--- /dev/null
+From 9f6035af06b526e678808d492fc0830aef6cfbd8 Mon Sep 17 00:00:00 2001
+From: Nathan Huckleberry <nhuck@google.com>
+Date: Tue, 18 Oct 2022 16:04:12 -0700
+Subject: crypto: x86/polyval - Fix crashes when keys are not 16-byte aligned
+
+From: Nathan Huckleberry <nhuck@google.com>
+
+commit 9f6035af06b526e678808d492fc0830aef6cfbd8 upstream.
+
+crypto_tfm::__crt_ctx is not guaranteed to be 16-byte aligned on x86-64.
+This causes crashes due to movaps instructions in clmul_polyval_update.
+
+Add logic to align polyval_tfm_ctx to 16 bytes.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 34f7f6c30112 ("crypto: x86/polyval - Add PCLMULQDQ accelerated implementation of POLYVAL")
+Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
+Signed-off-by: Nathan Huckleberry <nhuck@google.com>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/crypto/polyval-clmulni_glue.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/crypto/polyval-clmulni_glue.c b/arch/x86/crypto/polyval-clmulni_glue.c
+index b7664d018851..8fa58b0f3cb3 100644
+--- a/arch/x86/crypto/polyval-clmulni_glue.c
++++ b/arch/x86/crypto/polyval-clmulni_glue.c
+@@ -27,13 +27,17 @@
+ #include <asm/cpu_device_id.h>
+ #include <asm/simd.h>
+
++#define POLYVAL_ALIGN 16
++#define POLYVAL_ALIGN_ATTR __aligned(POLYVAL_ALIGN)
++#define POLYVAL_ALIGN_EXTRA ((POLYVAL_ALIGN - 1) & ~(CRYPTO_MINALIGN - 1))
++#define POLYVAL_CTX_SIZE (sizeof(struct polyval_tfm_ctx) + POLYVAL_ALIGN_EXTRA)
+ #define NUM_KEY_POWERS 8
+
+ struct polyval_tfm_ctx {
+ /*
+ * These powers must be in the order h^8, ..., h^1.
+ */
+- u8 key_powers[NUM_KEY_POWERS][POLYVAL_BLOCK_SIZE];
++ u8 key_powers[NUM_KEY_POWERS][POLYVAL_BLOCK_SIZE] POLYVAL_ALIGN_ATTR;
+ };
+
+ struct polyval_desc_ctx {
+@@ -45,6 +49,11 @@ asmlinkage void clmul_polyval_update(const struct polyval_tfm_ctx *keys,
+ const u8 *in, size_t nblocks, u8 *accumulator);
+ asmlinkage void clmul_polyval_mul(u8 *op1, const u8 *op2);
+
++static inline struct polyval_tfm_ctx *polyval_tfm_ctx(struct crypto_shash *tfm)
++{
++ return PTR_ALIGN(crypto_shash_ctx(tfm), POLYVAL_ALIGN);
++}
++
+ static void internal_polyval_update(const struct polyval_tfm_ctx *keys,
+ const u8 *in, size_t nblocks, u8 *accumulator)
+ {
+@@ -72,7 +81,7 @@ static void internal_polyval_mul(u8 *op1, const u8 *op2)
+ static int polyval_x86_setkey(struct crypto_shash *tfm,
+ const u8 *key, unsigned int keylen)
+ {
+- struct polyval_tfm_ctx *tctx = crypto_shash_ctx(tfm);
++ struct polyval_tfm_ctx *tctx = polyval_tfm_ctx(tfm);
+ int i;
+
+ if (keylen != POLYVAL_BLOCK_SIZE)
+@@ -102,7 +111,7 @@ static int polyval_x86_update(struct shash_desc *desc,
+ const u8 *src, unsigned int srclen)
+ {
+ struct polyval_desc_ctx *dctx = shash_desc_ctx(desc);
+- const struct polyval_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm);
++ const struct polyval_tfm_ctx *tctx = polyval_tfm_ctx(desc->tfm);
+ u8 *pos;
+ unsigned int nblocks;
+ unsigned int n;
+@@ -143,7 +152,7 @@ static int polyval_x86_update(struct shash_desc *desc,
+ static int polyval_x86_final(struct shash_desc *desc, u8 *dst)
+ {
+ struct polyval_desc_ctx *dctx = shash_desc_ctx(desc);
+- const struct polyval_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm);
++ const struct polyval_tfm_ctx *tctx = polyval_tfm_ctx(desc->tfm);
+
+ if (dctx->bytes) {
+ internal_polyval_mul(dctx->buffer,
+@@ -167,7 +176,7 @@ static struct shash_alg polyval_alg = {
+ .cra_driver_name = "polyval-clmulni",
+ .cra_priority = 200,
+ .cra_blocksize = POLYVAL_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct polyval_tfm_ctx),
++ .cra_ctxsize = POLYVAL_CTX_SIZE,
+ .cra_module = THIS_MODULE,
+ },
+ };
+--
+2.38.1
+
--- /dev/null
+From 809734c110548dca410fb0cca52e6b1540319f5e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Joaqu=C3=ADn=20Ignacio=20Aramend=C3=ADa?=
+ <samsagax@gmail.com>
+Date: Mon, 24 Oct 2022 08:33:59 -0300
+Subject: drm/amd/display: Revert logic for plane modifiers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joaquín Ignacio Aramendía <samsagax@gmail.com>
+
+commit 809734c110548dca410fb0cca52e6b1540319f5e upstream.
