--- /dev/null
+From 5253cb8c00a6f4356760efb38bca0e0393aa06de Mon Sep 17 00:00:00 2001
+From: Tomasz Maciej Nowak <tmn505@gmail.com>
+Date: Thu, 27 Feb 2020 17:52:32 +0100
+Subject: arm64: dts: marvell: espressobin: add ethernet alias
+
+From: Tomasz Maciej Nowak <tmn505@gmail.com>
+
+commit 5253cb8c00a6f4356760efb38bca0e0393aa06de upstream.
+
+The maker of this board and its variants, stores MAC address in U-Boot
+environment. Add alias for bootloader to recognise, to which ethernet
+node inject the factory MAC address.
+
+Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+[pali: Backported to 5.4 and older versions]
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+@@ -19,6 +19,12 @@
+ model = "Globalscale Marvell ESPRESSOBin Board";
+ compatible = "globalscale,espressobin", "marvell,armada3720", "marvell,armada3710";
+
++ aliases {
++ ethernet0 = ð0;
++ serial0 = &uart0;
++ serial1 = &uart1;
++ };
++
+ chosen {
+ stdout-path = "serial0:115200n8";
+ };
--- /dev/null
+From b5ac98cbb8e5e30c34ebc837d1e5a3982d2b5f5c Mon Sep 17 00:00:00 2001
+From: Marius Iacob <themariusus@gmail.com>
+Date: Sat, 1 Aug 2020 15:34:46 +0300
+Subject: drm: Added orientation quirk for ASUS tablet model T103HAF
+
+From: Marius Iacob <themariusus@gmail.com>
+
+commit b5ac98cbb8e5e30c34ebc837d1e5a3982d2b5f5c upstream.
+
+Signed-off-by: Marius Iacob <themariusus@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200801123445.1514567-1-themariusus@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -121,6 +121,12 @@ static const struct dmi_system_id orient
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
++ }, { /* Asus T103HAF */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
++ },
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* GPD MicroPC (generic strings, also match on bios date) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
--- /dev/null
+From 8b0379a85762b516c7b46aed7dbf2a4947c00564 Mon Sep 17 00:00:00 2001
+From: hersen wu <hersenxs.wu@amd.com>
+Date: Sun, 19 Jul 2020 17:21:59 -0400
+Subject: drm/amd/display: dchubbub p-state warning during surface planes switch
+
+From: hersen wu <hersenxs.wu@amd.com>
+
+commit 8b0379a85762b516c7b46aed7dbf2a4947c00564 upstream.
+
+[Why]
+ramp_up_dispclk_with_dpp is to change dispclk, dppclk and dprefclk
+according to bandwidth requirement. call stack: rv1_update_clocks -->
+update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth
+--> prepare_bandwidth / optimize_bandwidth. before change dcn hw,
+prepare_bandwidth will be called first to allow enough clock,
+watermark for change, after end of dcn hw change, optimize_bandwidth
+is executed to lower clock to save power for new dcn hw settings.
+
+below is sequence of commit_planes_for_stream:
+step 1: prepare_bandwidth - raise clock to have enough bandwidth
+step 2: lock_doublebuffer_enable
+step 3: pipe_control_lock(true) - make dchubp register change will
+not take effect right way
+step 4: apply_ctx_for_surface - program dchubp
+step 5: pipe_control_lock(false) - dchubp register change take effect
+step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream
+for full_date, optimize clock to save power
+
+at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be
+changed for new dchubp configuration. but real dcn hub dchubps are
+still running with old configuration until end of step 5. this need
+clocks settings at step 1 should not less than that before step 1.
+this is checked by two conditions: 1. if (should_set_clock(safe_to_lower
+, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) ||
+new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz)
+2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz
+
+the second condition is based on new dchubp configuration. dppclk
+for new dchubp may be different from dppclk before step 1.
+for example, before step 1, dchubps are as below:
+pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979)
+pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080)
+for dppclk for pipe0 need dppclk = dispclk
+
+new dchubp pipe split configuration:
+pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080)
+pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080)
+dppclk only needs dppclk = dispclk /2.
