--- /dev/null
+From 36e4523aaf4a35de963e190064b53839fa131653 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Thu, 28 Feb 2019 15:49:09 +0100
+Subject: drm/atomic: Wire file_priv through for property changes
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 36e4523aaf4a35de963e190064b53839fa131653 upstream.
+
+We need this to make sure lessees can only connect their
+plane/connectors to crtc objects they own. And note that this is
+irrespective of whether the lessor is atomic or not, lessor cannot
+prevent lessees from enabling atomic.
+
+Cc: stable@vger.kernel.org
+Cc: Keith Packard <keithp@keithp.com>
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190228144910.26488-7-daniel.vetter@ffwll.ch
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_atomic_uapi.c | 32 +++++++++++++++++++-------------
+ drivers/gpu/drm/drm_crtc_internal.h | 1 +
+ drivers/gpu/drm/drm_mode_object.c | 5 +++--
+ 3 files changed, 23 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -512,8 +512,8 @@ drm_atomic_crtc_get_property(struct drm_
+ }
+
+ static int drm_atomic_plane_set_property(struct drm_plane *plane,
+- struct drm_plane_state *state, struct drm_property *property,
+- uint64_t val)
++ struct drm_plane_state *state, struct drm_file *file_priv,
++ struct drm_property *property, uint64_t val)
+ {
+ struct drm_device *dev = plane->dev;
+ struct drm_mode_config *config = &dev->mode_config;
+@@ -521,7 +521,8 @@ static int drm_atomic_plane_set_property
+ int ret;
+
+ if (property == config->prop_fb_id) {
+- struct drm_framebuffer *fb = drm_framebuffer_lookup(dev, NULL, val);
++ struct drm_framebuffer *fb;
++ fb = drm_framebuffer_lookup(dev, file_priv, val);
+ drm_atomic_set_fb_for_plane(state, fb);
+ if (fb)
+ drm_framebuffer_put(fb);
+@@ -537,7 +538,7 @@ static int drm_atomic_plane_set_property
+ return -EINVAL;
+
+ } else if (property == config->prop_crtc_id) {
+- struct drm_crtc *crtc = drm_crtc_find(dev, NULL, val);
++ struct drm_crtc *crtc = drm_crtc_find(dev, file_priv, val);
+ return drm_atomic_set_crtc_for_plane(state, crtc);
+ } else if (property == config->prop_crtc_x) {
+ state->crtc_x = U642I64(val);
+@@ -681,14 +682,14 @@ static int drm_atomic_set_writeback_fb_f
+ }
+
+ static int drm_atomic_connector_set_property(struct drm_connector *connector,
+- struct drm_connector_state *state, struct drm_property *property,
+- uint64_t val)
++ struct drm_connector_state *state, struct drm_file *file_priv,
++ struct drm_property *property, uint64_t val)
+ {
+ struct drm_device *dev = connector->dev;
+ struct drm_mode_config *config = &dev->mode_config;
+
+ if (property == config->prop_crtc_id) {
+- struct drm_crtc *crtc = drm_crtc_find(dev, NULL, val);
++ struct drm_crtc *crtc = drm_crtc_find(dev, file_priv, val);
+ return drm_atomic_set_crtc_for_connector(state, crtc);
+ } else if (property == config->dpms_property) {
+ /* setting DPMS property requires special handling, which
+@@ -747,8 +748,10 @@ static int drm_atomic_connector_set_prop
+ }
+ state->content_protection = val;
+ } else if (property == config->writeback_fb_id_property) {
+- struct drm_framebuffer *fb = drm_framebuffer_lookup(dev, NULL, val);
+- int ret = drm_atomic_set_writeback_fb_for_connector(state, fb);
++ struct drm_framebuffer *fb;
++ int ret;
++ fb = drm_framebuffer_lookup(dev, file_priv, val);
++ ret = drm_atomic_set_writeback_fb_for_connector(state, fb);
+ if (fb)
+ drm_framebuffer_put(fb);
+ return ret;
+@@ -943,6 +946,7 @@ out:
+ }
+
+ int drm_atomic_set_property(struct drm_atomic_state *state,
++ struct drm_file *file_priv,
+ struct drm_mode_object *obj,
+ struct drm_property *prop,
+ uint64_t prop_value)
+@@ -965,7 +969,8 @@ int drm_atomic_set_property(struct drm_a
+ }
+
+ ret = drm_atomic_connector_set_property(connector,
+- connector_state, prop, prop_value);
++ connector_state, file_priv,
