------
+ fs/cifs/misc.c | 46 ++++++++++++++++++++++++++++++++++------------
+ 3 files changed, 56 insertions(+), 30 deletions(-)
+
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1615,6 +1615,11 @@ struct dfs_info3_param {
+ int ttl;
+ };
+
++struct file_list {
++ struct list_head list;
++ struct cifsFileInfo *cfile;
++};
++
+ /*
+ * common struct for holding inode info when searching for or updating an
+ * inode with new info
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -4860,34 +4860,33 @@ void cifs_oplock_break(struct work_struc
+
+ oplock_break_ack:
+ /*
+- * releasing stale oplock after recent reconnect of smb session using
+- * a now incorrect file handle is not a data integrity issue but do
+- * not bother sending an oplock release if session to server still is
+- * disconnected since oplock already released by the server
+- */
+- if (!cfile->oplock_break_cancelled) {
+- rc = tcon->ses->server->ops->oplock_response(tcon, &cfile->fid,
+- cinode);
+- cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
+- }
+- /*
+ * When oplock break is received and there are no active
+ * file handles but cached, then schedule deferred close immediately.
+ * So, new open will not use cached handle.
+ */
+ spin_lock(&CIFS_I(inode)->deferred_lock);
+ is_deferred = cifs_is_deferred_close(cfile, &dclose);
++ spin_unlock(&CIFS_I(inode)->deferred_lock);
+ if (is_deferred &&
+ cfile->deferred_close_scheduled &&
+ delayed_work_pending(&cfile->deferred)) {
+- /*
+- * If there is no pending work, mod_delayed_work queues new work.
+- * So, Increase the ref count to avoid use-after-free.
+- */
+- if (!mod_delayed_work(deferredclose_wq, &cfile->deferred, 0))
+- cifsFileInfo_get(cfile);
++ if (cancel_delayed_work(&cfile->deferred)) {
++ _cifsFileInfo_put(cfile, false, false);
++ goto oplock_break_done;
++ }
+ }
+- spin_unlock(&CIFS_I(inode)->deferred_lock);
++ /*
++ * releasing stale oplock after recent reconnect of smb session using
++ * a now incorrect file handle is not a data integrity issue but do
++ * not bother sending an oplock release if session to server still is
++ * disconnected since oplock already released by the server
++ */
++ if (!cfile->oplock_break_cancelled) {
++ rc = tcon->ses->server->ops->oplock_response(tcon, &cfile->fid,
++ cinode);
++ cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
++ }
++oplock_break_done:
+ _cifsFileInfo_put(cfile, false /* do not wait for ourself */, false);
+ cifs_done_oplock_break(cinode);
+ }
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -735,20 +735,32 @@ void
+ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode)
+ {
+ struct cifsFileInfo *cfile = NULL;
++ struct file_list *tmp_list, *tmp_next_list;
++ struct list_head file_head;
+
+ if (cifs_inode == NULL)
+ return;
+
++ INIT_LIST_HEAD(&file_head);
++ spin_lock(&cifs_inode->open_file_lock);
+ list_for_each_entry(cfile, &cifs_inode->openFileList, flist) {
+ if (delayed_work_pending(&cfile->deferred)) {
+- /*
+- * If there is no pending work, mod_delayed_work queues new work.
+- * So, Increase the ref count to avoid use-after-free.
+- */
+- if (!mod_delayed_work(deferredclose_wq, &cfile->deferred, 0))
+- cifsFileInfo_get(cfile);
++ if (cancel_delayed_work(&cfile->deferred)) {
++ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC);
++ if (tmp_list == NULL)
++ continue;
++ tmp_list->cfile = cfile;
++ list_add_tail(&tmp_list->list, &file_head);
++ }
+ }
+ }
++ spin_unlock(&cifs_inode->open_file_lock);
++
++ list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) {
++ _cifsFileInfo_put(tmp_list->cfile, true, false);
++ list_del(&tmp_list->list);
++ kfree(tmp_list);
++ }
+ }
+
+ void
+@@ -756,20 +768,30 @@ cifs_close_all_deferred_files(struct cif
+ {
+ struct cifsFileInfo *cfile;
+ struct list_head *tmp;
++ struct file_list *tmp_list, *tmp_next_list;
++ struct list_head file_head;
+
++ INIT_LIST_HEAD(&file_head);
+ spin_lock(&tcon->open_file_lock);
+ list_for_each(tmp, &tcon->openFileList) {
+ cfile = list_entry(tmp, struct cifsFileInfo, tlist);
+ if (delayed_work_pending(&cfile->deferred)) {
+- /*
+- * If there is no pending work, mod_delayed_work queues new work.
+- * So, Increase the ref count to avoid use-after-free.
+- */
+- if (!mod_delayed_work(deferredclose_wq, &cfile->deferred, 0))
+- cifsFileInfo_get(cfile);
++ if (cancel_delayed_work(&cfile->deferred)) {
++ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC);
++ if (tmp_list == NULL)
++ continue;
++ tmp_list->cfile = cfile;
++ list_add_tail(&tmp_list->list, &file_head);
++ }
+ }
+ }
+ spin_unlock(&tcon->open_file_lock);
++
++ list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) {
++ _cifsFileInfo_put(tmp_list->cfile, true, false);
++ list_del(&tmp_list->list);
++ kfree(tmp_list);
++ }
+ }
+
+ /* parses DFS refferal V3 structure
--- /dev/null
+From 7d3fc01796fc895e5fcce45c994c5a8db8120a8d Mon Sep 17 00:00:00 2001
+From: Shyam Prasad N <sprasad@microsoft.com>
+Date: Wed, 4 Aug 2021 18:37:22 +0000
+Subject: cifs: create sd context must be a multiple of 8
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+commit 7d3fc01796fc895e5fcce45c994c5a8db8120a8d upstream.
+
+We used to follow the rule earlier that the create SD context
+always be a multiple of 8. However, with the change:
+cifs: refactor create_sd_buf() and and avoid corrupting the buffer
+...we recompute the length, and we failed that rule.
+Fixing that with this change.
+
+Cc: <stable@vger.kernel.org> # v5.10+
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/smb2pdu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2375,7 +2375,7 @@ create_sd_buf(umode_t mode, bool set_own
+ memcpy(aclptr, &acl, sizeof(struct cifs_acl));
+
+ buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd);
+- *len = ptr - (__u8 *)buf;
++ *len = roundup(ptr - (__u8 *)buf, 8);
+
+ return buf;
+ }
--- /dev/null
+From 41535701da3324b80029cabb501e86c4fafe339d Mon Sep 17 00:00:00 2001
+From: Rohith Surabattula <rohiths@microsoft.com>
+Date: Thu, 29 Jul 2021 07:45:29 +0000
+Subject: cifs: Handle race conditions during rename
+
+From: Rohith Surabattula <rohiths@microsoft.com>
+
+commit 41535701da3324b80029cabb501e86c4fafe339d upstream.
+
+When rename is executed on directory which has files for which
+close is deferred, then rename will fail with EACCES.
+
+This patch will try to close all deferred files when EACCES is received
+and retry rename on a directory.
+
+Signed-off-by: Rohith Surabattula <rohiths@microsoft.com>
+Cc: stable@vger.kernel.org # 5.13
+Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/inode.c | 19 +++++++++++++++++--
+ fs/cifs/misc.c | 16 +++++++++++-----
+ 2 files changed, 28 insertions(+), 7 deletions(-)
+
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1637,7 +1637,7 @@ int cifs_unlink(struct inode *dir, struc
+ goto unlink_out;
+ }
+
+- cifs_close_all_deferred_files(tcon);
++ cifs_close_deferred_file(CIFS_I(inode));
+ if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP &
+ le64_to_cpu(tcon->fsUnixInfo.Capability))) {
+ rc = CIFSPOSIXDelFile(xid, tcon, full_path,
+@@ -2096,6 +2096,7 @@ cifs_rename2(struct user_namespace *mnt_
+ FILE_UNIX_BASIC_INFO *info_buf_target;
+ unsigned int xid;
+ int rc, tmprc;
++ int retry_count = 0;
+
+ if (flags & ~RENAME_NOREPLACE)
+ return -EINVAL;
+@@ -2125,10 +2126,24 @@ cifs_rename2(struct user_namespace *mnt_
+ goto cifs_rename_exit;
+ }
+
+- cifs_close_all_deferred_files(tcon);
++ cifs_close_deferred_file(CIFS_I(d_inode(source_dentry)));
++ if (d_inode(target_dentry) != NULL)
++ cifs_close_deferred_file(CIFS_I(d_inode(target_dentry)));
++
+ rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry,
+ to_name);
+
++ if (rc == -EACCES) {
++ while (retry_count < 3) {
++ cifs_close_all_deferred_files(tcon);
++ rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry,
++ to_name);
++ if (rc != -EACCES)
++ break;
++ retry_count++;
++ }
++ }
++
+ /*
+ * No-replace is the natural behavior for CIFS, so skip unlink hacks.
+ */
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -735,13 +735,19 @@ void
+ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode)
+ {
+ struct cifsFileInfo *cfile = NULL;
+- struct cifs_deferred_close *dclose;
++
++ if (cifs_inode == NULL)
++ return;
+
+ list_for_each_entry(cfile, &cifs_inode->openFileList, flist) {
+- spin_lock(&cifs_inode->deferred_lock);
+- if (cifs_is_deferred_close(cfile, &dclose))
+- mod_delayed_work(deferredclose_wq, &cfile->deferred, 0);
+- spin_unlock(&cifs_inode->deferred_lock);
++ if (delayed_work_pending(&cfile->deferred)) {
++ /*
++ * If there is no pending work, mod_delayed_work queues new work.
++ * So, Increase the ref count to avoid use-after-free.
++ */
++ if (!mod_delayed_work(deferredclose_wq, &cfile->deferred, 0))
++ cifsFileInfo_get(cfile);
++ }
+ }
+ }
+
--- /dev/null
+From 981567bd965329df7e64b13e92a54da816c1e0a4 Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+Date: Tue, 10 Aug 2021 16:33:55 +1000
+Subject: cifs: use the correct max-length for dentry_path_raw()
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+commit 981567bd965329df7e64b13e92a54da816c1e0a4 upstream.
+
+RHBZ: 1972502
+
+PATH_MAX is 4096 but PAGE_SIZE can be >4096 on some architectures
+such as ppc and would thus write beyond the end of the actual object.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: Xiaoli Feng <xifeng@redhat.com>
+Suggested-by: Brian foster <bfoster@redhat.com>
+Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/dir.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -112,7 +112,7 @@ build_path_from_dentry_optional_prefix(s
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
+ pplen = cifs_sb->prepath ? strlen(cifs_sb->prepath) + 1 : 0;
+
+- s = dentry_path_raw(direntry, page, PAGE_SIZE);
++ s = dentry_path_raw(direntry, page, PATH_MAX);
+ if (IS_ERR(s))
+ return s;
+ if (!s[1]) // for root we want "", not "/"
--- /dev/null
+From c90f6263f58a28c3d97b83679d6fd693b33dfd4e Mon Sep 17 00:00:00 2001
+From: Eric Bernstein <eric.bernstein@amd.com>
+Date: Mon, 26 Jul 2021 15:53:18 -0400
+Subject: drm/amd/display: Remove invalid assert for ODM + MPC case
+
+From: Eric Bernstein <eric.bernstein@amd.com>
+
+commit c90f6263f58a28c3d97b83679d6fd693b33dfd4e upstream.
+
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Signed-off-by: Eric Bernstein <eric.bernstein@amd.com>
+Cc: stable@vger.kernel.org
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
+@@ -1788,7 +1788,6 @@ static bool dcn30_split_stream_for_mpc_o
+ }
+ pri_pipe->next_odm_pipe = sec_pipe;
+ sec_pipe->prev_odm_pipe = pri_pipe;
+- ASSERT(sec_pipe->top_pipe == NULL);
+
+ if (!sec_pipe->top_pipe)
+ sec_pipe->stream_res.opp = pool->opps[pipe_idx];
--- /dev/null
+From 0cde63a8fc4d9f9f580c297211fd05f91c0fd66d Mon Sep 17 00:00:00 2001
+From: Anson Jacob <Anson.Jacob@amd.com>
+Date: Fri, 30 Jul 2021 19:46:20 -0400
+Subject: drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work
+
+From: Anson Jacob <Anson.Jacob@amd.com>
+
+commit 0cde63a8fc4d9f9f580c297211fd05f91c0fd66d upstream.
+
+Replace GFP_KERNEL with GFP_ATOMIC as amdgpu_dm_irq_schedule_work
+can't sleep.
+
+BUG: sleeping function called from invalid context at include/linux/sched/mm.h:196
+in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 253, name: kworker/6:1H
+CPU: 6 PID: 253 Comm: kworker/6:1H Tainted: G W OE 5.11.0-promotion_2021_06_07-18_36_28_prelim_revert_retrain #8
+Hardware name: System manufacturer System Product Name/PRIME X570-PRO, BIOS 3405 02/01/2021
+Workqueue: events_highpri dm_irq_work_func [amdgpu]
+Call Trace:
+ <IRQ>
+ dump_stack+0x5e/0x74
+ ___might_sleep.cold+0x87/0x98
+ __might_sleep+0x4b/0x80
+ kmem_cache_alloc_trace+0x390/0x4f0
+ amdgpu_dm_irq_handler+0x171/0x230 [amdgpu]
+ amdgpu_irq_dispatch+0xc0/0x1e0 [amdgpu]
+ amdgpu_ih_process+0x81/0x100 [amdgpu]
+ amdgpu_irq_handler+0x26/0xa0 [amdgpu]
+ __handle_irq_event_percpu+0x49/0x190
+ ? __hrtimer_get_next_event+0x4d/0x80
+ handle_irq_event_percpu+0x33/0x80
+ handle_irq_event+0x33/0x60
+ handle_edge_irq+0x82/0x190
+ asm_call_irq_on_stack+0x12/0x20
+ </IRQ>
+ common_interrupt+0xbb/0x140
+ asm_common_interrupt+0x1e/0x40
+RIP: 0010:amdgpu_device_rreg.part.0+0x44/0xf0 [amdgpu]
+Code: 53 48 89 fb 4c 3b af c8 08 00 00 73 6d 83 e2 02 75 0d f6 87 40 62 01 00 10 0f 85 83 00 00 00 4c 03 ab d0 08 00 00 45 8b 6d 00 <8b> 05 3e b6 52 00 85 c0 7e 62 48 8b 43 08 0f b7 70 3e 65 8b 05 e3
+RSP: 0018:ffffae7740fff9e8 EFLAGS: 00000286
+RAX: ffffffffc05ee610 RBX: ffff8aaf8f620000 RCX: 0000000000000006
+RDX: 0000000000000000 RSI: 0000000000005430 RDI: ffff8aaf8f620000
+RBP: ffffae7740fffa08 R08: 0000000000000001 R09: 000000000000000a
+R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000005430
+R13: 0000000071000000 R14: 0000000000000001 R15: 0000000000005430
+ ? amdgpu_cgs_write_register+0x20/0x20 [amdgpu]
+ amdgpu_device_rreg+0x17/0x20 [amdgpu]
+ amdgpu_cgs_read_register+0x14/0x20 [amdgpu]
+ dm_read_reg_func+0x38/0xb0 [amdgpu]
+ generic_reg_wait+0x80/0x160 [amdgpu]
+ dce_aux_transfer_raw+0x324/0x7c0 [amdgpu]
+ dc_link_aux_transfer_raw+0x43/0x50 [amdgpu]
+ dm_dp_aux_transfer+0x87/0x110 [amdgpu]
+ drm_dp_dpcd_access+0x72/0x110 [drm_kms_helper]
+ drm_dp_dpcd_read+0xb7/0xf0 [drm_kms_helper]
+ drm_dp_get_one_sb_msg+0x349/0x480 [drm_kms_helper]
+ drm_dp_mst_hpd_irq+0xc5/0xe40 [drm_kms_helper]
+ ? drm_dp_mst_hpd_irq+0xc5/0xe40 [drm_kms_helper]
+ dm_handle_hpd_rx_irq+0x184/0x1a0 [amdgpu]
+ ? dm_handle_hpd_rx_irq+0x184/0x1a0 [amdgpu]
+ handle_hpd_rx_irq+0x195/0x240 [amdgpu]
+ ? __switch_to_asm+0x42/0x70
+ ? __switch_to+0x131/0x450
+ dm_irq_work_func+0x19/0x20 [amdgpu]
+ process_one_work+0x209/0x400
+ worker_thread+0x4d/0x3e0
+ ? cancel_delayed_work+0xa0/0xa0
+ kthread+0x124/0x160
+ ? kthread_park+0x90/0x90
+ ret_from_fork+0x22/0x30
+
+Reviewed-by: Aurabindo Jayamohanan Pillai <Aurabindo.Pillai@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
+Cc: stable@vger.kernel.org
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
+@@ -584,7 +584,7 @@ static void amdgpu_dm_irq_schedule_work(
+ handler_data = container_of(handler_list->next, struct amdgpu_dm_irq_handler_data, list);
+
+ /*allocate a new amdgpu_dm_irq_handler_data*/
+- handler_data_add = kzalloc(sizeof(*handler_data), GFP_KERNEL);
++ handler_data_add = kzalloc(sizeof(*handler_data), GFP_ATOMIC);
+ if (!handler_data_add) {
+ DRM_ERROR("DM_IRQ: failed to allocate irq handler!\n");
+ return;
--- /dev/null
+From 46dd2965bdd1c5a4f6499c73ff32e636fa8f9769 Mon Sep 17 00:00:00 2001
+From: Solomon Chiu <solomon.chiu@amd.com>
+Date: Wed, 28 Jul 2021 00:20:30 +0800
+Subject: drm/amdgpu: Add preferred mode in modeset when freesync video mode's enabled.
+
+From: Solomon Chiu <solomon.chiu@amd.com>
+
+commit 46dd2965bdd1c5a4f6499c73ff32e636fa8f9769 upstream.
+
+[Why]
+With kernel module parameter "freesync_video" is enabled, if the mode
+is changed to preferred mode(the mode with highest rate), then Freesync
+fails because the preferred mode is treated as one of freesync video
+mode, and then be configurated as freesync video mode(fixed refresh
+rate).
+
+[How]
+Skip freesync fixed rate configurating when modeset to preferred mode.
+
+Signed-off-by: Solomon Chiu <solomon.chiu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9410,7 +9410,12 @@ static int dm_update_crtc_state(struct a
+ } else if (amdgpu_freesync_vid_mode && aconnector &&
+ is_freesync_video_mode(&new_crtc_state->mode,
+ aconnector)) {
+- set_freesync_fixed_config(dm_new_crtc_state);
++ struct drm_display_mode *high_mode;
++
++ high_mode = get_highest_refresh_rate_mode(aconnector, false);
++ if (!drm_mode_equal(&new_crtc_state->mode, high_mode)) {
++ set_freesync_fixed_config(dm_new_crtc_state);
++ }
+ }
+
+ ret = dm_atomic_get_state(state, &dm_state);
--- /dev/null
+From 202ead5a3c589b0594a75cb99f080174f6851fed Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Aug 2021 10:03:30 -0400
+Subject: drm/amdgpu: don't enable baco on boco platforms in runpm
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 202ead5a3c589b0594a75cb99f080174f6851fed upstream.