+
+dispclk, dppclk are not lock by otg master lock. they take effect
+after step 1. during this transition, dispclk are the same, but
+dppclk is changed to half of previous clock for old dchubp
+configuration between step 1 and step 6. This may cause p-state
+warning intermittently.
+
+[How]
+for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we
+need make sure dppclk are not changed to less between step 1 and 6.
+for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz,
+new display clock is raised, but we do not know ratio of
+new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz,
+new_clocks->dispclk_khz /2 does not guarantee equal or higher than
+old dppclk. we could ignore power saving different between
+dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6.
+as long as safe_to_lower = false, set dpclk = dispclk to simplify
+condition check.
+
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
+Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
+Acked-by: Eryk Brol <eryk.brol@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c | 69 ++++++++++++-
+ 1 file changed, 67 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c
+@@ -85,12 +85,77 @@ static int rv1_determine_dppclk_threshol
+ return disp_clk_threshold;
+ }
+
+-static void ramp_up_dispclk_with_dpp(struct clk_mgr_internal *clk_mgr, struct dc *dc, struct dc_clocks *new_clocks)
++static void ramp_up_dispclk_with_dpp(
++ struct clk_mgr_internal *clk_mgr,
++ struct dc *dc,
++ struct dc_clocks *new_clocks,
++ bool safe_to_lower)
+ {
+ int i;
+ int dispclk_to_dpp_threshold = rv1_determine_dppclk_threshold(clk_mgr, new_clocks);
+ bool request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz;
+
++ /* this function is to change dispclk, dppclk and dprefclk according to
++ * bandwidth requirement. Its call stack is rv1_update_clocks -->
++ * update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth
++ * --> prepare_bandwidth / optimize_bandwidth. before change dcn hw,
++ * prepare_bandwidth will be called first to allow enough clock,
++ * watermark for change, after end of dcn hw change, optimize_bandwidth
++ * is executed to lower clock to save power for new dcn hw settings.
++ *
++ * below is sequence of commit_planes_for_stream:
++ *
++ * step 1: prepare_bandwidth - raise clock to have enough bandwidth
++ * step 2: lock_doublebuffer_enable
++ * step 3: pipe_control_lock(true) - make dchubp register change will
++ * not take effect right way
++ * step 4: apply_ctx_for_surface - program dchubp
++ * step 5: pipe_control_lock(false) - dchubp register change take effect
++ * step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream
++ * for full_date, optimize clock to save power
++ *
++ * at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be
++ * changed for new dchubp configuration. but real dcn hub dchubps are
++ * still running with old configuration until end of step 5. this need
++ * clocks settings at step 1 should not less than that before step 1.
++ * this is checked by two conditions: 1. if (should_set_clock(safe_to_lower
++ * , new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) ||
++ * new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz)
++ * 2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz
++ *
++ * the second condition is based on new dchubp configuration. dppclk
++ * for new dchubp may be different from dppclk before step 1.
++ * for example, before step 1, dchubps are as below:
++ * pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979)
++ * pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080)
++ * for dppclk for pipe0 need dppclk = dispclk
++ *
++ * new dchubp pipe split configuration:
++ * pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080)
++ * pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080)
++ * dppclk only needs dppclk = dispclk /2.
++ *
++ * dispclk, dppclk are not lock by otg master lock. they take effect
++ * after step 1. during this transition, dispclk are the same, but
++ * dppclk is changed to half of previous clock for old dchubp
++ * configuration between step 1 and step 6. This may cause p-state
++ * warning intermittently.
++ *
++ * for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we
++ * need make sure dppclk are not changed to less between step 1 and 6.
++ * for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz,
++ * new display clock is raised, but we do not know ratio of
++ * new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz,
++ * new_clocks->dispclk_khz /2 does not guarantee equal or higher than
++ * old dppclk. we could ignore power saving different between
++ * dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6.
++ * as long as safe_to_lower = false, set dpclk = dispclk to simplify
++ * condition check.
++ * todo: review this change for other asic.