++ prop, prop_value);
+ break;
+ }
+ case DRM_MODE_OBJECT_CRTC: {
+@@ -993,7 +998,8 @@ int drm_atomic_set_property(struct drm_a
+ }
+
+ ret = drm_atomic_plane_set_property(plane,
+- plane_state, prop, prop_value);
++ plane_state, file_priv,
++ prop, prop_value);
+ break;
+ }
+ default:
+@@ -1365,8 +1371,8 @@ retry:
+ goto out;
+ }
+
+- ret = drm_atomic_set_property(state, obj, prop,
+- prop_value);
++ ret = drm_atomic_set_property(state, file_priv,
++ obj, prop, prop_value);
+ if (ret) {
+ drm_mode_object_put(obj);
+ goto out;
+--- a/drivers/gpu/drm/drm_crtc_internal.h
++++ b/drivers/gpu/drm/drm_crtc_internal.h
+@@ -214,6 +214,7 @@ int drm_atomic_connector_commit_dpms(str
+ struct drm_connector *connector,
+ int mode);
+ int drm_atomic_set_property(struct drm_atomic_state *state,
++ struct drm_file *file_priv,
+ struct drm_mode_object *obj,
+ struct drm_property *prop,
+ uint64_t prop_value);
+--- a/drivers/gpu/drm/drm_mode_object.c
++++ b/drivers/gpu/drm/drm_mode_object.c
+@@ -451,6 +451,7 @@ static int set_property_legacy(struct dr
+ }
+
+ static int set_property_atomic(struct drm_mode_object *obj,
++ struct drm_file *file_priv,
+ struct drm_property *prop,
+ uint64_t prop_value)
+ {
+@@ -477,7 +478,7 @@ retry:
+ obj_to_connector(obj),
+ prop_value);
+ } else {
+- ret = drm_atomic_set_property(state, obj, prop, prop_value);
++ ret = drm_atomic_set_property(state, file_priv, obj, prop, prop_value);
+ if (ret)
+ goto out;
+ ret = drm_atomic_commit(state);
+@@ -520,7 +521,7 @@ int drm_mode_obj_set_property_ioctl(stru
+ goto out_unref;
+
+ if (drm_drv_uses_atomic_modeset(property->dev))
+- ret = set_property_atomic(arg_obj, property, arg->value);
++ ret = set_property_atomic(arg_obj, file_priv, property, arg->value);
+ else
+ ret = set_property_legacy(arg_obj, property, arg->value);
+
--- /dev/null
+From 23e35c0eb81a23d40c079a7eb187fc321fa1deb7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 26 Apr 2019 14:47:53 +0200
+Subject: drm/cma-helper: Fix drm_gem_cma_free_object()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Noralf Trønnes <noralf@tronnes.org>
+
+commit 23e35c0eb81a23d40c079a7eb187fc321fa1deb7 upstream.
+
+The logic for freeing an imported buffer with a virtual address is
+broken. It will free the buffer instead of unmapping the dma buf.
+Fix by reversing the if ladder and first check if the buffer is imported.
+
+Fixes: b9068cde51ee ("drm/cma-helper: Add DRM_GEM_CMA_VMAP_DRIVER_OPS")
+Cc: stable@vger.kernel.org
+Reported-by: "Li, Tingqian" <tingqian.li@intel.com>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Reviewed-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190426124753.53722-1-noralf@tronnes.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_gem_cma_helper.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_gem_cma_helper.c
++++ b/drivers/gpu/drm/drm_gem_cma_helper.c
+@@ -186,13 +186,13 @@ void drm_gem_cma_free_object(struct drm_
+
+ cma_obj = to_drm_gem_cma_obj(gem_obj);
+
+- if (cma_obj->vaddr) {
+- dma_free_wc(gem_obj->dev->dev, cma_obj->base.size,
+- cma_obj->vaddr, cma_obj->paddr);
+- } else if (gem_obj->import_attach) {
++ if (gem_obj->import_attach) {
+ if (cma_obj->vaddr)
+ dma_buf_vunmap(gem_obj->import_attach->dmabuf, cma_obj->vaddr);
+ drm_prime_gem_destroy(gem_obj, cma_obj->sgt);
++ } else if (cma_obj->vaddr) {
++ dma_free_wc(gem_obj->dev->dev, cma_obj->base.size,
++ cma_obj->vaddr, cma_obj->paddr);
+ }
+
+ drm_gem_object_release(gem_obj);
--- /dev/null
+From c8f005684c98f4d9942baec13ad98054dbf312a0 Mon Sep 17 00:00:00 2001
+From: Deepak Rawat <drawat@vmware.com>
+Date: Mon, 15 Apr 2019 10:28:05 -0700
+Subject: drm: Expose "FB_DAMAGE_CLIPS" property to atomic aware user-space only
+
+From: Deepak Rawat <drawat@vmware.com>
+
+commit c8f005684c98f4d9942baec13ad98054dbf312a0 upstream.
