--- /dev/null
+From 51ef434a15b450bfbef1e06cc87ee4e98a224486 Mon Sep 17 00:00:00 2001
+From: Akshu Agrawal <akshu.agrawal@amd.com>
+Date: Mon, 24 Sep 2018 15:48:02 +0530
+Subject: drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD
+
+From: Akshu Agrawal <akshu.agrawal@amd.com>
+
+commit 51ef434a15b450bfbef1e06cc87ee4e98a224486 upstream.
+
+We observe black lines (underflow) on display when playing a
+4K video with UVD. On Disabling Low memory P state this issue is
+not seen.
+Multiple runs of power measurement shows no imapct.
+
+Signed-off-by: Akshu Agrawal <akshu.agrawal@amd.com>
+Signed-off-by: Satyajit Sahu <satyajit.sahu@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+@@ -1222,14 +1222,17 @@ static int smu8_dpm_force_dpm_level(stru
+
+ static int smu8_dpm_powerdown_uvd(struct pp_hwmgr *hwmgr)
+ {
+- if (PP_CAP(PHM_PlatformCaps_UVDPowerGating))
++ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) {
++ smu8_nbdpm_pstate_enable_disable(hwmgr, true, true);
+ return smum_send_msg_to_smc(hwmgr, PPSMC_MSG_UVDPowerOFF);
++ }
+ return 0;
+ }
+
+ static int smu8_dpm_powerup_uvd(struct pp_hwmgr *hwmgr)
+ {
+ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) {
++ smu8_nbdpm_pstate_enable_disable(hwmgr, false, true);
+ return smum_send_msg_to_smc_with_parameter(
+ hwmgr,
+ PPSMC_MSG_UVDPowerON,
--- /dev/null
+From d9997b64c52b70bd98c48f443f068253621d1ffc Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 28 Aug 2018 14:16:23 -0500
+Subject: drm/amdgpu: add missing CHIP_HAINAN in amdgpu_ucode_get_load_type
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit d9997b64c52b70bd98c48f443f068253621d1ffc upstream.
+
+This caused a confusing error message, but there is functionally
+no problem since the default method is DIRECT.
+
+Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+@@ -277,6 +277,7 @@ amdgpu_ucode_get_load_type(struct amdgpu
+ case CHIP_PITCAIRN:
+ case CHIP_VERDE:
+ case CHIP_OLAND:
++ case CHIP_HAINAN:
+ return AMDGPU_FW_LOAD_DIRECT;
+ #endif
+ #ifdef CONFIG_DRM_AMDGPU_CIK
--- /dev/null
+From 3df27645395e8f79c0dc20a15cf1da61f376000d Mon Sep 17 00:00:00 2001
+From: Rex Zhu <Rex.Zhu@amd.com>
+Date: Fri, 12 Oct 2018 22:26:11 +0800
+Subject: drm/amdgpu: Fix typo in amdgpu_vmid_mgr_init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rex Zhu <Rex.Zhu@amd.com>
+
+commit 3df27645395e8f79c0dc20a15cf1da61f376000d upstream.
+
+fix a typo in for loop: i->j
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+@@ -574,7 +574,7 @@ void amdgpu_vmid_mgr_init(struct amdgpu_
+ /* skip over VMID 0, since it is the system VM */
+ for (j = 1; j < id_mgr->num_ids; ++j) {
+ amdgpu_vmid_reset(adev, i, j);
+- amdgpu_sync_create(&id_mgr->ids[i].active);
++ amdgpu_sync_create(&id_mgr->ids[j].active);
+ list_add_tail(&id_mgr->ids[j].list, &id_mgr->ids_lru);
+ }
+ }
--- /dev/null
+From e96550956fbcd090629c0e2b5b8cded2eded2adf Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 8 Oct 2018 19:24:30 -0400
+Subject: drm/atomic_helper: Disallow new modesets on unregistered connectors
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit e96550956fbcd090629c0e2b5b8cded2eded2adf upstream.
+
+With the exception of modesets which would switch the DPMS state of a
+connector from on to off, we want to make sure that we disallow all
+modesets which would result in enabling a new monitor or a new mode
+configuration on a monitor if the connector for the display in question
+is no longer registered. This allows us to stop userspace from trying to
+enable new displays on connectors for an MST topology that were just
+removed from the system, without preventing userspace from disabling
+DPMS on those connectors.
+
+Changes since v5:
+- Fix typo in comment, nothing else
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: stable@vger.kernel.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-2-lyude@redhat.com
+(cherry picked from commit 4d80273976bf880c4bed9359b8f2d45663140c86)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_atomic_helper.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -306,6 +306,26 @@ update_connector_routing(struct drm_atom
+ return 0;
+ }
+
++ crtc_state = drm_atomic_get_new_crtc_state(state,
++ new_connector_state->crtc);
++ /*
++ * For compatibility with legacy users, we want to make sure that
++ * we allow DPMS On->Off modesets on unregistered connectors. Modesets
++ * which would result in anything else must be considered invalid, to
++ * avoid turning on new displays on dead connectors.
++ *
++ * Since the connector can be unregistered at any point during an
++ * atomic check or commit, this is racy. But that's OK: all we care
++ * about is ensuring that userspace can't do anything but shut off the
++ * display on a connector that was destroyed after its been notified,
++ * not before.
++ */
++ if (!READ_ONCE(connector->registered) && crtc_state->active) {
++ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n",
++ connector->base.id, connector->name);
++ return -EINVAL;
++ }
++
+ funcs = connector->helper_private;
+
+ if (funcs->atomic_best_encoder)
+@@ -350,7 +370,6 @@ update_connector_routing(struct drm_atom
+
+ set_best_encoder(state, new_connector_state, new_encoder);
+
+- crtc_state = drm_atomic_get_new_crtc_state(state, new_connector_state->crtc);
+ crtc_state->connectors_changed = true;
+
+ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] using [ENCODER:%d:%s] on [CRTC:%d:%s]\n",
--- /dev/null
+From 23d8003907d094f77cf959228e2248d6db819fa7 Mon Sep 17 00:00:00 2001
+From: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+Date: Fri, 9 Nov 2018 11:00:12 +0200
+Subject: drm/dp_mst: Check if primary mstb is null
+
+From: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+
+commit 23d8003907d094f77cf959228e2248d6db819fa7 upstream.
+
+Unfortunately drm_dp_get_mst_branch_device which is called from both
+drm_dp_mst_handle_down_rep and drm_dp_mst_handle_up_rep seem to rely
+on that mgr->mst_primary is not NULL, which seem to be wrong as it can be
+cleared with simultaneous mode set, if probing fails or in other case.
+mgr->lock mutex doesn't protect against that as it might just get
+assigned to NULL right before, not simultaneously.
+
+There are currently bugs 107738, 108616 bugs which crash in
+drm_dp_get_mst_branch_device, caused by this issue.
+
+v2: Refactored the code, as it was nicely noticed.
+ Fixed Bugzilla bug numbers(second was 108616, but not 108816)
+ and added links.
+
+[changed title and added stable cc]
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+Cc: stable@vger.kernel.org
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108616
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107738
+Link: https://patchwork.freedesktop.org/patch/msgid/20181109090012.24438-1-stanislav.lisovskiy@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1274,6 +1274,9 @@ static struct drm_dp_mst_branch *drm_dp_
+ mutex_lock(&mgr->lock);
+ mstb = mgr->mst_primary;
+
++ if (!mstb)
++ goto out;
++
+ for (i = 0; i < lct - 1; i++) {
+ int shift = (i % 2) ? 0 : 4;
+ int port_num = (rad[i / 2] >> shift) & 0xf;
--- /dev/null
+From 6fce3a406108ee6c8a61e2a33e52e9198a626ea0 Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Thu, 4 Oct 2018 11:37:00 +0200
+Subject: drm/etnaviv: fix bogus fence complete check in timeout handler
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+commit 6fce3a406108ee6c8a61e2a33e52e9198a626ea0 upstream.
+
+The GPU hardware fences and the job out-fences are on different timelines
+so it's wrong to compare them. Fix this by only looking at the out-fence.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 2c83a726d6fb (drm/etnaviv: bring back progress check in job
+ timeout handler)
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/etnaviv/etnaviv_sched.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+@@ -93,7 +93,7 @@ static void etnaviv_sched_timedout_job(s
+ * If the GPU managed to complete this jobs fence, the timout is
+ * spurious. Bail out.
+ */
+- if (fence_completed(gpu, submit->out_fence->seqno))
++ if (dma_fence_is_signaled(submit->out_fence))
+ return;
+
+ /*
--- /dev/null
+From 085603287452fc96376ed4888bf29f8c095d2b40 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 25 Oct 2018 10:18:23 +0100
+Subject: drm/i915: Compare user's 64b GTT offset even on 32b
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 085603287452fc96376ed4888bf29f8c095d2b40 upstream.
+
+Beware mixing unsigned long constants and 64b values, as on 32b the
+constant will be zero extended and discard the high 32b when used as
+a mask!
+
+Reported-by: Sergii Romantsov <sergii.romantsov@globallogic.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108282
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181025091823.20571-2-chris@chris-wilson.co.uk
+(cherry picked from commit 6fc4e48f9ed46e9adff236a0c350074aafa3b7fa)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gvt/gtt.h | 1 -
+ drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 +-
+ drivers/gpu/drm/i915/i915_gem_gtt.h | 2 ++
+ 3 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gvt/gtt.h
++++ b/drivers/gpu/drm/i915/gvt/gtt.h
+@@ -35,7 +35,6 @@
+ #define _GVT_GTT_H_
+
+ #define I915_GTT_PAGE_SHIFT 12
+-#define I915_GTT_PAGE_MASK (~(I915_GTT_PAGE_SIZE - 1))
+
+ struct intel_vgpu_mm;
+
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -449,7 +449,7 @@ eb_validate_vma(struct i915_execbuffer *
+ * any non-page-aligned or non-canonical addresses.
+ */
+ if (unlikely(entry->flags & EXEC_OBJECT_PINNED &&
+- entry->offset != gen8_canonical_addr(entry->offset & PAGE_MASK)))
++ entry->offset != gen8_canonical_addr(entry->offset & I915_GTT_PAGE_MASK)))
+ return -EINVAL;
+
+ /* pad_to_size was once a reserved field, so sanitize it */
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.h
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.h
+@@ -49,6 +49,8 @@
+ #define I915_GTT_PAGE_SIZE I915_GTT_PAGE_SIZE_4K
+ #define I915_GTT_MAX_PAGE_SIZE I915_GTT_PAGE_SIZE_2M
+
++#define I915_GTT_PAGE_MASK -I915_GTT_PAGE_SIZE
++
+ #define I915_GTT_MIN_ALIGNMENT I915_GTT_PAGE_SIZE
+
+ #define I915_FENCE_REG_NONE -1
--- /dev/null
+From 6a8915d0f8cf323e1beb792a33095cf652db4056 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 5 Nov 2018 21:46:04 +0200
+Subject: drm/i915: Don't oops during modeset shutdown after lpe audio deinit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 6a8915d0f8cf323e1beb792a33095cf652db4056 upstream.
+
+We deinit the lpe audio device before we call
+drm_atomic_helper_shutdown(), which means the platform device
+may already be gone when it comes time to shut down the crtc.
+As we don't know when the last reference to the platform
+device gets dropped by the audio driver we can't assume that
+the device and its data are still around when turning off the
+crtc. Mark the platform device as gone as soon as we do the
+audio deinit.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181105194604.6994-1-ville.syrjala@linux.intel.com
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+(cherry picked from commit f45a7977d1140c11f334e01a9f77177ed68e3bfa)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_lpe_audio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
++++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
+@@ -297,8 +297,10 @@ void intel_lpe_audio_teardown(struct drm
+ lpe_audio_platdev_destroy(dev_priv);
+
+ irq_free_desc(dev_priv->lpe_audio.irq);
+-}
+
++ dev_priv->lpe_audio.irq = -1;
++ dev_priv->lpe_audio.platdev = NULL;
++}
+
+ /**
+ * intel_lpe_audio_notify() - notify lpe audio event
--- /dev/null
+From 80c188695a77eddaa6e8885510ff4ef59fd478c3 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 8 Oct 2018 19:24:32 -0400
+Subject: drm/i915: Don't unset intel_connector->mst_port
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 80c188695a77eddaa6e8885510ff4ef59fd478c3 upstream.
+
+Currently we set intel_connector->mst_port to NULL to signify that the
+MST port has been removed from the system so that we can prevent further
+action on the port such as connector probes, mode probing, etc.
+However, we're going to need access to intel_connector->mst_port in
+order to fixup ->best_encoder() so that it can always return the correct
+encoder for an MST port to prevent legacy DPMS prop changes from
+failing. This should be safe, so instead keep intel_connector->mst_port
+always set and instead just check the status of
+drm_connector->regustered to signify whether or not the connector has
+disappeared from the system.
+
+Changes since v2:
+- Add a comment to mst_port_gone (Jani Nikula)
+- Change mst_port_gone to a u8 instead of a bool, per the kernel bot.
+ Apparently bool is discouraged in structs these days
+Changes since v4:
+- Don't use mst_port_gone at all! Just check if the connector is
+ registered or not - Daniel Vetter
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: stable@vger.kernel.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-4-lyude@redhat.com
+(cherry picked from commit 6ed5bb1fbad34382c8cfe9a9bf737e9a43053df5)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp_mst.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -307,9 +307,8 @@ static int intel_dp_mst_get_ddc_modes(st
+ struct edid *edid;
+ int ret;
+
+- if (!intel_dp) {
++ if (!READ_ONCE(connector->registered))
+ return intel_connector_update_modes(connector, NULL);
+- }
+
+ edid = drm_dp_mst_get_edid(connector, &intel_dp->mst_mgr, intel_connector->port);
+ ret = intel_connector_update_modes(connector, edid);
+@@ -324,9 +323,10 @@ intel_dp_mst_detect(struct drm_connector
+ struct intel_connector *intel_connector = to_intel_connector(connector);
+ struct intel_dp *intel_dp = intel_connector->mst_port;
+
+- if (!intel_dp)
++ if (!READ_ONCE(connector->registered))
+ return connector_status_disconnected;
+- return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, intel_connector->port);
++ return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr,
++ intel_connector->port);
+ }
+
+ static void
+@@ -366,7 +366,7 @@ intel_dp_mst_mode_valid(struct drm_conne
+ int bpp = 24; /* MST uses fixed bpp */
+ int max_rate, mode_rate, max_lanes, max_link_clock;
+
+- if (!intel_dp)
++ if (!READ_ONCE(connector->registered))
+ return MODE_ERROR;
+
+ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+@@ -398,7 +398,7 @@ static struct drm_encoder *intel_mst_ato
+ struct intel_dp *intel_dp = intel_connector->mst_port;
+ struct intel_crtc *crtc = to_intel_crtc(state->crtc);
+
+- if (!intel_dp)
++ if (!READ_ONCE(connector->registered))
+ return NULL;
+ return &intel_dp->mst_encoders[crtc->pipe]->base.base;
+ }
+@@ -510,7 +510,6 @@ static void intel_dp_register_mst_connec
+ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ struct drm_connector *connector)
+ {
+- struct intel_connector *intel_connector = to_intel_connector(connector);
+ struct drm_i915_private *dev_priv = to_i915(connector->dev);
+
+ DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", connector->base.id, connector->name);
+@@ -519,10 +518,6 @@ static void intel_dp_destroy_mst_connect
+ if (dev_priv->fbdev)
+ drm_fb_helper_remove_one_connector(&dev_priv->fbdev->helper,
+ connector);
+- /* prevent race with the check in ->detect */
+- drm_modeset_lock(&connector->dev->mode_config.connection_mutex, NULL);
+- intel_connector->mst_port = NULL;
+- drm_modeset_unlock(&connector->dev->mode_config.connection_mutex);
+
+ drm_connector_unreference(connector);
+ }
--- /dev/null
+From 49af5d95b9b3c21a84ad115a9db9acbc036d849a Mon Sep 17 00:00:00 2001
+From: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Date: Thu, 27 Sep 2018 13:57:30 -0700
+Subject: drm/i915/dp: Fix link retraining comment in intel_dp_long_pulse()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+
+commit 49af5d95b9b3c21a84ad115a9db9acbc036d849a upstream.
