From: Greg Kroah-Hartman Date: Sat, 10 Sep 2022 06:37:45 +0000 (+0200) Subject: 5.19-stable patches X-Git-Tag: v5.19.9~51 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=96e13f9d913351645529824dcca29f75b9c1c4f7;p=thirdparty%2Fkernel%2Fstable-queue.git 5.19-stable patches added patches: drm-i915-bios-copy-the-whole-mipi-sequence-block.patch drm-i915-implement-waedplinkratedatareload.patch drm-i915-slpc-let-s-fix-the-pcode-min-freq-table-setup-for-slpc.patch nvmet-fix-a-use-after-free.patch scsi-lpfc-add-missing-destroy_workqueue-in-error-path.patch scsi-mpt3sas-fix-use-after-free-warning.patch --- diff --git a/queue-5.19/drm-i915-bios-copy-the-whole-mipi-sequence-block.patch b/queue-5.19/drm-i915-bios-copy-the-whole-mipi-sequence-block.patch new file mode 100644 index 00000000000..49258539e39 --- /dev/null +++ b/queue-5.19/drm-i915-bios-copy-the-whole-mipi-sequence-block.patch @@ -0,0 +1,56 @@ +From edca5a2c373db61efa959307c13ed9156b1c14d9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 29 Aug 2022 16:58:34 +0300 +Subject: drm/i915/bios: Copy the whole MIPI sequence block +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit edca5a2c373db61efa959307c13ed9156b1c14d9 upstream. + +Turns out the MIPI sequence block version number and +new block size fields are considered part of the block +header and are not included in the reported new block size +field itself. Bump up the block size appropriately so that +we'll copy over the last five bytes of the block as well. + +For this particular machine those last five bytes included +parts of the GPIO op for the backlight on sequence, causing +the backlight no longer to turn back on: + + Sequence 6 - MIPI_SEQ_BACKLIGHT_ON + Delay: 20000 us +- GPIO index 0, number 0, set 0 (0x00) ++ GPIO index 1, number 70, set 1 (0x01) + +Cc: stable@vger.kernel.org +Fixes: e163cfb4c96d ("drm/i915/bios: Make copies of VBT data blocks") +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6652 +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20220829135834.8585-1-ville.syrjala@linux.intel.com +Reviewed-by: Jani Nikula +(cherry picked from commit a06289f3f72431f3777af95ea1226b5b0abdc426) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_bios.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_bios.c ++++ b/drivers/gpu/drm/i915/display/intel_bios.c +@@ -478,6 +478,13 @@ init_bdb_block(struct drm_i915_private * + + block_size = get_blocksize(block); + ++ /* ++ * Version number and new block size are considered ++ * part of the header for MIPI sequenece block v3+. ++ */ ++ if (section_id == BDB_MIPI_SEQUENCE && *(const u8 *)block >= 3) ++ block_size += 5; ++ + entry = kzalloc(struct_size(entry, data, max(min_size, block_size) + 3), + GFP_KERNEL); + if (!entry) { diff --git a/queue-5.19/drm-i915-implement-waedplinkratedatareload.patch b/queue-5.19/drm-i915-implement-waedplinkratedatareload.patch new file mode 100644 index 00000000000..e22a58b7336 --- /dev/null +++ b/queue-5.19/drm-i915-implement-waedplinkratedatareload.patch @@ -0,0 +1,90 @@ +From 672d6ca758651f0ec12cd0d59787067a5bde1c96 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Fri, 2 Sep 2022 10:03:18 +0300 +Subject: drm/i915: Implement WaEdpLinkRateDataReload +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 672d6ca758651f0ec12cd0d59787067a5bde1c96 upstream. + +A lot of modern laptops use the Parade PS8461E MUX for eDP +switching. The MUX can operate in jitter cleaning mode or +redriver mode, the first one resulting in higher link +quality. The jitter cleaning mode needs to know the link +rate used and the MUX achieves this by snooping the +LINK_BW_SET, LINK_RATE_SELECT and