+
+This file was split in commit 5d945cbcd4b16a29d6470a80dfb19738f9a4319f
+("drm/amd/display: Create a file dedicated to planes") and the logic in
+dm_plane_format_mod_supported() function got changed by a switch logic.
+That change broke drm_plane modifiers setting on series 5000 APUs
+(tested on OXP mini AMD 5800U and HP Dev One 5850U PRO)
+leading to Gamescope not working as reported on GitHub[1]
+
+To reproduce the issue, enter a TTY and run:
+
+$ gamescope -- vkcube
+
+With said commit applied it will abort. This one restores the old logic,
+fixing the issue that affects Gamescope.
+
+[1](https://github.com/Plagman/gamescope/issues/624)
+
+Cc: <stable@vger.kernel.org> # 6.0.x
+Signed-off-by: Joaquín Ignacio Aramendía <samsagax@gmail.com>
+Reviewed-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .../amd/display/amdgpu_dm/amdgpu_dm_plane.c | 50 +++----------------
+ 1 file changed, 7 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+index dfd3be49eac8..e6854f7270a6 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+@@ -1369,7 +1369,7 @@ static bool dm_plane_format_mod_supported(struct drm_plane *plane,
+ {
+ struct amdgpu_device *adev = drm_to_adev(plane->dev);
+ const struct drm_format_info *info = drm_format_info(format);
+- struct hw_asic_id asic_id = adev->dm.dc->ctx->asic_id;
++ int i;
+
+ enum dm_micro_swizzle microtile = modifier_gfx9_swizzle_mode(modifier) & 3;
+
+@@ -1386,49 +1386,13 @@ static bool dm_plane_format_mod_supported(struct drm_plane *plane,
+ return true;
+ }
+
+- /* check if swizzle mode is supported by this version of DCN */
+- switch (asic_id.chip_family) {
+- case FAMILY_SI:
+- case FAMILY_CI:
+- case FAMILY_KV:
+- case FAMILY_CZ:
+- case FAMILY_VI:
+- /* asics before AI does not have modifier support */
+- return false;
+- case FAMILY_AI:
+- case FAMILY_RV:
+- case FAMILY_NV:
+- case FAMILY_VGH:
+- case FAMILY_YELLOW_CARP:
+- case AMDGPU_FAMILY_GC_10_3_6:
+- case AMDGPU_FAMILY_GC_10_3_7:
+- switch (AMD_FMT_MOD_GET(TILE, modifier)) {
+- case AMD_FMT_MOD_TILE_GFX9_64K_R_X:
+- case AMD_FMT_MOD_TILE_GFX9_64K_D_X:
+- case AMD_FMT_MOD_TILE_GFX9_64K_S_X:
+- case AMD_FMT_MOD_TILE_GFX9_64K_D:
+- return true;
+- default:
+- return false;
+- }
+- break;
+- case AMDGPU_FAMILY_GC_11_0_0:
+- case AMDGPU_FAMILY_GC_11_0_1:
+- switch (AMD_FMT_MOD_GET(TILE, modifier)) {
+- case AMD_FMT_MOD_TILE_GFX11_256K_R_X:
+- case AMD_FMT_MOD_TILE_GFX9_64K_R_X:
+- case AMD_FMT_MOD_TILE_GFX9_64K_D_X:
+- case AMD_FMT_MOD_TILE_GFX9_64K_S_X:
+- case AMD_FMT_MOD_TILE_GFX9_64K_D:
+- return true;
+- default:
+- return false;
+- }
+- break;
+- default:
+- ASSERT(0); /* Unknown asic */
+- break;
++ /* Check that the modifier is on the list of the plane's supported modifiers. */
++ for (i = 0; i < plane->modifier_count; i++) {
++ if (modifier == plane->modifiers[i])
++ break;
+ }
++ if (i == plane->modifier_count)
++ return false;
+
+ /*
+ * For D swizzle the canonical modifier depends on the bpp, so check
+--
+2.38.1
+
--- /dev/null
+From d61e1d1d5225a9baeb995bcbdb904f66f70ed87e Mon Sep 17 00:00:00 2001
+From: Prike Liang <Prike.Liang@amd.com>
+Date: Fri, 21 Oct 2022 10:04:40 +0800
+Subject: drm/amdgpu: disallow gfxoff until GC IP blocks complete s2idle resume
+
+From: Prike Liang <Prike.Liang@amd.com>
+
+commit d61e1d1d5225a9baeb995bcbdb904f66f70ed87e upstream.
