--- /dev/null
+From 6bdeff12a96c9a5da95c8d11fefd145eb165e32a Mon Sep 17 00:00:00 2001
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Date: Tue, 15 Dec 2020 10:33:34 -0500
+Subject: drm/amd/display: Add get_dig_frontend implementation for DCEx
+
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+
+commit 6bdeff12a96c9a5da95c8d11fefd145eb165e32a upstream.
+
+Some old ASICs might not implement/require get_dig_frontend helper; in
+this scenario, we can have a NULL pointer exception when we try to call
+it inside vbios disable operation. For example, this situation might
+happen when using Polaris12 with an eDP panel. This commit avoids this
+situation by adding a specific get_dig_frontend implementation for DCEx.
+
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Harry Wentland <Harry.Wentland@amd.com>
+Cc: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Cc: Chiawen Huang <chiawen.huang@amd.com>
+Reported-and-tested-by: Borislav Petkov <bp@suse.de>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 44 +++++++++++++++++-
+ drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h | 2
+ 2 files changed, 44 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
+@@ -119,7 +119,8 @@ static const struct link_encoder_funcs d
+ .disable_hpd = dce110_link_encoder_disable_hpd,
+ .is_dig_enabled = dce110_is_dig_enabled,
+ .destroy = dce110_link_encoder_destroy,
+- .get_max_link_cap = dce110_link_encoder_get_max_link_cap
++ .get_max_link_cap = dce110_link_encoder_get_max_link_cap,
++ .get_dig_frontend = dce110_get_dig_frontend,
+ };
+
+ static enum bp_result link_transmitter_control(
+@@ -235,6 +236,44 @@ static void set_link_training_complete(
+
+ }
+
++unsigned int dce110_get_dig_frontend(struct link_encoder *enc)
++{
++ struct dce110_link_encoder *enc110 = TO_DCE110_LINK_ENC(enc);
++ u32 value;
++ enum engine_id result;
++
++ REG_GET(DIG_BE_CNTL, DIG_FE_SOURCE_SELECT, &value);
++
++ switch (value) {
++ case DCE110_DIG_FE_SOURCE_SELECT_DIGA:
++ result = ENGINE_ID_DIGA;
++ break;
++ case DCE110_DIG_FE_SOURCE_SELECT_DIGB:
++ result = ENGINE_ID_DIGB;
++ break;
++ case DCE110_DIG_FE_SOURCE_SELECT_DIGC:
++ result = ENGINE_ID_DIGC;
++ break;
++ case DCE110_DIG_FE_SOURCE_SELECT_DIGD:
++ result = ENGINE_ID_DIGD;
++ break;
++ case DCE110_DIG_FE_SOURCE_SELECT_DIGE:
++ result = ENGINE_ID_DIGE;
++ break;
++ case DCE110_DIG_FE_SOURCE_SELECT_DIGF:
++ result = ENGINE_ID_DIGF;
++ break;
++ case DCE110_DIG_FE_SOURCE_SELECT_DIGG:
++ result = ENGINE_ID_DIGG;
++ break;
++ default:
++ // invalid source select DIG
++ result = ENGINE_ID_UNKNOWN;
++ }
++
++ return result;
++}
++
+ void dce110_link_encoder_set_dp_phy_pattern_training_pattern(
+ struct link_encoder *enc,
+ uint32_t index)
+@@ -1665,7 +1704,8 @@ static const struct link_encoder_funcs d
+ .disable_hpd = dce110_link_encoder_disable_hpd,
+ .is_dig_enabled = dce110_is_dig_enabled,
+ .destroy = dce110_link_encoder_destroy,
+- .get_max_link_cap = dce110_link_encoder_get_max_link_cap
++ .get_max_link_cap = dce110_link_encoder_get_max_link_cap,
++ .get_dig_frontend = dce110_get_dig_frontend
+ };
+
+ void dce60_link_encoder_construct(
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
+@@ -295,6 +295,8 @@ void dce110_link_encoder_connect_dig_be_
+ enum engine_id engine,
+ bool connect);
+
++unsigned int dce110_get_dig_frontend(struct link_encoder *enc);
++
+ void dce110_link_encoder_set_dp_phy_pattern_training_pattern(
+ struct link_encoder *enc,
+ uint32_t index);
--- /dev/null
+From dfea9fce29fda6f2f91161677e0e0d9b671bc099 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Fri, 18 Dec 2020 13:12:21 +0000
+Subject: io_uring: close a small race gap for files cancel
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit dfea9fce29fda6f2f91161677e0e0d9b671bc099 upstream.
