Merge tag 'drm-misc-next-2019-12-16' of git://anongit.freedesktop.org/drm/drm-misc...

drm-misc-next for v5.6:

UAPI Changes:
- Add support for DMA-BUF HEAPS.

Cross-subsystem Changes:
- mipi dsi definition updates, pulled into drm-intel as well.
- Add lockdep annotations for dma_resv vs mmap_sem and fs_reclaim.
- Remove support for dma-buf kmap/kunmap.
- Constify fb_ops in all fbdev drivers, including drm drivers and drm-core, and media as well.

Core Changes:
- Small cleanups to ttm.
- Fix SCDC definition.
- Assorted cleanups to core.
- Add todo to remove load/unload hooks, and use generic fbdev emulation.
- Assorted documentation updates.
- Use blocking ww lock in ttm fault handler.
- Remove drm_fb_helper_fbdev_setup/teardown.
- Warning fixes with W=1 for atomic.
- Use drm_debug_enabled() instead of drm_debug flag testing in various drivers.
- Fallback to nontiled mode in fbdev emulation when not all tiles are present. (Later on reverted)
- Various kconfig indentation fixes in core and drivers.
- Fix freeing transactions in dp-mst correctly.
- Sean Paul is steping down as core maintainer. :-(
- Add lockdep annotations for atomic locks vs dma-resv.
- Prevent use-after-free for a bad job in drm_scheduler.
- Fill out all block sizes in the P01x and P210 definitions.
- Avoid division by zero in drm/rect, and fix bounds.
- Add drm/rect selftests.
- Add aspect ratio and alternate clocks for HDMI 4k modes.
- Add todo for drm_framebuffer_funcs and fb_create cleanup.
- Drop DRM_AUTH for prime import/export ioctls.
- Clear DP-MST payload id tables downstream when initializating.
- Fix for DSC throughput definition.
- Add extra FEC definitions.
- Fix fake offset in drm_gem_object_funs.mmap.
- Stop using encoder->bridge in core directly
- Handle bridge chaining slightly better.
- Add backlight support to drm/panel, and use it in many panel drivers.
- Increase max number of y420 modes from 128 to 256, as preparation to add the new modes.

Driver Changes:
- Small fixes all over.
- Fix documentation in vkms.
- Fix mmap_sem vs dma_resv in nouveau.
- Small cleanup in komeda.
- Add page flip support in gma500 for psb/cdv.
- Add ddc symlink in the connector sysfs directory for many drivers.
- Add support for analogic an6345, and fix small bugs in it.
- Add atomic modesetting support to ast.
- Fix radeon fault handler VMA race.
- Switch udl to use generic shmem helpers.
- Unconditional vblank handling for mcde.
- Miscellaneous fixes to mcde.
- Tweak debug output from komeda using debugfs.
- Add gamma and color transform support to komeda for DOU-IPS.
- Add support for sony acx424AKP panel.
- Various small cleanups to gma500.
- Use generic fbdev emulation in udl, and replace udl_framebuffer with generic implementation.
- Add support for Logic PD Type 28 panel.
- Use drm_panel_* wrapper functions in exynos/tegra/msm.
- Add devicetree bindings for generic DSI panels.
- Don't include drm_pci.h directly in many drivers.
- Add support for begin/end_cpu_access in udmabuf.
- Stop using drm_get_pci_dev in gma500 and mga200.
- Fixes to UDL damage handling, and use dma_buf_begin/end_cpu_access.
- Add devfreq thermal support to panfrost.
- Fix hotplug with daisy chained monitors by removing VCPI when disabling topology manager.
- meson: Add support for OSD1 plane AFBC commit.
- Stop displaying garbage when toggling ast primary plane on/off.
- More cleanups and fixes to UDL.
- Add D32 suport to komeda.
- Remove globle copy of drm_dev in gma500.
- Add support for Boe Himax8279d MIPI-DSI LCD panel.
- Add support for ingenic JZ4770 panel.
- Small null pointer deference fix in ingenic.
- Remove support for the special tfp420 driver, as there is a generic way to do it.

