From: Greg Kroah-Hartman Date: Thu, 20 Aug 2020 08:43:44 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.14.194~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=058934fde7193c4ad9da0d7e2ad4c135e8ba490e;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: arm64-dts-marvell-espressobin-add-ethernet-alias.patch drm-added-orientation-quirk-for-asus-tablet-model-t103haf.patch drm-amd-display-dchubbub-p-state-warning-during-surface-planes-switch.patch drm-amdgpu-fix-bug-where-dpm-is-not-enabled-after-hibernate-and-resume.patch drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch drm-panfrost-use-kvfree-to-free-bo-sgts.patch drm-radeon-fix-fb_div-check-in-ni_init_smc_spll_table.patch khugepaged-retract_page_tables-remember-to-test-exit.patch --- diff --git a/queue-5.4/arm64-dts-marvell-espressobin-add-ethernet-alias.patch b/queue-5.4/arm64-dts-marvell-espressobin-add-ethernet-alias.patch new file mode 100644 index 00000000000..428db54215b --- /dev/null +++ b/queue-5.4/arm64-dts-marvell-espressobin-add-ethernet-alias.patch @@ -0,0 +1,37 @@ +From 5253cb8c00a6f4356760efb38bca0e0393aa06de Mon Sep 17 00:00:00 2001 +From: Tomasz Maciej Nowak +Date: Thu, 27 Feb 2020 17:52:32 +0100 +Subject: arm64: dts: marvell: espressobin: add ethernet alias + +From: Tomasz Maciej Nowak + +commit 5253cb8c00a6f4356760efb38bca0e0393aa06de upstream. + +The maker of this board and its variants, stores MAC address in U-Boot +environment. Add alias for bootloader to recognise, to which ethernet +node inject the factory MAC address. + +Signed-off-by: Tomasz Maciej Nowak +Signed-off-by: Gregory CLEMENT +[pali: Backported to 5.4 and older versions] +Signed-off-by: Pali Rohár +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts +@@ -19,6 +19,12 @@ + model = "Globalscale Marvell ESPRESSOBin Board"; + compatible = "globalscale,espressobin", "marvell,armada3720", "marvell,armada3710"; + ++ aliases { ++ ethernet0 = ð0; ++ serial0 = &uart0; ++ serial1 = &uart1; ++ }; ++ + chosen { + stdout-path = "serial0:115200n8"; + }; diff --git a/queue-5.4/drm-added-orientation-quirk-for-asus-tablet-model-t103haf.patch b/queue-5.4/drm-added-orientation-quirk-for-asus-tablet-model-t103haf.patch new file mode 100644 index 00000000000..bcf70e66558 --- /dev/null +++ b/queue-5.4/drm-added-orientation-quirk-for-asus-tablet-model-t103haf.patch @@ -0,0 +1,34 @@ +From b5ac98cbb8e5e30c34ebc837d1e5a3982d2b5f5c Mon Sep 17 00:00:00 2001 +From: Marius Iacob +Date: Sat, 1 Aug 2020 15:34:46 +0300 +Subject: drm: Added orientation quirk for ASUS tablet model T103HAF + +From: Marius Iacob + +commit b5ac98cbb8e5e30c34ebc837d1e5a3982d2b5f5c upstream. + +Signed-off-by: Marius Iacob +Cc: stable@vger.kernel.org +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20200801123445.1514567-1-themariusus@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -121,6 +121,12 @@ static const struct dmi_system_id orient + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* Asus T103HAF */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* GPD MicroPC (generic strings, also match on bios date) */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), diff --git a/queue-5.4/drm-amd-display-dchubbub-p-state-warning-during-surface-planes-switch.patch b/queue-5.4/drm-amd-display-dchubbub-p-state-warning-during-surface-planes-switch.patch new file mode 100644 index 00000000000..7cf9b44b711 --- /dev/null +++ b/queue-5.4/drm-amd-display-dchubbub-p-state-warning-during-surface-planes-switch.patch @@ -0,0 +1,168 @@ +From 8b0379a85762b516c7b46aed7dbf2a4947c00564 Mon Sep 17 00:00:00 2001 +From: hersen wu +Date: Sun, 19 Jul 2020 17:21:59 -0400 +Subject: drm/amd/display: dchubbub p-state warning during surface planes switch + +From: hersen wu + +commit 8b0379a85762b516c7b46aed7dbf2a4947c00564 upstream. + +[Why] +ramp_up_dispclk_with_dpp is to change dispclk, dppclk and dprefclk +according to bandwidth requirement. call stack: rv1_update_clocks --> +update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth +--> prepare_bandwidth / optimize_bandwidth. before change dcn hw, +prepare_bandwidth will be called first to allow enough clock, +watermark for change, after end of dcn hw change, optimize_bandwidth +is executed to lower clock to save power for new dcn hw settings. + +below is sequence of commit_planes_for_stream: +step 1: prepare_bandwidth - raise clock to have enough bandwidth +step 2: lock_doublebuffer_enable +step 3: pipe_control_lock(true) - make dchubp register change will +not take effect right way +step 4: apply_ctx_for_surface - program dchubp +step 5: pipe_control_lock(false) - dchubp register change take effect +step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream +for full_date, optimize clock to save power + +at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be +changed for new dchubp configuration. but real dcn hub dchubps are +still running with old configuration until end of step 5. this need +clocks settings at step 1 should not less than that before step 1. +this is checked by two conditions: 1. if (should_set_clock(safe_to_lower +, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) || +new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) +2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz + +the second condition is based on new dchubp configuration. dppclk +for new dchubp may be different from dppclk before step 1. +for example, before step 1, dchubps are as below: +pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979) +pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080) +for dppclk for pipe0 need dppclk = dispclk + +new dchubp pipe split configuration: +pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080) +pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080) +dppclk only needs dppclk = dispclk /2. + +dispclk, dppclk are not lock by otg master lock. they take effect +after step 1. during this transition, dispclk are the same, but +dppclk is changed to half of previous clock for old dchubp +configuration between step 1 and step 6. This may cause p-state +warning intermittently. + +[How] +for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we +need make sure dppclk are not changed to less between step 1 and 6. +for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz, +new display clock is raised, but we do not know ratio of +new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz, +new_clocks->dispclk_khz /2 does not guarantee equal or higher than +old dppclk. we could ignore power saving different between +dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6. +as long as safe_to_lower = false, set dpclk = dispclk to simplify +condition check. + +CC: Stable +Signed-off-by: Hersen Wu +Reviewed-by: Aric Cyr +Acked-by: Eryk Brol +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c | 69 ++++++++++++- + 1 file changed, 67 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c +@@ -85,12 +85,77 @@ static int rv1_determine_dppclk_threshol + return disp_clk_threshold; + } + +-static void ramp_up_dispclk_with_dpp(struct clk_mgr_internal *clk_mgr, struct dc *dc, struct dc_clocks *new_clocks) ++static void ramp_up_dispclk_with_dpp( ++ struct clk_mgr_internal *clk_mgr, ++ struct dc *dc, ++ struct dc_clocks *new_clocks, ++ bool safe_to_lower) + { + int i; + int dispclk_to_dpp_threshold = rv1_determine_dppclk_threshold(clk_mgr, new_clocks); + bool request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz; + ++ /* this function is to change dispclk, dppclk and dprefclk according to ++ * bandwidth requirement. Its call stack is rv1_update_clocks --> ++ * update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth ++ * --> prepare_bandwidth / optimize_bandwidth. before change dcn hw, ++ * prepare_bandwidth will be called first to allow enough clock, ++ * watermark for change, after end of dcn hw change, optimize_bandwidth ++ * is executed to lower clock to save power for new dcn hw settings. ++ * ++ * below is