--- /dev/null
+From 215f0aaf021bdbf9dc426fc1209555f287e9017d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Sep 2020 20:03:11 -0600
+Subject: drm/msm: Enable expanded apriv support for a650
+
+From: Jordan Crouse <jcrouse@codeaurora.org>
+
+[ Upstream commit 604234f33658cdd72f686be405a99646b397d0b3 ]
+
+a650 supports expanded apriv support that allows us to map critical buffers
+(ringbuffer and memstore) as as privileged to protect them from corruption.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 6 +++++-
+ drivers/gpu/drm/msm/msm_gpu.c | 2 +-
+ drivers/gpu/drm/msm/msm_gpu.h | 11 +++++++++++
+ drivers/gpu/drm/msm/msm_ringbuffer.c | 4 ++--
+ 4 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index b7dc350d96fc8..ee99cdeb449ca 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -541,7 +541,8 @@ static int a6xx_hw_init(struct msm_gpu *gpu)
+ A6XX_PROTECT_RDONLY(0x980, 0x4));
+ gpu_write(gpu, REG_A6XX_CP_PROTECT(25), A6XX_PROTECT_RW(0xa630, 0x0));
+
+- if (adreno_is_a650(adreno_gpu)) {
++ /* Enable expanded apriv for targets that support it */
++ if (gpu->hw_apriv) {
+ gpu_write(gpu, REG_A6XX_CP_APRIV_CNTL,
+ (1 << 6) | (1 << 5) | (1 << 3) | (1 << 2) | (1 << 1));
+ }
+@@ -926,6 +927,9 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
+ adreno_gpu->registers = NULL;
+ adreno_gpu->reg_offsets = a6xx_register_offsets;
+
++ if (adreno_is_a650(adreno_gpu))
++ adreno_gpu->base.hw_apriv = true;
++
+ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
+ if (ret) {
+ a6xx_destroy(&(a6xx_gpu->base.base));
+diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
+index a22d306223068..9b839d6f4692a 100644
+--- a/drivers/gpu/drm/msm/msm_gpu.c
++++ b/drivers/gpu/drm/msm/msm_gpu.c
+@@ -905,7 +905,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+
+ memptrs = msm_gem_kernel_new(drm,
+ sizeof(struct msm_rbmemptrs) * nr_rings,
+- MSM_BO_UNCACHED, gpu->aspace, &gpu->memptrs_bo,
++ check_apriv(gpu, MSM_BO_UNCACHED), gpu->aspace, &gpu->memptrs_bo,
+ &memptrs_iova);
+
+ if (IS_ERR(memptrs)) {
+diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
+index 429cb40f79315..f22e0f67ba40e 100644
+--- a/drivers/gpu/drm/msm/msm_gpu.h
++++ b/drivers/gpu/drm/msm/msm_gpu.h
+@@ -14,6 +14,7 @@
+ #include "msm_drv.h"
+ #include "msm_fence.h"
+ #include "msm_ringbuffer.h"
++#include "msm_gem.h"
+
+ struct msm_gem_submit;
+ struct msm_gpu_perfcntr;
+@@ -138,6 +139,8 @@ struct msm_gpu {
+ } devfreq;
+
+ struct msm_gpu_state *crashstate;
++ /* True if the hardware supports expanded apriv (a650 and newer) */
++ bool hw_apriv;
+ };
+
+ /* It turns out that all targets use the same ringbuffer size */
+@@ -326,4 +329,12 @@ static inline void msm_gpu_crashstate_put(struct msm_gpu *gpu)
+ mutex_unlock(&gpu->dev->struct_mutex);
+ }
+
++/*
++ * Simple macro to semi-cleanly add the MAP_PRIV flag for targets that can
++ * support expanded privileges
++ */
++#define check_apriv(gpu, flags) \
++ (((gpu)->hw_apriv ? MSM_BO_MAP_PRIV : 0) | (flags))
++
++
+ #endif /* __MSM_GPU_H__ */
+diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c
+index 39ecb5a18431e..935bf9b1d9418 100644
+--- a/drivers/gpu/drm/msm/msm_ringbuffer.c
++++ b/drivers/gpu/drm/msm/msm_ringbuffer.c
+@@ -27,8 +27,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int id,
+ ring->id = id;
+
+ ring->start = msm_gem_kernel_new(gpu->dev, MSM_GPU_RINGBUFFER_SZ,
+- MSM_BO_WC | MSM_BO_GPU_READONLY, gpu->aspace, &ring->bo,
+- &ring->iova);
++ check_apriv(gpu, MSM_BO_WC | MSM_BO_GPU_READONLY),
++ gpu->aspace, &ring->bo, &ring->iova);
+
+ if (IS_ERR(ring->start)) {
+ ret = PTR_ERR(ring->start);
+--
+2.25.1
+
--- /dev/null
+From 4eb7789ae140e691cf4e87db73c7ebc398bcf5d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Aug 2020 09:23:09 -0700
+Subject: drm/msm/gpu: make ringbuffer readonly
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 352c83fb39cae3eff95a8e1ed23006291abb6196 ]
+
+The GPU has no business writing into the ringbuffer, let's make it
+readonly to the GPU.
+
+Fixes: 7198e6b03155 ("drm/msm: add a3xx gpu support")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_ringbuffer.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c
+index e397c44cc0112..39ecb5a18431e 100644
+--- a/drivers/gpu/drm/msm/msm_ringbuffer.c
++++ b/drivers/gpu/drm/msm/msm_ringbuffer.c
+@@ -27,7 +27,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int id,
+ ring->id = id;
+
+ ring->start = msm_gem_kernel_new(gpu->dev, MSM_GPU_RINGBUFFER_SZ,
+- MSM_BO_WC, gpu->aspace, &ring->bo, &ring->iova);
++ MSM_BO_WC | MSM_BO_GPU_READONLY, gpu->aspace, &ring->bo,
++ &ring->iova);
+
+ if (IS_ERR(ring->start)) {
+ ret = PTR_ERR(ring->start);
+--
+2.25.1
+