--- /dev/null
+From edca5a2c373db61efa959307c13ed9156b1c14d9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 29 Aug 2022 16:58:34 +0300
+Subject: drm/i915/bios: Copy the whole MIPI sequence block
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit edca5a2c373db61efa959307c13ed9156b1c14d9 upstream.
+
+Turns out the MIPI sequence block version number and
+new block size fields are considered part of the block
+header and are not included in the reported new block size
+field itself. Bump up the block size appropriately so that
+we'll copy over the last five bytes of the block as well.
+
+For this particular machine those last five bytes included
+parts of the GPIO op for the backlight on sequence, causing
+the backlight no longer to turn back on:
+
+ Sequence 6 - MIPI_SEQ_BACKLIGHT_ON
+ Delay: 20000 us
+- GPIO index 0, number 0, set 0 (0x00)
++ GPIO index 1, number 70, set 1 (0x01)
+
+Cc: stable@vger.kernel.org
+Fixes: e163cfb4c96d ("drm/i915/bios: Make copies of VBT data blocks")
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6652
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220829135834.8585-1-ville.syrjala@linux.intel.com
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit a06289f3f72431f3777af95ea1226b5b0abdc426)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_bios.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_bios.c
++++ b/drivers/gpu/drm/i915/display/intel_bios.c
+@@ -478,6 +478,13 @@ init_bdb_block(struct drm_i915_private *
+
+ block_size = get_blocksize(block);
+
++ /*
++ * Version number and new block size are considered
++ * part of the header for MIPI sequenece block v3+.
++ */
++ if (section_id == BDB_MIPI_SEQUENCE && *(const u8 *)block >= 3)
++ block_size += 5;
++
+ entry = kzalloc(struct_size(entry, data, max(min_size, block_size) + 3),
+ GFP_KERNEL);
+ if (!entry) {
--- /dev/null
+From 672d6ca758651f0ec12cd0d59787067a5bde1c96 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Fri, 2 Sep 2022 10:03:18 +0300
+Subject: drm/i915: Implement WaEdpLinkRateDataReload
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 672d6ca758651f0ec12cd0d59787067a5bde1c96 upstream.
+
+A lot of modern laptops use the Parade PS8461E MUX for eDP
+switching. The MUX can operate in jitter cleaning mode or
+redriver mode, the first one resulting in higher link
+quality. The jitter cleaning mode needs to know the link
+rate used and the MUX achieves this by snooping the
+LINK_BW_SET, LINK_RATE_SELECT and SUPPORTED_LINK_RATES
+DPCD accesses.
+
+When the MUX is powered down (seems this can happen whenever
+the display is turned off) it loses track of the snooped
+link rates so when we do the LINK_RATE_SELECT write it no
+longer knowns which link rate we're selecting, and thus it
+falls back to the lower quality redriver mode. This results
+in unstable high link rates (eg. usually 8.1Gbps link rate
+no longer works correctly).
+
+In order to avoid all that let's re-snoop SUPPORTED_LINK_RATES
+from the sink at the start of every link training.
+
+Unfortunately we don't have a way to detect the presence of
+the MUX. It looks like the set of laptops equipped with this
+MUX is fairly large and contains devices from multiple
+manufacturers. It may also still be growing with new models.
+So a quirk doesn't seem like a very easily maintainable
+option, thus we shall attempt to do this unconditionally on
+all machines that use LINK_RATE_SELECT. Hopefully this extra
+DPCD read doesn't cause issues for any unaffected machine.
+If that turns out to be the case we'll need to convert this
+into a quirk in the future.
+
+Cc: stable@vger.kernel.org
+Cc: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6205
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220902070319.15395-1-ville.syrjala@linux.intel.com
+Tested-by: Aaron Ma <aaron.ma@canonical.com>
+Tested-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 25899c590cb5ba9b9f284c6ca8e7e9086793d641)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_dp_link_training.c | 22 ++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_dp_link_training.c
++++ b/drivers/gpu/drm/i915/display/intel_dp_link_training.c
+@@ -671,6 +671,28 @@ intel_dp_prepare_link_train(struct intel
+ intel_dp_compute_rate(intel_dp, crtc_state->port_clock,
+ &link_bw, &rate_select);
+
++ /*
++ * WaEdpLinkRateDataReload
++ *
++ * Parade PS8461E MUX (used on varius TGL+ laptops) needs
++ * to snoop the link rates reported by the sink when we
++ * use LINK_RATE_SET in order to operate in jitter cleaning
++ * mode (as opposed to redriver mode). Unfortunately it
++ * loses track of the snooped link rates when powered down,
++ * so we need to make it re-snoop often. Without this high
++ * link rates are not stable.
