--- /dev/null
+From 963bbdb32b47cfa67a449e715e1dcc525fbd01fc Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Mon, 19 Dec 2022 12:59:55 +0200
+Subject: drm/i915/dsi: add support for ICL+ native MIPI GPIO sequence
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 963bbdb32b47cfa67a449e715e1dcc525fbd01fc upstream.
+
+Starting from ICL, the default for MIPI GPIO sequences seems to be using
+native GPIOs i.e. GPIOs available in the GPU. These native GPIOs reuse
+many pins that quite frankly seem scary to poke based on the VBT
+sequences. We pretty much have to trust that the board is configured
+such that the relevant HPD, PP_CONTROL and GPIO bits aren't used for
+anything else.
+
+MIPI sequence v4 also adds a flag to fall back to non-native sequences.
+
+v5:
+- Wrap SHOTPLUG_CTL_DDI modification in spin_lock() in icp_irq_handler()
+ too (Ville)
+- References instead of Closes issue 6131 because this does not fix everything
+
+v4:
+- Wrap SHOTPLUG_CTL_DDI modification in spin_lock_irq() (Ville)
+
+v3:
+- Fix -Wbitwise-conditional-parentheses (kernel test robot <lkp@intel.com>)
+
+v2:
+- Fix HPD pin output set (impacts GPIOs 0 and 5)
+- Fix GPIO data output direction set (impacts GPIOs 4 and 9)
+- Reduce register accesses to single intel_de_rwm()
+
+References: https://gitlab.freedesktop.org/drm/intel/-/issues/6131
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221219105955.4014451-1-jani.nikula@intel.com
+(cherry picked from commit f087cfe6fcff58044f7aa3b284965af47f472fb0)
+Cc: stable@vger.kernel.org # 6.1
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 94 ++++++++++++++++++++++++++-
+ drivers/gpu/drm/i915/i915_irq.c | 3
+ drivers/gpu/drm/i915/i915_reg.h | 1
+ 3 files changed, 95 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
++++ b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
+@@ -41,9 +41,11 @@
+
+ #include "i915_drv.h"
+ #include "i915_reg.h"
++#include "intel_de.h"
+ #include "intel_display_types.h"
+ #include "intel_dsi.h"
+ #include "intel_dsi_vbt.h"
++#include "intel_gmbus_regs.h"
+ #include "vlv_dsi.h"
+ #include "vlv_dsi_regs.h"
+ #include "vlv_sideband.h"
+@@ -377,6 +379,85 @@ static void icl_exec_gpio(struct intel_c
+ drm_dbg_kms(&dev_priv->drm, "Skipping ICL GPIO element execution\n");
+ }
+
++enum {
++ MIPI_RESET_1 = 0,
++ MIPI_AVDD_EN_1,
++ MIPI_BKLT_EN_1,
++ MIPI_AVEE_EN_1,
++ MIPI_VIO_EN_1,
++ MIPI_RESET_2,
++ MIPI_AVDD_EN_2,
++ MIPI_BKLT_EN_2,
++ MIPI_AVEE_EN_2,
++ MIPI_VIO_EN_2,
++};
++
++static void icl_native_gpio_set_value(struct drm_i915_private *dev_priv,
++ int gpio, bool value)
++{
++ int index;
++
++ if (drm_WARN_ON(&dev_priv->drm, DISPLAY_VER(dev_priv) == 11 && gpio >= MIPI_RESET_2))
++ return;
++
++ switch (gpio) {
++ case MIPI_RESET_1:
++ case MIPI_RESET_2:
++ index = gpio == MIPI_RESET_1 ? HPD_PORT_A : HPD_PORT_B;
++
++ /*
++ * Disable HPD to set the pin to output, and set output
++ * value. The HPD pin should not be enabled for DSI anyway,
++ * assuming the board design and VBT are sane, and the pin isn't
++ * used by a non-DSI encoder.
++ *
++ * The locking protects against concurrent SHOTPLUG_CTL_DDI
++ * modifications in irq setup and handling.