SUPPORTED_LINK_RATES +DPCD accesses. + +When the MUX is powered down (seems this can happen whenever +the display is turned off) it loses track of the snooped +link rates so when we do the LINK_RATE_SELECT write it no +longer knowns which link rate we're selecting, and thus it +falls back to the lower quality redriver mode. This results +in unstable high link rates (eg. usually 8.1Gbps link rate +no longer works correctly). + +In order to avoid all that let's re-snoop SUPPORTED_LINK_RATES +from the sink at the start of every link training. + +Unfortunately we don't have a way to detect the presence of +the MUX. It looks like the set of laptops equipped with this +MUX is fairly large and contains devices from multiple +manufacturers. It may also still be growing with new models. +So a quirk doesn't seem like a very easily maintainable +option, thus we shall attempt to do this unconditionally on +all machines that use LINK_RATE_SELECT. Hopefully this extra +DPCD read doesn't cause issues for any unaffected machine. +If that turns out to be the case we'll need to convert this +into a quirk in the future. + +Cc: stable@vger.kernel.org +Cc: Jason A. Donenfeld +Cc: Ankit Nautiyal +Cc: Jani Nikula +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6205 +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20220902070319.15395-1-ville.syrjala@linux.intel.com +Tested-by: Aaron Ma +Tested-by: Jason A. Donenfeld +Reviewed-by: Jani Nikula +(cherry picked from commit 25899c590cb5ba9b9f284c6ca8e7e9086793d641) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dp_link_training.c | 22 ++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_dp_link_training.c ++++ b/drivers/gpu/drm/i915/display/intel_dp_link_training.c +@@ -671,6 +671,28 @@ intel_dp_prepare_link_train(struct intel + intel_dp_compute_rate(intel_dp, crtc_state->port_clock, + &link_bw, &rate_select); + ++ /* ++ * WaEdpLinkRateDataReload ++ * ++ * Parade PS8461E MUX (used on varius TGL+ laptops) needs ++ * to snoop the link rates reported by the sink when we ++ * use LINK_RATE_SET in order to operate in jitter cleaning ++ * mode (as opposed to redriver mode). Unfortunately it ++ * loses track of the snooped link rates when powered down, ++ * so we need to make it re-snoop often. Without this high ++ * link rates are not stable. ++ */ ++ if (!link_bw) { ++ struct intel_connector *connector = intel_dp->attached_connector; ++ __le16 sink_rates[DP_MAX_SUPPORTED_RATES]; ++ ++ drm_dbg_kms(&i915->drm, "[CONNECTOR:%d:%s] Reloading eDP link rates\n", ++ connector->base.base.id, connector->base.name); ++ ++ drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES, ++ sink_rates, sizeof(sink_rates)); ++ } ++ + if (link_bw) + drm_dbg_kms(&i915->drm, + "[ENCODER:%d:%s] Using LINK_BW_SET value %02x\n", diff --git a/queue-5.19/drm-i915-slpc-let-s-fix-the-pcode-min-freq-table-setup-for-slpc.patch b/queue-5.19/drm-i915-slpc-let-s-fix-the-pcode-min-freq-table-setup-for-slpc.patch new file mode 100644 index 00000000000..3e3d05efaf1 --- /dev/null +++ b/queue-5.19/drm-i915-slpc-let-s-fix-the-pcode-min-freq-table-setup-for-slpc.patch @@ -0,0 +1,170 @@ +From e1cab970574c001d83e59ca8388c474a57a1afb6 Mon Sep 17 00:00:00 2001 +From: Rodrigo Vivi +Date: Wed, 31 Aug 2022 17:45:38 -0400 +Subject: drm/i915/slpc: Let's fix the PCODE min freq table setup for SLPC + +From: Rodrigo Vivi + +commit e1cab970574c001d83e59ca8388c474a57a1afb6 upstream. + +We need to inform PCODE of a desired ring frequencies so PCODE update +the memory frequencies to us. rps->min_freq and rps->max_freq are the +frequencies used in that request. However they were unset when SLPC was +enabled and PCODE never