+
+Comment claims link needs to be retrained because the connected sink raised
+a long pulse to indicate link loss. If the sink did so,
+intel_dp_hotplug() would have handled link retraining. Looking at the
+logs in Bugzilla referenced in commit '3cf71bc9904d ("drm/i915: Re-apply
+Perform link quality check, unconditionally during long pulse"")', the
+issue is that the sink does not trigger an interrupt. What we want is
+->detect() from user space to check link status and retrain. Ville's
+review for the original patch also indicates the same root cause. So,
+rewrite the comment.
+
+v2: Patch split and rewrote comment.
+
+Cc: Lyude Paul <lyude@redhat.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Jan-Marek Glogowski <glogow@fbihome.de>
+References: 3cf71bc9904d ("drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"")
+Signed-off-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180927205735.16651-1-dhinakaran.pandiyan@intel.com
+(cherry picked from commit 9ebd8202393dde9d3678c9ec162c1aa63ba17eac)
+Fixes: 399334708b4f ("drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"")
+Cc: stable@vger.kernel.org
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -4874,16 +4874,9 @@ intel_dp_long_pulse(struct intel_connect
+ goto out;
+ } else {
+ /*
+- * If display is now connected check links status,
+- * there has been known issues of link loss triggering
+- * long pulse.
+- *
+- * Some sinks (eg. ASUS PB287Q) seem to perform some
+- * weird HPD ping pong during modesets. So we can apparently
+- * end up with HPD going low during a modeset, and then
+- * going back up soon after. And once that happens we must
+- * retrain the link to get a picture. That's in case no
+- * userspace component reacted to intermittent HPD dip.
++ * Some external monitors do not signal loss of link
++ * synchronization with an IRQ_HPD, so force a link status
++ * check.
+ */
+ struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
+
--- /dev/null
+From 041444458835d7fb2c9f042598bfe16bf375b15d Mon Sep 17 00:00:00 2001
+From: Manasi Navare <manasi.d.navare@intel.com>
+Date: Tue, 9 Oct 2018 14:28:04 -0700
+Subject: drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit panel's native mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Manasi Navare <manasi.d.navare@intel.com>
+
+commit 041444458835d7fb2c9f042598bfe16bf375b15d upstream.
+
+This patch fixes the original commit c0cfb10d9e1de49 ("drm/i915/edp:
+Do not do link training fallback or prune modes on EDP") that causes
+a blank screen in case of certain eDP panels (Eg: seen on Dell XPS13 9350)
+where first link training fails and a retraining is required by falling
+back to lower link rate/lane count.
+In case of some panels they advertise higher link rate/lane count
+than whats required for supporting the panel's native mode.
+But we always link train at highest link rate/lane count for eDP
+and if that fails we can still fallback to lower link rate/lane count
+as long as the fallback link BW still fits the native mode to avoid
+pruning the panel's native mode yet retraining at fallback values
+to recover from a blank screen.
+
+v3:
+* Add const for fixed_mode (Ville)
+v2:
+* Send uevent if link failure on eDP unconditionally
+
+Fixes: c0cfb10d9e1d ("drm/i915/edp: Do not do link training fallback or prune modes on EDP")
+Cc: Clinton Taylor <clinton.a.taylor@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: <stable@vger.kernel.org> # v4.17+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107489
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105338
+Signed-off-by: Manasi Navare <manasi.d.navare@intel.com>
+Tested-by: Alexander Wilson <alexander.wilson@ncf.edu>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181009212804.702-1-manasi.d.navare@intel.com
+(cherry picked from commit 1e712535c51ab025ebc776d4405683d81521996d)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c | 30 ++++++++++++++++++++++++++
+ drivers/gpu/drm/i915/intel_dp_link_training.c | 26 +++++++---------------
+ 2 files changed, 39 insertions(+), 17 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -387,6 +387,22 @@ static bool intel_dp_link_params_valid(s
+ return true;
+ }
+
++static bool intel_dp_can_link_train_fallback_for_edp(struct intel_dp *intel_dp,
++ int link_rate,
++ uint8_t lane_count)
++{
++ const struct drm_display_mode *fixed_mode =
++ intel_dp->attached_connector->panel.fixed_mode;
++ int mode_rate, max_rate;
++
++ mode_rate = intel_dp_link_required(fixed_mode->clock, 18);
++ max_rate = intel_dp_max_data_rate(link_rate, lane_count);
++ if (mode_rate > max_rate)
++ return false;
++
++ return true;
++}
++
+ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp,
+ int link_rate, uint8_t lane_count)
+ {
+@@ -396,9 +412,23 @@ int intel_dp_get_link_train_fallback_val
+ intel_dp->num_common_rates,
+ link_rate);
+ if (index > 0) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp->common_rates[index - 1],
++ lane_count)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp->common_rates[index - 1];
+ intel_dp->max_link_lane_count = lane_count;
+ } else if (lane_count > 1) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp_max_common_rate(intel_dp),
++ lane_count >> 1)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp_max_common_rate(intel_dp);
+ intel_dp->max_link_lane_count = lane_count >> 1;
+ } else {
+--- a/drivers/gpu/drm/i915/intel_dp_link_training.c
++++ b/drivers/gpu/drm/i915/intel_dp_link_training.c
+@@ -335,22 +335,14 @@ intel_dp_start_link_train(struct intel_d
+ return;
+
+ failure_handling:
+- /* Dont fallback and prune modes if its eDP */
+- if (!intel_dp_is_edp(intel_dp)) {
+- DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- if (!intel_dp_get_link_train_fallback_values(intel_dp,
+- intel_dp->link_rate,
+- intel_dp->lane_count))
+- /* Schedule a Hotplug Uevent to userspace to start modeset */
+- schedule_work(&intel_connector->modeset_retry_work);
+- } else {
+- DRM_ERROR("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- }
++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
++ intel_connector->base.base.id,
++ intel_connector->base.name,
++ intel_dp->link_rate, intel_dp->lane_count);
++ if (!intel_dp_get_link_train_fallback_values(intel_dp,
++ intel_dp->link_rate,
++ intel_dp->lane_count))
++ /* Schedule a Hotplug Uevent to userspace to start modeset */
++ schedule_work(&intel_connector->modeset_retry_work);
+ return;
+ }
--- /dev/null
+From f9776280c29e77a18cbc7ebb6d48f7885e494990 Mon Sep 17 00:00:00 2001
+From: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Date: Thu, 27 Sep 2018 13:57:31 -0700
+Subject: drm/i915/dp: Restrict link retrain workaround to external monitors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+
+commit f9776280c29e77a18cbc7ebb6d48f7885e494990 upstream.