++ **/
++ if (!safe_to_lower)
++ request_dpp_div = false;
++
+ /* set disp clk to dpp clk threshold */
+
+ clk_mgr->funcs->set_dispclk(clk_mgr, dispclk_to_dpp_threshold);
+@@ -206,7 +271,7 @@ static void rv1_update_clocks(struct clk
+ /* program dispclk on = as a w/a for sleep resume clock ramping issues */
+ if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz)
+ || new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) {
+- ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks);
++ ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks, safe_to_lower);
+ clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz;
+ send_request_to_lower = true;
+ }
--- /dev/null
+From f87812284172a9809820d10143b573d833cd3f75 Mon Sep 17 00:00:00 2001
+From: Sandeep Raghuraman <sandy.8925@gmail.com>
+Date: Thu, 6 Aug 2020 22:52:20 +0530
+Subject: drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume
+
+From: Sandeep Raghuraman <sandy.8925@gmail.com>
+
+commit f87812284172a9809820d10143b573d833cd3f75 upstream.
+
+Reproducing bug report here:
+After hibernating and resuming, DPM is not enabled. This remains the case
+even if you test hibernate using the steps here:
+https://www.kernel.org/doc/html/latest/power/basic-pm-debugging.html
+
+I debugged the problem, and figured out that in the file hardwaremanager.c,
+in the function, phm_enable_dynamic_state_management(), the check
+'if (!hwmgr->pp_one_vf && smum_is_dpm_running(hwmgr) && !amdgpu_passthrough(adev) && adev->in_suspend)'
+returns true for the hibernate case, and false for the suspend case.
+
+This means that for the hibernate case, the AMDGPU driver doesn't enable DPM
+(even though it should) and simply returns from that function.
+In the suspend case, it goes ahead and enables DPM, even though it doesn't need to.
+
+I debugged further, and found out that in the case of suspend, for the
+CIK/Hawaii GPUs, smum_is_dpm_running(hwmgr) returns false, while in the case of
+hibernate, smum_is_dpm_running(hwmgr) returns true.
+
+For CIK, the ci_is_dpm_running() function calls the ci_is_smc_ram_running() function,
+which is ultimately used to determine if DPM is currently enabled or not,
+and this seems to provide the wrong answer.
+
+I've changed the ci_is_dpm_running() function to instead use the same method that
+some other AMD GPU chips do (e.g Fiji), which seems to read the voltage controller.
+I've tested on my R9 390 and it seems to work correctly for both suspend and
+hibernate use cases, and has been stable so far.
+
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=208839
+Signed-off-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -2725,7 +2725,10 @@ static int ci_initialize_mc_reg_table(st
+
+ static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr)
+ {
+- return ci_is_smc_ram_running(hwmgr);
++ return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device,
++ CGS_IND_REG__SMC, FEATURE_STATUS,
++ VOLTAGE_CONTROLLER_ON))
++ ? true : false;
+ }
+
+ static int ci_smu_init(struct pp_hwmgr *hwmgr)
--- /dev/null
+From a34a0a632dd991a371fec56431d73279f9c54029 Mon Sep 17 00:00:00 2001
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+Date: Sun, 19 Jul 2020 23:45:45 +0800
+Subject: drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+
+commit a34a0a632dd991a371fec56431d73279f9c54029 upstream.
+
+drm_dp_mst_allocate_vcpi() invokes
+drm_dp_mst_topology_get_port_validated(), which increases the refcount
+of the "port".
+
+These reference counting issues take place in two exception handling
+paths separately. Either when “slots” is less than 0 or when
+drm_dp_init_vcpi() returns a negative value, the function forgets to
+reduce the refcnt increased drm_dp_mst_topology_get_port_validated(),
+which results in a refcount leak.
+
+Fix these issues by pulling up the error handling when "slots" is less
+than 0, and calling drm_dp_mst_topology_put_port() before termination
+when drm_dp_init_vcpi() returns a negative value.