+
+In the S2idle suspend/resume phase the gfxoff is keeping functional so
+some IP blocks will be likely to reinitialize at gfxoff entry and that
+will result in failing to program GC registers.Therefore, let disallow
+gfxoff until AMDGPU IPs reinitialized completely.
+
+Signed-off-by: Prike Liang <Prike.Liang@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 5.15.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3208,6 +3208,15 @@ static int amdgpu_device_ip_resume_phase
+ return r;
+ }
+ adev->ip_blocks[i].status.hw = true;
++
++ if (adev->in_s0ix && adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_SMC) {
++ /* disable gfxoff for IP resume. The gfxoff will be re-enabled in
++ * amdgpu_device_resume() after IP resume.
++ */
++ amdgpu_gfx_off_ctrl(adev, false);
++ DRM_DEBUG("will disable gfxoff for re-initializing other blocks\n");
++ }
++
+ }
+
+ return 0;
+@@ -4180,6 +4189,13 @@ int amdgpu_device_resume(struct drm_devi
+ /* Make sure IB tests flushed */
+ flush_delayed_work(&adev->delayed_init_work);
+
++ if (adev->in_s0ix) {
++ /* re-enable gfxoff after IP resume. This re-enables gfxoff after
++ * it was disabled for IP resume in amdgpu_device_ip_resume_phase2().
++ */
++ amdgpu_gfx_off_ctrl(adev, true);
++ DRM_DEBUG("will enable gfxoff for the mission mode\n");
++ }
+ if (fbcon)
+ drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, false);
+
--- /dev/null
+From 79610d3041338dc1ef554d6fd8b3b3e23be527f5 Mon Sep 17 00:00:00 2001
+From: Chengming Gui <Jack.Gui@amd.com>
+Date: Tue, 18 Oct 2022 17:31:38 +0800
+Subject: drm/amdgpu: fix pstate setting issue
+
+From: Chengming Gui <Jack.Gui@amd.com>
+
+commit 79610d3041338dc1ef554d6fd8b3b3e23be527f5 upstream.
+
+[WHY]
+0, original pstate X
+1, ctx_A_create -> ctx_A->stable_pstate = X
+2, ctx_A_set_pstate (Y) -> current pstate is Y (PEAK or STANDARD)
+3, ctx_B_create -> ctx_B->stable_pstate = Y
+4, ctx_A_destroy -> restore pstate to X
+5, ctx_B_destroy -> restore pstate to Y
+Above sequence will cause final pstate is wrong (Y), should be original X.
+
+[HOW]
+When ctx_B create,
+if ctx_A touched pstate setting
+(not auto, stable_pstate_ctx != NULL),
+set ctx_B->stable_pstate the same value as ctx_A saved,
+if stable_pstate_ctx == NULL,
+fetch current pstate to fill
+ctx_B->stable_pstate.
+
+Signed-off-by: Chengming Gui <Jack.Gui@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+@@ -327,7 +327,10 @@ static int amdgpu_ctx_init(struct amdgpu
+ if (r)
+ return r;
+
+- ctx->stable_pstate = current_stable_pstate;
++ if (mgr->adev->pm.stable_pstate_ctx)
++ ctx->stable_pstate = mgr->adev->pm.stable_pstate_ctx->stable_pstate;
++ else
++ ctx->stable_pstate = current_stable_pstate;
+
+ return 0;
+ }
--- /dev/null
+From d2c4c1569a7d7d5c8f75963bf2d62d7aeac30e2a Mon Sep 17 00:00:00 2001
+From: Lijo Lazar <lijo.lazar@amd.com>
+Date: Fri, 30 Sep 2022 10:43:08 +0530
+Subject: drm/amdgpu: Remove ATC L2 access for MMHUB 2.1.x
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+commit d2c4c1569a7d7d5c8f75963bf2d62d7aeac30e2a upstream.
+
+MMHUB 2.1.x versions don't have ATCL2. Remove accesses to ATCL2 registers.
+
+Since they are non-existing registers, read access will cause a
+'Completer Abort' and gets reported when AER is enabled with the below patch.
+Tagging with the patch so that this is backported along with it.