+
+Commit '3cf71bc9904d ("drm/i915: Re-apply "Perform link quality check,
+unconditionally during long pulse"")' applies a work around for sinks
+that don't signal link loss. The work around does not need to have to be
+that broad as the issue was seen with only one particular monitor; limit
+this only for external displays as eDP features like PSR turn off the link
+and the driver ends up retraining the link seeeing that link is not
+synchronized.
+
+Cc: Lyude Paul <lyude@redhat.com>
+Cc: Jan-Marek Glogowski <glogow@fbihome.de>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+References: 3cf71bc9904d ("drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"")
+Signed-off-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180927205735.16651-2-dhinakaran.pandiyan@intel.com
+(cherry picked from commit f24f6eb95807bca0dbd8dc5b2f3a4099000f4472)
+Fixes: 399334708b4f ("drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"")
+Cc: stable@vger.kernel.org
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -4872,12 +4872,13 @@ intel_dp_long_pulse(struct intel_connect
+ */
+ status = connector_status_disconnected;
+ goto out;
+- } else {
+- /*
+- * Some external monitors do not signal loss of link
+- * synchronization with an IRQ_HPD, so force a link status
+- * check.
+- */
++ }
++
++ /*
++ * Some external monitors do not signal loss of link synchronization
++ * with an IRQ_HPD, so force a link status check.
++ */
++ if (!intel_dp_is_edp(intel_dp)) {
+ struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
+
+ intel_dp_retrain_link(encoder, ctx);
--- /dev/null
+From 0a823e8fd4fd67726697854578f3584ee3a49b1d Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 8 Nov 2018 08:17:38 +0000
+Subject: drm/i915/execlists: Force write serialisation into context image vs execution
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 0a823e8fd4fd67726697854578f3584ee3a49b1d upstream.
+
+Ensure that the writes into the context image are completed prior to the
+register mmio to trigger execution. Although previously we were assured
+by the SDM that all writes are flushed before an uncached memory
+transaction (our mmio write to submit the context to HW for execution),
+we have empirical evidence to believe that this is not actually the
+case.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108656
+References: https://bugs.freedesktop.org/show_bug.cgi?id=108315
+References: https://bugs.freedesktop.org/show_bug.cgi?id=106887
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Acked-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181108081740.25615-1-chris@chris-wilson.co.uk
+Cc: stable@vger.kernel.org
+(cherry picked from commit 987abd5c62f92ee4970b45aa077f47949974e615)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_lrc.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -425,7 +425,8 @@ static u64 execlists_update_context(stru
+
+ reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail);
+
+- /* True 32b PPGTT with dynamic page allocation: update PDP
++ /*
++ * True 32b PPGTT with dynamic page allocation: update PDP
+ * registers and point the unallocated PDPs to scratch page.
+ * PML4 is allocated during ppgtt init, so this is not needed
+ * in 48-bit mode.
+@@ -433,6 +434,17 @@ static u64 execlists_update_context(stru
+ if (ppgtt && !i915_vm_is_48bit(&ppgtt->base))
+ execlists_update_context_pdps(ppgtt, reg_state);
+
++ /*
++ * Make sure the context image is complete before we submit it to HW.
++ *
++ * Ostensibly, writes (including the WCB) should be flushed prior to
++ * an uncached write such as our mmio register access, the empirical
++ * evidence (esp. on Braswell) suggests that the WC write into memory
++ * may not be visible to the HW prior to the completion of the UC
++ * register write and that we may begin execution from the context
++ * before its image is complete leading to invalid PD chasing.
++ */
++ wmb();
+ return ce->lrc_desc;
+ }
+
--- /dev/null
+From f42f343887016330b321dd40eebc68c7292e4f1b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 29 Oct 2018 16:00:31 +0200
+Subject: drm/i915: Fix error handling for the NV12 fb dimensions check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit f42f343887016330b321dd40eebc68c7292e4f1b upstream.
+
+Let's not leak obj->framebuffer_references when we decide that
+the framebuffer domensions are not suitable for NV12.
+
+Cc: stable@vger.kernel.org
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Vidya Srinivas <vidya.srinivas@intel.com>
+Fixes: e44134f2673c ("drm/i915: Add NV12 support to intel_framebuffer_init")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181029140031.11765-1-ville.syrjala@linux.intel.com
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+(cherry picked from commit 3b90946fcb6f13b65888c380461793a9dea9d1f4)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -14383,7 +14383,7 @@ static int intel_framebuffer_init(struct
+ fb->height < SKL_MIN_YUV_420_SRC_H ||
+ (fb->width % 4) != 0 || (fb->height % 4) != 0)) {
+ DRM_DEBUG_KMS("src dimensions not correct for NV12\n");
+- return -EINVAL;
++ goto err;
+ }
+
+ for (i = 0; i < fb->format->num_planes; i++) {
--- /dev/null
+From df5e31c204b34e8d9e5ec33f5b28e960c4f25e14 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 25 Oct 2018 16:05:36 +0300
+Subject: drm/i915: Fix ilk+ watermarks when disabling pipes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit df5e31c204b34e8d9e5ec33f5b28e960c4f25e14 upstream.
+
+We're no longer programming any watermarks when we're disabling
+a pipe. That means ilk_wm_merge() & co. will keep considering
+the any pipe that is getting disabled as still enabled. Thus we
+either get no LP1+ watermakrs (ilk-ivb), or we get suboptimal
+ones (hsw-bdw).
+
+This seems to have been broken by commit b6b178a77210 ("drm/i915:
+Calculate ironlake intermediate watermarks correctly, v2."). Before
+that we apparently had some difference between the intermediate
+and optimal watermarks and so we would program the optiomal ones.
+Now intermediate and optimal are identical for disabled pipes
+and so we don't program either.
+
+Fix this by programming the intermediate watermarks even for
+disabled pipes. We were already doing that for skl+. We'll
+leave out gmch platforms for now since those do the merging
+in a different manner and should work as is. We'll want to
+unify this eventually, but play it safe for now and just put
+in a FIXME.
+
+Cc: stable@vger.kernel.org
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Fixes: b6b178a77210 ("drm/i915: Calculate ironlake intermediate watermarks correctly, v2.")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181025130536.29024-1-ville.syrjala@linux.intel.com
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> #irc
+(cherry picked from commit a748faea3bfd7fd1d1485bc1c426c7d460cc6503)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -12509,17 +12509,12 @@ static void intel_atomic_commit_tail(str
+ intel_check_cpu_fifo_underruns(dev_priv);
+ intel_check_pch_fifo_underruns(dev_priv);
+
+- if (!new_crtc_state->active) {
+- /*
+- * Make sure we don't call initial_watermarks
+- * for ILK-style watermark updates.
+- *
+- * No clue what this is supposed to achieve.