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/ba73535a-9334-5302-2e1f-5208bd7390bd@linux.intel.com

diff --cc MAINTAINERS
index cc0a4a8,8b2e6c6..bfebe68
--- 1/MAINTAINERS
--- 2/MAINTAINERS
+++ b/MAINTAINERS
@@@ -4970,9 -4940,26 +4970,27 @@@ F:    include/linux/dma-buf
  F:    include/linux/reservation.h
  F:    include/linux/*fence.h
  F:    Documentation/driver-api/dma-buf.rst
 +K:    dma_(buf|fence|resv)
  T:    git git://anongit.freedesktop.org/drm/drm-misc
  
+ DMA-BUF HEAPS FRAMEWORK
+ M:    Sumit Semwal <sumit.semwal@linaro.org>
+ R:    Andrew F. Davis <afd@ti.com>
+ R:    Benjamin Gaignard <benjamin.gaignard@linaro.org>
+ R:    Liam Mark <lmark@codeaurora.org>
+ R:    Laura Abbott <labbott@redhat.com>
+ R:    Brian Starkey <Brian.Starkey@arm.com>
+ R:    John Stultz <john.stultz@linaro.org>
+ S:    Maintained
+ L:    linux-media@vger.kernel.org
+ L:    dri-devel@lists.freedesktop.org
+ L:    linaro-mm-sig@lists.linaro.org (moderated for non-subscribers)
+ F:    include/uapi/linux/dma-heap.h
+ F:    include/linux/dma-heap.h
+ F:    drivers/dma-buf/dma-heap.c
+ F:    drivers/dma-buf/heaps/*
+ T:    git git://anongit.freedesktop.org/drm/drm-misc
+ 
  DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
  M:    Vinod Koul <vkoul@kernel.org>
  L:    dmaengine@vger.kernel.org

diff --cc drivers/dma-buf/dma-buf.c
Simple merge

diff --cc drivers/gpu/drm/Kconfig
Simple merge

diff --cc drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
Simple merge

diff --cc drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
Simple merge

diff --cc drivers/gpu/drm/arm/display/komeda/komeda_kms.c
Simple merge

diff --cc drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c
Simple merge

diff --cc drivers/gpu/drm/drm_atomic_helper.c
Simple merge

diff --cc drivers/gpu/drm/drm_dp_mst_topology.c
index 273dd80,1770754..e68d230
--- 1/drivers/gpu/drm/drm_dp_mst_topology.c
--- 2/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@@ -74,8 -61,13 +74,13 @@@ static int drm_dp_send_dpcd_write(struc
                                  struct drm_dp_mst_port *port,
                                  int offset, int size, u8 *bytes);
  
 -static void drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
 -                                   struct drm_dp_mst_branch *mstb);
 +static int drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
 +                                  struct drm_dp_mst_branch *mstb);
+ 
+ static void
+ drm_dp_send_clear_payload_id_table(struct drm_dp_mst_topology_mgr *mgr,
+                                  struct drm_dp_mst_branch *mstb);
+ 
  static int drm_dp_send_enum_path_resources(struct drm_dp_mst_topology_mgr *mgr,
                                           struct drm_dp_mst_branch *mstb,
                                           struct drm_dp_mst_port *port);
@@@ -2515,15 -2179,15 +2533,19 @@@ static int drm_dp_check_and_send_link_a
  
  static void drm_dp_mst_link_probe_work(struct work_struct *work)
  {
 -      struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, work);
 +      struct drm_dp_mst_topology_mgr *mgr =
 +              container_of(work, struct drm_dp_mst_topology_mgr, work);
 +      struct drm_device *dev = mgr->dev;
        struct drm_dp_mst_branch *mstb;
        int ret;
+       bool clear_payload_id_table;
  