updated the memory freq. + +v2 (as Suggested by Ashutosh): if SLPC is in use, let's pick the right + frequencies from the get_ia_constants instead of the fake init of + rps' min and max. + +v3: don't forget the max <= min return + +v4: Move all the freq conversion to intel_rps.c. And the max <= min + check to where it belongs. + +v5: (Ashutosh) Fix old comment s/50 HZ/50 MHz and add a doc explaining + the "raw format" + +Fixes: 7ba79a671568 ("drm/i915/guc/slpc: Gate Host RPS when SLPC is enabled") +Cc: # v5.15+ +Cc: Ashutosh Dixit +Tested-by: Sushma Venkatesh Reddy +Signed-off-by: Rodrigo Vivi +Reviewed-by: Ashutosh Dixit +Link: https://patchwork.freedesktop.org/patch/msgid/20220831214538.143950-1-rodrigo.vivi@intel.com +(cherry picked from commit 018a7bdbb090b9155a6509a0d1a684db4afaa5b1) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/intel_llc.c | 19 ++++++------- + drivers/gpu/drm/i915/gt/intel_rps.c | 50 ++++++++++++++++++++++++++++++++++++ + drivers/gpu/drm/i915/gt/intel_rps.h | 2 + + 3 files changed, 61 insertions(+), 10 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/intel_llc.c ++++ b/drivers/gpu/drm/i915/gt/intel_llc.c +@@ -12,6 +12,7 @@ + #include "intel_llc.h" + #include "intel_mchbar_regs.h" + #include "intel_pcode.h" ++#include "intel_rps.h" + + struct ia_constants { + unsigned int min_gpu_freq; +@@ -55,9 +56,6 @@ static bool get_ia_constants(struct inte + if (!HAS_LLC(i915) || IS_DGFX(i915)) + return false; + +- if (rps->max_freq <= rps->min_freq) +- return false; +- + consts->max_ia_freq = cpu_max_MHz(); + + consts->min_ring_freq = +@@ -65,13 +63,8 @@ static bool get_ia_constants(struct inte + /* convert DDR frequency from units of 266.6MHz to bandwidth */ + consts->min_ring_freq = mult_frac(consts->min_ring_freq, 8, 3); + +- consts->min_gpu_freq = rps->min_freq; +- consts->max_gpu_freq = rps->max_freq; +- if (GRAPHICS_VER(i915) >= 9) { +- /* Convert GT frequency to 50 HZ units */ +- consts->min_gpu_freq /= GEN9_FREQ_SCALER; +- consts->max_gpu_freq /= GEN9_FREQ_SCALER; +- } ++ consts->min_gpu_freq = intel_rps_get_min_raw_freq(rps); ++ consts->max_gpu_freq = intel_rps_get_max_raw_freq(rps); + + return true; + } +@@ -132,6 +125,12 @@ static void gen6_update_ring_freq(struct + return; + + /* ++ * Although this is unlikely on any platform during initialization, ++ * let's ensure we don't get accidentally into infinite loop ++ */ ++ if (consts.max_gpu_freq <= consts.min_gpu_freq) ++ return; ++ /* + * For each potential GPU frequency, load a ring frequency we'd like + * to use for memory access. We do this by specifying the IA frequency + * the PCU should use as a reference to determine the ring frequency. +--- a/drivers/gpu/drm/i915/gt/intel_rps.c ++++ b/drivers/gpu/drm/i915/gt/intel_rps.c +@@ -2123,6 +2123,31 @@ u32 intel_rps_get_max_frequency(struct i + return intel_gpu_freq(rps, rps->max_freq_softlimit); + } + ++/** ++ * intel_rps_get_max_raw_freq - returns the max frequency in some raw format. ++ * @rps: the intel_rps structure ++ * ++ * Returns the max frequency in a raw format. In newer platforms raw is in ++ * units of 50 MHz. ++ */ ++u32 intel_rps_get_max_raw_freq(struct intel_rps *rps) ++{ ++ struct intel_guc_slpc *slpc = rps_to_slpc(rps); ++ u32 freq; ++ ++ if (rps_uses_slpc(rps)) { ++ return DIV_ROUND_CLOSEST(slpc->rp0_freq, ++ GT_FREQUENCY_MULTIPLIER); ++ } else { ++ freq = rps->max_freq; ++ if (GRAPHICS_VER(rps_to_i915(rps)) >= 9) { ++ /* Convert GT frequency to 50 MHz units */ ++ freq /= GEN9_FREQ_SCALER; ++ } ++ return freq; ++ } ++} ++ + u32 intel_rps_get_rp0_frequency(struct intel_rps *rps) + { + struct intel_guc_slpc *slpc = rps_to_slpc(rps); +@@ -2211,6 +2236,31 @@ u32 intel_rps_get_min_frequency(struct i + return intel_gpu_freq(rps, rps->min_freq_softlimit); + } + ++/** ++ * intel_rps_get_min_raw_freq - returns the min frequency in some raw format. ++ * @rps: the intel_rps structure ++ * ++ * Returns the min frequency in a raw format. In newer platforms raw is in ++ * units of 50 MHz. ++ */ ++u32 intel_rps_get_min_raw_freq(struct intel_rps *rps) ++{ ++ struct intel_guc_slpc *slpc = rps_to_slpc(rps); ++ u32 freq; ++ ++ if (rps_uses_slpc(rps)) { ++ return DIV_ROUND_CLOSEST(slpc->min_freq, ++ GT_FREQUENCY_MULTIPLIER); ++ } else { ++ freq = rps->min_freq; ++ if (GRAPHICS_VER(rps_to_i915(rps)) >= 9) { ++ /* Convert GT frequency to 50 MHz units */ ++ freq /= GEN9_FREQ_SCALER; ++ } ++ return freq; ++ } ++} ++ + static int set_min_freq(struct intel_rps *rps, u32 val) + { + int ret = 0; +--- a/drivers/gpu/drm/i915/gt/intel_rps.h ++++ b/drivers/gpu/drm/i915/gt/intel_rps.h +@@ -37,8 +37,10 @@ u32 intel_rps_get_cagf(struct intel_rps + u32 intel_rps_read_actual_frequency(struct intel_rps *rps); + u32 intel_rps_get_requested_frequency(struct intel_rps *rps); + u32 intel_rps_get_min_frequency(struct intel_rps *rps); ++u32 intel_rps_get_min_raw_freq(struct intel_rps *rps); + int intel_rps_set_min_frequency(struct intel_rps *rps, u32 val); + u32 intel_rps_get_max_frequency(struct intel_rps *rps); ++u32 intel_rps_get_max_raw_freq(struct intel_rps *rps); + int intel_rps_set_max_frequency(struct intel_rps *rps, u32 val); + u32 intel_rps_get_rp0_frequency(struct intel_rps *rps); + u32 intel_rps_get_rp1_frequency(struct intel_rps *rps); diff --git a/queue-5.19/nvmet-fix-a-use-after-free.patch b/queue-5.19/nvmet-fix-a-use-after-free.patch new file mode 100644 index 00000000000..03481612c1a --- /dev/null +++ b/queue-5.19/nvmet-fix-a-use-after-free.patch @@ -0,0 +1,63 @@ +From 6a02a61e81c231cc5c680c5dbf8665275147ac52 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Fri, 12 Aug 2022 14:03:17 -0700 +Subject: nvmet: fix a use-after-free + +From: Bart Van Assche + +commit 6a02a61e81c231cc5c680c5dbf8665275147ac52 upstream. + +Fix the following use-after-free complaint triggered by blktests nvme/004: + +BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 +Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 +Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] +Call Trace: + show_stack+0x52/0x58 + dump_stack_lvl+0x49/0x5e + print_report.cold+0x36/0x1e2 + kasan_report+0xb9/0xf0 + __asan_load4+0x6b/0x80 + blk_mq_complete_request_remote+0xac/0x350 + nvme_loop_queue_response+0x1df/0x275 [nvme_loop] + __nvmet_req_complete+0x132/0x4f0 [nvmet] + nvmet_req_complete+0x15/0x40 [nvmet] + nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] + nvme_loop_execute_work+0x20/0x30 [nvme_loop] + process_one_work+0x56e/0xa70 + worker_thread+0x2d1/0x640 + kthread+0x183/0x1c0 + ret_from_fork+0x1f/0x30 + +Cc: stable@vger.kernel.org +Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") +Signed-off-by: Bart Van Assche +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/target/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -735,6 +735,8 @@ static void nvmet_set_error(struct nvmet + + static void __nvmet_req_complete(struct nvmet_req *req, u16 status) + { ++ struct nvmet_ns *ns = req->ns; ++ + if (!req->sq->sqhd_disabled) + nvmet_update_sq_head(req); + req->cqe->sq_id = cpu_to_le16(req->sq->qid); +@@ -745,9 +747,9 @@ static void __nvmet_req_complete(struct + + trace_nvmet_req_complete(req); + +- if (req->ns) +- nvmet_put_namespace(req->ns); + req->ops->queue_response(req); ++ if (ns) ++ nvmet_put_namespace(ns); + } + + void nvmet_req_complete(struct nvmet_req *req, u16 