+- */
+- if (INTEL_GEN(dev_priv) >= 9)
+- dev_priv->display.initial_watermarks(intel_state,
+- to_intel_crtc_state(new_crtc_state));
+- }
++ /* FIXME unify this for all platforms */
++ if (!new_crtc_state->active &&
++ !HAS_GMCH_DISPLAY(dev_priv) &&
++ dev_priv->display.initial_watermarks)
++ dev_priv->display.initial_watermarks(intel_state,
++ to_intel_crtc_state(new_crtc_state));
+ }
+ }
+
--- /dev/null
+From 7c4512300cfa5a4dcc8c1c52ae61e3fa4bd11a39 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Tue, 6 Nov 2018 16:30:12 -0500
+Subject: drm/i915: Fix possible race in intel_dp_add_mst_connector()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 7c4512300cfa5a4dcc8c1c52ae61e3fa4bd11a39 upstream.
+
+This hasn't caused any issues yet that I'm aware of, but as Ville
+Syrjälä pointed out - we need to make sure that
+intel_connector->mst_port is set before initializing MST connectors,
+since in theory we could potentially check intel_connector->mst_port in
+i915_hpd_poll_init_work() after registering the connector but before
+having written it's value.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20181106213017.14563-2-lyude@redhat.com
+(cherry picked from commit 66a5ab1034be801630816d1fa6cfc30db1a2f0b0)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp_mst.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -464,6 +464,10 @@ static struct drm_connector *intel_dp_ad
+ if (!intel_connector)
+ return NULL;
+
++ intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
++ intel_connector->mst_port = intel_dp;
++ intel_connector->port = port;
++
+ connector = &intel_connector->base;
+ ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs,
+ DRM_MODE_CONNECTOR_DisplayPort);
+@@ -474,10 +478,6 @@ static struct drm_connector *intel_dp_ad
+
+ drm_connector_helper_add(connector, &intel_dp_mst_connector_helper_funcs);
+
+- intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
+- intel_connector->mst_port = intel_dp;
+- intel_connector->port = port;
+-
+ for_each_pipe(dev_priv, pipe) {
+ struct drm_encoder *enc =
+ &intel_dp->mst_encoders[pipe]->base.base;
--- /dev/null
+From 6503493145cba4413ecd3d4d153faeef4a1e9b85 Mon Sep 17 00:00:00 2001
+From: Clint Taylor <clinton.a.taylor@intel.com>
+Date: Thu, 25 Oct 2018 11:52:00 -0700
+Subject: drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values
+
+From: Clint Taylor <clinton.a.taylor@intel.com>
+
+commit 6503493145cba4413ecd3d4d153faeef4a1e9b85 upstream.
+
+HDMI 2.0 594Mhz modes were incorrectly selecting 25.200Mhz Automatic N value
+mode instead of HDMI specification values.
+
+V2: Fix 88.2 Hz N value
+
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Clint Taylor <clinton.a.taylor@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1540493521-1746-2-git-send-email-clinton.a.taylor@intel.com
+(cherry picked from commit 5a400aa3c562c4a726b4da286e63c96db905ade1)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_audio.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_audio.c
++++ b/drivers/gpu/drm/i915/intel_audio.c
+@@ -134,6 +134,9 @@ static const struct {
+ /* HDMI N/CTS table */
+ #define TMDS_297M 297000
+ #define TMDS_296M 296703
++#define TMDS_594M 594000
++#define TMDS_593M 593407
++
+ static const struct {
+ int sample_rate;
+ int clock;
+@@ -154,6 +157,20 @@ static const struct {
+ { 176400, TMDS_297M, 18816, 247500 },
+ { 192000, TMDS_296M, 23296, 281250 },
+ { 192000, TMDS_297M, 20480, 247500 },
++ { 44100, TMDS_593M, 8918, 937500 },
++ { 44100, TMDS_594M, 9408, 990000 },
++ { 48000, TMDS_593M, 5824, 562500 },
++ { 48000, TMDS_594M, 6144, 594000 },
++ { 32000, TMDS_593M, 5824, 843750 },
++ { 32000, TMDS_594M, 3072, 445500 },
++ { 88200, TMDS_593M, 17836, 937500 },
++ { 88200, TMDS_594M, 18816, 990000 },
++ { 96000, TMDS_593M, 11648, 562500 },
++ { 96000, TMDS_594M, 12288, 594000 },
++ { 176400, TMDS_593M, 35672, 937500 },
++ { 176400, TMDS_594M, 37632, 990000 },
++ { 192000, TMDS_593M, 23296, 562500 },
++ { 192000, TMDS_594M, 24576, 594000 },
+ };
+
+ /* get AUD_CONFIG_PIXEL_CLOCK_HDMI_* value for mode */
--- /dev/null
+From ab0d6a141843e0b4b2709dfd37b53468b5452c3a Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri, 12 Oct 2018 15:02:28 +0100
+Subject: drm/i915: Large page offsets for pread/pwrite
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit ab0d6a141843e0b4b2709dfd37b53468b5452c3a upstream.
+
+Handle integer overflow when computing the sub-page length for shmem
+backed pread/pwrite.
+
+Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181012140228.29783-1-chris@chris-wilson.co.uk
+(cherry picked from commit a5e856a5348f6cd50889d125c40bbeec7328e466)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1112,11 +1112,7 @@ i915_gem_shmem_pread(struct drm_i915_gem
+ offset = offset_in_page(args->offset);
+ for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {
+ struct page *page = i915_gem_object_get_page(obj, idx);
+- int length;
+-
+- length = remain;
+- if (offset + length > PAGE_SIZE)
+- length = PAGE_SIZE - offset;
++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);
+
+ ret = shmem_pread(page, offset, length, user_data,
+ page_to_phys(page) & obj_do_bit17_swizzling,
+@@ -1562,11 +1558,7 @@ i915_gem_shmem_pwrite(struct drm_i915_ge
+ offset = offset_in_page(args->offset);
+ for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {
+ struct page *page = i915_gem_object_get_page(obj, idx);
+- int length;
+-
+- length = remain;
+- if (offset + length > PAGE_SIZE)
+- length = PAGE_SIZE - offset;
++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);
+
+ ret = shmem_pwrite(page, offset, length, user_data,
+ page_to_phys(page) & obj_do_bit17_swizzling,
--- /dev/null
+From 0014868b9c3c1dda1de6711cf58c3486fb422d07 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri, 2 Nov 2018 16:12:09 +0000
+Subject: drm/i915: Mark pin flags as u64
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 0014868b9c3c1dda1de6711cf58c3486fb422d07 upstream.
+
+Since the flags are being used to operate on a u64 variable, they too
+need to be marked as such so that the inverses are full width (and not
+zero extended on 32b kernels and bdw+).