sequence of commit_planes_for_stream: ++ * ++ * step 1: prepare_bandwidth - raise clock to have enough bandwidth ++ * step 2: lock_doublebuffer_enable ++ * step 3: pipe_control_lock(true) - make dchubp register change will ++ * not take effect right way ++ * step 4: apply_ctx_for_surface - program dchubp ++ * step 5: pipe_control_lock(false) - dchubp register change take effect ++ * step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream ++ * for full_date, optimize clock to save power ++ * ++ * at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be ++ * changed for new dchubp configuration. but real dcn hub dchubps are ++ * still running with old configuration until end of step 5. this need ++ * clocks settings at step 1 should not less than that before step 1. ++ * this is checked by two conditions: 1. if (should_set_clock(safe_to_lower ++ * , new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) || ++ * new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) ++ * 2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz ++ * ++ * the second condition is based on new dchubp configuration. dppclk ++ * for new dchubp may be different from dppclk before step 1. ++ * for example, before step 1, dchubps are as below: ++ * pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979) ++ * pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080) ++ * for dppclk for pipe0 need dppclk = dispclk ++ * ++ * new dchubp pipe split configuration: ++ * pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080) ++ * pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080) ++ * dppclk only needs dppclk = dispclk /2. ++ * ++ * dispclk, dppclk are not lock by otg master lock. they take effect ++ * after step 1. during this transition, dispclk are the same, but ++ * dppclk is changed to half of previous clock for old dchubp ++ * configuration between step 1 and step 6. This may cause p-state ++ * warning intermittently. ++ * ++ * for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we ++ * need make sure dppclk are not changed to less between step 1 and 6. ++ * for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz, ++ * new display clock is raised, but we do not know ratio of ++ * new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz, ++ * new_clocks->dispclk_khz /2 does not guarantee equal or higher than ++ * old dppclk. we could ignore power saving different between ++ * dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6. ++ * as long as safe_to_lower = false, set dpclk = dispclk to simplify ++ * condition check. ++ * todo: review this change for other asic. ++ **/ ++ if (!safe_to_lower) ++ request_dpp_div = false; ++ + /* set disp clk to dpp clk threshold */ + + clk_mgr->funcs->set_dispclk(clk_mgr, dispclk_to_dpp_threshold); +@@ -206,7 +271,7 @@ static void rv1_update_clocks(struct clk + /* program dispclk on = as a w/a for sleep resume clock ramping issues */ + if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) + || new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) { +- ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks); ++ ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks, safe_to_lower); + clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz; + send_request_to_lower = true; + } diff --git a/queue-5.4/drm-amdgpu-fix-bug-where-dpm-is-not-enabled-after-hibernate-and-resume.patch b/queue-5.4/drm-amdgpu-fix-bug-where-dpm-is-not-enabled-after-hibernate-and-resume.patch new file mode 100644 index 00000000000..cc47905c1c9 --- /dev/null +++ b/queue-5.4/drm-amdgpu-fix-bug-where-dpm-is-not-enabled-after-hibernate-and-resume.patch @@ -0,0 +1,60 @@ +From f87812284172a9809820d10143b573d833cd3f75 Mon Sep 17 00:00:00 2001 +From: Sandeep Raghuraman +Date: Thu, 6 Aug 2020 22:52:20 +0530 +Subject: drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume + +From: Sandeep Raghuraman + +commit f87812284172a9809820d10143b573d833cd3f75 upstream. + +Reproducing bug report here: +After