--- /dev/null
+From 4543eda52113d1e2cc0e9bf416f79597e6ef1ec7 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 7 Aug 2013 19:34:53 -0400
+Subject: drm/radeon: fix endian bugs in hw i2c atom routines
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 4543eda52113d1e2cc0e9bf416f79597e6ef1ec7 upstream.
+
+Need to swap the data fetched over i2c properly. This
+is the same fix as the endian fix for aux channel
+transactions.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_dp.c | 6 +++---
+ drivers/gpu/drm/radeon/atombios_i2c.c | 4 +++-
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -51,7 +51,7 @@ static char *pre_emph_names[] = {
+ * or from atom. Note that atom operates on
+ * dw units.
+ */
+-static void radeon_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le)
++void radeon_atom_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le)
+ {
+ #ifdef __BIG_ENDIAN
+ u8 src_tmp[20], dst_tmp[20]; /* used for byteswapping */
+@@ -101,7 +101,7 @@ static int radeon_process_aux_ch(struct
+
+ base = (unsigned char *)(rdev->mode_info.atom_context->scratch + 1);
+
+- radeon_copy_swap(base, send, send_bytes, true);
++ radeon_atom_copy_swap(base, send, send_bytes, true);
+
+ args.v1.lpAuxRequest = cpu_to_le16((u16)(0 + 4));
+ args.v1.lpDataOut = cpu_to_le16((u16)(16 + 4));
+@@ -138,7 +138,7 @@ static int radeon_process_aux_ch(struct
+ recv_bytes = recv_size;
+
+ if (recv && recv_size)
+- radeon_copy_swap(recv, base + 16, recv_bytes, false);
++ radeon_atom_copy_swap(recv, base + 16, recv_bytes, false);
+
+ return recv_bytes;
+ }
+--- a/drivers/gpu/drm/radeon/atombios_i2c.c
++++ b/drivers/gpu/drm/radeon/atombios_i2c.c
+@@ -27,6 +27,8 @@
+ #include "radeon.h"
+ #include "atom.h"
+
++extern void radeon_atom_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le);
++
+ #define TARGET_HW_I2C_CLOCK 50
+
+ /* these are a limitation of ProcessI2cChannelTransaction not the hw */
+@@ -77,7 +79,7 @@ static int radeon_process_i2c_ch(struct
+ }
+
+ if (!(flags & HW_I2C_WRITE))
+- memcpy(buf, base, num);
++ radeon_atom_copy_swap(buf, base, num, false);
+
+ return 0;
+ }
--- /dev/null
+From 95663948ba22a4be8b99acd67fbf83e86ddffba4 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 20 Aug 2013 14:59:01 -0400
+Subject: drm/radeon: fix LCD record parsing
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 95663948ba22a4be8b99acd67fbf83e86ddffba4 upstream.
+
+If the LCD table contains an EDID record, properly account
+for the edid size when walking through the records.
+
+This should fix error messages about unknown LCD records.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_atombios.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -1622,7 +1622,9 @@ struct radeon_encoder_atom_dig *radeon_a
+ kfree(edid);
+ }
+ }
+- record += sizeof(ATOM_FAKE_EDID_PATCH_RECORD);
++ record += fake_edid_record->ucFakeEDIDLength ?
++ fake_edid_record->ucFakeEDIDLength + 2 :
++ sizeof(ATOM_FAKE_EDID_PATCH_RECORD);
+ break;
+ case LCD_PANEL_RESOLUTION_RECORD_TYPE:
+ panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
--- /dev/null
+From 182b17c8dc4e83aab000ce86587b6810e515da87 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 17 Sep 2013 14:21:15 +1000
+Subject: drm/ttm: fix the tt_populated check in ttm_tt_destroy()
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+commit 182b17c8dc4e83aab000ce86587b6810e515da87 upstream.
+
+After a vmalloc failure in ttm_dma_tt_alloc_page_directory(),
+ttm_dma_tt_init() will call ttm_tt_destroy() to cleanup, and end up
+inside the driver's unpopulate() hook when populate() has never yet
+been called.
+
+On nouveau, the first issue to be hit because of this is that
+dma_address[] may be a NULL pointer. After working around this,
+ttm_pool_unpopulate() may potentially hit the same issue with
+the pages[] array.
+
+It seems to make more sense to avoid calling unpopulate on already
+unpopulated TTMs than to add checks to all the implementations.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Cc: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_tt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_tt.c
++++ b/drivers/gpu/drm/ttm/ttm_tt.c
+@@ -170,7 +170,7 @@ void ttm_tt_destroy(struct ttm_tt *ttm)
+ ttm_tt_unbind(ttm);
+ }
+
+- if (likely(ttm->pages != NULL)) {
++ if (ttm->state == tt_unbound) {
+ ttm->bdev->driver->ttm_tt_unpopulate(ttm);
+ }
+
hid-provide-a-helper-for-validating-hid-reports.patch
hid-zeroplus-validate-output-report-details.patch
hid-logitech-dj-validate-output-report-details.patch
+drm-ttm-fix-the-tt_populated-check-in-ttm_tt_destroy.patch
+drm-radeon-fix-lcd-record-parsing.patch
+drm-radeon-fix-endian-bugs-in-hw-i2c-atom-routines.patch