+
+If the platform uses BOCO, don't use BACO in runtime suspend.
+We could end up executing the BACO path if the platform supports
+both.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1669
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1537,6 +1537,8 @@ static int amdgpu_pmops_runtime_suspend(
+ pci_ignore_hotplug(pdev);
+ pci_set_power_state(pdev, PCI_D3cold);
+ drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF;
++ } else if (amdgpu_device_supports_boco(drm_dev)) {
++ /* nothing to do */
+ } else if (amdgpu_device_supports_baco(drm_dev)) {
+ amdgpu_device_baco_enter(drm_dev);
+ }
--- /dev/null
+From 7cbe08a930a132d84b4cf79953b00b074ec7a2a7 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 9 Aug 2021 11:22:20 -0400
+Subject: drm/amdgpu: handle VCN instances when harvesting (v2)
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 7cbe08a930a132d84b4cf79953b00b074ec7a2a7 upstream.
+
+There may be multiple instances and only one is harvested.
+
+v2: fix typo in commit message
+
+Fixes: 83a0b8639185 ("drm/amdgpu: add judgement when add ip blocks (v2)")
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1673
+Reviewed-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: James Zhu <James.Zhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -299,6 +299,9 @@ int amdgpu_discovery_reg_base_init(struc
+ ip->major, ip->minor,
+ ip->revision);
+
++ if (le16_to_cpu(ip->hw_id) == VCN_HWID)
++ adev->vcn.num_vcn_inst++;
++
+ for (k = 0; k < num_base_address; k++) {
+ /*
+ * convert the endianness of base addresses in place,
+@@ -377,7 +380,7 @@ void amdgpu_discovery_harvest_ip(struct
+ {
+ struct binary_header *bhdr;
+ struct harvest_table *harvest_info;
+- int i;
++ int i, vcn_harvest_count = 0;
+
+ bhdr = (struct binary_header *)adev->mman.discovery_bin;
+ harvest_info = (struct harvest_table *)(adev->mman.discovery_bin +
+@@ -389,8 +392,7 @@ void amdgpu_discovery_harvest_ip(struct
+
+ switch (le32_to_cpu(harvest_info->list[i].hw_id)) {
+ case VCN_HWID:
+- adev->harvest_ip_mask |= AMD_HARVEST_IP_VCN_MASK;
+- adev->harvest_ip_mask |= AMD_HARVEST_IP_JPEG_MASK;
++ vcn_harvest_count++;
+ break;
+ case DMU_HWID:
+ adev->harvest_ip_mask |= AMD_HARVEST_IP_DMU_MASK;
+@@ -399,6 +401,10 @@ void amdgpu_discovery_harvest_ip(struct
+ break;
+ }
+ }
++ if (vcn_harvest_count == adev->vcn.num_vcn_inst) {
++ adev->harvest_ip_mask |= AMD_HARVEST_IP_VCN_MASK;
++ adev->harvest_ip_mask |= AMD_HARVEST_IP_JPEG_MASK;
++ }
+ }
+
+ int amdgpu_discovery_get_gfx_info(struct amdgpu_device *adev)
--- /dev/null
+From abd9d66a055722393d33685214c08386694871d7 Mon Sep 17 00:00:00 2001
+From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Date: Wed, 11 Aug 2021 10:48:57 +0530
+Subject: drm/i915/display: Fix the 12 BPC bits for PIPE_MISC reg
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+
+commit abd9d66a055722393d33685214c08386694871d7 upstream.
+
+Till DISPLAY12 the PIPE_MISC bits 5-7 are used to set the
+Dithering BPC, with valid values of 6, 8, 10 BPC.
+For ADLP+ these bits are used to set the PORT OUTPUT BPC, with valid
+values of: 6, 8, 10, 12 BPC, and need to be programmed whether
+dithering is enabled or not.
+
+This patch:
+-corrects the bits 5-7 for PIPE MISC register for 12 BPC.
+-renames the bits and mask to have generic names for these bits for
+dithering bpc and port output bpc.
+
+v3: Added a note for MIPI DSI which uses the PIPE_MISC for readout
+for pipe_bpp. (Uma Shankar)
+
+v2: Added 'display' to the subject and fixes tag. (Uma Shankar)
+
+Fixes: 756f85cffef2 ("drm/i915/bdw: Broadwell has PIPEMISC")
+Cc: Paulo Zanoni <paulo.r.zanoni@intel.com> (v1)
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v3.13+
+
+Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Reviewed-by: Uma Shankar <uma.shankar@intel.com>
+Signed-off-by: Uma Shankar <uma.shankar@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210811051857.109723-1-ankit.k.nautiyal@intel.com
+(cherry picked from commit 70418a68713c13da3f36c388087d0220b456a430)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_display.c | 34 +++++++++++++++++++--------
+ drivers/gpu/drm/i915/i915_reg.h | 16 ++++++++----
+ 2 files changed, 35 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -5424,16 +5424,18 @@ static void bdw_set_pipemisc(const struc
+
+ switch (crtc_state->pipe_bpp) {
+ case 18:
+- val |= PIPEMISC_DITHER_6_BPC;
++ val |= PIPEMISC_6_BPC;
+ break;
+ case 24:
+- val |= PIPEMISC_DITHER_8_BPC;
++ val |= PIPEMISC_8_BPC;
+ break;
+ case 30:
+- val |= PIPEMISC_DITHER_10_BPC;
++ val |= PIPEMISC_10_BPC;
+ break;
+ case 36:
+- val |= PIPEMISC_DITHER_12_BPC;
++ /* Port output 12BPC defined for ADLP+ */
++ if (DISPLAY_VER(dev_priv) > 12)
++ val |= PIPEMISC_12_BPC_ADLP;
+ break;
+ default:
+ MISSING_CASE(crtc_state->pipe_bpp);
+@@ -5469,15 +5471,27 @@ int bdw_get_pipemisc_bpp(struct intel_cr
+
+ tmp = intel_de_read(dev_priv, PIPEMISC(crtc->pipe));
+
+- switch (tmp & PIPEMISC_DITHER_BPC_MASK) {
+- case PIPEMISC_DITHER_6_BPC:
++ switch (tmp & PIPEMISC_BPC_MASK) {
++ case PIPEMISC_6_BPC:
+ return 18;
+- case PIPEMISC_DITHER_8_BPC:
++ case PIPEMISC_8_BPC:
+ return 24;
+- case PIPEMISC_DITHER_10_BPC:
++ case PIPEMISC_10_BPC:
+ return 30;
+- case PIPEMISC_DITHER_12_BPC:
+- return 36;
++ /*
++ * PORT OUTPUT 12 BPC defined for ADLP+.
++ *
++ * TODO:
++ * For previous platforms with DSI interface, bits 5:7
++ * are used for storing pipe_bpp irrespective of dithering.
++ * Since the value of 12 BPC is not defined for these bits
++ * on older platforms, need to find a workaround for 12 BPC
++ * MIPI DSI HW readout.
++ */
++ case PIPEMISC_12_BPC_ADLP:
++ if (DISPLAY_VER(dev_priv) > 12)
++ return 36;
++ fallthrough;
+ default:
+ MISSING_CASE(tmp);
+ return 0;
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -6134,11 +6134,17 @@ enum {
+ #define PIPEMISC_HDR_MODE_PRECISION (1 << 23) /* icl+ */
+ #define PIPEMISC_OUTPUT_COLORSPACE_YUV (1 << 11)
+ #define PIPEMISC_PIXEL_ROUNDING_TRUNC REG_BIT(8) /* tgl+ */
+-#define PIPEMISC_DITHER_BPC_MASK (7 << 5)
+-#define PIPEMISC_DITHER_8_BPC (0 << 5)
+-#define PIPEMISC_DITHER_10_BPC (1 << 5)
+-#define PIPEMISC_DITHER_6_BPC (2 << 5)
+-#define PIPEMISC_DITHER_12_BPC (3 << 5)
++/*
++ * For Display < 13, Bits 5-7 of PIPE MISC represent DITHER BPC with
++ * valid values of: 6, 8, 10 BPC.
++ * ADLP+, the bits 5-7 represent PORT OUTPUT BPC with valid values of:
++ * 6, 8, 10, 12 BPC.
++ */
++#define PIPEMISC_BPC_MASK (7 << 5)
++#define PIPEMISC_8_BPC (0 << 5)
++#define PIPEMISC_10_BPC (1 << 5)
++#define PIPEMISC_6_BPC (2 << 5)
++#define PIPEMISC_12_BPC_ADLP (4 << 5) /* adlp+ */
+ #define PIPEMISC_DITHER_ENABLE (1 << 4)
+ #define PIPEMISC_DITHER_TYPE_MASK (3 << 2)
+ #define PIPEMISC_DITHER_TYPE_SP (0 << 2)
--- /dev/null
+From 699aa57b35672c3b2f230e2b7e5d0ab8c2bde80a Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+Date: Fri, 6 Aug 2021 12:40:56 +0800
+Subject: drm/i915/gvt: Fix cached atomics setting for Windows VM
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 699aa57b35672c3b2f230e2b7e5d0ab8c2bde80a upstream.
+
+We've seen recent regression with host and windows VM running
+simultaneously that cause gpu hang or even crash. Finally bisect to
+commit 58586680ffad ("drm/i915: Disable atomics in L3 for gen9"),
+which seems cached atomics behavior difference caused regression
+issue.
+
+This tries to add new scratch register handler and add those in mmio
+save/restore list for context switch. No gpu hang produced with this one.