+
+v2: squash in uninitialized warning fix (Nathan Chancellor)
+
+Fixes: 8795e182b02d ("PCI/portdrv: Don't disable AER reporting in get_port_device_capability()")
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Guchun Chen <guchun.chen@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 28 ++++++++--------------------
+ 1 file changed, 8 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
+@@ -32,8 +32,6 @@
+ #include "gc/gc_10_1_0_offset.h"
+ #include "soc15_common.h"
+
+-#define mmMM_ATC_L2_MISC_CG_Sienna_Cichlid 0x064d
+-#define mmMM_ATC_L2_MISC_CG_Sienna_Cichlid_BASE_IDX 0
+ #define mmDAGB0_CNTL_MISC2_Sienna_Cichlid 0x0070
+ #define mmDAGB0_CNTL_MISC2_Sienna_Cichlid_BASE_IDX 0
+
+@@ -574,7 +572,6 @@ static void mmhub_v2_0_update_medium_gra
+ case IP_VERSION(2, 1, 0):
+ case IP_VERSION(2, 1, 1):
+ case IP_VERSION(2, 1, 2):
+- def = data = RREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid);
+ def1 = data1 = RREG32_SOC15(MMHUB, 0, mmDAGB0_CNTL_MISC2_Sienna_Cichlid);
+ break;
+ default:
+@@ -608,8 +605,6 @@ static void mmhub_v2_0_update_medium_gra
+ case IP_VERSION(2, 1, 0):
+ case IP_VERSION(2, 1, 1):
+ case IP_VERSION(2, 1, 2):
+- if (def != data)
+- WREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid, data);
+ if (def1 != data1)
+ WREG32_SOC15(MMHUB, 0, mmDAGB0_CNTL_MISC2_Sienna_Cichlid, data1);
+ break;
+@@ -634,8 +629,8 @@ static void mmhub_v2_0_update_medium_gra
+ case IP_VERSION(2, 1, 0):
+ case IP_VERSION(2, 1, 1):
+ case IP_VERSION(2, 1, 2):
+- def = data = RREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid);
+- break;
++ /* There is no ATCL2 in MMHUB for 2.1.x */
++ return;
+ default:
+ def = data = RREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG);
+ break;
+@@ -646,18 +641,8 @@ static void mmhub_v2_0_update_medium_gra
+ else
+ data &= ~MM_ATC_L2_MISC_CG__MEM_LS_ENABLE_MASK;
+
+- if (def != data) {
+- switch (adev->ip_versions[MMHUB_HWIP][0]) {
+- case IP_VERSION(2, 1, 0):
+- case IP_VERSION(2, 1, 1):
+- case IP_VERSION(2, 1, 2):
+- WREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid, data);
+- break;
+- default:
+- WREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG, data);
+- break;
+- }
+- }
++ if (def != data)
++ WREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG, data);
+ }
+
+ static int mmhub_v2_0_set_clockgating(struct amdgpu_device *adev,
+@@ -695,7 +680,10 @@ static void mmhub_v2_0_get_clockgating(s
+ case IP_VERSION(2, 1, 0):
+ case IP_VERSION(2, 1, 1):
+ case IP_VERSION(2, 1, 2):
+- data = RREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid);
++ /* There is no ATCL2 in MMHUB for 2.1.x. Keep the status
++ * based on DAGB
++ */
++ data = MM_ATC_L2_MISC_CG__ENABLE_MASK;
+ data1 = RREG32_SOC15(MMHUB, 0, mmDAGB0_CNTL_MISC2_Sienna_Cichlid);
+ break;
+ default:
--- /dev/null
+From 969758bbf5e9360b63bbb2328ac3fda46bbbc9f5 Mon Sep 17 00:00:00 2001
+From: Jesse Zhang <jesse.zhang@amd.com>
+Date: Tue, 11 Oct 2022 05:23:10 +0000
+Subject: drm/amdkfd: correct the cache info for gfx1036
+
+From: Jesse Zhang <jesse.zhang@amd.com>
+
+commit 969758bbf5e9360b63bbb2328ac3fda46bbbc9f5 upstream.
+
+correct the cache information for gfx1036
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
+Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
+Signed-off-by: Jesse Zhang <jesse.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 53 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 52 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+@@ -843,6 +843,54 @@ static struct kfd_gpu_cache_info gfx1037
+ },
+ };
+
++static struct kfd_gpu_cache_info gc_10_3_6_cache_info[] = {
++ {
++ /* TCP L1 Cache per CU */
++ .cache_size = 16,
++ .cache_level = 1,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_DATA_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 1,
++ },
++ {
++ /* Scalar L1 Instruction Cache per SQC */
++ .cache_size = 32,
++ .cache_level = 1,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_INST_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 2,
++ },
++ {
++ /* Scalar L1 Data Cache per SQC */
++ .cache_size = 16,
++ .cache_level = 1,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_DATA_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 2,
++ },
++ {
++ /* GL1 Data Cache per SA */
++ .cache_size = 128,
++ .cache_level = 1,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_DATA_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 2,
++ },
++ {
++ /* L2 Data Cache per GPU (Total Tex Cache) */
++ .cache_size = 256,
++ .cache_level = 2,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_DATA_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 2,
++ },
++};
++
+ static void kfd_populated_cu_info_cpu(struct kfd_topology_device *dev,
+ struct crat_subtype_computeunit *cu)
+ {
+@@ -1562,10 +1610,13 @@ static int kfd_fill_gpu_cache_info(struc
+ num_of_cache_types = ARRAY_SIZE(beige_goby_cache_info);
+ break;
+ case IP_VERSION(10, 3, 3):
+- case IP_VERSION(10, 3, 6): /* TODO: Double check these on production silicon */
+ pcache_info = yellow_carp_cache_info;
+ num_of_cache_types = ARRAY_SIZE(yellow_carp_cache_info);
+ break;
++ case IP_VERSION(10, 3, 6):
++ pcache_info = gc_10_3_6_cache_info;
++ num_of_cache_types = ARRAY_SIZE(gc_10_3_6_cache_info);
++ break;
+ case IP_VERSION(10, 3, 7):
+ pcache_info = gfx1037_cache_info;
+ num_of_cache_types = ARRAY_SIZE(gfx1037_cache_info);
--- /dev/null
+From 9656db1b933caf6ffaaef10322093fe018359090 Mon Sep 17 00:00:00 2001
+From: Prike Liang <Prike.Liang@amd.com>
+Date: Thu, 20 Oct 2022 14:44:26 +0800
+Subject: drm/amdkfd: update gfx1037 Lx cache setting
+
+From: Prike Liang <Prike.Liang@amd.com>
+
+commit 9656db1b933caf6ffaaef10322093fe018359090 upstream.