hibernating and resuming, DPM is not enabled. This remains the case +even if you test hibernate using the steps here: +https://www.kernel.org/doc/html/latest/power/basic-pm-debugging.html + +I debugged the problem, and figured out that in the file hardwaremanager.c, +in the function, phm_enable_dynamic_state_management(), the check +'if (!hwmgr->pp_one_vf && smum_is_dpm_running(hwmgr) && !amdgpu_passthrough(adev) && adev->in_suspend)' +returns true for the hibernate case, and false for the suspend case. + +This means that for the hibernate case, the AMDGPU driver doesn't enable DPM +(even though it should) and simply returns from that function. +In the suspend case, it goes ahead and enables DPM, even though it doesn't need to. + +I debugged further, and found out that in the case of suspend, for the +CIK/Hawaii GPUs, smum_is_dpm_running(hwmgr) returns false, while in the case of +hibernate, smum_is_dpm_running(hwmgr) returns true. + +For CIK, the ci_is_dpm_running() function calls the ci_is_smc_ram_running() function, +which is ultimately used to determine if DPM is currently enabled or not, +and this seems to provide the wrong answer. + +I've changed the ci_is_dpm_running() function to instead use the same method that +some other AMD GPU chips do (e.g Fiji), which seems to read the voltage controller. +I've tested on my R9 390 and it seems to work correctly for both suspend and +hibernate use cases, and has been stable so far. + +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=208839 +Signed-off-by: Sandeep Raghuraman +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +@@ -2725,7 +2725,10 @@ static int ci_initialize_mc_reg_table(st + + static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr) + { +- return ci_is_smc_ram_running(hwmgr); ++ return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device, ++ CGS_IND_REG__SMC, FEATURE_STATUS, ++ VOLTAGE_CONTROLLER_ON)) ++ ? true : false; + } + + static int ci_smu_init(struct pp_hwmgr *hwmgr) diff --git a/queue-5.4/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch b/queue-5.4/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch new file mode 100644 index 00000000000..5cf909ac617 --- /dev/null +++ b/queue-5.4/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch @@ -0,0 +1,65 @@ +From a34a0a632dd991a371fec56431d73279f9c54029 Mon Sep 17 00:00:00 2001 +From: Xin Xiong +Date: Sun, 19 Jul 2020 23:45:45 +0800 +Subject: drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xin Xiong + +commit a34a0a632dd991a371fec56431d73279f9c54029 upstream. + +drm_dp_mst_allocate_vcpi() invokes +drm_dp_mst_topology_get_port_validated(), which increases the refcount +of the "port". + +These reference counting issues take place in two exception handling +paths separately. Either when “slots” is less than 0 or when +drm_dp_init_vcpi() returns a negative value, the function forgets to +reduce the refcnt increased drm_dp_mst_topology_get_port_validated(), +which results in a refcount leak. + +Fix these issues by pulling up the error handling when "slots" is less +than 0, and calling drm_dp_mst_topology_put_port() before termination +when drm_dp_init_vcpi() returns a negative value. + +Fixes: 1e797f556c61 ("drm/dp: Split drm_dp_mst_allocate_vcpi") +Cc: # v4.12+ +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Signed-off-by: Xin Xiong +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20200719154545.GA41231@xin-virtual-machine +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -3369,11 +3369,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm + { + int ret; + +- port = drm_dp_mst_topology_get_port_validated(mgr, port); +- if (!port) ++ if (slots < 0) + return false; + +- if (slots < 0) ++ port = drm_dp_mst_topology_get_port_validated(mgr, port); ++ if (!port) + return false; + + if (port->vcpi.vcpi > 0) { +@@ -3389,6 +3389,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm + if (ret) { + DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n", + DIV_ROUND_UP(pbn, mgr->pbn_div), ret); ++ drm_dp_mst_topology_put_port(port); + goto out; + } + DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n", diff --git a/queue-5.4/drm-panfrost-use-kvfree-to-free-bo-sgts.patch b/queue-5.4/drm-panfrost-use-kvfree-to-free-bo-sgts.patch new file mode 100644 index 00000000000..f02d5af2d53 --- /dev/null +++ b/queue-5.4/drm-panfrost-use-kvfree-to-free-bo-sgts.patch @@ -0,0 +1,47 @@ +From 114427b8927a4def2942b2b886f7e4aeae289ccb Mon Sep 17 00:00:00 2001 +From: Denis Efremov +Date: Mon, 8 Jun 2020 18:17:28 +0300 +Subject: drm/panfrost: Use kvfree() to free bo->sgts + +From: Denis Efremov + +commit 114427b8927a4def2942b2b886f7e4aeae289ccb upstream. + +Use kvfree() to free bo->sgts, because the memory is allocated with +kvmalloc_array() in panfrost_mmu_map_fault_addr(). + +Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") +Cc: stable@vger.kernel.org +Signed-off-by: Denis Efremov +Reviewed-by: Steven Price +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20200608151728.234026-1-efremov@linux.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/panfrost/panfrost_gem.c | 2 +- + drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/panfrost/panfrost_gem.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c +@@ -46,7 +46,7 @@ static void panfrost_gem_free_object(str + sg_free_table(&bo->sgts[i]); + } + } +- kfree(bo->sgts); ++ kvfree(bo->sgts); + } + + drm_gem_shmem_free_object(obj); +--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c +@@ -486,7 +486,7 @@ static int panfrost_mmu_map_fault_addr(s + pages = kvmalloc_array(bo->base.base.size >> PAGE_SHIFT, + sizeof(struct page *), GFP_KERNEL | __GFP_ZERO); + if (!pages) { +- kfree(bo->sgts); ++ kvfree(bo->sgts); + bo->sgts = NULL; + mutex_unlock(&bo->base.pages_lock); + ret = -ENOMEM; diff --git a/queue-5.4/drm-radeon-fix-fb_div-check-in-ni_init_smc_spll_table.patch b/queue-5.4/drm-radeon-fix-fb_div-check-in-ni_init_smc_spll_table.patch new file mode 100644 index 00000000000..32b086297e7 --- /dev/null +++ b/queue-5.4/drm-radeon-fix-fb_div-check-in-ni_init_smc_spll_table.patch @@ -0,0 +1,33 @@ +From f29aa08852e1953e461f2d47ab13c34e14bc08b3 Mon Sep 17 00:00:00 2001 +From: Denis Efremov +Date: Mon, 22 Jun 2020 23:31:22 +0300 +Subject: drm/radeon: fix fb_div check in ni_init_smc_spll_table() + +From: Denis Efremov + +commit f29aa08852e1953e461f2d47ab13c34e14bc08b3 upstream. + +clk_s is checked twice in a row in ni_init_smc_spll_table(). +fb_div should be checked instead. + +Fixes: 69e0b57a91ad ("drm/radeon/kms: add dpm support for cayman (v5)") +Cc: stable@vger.kernel.org +Signed-off-by: Denis Efremov +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/ni_dpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/ni_dpm.c ++++ b/drivers/gpu/drm/radeon/ni_dpm.c +@@ -2125,7 +2125,7 @@ static int ni_init_smc_spll_table(struct + if (p_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_PDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_PDIV_SHIFT)) + ret = -EINVAL; + +- if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT)) ++ if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT)) + ret = -EINVAL; + + if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT)) diff --git a/queue-5.4/khugepaged-retract_page_tables-remember-to-test-exit.patch b/queue-5.4/khugepaged-retract_page_tables-remember-to-test-exit.patch new file mode 100644 index 00000000000..e1e07c40e81 --- /dev/null +++ b/queue-5.4/khugepaged-retract_page_tables-remember-to-test-exit.patch @@ -0,0 +1,99 @@ +From 18e77600f7a1ed69f8ce46c9e11cad0985712dfa Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Thu, 6 Aug 2020 23:26:22 -0700 +Subject: khugepaged: retract_page_tables() remember to test exit + +From: Hugh Dickins + +commit 18e77600f7a1ed69f8ce46c9e11cad0985712dfa upstream. + +Only once have I seen this scenario (and forgot even to notice what forced +the eventual crash): a sequence of "BUG: Bad page map" alerts from +vm_normal_page(), from