 +      mutex_lock(&mgr->probe_lock);
 +
        mutex_lock(&mgr->lock);
+       clear_payload_id_table = !mgr->payload_id_table_cleared;
+       mgr->payload_id_table_cleared = true;
+ 
        mstb = mgr->mst_primary;
        if (mstb) {
                ret = drm_dp_mst_topology_try_get_mstb(mstb);
@@@ -2531,17 -2195,24 +2553,30 @@@
                        mstb = NULL;
        }
        mutex_unlock(&mgr->lock);
 -      if (!mstb)
 +      if (!mstb) {
 +              mutex_unlock(&mgr->probe_lock);
                return;
 +      }
  
 -      drm_dp_check_and_send_link_address(mgr, mstb);
+       /*
+        * Certain branch devices seem to incorrectly report an available_pbn
+        * of 0 on downstream sinks, even after clearing the
+        * DP_PAYLOAD_ALLOCATE_* registers in
+        * drm_dp_mst_topology_mgr_set_mst(). Namely, the CableMatters USB-C
+        * 2x DP hub. Sending a CLEAR_PAYLOAD_ID_TABLE message seems to make
+        * things work again.
+        */
+       if (clear_payload_id_table) {
+               DRM_DEBUG_KMS("Clearing payload ID table\n");
+               drm_dp_send_clear_payload_id_table(mgr, mstb);
+       }
+ 
 +      ret = drm_dp_check_and_send_link_address(mgr, mstb);
        drm_dp_mst_topology_put_mstb(mstb);
 +
 +      mutex_unlock(&mgr->probe_lock);
 +      if (ret)
 +              drm_kms_helper_hotplug_event(dev);
  }
  
  static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr,
@@@ -2856,9 -2503,30 +2891,31 @@@ out
        if (ret <= 0)
                mstb->link_address_sent = false;
        kfree(txmsg);
 +      return ret < 0 ? ret : changed;
  }
  
+ void drm_dp_send_clear_payload_id_table(struct drm_dp_mst_topology_mgr *mgr,
+                                       struct drm_dp_mst_branch *mstb)
+ {
+       struct drm_dp_sideband_msg_tx *txmsg;
+       int len, ret;
+ 
+       txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
+       if (!txmsg)
+               return;
+ 
+       txmsg->dst = mstb;
+       len = build_clear_payload_id_table(txmsg);
+ 
+       drm_dp_queue_down_tx(mgr, txmsg);
+ 
+       ret = drm_dp_mst_wait_tx_reply(mstb, txmsg);
+       if (ret > 0 && txmsg->reply.reply_type == DP_SIDEBAND_REPLY_NAK)
+               DRM_DEBUG_KMS("clear payload table id nak received\n");
+ 
+       kfree(txmsg);
+ }
+ 
  static int
  drm_dp_send_enum_path_resources(struct drm_dp_mst_topology_mgr *mgr,
                                struct drm_dp_mst_branch *mstb,

diff --cc drivers/gpu/drm/drm_gem.c
index 000fa4a,56f42e0..a9e4a61
--- 1/drivers/gpu/drm/drm_gem.c
--- 2/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@@ -1105,23 -1105,10 +1105,20 @@@ int drm_gem_mmap_obj(struct drm_gem_obj
        if (obj_size < vma->vm_end - vma->vm_start)
                return -EINVAL;
  
 +      /* Take a ref for this mapping of the object, so that the fault
 +       * handler can dereference the mmap offset's pointer to the object.
 +       * This reference is cleaned up by the corresponding vm_close
 +       * (which should happen whether the vma was created by this call, or
 +       * by a vm_open due to mremap or partial unmap or whatever).
 +       */
 +      drm_gem_object_get(obj);
 +
        if (obj->funcs && obj->funcs->mmap) {
-               /* Remove the fake offset */
-               vma->vm_pgoff -= drm_vma_node_start(&obj->vma_node);
- 
                ret = obj->funcs->mmap(obj, vma);
 -              if (ret)
 +              if (ret) {
 +                      drm_gem_object_put_unlocked(obj);
                        return ret;
 +              }
                WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));
        } else {
                if (obj->funcs && obj->funcs->vm_ops)