+
+The purpose of io_uring_cancel_files() is to wait for all requests
+matching ->files to go/be cancelled. We should first drop files of a
+request in io_req_drop_files() and only then make it undiscoverable for
+io_uring_cancel_files.
+
+First drop, then delete from list. It's ok to leave req->id->files
+dangling, because it's not dereferenced by cancellation code, only
+compared against. It would potentially go to sleep and be awaken by
+following in io_req_drop_files() wake_up().
+
+Fixes: 0f2122045b946 ("io_uring: don't rely on weak ->files references")
+Cc: <stable@vger.kernel.org> # 5.5+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -5861,15 +5861,15 @@ static void io_req_drop_files(struct io_
+ struct io_ring_ctx *ctx = req->ctx;
+ unsigned long flags;
+
++ put_files_struct(req->work.identity->files);
++ put_nsproxy(req->work.identity->nsproxy);
+ spin_lock_irqsave(&ctx->inflight_lock, flags);
+ list_del(&req->inflight_entry);
+- if (waitqueue_active(&ctx->inflight_wait))
+- wake_up(&ctx->inflight_wait);
+ spin_unlock_irqrestore(&ctx->inflight_lock, flags);
+ req->flags &= ~REQ_F_INFLIGHT;
+- put_files_struct(req->work.identity->files);
+- put_nsproxy(req->work.identity->nsproxy);
+ req->work.flags &= ~IO_WQ_WORK_FILES;
++ if (waitqueue_active(&ctx->inflight_wait))
++ wake_up(&ctx->inflight_wait);
+ }
+
+ static void __io_clean_op(struct io_kiocb *req)
--- /dev/null
+From 93decc563637c4288380912eac0eb42fb246cc04 Mon Sep 17 00:00:00 2001
+From: Kevin Vigor <kvigor@gmail.com>
+Date: Fri, 6 Nov 2020 14:20:34 -0800
+Subject: md/raid10: initialize r10_bio->read_slot before use.
+
+From: Kevin Vigor <kvigor@gmail.com>
+
+commit 93decc563637c4288380912eac0eb42fb246cc04 upstream.
+
+In __make_request() a new r10bio is allocated and passed to
+raid10_read_request(). The read_slot member of the bio is not
+initialized, and the raid10_read_request() uses it to index an
+array. This leads to occasional panics.
+
+Fix by initializing the field to invalid value and checking for
+valid value in raid10_read_request().
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Kevin Vigor <kvigor@gmail.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/md/raid10.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1128,7 +1128,7 @@ static void raid10_read_request(struct m
+ struct md_rdev *err_rdev = NULL;
+ gfp_t gfp = GFP_NOIO;
+
+- if (r10_bio->devs[slot].rdev) {
++ if (slot >= 0 && r10_bio->devs[slot].rdev) {
+ /*
+ * This is an error retry, but we cannot
+ * safely dereference the rdev in the r10_bio,
+@@ -1493,6 +1493,7 @@ static void __make_request(struct mddev
+ r10_bio->mddev = mddev;
+ r10_bio->sector = bio->bi_iter.bi_sector;
+ r10_bio->state = 0;
++ r10_bio->read_slot = -1;
+ memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * conf->copies);
+
+ if (bio_data_dir(bio) == READ)
projects / thirdparty / kernel / stable-queue.git / commitdiff