++ */
++ spin_lock_irq(&dev_priv->irq_lock);
++ intel_de_rmw(dev_priv, SHOTPLUG_CTL_DDI,
++ SHOTPLUG_CTL_DDI_HPD_ENABLE(index) |
++ SHOTPLUG_CTL_DDI_HPD_OUTPUT_DATA(index),
++ value ? SHOTPLUG_CTL_DDI_HPD_OUTPUT_DATA(index) : 0);
++ spin_unlock_irq(&dev_priv->irq_lock);
++ break;
++ case MIPI_AVDD_EN_1:
++ case MIPI_AVDD_EN_2:
++ index = gpio == MIPI_AVDD_EN_1 ? 0 : 1;
++
++ intel_de_rmw(dev_priv, PP_CONTROL(index), PANEL_POWER_ON,
++ value ? PANEL_POWER_ON : 0);
++ break;
++ case MIPI_BKLT_EN_1:
++ case MIPI_BKLT_EN_2:
++ index = gpio == MIPI_AVDD_EN_1 ? 0 : 1;
++
++ intel_de_rmw(dev_priv, PP_CONTROL(index), EDP_BLC_ENABLE,
++ value ? EDP_BLC_ENABLE : 0);
++ break;
++ case MIPI_AVEE_EN_1:
++ case MIPI_AVEE_EN_2:
++ index = gpio == MIPI_AVEE_EN_1 ? 1 : 2;
++
++ intel_de_rmw(dev_priv, GPIO(dev_priv, index),
++ GPIO_CLOCK_VAL_OUT,
++ GPIO_CLOCK_DIR_MASK | GPIO_CLOCK_DIR_OUT |
++ GPIO_CLOCK_VAL_MASK | (value ? GPIO_CLOCK_VAL_OUT : 0));
++ break;
++ case MIPI_VIO_EN_1:
++ case MIPI_VIO_EN_2:
++ index = gpio == MIPI_VIO_EN_1 ? 1 : 2;
++
++ intel_de_rmw(dev_priv, GPIO(dev_priv, index),
++ GPIO_DATA_VAL_OUT,
++ GPIO_DATA_DIR_MASK | GPIO_DATA_DIR_OUT |
++ GPIO_DATA_VAL_MASK | (value ? GPIO_DATA_VAL_OUT : 0));
++ break;
++ default:
++ MISSING_CASE(gpio);
++ }
++}
++
+ static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
+ {
+ struct drm_device *dev = intel_dsi->base.base.dev;
+@@ -384,8 +465,7 @@ static const u8 *mipi_exec_gpio(struct i
+ struct intel_connector *connector = intel_dsi->attached_connector;
+ u8 gpio_source, gpio_index = 0, gpio_number;
+ bool value;
+-
+- drm_dbg_kms(&dev_priv->drm, "\n");
++ bool native = DISPLAY_VER(dev_priv) >= 11;
+
+ if (connector->panel.vbt.dsi.seq_version >= 3)
+ gpio_index = *data++;
+@@ -398,10 +478,18 @@ static const u8 *mipi_exec_gpio(struct i
+ else
+ gpio_source = 0;
+
++ if (connector->panel.vbt.dsi.seq_version >= 4 && *data & BIT(1))
++ native = false;
++
+ /* pull up/down */
+ value = *data++ & 1;
+
+- if (DISPLAY_VER(dev_priv) >= 11)
++ drm_dbg_kms(&dev_priv->drm, "GPIO index %u, number %u, source %u, native %s, set to %s\n",
++ gpio_index, gpio_number, gpio_source, str_yes_no(native), str_on_off(value));
++
++ if (native)
++ icl_native_gpio_set_value(dev_priv, gpio_number, value);
++ else if (DISPLAY_VER(dev_priv) >= 11)
+ icl_exec_gpio(connector, gpio_source, gpio_index, value);
+ else if (IS_VALLEYVIEW(dev_priv))
+ vlv_exec_gpio(connector, gpio_source, gpio_number, value);
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1981,8 +1981,11 @@ static void icp_irq_handler(struct drm_i
+ if (ddi_hotplug_trigger) {
+ u32 dig_hotplug_reg;
+
++ /* Locking due to DSI native GPIO sequences */
++ spin_lock(&dev_priv->irq_lock);
+ dig_hotplug_reg = intel_uncore_read(&dev_priv->uncore, SHOTPLUG_CTL_DDI);
+ intel_uncore_write(&dev_priv->uncore, SHOTPLUG_CTL_DDI, dig_hotplug_reg);
++ spin_unlock(&dev_priv->irq_lock);
+
+ intel_get_hpd_pins(dev_priv, &pin_mask, &long_mask,
+ ddi_hotplug_trigger, dig_hotplug_reg,
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -6035,6 +6035,7 @@
+
+ #define SHOTPLUG_CTL_DDI _MMIO(0xc4030)
+ #define SHOTPLUG_CTL_DDI_HPD_ENABLE(hpd_pin) (0x8 << (_HPD_PIN_DDI(hpd_pin) * 4))
++#define SHOTPLUG_CTL_DDI_HPD_OUTPUT_DATA(hpd_pin) (0x4 << (_HPD_PIN_DDI(hpd_pin) * 4))
+ #define SHOTPLUG_CTL_DDI_HPD_STATUS_MASK(hpd_pin) (0x3 << (_HPD_PIN_DDI(hpd_pin) * 4))
+ #define SHOTPLUG_CTL_DDI_HPD_NO_DETECT(hpd_pin) (0x0 << (_HPD_PIN_DDI(hpd_pin) * 4))
+ #define SHOTPLUG_CTL_DDI_HPD_SHORT_DETECT(hpd_pin) (0x1 << (_HPD_PIN_DDI(hpd_pin) * 4))
--- /dev/null
+From 6217e9f05a74df48c77ee68993d587cdfdb1feb7 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Tue, 20 Dec 2022 16:01:05 +0200
+Subject: drm/i915/dsi: fix MIPI_BKLT_EN_1 native GPIO index
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 6217e9f05a74df48c77ee68993d587cdfdb1feb7 upstream.