+
+Plane property "FB_DAMAGE_CLIPS" can only be used by atomic aware
+user-space, so no point exposing it otherwise.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Deepak Rawat <drawat@vmware.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Fixes: d3b21767821e ("drm: Add a new plane property to send damage during plane update")
+Link: https://patchwork.freedesktop.org/patch/msgid/20190415172814.9840-1-drawat@vmware.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_mode_config.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_mode_config.c
++++ b/drivers/gpu/drm/drm_mode_config.c
+@@ -297,8 +297,9 @@ static int drm_mode_create_standard_prop
+ return -ENOMEM;
+ dev->mode_config.prop_crtc_id = prop;
+
+- prop = drm_property_create(dev, DRM_MODE_PROP_BLOB, "FB_DAMAGE_CLIPS",
+- 0);
++ prop = drm_property_create(dev,
++ DRM_MODE_PROP_ATOMIC | DRM_MODE_PROP_BLOB,
++ "FB_DAMAGE_CLIPS", 0);
+ if (!prop)
+ return -ENOMEM;
+ dev->mode_config.prop_fb_damage_clips = prop;
--- /dev/null
+From 6e3f17ee73f7e3c2ef0e2c8fd8624b2ece8ef2c9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Mon, 1 Apr 2019 16:13:58 +0200
+Subject: drm/fb-helper: generic: Call drm_client_add() after setup is done
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Noralf Trønnes <noralf@tronnes.org>
+
+commit 6e3f17ee73f7e3c2ef0e2c8fd8624b2ece8ef2c9 upstream.
+
+Hotplug can happen while drm_fbdev_generic_setup() is running so move
+drm_client_add() call after setup is done to avoid
+drm_fbdev_client_hotplug() running in two threads at the same time.
+
+Fixes: 9060d7f49376 ("drm/fb-helper: Finish the generic fbdev emulation")
+Cc: stable@vger.kernel.org
+Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190401141358.25309-1-noralf@tronnes.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -3317,8 +3317,6 @@ int drm_fbdev_generic_setup(struct drm_d
+ return ret;
+ }
+
+- drm_client_add(&fb_helper->client);
+-
+ if (!preferred_bpp)
+ preferred_bpp = dev->mode_config.preferred_depth;
+ if (!preferred_bpp)
+@@ -3329,6 +3327,8 @@ int drm_fbdev_generic_setup(struct drm_d
+ if (ret)
+ DRM_DEV_DEBUG(dev->dev, "client hotplug ret=%d\n", ret);
+
++ drm_client_add(&fb_helper->client);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(drm_fbdev_generic_setup);
--- /dev/null
+From 137caa702f2308f7ef03876e164b0d0f3300712a Mon Sep 17 00:00:00 2001
+From: Philipp Zabel <p.zabel@pengutronix.de>
+Date: Thu, 9 May 2019 11:01:39 +0200
+Subject: drm/imx: ipuv3-plane: fix atomic update status query for non-plus i.MX6Q
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+commit 137caa702f2308f7ef03876e164b0d0f3300712a upstream.
+
+The current buffer check halves the frame rate on non-plus i.MX6Q,
+as the IDMAC current buffer pointer is not yet updated when
+ipu_plane_atomic_update_pending is called from the EOF irq handler.
