--- /dev/null
+From d89f6048bdcb6a56abb396c584747d5eeae650db Mon Sep 17 00:00:00 2001
+From: Harry Wentland <harry.wentland@amd.com>
+Date: Thu, 22 Apr 2021 19:10:52 -0400
+Subject: drm/amd/display: Reject non-zero src_y and src_x for video planes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+commit d89f6048bdcb6a56abb396c584747d5eeae650db upstream.
+
+[Why]
+This hasn't been well tested and leads to complete system hangs on DCN1
+based systems, possibly others.
+
+The system hang can be reproduced by gesturing the video on the YouTube
+Android app on ChromeOS into full screen.
+
+[How]
+Reject atomic commits with non-zero drm_plane_state.src_x or src_y values.
+
+v2:
+ - Add code comment describing the reason we're rejecting non-zero
+ src_x and src_y
+ - Drop gerrit Change-Id
+ - Add stable CC
+ - Based on amd-staging-drm-next
+
+v3: removed trailing whitespace
+
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Cc: stable@vger.kernel.org
+Cc: nicholas.kazlauskas@amd.com
+Cc: amd-gfx@lists.freedesktop.org
+Cc: alexander.deucher@amd.com
+Cc: Roman.Li@amd.com
+Cc: hersenxs.wu@amd.com
+Cc: danny.wang@amd.com
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3850,6 +3850,23 @@ static int fill_dc_scaling_info(const st
+ scaling_info->src_rect.x = state->src_x >> 16;
+ scaling_info->src_rect.y = state->src_y >> 16;
+
++ /*
++ * For reasons we don't (yet) fully understand a non-zero
++ * src_y coordinate into an NV12 buffer can cause a
++ * system hang. To avoid hangs (and maybe be overly cautious)
++ * let's reject both non-zero src_x and src_y.
++ *
++ * We currently know of only one use-case to reproduce a
++ * scenario with non-zero src_x and src_y for NV12, which
++ * is to gesture the YouTube Android app into full screen
++ * on ChromeOS.
++ */
++ if (state->fb &&
++ state->fb->format->format == DRM_FORMAT_NV12 &&
++ (scaling_info->src_rect.x != 0 ||
++ scaling_info->src_rect.y != 0))
++ return -EINVAL;
++
+ scaling_info->src_rect.width = state->src_w >> 16;
+ if (scaling_info->src_rect.width == 0)
+ return -EINVAL;
--- /dev/null
+From c83c4e1912446db697a120eb30126cd80cbf6349 Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Wed, 28 Apr 2021 12:00:20 +0800
+Subject: drm/amdgpu: add new MC firmware for Polaris12 32bit ASIC
+
+From: Evan Quan <evan.quan@amd.com>
+
+commit c83c4e1912446db697a120eb30126cd80cbf6349 upstream.
+
+Polaris12 32bit ASIC needs a special MC firmware.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+@@ -59,6 +59,7 @@ MODULE_FIRMWARE("amdgpu/tonga_mc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris11_mc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris10_mc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris12_mc.bin");
++MODULE_FIRMWARE("amdgpu/polaris12_32_mc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris11_k_mc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris10_k_mc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris12_k_mc.bin");
+@@ -243,10 +244,16 @@ static int gmc_v8_0_init_microcode(struc
+ chip_name = "polaris10";
+ break;
+ case CHIP_POLARIS12:
+- if (ASICID_IS_P23(adev->pdev->device, adev->pdev->revision))
++ if (ASICID_IS_P23(adev->pdev->device, adev->pdev->revision)) {
+ chip_name = "polaris12_k";
+- else
+- chip_name = "polaris12";
++ } else {
++ WREG32(mmMC_SEQ_IO_DEBUG_INDEX, ixMC_IO_DEBUG_UP_159);
++ /* Polaris12 32bit ASIC needs a special MC firmware */
++ if (RREG32(mmMC_SEQ_IO_DEBUG_DATA) == 0x05b4dc40)
++ chip_name = "polaris12_32";
++ else
++ chip_name = "polaris12";
++ }
+ break;
+ case CHIP_FIJI:
+ case CHIP_CARRIZO:
--- /dev/null
+From 20a5f5a98e1bb3d40acd97e89299e8c2d22784be Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 22 Apr 2021 13:11:39 +0200
+Subject: drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 20a5f5a98e1bb3d40acd97e89299e8c2d22784be upstream.