+
+Fixes: 1e797f556c61 ("drm/dp: Split drm_dp_mst_allocate_vcpi")
+Cc: <stable@vger.kernel.org> # v4.12+
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200719154545.GA41231@xin-virtual-machine
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -3369,11 +3369,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm
+ {
+ int ret;
+
+- port = drm_dp_mst_topology_get_port_validated(mgr, port);
+- if (!port)
++ if (slots < 0)
+ return false;
+
+- if (slots < 0)
++ port = drm_dp_mst_topology_get_port_validated(mgr, port);
++ if (!port)
+ return false;
+
+ if (port->vcpi.vcpi > 0) {
+@@ -3389,6 +3389,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm
+ if (ret) {
+ DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n",
+ DIV_ROUND_UP(pbn, mgr->pbn_div), ret);
++ drm_dp_mst_topology_put_port(port);
+ goto out;
+ }
+ DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",
--- /dev/null
+From 114427b8927a4def2942b2b886f7e4aeae289ccb Mon Sep 17 00:00:00 2001
+From: Denis Efremov <efremov@linux.com>
+Date: Mon, 8 Jun 2020 18:17:28 +0300
+Subject: drm/panfrost: Use kvfree() to free bo->sgts
+
+From: Denis Efremov <efremov@linux.com>
+
+commit 114427b8927a4def2942b2b886f7e4aeae289ccb upstream.
+
+Use kvfree() to free bo->sgts, because the memory is allocated with
+kvmalloc_array() in panfrost_mmu_map_fault_addr().
+
+Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations")
+Cc: stable@vger.kernel.org
+Signed-off-by: Denis Efremov <efremov@linux.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200608151728.234026-1-efremov@linux.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/panfrost/panfrost_gem.c | 2 +-
+ drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/panfrost/panfrost_gem.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c
+@@ -46,7 +46,7 @@ static void panfrost_gem_free_object(str
+ sg_free_table(&bo->sgts[i]);
+ }
+ }
+- kfree(bo->sgts);
++ kvfree(bo->sgts);
+ }
+
+ drm_gem_shmem_free_object(obj);
+--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
+@@ -486,7 +486,7 @@ static int panfrost_mmu_map_fault_addr(s
+ pages = kvmalloc_array(bo->base.base.size >> PAGE_SHIFT,
+ sizeof(struct page *), GFP_KERNEL | __GFP_ZERO);
+ if (!pages) {
+- kfree(bo->sgts);
++ kvfree(bo->sgts);
+ bo->sgts = NULL;
+ mutex_unlock(&bo->base.pages_lock);
+ ret = -ENOMEM;
--- /dev/null
+From f29aa08852e1953e461f2d47ab13c34e14bc08b3 Mon Sep 17 00:00:00 2001
+From: Denis Efremov <efremov@linux.com>
+Date: Mon, 22 Jun 2020 23:31:22 +0300
+Subject: drm/radeon: fix fb_div check in ni_init_smc_spll_table()
+
+From: Denis Efremov <efremov@linux.com>
+
+commit f29aa08852e1953e461f2d47ab13c34e14bc08b3 upstream.
+
+clk_s is checked twice in a row in ni_init_smc_spll_table().
+fb_div should be checked instead.
+
+Fixes: 69e0b57a91ad ("drm/radeon/kms: add dpm support for cayman (v5)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Denis Efremov <efremov@linux.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni_dpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/ni_dpm.c
++++ b/drivers/gpu/drm/radeon/ni_dpm.c
+@@ -2125,7 +2125,7 @@ static int ni_init_smc_spll_table(struct
+ if (p_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_PDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_PDIV_SHIFT))
+ ret = -EINVAL;
+
+- if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT))
++ if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT))
+ ret = -EINVAL;
+
+ if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT))
--- /dev/null
+From 18e77600f7a1ed69f8ce46c9e11cad0985712dfa Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Thu, 6 Aug 2020 23:26:22 -0700
+Subject: khugepaged: retract_page_tables() remember to test exit
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 18e77600f7a1ed69f8ce46c9e11cad0985712dfa upstream.
+
+Only once have I seen this scenario (and forgot even to notice what forced
+the eventual crash): a sequence of "BUG: Bad page map" alerts from
+vm_normal_page(), from zap_pte_range() servicing exit_mmap();
+pmd:00000000, pte values corresponding to data in physical page 0.