+
+Fixes: 70e8a0c71e9 ("drm/imx: ipuv3-plane: add function to query atomic update status")
+Tested-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/imx/ipuv3-plane.c | 13 ++++++++-----
+ drivers/gpu/drm/imx/ipuv3-plane.h | 1 -
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/imx/ipuv3-plane.c
++++ b/drivers/gpu/drm/imx/ipuv3-plane.c
+@@ -605,7 +605,6 @@ static void ipu_plane_atomic_update(stru
+ active = ipu_idmac_get_current_buffer(ipu_plane->ipu_ch);
+ ipu_cpmem_set_buffer(ipu_plane->ipu_ch, !active, eba);
+ ipu_idmac_select_buffer(ipu_plane->ipu_ch, !active);
+- ipu_plane->next_buf = !active;
+ if (ipu_plane_separate_alpha(ipu_plane)) {
+ active = ipu_idmac_get_current_buffer(ipu_plane->alpha_ch);
+ ipu_cpmem_set_buffer(ipu_plane->alpha_ch, !active,
+@@ -710,7 +709,6 @@ static void ipu_plane_atomic_update(stru
+ ipu_cpmem_set_buffer(ipu_plane->ipu_ch, 1, eba);
+ ipu_idmac_lock_enable(ipu_plane->ipu_ch, num_bursts);
+ ipu_plane_enable(ipu_plane);
+- ipu_plane->next_buf = -1;
+ }
+
+ static const struct drm_plane_helper_funcs ipu_plane_helper_funcs = {
+@@ -732,10 +730,15 @@ bool ipu_plane_atomic_update_pending(str
+
+ if (ipu_state->use_pre)
+ return ipu_prg_channel_configure_pending(ipu_plane->ipu_ch);
+- else if (ipu_plane->next_buf >= 0)
+- return ipu_idmac_get_current_buffer(ipu_plane->ipu_ch) !=
+- ipu_plane->next_buf;
+
++ /*
++ * Pretend no update is pending in the non-PRE/PRG case. For this to
++ * happen, an atomic update would have to be deferred until after the
++ * start of the next frame and simultaneously interrupt latency would
++ * have to be high enough to let the atomic update finish and issue an
++ * event before the previous end of frame interrupt handler can be
++ * executed.
++ */
+ return false;
+ }
+ int ipu_planes_assign_pre(struct drm_device *dev,
+--- a/drivers/gpu/drm/imx/ipuv3-plane.h
++++ b/drivers/gpu/drm/imx/ipuv3-plane.h
+@@ -27,7 +27,6 @@ struct ipu_plane {
+ int dp_flow;
+
+ bool disabling;
+- int next_buf;
+ };
+
+ struct ipu_plane *ipu_plane_init(struct drm_device *dev, struct ipu_soc *ipu,
--- /dev/null
+From 204f640da6914844b3270b41b29c84f6e3b74083 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Thu, 28 Feb 2019 15:49:08 +0100
+Subject: drm/lease: Make sure implicit planes are leased
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 204f640da6914844b3270b41b29c84f6e3b74083 upstream.
+
+If userspace doesn't enable universal planes, then we automatically
+add the primary and cursor planes. But for universal userspace there's
+no such check (and maybe we only want to give the lessee one plane,
+maybe not even the primary one), hence we need to check for the
+implied plane.
+
+v2: don't forget setcrtc ioctl.
+
+v3: Still allow disabling of the crtc in SETCRTC.
+
+Cc: stable@vger.kernel.org
+Cc: Keith Packard <keithp@keithp.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190228144910.26488-6-daniel.vetter@ffwll.ch
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_crtc.c | 4 ++++
+ drivers/gpu/drm/drm_plane.c | 8 ++++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -559,6 +559,10 @@ int drm_mode_setcrtc(struct drm_device *
+
+ plane = crtc->primary;
+
++ /* allow disabling with the primary plane leased */
++ if (crtc_req->mode_valid && !drm_lease_held(file_priv, plane->base.id))
++ return -EACCES;
++
+ mutex_lock(&crtc->dev->mode_config.mutex);
+ DRM_MODESET_LOCK_ALL_BEGIN(dev, ctx,
+ DRM_MODESET_ACQUIRE_INTERRUPTIBLE, ret);
+--- a/drivers/gpu/drm/drm_plane.c
++++ b/drivers/gpu/drm/drm_plane.c
+@@ -960,6 +960,11 @@ retry:
+ if (ret)
+ goto out;
+
++ if (!drm_lease_held(file_priv, crtc->cursor->base.id)) {
++ ret = -EACCES;
++ goto out;
++ }
++
+ ret = drm_mode_cursor_universal(crtc, req, file_priv, &ctx);
+ goto out;
+ }
+@@ -1062,6 +1067,9 @@ int drm_mode_page_flip_ioctl(struct drm_
+
+ plane = crtc->primary;
+
++ if (!drm_lease_held(file_priv, plane->base.id))
++ return -EACCES;
++
+ if (crtc->funcs->page_flip_target) {
+ u32 current_vblank;
+ int r;
--- /dev/null
+From b8f9d7f37b6af829c34c49d1a4f73ce6ed58e403 Mon Sep 17 00:00:00 2001
+From: Vicente Bergas <vicencb@gmail.com>
+Date: Tue, 2 Apr 2019 13:37:53 +0200
+Subject: drm/rockchip: shutdown drm subsystem on shutdown
+
+From: Vicente Bergas <vicencb@gmail.com>
+
+commit b8f9d7f37b6af829c34c49d1a4f73ce6ed58e403 upstream.