+
+Starting with Vega the hardware supports concurrent flushes
+of VMID which can be used to implement per process VMID
+allocation.
+
+But concurrent flushes are mutual exclusive with back to
+back VMID allocations, fix this to avoid a VMID used in
+two ways at the same time.
+
+v2: don't set ring to NULL
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: James Zhu <James.Zhu@amd.com>
+Tested-by: James Zhu <James.Zhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 19 +++++++++++--------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 1 +
+ 3 files changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+@@ -215,7 +215,11 @@ static int amdgpu_vmid_grab_idle(struct
+ /* Check if we have an idle VMID */
+ i = 0;
+ list_for_each_entry((*idle), &id_mgr->ids_lru, list) {
+- fences[i] = amdgpu_sync_peek_fence(&(*idle)->active, ring);
++ /* Don't use per engine and per process VMID at the same time */
++ struct amdgpu_ring *r = adev->vm_manager.concurrent_flush ?
++ NULL : ring;
++
++ fences[i] = amdgpu_sync_peek_fence(&(*idle)->active, r);
+ if (!fences[i])
+ break;
+ ++i;
+@@ -281,7 +285,7 @@ static int amdgpu_vmid_grab_reserved(str
+ if (updates && (*id)->flushed_updates &&
+ updates->context == (*id)->flushed_updates->context &&
+ !dma_fence_is_later(updates, (*id)->flushed_updates))
+- updates = NULL;
++ updates = NULL;
+
+ if ((*id)->owner != vm->immediate.fence_context ||
+ job->vm_pd_addr != (*id)->pd_gpu_addr ||
+@@ -290,6 +294,10 @@ static int amdgpu_vmid_grab_reserved(str
+ !dma_fence_is_signaled((*id)->last_flush))) {
+ struct dma_fence *tmp;
+
++ /* Don't use per engine and per process VMID at the same time */
++ if (adev->vm_manager.concurrent_flush)
++ ring = NULL;
++
+ /* to prevent one context starved by another context */
+ (*id)->pd_gpu_addr = 0;
+ tmp = amdgpu_sync_peek_fence(&(*id)->active, ring);
+@@ -365,12 +373,7 @@ static int amdgpu_vmid_grab_used(struct
+ if (updates && (!flushed || dma_fence_is_later(updates, flushed)))
+ needs_flush = true;
+
+- /* Concurrent flushes are only possible starting with Vega10 and
+- * are broken on Navi10 and Navi14.
+- */
+- if (needs_flush && (adev->asic_type < CHIP_VEGA10 ||
+- adev->asic_type == CHIP_NAVI10 ||
+- adev->asic_type == CHIP_NAVI14))
++ if (needs_flush && !adev->vm_manager.concurrent_flush)
+ continue;
+
+ /* Good, we can use this VMID. Remember this submission as
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -3147,6 +3147,12 @@ void amdgpu_vm_manager_init(struct amdgp
+ {
+ unsigned i;
+
++ /* Concurrent flushes are only possible starting with Vega10 and
++ * are broken on Navi10 and Navi14.
++ */
++ adev->vm_manager.concurrent_flush = !(adev->asic_type < CHIP_VEGA10 ||
++ adev->asic_type == CHIP_NAVI10 ||
++ adev->asic_type == CHIP_NAVI14);
+ amdgpu_vmid_mgr_init(adev);
+
+ adev->vm_manager.fence_context =
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+@@ -331,6 +331,7 @@ struct amdgpu_vm_manager {
+ /* Handling of VMIDs */
+ struct amdgpu_vmid_mgr id_mgr[AMDGPU_MAX_VMHUBS];
+ unsigned int first_kfd_vmid;
++ bool concurrent_flush;
+
+ /* Handling of VM fences */
+ u64 fence_context;
--- /dev/null
+From 4b12ee6f426e5e36396501a58f3a1af5b92a7e06 Mon Sep 17 00:00:00 2001
+From: Victor Zhao <Victor.Zhao@amd.com>
+Date: Tue, 27 Apr 2021 17:52:56 +0800
+Subject: drm/amdgpu: fix r initial values
+
+From: Victor Zhao <Victor.Zhao@amd.com>
+
+commit 4b12ee6f426e5e36396501a58f3a1af5b92a7e06 upstream.