++ */
++ if (!link_bw) {
++ struct intel_connector *connector = intel_dp->attached_connector;
++ __le16 sink_rates[DP_MAX_SUPPORTED_RATES];
++
++ drm_dbg_kms(&i915->drm, "[CONNECTOR:%d:%s] Reloading eDP link rates\n",
++ connector->base.base.id, connector->base.name);
++
++ drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES,
++ sink_rates, sizeof(sink_rates));
++ }
++
+ if (link_bw)
+ drm_dbg_kms(&i915->drm,
+ "[ENCODER:%d:%s] Using LINK_BW_SET value %02x\n",
--- /dev/null
+From e1cab970574c001d83e59ca8388c474a57a1afb6 Mon Sep 17 00:00:00 2001
+From: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Date: Wed, 31 Aug 2022 17:45:38 -0400
+Subject: drm/i915/slpc: Let's fix the PCODE min freq table setup for SLPC
+
+From: Rodrigo Vivi <rodrigo.vivi@intel.com>
+
+commit e1cab970574c001d83e59ca8388c474a57a1afb6 upstream.
+
+We need to inform PCODE of a desired ring frequencies so PCODE update
+the memory frequencies to us. rps->min_freq and rps->max_freq are the
+frequencies used in that request. However they were unset when SLPC was
+enabled and PCODE never updated the memory freq.
+
+v2 (as Suggested by Ashutosh): if SLPC is in use, let's pick the right
+ frequencies from the get_ia_constants instead of the fake init of
+ rps' min and max.
+
+v3: don't forget the max <= min return
+
+v4: Move all the freq conversion to intel_rps.c. And the max <= min
+ check to where it belongs.
+
+v5: (Ashutosh) Fix old comment s/50 HZ/50 MHz and add a doc explaining
+ the "raw format"
+
+Fixes: 7ba79a671568 ("drm/i915/guc/slpc: Gate Host RPS when SLPC is enabled")
+Cc: <stable@vger.kernel.org> # v5.15+
+Cc: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Tested-by: Sushma Venkatesh Reddy <sushma.venkatesh.reddy@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220831214538.143950-1-rodrigo.vivi@intel.com
+(cherry picked from commit 018a7bdbb090b9155a6509a0d1a684db4afaa5b1)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/intel_llc.c | 19 ++++++-------
+ drivers/gpu/drm/i915/gt/intel_rps.c | 50 ++++++++++++++++++++++++++++++++++++
+ drivers/gpu/drm/i915/gt/intel_rps.h | 2 +
+ 3 files changed, 61 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_llc.c
++++ b/drivers/gpu/drm/i915/gt/intel_llc.c
+@@ -12,6 +12,7 @@
+ #include "intel_llc.h"
+ #include "intel_mchbar_regs.h"
+ #include "intel_pcode.h"
++#include "intel_rps.h"
+
+ struct ia_constants {
+ unsigned int min_gpu_freq;
+@@ -55,9 +56,6 @@ static bool get_ia_constants(struct inte
+ if (!HAS_LLC(i915) || IS_DGFX(i915))
+ return false;
+
+- if (rps->max_freq <= rps->min_freq)
+- return false;
+-
+ consts->max_ia_freq = cpu_max_MHz();
+
+ consts->min_ring_freq =
+@@ -65,13 +63,8 @@ static bool get_ia_constants(struct inte
+ /* convert DDR frequency from units of 266.6MHz to bandwidth */
+ consts->min_ring_freq = mult_frac(consts->min_ring_freq, 8, 3);
+
+- consts->min_gpu_freq = rps->min_freq;
+- consts->max_gpu_freq = rps->max_freq;
+- if (GRAPHICS_VER(i915) >= 9) {
+- /* Convert GT frequency to 50 HZ units */
+- consts->min_gpu_freq /= GEN9_FREQ_SCALER;
+- consts->max_gpu_freq /= GEN9_FREQ_SCALER;
+- }
++ consts->min_gpu_freq = intel_rps_get_min_raw_freq(rps);
++ consts->max_gpu_freq = intel_rps_get_max_raw_freq(rps);
+
+ return true;
+ }
+@@ -132,6 +125,12 @@ static void gen6_update_ring_freq(struct
+ return;
+
+ /*
++ * Although this is unlikely on any platform during initialization,
++ * let's ensure we don't get accidentally into infinite loop
++ */
++ if (consts.max_gpu_freq <= consts.min_gpu_freq)
++ return;
++ /*
+ * For each potential GPU frequency, load a ring frequency we'd like
+ * to use for memory access. We do this by specifying the IA frequency
+ * the PCU should use as a reference to determine the ring frequency.