zap_pte_range() servicing exit_mmap(); +pmd:00000000, pte values corresponding to data in physical page 0. + +The pte mappings being zapped in this case were supposed to be from a huge +page of ext4 text (but could as well have been shmem): my belief is that +it was racing with collapse_file()'s retract_page_tables(), found *pmd +pointing to a page table, locked it, but *pmd had become 0 by the time +start_pte was decided. + +In most cases, that possibility is excluded by holding mmap lock; but +exit_mmap() proceeds without mmap lock. Most of what's run by khugepaged +checks khugepaged_test_exit() after acquiring mmap lock: +khugepaged_collapse_pte_mapped_thps() and hugepage_vma_revalidate() do so, +for example. But retract_page_tables() did not: fix that. + +The fix is for retract_page_tables() to check khugepaged_test_exit(), +after acquiring mmap lock, before doing anything to the page table. +Getting the mmap lock serializes with __mmput(), which briefly takes and +drops it in __khugepaged_exit(); then the khugepaged_test_exit() check on +mm_users makes sure we don't touch the page table once exit_mmap() might +reach it, since exit_mmap() will be proceeding without mmap lock, not +expecting anyone to be racing with it. + +Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") +Signed-off-by: Hugh Dickins +Signed-off-by: Andrew Morton +Acked-by: Kirill A. Shutemov +Cc: Andrea Arcangeli +Cc: Mike Kravetz +Cc: Song Liu +Cc: [4.8+] +Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008021215400.27773@eggly.anvils +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/khugepaged.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1414,6 +1414,7 @@ out: + static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) + { + struct vm_area_struct *vma; ++ struct mm_struct *mm; + unsigned long addr; + pmd_t *pmd, _pmd; + +@@ -1442,7 +1443,8 @@ static void retract_page_tables(struct a + continue; + if (vma->vm_end < addr + HPAGE_PMD_SIZE) + continue; +- pmd = mm_find_pmd(vma->vm_mm, addr); ++ mm = vma->vm_mm; ++ pmd = mm_find_pmd(mm, addr); + if (!pmd) + continue; + /* +@@ -1452,17 +1454,19 @@ static void retract_page_tables(struct a + * mmap_sem while holding page lock. Fault path does it in + * reverse order. Trylock is a way to avoid deadlock. + */ +- if (down_write_trylock(&vma->vm_mm->mmap_sem)) { +- spinlock_t *ptl = pmd_lock(vma->vm_mm, pmd); +- /* assume page table is clear */ +- _pmd = pmdp_collapse_flush(vma, addr, pmd); +- spin_unlock(ptl); +- up_write(&vma->vm_mm->mmap_sem); +- mm_dec_nr_ptes(vma->vm_mm); +- pte_free(vma->vm_mm, pmd_pgtable(_pmd)); ++ if (down_write_trylock(&mm->mmap_sem)) { ++ if (!khugepaged_test_exit(mm)) { ++ spinlock_t *ptl = pmd_lock(mm, pmd); ++ /* assume page table is clear */ ++ _pmd = pmdp_collapse_flush(vma, addr, pmd); ++ spin_unlock(ptl); ++ mm_dec_nr_ptes(mm); ++ pte_free(mm, pmd_pgtable(_pmd)); ++ } ++ up_write(&mm->mmap_sem); + } else { + /* Try again later */ +- khugepaged_add_pte_mapped_thp(vma->vm_mm, addr); ++ khugepaged_add_pte_mapped_thp(mm, addr); + } + } + i_mmap_unlock_write(mapping); diff --git a/queue-5.4/series b/queue-5.4/series index 2f271e39c50..4e4e7a2920d 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -142,3 +142,11 @@ perf-bench-mem-always-memset-source-before-memcpy.patch tools-build-feature-quote-cc-and-cxx-for-their-argum.patch perf-x86-rapl-fix-missing-psys-sysfs-attributes.patch sh-landisk-add-missing-initialization-of-sh_io_port_.patch +khugepaged-retract_page_tables-remember-to-test-exit.patch +arm64-dts-marvell-espressobin-add-ethernet-alias.patch +drm-radeon-fix-fb_div-check-in-ni_init_smc_spll_table.patch +drm-panfrost-use-kvfree-to-free-bo-sgts.patch +drm-added-orientation-quirk-for-asus-tablet-model-t103haf.patch +drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch +drm-amdgpu-fix-bug-where-dpm-is-not-enabled-after-hibernate-and-resume.patch +drm-amd-display-dchubbub-p-state-warning-during-surface-planes-switch.patch