+
+Update the gfx1037 L1/L2 cache setting.
+
+Signed-off-by: Prike Liang <Prike.Liang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 53 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 52 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+@@ -795,6 +795,54 @@ static struct kfd_gpu_cache_info yellow_
+ },
+ };
+
++static struct kfd_gpu_cache_info gfx1037_cache_info[] = {
++ {
++ /* TCP L1 Cache per CU */
++ .cache_size = 16,
++ .cache_level = 1,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_DATA_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 1,
++ },
++ {
++ /* Scalar L1 Instruction Cache per SQC */
++ .cache_size = 32,
++ .cache_level = 1,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_INST_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 2,
++ },
++ {
++ /* Scalar L1 Data Cache per SQC */
++ .cache_size = 16,
++ .cache_level = 1,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_DATA_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 2,
++ },
++ {
++ /* GL1 Data Cache per SA */
++ .cache_size = 128,
++ .cache_level = 1,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_DATA_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 2,
++ },
++ {
++ /* L2 Data Cache per GPU (Total Tex Cache) */
++ .cache_size = 256,
++ .cache_level = 2,
++ .flags = (CRAT_CACHE_FLAGS_ENABLED |
++ CRAT_CACHE_FLAGS_DATA_CACHE |
++ CRAT_CACHE_FLAGS_SIMD_CACHE),
++ .num_cu_shared = 2,
++ },
++};
++
+ static void kfd_populated_cu_info_cpu(struct kfd_topology_device *dev,
+ struct crat_subtype_computeunit *cu)
+ {
+@@ -1515,10 +1563,13 @@ static int kfd_fill_gpu_cache_info(struc
+ break;
+ case IP_VERSION(10, 3, 3):
+ case IP_VERSION(10, 3, 6): /* TODO: Double check these on production silicon */
+- case IP_VERSION(10, 3, 7): /* TODO: Double check these on production silicon */
+ pcache_info = yellow_carp_cache_info;
+ num_of_cache_types = ARRAY_SIZE(yellow_carp_cache_info);
+ break;
++ case IP_VERSION(10, 3, 7):
++ pcache_info = gfx1037_cache_info;
++ num_of_cache_types = ARRAY_SIZE(gfx1037_cache_info);
++ break;
+ case IP_VERSION(11, 0, 0):
+ case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 2):
--- /dev/null
+From 1a3abd12a394f5c66943fee75cef533069e831fb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Roberto=20de=20Souza?= <jose.souza@intel.com>
+Date: Mon, 17 Oct 2022 06:24:32 -0700
+Subject: drm/i915: Extend Wa_1607297627 to Alderlake-P
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Roberto de Souza <jose.souza@intel.com>
+
+commit 1a3abd12a394f5c66943fee75cef533069e831fb upstream.
+
+Workaround 1607297627 was missed for Alderlake-P, so here extending it
+to it and adding the fixes tag so this WA is backported to all
+stable kernels.
+
+v2:
+- fixed subject
+- added Fixes tag
+
+BSpec: 54369
+Cc: <stable@vger.kernel.org> # v5.17+
+Fixes: dfb924e33927 ("drm/i915/adlp: Remove require_force_probe protection")
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221017132432.112850-1-jose.souza@intel.com
+(cherry picked from commit 847eec69f01a28ca44f5ac7e1d71d3a60263d680)
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -2301,11 +2301,11 @@ rcs_engine_wa_init(struct intel_engine_c
+ }
+
+ if (IS_DG1_GRAPHICS_STEP(i915, STEP_A0, STEP_B0) ||
+- IS_ROCKETLAKE(i915) || IS_TIGERLAKE(i915)) {
++ IS_ROCKETLAKE(i915) || IS_TIGERLAKE(i915) || IS_ALDERLAKE_P(i915)) {
+ /*
+ * Wa_1607030317:tgl
+ * Wa_1607186500:tgl
+- * Wa_1607297627:tgl,rkl,dg1[a0]
++ * Wa_1607297627:tgl,rkl,dg1[a0],adlp
+ *
+ * On TGL and RKL there are multiple entries for this WA in the
+ * BSpec; some indicate this is an A0-only WA, others indicate
--- /dev/null
+From 2b57f726611e294dc4297dd48eb8c98ef1938e82 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:16 +0200
+Subject: drm/msm/dp: fix aux-bus EP lifetime
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 2b57f726611e294dc4297dd48eb8c98ef1938e82 upstream.