diff --cc drivers/gpu/drm/i915/display/intel_display.c
Simple merge

diff --cc drivers/gpu/drm/i915/display/intel_dp.c
Simple merge

diff --cc drivers/gpu/drm/i915/display/intel_fbdev.c
Simple merge

diff --cc drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c
Simple merge

diff --cc drivers/gpu/drm/i915/i915_drv.c
Simple merge

diff --cc drivers/gpu/drm/i915/i915_gem.h
Simple merge

diff --cc drivers/gpu/drm/i915/i915_utils.c
Simple merge

diff --cc drivers/gpu/drm/i915/intel_pm.c
Simple merge

diff --cc drivers/gpu/drm/mcde/mcde_dsi.c
Simple merge

diff --cc drivers/gpu/drm/mediatek/mtk_drm_plane.c
Simple merge

diff --cc drivers/gpu/drm/mgag200/mgag200_drv.c
index b113876,ef795ab..9f4f5f0
--- 1/drivers/gpu/drm/mgag200/mgag200_drv.c
--- 2/drivers/gpu/drm/mgag200/mgag200_drv.c
+++ b/drivers/gpu/drm/mgag200/mgag200_drv.c
@@@ -61,39 -94,8 +95,37 @@@ static void mga_pci_remove(struct pci_d
  
  DEFINE_DRM_GEM_FOPS(mgag200_driver_fops);
  
 +static bool mgag200_pin_bo_at_0(const struct mga_device *mdev)
 +{
 +      return mdev->flags & MGAG200_FLAG_HW_BUG_NO_STARTADD;
 +}
 +
 +int mgag200_driver_dumb_create(struct drm_file *file,
 +                             struct drm_device *dev,
 +                             struct drm_mode_create_dumb *args)
 +{
 +      struct mga_device *mdev = dev->dev_private;
 +      unsigned long pg_align;
 +
 +      if (WARN_ONCE(!dev->vram_mm, "VRAM MM not initialized"))
 +              return -EINVAL;
 +
 +      pg_align = 0ul;
 +
 +      /*
 +       * Aligning scanout buffers to the size of the video ram forces
 +       * placement at offset 0. Works around a bug where HW does not
 +       * respect 'startadd' field.
 +       */
 +      if (mgag200_pin_bo_at_0(mdev))
 +              pg_align = PFN_UP(mdev->mc.vram_size);
 +
 +      return drm_gem_vram_fill_create_dumb(file, dev, &dev->vram_mm->bdev,
 +                                           pg_align, false, args);
 +}
 +
  static struct drm_driver driver = {
        .driver_features = DRIVER_GEM | DRIVER_MODESET,
-       .load = mgag200_driver_load,
-       .unload = mgag200_driver_unload,
        .fops = &mgag200_driver_fops,
        .name = DRIVER_NAME,
        .desc = DRIVER_DESC,