+--- a/drivers/gpu/drm/i915/gt/intel_rps.c
++++ b/drivers/gpu/drm/i915/gt/intel_rps.c
+@@ -2123,6 +2123,31 @@ u32 intel_rps_get_max_frequency(struct i
+ return intel_gpu_freq(rps, rps->max_freq_softlimit);
+ }
+
++/**
++ * intel_rps_get_max_raw_freq - returns the max frequency in some raw format.
++ * @rps: the intel_rps structure
++ *
++ * Returns the max frequency in a raw format. In newer platforms raw is in
++ * units of 50 MHz.
++ */
++u32 intel_rps_get_max_raw_freq(struct intel_rps *rps)
++{
++ struct intel_guc_slpc *slpc = rps_to_slpc(rps);
++ u32 freq;
++
++ if (rps_uses_slpc(rps)) {
++ return DIV_ROUND_CLOSEST(slpc->rp0_freq,
++ GT_FREQUENCY_MULTIPLIER);
++ } else {
++ freq = rps->max_freq;
++ if (GRAPHICS_VER(rps_to_i915(rps)) >= 9) {
++ /* Convert GT frequency to 50 MHz units */
++ freq /= GEN9_FREQ_SCALER;
++ }
++ return freq;
++ }
++}
++
+ u32 intel_rps_get_rp0_frequency(struct intel_rps *rps)
+ {
+ struct intel_guc_slpc *slpc = rps_to_slpc(rps);
+@@ -2211,6 +2236,31 @@ u32 intel_rps_get_min_frequency(struct i
+ return intel_gpu_freq(rps, rps->min_freq_softlimit);
+ }
+
++/**
++ * intel_rps_get_min_raw_freq - returns the min frequency in some raw format.
++ * @rps: the intel_rps structure
++ *
++ * Returns the min frequency in a raw format. In newer platforms raw is in
++ * units of 50 MHz.
++ */
++u32 intel_rps_get_min_raw_freq(struct intel_rps *rps)
++{
++ struct intel_guc_slpc *slpc = rps_to_slpc(rps);
++ u32 freq;
++
++ if (rps_uses_slpc(rps)) {
++ return DIV_ROUND_CLOSEST(slpc->min_freq,
++ GT_FREQUENCY_MULTIPLIER);
++ } else {
++ freq = rps->min_freq;
++ if (GRAPHICS_VER(rps_to_i915(rps)) >= 9) {
++ /* Convert GT frequency to 50 MHz units */
++ freq /= GEN9_FREQ_SCALER;
++ }
++ return freq;
++ }
++}
++
+ static int set_min_freq(struct intel_rps *rps, u32 val)
+ {
+ int ret = 0;
+--- a/drivers/gpu/drm/i915/gt/intel_rps.h
++++ b/drivers/gpu/drm/i915/gt/intel_rps.h
+@@ -37,8 +37,10 @@ u32 intel_rps_get_cagf(struct intel_rps
+ u32 intel_rps_read_actual_frequency(struct intel_rps *rps);
+ u32 intel_rps_get_requested_frequency(struct intel_rps *rps);
+ u32 intel_rps_get_min_frequency(struct intel_rps *rps);
++u32 intel_rps_get_min_raw_freq(struct intel_rps *rps);
+ int intel_rps_set_min_frequency(struct intel_rps *rps, u32 val);
+ u32 intel_rps_get_max_frequency(struct intel_rps *rps);
++u32 intel_rps_get_max_raw_freq(struct intel_rps *rps);
+ int intel_rps_set_max_frequency(struct intel_rps *rps, u32 val);
+ u32 intel_rps_get_rp0_frequency(struct intel_rps *rps);
+ u32 intel_rps_get_rp1_frequency(struct intel_rps *rps);
--- /dev/null
+From 6a02a61e81c231cc5c680c5dbf8665275147ac52 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Fri, 12 Aug 2022 14:03:17 -0700
+Subject: nvmet: fix a use-after-free
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 6a02a61e81c231cc5c680c5dbf8665275147ac52 upstream.