+
+Cc: stable@vger.kernel.org # 5.12+
+Cc: "Xu, Terrence" <terrence.xu@intel.com>
+Cc: "Bloomfield, Jon" <jon.bloomfield@intel.com>
+Cc: "Ekstrand, Jason" <jason.ekstrand@intel.com>
+Reviewed-by: Colin Xu <colin.xu@intel.com>
+Fixes: 58586680ffad ("drm/i915: Disable atomics in L3 for gen9")
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20210806044056.648016-1-zhenyuw@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gvt/handlers.c | 1 +
+ drivers/gpu/drm/i915/gvt/mmio_context.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/i915/gvt/handlers.c
++++ b/drivers/gpu/drm/i915/gvt/handlers.c
+@@ -3149,6 +3149,7 @@ static int init_bdw_mmio_info(struct int
+ MMIO_DFH(_MMIO(0xb100), D_BDW, F_CMD_ACCESS, NULL, NULL);
+ MMIO_DFH(_MMIO(0xb10c), D_BDW, F_CMD_ACCESS, NULL, NULL);
+ MMIO_D(_MMIO(0xb110), D_BDW);
++ MMIO_D(GEN9_SCRATCH_LNCF1, D_BDW_PLUS);
+
+ MMIO_F(_MMIO(0x24d0), 48, F_CMD_ACCESS | F_CMD_WRITE_PATCH, 0, 0,
+ D_BDW_PLUS, NULL, force_nonpriv_write);
+--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
++++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
+@@ -105,6 +105,8 @@ static struct engine_mmio gen9_engine_mm
+ {RCS0, COMMON_SLICE_CHICKEN2, 0xffff, true}, /* 0x7014 */
+ {RCS0, GEN9_CS_DEBUG_MODE1, 0xffff, false}, /* 0x20ec */
+ {RCS0, GEN8_L3SQCREG4, 0, false}, /* 0xb118 */
++ {RCS0, GEN9_SCRATCH1, 0, false}, /* 0xb11c */
++ {RCS0, GEN9_SCRATCH_LNCF1, 0, false}, /* 0xb008 */
+ {RCS0, GEN7_HALF_SLICE_CHICKEN1, 0xffff, true}, /* 0xe100 */
+ {RCS0, HALF_SLICE_CHICKEN2, 0xffff, true}, /* 0xe180 */
+ {RCS0, HALF_SLICE_CHICKEN3, 0xffff, true}, /* 0xe184 */
--- /dev/null
+From 86ff25ed6cd8240d18df58930bd8848b19fce308 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 29 Jul 2021 16:35:32 +0200
+Subject: i2c: dev: zero out array used for i2c reads from userspace
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 86ff25ed6cd8240d18df58930bd8848b19fce308 upstream.
+
+If an i2c driver happens to not provide the full amount of data that a
+user asks for, it is possible that some uninitialized data could be sent
+to userspace. While all in-kernel drivers look to be safe, just be sure
+by initializing the buffer to zero before it is passed to the i2c driver
+so that any future drivers will not have this issue.
+
+Also properly copy the amount of data recvieved to the userspace buffer,
+as pointed out by Dan Carpenter.
+
+Reported-by: Eric Dumazet <edumazet@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/i2c-dev.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -141,7 +141,7 @@ static ssize_t i2cdev_read(struct file *
+ if (count > 8192)
+ count = 8192;
+
+- tmp = kmalloc(count, GFP_KERNEL);
++ tmp = kzalloc(count, GFP_KERNEL);
+ if (tmp == NULL)
+ return -ENOMEM;
+
+@@ -150,7 +150,8 @@ static ssize_t i2cdev_read(struct file *
+
+ ret = i2c_master_recv(client, tmp, count);
+ if (ret >= 0)
+- ret = copy_to_user(buf, tmp, count) ? -EFAULT : ret;
++ if (copy_to_user(buf, tmp, ret))
++ ret = -EFAULT;
+ kfree(tmp);
+ return ret;
+ }
--- /dev/null
+From 5afc1540f13804a31bb704b763308e17688369c5 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 30 Jul 2021 08:16:51 +0100
+Subject: iio: adc: Fix incorrect exit of for-loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 5afc1540f13804a31bb704b763308e17688369c5 upstream.
+
+Currently the for-loop that scans for the optimial adc_period iterates
+through all the possible adc_period levels because the exit logic in
+the loop is inverted. I believe the comparison should be swapped and
+the continue replaced with a break to exit the loop at the correct
+point.
+
+Addresses-Coverity: ("Continue has no effect")
+Fixes: e08e19c331fb ("iio:adc: add iio driver for Palmas (twl6035/7) gpadc")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210730071651.17394-1-colin.king@canonical.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/palmas_gpadc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/palmas_gpadc.c
++++ b/drivers/iio/adc/palmas_gpadc.c
+@@ -664,8 +664,8 @@ static int palmas_adc_wakeup_configure(s
+
+ adc_period = adc->auto_conversion_period;
+ for (i = 0; i < 16; ++i) {
+- if (((1000 * (1 << i)) / 32) < adc_period)
+- continue;
++ if (((1000 * (1 << i)) / 32) >= adc_period)
++ break;
+ }
+ if (i > 0)
+ i--;
--- /dev/null
+From 9898cb24e454602beb6e17bacf9f97b26c85c955 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Fri, 9 Jul 2021 12:11:10 +0200
+Subject: iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit 9898cb24e454602beb6e17bacf9f97b26c85c955 upstream.
+
+The ADS7950 requires that CS is deasserted after each SPI word. Before
+commit e2540da86ef8 ("iio: adc: ti-ads7950: use SPI_CS_WORD to reduce
+CPU usage") the driver used a message with one spi transfer per channel
+where each but the last one had .cs_change set to enforce a CS toggle.
+This was wrongly translated into a message with a single transfer and
+.cs_change set which results in a CS toggle after each word but the
+last which corrupts the first adc conversion of all readouts after the
+first readout.
+
+Fixes: e2540da86ef8 ("iio: adc: ti-ads7950: use SPI_CS_WORD to reduce CPU usage")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: David Lechner <david@lechnology.com>
+Tested-by: David Lechner <david@lechnology.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210709101110.1814294-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ti-ads7950.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/iio/adc/ti-ads7950.c
++++ b/drivers/iio/adc/ti-ads7950.c
+@@ -568,7 +568,6 @@ static int ti_ads7950_probe(struct spi_d
+ st->ring_xfer.tx_buf = &st->tx_buf[0];
+ st->ring_xfer.rx_buf = &st->rx_buf[0];
+ /* len will be set later */
+- st->ring_xfer.cs_change = true;
+
+ spi_message_add_tail(&st->ring_xfer, &st->ring_msg);
+
--- /dev/null
+From 7e77ef8b8d600cf8448a2bbd32f682c28884551f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Antti=20Ker=C3=A4nen?= <detegr@rbx.email>
+Date: Thu, 8 Jul 2021 12:54:29 +0300
+Subject: iio: adis: set GPIO reset pin direction
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antti Keränen <detegr@rbx.email>
+
+commit 7e77ef8b8d600cf8448a2bbd32f682c28884551f upstream.
+
+Set reset pin direction to output as the reset pin needs to be an active
+low output pin.
+
+Co-developed-by: Hannu Hartikainen <hannu@hrtk.in>
+Signed-off-by: Hannu Hartikainen <hannu@hrtk.in>
+Signed-off-by: Antti Keränen <detegr@rbx.email>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Fixes: ecb010d44108 ("iio: imu: adis: Refactor adis_initial_startup")
+Link: https://lore.kernel.org/r/20210708095425.13295-1-detegr@rbx.email
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/adis.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/iio/imu/adis.c
++++ b/drivers/iio/imu/adis.c
+@@ -415,12 +415,11 @@ int __adis_initial_startup(struct adis *
+ int ret;
+
+ /* check if the device has rst pin low */
+- gpio = devm_gpiod_get_optional(&adis->spi->dev, "reset", GPIOD_ASIS);
++ gpio = devm_gpiod_get_optional(&adis->spi->dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(gpio))
+ return PTR_ERR(gpio);
+
+ if (gpio) {
+- gpiod_set_value_cansleep(gpio, 1);
+ msleep(10);
+ /* bring device out of reset */
+ gpiod_set_value_cansleep(gpio, 0);
--- /dev/null
+From 84edec86f449adea9ee0b4912a79ab8d9d65abb7 Mon Sep 17 00:00:00 2001
+From: Chris Lesiak <chris.lesiak@licor.com>
+Date: Mon, 14 Jun 2021 09:18:20 -0500
+Subject: iio: humidity: hdc100x: Add margin to the conversion time
+
+From: Chris Lesiak <chris.lesiak@licor.com>
+
+commit 84edec86f449adea9ee0b4912a79ab8d9d65abb7 upstream.
+
+The datasheets have the following note for the conversion time
+specification: "This parameter is specified by design and/or
+characterization and it is not tested in production."
+
+Parts have been seen that require more time to do 14-bit conversions for
+the relative humidity channel. The result is ENXIO due to the address
+phase of a transfer not getting an ACK.
+
+Delay an additional 1 ms per conversion to allow for additional margin.