+
+Sriov gets suspend of IP block <dce_virtual> failed as return
+value was not initialized.
+
+v2: return 0 directly to align original code semantic before this
+was broken out into a separate helper function instead of setting
+initial values
+
+Signed-off-by: Victor Zhao <Victor.Zhao@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+@@ -1355,7 +1355,7 @@ int amdgpu_display_suspend_helper(struct
+ }
+ }
+ }
+- return r;
++ return 0;
+ }
+
+ int amdgpu_display_resume_helper(struct amdgpu_device *adev)
--- /dev/null
+From 8bf073ca9235fe38d7b74a0b4e779cfa7cc70fc9 Mon Sep 17 00:00:00 2001
+From: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
+Date: Wed, 5 May 2021 03:27:49 +0200
+Subject: drm/amdgpu: Init GFX10_ADDR_CONFIG for VCN v3 in DPG mode.
+
+From: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
+
+commit 8bf073ca9235fe38d7b74a0b4e779cfa7cc70fc9 upstream.
+
+Otherwise tiling modes that require the values form this field
+(In particular _*_X) would be corrupted upon video decode.
+
+Copied from the VCN v2 code.
+
+Fixes: 99541f392b4d ("drm/amdgpu: add mc resume DPG mode for VCN3.0")
+Reviewed-and-Tested by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+@@ -584,6 +584,10 @@ static void vcn_v3_0_mc_resume_dpg_mode(
+ WREG32_SOC15_DPG_MODE(inst_idx, SOC15_DPG_MODE_OFFSET(
+ VCN, inst_idx, mmUVD_VCPU_NONCACHE_SIZE0),
+ AMDGPU_GPU_PAGE_ALIGN(sizeof(struct amdgpu_fw_shared)), 0, indirect);
++
++ /* VCN global tiling registers */
++ WREG32_SOC15_DPG_MODE(0, SOC15_DPG_MODE_OFFSET(
++ UVD, 0, mmUVD_GFX10_ADDR_CONFIG), adev->gfx.config.gb_addr_config, 0, indirect);
+ }
+
+ static void vcn_v3_0_disable_static_power_gating(struct amdgpu_device *adev, int inst)
--- /dev/null
+From ed01fca38717169fcb61bd45ad1c3750d9c40d59 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Thu, 15 Apr 2021 11:36:19 -0700
+Subject: drm: bridge: fix ANX7625 use of mipi_dsi_() functions
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+commit ed01fca38717169fcb61bd45ad1c3750d9c40d59 upstream.
+
+The Analogix DRM ANX7625 bridge driver uses mips_dsi_() function
+interfaces so it should select DRM_MIPI_DSI to prevent build errors.
+
+ERROR: modpost: "mipi_dsi_attach" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
+ERROR: modpost: "mipi_dsi_device_register_full" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
+ERROR: modpost: "of_find_mipi_dsi_host_by_node" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
+ERROR: modpost: "mipi_dsi_device_unregister" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
+ERROR: modpost: "mipi_dsi_detach" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
+
+Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Cc: Xin Ji <xji@analogixsemi.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: dri-devel@lists.freedesktop.org
+Cc: Andrzej Hajda <a.hajda@samsung.com>
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Cc: Robert Foss <robert.foss@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210415183619.1431-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/analogix/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/bridge/analogix/Kconfig
++++ b/drivers/gpu/drm/bridge/analogix/Kconfig
+@@ -30,6 +30,7 @@ config DRM_ANALOGIX_ANX7625
+ tristate "Analogix Anx7625 MIPI to DP interface support"
+ depends on DRM
+ depends on OF
++ select DRM_MIPI_DSI
+ help
+ ANX7625 is an ultra-low power 4K mobile HD transmitter
+ designed for portable devices. It converts MIPI/DPI to
--- /dev/null
+From 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sat, 27 Mar 2021 11:57:40 +0000
+Subject: drm: bridge/panel: Cleanup connector on bridge detach
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 upstream.