+
+Device-managed resources allocated post component bind must be tied to
+the lifetime of the aggregate DRM device or they will not necessarily be
+released when binding of the aggregate device is deferred.
+
+This can lead resource leaks or failure to bind the aggregate device
+when binding is later retried and a second attempt to allocate the
+resources is made.
+
+For the DP aux-bus, an attempt to populate the bus a second time will
+simply fail ("DP AUX EP device already populated").
+
+Fix this by tying the lifetime of the EP device to the DRM device rather
+than DP controller platform device.
+
+Fixes: c3bf8e21b38a ("drm/msm/dp: Add eDP support via aux_bus")
+Cc: stable@vger.kernel.org # 5.19
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/502672/
+Link: https://lore.kernel.org/r/20220913085320.8577-7-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index 352cc09f2069..42de690132cf 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -1528,6 +1528,11 @@ void msm_dp_debugfs_init(struct msm_dp *dp_display, struct drm_minor *minor)
+ }
+ }
+
++static void of_dp_aux_depopulate_bus_void(void *data)
++{
++ of_dp_aux_depopulate_bus(data);
++}
++
+ static int dp_display_get_next_bridge(struct msm_dp *dp)
+ {
+ int rc;
+@@ -1552,10 +1557,16 @@ static int dp_display_get_next_bridge(struct msm_dp *dp)
+ * panel driver is probed asynchronously but is the best we
+ * can do without a bigger driver reorganization.
+ */
+- rc = devm_of_dp_aux_populate_ep_devices(dp_priv->aux);
++ rc = of_dp_aux_populate_bus(dp_priv->aux, NULL);
+ of_node_put(aux_bus);
+ if (rc)
+ goto error;
++
++ rc = devm_add_action_or_reset(dp->drm_dev->dev,
++ of_dp_aux_depopulate_bus_void,
++ dp_priv->aux);
++ if (rc)
++ goto error;
+ } else if (dp->is_edp) {
+ DRM_ERROR("eDP aux_bus not found\n");
+ return -ENODEV;
+--
+2.38.1
+
--- /dev/null
+From 16194958f888d63839042d1190f7001e5ddec47b Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:17 +0200
+Subject: drm/msm/dp: fix bridge lifetime
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 16194958f888d63839042d1190f7001e5ddec47b upstream.
+
+Device-managed resources allocated post component bind must be tied to
+the lifetime of the aggregate DRM device or they will not necessarily be
+released when binding of the aggregate device is deferred.
+
+This can lead resource leaks or failure to bind the aggregate device
+when binding is later retried and a second attempt to allocate the
+resources is made.
+
+For the DP bridges, previously allocated bridges will leak on probe
+deferral.
+
+Fix this by amending the DP parser interface and tying the lifetime of
+the bridge device to the DRM device rather than DP platform device.
+
+Fixes: c3bf8e21b38a ("drm/msm/dp: Add eDP support via aux_bus")
+Cc: stable@vger.kernel.org # 5.19
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/502667/
+Link: https://lore.kernel.org/r/20220913085320.8577-8-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 2 +-
+ drivers/gpu/drm/msm/dp/dp_parser.c | 6 +++---
+ drivers/gpu/drm/msm/dp/dp_parser.h | 5 +++--
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index 42de690132cf..a49f6dbbe888 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -1579,7 +1579,7 @@ static int dp_display_get_next_bridge(struct msm_dp *dp)
+ * For DisplayPort interfaces external bridges are optional, so
+ * silently ignore an error if one is not present (-ENODEV).