+
+Fixes: 4839367d99e3 ("iio: humidity: add HDC100x support")
+Signed-off-by: Chris Lesiak <chris.lesiak@licor.com>
+Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Link: https://lore.kernel.org/r/20210614141820.2034827-1-chris.lesiak@licor.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/humidity/hdc100x.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/humidity/hdc100x.c
++++ b/drivers/iio/humidity/hdc100x.c
+@@ -25,6 +25,8 @@
+ #include <linux/iio/trigger_consumer.h>
+ #include <linux/iio/triggered_buffer.h>
+
++#include <linux/time.h>
++
+ #define HDC100X_REG_TEMP 0x00
+ #define HDC100X_REG_HUMIDITY 0x01
+
+@@ -166,7 +168,7 @@ static int hdc100x_get_measurement(struc
+ struct iio_chan_spec const *chan)
+ {
+ struct i2c_client *client = data->client;
+- int delay = data->adc_int_us[chan->address];
++ int delay = data->adc_int_us[chan->address] + 1*USEC_PER_MSEC;
+ int ret;
+ __be16 val;
+
+@@ -316,7 +318,7 @@ static irqreturn_t hdc100x_trigger_handl
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct hdc100x_data *data = iio_priv(indio_dev);
+ struct i2c_client *client = data->client;
+- int delay = data->adc_int_us[0] + data->adc_int_us[1];
++ int delay = data->adc_int_us[0] + data->adc_int_us[1] + 2*USEC_PER_MSEC;
+ int ret;
+
+ /* dual read starts at temp register */
--- /dev/null
+From c018db4a57f3e31a9cb24d528e9f094eda89a499 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Mon, 9 Aug 2021 08:15:50 -0600
+Subject: io_uring: drop ctx->uring_lock before flushing work item
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit c018db4a57f3e31a9cb24d528e9f094eda89a499 upstream.
+
+Ammar reports that he's seeing a lockdep splat on running test/rsrc_tags
+from the regression suite:
+
+======================================================
+WARNING: possible circular locking dependency detected
+5.14.0-rc3-bluetea-test-00249-gc7d102232649 #5 Tainted: G OE
+------------------------------------------------------
+kworker/2:4/2684 is trying to acquire lock:
+ffff88814bb1c0a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_rsrc_put_work+0x13d/0x1a0
+
+but task is already holding lock:
+ffffc90001c6be70 ((work_completion)(&(&ctx->rsrc_put_work)->work)){+.+.}-{0:0}, at: process_one_work+0x1bc/0x530
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #1 ((work_completion)(&(&ctx->rsrc_put_work)->work)){+.+.}-{0:0}:
+ __flush_work+0x31b/0x490
+ io_rsrc_ref_quiesce.part.0.constprop.0+0x35/0xb0
+ __do_sys_io_uring_register+0x45b/0x1060
+ do_syscall_64+0x35/0xb0
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+-> #0 (&ctx->uring_lock){+.+.}-{3:3}:
+ __lock_acquire+0x119a/0x1e10
+ lock_acquire+0xc8/0x2f0
+ __mutex_lock+0x86/0x740
+ io_rsrc_put_work+0x13d/0x1a0
+ process_one_work+0x236/0x530
+ worker_thread+0x52/0x3b0
+ kthread+0x135/0x160
+ ret_from_fork+0x1f/0x30
+
+other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock((work_completion)(&(&ctx->rsrc_put_work)->work));
+ lock(&ctx->uring_lock);
+ lock((work_completion)(&(&ctx->rsrc_put_work)->work));
+ lock(&ctx->uring_lock);
+
+ *** DEADLOCK ***
+
+2 locks held by kworker/2:4/2684:
+ #0: ffff88810004d938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1bc/0x530
+ #1: ffffc90001c6be70 ((work_completion)(&(&ctx->rsrc_put_work)->work)){+.+.}-{0:0}, at: process_one_work+0x1bc/0x530
+
+stack backtrace:
+CPU: 2 PID: 2684 Comm: kworker/2:4 Tainted: G OE 5.14.0-rc3-bluetea-test-00249-gc7d102232649 #5
+Hardware name: Acer Aspire ES1-421/OLVIA_BE, BIOS V1.05 07/02/2015
+Workqueue: events io_rsrc_put_work
+Call Trace:
+ dump_stack_lvl+0x6a/0x9a
+ check_noncircular+0xfe/0x110
+ __lock_acquire+0x119a/0x1e10
+ lock_acquire+0xc8/0x2f0
+ ? io_rsrc_put_work+0x13d/0x1a0
+ __mutex_lock+0x86/0x740
+ ? io_rsrc_put_work+0x13d/0x1a0
+ ? io_rsrc_put_work+0x13d/0x1a0
+ ? io_rsrc_put_work+0x13d/0x1a0
+ ? process_one_work+0x1ce/0x530
+ io_rsrc_put_work+0x13d/0x1a0
+ process_one_work+0x236/0x530
+ worker_thread+0x52/0x3b0
+ ? process_one_work+0x530/0x530
+ kthread+0x135/0x160
+ ? set_kthread_struct+0x40/0x40
+ ret_from_fork+0x1f/0x30
+
+which is due to holding the ctx->uring_lock when flushing existing
+pending work, while the pending work flushing may need to grab the uring
+lock if we're using IOPOLL.
+
+Fix this by dropping the uring_lock a bit earlier as part of the flush.
+
+Cc: stable@vger.kernel.org
+Link: https://github.com/axboe/liburing/issues/404
+Tested-by: Ammar Faizi <ammarfaizi2@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/io_uring.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -7166,17 +7166,19 @@ static int io_rsrc_ref_quiesce(struct io
+ /* kill initial ref, already quiesced if zero */
+ if (atomic_dec_and_test(&data->refs))
+ break;
++ mutex_unlock(&ctx->uring_lock);
+ flush_delayed_work(&ctx->rsrc_put_work);
+ ret = wait_for_completion_interruptible(&data->done);
+- if (!ret)
++ if (!ret) {
++ mutex_lock(&ctx->uring_lock);
+ break;
++ }
+
+ atomic_inc(&data->refs);
+ /* wait for all works potentially completing data->done */
+ flush_delayed_work(&ctx->rsrc_put_work);
+ reinit_completion(&data->done);
+
+- mutex_unlock(&ctx->uring_lock);
+ ret = io_run_task_work_sig();
+ mutex_lock(&ctx->uring_lock);
+ } while (ret >= 0);
--- /dev/null
+From 43597aac1f87230cb565ab354d331682f13d3c7a Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Tue, 10 Aug 2021 02:44:23 +0100
+Subject: io_uring: fix ctx-exit io_rsrc_put_work() deadlock
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 43597aac1f87230cb565ab354d331682f13d3c7a upstream.
+
+__io_rsrc_put_work() might need ->uring_lock, so nobody should wait for
+rsrc nodes holding the mutex. However, that's exactly what
+io_ring_ctx_free() does with io_wait_rsrc_data().
+
+Split it into rsrc wait + dealloc, and move the first one out of the
+lock.
+
+Cc: stable@vger.kernel.org
+Fixes: b60c8dce33895 ("io_uring: preparation for rsrc tagging")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/0130c5c2693468173ec1afab714e0885d2c9c363.1628559783.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/io_uring.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8614,13 +8614,10 @@ static void io_req_caches_free(struct io
+ mutex_unlock(&ctx->uring_lock);
+ }
+
+-static bool io_wait_rsrc_data(struct io_rsrc_data *data)
++static void io_wait_rsrc_data(struct io_rsrc_data *data)
+ {
+- if (!data)
+- return false;
+- if (!atomic_dec_and_test(&data->refs))
++ if (data && !atomic_dec_and_test(&data->refs))
+ wait_for_completion(&data->done);
+- return true;
+ }
+
+ static void io_ring_ctx_free(struct io_ring_ctx *ctx)
+@@ -8632,10 +8629,14 @@ static void io_ring_ctx_free(struct io_r
+ ctx->mm_account = NULL;
+ }
+
++ /* __io_rsrc_put_work() may need uring_lock to progress, wait w/o it */
++ io_wait_rsrc_data(ctx->buf_data);
++ io_wait_rsrc_data(ctx->file_data);
++
+ mutex_lock(&ctx->uring_lock);
+- if (io_wait_rsrc_data(ctx->buf_data))
++ if (ctx->buf_data)
+ __io_sqe_buffers_unregister(ctx);
+- if (io_wait_rsrc_data(ctx->file_data))
++ if (ctx->file_data)
+ __io_sqe_files_unregister(ctx);
+ if (ctx->rings)
+ __io_cqring_overflow_flush(ctx, true);
--- /dev/null
+From 854f32648b8a5e424d682953b1a9f3b7c3322701 Mon Sep 17 00:00:00 2001
+From: Liang Wang <wangliang101@huawei.com>
+Date: Fri, 13 Aug 2021 16:54:45 -0700
+Subject: lib: use PFN_PHYS() in devmem_is_allowed()
+
+From: Liang Wang <wangliang101@huawei.com>
+
+commit 854f32648b8a5e424d682953b1a9f3b7c3322701 upstream.
+
+The physical address may exceed 32 bits on 32-bit systems with more than
+32 bits of physcial address. Use PFN_PHYS() in devmem_is_allowed(), or
+the physical address may overflow and be truncated.
+
+We found this bug when mapping a high addresses through devmem tool,
+when CONFIG_STRICT_DEVMEM is enabled on the ARM with ARM_LPAE and devmem
+is used to map a high address that is not in the iomem address range, an
+unexpected error indicating no permission is returned.
+
+This bug was initially introduced from v2.6.37, and the function was
+moved to lib in v5.11.
+
+Link: https://lkml.kernel.org/r/20210731025057.78825-1-wangliang101@huawei.com
+Fixes: 087aaffcdf9c ("ARM: implement CONFIG_STRICT_DEVMEM by disabling access to RAM via /dev/mem")
+Fixes: 527701eda5f1 ("lib: Add a generic version of devmem_is_allowed()")
+Signed-off-by: Liang Wang <wangliang101@huawei.com>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Palmer Dabbelt <palmerdabbelt@google.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Liang Wang <wangliang101@huawei.com>
+Cc: Xiaoming Ni <nixiaoming@huawei.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [2.6.37+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/devmem_is_allowed.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/devmem_is_allowed.c
++++ b/lib/devmem_is_allowed.c
+@@ -19,7 +19,7 @@
+ */
+ int devmem_is_allowed(unsigned long pfn)
+ {
+- if (iomem_is_exclusive(pfn << PAGE_SHIFT))
++ if (iomem_is_exclusive(PFN_PHYS(pfn)))
+ return 0;
+ if (!page_is_ram(pfn))
+ return 1;
--- /dev/null
+From d9cee9f85b22fab88d2b76d2e92b18e3d0e6aa8c Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 30 Jul 2021 09:46:04 -0700
+Subject: libnvdimm/region: Fix label activation vs errors
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit d9cee9f85b22fab88d2b76d2e92b18e3d0e6aa8c upstream.