+
+As explained by Robin Murphy:
+> the IOMMU shutdown disables paging, so if the VOP is still
+> scanning out then that will result in whatever IOVAs it was using now going
+> straight out onto the bus as physical addresses.
+
+We had a more radical approach before in commit
+7f3ef5dedb14 ("drm/rockchip: Allow driver to be shutdown on reboot/kexec")
+but that resulted in new warnings and oopses on shutdown on rk3399
+chromeos devices.
+
+So second try is resurrecting Vicentes shutdown change which should
+achieve the same result but in a less drastic way.
+
+Fixes: 63238173b2fa ("Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"")
+Cc: Jeffy Chen <jeffy.chen@rock-chips.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Brian Norris <briannorris@chromium.org>
+Cc: Doug Anderson <dianders@chromium.org>
+Cc: stable@vger.kernel.org
+Suggested-by: JeffyChen <jeffy.chen@rock-chips.com>
+Suggested-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Vicente Bergas <vicencb@gmail.com>
+[adapted commit message to explain the history]
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Tested-by: Brian Norris <briannorris@chromium.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Marc Zyngier <marc.zyngier@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190402113753.10118-1-heiko@sntech.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+@@ -448,6 +448,14 @@ static int rockchip_drm_platform_remove(
+ return 0;
+ }
+
++static void rockchip_drm_platform_shutdown(struct platform_device *pdev)
++{
++ struct drm_device *drm = platform_get_drvdata(pdev);
++
++ if (drm)
++ drm_atomic_helper_shutdown(drm);
++}
++
+ static const struct of_device_id rockchip_drm_dt_ids[] = {
+ { .compatible = "rockchip,display-subsystem", },
+ { /* sentinel */ },
+@@ -457,6 +465,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_
+ static struct platform_driver rockchip_drm_platform_driver = {
+ .probe = rockchip_drm_platform_probe,
+ .remove = rockchip_drm_platform_remove,
++ .shutdown = rockchip_drm_platform_shutdown,
+ .driver = {
+ .name = "rockchip-drm",
+ .of_match_table = rockchip_drm_dt_ids,
--- /dev/null
+From 8a943c6021ba8b95a36c842327e468df1fddd4a7 Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Tue, 14 May 2019 22:43:36 +0200
+Subject: drm/sun4i: Fix sun8i HDMI PHY clock initialization
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+commit 8a943c6021ba8b95a36c842327e468df1fddd4a7 upstream.
+
+Current code initializes HDMI PHY clock driver before reset line is
+deasserted and clocks enabled. Because of that, initial readout of
+clock divider is incorrect (0 instead of 2). This causes any clock
+rate with divider 1 (register value 0) to be set incorrectly.
+
+Fix this by moving initialization of HDMI PHY clock driver after reset
+line is deasserted and clocks enabled.