status) diff --git a/queue-5.19/scsi-lpfc-add-missing-destroy_workqueue-in-error-path.patch b/queue-5.19/scsi-lpfc-add-missing-destroy_workqueue-in-error-path.patch new file mode 100644 index 00000000000..fd0edcebfc8 --- /dev/null +++ b/queue-5.19/scsi-lpfc-add-missing-destroy_workqueue-in-error-path.patch @@ -0,0 +1,43 @@ +From da6d507f5ff328f346b3c50e19e19993027b8ffd Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 23 Aug 2022 12:42:37 +0800 +Subject: scsi: lpfc: Add missing destroy_workqueue() in error path + +From: Yang Yingliang + +commit da6d507f5ff328f346b3c50e19e19993027b8ffd upstream. + +Add the missing destroy_workqueue() before return from +lpfc_sli4_driver_resource_setup() in the error path. + +Link: https://lore.kernel.org/r/20220823044237.285643-1-yangyingliang@huawei.com +Fixes: 3cee98db2610 ("scsi: lpfc: Fix crash on driver unload in wq free") +Reviewed-by: James Smart +Signed-off-by: Yang Yingliang +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/lpfc/lpfc_init.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -8061,7 +8061,7 @@ lpfc_sli4_driver_resource_setup(struct l + /* Allocate device driver memory */ + rc = lpfc_mem_alloc(phba, SGL_ALIGN_SZ); + if (rc) +- return -ENOMEM; ++ goto out_destroy_workqueue; + + /* IF Type 2 ports get initialized now. */ + if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >= +@@ -8489,6 +8489,9 @@ out_free_bsmbx: + lpfc_destroy_bootstrap_mbox(phba); + out_free_mem: + lpfc_mem_free(phba); ++out_destroy_workqueue: ++ destroy_workqueue(phba->wq); ++ phba->wq = NULL; + return rc; + } + diff --git a/queue-5.19/scsi-mpt3sas-fix-use-after-free-warning.patch b/queue-5.19/scsi-mpt3sas-fix-use-after-free-warning.patch new file mode 100644 index 00000000000..db6ebf40e9c --- /dev/null +++ b/queue-5.19/scsi-mpt3sas-fix-use-after-free-warning.patch @@ -0,0 +1,41 @@ +From 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 Mon Sep 17 00:00:00 2001 +From: Sreekanth Reddy +Date: Tue, 6 Sep 2022 19:19:08 +0530 +Subject: scsi: mpt3sas: Fix use-after-free warning + +From: Sreekanth Reddy + +commit 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 upstream. + +Fix the following use-after-free warning which is observed during +controller reset: + +refcount_t: underflow; use-after-free. +WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0 + +Link: https://lore.kernel.org/r/20220906134908.1039-2-sreekanth.reddy@broadcom.com +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -3670,6 +3670,7 @@ static struct fw_event_work *dequeue_nex + fw_event = list_first_entry(&ioc->fw_event_list, + struct fw_event_work, list); + list_del_init(&fw_event->list); ++ fw_event_work_put(fw_event); + } + spin_unlock_irqrestore(&ioc->fw_event_lock, flags); + +@@ -3751,7 +3752,6 @@ _scsih_fw_event_cleanup_queue(struct MPT + if (cancel_work_sync(&fw_event->work)) + fw_event_work_put(fw_event); + +- fw_event_work_put(fw_event); + } + ioc->fw_events_cleanup = 0; + } diff --git a/queue-5.19/series b/queue-5.19/series index 5d09592fadf..a4bba0bf95b 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -51,3 +51,9 @@ debugfs-add-debugfs_lookup_and_remove.patch sched-debug-fix-dentry-leak-in-update_sched_domain_debugfs.patch drm-amd-display-fix-memory-leak-when-using-debugfs_lookup.patch driver-core-fix-driver_set_override-issue-with-empty-strings.patch +nvmet-fix-a-use-after-free.patch +drm-i915-bios-copy-the-whole-mipi-sequence-block.patch +drm-i915-slpc-let-s-fix-the-pcode-min-freq-table-setup-for-slpc.patch +drm-i915-implement-waedplinkratedatareload.patch +scsi-mpt3sas-fix-use-after-free-warning.patch +scsi-lpfc-add-missing-destroy_workqueue-in-error-path.patch