+
+There are a few scenarios where init_active_labels() can return without
+registering deactivate_labels() to run when the region is disabled. In
+particular label error injection creates scenarios where a DIMM is
+disabled, but labels on other DIMMs in the region become activated.
+
+Arrange for init_active_labels() to always register deactivate_labels().
+
+Reported-by: Krzysztof Kensicki <krzysztof.kensicki@intel.com>
+Cc: <stable@vger.kernel.org>
+Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation.")
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Link: https://lore.kernel.org/r/162766356450.3223041.1183118139023841447.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvdimm/namespace_devs.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -2527,7 +2527,7 @@ static void deactivate_labels(void *regi
+
+ static int init_active_labels(struct nd_region *nd_region)
+ {
+- int i;
++ int i, rc = 0;
+
+ for (i = 0; i < nd_region->ndr_mappings; i++) {
+ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
+@@ -2546,13 +2546,14 @@ static int init_active_labels(struct nd_
+ else if (test_bit(NDD_LABELING, &nvdimm->flags))
+ /* fail, labels needed to disambiguate dpa */;
+ else
+- return 0;
++ continue;
+
+ dev_err(&nd_region->dev, "%s: is %s, failing probe\n",
+ dev_name(&nd_mapping->nvdimm->dev),
+ test_bit(NDD_LOCKED, &nvdimm->flags)
+ ? "locked" : "disabled");
+- return -ENXIO;
++ rc = -ENXIO;
++ goto out;
+ }
+ nd_mapping->ndd = ndd;
+ atomic_inc(&nvdimm->busy);
+@@ -2586,13 +2587,17 @@ static int init_active_labels(struct nd_
+ break;
+ }
+
+- if (i < nd_region->ndr_mappings) {
++ if (i < nd_region->ndr_mappings)
++ rc = -ENOMEM;
++
++out:
++ if (rc) {
+ deactivate_labels(nd_region);
+- return -ENOMEM;
++ return rc;
+ }
+
+ return devm_add_action_or_reset(&nd_region->dev, deactivate_labels,
+- nd_region);
++ nd_region);
+ }
+
+ int nd_region_register_namespaces(struct nd_region *nd_region, int *err)
--- /dev/null
+From acc68b8d2a1196c4db806947606f162dbeed2274 Mon Sep 17 00:00:00 2001
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Thu, 5 Aug 2021 17:55:11 +0300
+Subject: net: ethernet: ti: cpsw: fix min eth packet size for non-switch use-cases
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+commit acc68b8d2a1196c4db806947606f162dbeed2274 upstream.
+
+The CPSW switchdev driver inherited fix from commit 9421c9015047 ("net:
+ethernet: ti: cpsw: fix min eth packet size") which changes min TX packet
+size to 64bytes (VLAN_ETH_ZLEN, excluding ETH_FCS). It was done to fix HW
+packed drop issue when packets are sent from Host to the port with PVID and
+un-tagging enabled. Unfortunately this breaks some other non-switch
+specific use-cases, like:
+- [1] CPSW port as DSA CPU port with DSA-tag applied at the end of the
+packet
+- [2] Some industrial protocols, which expects min TX packet size 60Bytes
+(excluding FCS).
+
+Fix it by configuring min TX packet size depending on driver mode
+ - 60Bytes (ETH_ZLEN) for multi mac (dual-mac) mode
+ - 64Bytes (VLAN_ETH_ZLEN) for switch mode
+and update it during driver mode change and annotate with
+READ_ONCE()/WRITE_ONCE() as it can be read by napi while writing.
+
+[1] https://lore.kernel.org/netdev/20210531124051.GA15218@cephalopod/
+[2] https://e2e.ti.com/support/arm/sitara_arm/f/791/t/701669
+
+Cc: stable@vger.kernel.org
+Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac")
+Reported-by: Ben Hutchings <ben.hutchings@essensium.com>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpsw_new.c | 7 +++++--
+ drivers/net/ethernet/ti/cpsw_priv.h | 4 +++-
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/ti/cpsw_new.c
++++ b/drivers/net/ethernet/ti/cpsw_new.c
+@@ -920,7 +920,7 @@ static netdev_tx_t cpsw_ndo_start_xmit(s
+ struct cpdma_chan *txch;
+ int ret, q_idx;
+
+- if (skb_padto(skb, CPSW_MIN_PACKET_SIZE)) {
++ if (skb_put_padto(skb, READ_ONCE(priv->tx_packet_min))) {
+ cpsw_err(priv, tx_err, "packet pad failed\n");
+ ndev->stats.tx_dropped++;
+ return NET_XMIT_DROP;
+@@ -1100,7 +1100,7 @@ static int cpsw_ndo_xdp_xmit(struct net_
+
+ for (i = 0; i < n; i++) {
+ xdpf = frames[i];
+- if (xdpf->len < CPSW_MIN_PACKET_SIZE)
++ if (xdpf->len < READ_ONCE(priv->tx_packet_min))
+ break;
+
+ if (cpsw_xdp_tx_frame(priv, xdpf, NULL, priv->emac_port))
+@@ -1389,6 +1389,7 @@ static int cpsw_create_ports(struct cpsw
+ priv->dev = dev;
+ priv->msg_enable = netif_msg_init(debug_level, CPSW_DEBUG);
+ priv->emac_port = i + 1;
++ priv->tx_packet_min = CPSW_MIN_PACKET_SIZE;
+
+ if (is_valid_ether_addr(slave_data->mac_addr)) {
+ ether_addr_copy(priv->mac_addr, slave_data->mac_addr);
+@@ -1686,6 +1687,7 @@ static int cpsw_dl_switch_mode_set(struc
+
+ priv = netdev_priv(sl_ndev);
+ slave->port_vlan = vlan;
++ WRITE_ONCE(priv->tx_packet_min, CPSW_MIN_PACKET_SIZE_VLAN);
+ if (netif_running(sl_ndev))
+ cpsw_port_add_switch_def_ale_entries(priv,
+ slave);
+@@ -1714,6 +1716,7 @@ static int cpsw_dl_switch_mode_set(struc
+
+ priv = netdev_priv(slave->ndev);
+ slave->port_vlan = slave->data->dual_emac_res_vlan;
++ WRITE_ONCE(priv->tx_packet_min, CPSW_MIN_PACKET_SIZE);
+ cpsw_port_add_dual_emac_def_ale_entries(priv, slave);
+ }
+
+--- a/drivers/net/ethernet/ti/cpsw_priv.h
++++ b/drivers/net/ethernet/ti/cpsw_priv.h
+@@ -89,7 +89,8 @@ do { \
+
+ #define CPSW_POLL_WEIGHT 64
+ #define CPSW_RX_VLAN_ENCAP_HDR_SIZE 4
+-#define CPSW_MIN_PACKET_SIZE (VLAN_ETH_ZLEN)
++#define CPSW_MIN_PACKET_SIZE_VLAN (VLAN_ETH_ZLEN)
++#define CPSW_MIN_PACKET_SIZE (ETH_ZLEN)
+ #define CPSW_MAX_PACKET_SIZE (VLAN_ETH_FRAME_LEN +\
+ ETH_FCS_LEN +\
+ CPSW_RX_VLAN_ENCAP_HDR_SIZE)
+@@ -380,6 +381,7 @@ struct cpsw_priv {
+ u32 emac_port;
+ struct cpsw_common *cpsw;
+ int offload_fwd_mark;
++ u32 tx_packet_min;
+ };
+
+ #define ndev_to_cpsw(ndev) (((struct cpsw_priv *)netdev_priv(ndev))->cpsw)
--- /dev/null
+From 34737e1320db6d51f0d140d5c684b9eb32f0da76 Mon Sep 17 00:00:00 2001
+From: Loic Poulain <loic.poulain@linaro.org>
+Date: Fri, 6 Aug 2021 12:35:09 +0200
+Subject: net: wwan: mhi_wwan_ctrl: Fix possible deadlock
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+commit 34737e1320db6d51f0d140d5c684b9eb32f0da76 upstream.
+
+Lockdep detected possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&mhiwwan->rx_lock);
+ local_irq_disable();
+ lock(&mhi_cntrl->pm_lock);
+ lock(&mhiwwan->rx_lock);
+ <Interrupt>
+ lock(&mhi_cntrl->pm_lock);
+
+ *** DEADLOCK ***
+
+To prevent this we need to disable the soft-interrupts when taking
+the rx_lock.