+
+If we don't call drm_connector_cleanup() manually in
+panel_bridge_detach(), the connector will be cleaned up with the other
+DRM objects in the call to drm_mode_config_cleanup(). However, since our
+drm_connector is devm-allocated, by the time drm_mode_config_cleanup()
+will be called, our connector will be long gone. Therefore, the
+connector must be cleaned up when the bridge is detached to avoid
+use-after-free conditions.
+
+v2: Cleanup connector only if it was created
+
+v3: Add FIXME
+
+v4: (Use connector->dev) directly in if() block
+
+Fixes: 13dfc0540a57 ("drm/bridge: Refactor out the panel wrapper from the lvds-encoder bridge.")
+Cc: <stable@vger.kernel.org> # 4.12+
+Cc: Andrzej Hajda <a.hajda@samsung.com>
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
+Cc: Jonas Karlman <jonas@kwiboo.se>
+Cc: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210327115742.18986-2-paul@crapouillou.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/panel.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/bridge/panel.c
++++ b/drivers/gpu/drm/bridge/panel.c
+@@ -87,6 +87,18 @@ static int panel_bridge_attach(struct dr
+
+ static void panel_bridge_detach(struct drm_bridge *bridge)
+ {
++ struct panel_bridge *panel_bridge = drm_bridge_to_panel_bridge(bridge);
++ struct drm_connector *connector = &panel_bridge->connector;
++
++ /*
++ * Cleanup the connector if we know it was initialized.
++ *
++ * FIXME: This wouldn't be needed if the panel_bridge structure was
++ * allocated with drmm_kzalloc(). This might be tricky since the
++ * drm_device pointer can only be retrieved when the bridge is attached.
++ */
++ if (connector->dev)
++ drm_connector_cleanup(connector);
+ }
+
+ static void panel_bridge_pre_enable(struct drm_bridge *bridge)
--- /dev/null
+From 419e91ea3143bf26991442465ac64d9461e98d96 Mon Sep 17 00:00:00 2001
+From: Wayne Lin <Wayne.Lin@amd.com>
+Date: Wed, 24 Feb 2021 18:15:20 +0800
+Subject: drm/dp_mst: Revise broadcast msg lct & lcr
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+commit 419e91ea3143bf26991442465ac64d9461e98d96 upstream.
+
+[Why & How]
+According to DP spec, broadcast message LCT equals to 1 and LCR equals
+to 6. Current implementation is incorrect. Fix it.
+In addition, revise a bit the hdr->rad handling to include broadcast
+case.
+
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210224101521.6713-2-Wayne.Lin@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2829,10 +2829,15 @@ static int set_hdr_from_dst_qlock(struct
+ else
+ hdr->broadcast = 0;
+ hdr->path_msg = txmsg->path_msg;
+- hdr->lct = mstb->lct;
+- hdr->lcr = mstb->lct - 1;
+- if (mstb->lct > 1)
+- memcpy(hdr->rad, mstb->rad, mstb->lct / 2);
++ if (hdr->broadcast) {
++ hdr->lct = 1;
++ hdr->lcr = 6;
++ } else {
++ hdr->lct = mstb->lct;
++ hdr->lcr = mstb->lct - 1;
++ }
++
++ memcpy(hdr->rad, mstb->rad, hdr->lct / 2);
+
+ return 0;
+ }
--- /dev/null
+From d919d3d6cdb31d0f9fe06c880f683a24f2838813 Mon Sep 17 00:00:00 2001
+From: Wayne Lin <Wayne.Lin@amd.com>
+Date: Wed, 24 Feb 2021 18:15:21 +0800
+Subject: drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+commit d919d3d6cdb31d0f9fe06c880f683a24f2838813 upstream.
+
+[Why & How]
+According to DP spec, CLEAR_PAYLOAD_ID_TABLE is a path broadcast request
+message and current implementation is incorrect. Fix it.
