--- /dev/null
+From ef99a60ffd9b918354e038bc5e61f007ff7e901d Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Sun, 17 Jan 2021 09:30:15 +0000
+Subject: drm/i915/gt: Clear CACHE_MODE prior to clearing residuals
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit ef99a60ffd9b918354e038bc5e61f007ff7e901d upstream.
+
+Since we do a bare context switch with no restore, the clear residual
+kernel runs on dirty state, and we must be careful to avoid executing
+with bad state from context registers inherited from a malicious client.
+
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2955
+Fixes: 09aa9e45863e ("drm/i915/gt: Restore clear-residual mitigations for Ivybridge, Baytrail")
+Testcase: igt/gem_ctx_isolation # ivb,vlv
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+Reviewed-by: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210117093015.29143-1-chris@chris-wilson.co.uk
+(cherry picked from commit ace44e13e577c2ae59980e9a6ff5ca253b1cf831)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gt/gen7_renderclear.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c
++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c
+@@ -390,6 +390,16 @@ static void emit_batch(struct i915_vma *
+ &cb_kernel_ivb,
+ desc_count);
+
++ /* Reset inherited context registers */
++ gen7_emit_pipeline_invalidate(&cmds);
++ batch_add(&cmds, MI_LOAD_REGISTER_IMM(2));
++ batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_0_GEN7));
++ batch_add(&cmds, 0xffff0000);
++ batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_1));
++ batch_add(&cmds, 0xffff0000 | PIXEL_SUBSPAN_COLLECT_OPT_DISABLE);
++ gen7_emit_pipeline_flush(&cmds);
++
++ /* Switch to the media pipeline and our base address */
+ gen7_emit_pipeline_invalidate(&cmds);
+ batch_add(&cmds, PIPELINE_SELECT | PIPELINE_SELECT_MEDIA);
+ batch_add(&cmds, MI_NOOP);
+@@ -399,9 +409,11 @@ static void emit_batch(struct i915_vma *
+ gen7_emit_state_base_address(&cmds, descriptors);
+ gen7_emit_pipeline_invalidate(&cmds);
+
++ /* Set the clear-residual kernel state */
+ gen7_emit_vfe_state(&cmds, bv, urb_size - 1, 0, 0);
+ gen7_emit_interface_descriptor_load(&cmds, descriptors, desc_count);
+
++ /* Execute the kernel on all HW threads */
+ for (i = 0; i < num_primitives(bv); i++)
+ gen7_emit_media_object(&cmds, i);
+
--- /dev/null
+From 171a8e99828144050015672016dd63494c6d200a Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Date: Mon, 18 Jan 2021 10:07:24 +0000
+Subject: drm/i915/pmu: Don't grab wakeref when enabling events
+
+From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+
+commit 171a8e99828144050015672016dd63494c6d200a upstream.
+
+Chris found a CI report which points out calling intel_runtime_pm_get from
+inside i915_pmu_enable hook is not allowed since it can be invoked from
+hard irq context. This is something we knew but forgot, so lets fix it
+once again.
+
+We do this by syncing the internal book keeping with hardware rc6 counter
+on driver load.
+
+v2:
+ * Always sync on parking and fully sync on init.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Fixes: f4e9894b6952 ("drm/i915/pmu: Correct the rc6 offset upon enabling")
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201214094349.3563876-1-tvrtko.ursulin@linux.intel.com
+(cherry picked from commit dbe13ae1d6abaab417edf3c37601c6a56594a4cd)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210118100724.465555-1-chris@chris-wilson.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_pmu.c | 30 ++++++++++++++++--------------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_pmu.c
++++ b/drivers/gpu/drm/i915/i915_pmu.c
+@@ -184,13 +184,24 @@ static u64 get_rc6(struct intel_gt *gt)
+ return val;
+ }
+
+-static void park_rc6(struct drm_i915_private *i915)
++static void init_rc6(struct i915_pmu *pmu)
+ {
+- struct i915_pmu *pmu = &i915->pmu;
++ struct drm_i915_private *i915 = container_of(pmu, typeof(*i915), pmu);
++ intel_wakeref_t wakeref;
+
+- if (pmu->enable & config_enabled_mask(I915_PMU_RC6_RESIDENCY))
++ with_intel_runtime_pm(i915->gt.uncore->rpm, wakeref) {
+ pmu->sample[__I915_SAMPLE_RC6].cur = __get_rc6(&i915->gt);
++ pmu->sample[__I915_SAMPLE_RC6_LAST_REPORTED].cur =
++ pmu->sample[__I915_SAMPLE_RC6].cur;
++ pmu->sleep_last = ktime_get();
++ }
++}
+
++static void park_rc6(struct drm_i915_private *i915)
++{
++ struct i915_pmu *pmu = &i915->pmu;
++
++ pmu->sample[__I915_SAMPLE_RC6].cur = __get_rc6(&i915->gt);
+ pmu->sleep_last = ktime_get();
+ }
+
+@@ -201,6 +212,7 @@ static u64 get_rc6(struct intel_gt *gt)
+ return __get_rc6(gt);
+ }
+
++static void init_rc6(struct i915_pmu *pmu) { }
+ static void park_rc6(struct drm_i915_private *i915) {}
+
+ #endif
+@@ -613,10 +625,8 @@ static void i915_pmu_enable(struct perf_
+ container_of(event->pmu, typeof(*i915), pmu.base);
+ unsigned int bit = event_enabled_bit(event);
+ struct i915_pmu *pmu = &i915->pmu;
+- intel_wakeref_t wakeref;
+ unsigned long flags;
+
+- wakeref = intel_runtime_pm_get(&i915->runtime_pm);
+ spin_lock_irqsave(&pmu->lock, flags);
+
+ /*
+@@ -627,13 +637,6 @@ static void i915_pmu_enable(struct perf_
+ GEM_BUG_ON(bit >= ARRAY_SIZE(pmu->enable_count));
+ GEM_BUG_ON(pmu->enable_count[bit] == ~0);
+
+- if (pmu->enable_count[bit] == 0 &&
+- config_enabled_mask(I915_PMU_RC6_RESIDENCY) & BIT_ULL(bit)) {
+- pmu->sample[__I915_SAMPLE_RC6_LAST_REPORTED].cur = 0;
+- pmu->sample[__I915_SAMPLE_RC6].cur = __get_rc6(&i915->gt);
+- pmu->sleep_last = ktime_get();
+- }
+-
+ pmu->enable |= BIT_ULL(bit);
+ pmu->enable_count[bit]++;
+
+@@ -674,8 +677,6 @@ static void i915_pmu_enable(struct perf_
+ * an existing non-zero value.
+ */
+ local64_set(&event->hw.prev_count, __i915_pmu_event_read(event));
+-
+- intel_runtime_pm_put(&i915->runtime_pm, wakeref);
+ }
+
+ static void i915_pmu_disable(struct perf_event *event)
+@@ -1101,6 +1102,7 @@ void i915_pmu_register(struct drm_i915_p
+ hrtimer_init(&pmu->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ pmu->timer.function = i915_sample;
+ pmu->cpuhp.slot = CPUHP_INVALID;
++ init_rc6(pmu);
+
+ if (!is_igp(i915)) {
+ pmu->name = kasprintf(GFP_KERNEL,