+
+Cc: stable@vger.kernel.org
+Fixes: fa588eba632d ("net: Add Qcom WWAN control driver")
+Reported-by: Thomas Perrot <thomas.perrot@bootlin.com>
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Reviewed-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wwan/mhi_wwan_ctrl.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wwan/mhi_wwan_ctrl.c
++++ b/drivers/net/wwan/mhi_wwan_ctrl.c
+@@ -41,14 +41,14 @@ struct mhi_wwan_dev {
+ /* Increment RX budget and schedule RX refill if necessary */
+ static void mhi_wwan_rx_budget_inc(struct mhi_wwan_dev *mhiwwan)
+ {
+- spin_lock(&mhiwwan->rx_lock);
++ spin_lock_bh(&mhiwwan->rx_lock);
+
+ mhiwwan->rx_budget++;
+
+ if (test_bit(MHI_WWAN_RX_REFILL, &mhiwwan->flags))
+ schedule_work(&mhiwwan->rx_refill);
+
+- spin_unlock(&mhiwwan->rx_lock);
++ spin_unlock_bh(&mhiwwan->rx_lock);
+ }
+
+ /* Decrement RX budget if non-zero and return true on success */
+@@ -56,7 +56,7 @@ static bool mhi_wwan_rx_budget_dec(struc
+ {
+ bool ret = false;
+
+- spin_lock(&mhiwwan->rx_lock);
++ spin_lock_bh(&mhiwwan->rx_lock);
+
+ if (mhiwwan->rx_budget) {
+ mhiwwan->rx_budget--;
+@@ -64,7 +64,7 @@ static bool mhi_wwan_rx_budget_dec(struc
+ ret = true;
+ }
+
+- spin_unlock(&mhiwwan->rx_lock);
++ spin_unlock_bh(&mhiwwan->rx_lock);
+
+ return ret;
+ }
+@@ -130,9 +130,9 @@ static void mhi_wwan_ctrl_stop(struct ww
+ {
+ struct mhi_wwan_dev *mhiwwan = wwan_port_get_drvdata(port);
+
+- spin_lock(&mhiwwan->rx_lock);
++ spin_lock_bh(&mhiwwan->rx_lock);
+ clear_bit(MHI_WWAN_RX_REFILL, &mhiwwan->flags);
+- spin_unlock(&mhiwwan->rx_lock);
++ spin_unlock_bh(&mhiwwan->rx_lock);
+
+ cancel_work_sync(&mhiwwan->rx_refill);
+
--- /dev/null
+From 31697ef7f3f45293bba3da87bcc710953e97fc3e Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <damien.lemoal@wdc.com>
+Date: Fri, 6 Aug 2021 09:43:11 +0900
+Subject: pinctrl: k210: Fix k210_fpioa_probe()
+
+From: Damien Le Moal <damien.lemoal@wdc.com>
+
+commit 31697ef7f3f45293bba3da87bcc710953e97fc3e upstream.
+
+In k210_fpioa_probe(), add missing calls to clk_disable_unprepare() in
+case of error after cenabling the clk and pclk clocks. Also add missing
+error handling when enabling pclk.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: d4c34d09ab03 ("pinctrl: Add RISC-V Canaan Kendryte K210 FPIOA driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Link: https://lore.kernel.org/r/20210806004311.52859-1-damien.lemoal@wdc.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/pinctrl-k210.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+--- a/drivers/pinctrl/pinctrl-k210.c
++++ b/drivers/pinctrl/pinctrl-k210.c
+@@ -950,23 +950,37 @@ static int k210_fpioa_probe(struct platf
+ return ret;
+
+ pdata->pclk = devm_clk_get_optional(dev, "pclk");
+- if (!IS_ERR(pdata->pclk))
+- clk_prepare_enable(pdata->pclk);
++ if (!IS_ERR(pdata->pclk)) {
++ ret = clk_prepare_enable(pdata->pclk);
++ if (ret)
++ goto disable_clk;
++ }
+
+ pdata->sysctl_map =
+ syscon_regmap_lookup_by_phandle_args(np,
+ "canaan,k210-sysctl-power",
+ 1, &pdata->power_offset);
+- if (IS_ERR(pdata->sysctl_map))
+- return PTR_ERR(pdata->sysctl_map);
++ if (IS_ERR(pdata->sysctl_map)) {
++ ret = PTR_ERR(pdata->sysctl_map);
++ goto disable_pclk;
++ }
+
+ k210_fpioa_init_ties(pdata);
+
+ pdata->pctl = pinctrl_register(&k210_pinctrl_desc, dev, (void *)pdata);
+- if (IS_ERR(pdata->pctl))
+- return PTR_ERR(pdata->pctl);
++ if (IS_ERR(pdata->pctl)) {
++ ret = PTR_ERR(pdata->pctl);
++ goto disable_pclk;
++ }
+
+ return 0;
++
++disable_pclk:
++ clk_disable_unprepare(pdata->pclk);
++disable_clk:
++ clk_disable_unprepare(pdata->clk);
++
++ return ret;
+ }
+
+ static const struct of_device_id k210_fpioa_dt_ids[] = {
--- /dev/null
+From 664cc971fb259007e49cc8a3ac43b0787d89443f Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 10 Aug 2021 09:10:15 +0200
+Subject: Revert "usb: dwc3: gadget: Use list_replace_init() before traversing lists"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 664cc971fb259007e49cc8a3ac43b0787d89443f upstream.
+
+This reverts commit d25d85061bd856d6be221626605319154f9b5043 as it is
+reported to cause problems on many different types of boards.
+
+Reported-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Reported-by: John Stultz <john.stultz@linaro.org>
+Cc: Ray Chi <raychi@google.com>
+Link: https://lore.kernel.org/r/CANcMJZCEVxVLyFgLwK98hqBEdc0_n4P0x_K6Gih8zNH3ouzbJQ@mail.gmail.com
+Fixes: d25d85061bd8 ("usb: dwc3: gadget: Use list_replace_init() before traversing lists")
+Cc: stable <stable@vger.kernel.org>
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Wesley Cheng <wcheng@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 18 ++----------------
+ 1 file changed, 2 insertions(+), 16 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1741,13 +1741,9 @@ static void dwc3_gadget_ep_cleanup_cance
+ {
+ struct dwc3_request *req;
+ struct dwc3_request *tmp;
+- struct list_head local;
+ struct dwc3 *dwc = dep->dwc;
+
+-restart:
+- list_replace_init(&dep->cancelled_list, &local);
+-
+- list_for_each_entry_safe(req, tmp, &local, list) {
++ list_for_each_entry_safe(req, tmp, &dep->cancelled_list, list) {
+ dwc3_gadget_ep_skip_trbs(dep, req);
+ switch (req->status) {
+ case DWC3_REQUEST_STATUS_DISCONNECTED:
+@@ -1765,9 +1761,6 @@ restart:
+ break;
+ }
+ }
+-
+- if (!list_empty(&dep->cancelled_list))
+- goto restart;
+ }
+
+ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
+@@ -2963,12 +2956,8 @@ static void dwc3_gadget_ep_cleanup_compl
+ {
+ struct dwc3_request *req;
+ struct dwc3_request *tmp;
+- struct list_head local;
+
+-restart:
+- list_replace_init(&dep->started_list, &local);
+-
+- list_for_each_entry_safe(req, tmp, &local, list) {
++ list_for_each_entry_safe(req, tmp, &dep->started_list, list) {
+ int ret;
+
+ ret = dwc3_gadget_ep_cleanup_completed_request(dep, event,
+@@ -2976,9 +2965,6 @@ restart:
+ if (ret)
+ break;
+ }
+-
+- if (!list_empty(&dep->started_list))
+- goto restart;
+ }
+
+ static bool dwc3_gadget_ep_should_continue(struct dwc3_ep *dep)
--- /dev/null
+From 030d6dbf0c2e5fdf23ad29557f0c87a882993e26 Mon Sep 17 00:00:00 2001
+From: Changbin Du <changbin.du@gmail.com>
+Date: Thu, 22 Jul 2021 10:17:15 +0800
+Subject: riscv: kexec: do not add '-mno-relax' flag if compiler doesn't support it
+
+From: Changbin Du <changbin.du@gmail.com>
+
+commit 030d6dbf0c2e5fdf23ad29557f0c87a882993e26 upstream.
+
+The RISC-V special option '-mno-relax' which to disable linker relaxations
+is supported by GCC8+. For GCC7 and lower versions do not support this
+option.
+
+Fixes: fba8a8674f68 ("RISC-V: Add kexec support")
+Signed-off-by: Changbin Du <changbin.du@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/kernel/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/riscv/kernel/Makefile
++++ b/arch/riscv/kernel/Makefile
+@@ -11,7 +11,7 @@ endif
+ CFLAGS_syscall_table.o += $(call cc-option,-Wno-override-init,)
+
+ ifdef CONFIG_KEXEC
+-AFLAGS_kexec_relocate.o := -mcmodel=medany -mno-relax
++AFLAGS_kexec_relocate.o := -mcmodel=medany $(call cc-option,-mno-relax)
+ endif
+
+ extra-y += head.o
--- /dev/null
+From 9977d880f7a3c233db9165a75a3a14defc2a4aee Mon Sep 17 00:00:00 2001
+From: "Ewan D. Milne" <emilne@redhat.com>
+Date: Mon, 9 Aug 2021 11:09:47 -0400
+Subject: scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash
+
+From: Ewan D. Milne <emilne@redhat.com>
+
+commit 9977d880f7a3c233db9165a75a3a14defc2a4aee upstream.
+
+The phba->poll_list is traversed in case of an error in
+lpfc_sli4_hba_setup(), so it must be initialized earlier in case the error
+path is taken.
+
+[ 490.030738] lpfc 0000:65:00.0: 0:1413 Failed to init iocb list.
+[ 490.036661] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
+[ 490.044485] PGD 0 P4D 0
+[ 490.047027] Oops: 0000 [#1] SMP PTI
+[ 490.050518] CPU: 0 PID: 7 Comm: kworker/0:1 Kdump: loaded Tainted: G I --------- - - 4.18.