+ */
+- rc = dp_parser_find_next_bridge(dp_priv->parser);
++ rc = devm_dp_parser_find_next_bridge(dp->drm_dev->dev, dp_priv->parser);
+ if (!dp->is_edp && rc == -ENODEV)
+ return 0;
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_parser.c b/drivers/gpu/drm/msm/dp/dp_parser.c
+index dd732215d55b..dcbe893d66d7 100644
+--- a/drivers/gpu/drm/msm/dp/dp_parser.c
++++ b/drivers/gpu/drm/msm/dp/dp_parser.c
+@@ -240,12 +240,12 @@ static int dp_parser_clock(struct dp_parser *parser)
+ return 0;
+ }
+
+-int dp_parser_find_next_bridge(struct dp_parser *parser)
++int devm_dp_parser_find_next_bridge(struct device *dev, struct dp_parser *parser)
+ {
+- struct device *dev = &parser->pdev->dev;
++ struct platform_device *pdev = parser->pdev;
+ struct drm_bridge *bridge;
+
+- bridge = devm_drm_of_get_bridge(dev, dev->of_node, 1, 0);
++ bridge = devm_drm_of_get_bridge(dev, pdev->dev.of_node, 1, 0);
+ if (IS_ERR(bridge))
+ return PTR_ERR(bridge);
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_parser.h b/drivers/gpu/drm/msm/dp/dp_parser.h
+index 866c1a82bf1a..d30ab773db46 100644
+--- a/drivers/gpu/drm/msm/dp/dp_parser.h
++++ b/drivers/gpu/drm/msm/dp/dp_parser.h
+@@ -138,8 +138,9 @@ struct dp_parser {
+ struct dp_parser *dp_parser_get(struct platform_device *pdev);
+
+ /**
+- * dp_parser_find_next_bridge() - find an additional bridge to DP
++ * devm_dp_parser_find_next_bridge() - find an additional bridge to DP
+ *
++ * @dev: device to tie bridge lifetime to
+ * @parser: dp_parser data from client
+ *
+ * This function is used to find any additional bridge attached to
+@@ -147,6 +148,6 @@ struct dp_parser *dp_parser_get(struct platform_device *pdev);
+ *
+ * Return: 0 if able to get the bridge, otherwise negative errno for failure.
+ */
+-int dp_parser_find_next_bridge(struct dp_parser *parser);
++int devm_dp_parser_find_next_bridge(struct device *dev, struct dp_parser *parser);
+
+ #endif
+--
+2.38.1
+
--- /dev/null
+From a79343dcaba4b11adb57350e0b6426906a9b658e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:15 +0200
+Subject: drm/msm/dp: fix IRQ lifetime
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit a79343dcaba4b11adb57350e0b6426906a9b658e upstream.
+
+Device-managed resources allocated post component bind must be tied to
+the lifetime of the aggregate DRM device or they will not necessarily be
+released when binding of the aggregate device is deferred.
+
+This is specifically true for the DP IRQ, which will otherwise remain
+requested so that the next bind attempt fails when requesting the IRQ a
+second time.
+
+Since commit c3bf8e21b38a ("drm/msm/dp: Add eDP support via aux_bus")
+this can happen when the aux-bus panel driver has not yet been loaded so
+that probe is deferred.
+
+Fix this by tying the device-managed lifetime of the DP IRQ to the DRM
+device so that it is released when bind fails.
+
+Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support")
+Cc: stable@vger.kernel.org # 5.10
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/502679/
+Link: https://lore.kernel.org/r/20220913085320.8577-6-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -1249,7 +1249,7 @@ int dp_display_request_irq(struct msm_dp
+ return -EINVAL;
+ }
+
+- rc = devm_request_irq(&dp->pdev->dev, dp->irq,
++ rc = devm_request_irq(dp_display->drm_dev->dev, dp->irq,
+ dp_display_irq_handler,
+ IRQF_TRIGGER_HIGH, "dp_display_isr", dp);
+ if (rc < 0) {
--- /dev/null
+From 74466e46e7543c7f74f1502181e9ba93f7521374 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:12 +0200
+Subject: drm/msm/dp: fix memory corruption with too many bridges
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 74466e46e7543c7f74f1502181e9ba93f7521374 upstream.
+
+Add the missing sanity check on the bridge counter to avoid corrupting
+data beyond the fixed-sized bridge array in case there are ever more
+than eight bridges.
+
+Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable")
+Cc: stable@vger.kernel.org # 5.17
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/502664/
+Link: https://lore.kernel.org/r/20220913085320.8577-3-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index bfd0aeff3f0d..be9ed891dc3f 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -1597,6 +1597,12 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev,
+ return -EINVAL;
+
+ priv = dev->dev_private;
++
++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
++ DRM_DEV_ERROR(dev->dev, "too many bridges\n");
++ return -ENOSPC;
++ }
++
+ dp_display->drm_dev = dev;
+
+ dp_priv = container_of(dp_display, struct dp_display_private, dp_display);
+--
+2.38.1
+
--- /dev/null
+From 2e786eb2f9cebb07e317226b60054df510b60c65 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:13 +0200
+Subject: drm/msm/dsi: fix memory corruption with too many bridges
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 2e786eb2f9cebb07e317226b60054df510b60c65 upstream.
+
+Add the missing sanity check on the bridge counter to avoid corrupting
+data beyond the fixed-sized bridge array in case there are ever more
+than eight bridges.