+
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210224101521.6713-3-Wayne.Lin@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1154,6 +1154,7 @@ static void build_clear_payload_id_table
+
+ req.req_type = DP_CLEAR_PAYLOAD_ID_TABLE;
+ drm_dp_encode_sideband_req(&req, msg);
++ msg->path_msg = true;
+ }
+
+ static int build_enum_path_resources(struct drm_dp_sideband_msg_tx *msg,
+@@ -2824,7 +2825,8 @@ static int set_hdr_from_dst_qlock(struct
+
+ req_type = txmsg->msg[0] & 0x7f;
+ if (req_type == DP_CONNECTION_STATUS_NOTIFY ||
+- req_type == DP_RESOURCE_STATUS_NOTIFY)
++ req_type == DP_RESOURCE_STATUS_NOTIFY ||
++ req_type == DP_CLEAR_PAYLOAD_ID_TABLE)
+ hdr->broadcast = 1;
+ else
+ hdr->broadcast = 0;
--- /dev/null
+From 7b4957684e5d813fcbdc98144e3cc5c4467b3e2e Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sun, 24 Jan 2021 08:55:52 +0000
+Subject: drm/ingenic: Fix non-OSD mode
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit 7b4957684e5d813fcbdc98144e3cc5c4467b3e2e upstream.
+
+Even though the JZ4740 did not have the OSD mode, it had (according to
+the documentation) two DMA channels, but there is absolutely no
+information about how to select the second DMA channel.
+
+Make the ingenic-drm driver work in non-OSD mode by using the
+foreground0 plane (which is bound to the DMA0 channel) as the primary
+plane, instead of the foreground1 plane, which is the primary plane
+when in OSD mode.
+
+Fixes: 3c9bea4ef32b ("drm/ingenic: Add support for OSD mode")
+Cc: <stable@vger.kernel.org> # v5.8+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Tested-by: H. Nikolaus Schaller <hns@goldelico.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210124085552.29146-5-paul@crapouillou.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
++++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
+@@ -554,7 +554,7 @@ static void ingenic_drm_plane_atomic_upd
+ height = state->src_h >> 16;
+ cpp = state->fb->format->cpp[0];
+
+- if (priv->soc_info->has_osd && plane->type == DRM_PLANE_TYPE_OVERLAY)
++ if (!priv->soc_info->has_osd || plane->type == DRM_PLANE_TYPE_OVERLAY)
+ hwdesc = &priv->dma_hwdescs->hwdesc_f0;
+ else
+ hwdesc = &priv->dma_hwdescs->hwdesc_f1;
+@@ -826,6 +826,7 @@ static int ingenic_drm_bind(struct devic
+ const struct jz_soc_info *soc_info;
+ struct ingenic_drm *priv;
+ struct clk *parent_clk;
++ struct drm_plane *primary;
+ struct drm_bridge *bridge;
+ struct drm_panel *panel;
+ struct drm_encoder *encoder;
+@@ -940,9 +941,11 @@ static int ingenic_drm_bind(struct devic
+ if (soc_info->has_osd)
+ priv->ipu_plane = drm_plane_from_index(drm, 0);
+
+- drm_plane_helper_add(&priv->f1, &ingenic_drm_plane_helper_funcs);
++ primary = priv->soc_info->has_osd ? &priv->f1 : &priv->f0;
+
+- ret = drm_universal_plane_init(drm, &priv->f1, 1,
++ drm_plane_helper_add(primary, &ingenic_drm_plane_helper_funcs);
++
++ ret = drm_universal_plane_init(drm, primary, 1,
+ &ingenic_drm_primary_plane_funcs,
+ priv->soc_info->formats_f1,
+ priv->soc_info->num_formats_f1,
+@@ -954,7 +957,7 @@ static int ingenic_drm_bind(struct devic
+
+ drm_crtc_helper_add(&priv->crtc, &ingenic_drm_crtc_helper_funcs);
+
+- ret = drm_crtc_init_with_planes(drm, &priv->crtc, &priv->f1,
++ ret = drm_crtc_init_with_planes(drm, &priv->crtc, primary,
+ NULL, &ingenic_drm_crtc_funcs, NULL);
+ if (ret) {
+ dev_err(dev, "Failed to init CRTC: %i\n", ret);
--- /dev/null
+From 3aa0a80fc692c9959c261f4c5bfe9c23ddd90562 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Fri, 5 Feb 2021 12:17:55 +0100
+Subject: drm/panfrost: Clear MMU irqs before handling the fault
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit 3aa0a80fc692c9959c261f4c5bfe9c23ddd90562 upstream.