+
+Fix the following use-after-free complaint triggered by blktests nvme/004:
+
+BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350
+Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460
+Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop]
+Call Trace:
+ show_stack+0x52/0x58
+ dump_stack_lvl+0x49/0x5e
+ print_report.cold+0x36/0x1e2
+ kasan_report+0xb9/0xf0
+ __asan_load4+0x6b/0x80
+ blk_mq_complete_request_remote+0xac/0x350
+ nvme_loop_queue_response+0x1df/0x275 [nvme_loop]
+ __nvmet_req_complete+0x132/0x4f0 [nvmet]
+ nvmet_req_complete+0x15/0x40 [nvmet]
+ nvmet_execute_io_connect+0x18a/0x1f0 [nvmet]
+ nvme_loop_execute_work+0x20/0x30 [nvme_loop]
+ process_one_work+0x56e/0xa70
+ worker_thread+0x2d1/0x640
+ kthread+0x183/0x1c0
+ ret_from_fork+0x1f/0x30
+
+Cc: stable@vger.kernel.org
+Fixes: a07b4970f464 ("nvmet: add a generic NVMe target")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -735,6 +735,8 @@ static void nvmet_set_error(struct nvmet
+
+ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
+ {
++ struct nvmet_ns *ns = req->ns;
++
+ if (!req->sq->sqhd_disabled)
+ nvmet_update_sq_head(req);
+ req->cqe->sq_id = cpu_to_le16(req->sq->qid);
+@@ -745,9 +747,9 @@ static void __nvmet_req_complete(struct
+
+ trace_nvmet_req_complete(req);
+
+- if (req->ns)
+- nvmet_put_namespace(req->ns);
+ req->ops->queue_response(req);
++ if (ns)
++ nvmet_put_namespace(ns);
+ }
+
+ void nvmet_req_complete(struct nvmet_req *req, u16 status)
--- /dev/null
+From da6d507f5ff328f346b3c50e19e19993027b8ffd Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Tue, 23 Aug 2022 12:42:37 +0800
+Subject: scsi: lpfc: Add missing destroy_workqueue() in error path
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit da6d507f5ff328f346b3c50e19e19993027b8ffd upstream.
+
+Add the missing destroy_workqueue() before return from
+lpfc_sli4_driver_resource_setup() in the error path.
+
+Link: https://lore.kernel.org/r/20220823044237.285643-1-yangyingliang@huawei.com
+Fixes: 3cee98db2610 ("scsi: lpfc: Fix crash on driver unload in wq free")
+Reviewed-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_init.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -8061,7 +8061,7 @@ lpfc_sli4_driver_resource_setup(struct l
+ /* Allocate device driver memory */
+ rc = lpfc_mem_alloc(phba, SGL_ALIGN_SZ);
+ if (rc)
+- return -ENOMEM;
++ goto out_destroy_workqueue;
+
+ /* IF Type 2 ports get initialized now. */
+ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >=
+@@ -8489,6 +8489,9 @@ out_free_bsmbx:
+ lpfc_destroy_bootstrap_mbox(phba);
+ out_free_mem:
+ lpfc_mem_free(phba);
++out_destroy_workqueue:
++ destroy_workqueue(phba->wq);
++ phba->wq = NULL;
+ return rc;
+ }
+
--- /dev/null
+From 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 Mon Sep 17 00:00:00 2001
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Date: Tue, 6 Sep 2022 19:19:08 +0530
+Subject: scsi: mpt3sas: Fix use-after-free warning
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+commit 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 upstream.
+
+Fix the following use-after-free warning which is observed during
+controller reset:
+
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0
+
+Link: https://lore.kernel.org/r/20220906134908.1039-2-sreekanth.reddy@broadcom.com
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -3670,6 +3670,7 @@ static struct fw_event_work *dequeue_nex
+ fw_event = list_first_entry(&ioc->fw_event_list,
+ struct fw_event_work, list);
+ list_del_init(&fw_event->list);
++ fw_event_work_put(fw_event);
+ }
+ spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
+
+@@ -3751,7 +3752,6 @@ _scsih_fw_event_cleanup_queue(struct MPT
+ if (cancel_work_sync(&fw_event->work))
+ fw_event_work_put(fw_event);
+
+- fw_event_work_put(fw_event);
+ }
+ ioc->fw_events_cleanup = 0;
+ }
sched-debug-fix-dentry-leak-in-update_sched_domain_debugfs.patch
drm-amd-display-fix-memory-leak-when-using-debugfs_lookup.patch
driver-core-fix-driver_set_override-issue-with-empty-strings.patch
+nvmet-fix-a-use-after-free.patch
+drm-i915-bios-copy-the-whole-mipi-sequence-block.patch
+drm-i915-slpc-let-s-fix-the-pcode-min-freq-table-setup-for-slpc.patch
+drm-i915-implement-waedplinkratedatareload.patch
+scsi-mpt3sas-fix-use-after-free-warning.patch
+scsi-lpfc-add-missing-destroy_workqueue-in-error-path.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