+
+Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
+Cc: stable@vger.kernel.org # 4.1
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/502668/
+Link: https://lore.kernel.org/r/20220913085320.8577-4-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/msm/dsi/dsi.c
++++ b/drivers/gpu/drm/msm/dsi/dsi.c
+@@ -227,6 +227,12 @@ int msm_dsi_modeset_init(struct msm_dsi
+ return -EINVAL;
+
+ priv = dev->dev_private;
++
++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
++ DRM_DEV_ERROR(dev->dev, "too many bridges\n");
++ return -ENOSPC;
++ }
++
+ msm_dsi->dev = dev;
+
+ ret = msm_dsi_host_modeset_init(msm_dsi->host, dev);
--- /dev/null
+From 6808abdb33bf90330e70a687d29f038507e06ebb Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:11 +0200
+Subject: drm/msm: fix use-after-free on probe deferral
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 6808abdb33bf90330e70a687d29f038507e06ebb upstream.
+
+The bridge counter was never reset when tearing down the DRM device so
+that stale pointers to deallocated structures would be accessed on the
+next tear down (e.g. after a second late bind deferral).
+
+Given enough bridges and a few probe deferrals this could currently also
+lead to data beyond the bridge array being corrupted.
+
+Fixes: d28ea556267c ("drm/msm: properly add and remove internal bridges")
+Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge")
+Cc: stable@vger.kernel.org # 3.12
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/502665/
+Link: https://lore.kernel.org/r/20220913085320.8577-2-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/msm_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -241,6 +241,7 @@ static int msm_drm_uninit(struct device
+
+ for (i = 0; i < priv->num_bridges; i++)
+ drm_bridge_remove(priv->bridges[i]);
++ priv->num_bridges = 0;
+
+ pm_runtime_get_sync(dev);
+ msm_irq_uninstall(ddev);
--- /dev/null
+From 152d394842bb564148e68b92486a87db0bf54859 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:18 +0200
+Subject: drm/msm/hdmi: fix IRQ lifetime
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 152d394842bb564148e68b92486a87db0bf54859 upstream.
+
+Device-managed resources allocated post component bind must be tied to
+the lifetime of the aggregate DRM device or they will not necessarily be
+released when binding of the aggregate device is deferred.
+
+This is specifically true for the HDMI IRQ, which will otherwise remain
+requested so that the next bind attempt fails when requesting the IRQ a
+second time.
+
+Fix this by tying the device-managed lifetime of the HDMI IRQ to the DRM
+device so that it is released when bind fails.
+
+Fixes: 067fef372c73 ("drm/msm/hdmi: refactor bind/init")
+Cc: stable@vger.kernel.org # 3.19
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/502666/
+Link: https://lore.kernel.org/r/20220913085320.8577-9-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/hdmi/hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -344,7 +344,7 @@ int msm_hdmi_modeset_init(struct hdmi *h
+ goto fail;
+ }
+
+- ret = devm_request_irq(&pdev->dev, hdmi->irq,
++ ret = devm_request_irq(dev->dev, hdmi->irq,
+ msm_hdmi_irq, IRQF_TRIGGER_HIGH,
+ "hdmi_isr", hdmi);
+ if (ret < 0) {
--- /dev/null
+From 4c1294da6aed1f16d47a417dcfe6602833c3c95c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:14 +0200
+Subject: drm/msm/hdmi: fix memory corruption with too many bridges
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 4c1294da6aed1f16d47a417dcfe6602833c3c95c upstream.
+
+Add the missing sanity check on the bridge counter to avoid corrupting
+data beyond the fixed-sized bridge array in case there are ever more
+than eight bridges.
+
+Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge")
+Cc: stable@vger.kernel.org # 3.12
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/502670/
+Link: https://lore.kernel.org/r/20220913085320.8577-5-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -300,6 +300,11 @@ int msm_hdmi_modeset_init(struct hdmi *h
+ struct platform_device *pdev = hdmi->pdev;
+ int ret;
+
++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
++ DRM_DEV_ERROR(dev->dev, "too many bridges\n");
++ return -ENOSPC;
++ }
++
+ hdmi->dev = dev;
+ hdmi->encoder = encoder;
+
scsi-qla2xxx-use-transport-defined-speed-mask-for-supported_speeds.patch
drm-amdgpu-fix-vram-bo-swap-issue.patch
drm-amdgpu-fix-for-bo-move-issue.patch
+drm-i915-extend-wa_1607297627-to-alderlake-p.patch
+drm-amdgpu-remove-atc-l2-access-for-mmhub-2.1.x.patch
+drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch
+drm-amdgpu-fix-pstate-setting-issue.patch
+drm-amd-display-revert-logic-for-plane-modifiers.patch
+drm-amdkfd-update-gfx1037-lx-cache-setting.patch
+drm-amdkfd-correct-the-cache-info-for-gfx1036.patch
+drm-msm-fix-use-after-free-on-probe-deferral.patch
+drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch
+drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch
+drm-msm-hdmi-fix-irq-lifetime.patch
+drm-msm-dp-fix-memory-corruption-with-too-many-bridges.patch
+drm-msm-dp-fix-aux-bus-ep-lifetime.patch
+drm-msm-dp-fix-irq-lifetime.patch
+drm-msm-dp-fix-bridge-lifetime.patch
+crypto-x86-polyval-fix-crashes-when-keys-are-not-16-byte-aligned.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