+
+The pte mappings being zapped in this case were supposed to be from a huge
+page of ext4 text (but could as well have been shmem): my belief is that
+it was racing with collapse_file()'s retract_page_tables(), found *pmd
+pointing to a page table, locked it, but *pmd had become 0 by the time
+start_pte was decided.
+
+In most cases, that possibility is excluded by holding mmap lock; but
+exit_mmap() proceeds without mmap lock. Most of what's run by khugepaged
+checks khugepaged_test_exit() after acquiring mmap lock:
+khugepaged_collapse_pte_mapped_thps() and hugepage_vma_revalidate() do so,
+for example. But retract_page_tables() did not: fix that.
+
+The fix is for retract_page_tables() to check khugepaged_test_exit(),
+after acquiring mmap lock, before doing anything to the page table.
+Getting the mmap lock serializes with __mmput(), which briefly takes and
+drops it in __khugepaged_exit(); then the khugepaged_test_exit() check on
+mm_users makes sure we don't touch the page table once exit_mmap() might
+reach it, since exit_mmap() will be proceeding without mmap lock, not
+expecting anyone to be racing with it.
+
+Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages")
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: <stable@vger.kernel.org> [4.8+]
+Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008021215400.27773@eggly.anvils
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/khugepaged.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1414,6 +1414,7 @@ out:
+ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
+ {
+ struct vm_area_struct *vma;
++ struct mm_struct *mm;
+ unsigned long addr;
+ pmd_t *pmd, _pmd;
+
+@@ -1442,7 +1443,8 @@ static void retract_page_tables(struct a
+ continue;
+ if (vma->vm_end < addr + HPAGE_PMD_SIZE)
+ continue;
+- pmd = mm_find_pmd(vma->vm_mm, addr);
++ mm = vma->vm_mm;
++ pmd = mm_find_pmd(mm, addr);
+ if (!pmd)
+ continue;
+ /*
+@@ -1452,17 +1454,19 @@ static void retract_page_tables(struct a
+ * mmap_sem while holding page lock. Fault path does it in
+ * reverse order. Trylock is a way to avoid deadlock.
+ */
+- if (down_write_trylock(&vma->vm_mm->mmap_sem)) {
+- spinlock_t *ptl = pmd_lock(vma->vm_mm, pmd);
+- /* assume page table is clear */
+- _pmd = pmdp_collapse_flush(vma, addr, pmd);
+- spin_unlock(ptl);
+- up_write(&vma->vm_mm->mmap_sem);
+- mm_dec_nr_ptes(vma->vm_mm);
+- pte_free(vma->vm_mm, pmd_pgtable(_pmd));
++ if (down_write_trylock(&mm->mmap_sem)) {
++ if (!khugepaged_test_exit(mm)) {
++ spinlock_t *ptl = pmd_lock(mm, pmd);
++ /* assume page table is clear */
++ _pmd = pmdp_collapse_flush(vma, addr, pmd);
++ spin_unlock(ptl);
++ mm_dec_nr_ptes(mm);
++ pte_free(mm, pmd_pgtable(_pmd));
++ }
++ up_write(&mm->mmap_sem);
+ } else {
+ /* Try again later */
+- khugepaged_add_pte_mapped_thp(vma->vm_mm, addr);
++ khugepaged_add_pte_mapped_thp(mm, addr);
+ }
+ }
+ i_mmap_unlock_write(mapping);
tools-build-feature-quote-cc-and-cxx-for-their-argum.patch
perf-x86-rapl-fix-missing-psys-sysfs-attributes.patch
sh-landisk-add-missing-initialization-of-sh_io_port_.patch
+khugepaged-retract_page_tables-remember-to-test-exit.patch
+arm64-dts-marvell-espressobin-add-ethernet-alias.patch
+drm-radeon-fix-fb_div-check-in-ni_init_smc_spll_table.patch
+drm-panfrost-use-kvfree-to-free-bo-sgts.patch
+drm-added-orientation-quirk-for-asus-tablet-model-t103haf.patch
+drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch
+drm-amdgpu-fix-bug-where-dpm-is-not-enabled-after-hibernate-and-resume.patch
+drm-amd-display-dchubbub-p-state-warning-during-surface-planes-switch.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