+
+Reported-by: Sergii Romantsov <sergii.romantsov@globallogic.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: stable@vger.kernel.org
+Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181102161232.17742-2-chris@chris-wilson.co.uk
+(cherry picked from commit 83b466b1dc5f0b4d33f0a901e8b00197a8f3582d)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem_gtt.h | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.h
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.h
+@@ -627,20 +627,20 @@ int i915_gem_gtt_insert(struct i915_addr
+ u64 start, u64 end, unsigned int flags);
+
+ /* Flags used by pin/bind&friends. */
+-#define PIN_NONBLOCK BIT(0)
+-#define PIN_MAPPABLE BIT(1)
+-#define PIN_ZONE_4G BIT(2)
+-#define PIN_NONFAULT BIT(3)
+-#define PIN_NOEVICT BIT(4)
++#define PIN_NONBLOCK BIT_ULL(0)
++#define PIN_MAPPABLE BIT_ULL(1)
++#define PIN_ZONE_4G BIT_ULL(2)
++#define PIN_NONFAULT BIT_ULL(3)
++#define PIN_NOEVICT BIT_ULL(4)
+
+-#define PIN_MBZ BIT(5) /* I915_VMA_PIN_OVERFLOW */
+-#define PIN_GLOBAL BIT(6) /* I915_VMA_GLOBAL_BIND */
+-#define PIN_USER BIT(7) /* I915_VMA_LOCAL_BIND */
+-#define PIN_UPDATE BIT(8)
++#define PIN_MBZ BIT_ULL(5) /* I915_VMA_PIN_OVERFLOW */
++#define PIN_GLOBAL BIT_ULL(6) /* I915_VMA_GLOBAL_BIND */
++#define PIN_USER BIT_ULL(7) /* I915_VMA_LOCAL_BIND */
++#define PIN_UPDATE BIT_ULL(8)
+
+-#define PIN_HIGH BIT(9)
+-#define PIN_OFFSET_BIAS BIT(10)
+-#define PIN_OFFSET_FIXED BIT(11)
++#define PIN_HIGH BIT_ULL(9)
++#define PIN_OFFSET_BIAS BIT_ULL(10)
++#define PIN_OFFSET_FIXED BIT_ULL(11)
+ #define PIN_OFFSET_MASK (-I915_GTT_PAGE_SIZE)
+
+ #endif
--- /dev/null
+From 7cada4d0b7a0fb813dbc9777fec092e9ed0546e9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 3 Oct 2018 17:49:51 +0300
+Subject: drm/i915: Restore vblank interrupts earlier
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 7cada4d0b7a0fb813dbc9777fec092e9ed0546e9 upstream.
+
+Plane sanitation needs vblank interrupts (on account of CxSR disable).
+So let's restore vblank interrupts earlier.
+
+v2: Make it actually build
+v3: Add comment to explain why we need this (Daniel)
+
+Cc: stable@vger.kernel.org
+Cc: Dennis <dennis.nezic@utoronto.ca>
+Tested-by: Dennis <dennis.nezic@utoronto.ca>
+Tested-by: Peter Nowee <peter.nowee@gmail.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105637
+Fixes: b1e01595a66d ("drm/i915: Redo plane sanitation during readout")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181003144951.4397-1-ville.syrjala@linux.intel.com
+(cherry picked from commit 68bc30deac625b8be8d3950b30dc93d09a3645f5)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -15216,13 +15216,9 @@ static void intel_sanitize_crtc(struct i
+ I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
+ }
+
+- /* restore vblank interrupts to correct state */
+- drm_crtc_vblank_reset(&crtc->base);
+ if (crtc->active) {
+ struct intel_plane *plane;
+
+- drm_crtc_vblank_on(&crtc->base);
+-
+ /* Disable everything but the primary plane */
+ for_each_intel_plane_on_crtc(dev, crtc, plane) {
+ const struct intel_plane_state *plane_state =
+@@ -15549,7 +15545,6 @@ intel_modeset_setup_hw_state(struct drm_
+ struct drm_modeset_acquire_ctx *ctx)
+ {
+ struct drm_i915_private *dev_priv = to_i915(dev);
+- enum pipe pipe;
+ struct intel_crtc *crtc;
+ struct intel_encoder *encoder;
+ int i;
+@@ -15560,15 +15555,23 @@ intel_modeset_setup_hw_state(struct drm_
+ /* HW state is read out, now we need to sanitize this mess. */
+ get_encoder_power_domains(dev_priv);
+
+- intel_sanitize_plane_mapping(dev_priv);
++ /*
++ * intel_sanitize_plane_mapping() may need to do vblank
++ * waits, so we need vblank interrupts restored beforehand.
++ */
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
++ drm_crtc_vblank_reset(&crtc->base);
+
+- for_each_intel_encoder(dev, encoder) {
+- intel_sanitize_encoder(encoder);
++ if (crtc->active)
++ drm_crtc_vblank_on(&crtc->base);
+ }
+
+- for_each_pipe(dev_priv, pipe) {
+- crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
++ intel_sanitize_plane_mapping(dev_priv);
++
++ for_each_intel_encoder(dev, encoder)
++ intel_sanitize_encoder(encoder);
+
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
+ intel_sanitize_crtc(crtc, ctx);
+ intel_dump_pipe_config(crtc, crtc->config,
+ "[setup_hw_state]");
--- /dev/null
+From fb5bbae9b1333d44023713946fdd28db0cd85751 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 5 Nov 2018 09:43:05 +0000
+Subject: drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit fb5bbae9b1333d44023713946fdd28db0cd85751 upstream.
+
+Exercising the gpu reloc path strenuously revealed an issue where the
+updated relocations (from MI_STORE_DWORD_IMM) were not being observed
+upon execution. After some experiments with adding pipecontrols (a lot
+of pipecontrols (32) as gen4/5 do not have a bit to wait on earlier pipe
+controls or even the current on), it was discovered that we merely
+needed to delay the EMIT_INVALIDATE by several flushes. It is important
+to note that it is the EMIT_INVALIDATE as opposed to the EMIT_FLUSH that
+needs the delay as opposed to what one might first expect -- that the
+delay is required for the TLB invalidation to take effect (one presumes
+to purge any CS buffers) as opposed to a delay after flushing to ensure
+the writes have landed before triggering invalidation.
+
+Testcase: igt/gem_tiled_fence_blits
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: stable@vger.kernel.org
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181105094305.5767-1-chris@chris-wilson.co.uk
+(cherry picked from commit 55f99bf2a9c331838c981694bc872cd1ec4070b2)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 38 ++++++++++++++++++++++++++++++--
+ 1 file changed, 36 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -91,6 +91,7 @@ static int
+ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
+ {
+ u32 cmd, *cs;
++ int i;
+
+ /*
+ * read/write caches:
+@@ -127,12 +128,45 @@ gen4_render_ring_flush(struct i915_reque
+ cmd |= MI_INVALIDATE_ISP;
+ }
+
+- cs = intel_ring_begin(rq, 2);
++ i = 2;
++ if (mode & EMIT_INVALIDATE)
++ i += 20;
++
++ cs = intel_ring_begin(rq, i);
+ if (IS_ERR(cs))
+ return PTR_ERR(cs);
+
+ *cs++ = cmd;
+- *cs++ = MI_NOOP;
++
++ /*
++ * A random delay to let the CS invalidate take effect? Without this
++ * delay, the GPU relocation path fails as the CS does not see
++ * the updated contents. Just as important, if we apply the flushes
++ * to the EMIT_FLUSH branch (i.e. immediately after the relocation
++ * write and before the invalidate on the next batch), the relocations
++ * still fail. This implies that is a delay following invalidation
++ * that is required to reset the caches as opposed to a delay to
++ * ensure the memory is written.
++ */
++ if (mode & EMIT_INVALIDATE) {
++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
++ *cs++ = i915_ggtt_offset(rq->engine->scratch) |
++ PIPE_CONTROL_GLOBAL_GTT;
++ *cs++ = 0;
++ *cs++ = 0;
++
++ for (i = 0; i < 12; i++)
++ *cs++ = MI_FLUSH;
++
++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
++ *cs++ = i915_ggtt_offset(rq->engine->scratch) |
++ PIPE_CONTROL_GLOBAL_GTT;
++ *cs++ = 0;
++ *cs++ = 0;
++ }
++
++ *cs++ = cmd;
++
+ intel_ring_advance(rq, cs);
+
+ return 0;
--- /dev/null
+From c02ba4ef16eefe663fdefcccaa57fad32d5481bf Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 8 Oct 2018 19:24:33 -0400
+Subject: drm/i915: Skip vcpi allocation for MSTB ports that are gone
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit c02ba4ef16eefe663fdefcccaa57fad32d5481bf upstream.