+
+Due to copy-paste fail, MIPI_BKLT_EN_1 would always use PPS index 1,
+never 0. Fix the sloppiest commit in recent memory.
+
+Fixes: 963bbdb32b47 ("drm/i915/dsi: add support for ICL+ native MIPI GPIO sequence")
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221220140105.313333-1-jani.nikula@intel.com
+(cherry picked from commit a561933c571798868b5fa42198427a7e6df56c09)
+Cc: stable@vger.kernel.org # 6.1
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
++++ b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
+@@ -430,7 +430,7 @@ static void icl_native_gpio_set_value(st
+ break;
+ case MIPI_BKLT_EN_1:
+ case MIPI_BKLT_EN_2:
+- index = gpio == MIPI_AVDD_EN_1 ? 0 : 1;
++ index = gpio == MIPI_BKLT_EN_1 ? 0 : 1;
+
+ intel_de_rmw(dev_priv, PP_CONTROL(index), EDP_BLC_ENABLE,
+ value ? EDP_BLC_ENABLE : 0);
--- /dev/null
+From 797805d81baa814f76cf7bdab35f86408a79d707 Mon Sep 17 00:00:00 2001
+From: William Liu <will@willsroot.io>
+Date: Fri, 30 Dec 2022 13:03:15 +0900
+Subject: ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: William Liu <will@willsroot.io>
+
+commit 797805d81baa814f76cf7bdab35f86408a79d707 upstream.
+
+"nt_len - CIFS_ENCPWD_SIZE" is passed directly from
+ksmbd_decode_ntlmssp_auth_blob to ksmbd_auth_ntlmv2. Malicious requests
+can set nt_len to less than CIFS_ENCPWD_SIZE, which results in a negative
+number (or large unsigned value) used for a subsequent memcpy in
+ksmbd_auth_ntlvm2 and can cause a panic.
+
+Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
+Cc: stable@vger.kernel.org
+Signed-off-by: William Liu <will@willsroot.io>
+Signed-off-by: Hrvoje Mišetić <misetichrvoje@gmail.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ksmbd/auth.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ksmbd/auth.c
++++ b/fs/ksmbd/auth.c
+@@ -322,7 +322,8 @@ int ksmbd_decode_ntlmssp_auth_blob(struc
+ dn_off = le32_to_cpu(authblob->DomainName.BufferOffset);
+ dn_len = le16_to_cpu(authblob->DomainName.Length);
+
+- if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len)
++ if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len ||
++ nt_len < CIFS_ENCPWD_SIZE)
+ return -EINVAL;
+
+ /* TODO : use domain name that imported from configuration file */
--- /dev/null
+From 83dcedd5540d4ac61376ddff5362f7d9f866a6ec Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Sat, 31 Dec 2022 17:32:31 +0900
+Subject: ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit 83dcedd5540d4ac61376ddff5362f7d9f866a6ec upstream.
+
+If kernel_recvmsg() return -EAGAIN in ksmbd_tcp_readv() and go round
+again, It will cause infinite loop issue. And all threads from next
+connections would be doing that. This patch add max retry count(2) to
+avoid it. kernel_recvmsg() will wait during 7sec timeout and try to
+retry two time if -EAGAIN is returned. And add flags of kvmalloc to
+__GFP_NOWARN and __GFP_NORETRY to disconnect immediately without
+retrying on memory alloation failure.