+
+Cc: stable@vger.kernel.org # 4.17+
+Fixes: 4f86e81748fe ("drm/sun4i: Add support for H3 HDMI PHY variant")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190514204337.11068-2-jernej.skrabec@siol.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
++++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+@@ -672,22 +672,13 @@ int sun8i_hdmi_phy_probe(struct sun8i_dw
+ goto err_put_clk_pll0;
+ }
+ }
+-
+- ret = sun8i_phy_clk_create(phy, dev,
+- phy->variant->has_second_pll);
+- if (ret) {
+- dev_err(dev, "Couldn't create the PHY clock\n");
+- goto err_put_clk_pll1;
+- }
+-
+- clk_prepare_enable(phy->clk_phy);
+ }
+
+ phy->rst_phy = of_reset_control_get_shared(node, "phy");
+ if (IS_ERR(phy->rst_phy)) {
+ dev_err(dev, "Could not get phy reset control\n");
+ ret = PTR_ERR(phy->rst_phy);
+- goto err_disable_clk_phy;
++ goto err_put_clk_pll1;
+ }
+
+ ret = reset_control_deassert(phy->rst_phy);
+@@ -708,18 +699,29 @@ int sun8i_hdmi_phy_probe(struct sun8i_dw
+ goto err_disable_clk_bus;
+ }
+
++ if (phy->variant->has_phy_clk) {
++ ret = sun8i_phy_clk_create(phy, dev,
++ phy->variant->has_second_pll);
++ if (ret) {
++ dev_err(dev, "Couldn't create the PHY clock\n");
++ goto err_disable_clk_mod;
++ }
++
++ clk_prepare_enable(phy->clk_phy);
++ }
++
+ hdmi->phy = phy;
+
+ return 0;
+
++err_disable_clk_mod:
++ clk_disable_unprepare(phy->clk_mod);
+ err_disable_clk_bus:
+ clk_disable_unprepare(phy->clk_bus);
+ err_deassert_rst_phy:
+ reset_control_assert(phy->rst_phy);
+ err_put_rst_phy:
+ reset_control_put(phy->rst_phy);
+-err_disable_clk_phy:
+- clk_disable_unprepare(phy->clk_phy);
+ err_put_clk_pll1:
+ clk_put(phy->clk_pll1);
+ err_put_clk_pll0:
--- /dev/null
+From 831adffb3b7b8df4c8e20b7b00843129fb87a166 Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Tue, 14 May 2019 22:43:37 +0200
+Subject: drm/sun4i: Fix sun8i HDMI PHY configuration for > 148.5 MHz
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+commit 831adffb3b7b8df4c8e20b7b00843129fb87a166 upstream.
+
+Vendor provided documentation says that EMP bits should be set to 3 for
+pixel clocks greater than 148.5 MHz.
+
+Fix that.
+
+Cc: stable@vger.kernel.org # 4.17+
+Fixes: 4f86e81748fe ("drm/sun4i: Add support for H3 HDMI PHY variant")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190514204337.11068-3-jernej.skrabec@siol.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
++++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+@@ -293,7 +293,8 @@ static int sun8i_hdmi_phy_config_h3(stru
+ SUN8I_HDMI_PHY_ANA_CFG2_REG_BIGSW |
+ SUN8I_HDMI_PHY_ANA_CFG2_REG_SLV(4);
+ ana_cfg3_init |= SUN8I_HDMI_PHY_ANA_CFG3_REG_AMPCK(9) |
+- SUN8I_HDMI_PHY_ANA_CFG3_REG_AMP(13);
++ SUN8I_HDMI_PHY_ANA_CFG3_REG_AMP(13) |
++ SUN8I_HDMI_PHY_ANA_CFG3_REG_EMP(3);
+ }
+
+ regmap_update_bits(phy->regs, SUN8I_HDMI_PHY_ANA_CFG1_REG,
--- /dev/null
+From 61b51fb51c01a519a249d28ec55c6513a13be5a3 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Thu, 7 Mar 2019 01:55:19 +0300
+Subject: drm/tegra: gem: Fix CPU-cache maintenance for BO's allocated using get_pages()
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit 61b51fb51c01a519a249d28ec55c6513a13be5a3 upstream.
+
+The allocated pages need to be invalidated in CPU caches. On ARM32 the
+DMA_BIDIRECTIONAL flag only ensures that data is written-back to DRAM and
+the data stays in CPU cache lines. While the DMA_FROM_DEVICE flag ensures
+that the corresponding CPU cache lines are getting invalidated and nothing
+more, that's exactly what is needed for a newly allocated pages.
+
+This fixes randomly failing rendercheck tests on Tegra30 using the
+Opentegra driver for tests that use small-sized pixmaps (10x10 and less,
+i.e. 1-2 memory pages) because apparently CPU reads out stale data from
+caches and/or that data is getting evicted to DRAM at the time of HW job
+execution.