+
+When a fault is handled it will unblock the GPU which will continue
+executing its shader and might fault almost immediately on a different
+page. If we clear interrupts after handling the fault we might miss new
+faults, so clear them before.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations")
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-2-boris.brezillon@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_mmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
+@@ -593,6 +593,8 @@ static irqreturn_t panfrost_mmu_irq_hand
+ access_type = (fault_status >> 8) & 0x3;
+ source_id = (fault_status >> 16);
+
++ mmu_write(pfdev, MMU_INT_CLEAR, mask);
++
+ /* Page fault only */
+ ret = -1;
+ if ((status & mask) == BIT(i) && (exception_type & 0xF8) == 0xC0)
+@@ -616,8 +618,6 @@ static irqreturn_t panfrost_mmu_irq_hand
+ access_type, access_type_name(pfdev, fault_status),
+ source_id);
+
+- mmu_write(pfdev, MMU_INT_CLEAR, mask);
+-
+ status &= ~mask;
+ }
+
--- /dev/null
+From f45da8204ff1707c529a8769f5467ff16f504b26 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Fri, 5 Feb 2021 12:17:56 +0100
+Subject: drm/panfrost: Don't try to map pages that are already mapped
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit f45da8204ff1707c529a8769f5467ff16f504b26 upstream.
+
+We allocate 2MB chunks at a time, so it might appear that a page fault
+has already been handled by a previous page fault when we reach
+panfrost_mmu_map_fault_addr(). Bail out in that case to avoid mapping the
+same area twice.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations")
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-3-boris.brezillon@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_mmu.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
+@@ -488,8 +488,14 @@ static int panfrost_mmu_map_fault_addr(s
+ }
+ bo->base.pages = pages;
+ bo->base.pages_use_count = 1;
+- } else
++ } else {
+ pages = bo->base.pages;
++ if (pages[page_offset]) {
++ /* Pages are already mapped, bail out. */
++ mutex_unlock(&bo->base.pages_lock);
++ goto out;
++ }
++ }
+
+ mapping = bo->base.base.filp->f_mapping;
+ mapping_set_unevictable(mapping);
+@@ -522,6 +528,7 @@ static int panfrost_mmu_map_fault_addr(s
+
+ dev_dbg(pfdev->dev, "mapped page fault @ AS%d %llx", as, addr);
+
++out:
+ panfrost_gem_mapping_put(bomapping);
+
+ return 0;
--- /dev/null
+From 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 3 Mar 2021 00:27:59 +0000
+Subject: drm/radeon: fix copy of uninitialized variable back to userspace
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 upstream.
+
+Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can
+copy back uninitialised data in value_tmp that pointer *value points
+to. This can occur when rdev->family is less than CHIP_BONAIRE and
+less than CHIP_TAHITI. Fix this by adding in a missing -EINVAL
+so that no invalid value is copied back to userspace.
+
+Addresses-Coverity: ("Uninitialized scalar variable)
+Cc: stable@vger.kernel.org # 3.13+
+Fixes: 439a1cfffe2c ("drm/radeon: expose render backend mask to the userspace")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_kms.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -518,6 +518,7 @@ int radeon_info_ioctl(struct drm_device
+ *value = rdev->config.si.backend_enable_mask;
+ } else {
+ DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");
++ return -EINVAL;
+ }
+ break;
+ case RADEON_INFO_MAX_SCLK:
mt76-fix-potential-dma-mapping-leak.patch
fddi-defxx-make-mmio-the-configuration-default-except-for-eisa.patch
drm-qxl-use-ttm-bo-priorities.patch
+drm-ingenic-fix-non-osd-mode.patch
+drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch
+drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch
+drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch
+drm-dp_mst-revise-broadcast-msg-lct-lcr.patch
+drm-dp_mst-set-clear_payload_id_table-as-broadcast.patch
+drm-bridge-fix-anx7625-use-of-mipi_dsi_-functions.patch
+drm-bridge-panel-cleanup-connector-on-bridge-detach.patch
+drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch
+drm-amdgpu-fix-concurrent-vm-flushes-on-vega-navi-v2.patch
+drm-amdgpu-add-new-mc-firmware-for-polaris12-32bit-asic.patch
+drm-amdgpu-fix-r-initial-values.patch
+drm-amdgpu-init-gfx10_addr_config-for-vcn-v3-in-dpg-mode.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