+
+Since we need to be able to allow DPMS on->off prop changes after an MST
+port has disappeared from the system, we need to be able to make sure we
+can compute a config for the resulting atomic commit. Currently this is
+impossible when the port has disappeared, since the VCPI slot searching
+we try to do in intel_dp_mst_compute_config() will fail with -EINVAL.
+
+Since the only commits we want to allow on no-longer-present MST ports
+are ones that shut off display hardware, we already know that no VCPI
+allocations are needed. So, hardcode the VCPI slot count to 0 when
+intel_dp_mst_compute_config() is called on an MST port that's gone.
+
+Changes since V4:
+- Don't use mst_port_gone at all, just check whether or not the drm
+ connector is registered - Daniel Vetter
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: stable@vger.kernel.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-5-lyude@redhat.com
+(cherry picked from commit f67207d78ceaf98b7531bc22df6f21328559c8d4)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp_mst.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -38,11 +38,11 @@ static bool intel_dp_mst_compute_config(
+ struct intel_dp_mst_encoder *intel_mst = enc_to_mst(&encoder->base);
+ struct intel_digital_port *intel_dig_port = intel_mst->primary;
+ struct intel_dp *intel_dp = &intel_dig_port->dp;
+- struct intel_connector *connector =
+- to_intel_connector(conn_state->connector);
++ struct drm_connector *connector = conn_state->connector;
++ void *port = to_intel_connector(connector)->port;
+ struct drm_atomic_state *state = pipe_config->base.state;
+ int bpp;
+- int lane_count, slots;
++ int lane_count, slots = 0;
+ const struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
+ int mst_pbn;
+ bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
+@@ -70,17 +70,23 @@ static bool intel_dp_mst_compute_config(
+
+ pipe_config->port_clock = intel_dp_max_link_rate(intel_dp);
+
+- if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, connector->port))
++ if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, port))
+ pipe_config->has_audio = true;
+
+ mst_pbn = drm_dp_calc_pbn_mode(adjusted_mode->crtc_clock, bpp);
+ pipe_config->pbn = mst_pbn;
+
+- slots = drm_dp_atomic_find_vcpi_slots(state, &intel_dp->mst_mgr,
+- connector->port, mst_pbn);
+- if (slots < 0) {
+- DRM_DEBUG_KMS("failed finding vcpi slots:%d\n", slots);
+- return false;
++ /* Zombie connectors can't have VCPI slots */
++ if (READ_ONCE(connector->registered)) {
++ slots = drm_dp_atomic_find_vcpi_slots(state,
++ &intel_dp->mst_mgr,
++ port,
++ mst_pbn);
++ if (slots < 0) {
++ DRM_DEBUG_KMS("failed finding vcpi slots:%d\n",
++ slots);
++ return false;
++ }
+ }
+
+ intel_link_compute_m_n(bpp, lane_count,
--- /dev/null
+From f9a7082327e26f54067a49cac2316d31e0cc8ba7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:47 +0200
+Subject: drm/msm: fix OF child-node lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit f9a7082327e26f54067a49cac2316d31e0cc8ba7 upstream.
+
+Use the new of_get_compatible_child() helper to lookup the legacy
+pwrlevels child node instead of using of_find_compatible_node(), which
+searches the entire tree from a given start node and thus can return an
+unrelated (i.e. non-child) node.
+
+This also addresses a potential use-after-free (e.g. after probe
+deferral) as the tree-wide helper drops a reference to its first
+argument (i.e. the probed device's node).
+
+While at it, also fix the related child-node reference leak.
+
+Fixes: e2af8b6b0ca1 ("drm/msm: gpu: Use OPP tables if we can")
+Cc: stable <stable@vger.kernel.org> # 4.12
+Cc: Jordan Crouse <jcrouse@codeaurora.org>
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: David Airlie <airlied@linux.ie>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -477,8 +477,7 @@ static int adreno_get_legacy_pwrlevels(s
+ struct device_node *child, *node;
+ int ret;
+
+- node = of_find_compatible_node(dev->of_node, NULL,
+- "qcom,gpu-pwrlevels");
++ node = of_get_compatible_child(dev->of_node, "qcom,gpu-pwrlevels");
+ if (!node) {
+ dev_err(dev, "Could not find the GPU powerlevels\n");
+ return -ENXIO;
+@@ -499,6 +498,8 @@ static int adreno_get_legacy_pwrlevels(s
+ dev_pm_opp_add(dev, val, 0);
+ }
+
++ of_node_put(node);
++
+ return 0;
+ }
+
--- /dev/null
+From dc854914999d5d52ac1b31740cb0ea8d89d0372e Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Thu, 6 Sep 2018 17:43:21 -0400
+Subject: drm/nouveau: Check backlight IDs are >= 0, not > 0
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit dc854914999d5d52ac1b31740cb0ea8d89d0372e upstream.
+
+Remember, ida IDs start at 0, not 1!
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Karol Herbst <kherbst@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_backlight.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
+@@ -116,7 +116,7 @@ nv40_backlight_init(struct drm_connector
+ &nv40_bl_ops, &props);
+
+ if (IS_ERR(bd)) {
+- if (bl_connector.id > 0)
++ if (bl_connector.id >= 0)
+ ida_simple_remove(&bl_ida, bl_connector.id);
+ return PTR_ERR(bd);
+ }
+@@ -249,7 +249,7 @@ nv50_backlight_init(struct drm_connector
+ nv_encoder, ops, &props);
+
+ if (IS_ERR(bd)) {
+- if (bl_connector.id > 0)
++ if (bl_connector.id >= 0)
+ ida_simple_remove(&bl_ida, bl_connector.id);
+ return PTR_ERR(bd);
+ }
--- /dev/null
+From 7b0f61e91b6056c71649efa3204112a4b6cf5fc8 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 8 Oct 2018 19:24:31 -0400
+Subject: drm/nouveau: Fix nv50_mstc->best_encoder()
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 7b0f61e91b6056c71649efa3204112a4b6cf5fc8 upstream.
+
+As mentioned in the previous commit, we currently prevent new modesets
+on recently-removed MST connectors by returning no encoder from our
+->best_encoder() callback once the MST port has disappeared. This is
+wrong however, because it prevents legacy modesetting users from being
+able to disable CRTCs on MST connectors after the connector's respective
+topology has disappeared.
+
+So, fix this by instead by just always returning a valid encoder.
+
+Changes since v2:
+- Remove usage of atomic MST helper for now, since that got replaced
+ with a much simpler solution
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
+Cc: stable@vger.kernel.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-3-lyude@redhat.com
+(cherry picked from commit e87b0bbc9f0380d403f8f2f6abba0d51c74d944f)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/dispnv50/disp.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -818,22 +818,16 @@ nv50_mstc_atomic_best_encoder(struct drm
+ {
+ struct nv50_head *head = nv50_head(connector_state->crtc);
+ struct nv50_mstc *mstc = nv50_mstc(connector);
+- if (mstc->port) {
+- struct nv50_mstm *mstm = mstc->mstm;
+- return &mstm->msto[head->base.index]->encoder;
+- }
+- return NULL;
++
++ return &mstc->mstm->msto[head->base.index]->encoder;
+ }
+
+ static struct drm_encoder *
+ nv50_mstc_best_encoder(struct drm_connector *connector)
+ {
+ struct nv50_mstc *mstc = nv50_mstc(connector);
+- if (mstc->port) {
+- struct nv50_mstm *mstm = mstc->mstm;
+- return &mstm->msto[0]->encoder;
+- }
+- return NULL;
++
++ return &mstc->mstm->msto[0]->encoder;
+ }
+
+ static enum drm_mode_status
--- /dev/null
+From 0e8afefd5da4875ddea9aa4ad17a2540a2bf9736 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 12 Oct 2018 12:16:10 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003)
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 0e8afefd5da4875ddea9aa4ad17a2540a2bf9736 upstream.