+
+Fixes: bd43c9f0fa1f ("drm/tegra: gem: Map pages via the DMA API")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tegra/gem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/tegra/gem.c
++++ b/drivers/gpu/drm/tegra/gem.c
+@@ -204,7 +204,7 @@ static void tegra_bo_free(struct drm_dev
+ {
+ if (bo->pages) {
+ dma_unmap_sg(drm->dev, bo->sgt->sgl, bo->sgt->nents,
+- DMA_BIDIRECTIONAL);
++ DMA_FROM_DEVICE);
+ drm_gem_put_pages(&bo->gem, bo->pages, true, true);
+ sg_free_table(bo->sgt);
+ kfree(bo->sgt);
+@@ -230,7 +230,7 @@ static int tegra_bo_get_pages(struct drm
+ }
+
+ err = dma_map_sg(drm->dev, bo->sgt->sgl, bo->sgt->nents,
+- DMA_BIDIRECTIONAL);
++ DMA_FROM_DEVICE);
+ if (err == 0) {
+ err = -EFAULT;
+ goto free_sgt;
--- /dev/null
+From 63cb44441826e842b7285575b96db631cc9f2505 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Tue, 7 May 2019 11:07:53 +0200
+Subject: drm/vmwgfx: Don't send drm sysfs hotplug events on initial master set
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 63cb44441826e842b7285575b96db631cc9f2505 upstream.
+
+This may confuse user-space clients like plymouth that opens a drm
+file descriptor as a result of a hotplug event and then generates a
+new event...
+
+Cc: <stable@vger.kernel.org>
+Fixes: 5ea1734827bb ("drm/vmwgfx: Send a hotplug event at master_set")
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -1240,7 +1240,13 @@ static int vmw_master_set(struct drm_dev
+ }
+
+ dev_priv->active_master = vmaster;
+- drm_sysfs_hotplug_event(dev);
++
++ /*
++ * Inform a new master that the layout may have changed while
++ * it was gone.
++ */
++ if (!from_open)
++ drm_sysfs_hotplug_event(dev);
+
+ return 0;
+ }
--- /dev/null
+From e41c20cf50a8a7d0dfa337a7530590aacef4193b Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Thu, 4 Apr 2019 13:25:43 +0000
+Subject: drm/vmwgfx: Fix compat mode shader operation
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit e41c20cf50a8a7d0dfa337a7530590aacef4193b upstream.
+
+In compat mode, we allowed host-backed user-space with guest-backed
+kernel / device. In this mode, set shader commands was broken since
+no relocations were emitted. Fix this.
+
+Cc: <stable@vger.kernel.org>
+Fixes: e8c66efbfe3a ("drm/vmwgfx: Make user resource lookups reference-free during validation")
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Brian Paul <brianp@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -2129,6 +2129,11 @@ static int vmw_cmd_set_shader(struct vmw
+ return 0;
+
+ if (cmd->body.shid != SVGA3D_INVALID_ID) {
++ /*
++ * This is the compat shader path - Per device guest-backed
++ * shaders, but user-space thinks it's per context host-
++ * backed shaders.
++ */
+ res = vmw_shader_lookup(vmw_context_res_man(ctx),
+ cmd->body.shid,
+ cmd->body.type);
+@@ -2137,6 +2142,14 @@ static int vmw_cmd_set_shader(struct vmw
+ ret = vmw_execbuf_res_noctx_val_add(sw_context, res);
+ if (unlikely(ret != 0))
+ return ret;
++
++ ret = vmw_resource_relocation_add
++ (sw_context, res,
++ vmw_ptr_diff(sw_context->buf_start,
++ &cmd->body.shid),
++ vmw_res_rel_normal);
++ if (unlikely(ret != 0))
++ return ret;
+ }
+ }
+
--- /dev/null
+From 8407f8a1d940fe28c4243ad4f0cb6a44dcee88f6 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Tue, 7 May 2019 11:10:10 +0200
+Subject: drm/vmwgfx: Fix user space handle equal to zero
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 8407f8a1d940fe28c4243ad4f0cb6a44dcee88f6 upstream.
+
+User-space handles equal to zero are interpreted as uninitialized or
+illegal by some drm systems (most notably kms). This means that a
+dumb buffer or surface with a zero user-space handle can never be
+used as a kms frame-buffer.