+[ 490.060511] Hardware name: Dell Inc. PowerEdge R440/0WKGTH, BIOS 1.4.8 05/22/2018
+[ 490.067994] Workqueue: events work_for_cpu_fn
+[ 490.072371] RIP: 0010:lpfc_sli4_cleanup_poll_list+0x20/0xb0 [lpfc]
+[ 490.078546] Code: cf e9 04 f7 fe ff 0f 1f 40 00 0f 1f 44 00 00 41 57 49 89 ff 41 56 41 55 41 54 4d 8d a79
+[ 490.097291] RSP: 0018:ffffbd1a463dbcc8 EFLAGS: 00010246
+[ 490.102518] RAX: 0000000000008200 RBX: ffff945cdb8c0000 RCX: 0000000000000000
+[ 490.109649] RDX: 0000000000018200 RSI: ffff9468d0e16818 RDI: 0000000000000000
+[ 490.116783] RBP: ffff945cdb8c1740 R08: 00000000000015c5 R09: 0000000000000042
+[ 490.123915] R10: 0000000000000000 R11: ffffbd1a463dbab0 R12: ffff945cdb8c25c0
+[ 490.131049] R13: 00000000fffffff4 R14: 0000000000001800 R15: ffff945cdb8c0000
+[ 490.138182] FS: 0000000000000000(0000) GS:ffff9468d0e00000(0000) knlGS:0000000000000000
+[ 490.146267] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 490.152013] CR2: 0000000000000000 CR3: 000000042ca10002 CR4: 00000000007706f0
+[ 490.159146] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 490.166277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 490.173409] PKRU: 55555554
+[ 490.176123] Call Trace:
+[ 490.178598] lpfc_sli4_queue_destroy+0x7f/0x3c0 [lpfc]
+[ 490.183745] lpfc_sli4_hba_setup+0x1bc7/0x23e0 [lpfc]
+[ 490.188797] ? kernfs_activate+0x63/0x80
+[ 490.192721] ? kernfs_add_one+0xe7/0x130
+[ 490.196647] ? __kernfs_create_file+0x80/0xb0
+[ 490.201020] ? lpfc_pci_probe_one_s4.isra.48+0x46f/0x9e0 [lpfc]
+[ 490.206944] lpfc_pci_probe_one_s4.isra.48+0x46f/0x9e0 [lpfc]
+[ 490.212697] lpfc_pci_probe_one+0x179/0xb70 [lpfc]
+[ 490.217492] local_pci_probe+0x41/0x90
+[ 490.221246] work_for_cpu_fn+0x16/0x20
+[ 490.224994] process_one_work+0x1a7/0x360
+[ 490.229009] ? create_worker+0x1a0/0x1a0
+[ 490.232933] worker_thread+0x1cf/0x390
+[ 490.236687] ? create_worker+0x1a0/0x1a0
+[ 490.240612] kthread+0x116/0x130
+[ 490.243846] ? kthread_flush_work_fn+0x10/0x10
+[ 490.248293] ret_from_fork+0x35/0x40
+[ 490.251869] Modules linked in: lpfc(+) xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4i
+[ 490.332609] CR2: 0000000000000000
+
+Link: https://lore.kernel.org/r/20210809150947.18104-1-emilne@redhat.com
+Fixes: 93a4d6f40198 ("scsi: lpfc: Add registration for CPU Offline/Online events")
+Cc: stable@vger.kernel.org
+Reviewed-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -13091,6 +13091,8 @@ lpfc_pci_probe_one_s4(struct pci_dev *pd
+ if (!phba)
+ return -ENOMEM;
+
++ INIT_LIST_HEAD(&phba->poll_list);
++
+ /* Perform generic PCI device enabling operation */
+ error = lpfc_enable_pci_dev(phba);
+ if (error)
+@@ -13225,7 +13227,6 @@ lpfc_pci_probe_one_s4(struct pci_dev *pd
+ /* Enable RAS FW log support */
+ lpfc_sli4_ras_setup(phba);
+
+- INIT_LIST_HEAD(&phba->poll_list);
+ timer_setup(&phba->cpuhp_poll_timer, lpfc_sli4_poll_hbtimer, 0);
+ cpuhp_state_add_instance_nocalls(lpfc_cpuhp_state, &phba->cpuhp);
+
--- /dev/null
+From b4d8a58f8dcfcc890f296696cadb76e77be44b5f Mon Sep 17 00:00:00 2001
+From: Hsuan-Chi Kuo <hsuanchikuo@gmail.com>
+Date: Thu, 4 Mar 2021 17:37:08 -0600
+Subject: seccomp: Fix setting loaded filter count during TSYNC
+
+From: Hsuan-Chi Kuo <hsuanchikuo@gmail.com>
+
+commit b4d8a58f8dcfcc890f296696cadb76e77be44b5f upstream.
+
+The desired behavior is to set the caller's filter count to thread's.
+This value is reported via /proc, so this fixes the inaccurate count
+exposed to userspace; it is not used for reference counting, etc.
+
+Signed-off-by: Hsuan-Chi Kuo <hsuanchikuo@gmail.com>
+Link: https://lore.kernel.org/r/20210304233708.420597-1-hsuanchikuo@gmail.com
+Co-developed-by: Wiktor Garbacz <wiktorg@google.com>
+Signed-off-by: Wiktor Garbacz <wiktorg@google.com>
+Link: https://lore.kernel.org/lkml/20210810125158.329849-1-wiktorg@google.com
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Fixes: c818c03b661c ("seccomp: Report number of loaded filters in /proc/$pid/status")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/seccomp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -602,7 +602,7 @@ static inline void seccomp_sync_threads(
+ smp_store_release(&thread->seccomp.filter,
+ caller->seccomp.filter);
+ atomic_set(&thread->seccomp.filter_count,
+- atomic_read(&thread->seccomp.filter_count));
++ atomic_read(&caller->seccomp.filter_count));
+
+ /*
+ * Don't let an unprivileged task work around
--- /dev/null
+lib-use-pfn_phys-in-devmem_is_allowed.patch
+revert-usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch
+iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch
+iio-adis-set-gpio-reset-pin-direction.patch
+iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch
+iio-adc-fix-incorrect-exit-of-for-loop.patch
+asoc-amd-fix-reference-to-pcm-buffer-address.patch
+asoc-xilinx-fix-reference-to-pcm-buffer-address.patch
+asoc-uniphier-fix-reference-to-pcm-buffer-address.patch
+asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch
+asoc-kirkwood-fix-reference-to-pcm-buffer-address.patch
+asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch
+i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch
+cifs-handle-race-conditions-during-rename.patch
+cifs-create-sd-context-must-be-a-multiple-of-8.patch
+cifs-call-close-synchronously-during-unlink-rename-lease-break.patch
+cifs-use-the-correct-max-length-for-dentry_path_raw.patch
+io_uring-drop-ctx-uring_lock-before-flushing-work-item.patch
+io_uring-fix-ctx-exit-io_rsrc_put_work-deadlock.patch
+scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch
+cgroup-rstat-fix-a-a-deadlock-on-32bit-around-u64_stats_sync.patch
+seccomp-fix-setting-loaded-filter-count-during-tsync.patch
+net-wwan-mhi_wwan_ctrl-fix-possible-deadlock.patch
+net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch
+arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch
+ceph-reduce-contention-in-ceph_check_delayed_caps.patch
+pinctrl-k210-fix-k210_fpioa_probe.patch
+acpi-nfit-fix-support-for-virtual-spa-ranges.patch
+libnvdimm-region-fix-label-activation-vs-errors.patch
+riscv-kexec-do-not-add-mno-relax-flag-if-compiler-doesn-t-support-it.patch
+vmlinux.lds.h-handle-clang-s-module.-c-d-tor-sections.patch
+drm-i915-gvt-fix-cached-atomics-setting-for-windows-vm.patch
+drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch
+drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch
+drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch
+drm-amdgpu-add-preferred-mode-in-modeset-when-freesync-video-mode-s-enabled.patch
+drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch
+drm-amdgpu-handle-vcn-instances-when-harvesting-v2.patch
--- /dev/null
+From 848378812e40152abe9b9baf58ce2004f76fb988 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Fri, 30 Jul 2021 19:31:08 -0700
+Subject: vmlinux.lds.h: Handle clang's module.{c,d}tor sections
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 848378812e40152abe9b9baf58ce2004f76fb988 upstream.
+
+A recent change in LLVM causes module_{c,d}tor sections to appear when
+CONFIG_K{A,C}SAN are enabled, which results in orphan section warnings
+because these are not handled anywhere:
+
+ld.lld: warning: arch/x86/pci/built-in.a(legacy.o):(.text.asan.module_ctor) is being placed in '.text.asan.module_ctor'
+ld.lld: warning: arch/x86/pci/built-in.a(legacy.o):(.text.asan.module_dtor) is being placed in '.text.asan.module_dtor'
+ld.lld: warning: arch/x86/pci/built-in.a(legacy.o):(.text.tsan.module_ctor) is being placed in '.text.tsan.module_ctor'
+
+Fangrui explains: "the function asan.module_ctor has the SHF_GNU_RETAIN
+flag, so it is in a separate section even with -fno-function-sections
+(default)".
+
+Place them in the TEXT_TEXT section so that these technologies continue
+to work with the newer compiler versions. All of the KASAN and KCSAN
+KUnit tests continue to pass after this change.
+
+Cc: stable@vger.kernel.org
+Link: https://github.com/ClangBuiltLinux/linux/issues/1432
+Link: https://github.com/llvm/llvm-project/commit/7b789562244ee941b7bf2cefeb3fc08a59a01865
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Fangrui Song <maskray@google.com>
+Acked-by: Marco Elver <elver@google.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20210731023107.1932981-1-nathan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/asm-generic/vmlinux.lds.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -586,6 +586,7 @@
+ NOINSTR_TEXT \
+ *(.text..refcount) \
+ *(.ref.text) \
++ *(.text.asan.* .text.tsan.*) \
+ TEXT_CFI_JT \
+ MEM_KEEP(init.text*) \
+ MEM_KEEP(exit.text*) \
projects / thirdparty / kernel / stable-queue.git / commitdiff