diff --cc drivers/gpu/drm/mgag200/mgag200_main.c
Simple merge

diff --cc drivers/gpu/drm/panfrost/panfrost_devfreq.c
Simple merge

diff --cc drivers/gpu/drm/panfrost/panfrost_drv.c
Simple merge

diff --cc drivers/gpu/drm/radeon/cik.c
Simple merge

diff --cc drivers/gpu/drm/radeon/r100.c
Simple merge

diff --cc drivers/gpu/drm/radeon/r600.c
Simple merge

diff --cc drivers/gpu/drm/radeon/si.c
Simple merge

diff --cc drivers/gpu/drm/radeon/si_dpm.c
Simple merge

diff --cc drivers/gpu/drm/scheduler/sched_main.c
Simple merge

diff --cc drivers/gpu/drm/tegra/fb.c
Simple merge

diff --cc drivers/gpu/drm/tegra/gem.c
Simple merge

diff --cc drivers/gpu/drm/tegra/output.c
Simple merge

diff --cc drivers/gpu/drm/ttm/ttm_bo.c
Simple merge

diff --cc drivers/gpu/drm/ttm/ttm_bo_vm.c
Simple merge

diff --cc drivers/gpu/host1x/job.c
Simple merge

diff --cc drivers/misc/fastrpc.c
Simple merge

diff --cc drivers/staging/android/ion/ion.c
Simple merge

diff --cc drivers/video/fbdev/aty/atyfb_base.c
Simple merge

diff --cc drivers/video/fbdev/core/fbmem.c
Simple merge

diff --cc drivers/video/fbdev/efifb.c
Simple merge

diff --cc drivers/video/fbdev/hyperv_fb.c
index 4cd27e5,fcd546e..afe9fd7
--- 1/drivers/video/fbdev/hyperv_fb.c
--- 2/drivers/video/fbdev/hyperv_fb.c
+++ b/drivers/video/fbdev/hyperv_fb.c
@@@ -889,13 -620,10 +889,13 @@@ static void hvfb_cfb_imageblit(struct f
  
        cfb_imageblit(p, image);
        if (par->synchronous_fb)
 -              synthvid_update(p);
 +              synthvid_update(p, 0, 0, INT_MAX, INT_MAX);
 +      else
 +              hvfb_ondemand_refresh_throttle(par, image->dx, image->dy,
 +                                             image->width, image->height);
  }
  
- static struct fb_ops hvfb_ops = {
+ static const struct fb_ops hvfb_ops = {
        .owner = THIS_MODULE,
        .fb_check_var = hvfb_check_var,
        .fb_set_par = hvfb_set_par,

diff --cc drivers/xen/gntdev-dmabuf.c
Simple merge

diff --cc include/drm/drm_dp_mst_helper.h
index d5fc90b,a448d70..5699493
--- 1/include/drm/drm_dp_mst_helper.h
--- 2/include/drm/drm_dp_mst_helper.h
+++ b/include/drm/drm_dp_mst_helper.h
@@@ -566,17 -496,17 +567,24 @@@ struct drm_dp_mst_topology_mgr 
        struct mutex lock;
  
        /**
 -       * @mst_state: If this manager is enabled for an MST capable port.
 -       * False if no MST sink/branch devices is connected.
 +       * @probe_lock: Prevents @work and @up_req_work, the only writers of
 +       * &drm_dp_mst_port.mstb and &drm_dp_mst_branch.ports, from racing
 +       * while they update the topology.
 +       */
 +      struct mutex probe_lock;
 +
 +      /**
 +       * @mst_state: If this manager is enabled for an MST capable port. False
 +       * if no MST sink/branch devices is connected.
         */
-       bool mst_state;
+       bool mst_state : 1;
+ 
+       /**
+        * @payload_id_table_cleared: Whether or not we've cleared the payload
+        * ID table for @mst_primary. Protected by @lock.
+        */
+       bool payload_id_table_cleared : 1;
+ 
        /**
         * @mst_primary: Pointer to the primary/first branch device.
         */

diff --cc include/linux/host1x.h
index 6f8d772,d11e89d..6edeb92
--- 1/include/linux/host1x.h
--- 2/include/linux/host1x.h
+++ b/include/linux/host1x.h
@@@ -67,13 -64,10 +67,11 @@@ struct sg_table
  struct host1x_bo_ops {
        struct host1x_bo *(*get)(struct host1x_bo *bo);
        void (*put)(struct host1x_bo *bo);
 -      dma_addr_t (*pin)(struct host1x_bo *bo, struct sg_table **sgt);
 -      void (*unpin)(struct host1x_bo *bo, struct sg_table *sgt);
 +      struct sg_table *(*pin)(struct device *dev, struct host1x_bo *bo,
 +                              dma_addr_t *phys);
 +      void (*unpin)(struct device *dev, struct sg_table *sgt);
        void *(*mmap)(struct host1x_bo *bo);
        void (*munmap)(struct host1x_bo *bo, void *addr);
-       void *(*kmap)(struct host1x_bo *bo, unsigned int pagenum);
-       void (*kunmap)(struct host1x_bo *bo, unsigned int pagenum, void *addr);
  };
  
  struct host1x_bo {