+
+Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
+Cc: stable@vger.kernel.org
+Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ksmbd/connection.c | 7 +++++--
+ fs/ksmbd/transport_tcp.c | 5 ++++-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/fs/ksmbd/connection.c
++++ b/fs/ksmbd/connection.c
+@@ -316,9 +316,12 @@ int ksmbd_conn_handler_loop(void *p)
+
+ /* 4 for rfc1002 length field */
+ size = pdu_size + 4;
+- conn->request_buf = kvmalloc(size, GFP_KERNEL);
++ conn->request_buf = kvmalloc(size,
++ GFP_KERNEL |
++ __GFP_NOWARN |
++ __GFP_NORETRY);
+ if (!conn->request_buf)
+- continue;
++ break;
+
+ memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
+ if (!ksmbd_smb_request(conn))
+--- a/fs/ksmbd/transport_tcp.c
++++ b/fs/ksmbd/transport_tcp.c
+@@ -295,6 +295,7 @@ static int ksmbd_tcp_readv(struct tcp_tr
+ struct msghdr ksmbd_msg;
+ struct kvec *iov;
+ struct ksmbd_conn *conn = KSMBD_TRANS(t)->conn;
++ int max_retry = 2;
+
+ iov = get_conn_iovec(t, nr_segs);
+ if (!iov)
+@@ -321,9 +322,11 @@ static int ksmbd_tcp_readv(struct tcp_tr
+ } else if (conn->status == KSMBD_SESS_NEED_RECONNECT) {
+ total_read = -EAGAIN;
+ break;
+- } else if (length == -ERESTARTSYS || length == -EAGAIN) {
++ } else if ((length == -ERESTARTSYS || length == -EAGAIN) &&
++ max_retry) {
+ usleep_range(1000, 2000);
+ length = 0;
++ max_retry--;
+ continue;
+ } else if (length <= 0) {
+ total_read = -EAGAIN;
--- /dev/null
+From cdfb2fef522d0c3f9cf293db51de88e9b3d46846 Mon Sep 17 00:00:00 2001
+From: Marios Makassikis <mmakassikis@freebox.fr>
+Date: Fri, 23 Dec 2022 11:59:31 +0100
+Subject: ksmbd: send proper error response in smb2_tree_connect()
+
+From: Marios Makassikis <mmakassikis@freebox.fr>
+
+commit cdfb2fef522d0c3f9cf293db51de88e9b3d46846 upstream.
+
+Currently, smb2_tree_connect doesn't send an error response packet on
+error.
+
+This causes libsmb2 to skip the specific error code and fail with the
+following:
+ smb2_service failed with : Failed to parse fixed part of command
+ payload. Unexpected size of Error reply. Expected 9, got 8
+
+Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ksmbd/smb2pdu.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/fs/ksmbd/smb2pdu.c
++++ b/fs/ksmbd/smb2pdu.c
+@@ -1926,13 +1926,13 @@ int smb2_tree_connect(struct ksmbd_work
+ if (conn->posix_ext_supported)
+ status.tree_conn->posix_extensions = true;
+
+-out_err1:
+ rsp->StructureSize = cpu_to_le16(16);
++ inc_rfc1001_len(work->response_buf, 16);
++out_err1:
+ rsp->Capabilities = 0;
+ rsp->Reserved = 0;
+ /* default manual caching */
+ rsp->ShareFlags = SMB2_SHAREFLAG_MANUAL_CACHING;
+- inc_rfc1001_len(work->response_buf, 16);
+
+ if (!IS_ERR(treename))
+ kfree(treename);
+@@ -1965,6 +1965,9 @@ out_err1:
+ rsp->hdr.Status = STATUS_ACCESS_DENIED;
+ }
+
++ if (status.ret != KSMBD_TREE_CONN_STATUS_OK)
++ smb2_set_err_rsp(work);
++
+ return rc;
+ }
+
drm-amd-display-add-check-for-det-fetch-latency-hidi.patch
drm-amd-display-uninitialized-variables-causing-4k60.patch
btrfs-handle-case-when-repair-happens-with-dev-repla.patch
+ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch
+ksmbd-send-proper-error-response-in-smb2_tree_connect.patch
+ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch
+drm-i915-dsi-add-support-for-icl-native-mipi-gpio-sequence.patch
+drm-i915-dsi-fix-mipi_bklt_en_1-native-gpio-index.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