+
+The Acer One 10 uses a clamshell design with a detachable keyboard.
+As such in normal operating mode, with the keyboard attach the device
+is in landscape mode (and the Acer logo at boot also shows in landscape
+mode).
+
+But the device uses a portrait screen rotated 90 degrees (sigh). This
+commit adds a quirk for this device so that we shown the fbcon the
+right way up and that we hint userspace to also show e.g. plymouth and
+gdm the right way up.
+
+Cc: stable@vger.kernel.org
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181012101610.29100-1-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -30,6 +30,12 @@ struct drm_dmi_panel_orientation_data {
+ int orientation;
+ };
+
++static const struct drm_dmi_panel_orientation_data acer_s1003 = {
++ .width = 800,
++ .height = 1280,
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data asus_t100ha = {
+ .width = 800,
+ .height = 1280,
+@@ -67,7 +73,13 @@ static const struct drm_dmi_panel_orient
+ };
+
+ static const struct dmi_system_id orientation_data[] = {
+- { /* Asus T100HA */
++ { /* Acer One 10 (S1003) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"),
++ },
++ .driver_data = (void *)&acer_s1003,
++ }, { /* Asus T100HA */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"),
--- /dev/null
+From 7f3ef5dedb146e3d5063b6845781ad1bb59b92b5 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Sun, 5 Aug 2018 13:48:07 +0100
+Subject: drm/rockchip: Allow driver to be shutdown on reboot/kexec
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+commit 7f3ef5dedb146e3d5063b6845781ad1bb59b92b5 upstream.
+
+Leaving the DRM driver enabled on reboot or kexec has the annoying
+effect of leaving the display generating transactions whilst the
+IOMMU has been shut down.
+
+In turn, the IOMMU driver (which shares its interrupt line with
+the VOP) starts warning either on shutdown or when entering the
+secondary kernel in the kexec case (nothing is expected on that
+front).
+
+A cheap way of ensuring that things are nicely shut down is to
+register a shutdown callback in the platform driver.
+
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Tested-by: Vicente Bergas <vicencb@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180805124807.18169-1-marc.zyngier@arm.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+@@ -442,6 +442,11 @@ static int rockchip_drm_platform_remove(
+ return 0;
+ }
+
++static void rockchip_drm_platform_shutdown(struct platform_device *pdev)
++{
++ rockchip_drm_platform_remove(pdev);
++}
++
+ static const struct of_device_id rockchip_drm_dt_ids[] = {
+ { .compatible = "rockchip,display-subsystem", },
+ { /* sentinel */ },
+@@ -451,6 +456,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_
+ static struct platform_driver rockchip_drm_platform_driver = {
+ .probe = rockchip_drm_platform_probe,
+ .remove = rockchip_drm_platform_remove,
++ .shutdown = rockchip_drm_platform_shutdown,
+ .driver = {
+ .name = "rockchip-drm",
+ .of_match_table = rockchip_drm_dt_ids,
--- /dev/null
+From 72a58a63a164b4e9d2d914e65caeb551846883f1 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Wed, 14 Nov 2018 09:55:42 -0800
+Subject: efi/arm/libstub: Pack FDT after populating it
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit 72a58a63a164b4e9d2d914e65caeb551846883f1 upstream.
+
+Commit:
+
+ 24d7c494ce46 ("efi/arm-stub: Round up FDT allocation to mapping size")
+
+increased the allocation size for the FDT image created by the stub to a
+fixed value of 2 MB, to simplify the former code that made several
+attempts with increasing values for the size. This is reasonable
+given that the allocation is of type EFI_LOADER_DATA, which is released
+to the kernel unless it is explicitly memblock_reserve()d by the early
+boot code.
+
+However, this allocation size leaked into the 'size' field of the FDT
+header metadata, and so the entire allocation remains occupied by the
+device tree binary, even if most of it is not used to store device tree
+information.
+
+So call fdt_pack() to shrink the FDT data structure to its minimum size
+after populating all the fields, so that the remaining memory is no
+longer wasted.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: <stable@vger.kernel.org> # v4.12+
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Fixes: 24d7c494ce46 ("efi/arm-stub: Round up FDT allocation to mapping size")
+Link: http://lkml.kernel.org/r/20181114175544.12860-4-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firmware/efi/libstub/fdt.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/firmware/efi/libstub/fdt.c
++++ b/drivers/firmware/efi/libstub/fdt.c
+@@ -158,6 +158,10 @@ static efi_status_t update_fdt(efi_syste
+ return efi_status;
+ }
+ }
++
++ /* shrink the FDT back to its minimum size */
++ fdt_pack(fdt);
++
+ return EFI_SUCCESS;
+
+ fdt_set_fail:
lib-ubsan.c-don-t-mark-__ubsan_handle_builtin_unreachable-as-noreturn.patch
hugetlbfs-fix-kernel-bug-at-fs-hugetlbfs-inode.c-444.patch
mm-swapfile.c-use-kvzalloc-for-swap_info_struct-allocation.patch
+efi-arm-libstub-pack-fdt-after-populating-it.patch
+drm-rockchip-allow-driver-to-be-shutdown-on-reboot-kexec.patch
+drm-msm-fix-of-child-node-lookup.patch
+drm-amdgpu-fix-typo-in-amdgpu_vmid_mgr_init.patch
+drm-amdgpu-add-missing-chip_hainan-in-amdgpu_ucode_get_load_type.patch
+drm-nouveau-check-backlight-ids-are-0-not-0.patch
+drm-nouveau-fix-nv50_mstc-best_encoder.patch
+drm-amd-powerplay-enable-disable-nbpstate-on-on-off-of-uvd.patch
+drm-etnaviv-fix-bogus-fence-complete-check-in-timeout-handler.patch
+drm-dp_mst-check-if-primary-mstb-is-null.patch
+drm-atomic_helper-disallow-new-modesets-on-unregistered-connectors.patch
+drm-panel-orientation-quirks-add-quirk-for-acer-one-10-s1003.patch
+drm-i915-dp-link-train-fallback-on-edp-only-if-fallback-link-bw-can-fit-panel-s-native-mode.patch
+drm-i915-restore-vblank-interrupts-earlier.patch
+drm-i915-don-t-unset-intel_connector-mst_port.patch
+drm-i915-skip-vcpi-allocation-for-mstb-ports-that-are-gone.patch
+drm-i915-large-page-offsets-for-pread-pwrite.patch
+drm-i915-dp-fix-link-retraining-comment-in-intel_dp_long_pulse.patch
+drm-i915-dp-restrict-link-retrain-workaround-to-external-monitors.patch
+drm-i915-hdmi-add-hdmi-2.0-audio-clock-recovery-n-values.patch
+drm-i915-fix-error-handling-for-the-nv12-fb-dimensions-check.patch
+drm-i915-fix-ilk-watermarks-when-disabling-pipes.patch
+drm-i915-compare-user-s-64b-gtt-offset-even-on-32b.patch
+drm-i915-don-t-oops-during-modeset-shutdown-after-lpe-audio-deinit.patch
+drm-i915-mark-pin-flags-as-u64.patch
+drm-i915-ringbuffer-delay-after-emit_invalidate-for-gen4-gen5.patch
+drm-i915-execlists-force-write-serialisation-into-context-image-vs-execution.patch
+drm-i915-fix-possible-race-in-intel_dp_add_mst_connector.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