+
+Cc: <stable@vger.kernel.org>
+Fixes: c7eae62666ad ("drm/vmwgfx: Make the object handles idr-generated")
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/ttm_object.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/ttm_object.c
++++ b/drivers/gpu/drm/vmwgfx/ttm_object.c
+@@ -174,7 +174,7 @@ int ttm_base_object_init(struct ttm_obje
+ kref_init(&base->refcount);
+ idr_preload(GFP_KERNEL);
+ spin_lock(&tdev->object_lock);
+- ret = idr_alloc(&tdev->idr, base, 0, 0, GFP_NOWAIT);
++ ret = idr_alloc(&tdev->idr, base, 1, 0, GFP_NOWAIT);
+ spin_unlock(&tdev->object_lock);
+ idr_preload_end();
+ if (ret < 0)
--- /dev/null
+From 4e78921ba4dd0aca1cc89168f45039add4183f8e Mon Sep 17 00:00:00 2001
+From: Gen Zhang <blackgod016574@gmail.com>
+Date: Sat, 25 May 2019 13:25:58 +0200
+Subject: efi/x86/Add missing error handling to old_memmap 1:1 mapping code
+
+From: Gen Zhang <blackgod016574@gmail.com>
+
+commit 4e78921ba4dd0aca1cc89168f45039add4183f8e upstream.
+
+The old_memmap flow in efi_call_phys_prolog() performs numerous memory
+allocations, and either does not check for failure at all, or it does
+but fails to propagate it back to the caller, which may end up calling
+into the firmware with an incomplete 1:1 mapping.
+
+So let's fix this by returning NULL from efi_call_phys_prolog() on
+memory allocation failures only, and by handling this condition in the
+caller. Also, clean up any half baked sets of page tables that we may
+have created before returning with a NULL return value.
+
+Note that any failure at this level will trigger a panic() two levels
+up, so none of this makes a huge difference, but it is a nice cleanup
+nonetheless.
+
+[ardb: update commit log, add efi_call_phys_epilog() call on error path]
+
+Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rob Bradford <robert.bradford@intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Link: http://lkml.kernel.org/r/20190525112559.7917-2-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Zubin Mithra <zsm@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/platform/efi/efi.c | 2 ++
+ arch/x86/platform/efi/efi_64.c | 9 ++++++---
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -85,6 +85,8 @@ static efi_status_t __init phys_efi_set_
+ pgd_t *save_pgd;
+
+ save_pgd = efi_call_phys_prolog();
++ if (!save_pgd)
++ return EFI_ABORTED;
+
+ /* Disable interrupts around EFI calls: */
+ local_irq_save(flags);
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -84,13 +84,15 @@ pgd_t * __init efi_call_phys_prolog(void
+
+ if (!efi_enabled(EFI_OLD_MEMMAP)) {
+ efi_switch_mm(&efi_mm);
+- return NULL;
++ return efi_mm.pgd;
+ }
+
+ early_code_mapping_set_exec(1);
+
+ n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
+ save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
++ if (!save_pgd)
++ return NULL;
+
+ /*
+ * Build 1:1 identity mapping for efi=old_map usage. Note that
+@@ -138,10 +140,11 @@ pgd_t * __init efi_call_phys_prolog(void
+ pgd_offset_k(pgd * PGDIR_SIZE)->pgd &= ~_PAGE_NX;
+ }
+
+-out:
+ __flush_tlb_all();
+-
+ return save_pgd;
++out:
++ efi_call_phys_epilog(save_pgd);
++ return NULL;
+ }
+
+ void __init efi_call_phys_epilog(pgd_t *save_pgd)
cifs-cifs_read_allocate_pages-don-t-iterate-through-whole-page-array-on-enomem.patch
revert-lockd-show-pid-of-lockd-for-remote-locks.patch
gcc-plugins-fix-build-failures-under-darwin-host.patch
+efi-x86-add-missing-error-handling-to-old_memmap-1-1-mapping-code.patch
+drm-tegra-gem-fix-cpu-cache-maintenance-for-bo-s-allocated-using-get_pages.patch
+drm-vmwgfx-fix-user-space-handle-equal-to-zero.patch
+drm-vmwgfx-fix-compat-mode-shader-operation.patch
+drm-vmwgfx-don-t-send-drm-sysfs-hotplug-events-on-initial-master-set.patch
+drm-sun4i-fix-sun8i-hdmi-phy-clock-initialization.patch
+drm-sun4i-fix-sun8i-hdmi-phy-configuration-for-148.5-mhz.patch
+drm-imx-ipuv3-plane-fix-atomic-update-status-query-for-non-plus-i.mx6q.patch
+drm-fb-helper-generic-call-drm_client_add-after-setup-is-done.patch
+drm-atomic-wire-file_priv-through-for-property-changes.patch
+drm-expose-fb_damage_clips-property-to-atomic-aware-user-space-only.patch
+drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch
+drm-lease-make-sure-implicit-planes-are-leased.patch
+drm-cma-helper-fix-drm_gem_cma_free_object.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
