Bail out if s_fence is no longer fresh.
https://patchwork.freedesktop.org/patch/333645/
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -333,6 +333,10 @@  void drm_sched_increase_karma(struct drm

 			spin_lock(&rq->lock);
 			list_for_each_entry_safe(entity, tmp, &rq->entities, list) {
+				if (!smp_load_acquire(&bad->s_fence)) {
+					spin_unlock(&rq->lock);
+					return;
+				}
 				if (bad->s_fence->scheduled.context ==
 				    entity->fence_context) {
 					if (atomic_read(&bad->karma) >
@@ -543,7 +547,7 @@  EXPORT_SYMBOL(drm_sched_job_init);
 void drm_sched_job_cleanup(struct drm_sched_job *job)
 {
 	dma_fence_put(&job->s_fence->finished);
-	job->s_fence = NULL;
+	smp_store_release(&job->s_fence, 0);
 }
 EXPORT_SYMBOL(drm_sched_job_cleanup);


Panfrost uses multiple schedulers (one for each slot, so 2 in reality),
and on a timeout has to stop all the schedulers to safely perform a
reset. However more than one scheduler can trigger a timeout at the same
time. This race condition results in jobs being freed while they are
still in use.

Modify drm_sched_stop() to call cancel_delayed_work_sync() when stopping
a different scheduler to the one belonging to the passed in job.
panfrost_job_timedout() is also modified to only allow one thread at a
time to handle the reset. Any subsequent threads simply return assuming
that the first thread will handle the situation.
https://patchwork.freedesktop.org/patch/333258/
MRFIXIT had to adjust
diff --git a/drivers/gpu/drm/panfrost/panfrost_device.h b/drivers/gpu/drm/panfrost/panfrost_device.h
index f503c566e99f..6441c7fba6c4 100644
--- a/drivers/gpu/drm/panfrost/panfrost_device.h
+++ b/drivers/gpu/drm/panfrost/panfrost_device.h
@@ -99,6 +99,8 @@  struct panfrost_device {
 		unsigned long cur_volt;
 		struct panfrost_devfreq_slot slot[NUM_JOB_SLOTS];
 	} devfreq;
+
+	bool is_resetting;
 };

 struct panfrost_mmu {
diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
index 05c85f45a0de..1b2019e08b43 100644
--- a/drivers/gpu/drm/panfrost/panfrost_job.c
+++ b/drivers/gpu/drm/panfrost/panfrost_job.c
@@ -392,6 +392,11 @@
 		job_read(pfdev, JS_TAIL_LO(js)),
 		sched_job);

+	if (pfdev->is_resetting) {
+		return;
+	}
+	pfdev->is_resetting = true;
+
 	if (!mutex_trylock(&pfdev->reset_lock))
 		return;

@@ -425,6 +430,7 @@
 	for (i = 0; i < NUM_JOB_SLOTS; i++)
 		drm_sched_start(&pfdev->js->queue[i].sched, true);

+	pfdev->is_resetting = false;
 	mutex_unlock(&pfdev->reset_lock);
 }


diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index 148468447ba9..bc6d1862ec8a 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -415,7 +415,10 @@  void drm_sched_stop(struct drm_gpu_scheduler *sched, struct drm_sched_job *bad)
 	 * this TDR finished and before the newly restarted jobs had a
 	 * chance to complete.
 	 */
-	cancel_delayed_work(&sched->work_tdr);
+	if (bad->sched != sched)
+		cancel_delayed_work_sync(&sched->work_tdr);
+	else
+		cancel_delayed_work(&sched->work_tdr);
 }

 EXPORT_SYMBOL(drm_sched_stop);


From 199ee71f2ef17372e3e788e129cbf61536fe9fa3 Mon Sep 17 00:00:00 2001
From: Robin Murphy <robin.murphy@arm.com>
Date: Wed, 11 Sep 2019 15:42:09 +0100
Subject: [PATCH] iommu/io-pgtable-arm: Allow coherent walks for Mali

Midgard GPUs have ACE-Lite master interfaces which allows systems to
integrate them in an I/O-coherent manner. It seems that from the GPU's
viewpoint, the rest of the system is its outer shareable domain, and it
will only emit snoop signals for outer shareable accesses. As such,
setting the TTBR_SHARE_OUTER bit does indeed get coherent pagetable
walks working nicely.

Making data accesses coherent seems to be more of a challenge...

Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
---
 drivers/iommu/io-pgtable-arm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index 77f41c9dd9be7..2794d46613392 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -1061,6 +1061,9 @@ arm_mali_lpae_alloc_pgtable(struct io_pgtable_cfg *cfg, void *cookie)
 	cfg->arm_mali_lpae_cfg.transtab = virt_to_phys(data->pgd) |
 					  ARM_MALI_LPAE_TTBR_READ_INNER |
 					  ARM_MALI_LPAE_TTBR_ADRMODE_TABLE;
+	if (cfg->coherent_walk)
+		cfg->arm_mali_lpae_cfg.transtab |= ARM_MALI_LPAE_TTBR_SHARE_OUTER;
+
 	return &data->iop;

 out_free_data: