--- /dev/null
+From 6914e1e3f63caa829431160f0f7093292daef2d5 Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Thu, 26 Mar 2015 09:25:44 +0530
+Subject: ARC: SA_SIGINFO ucontext regs off-by-one
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit 6914e1e3f63caa829431160f0f7093292daef2d5 upstream.
+
+The regfile provided to SA_SIGINFO signal handler as ucontext was off by
+one due to pt_regs gutter cleanups in 2013.
+
+Before handling signal, user pt_regs are copied onto user_regs_struct and copied
+back later. Both structs are binary compatible. This was all fine until
+commit 2fa919045b72 (ARC: pt_regs update #2) which removed the empty stack slot
+at top of pt_regs (corresponding to first pad) and made the corresponding
+fixup in struct user_regs_struct (the pad in there was moved out of
+@scratch - not removed altogether as it is part of ptrace ABI)
+
+ struct user_regs_struct {
++ long pad;
+ struct {
+- long pad;
+ long bta, lp_start, lp_end,....
+ } scratch;
+ ...
+ }
+
+This meant that now user_regs_struct was off by 1 reg w.r.t pt_regs and
+signal code needs to user_regs_struct.scratch to reflect it as pt_regs,
+which is what this commit does.
+
+This problem was hidden for 2 years, because both save/restore, despite
+using wrong location, were using the same location. Only an interim
+inspection (reproducer below) exposed the issue.
+
+ void handle_segv(int signo, siginfo_t *info, void *context)
+ {
+ ucontext_t *uc = context;
+ struct user_regs_struct *regs = &(uc->uc_mcontext.regs);
+
+ printf("regs %x %x\n", <=== prints 7 8 (vs. 8 9)
+ regs->scratch.r8, regs->scratch.r9);
+ }
+
+ int main()
+ {
+ struct sigaction sa;
+
+ sa.sa_sigaction = handle_segv;
+ sa.sa_flags = SA_SIGINFO;
+ sigemptyset(&sa.sa_mask);
+ sigaction(SIGSEGV, &sa, NULL);
+
+ asm volatile(
+ "mov r7, 7 \n"
+ "mov r8, 8 \n"
+ "mov r9, 9 \n"
+ "mov r10, 10 \n"
+ :::"r7","r8","r9","r10");
+
+ *((unsigned int*)0x10) = 0;
+ }
+
+Fixes: 2fa919045b72ec892e "ARC: pt_regs update #2: Remove unused gutter at start of pt_regs"
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/kernel/signal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arc/kernel/signal.c
++++ b/arch/arc/kernel/signal.c
+@@ -67,7 +67,7 @@ stash_usr_regs(struct rt_sigframe __user
+ sigset_t *set)
+ {
+ int err;
+- err = __copy_to_user(&(sf->uc.uc_mcontext.regs), regs,
++ err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), regs,
+ sizeof(sf->uc.uc_mcontext.regs.scratch));
+ err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
+
+@@ -83,7 +83,7 @@ static int restore_usr_regs(struct pt_re
+ if (!err)
+ set_current_blocked(&set);
+
+- err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs),
++ err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs.scratch),
+ sizeof(sf->uc.uc_mcontext.regs.scratch));
+
+ return err;
--- /dev/null
+From e4140819dadc3624accac8294881bca8a3cba4ed Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Thu, 26 Mar 2015 11:14:41 +0530
+Subject: ARC: signal handling robustify
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit e4140819dadc3624accac8294881bca8a3cba4ed upstream.
+
+A malicious signal handler / restorer can DOS the system by fudging the
+user regs saved on stack, causing weird things such as sigreturn returning
+to user mode PC but cpu state still being kernel mode....
+
+Ensure that in sigreturn path status32 always has U bit; any other bogosity
+(gargbage PC etc) will be taken care of by normal user mode exceptions mechanisms.
+
+Reproducer signal handler:
+
+ void handle_sig(int signo, siginfo_t *info, void *context)
+ {
+ ucontext_t *uc = context;
+ struct user_regs_struct *regs = &(uc->uc_mcontext.regs);
+
+ regs->scratch.status32 = 0;
+ }
+
+Before the fix, kernel would go off to weeds like below:
+
+ --------->8-----------
+ [ARCLinux]$ ./signal-test
+ Path: /signal-test
+ CPU: 0 PID: 61 Comm: signal-test Not tainted 4.0.0-rc5+ #65
+ task: 8f177880 ti: 5ffe6000 task.ti: 8f15c000
+
+ [ECR ]: 0x00220200 => Invalid Write @ 0x00000010 by insn @ 0x00010698
+ [EFA ]: 0x00000010
+ [BLINK ]: 0x2007c1ee
+ [ERET ]: 0x10698
+ [STAT32]: 0x00000000 : <--------
+ BTA: 0x00010680 SP: 0x5ffe7e48 FP: 0x00000000
+ LPS: 0x20003c6c LPE: 0x20003c70 LPC: 0x00000000
+ ...
+ --------->8-----------
+
+Reported-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/kernel/signal.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/arch/arc/kernel/signal.c
++++ b/arch/arc/kernel/signal.c
+@@ -131,6 +131,15 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ /* Don't restart from sigreturn */
+ syscall_wont_restart(regs);
+
++ /*
++ * Ensure that sigreturn always returns to user mode (in case the
++ * regs saved on user stack got fudged between save and sigreturn)
++ * Otherwise it is easy to panic the kernel with a custom
++ * signal handler and/or restorer which clobberes the status32/ret
++ * to return to a bogus location in kernel mode.
++ */
++ regs->status32 |= STATUS_U_MASK;
++
+ return regs->r0;
+
+ badframe:
+@@ -229,8 +238,11 @@ setup_rt_frame(struct ksignal *ksig, sig
+
+ /*
+ * handler returns using sigreturn stub provided already by userpsace
++ * If not, nuke the process right away
+ */
+- BUG_ON(!(ksig->ka.sa.sa_flags & SA_RESTORER));
++ if(!(ksig->ka.sa.sa_flags & SA_RESTORER))
++ return 1;
++
+ regs->blink = (unsigned long)ksig->ka.sa.sa_restorer;
+
+ /* User Stack for signal handler will be above the frame just carved */
+@@ -296,12 +308,12 @@ static void
+ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
+ {
+ sigset_t *oldset = sigmask_to_save();
+- int ret;
++ int failed;
+
+ /* Set up the stack frame */
+- ret = setup_rt_frame(ksig, oldset, regs);
++ failed = setup_rt_frame(ksig, oldset, regs);
+
+- signal_setup_done(ret, ksig, 0);
++ signal_setup_done(failed, ksig, 0);
+ }
+
+ void do_signal(struct pt_regs *regs)
--- /dev/null
+From fdc0074c5fc8c7adb8186cbb123fe2082d9bd05f Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Mon, 9 Feb 2015 18:23:20 +0800
+Subject: ARM: sunxi: Have ARCH_SUNXI select RESET_CONTROLLER for clock driver usage
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit fdc0074c5fc8c7adb8186cbb123fe2082d9bd05f upstream.
+
+As the sunxi usb clocks all contain a reset controller, it is not
+possible to build the sunxi clock driver without RESET_CONTROLLER
+enabled. Doing so results in an undefined symbol error:
+
+ drivers/built-in.o: In function `sunxi_gates_clk_setup':
+ linux/drivers/clk/sunxi/clk-sunxi.c:1071: undefined reference to
+ `reset_controller_register'
+
+This is possible if building a minimal kernel without PHY_SUN4I_USB.
+
+The dependency issue is made visible at compile time instead of
+link time by the new A80 mmc clocks, which also use a reset control
+itself.
+
+This patch makes ARCH_SUNXI select ARCH_HAS_RESET_CONTROLLER and
+RESET_CONTROLLER.
+
+Fixes: 559482d1f950 ARM: sunxi: Split the various SoCs support in Kconfig
+Reported-by: Lourens Rozema <ik@lourensrozema.nl>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-sunxi/Kconfig | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/mach-sunxi/Kconfig
++++ b/arch/arm/mach-sunxi/Kconfig
+@@ -1,10 +1,12 @@
+ menuconfig ARCH_SUNXI
+ bool "Allwinner SoCs" if ARCH_MULTI_V7
+ select ARCH_REQUIRE_GPIOLIB
++ select ARCH_HAS_RESET_CONTROLLER
+ select CLKSRC_MMIO
+ select GENERIC_IRQ_CHIP
+ select PINCTRL
+ select SUN4I_TIMER
++ select RESET_CONTROLLER
+
+ if ARCH_SUNXI
+
+@@ -20,10 +22,8 @@ config MACH_SUN5I
+ config MACH_SUN6I
+ bool "Allwinner A31 (sun6i) SoCs support"
+ default ARCH_SUNXI
+- select ARCH_HAS_RESET_CONTROLLER
+ select ARM_GIC
+ select MFD_SUN6I_PRCM
+- select RESET_CONTROLLER
+ select SUN5I_HSTIMER
+
+ config MACH_SUN7I
+@@ -37,16 +37,12 @@ config MACH_SUN7I
+ config MACH_SUN8I
+ bool "Allwinner A23 (sun8i) SoCs support"
+ default ARCH_SUNXI
+- select ARCH_HAS_RESET_CONTROLLER
+ select ARM_GIC
+ select MFD_SUN6I_PRCM
+- select RESET_CONTROLLER
+
+ config MACH_SUN9I
+ bool "Allwinner (sun9i) SoCs support"
+ default ARCH_SUNXI
+- select ARCH_HAS_RESET_CONTROLLER
+ select ARM_GIC
+- select RESET_CONTROLLER
+
+ endif
--- /dev/null
+From 9a30b096b543932de218dd3501b5562e00a8792d Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Thu, 12 Mar 2015 23:53:26 -0400
+Subject: blk-mq: fix use of incorrect goto label in blk_mq_init_queue error path
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 9a30b096b543932de218dd3501b5562e00a8792d upstream.
+
+If percpu_ref_init() fails the allocated q and hctxs must get cleaned
+up; using 'err_map' doesn't allow that to happen.
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Reviewed-by: Ming Lei <ming.lei@canonical.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-mq.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1937,7 +1937,7 @@ struct request_queue *blk_mq_init_queue(
+ */
+ if (percpu_ref_init(&q->mq_usage_counter, blk_mq_usage_counter_release,
+ PERCPU_REF_INIT_ATOMIC, GFP_KERNEL))
+- goto err_map;
++ goto err_mq_usage;
+
+ setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
+ blk_queue_rq_timeout(q, 30000);
+@@ -1980,7 +1980,7 @@ struct request_queue *blk_mq_init_queue(
+ blk_mq_init_cpu_queues(q, set->nr_hw_queues);
+
+ if (blk_mq_init_hw_queues(q, set))
+- goto err_hw;
++ goto err_mq_usage;
+
+ mutex_lock(&all_q_mutex);
+ list_add_tail(&q->all_q_node, &all_q_list);
+@@ -1992,7 +1992,7 @@ struct request_queue *blk_mq_init_queue(
+
+ return q;
+
+-err_hw:
++err_mq_usage:
+ blk_cleanup_queue(q);
+ err_hctxs:
+ kfree(map);
--- /dev/null
+From bc188d818edf325ae38cfa43254a0b10a4defd65 Mon Sep 17 00:00:00 2001
+From: Sam Bradshaw <sbradshaw@micron.com>
+Date: Wed, 18 Mar 2015 17:06:18 -0600
+Subject: blkmq: Fix NULL pointer deref when all reserved tags in
+
+From: Sam Bradshaw <sbradshaw@micron.com>
+
+commit bc188d818edf325ae38cfa43254a0b10a4defd65 upstream.
+
+When allocating from the reserved tags pool, bt_get() is called with
+a NULL hctx. If all tags are in use, the hw queue is kicked to push
+out any pending IO, potentially freeing tags, and tag allocation is
+retried. The problem is that blk_mq_run_hw_queue() doesn't check for
+a NULL hctx. So we avoid it with a simple NULL hctx test.
+
+Tested by hammering mtip32xx with concurrent smartctl/hdparm.
+
+Signed-off-by: Sam Bradshaw <sbradshaw@micron.com>
+Signed-off-by: Selvan Mani <smani@micron.com>
+Fixes: b32232073e80 ("blk-mq: fix hang in bt_get()")
+Added appropriate comment.
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-mq-tag.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -265,9 +265,11 @@ static int bt_get(struct blk_mq_alloc_da
+ /*
+ * We're out of tags on this hardware queue, kick any
+ * pending IO submits before going to sleep waiting for
+- * some to complete.
++ * some to complete. Note that hctx can be NULL here for
++ * reserved tag allocation.
+ */
+- blk_mq_run_hw_queue(hctx, false);
++ if (hctx)
++ blk_mq_run_hw_queue(hctx, false);
+
+ /*
+ * Retry tag allocation after running the hardware queue,
--- /dev/null
+From e9637415a92cf25ad800b7fdeddcd30cce7b44ab Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Mon, 30 Mar 2015 13:39:09 -0400
+Subject: block: fix blk_stack_limits() regression due to lcm() change
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit e9637415a92cf25ad800b7fdeddcd30cce7b44ab upstream.
+
+Linux 3.19 commit 69c953c ("lib/lcm.c: lcm(n,0)=lcm(0,n) is 0, not n")
+caused blk_stack_limits() to not properly stack queue_limits for stacked
+devices (e.g. DM).
+
+Fix this regression by establishing lcm_not_zero() and switching
+blk_stack_limits() over to using it.
+
+DM uses blk_set_stacking_limits() to establish the initial top-level
+queue_limits that are then built up based on underlying devices' limits
+using blk_stack_limits(). In the case of optimal_io_size (io_opt)
+blk_set_stacking_limits() establishes a default value of 0. With commit
+69c953c, lcm(0, n) is no longer n, which compromises proper stacking of
+the underlying devices' io_opt.
+
+Test:
+$ modprobe scsi_debug dev_size_mb=10 num_tgts=1 opt_blks=1536
+$ cat /sys/block/sde/queue/optimal_io_size
+786432
+$ dmsetup create node --table "0 100 linear /dev/sde 0"
+
+Before this fix:
+$ cat /sys/block/dm-5/queue/optimal_io_size
+0
+
+After this fix:
+$ cat /sys/block/dm-5/queue/optimal_io_size
+786432
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-settings.c | 6 +++---
+ include/linux/lcm.h | 1 +
+ lib/lcm.c | 11 +++++++++++
+ 3 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -585,7 +585,7 @@ int blk_stack_limits(struct queue_limits
+ b->physical_block_size);
+
+ t->io_min = max(t->io_min, b->io_min);
+- t->io_opt = lcm(t->io_opt, b->io_opt);
++ t->io_opt = lcm_not_zero(t->io_opt, b->io_opt);
+
+ t->cluster &= b->cluster;
+ t->discard_zeroes_data &= b->discard_zeroes_data;
+@@ -616,7 +616,7 @@ int blk_stack_limits(struct queue_limits
+ b->raid_partial_stripes_expensive);
+
+ /* Find lowest common alignment_offset */
+- t->alignment_offset = lcm(t->alignment_offset, alignment)
++ t->alignment_offset = lcm_not_zero(t->alignment_offset, alignment)
+ % max(t->physical_block_size, t->io_min);
+
+ /* Verify that new alignment_offset is on a logical block boundary */
+@@ -643,7 +643,7 @@ int blk_stack_limits(struct queue_limits
+ b->max_discard_sectors);
+ t->discard_granularity = max(t->discard_granularity,
+ b->discard_granularity);
+- t->discard_alignment = lcm(t->discard_alignment, alignment) %
++ t->discard_alignment = lcm_not_zero(t->discard_alignment, alignment) %
+ t->discard_granularity;
+ }
+
+--- a/include/linux/lcm.h
++++ b/include/linux/lcm.h
+@@ -4,5 +4,6 @@
+ #include <linux/compiler.h>
+
+ unsigned long lcm(unsigned long a, unsigned long b) __attribute_const__;
++unsigned long lcm_not_zero(unsigned long a, unsigned long b) __attribute_const__;
+
+ #endif /* _LCM_H */
+--- a/lib/lcm.c
++++ b/lib/lcm.c
+@@ -12,3 +12,14 @@ unsigned long lcm(unsigned long a, unsig
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(lcm);
++
++unsigned long lcm_not_zero(unsigned long a, unsigned long b)
++{
++ unsigned long l = lcm(a, b);
++
++ if (l)
++ return l;
++
++ return (b ? : a);
++}
++EXPORT_SYMBOL_GPL(lcm_not_zero);
--- /dev/null
+From 1365aa6266fad0669487240af3f098593796172c Mon Sep 17 00:00:00 2001
+From: Oded Gabbay <oded.gabbay@amd.com>
+Date: Tue, 17 Feb 2015 11:58:27 +0200
+Subject: drm/amdkfd: Initialize only amdkfd's assigned pipelines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Oded Gabbay <oded.gabbay@amd.com>
+
+commit 1365aa6266fad0669487240af3f098593796172c upstream.
+
+This patch fixes a bug in the initialization of the pipelines. The
+init_pipelines() function was called with a constant value of 0 in the
+first_pipe argument. This is an error because amdkfd doesn't handle pipe 0.
+
+The correct way is to pass the value that get_first_pipe() returns as the
+argument for first_pipe.
+
+This bug appeared in 3.19 (first version with amdkfd) and it causes around 15%
+drop in CPU performance of Kaveri (A10-7850).
+
+v2: Don't set get_first_pipe() as inline because it calls BUG_ON()
+
+Signed-off-by: Oded Gabbay <oded.gabbay@amd.com>
+Tested-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -56,9 +56,9 @@ static inline unsigned int get_pipes_num
+ return dqm->dev->shared_resources.compute_pipe_count;
+ }
+
+-static inline unsigned int get_first_pipe(struct device_queue_manager *dqm)
++unsigned int get_first_pipe(struct device_queue_manager *dqm)
+ {
+- BUG_ON(!dqm);
++ BUG_ON(!dqm || !dqm->dev);
+ return dqm->dev->shared_resources.first_compute_pipe;
+ }
+
+@@ -693,7 +693,7 @@ static int initialize_cpsch(struct devic
+ INIT_LIST_HEAD(&dqm->queues);
+ dqm->queue_count = dqm->processes_count = 0;
+ dqm->active_runlist = false;
+- retval = init_pipelines(dqm, get_pipes_num(dqm), 0);
++ retval = init_pipelines(dqm, get_pipes_num(dqm), get_first_pipe(dqm));
+ if (retval != 0)
+ goto fail_init_pipelines;
+
--- /dev/null
+From ad692b46dbf122ef90aadce3b389ef64c90e861d Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Thu, 26 Mar 2015 10:42:00 +0200
+Subject: drm/edid: set ELD for firmware and debugfs override EDIDs
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit ad692b46dbf122ef90aadce3b389ef64c90e861d upstream.
+
+If the user supplies EDID through firmware or debugfs override, the
+driver callbacks are bypassed and the connector ELD does not get
+updated, and audio fails. Set ELD for firmware and debugfs EDIDs too.
+
+There should be no harm in gratuitously doing this for non HDMI/DP
+connectors, as it's still up to the driver to use the ELD, if any.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82349
+Reference: https://bugs.freedesktop.org/show_bug.cgi?id=80691
+Reported-by: Emil <emilsvennesson@gmail.com>
+Reported-by: Rob Engle <grenoble@gmail.com>
+Tested-by: Jolan Luff <jolan@gormsby.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_edid_load.c | 1 +
+ drivers/gpu/drm/drm_probe_helper.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/drm_edid_load.c
++++ b/drivers/gpu/drm/drm_edid_load.c
+@@ -287,6 +287,7 @@ int drm_load_edid_firmware(struct drm_co
+
+ drm_mode_connector_update_edid_property(connector, edid);
+ ret = drm_add_edid_modes(connector, edid);
++ drm_edid_to_eld(connector, edid);
+ kfree(edid);
+
+ return ret;
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -152,6 +152,7 @@ static int drm_helper_probe_single_conne
+ struct edid *edid = (struct edid *) connector->edid_blob_ptr->data;
+
+ count = drm_add_edid_modes(connector, edid);
++ drm_edid_to_eld(connector, edid);
+ } else
+ count = (*connector_funcs->get_modes)(connector);
+ }
--- /dev/null
+From 8218c3f4df3bb1c637c17552405039a6dd3c1ee1 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 27 Feb 2015 12:58:13 +0100
+Subject: drm: Fixup racy refcounting in plane_force_disable
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 8218c3f4df3bb1c637c17552405039a6dd3c1ee1 upstream.
+
+Originally it was impossible to be dropping the last refcount in this
+function since there was always one around still from the idr. But in
+
+commit 83f45fc360c8e16a330474860ebda872d1384c8c
+Author: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed Aug 6 09:10:18 2014 +0200
+
+ drm: Don't grab an fb reference for the idr
+
+we've switched to weak references, broke that assumption but forgot to
+fix it up.
+
+Since we still force-disable planes it's only possible to hit this
+when racing multiple rmfb with fbdev restoring or similar evil things.
+As long as userspace is nice it's impossible to hit the BUG_ON.
+
+But the BUG_ON would most likely be hit from fbdev code, which usually
+invovles the console_lock besides all modeset locks. So very likely
+we'd never get the bug reports if this was hit in the wild, hence
+better be safe than sorry and backport.
+
+Spotted by Matt Roper while reviewing other patches.
+
+[airlied: pull this back into 4.0 - the oops happens there]
+
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_crtc.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -531,17 +531,6 @@ void drm_framebuffer_reference(struct dr
+ }
+ EXPORT_SYMBOL(drm_framebuffer_reference);
+
+-static void drm_framebuffer_free_bug(struct kref *kref)
+-{
+- BUG();
+-}
+-
+-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
+-{
+- DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
+- kref_put(&fb->refcount, drm_framebuffer_free_bug);
+-}
+-
+ /**
+ * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
+ * @fb: fb to unregister
+@@ -1322,7 +1311,7 @@ void drm_plane_force_disable(struct drm_
+ return;
+ }
+ /* disconnect the plane from the fb and crtc: */
+- __drm_framebuffer_unreference(plane->old_fb);
++ drm_framebuffer_unreference(plane->old_fb);
+ plane->old_fb = NULL;
+ plane->fb = NULL;
+ plane->crtc = NULL;
--- /dev/null
+From f37b5c2be8979993efee2da50b51126e3908eb8b Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Tue, 10 Feb 2015 23:12:27 +0100
+Subject: drm/i915: Align initial plane backing objects correctly
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit f37b5c2be8979993efee2da50b51126e3908eb8b upstream.
+
+Some bios really like to joke and start the planes at an offset ...
+hooray!
+
+Align start and end to fix this.
+
+v2: Fixup calculation of size, spotted by Chris Wilson.
+
+v3: Fix serious fumble I've just spotted.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=86883
+Cc: Johannes W <jargon@molb.org>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Reported-and-tested-by: Johannes W <jargon@molb.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+[Jani: split WARN_ONs, rebase on v4.0-rc1]
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem_stolen.c | 5 +----
+ drivers/gpu/drm/i915/intel_display.c | 18 +++++++++++-------
+ 2 files changed, 12 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -485,10 +485,7 @@ i915_gem_object_create_stolen_for_preall
+ stolen_offset, gtt_offset, size);
+
+ /* KISS and expect everything to be page-aligned */
+- BUG_ON(stolen_offset & 4095);
+- BUG_ON(size & 4095);
+-
+- if (WARN_ON(size == 0))
++ if (WARN_ON(size == 0 || stolen_offset & 4095 || size & 4095))
+ return NULL;
+
+ stolen = kzalloc(sizeof(*stolen), GFP_KERNEL);
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2339,13 +2339,19 @@ static bool intel_alloc_plane_obj(struct
+ struct drm_device *dev = crtc->base.dev;
+ struct drm_i915_gem_object *obj = NULL;
+ struct drm_mode_fb_cmd2 mode_cmd = { 0 };
+- u32 base = plane_config->base;
++ u32 base_aligned = round_down(plane_config->base, PAGE_SIZE);
++ u32 size_aligned = round_up(plane_config->base + plane_config->size,
++ PAGE_SIZE);
++
++ size_aligned -= base_aligned;
+
+ if (plane_config->size == 0)
+ return false;
+
+- obj = i915_gem_object_create_stolen_for_preallocated(dev, base, base,
+- plane_config->size);
++ obj = i915_gem_object_create_stolen_for_preallocated(dev,
++ base_aligned,
++ base_aligned,
++ size_aligned);
+ if (!obj)
+ return false;
+
+@@ -6660,8 +6666,7 @@ static void i9xx_get_plane_config(struct
+ aligned_height = intel_align_height(dev, crtc->base.primary->fb->height,
+ plane_config->tiled);
+
+- plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] *
+- aligned_height);
++ plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height;
+
+ DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
+ pipe, plane, crtc->base.primary->fb->width,
+@@ -7711,8 +7716,7 @@ static void ironlake_get_plane_config(st
+ aligned_height = intel_align_height(dev, crtc->base.primary->fb->height,
+ plane_config->tiled);
+
+- plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] *
+- aligned_height);
++ plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height;
+
+ DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
+ pipe, plane, crtc->base.primary->fb->width,
--- /dev/null
+From c9c52e24194a741f9fca96e7aa965f0fa36af504 Mon Sep 17 00:00:00 2001
+From: Deepak S <deepak.s@linux.intel.com>
+Date: Sat, 28 Mar 2015 15:23:34 +0530
+Subject: drm/i915/chv: Remove Wait for a previous gfx force-off
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Deepak S <deepak.s@linux.intel.com>
+
+commit c9c52e24194a741f9fca96e7aa965f0fa36af504 upstream.
+
+On CHV, PUNIT team confirmed that 'VLV_GFX_CLK_STATUS_BIT' is not a
+sticky bit and it will always be set. So ignore Check for previous
+Gfx force off during suspend and allow the force clk as part S0ix
+Sequence
+
+Signed-off-by: Deepak S <deepak.s@linux.intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_drv.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -1196,11 +1196,13 @@ int vlv_force_gfx_clock(struct drm_i915_
+ int err;
+
+ val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
+- WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on);
+
+ #define COND (I915_READ(VLV_GTLC_SURVIVABILITY_REG) & VLV_GFX_CLK_STATUS_BIT)
+ /* Wait for a previous force-off to settle */
+- if (force_on) {
++ if (force_on && !IS_CHERRYVIEW(dev_priv->dev)) {
++ /* WARN_ON only for the Valleyview */
++ WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on);
++
+ err = wait_for(!COND, 20);
+ if (err) {
+ DRM_ERROR("timeout waiting for GFX clock force-off (%08x)\n",
--- /dev/null
+From 840a1cf0cd533f30da792527ca5ff6a023d4a727 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Fri, 27 Mar 2015 19:59:40 +0200
+Subject: drm/i915: Reject the colorkey ioctls for primary and cursor planes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+
+commit 840a1cf0cd533f30da792527ca5ff6a023d4a727 upstream.
+
+The legcy colorkey ioctls are only implemented for sprite planes, so
+reject the ioctl for primary/cursor planes. If we want to support
+colorkeying with these planes (assuming we have hw support of course)
+we should just move ahead with the colorkey property conversion.
+
+Testcase: kms_legacy_colorkey
+Cc: Tommi Rantala <tt.rantala@gmail.com>
+Reference: http://mid.gmane.org/CA+ydwtr+bCo7LJ44JFmUkVRx144UDFgOS+aJTfK6KHtvBDVuAw@mail.gmail.com
+Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_sprite.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_sprite.c
++++ b/drivers/gpu/drm/i915/intel_sprite.c
+@@ -1495,7 +1495,7 @@ int intel_sprite_set_colorkey(struct drm
+ drm_modeset_lock_all(dev);
+
+ plane = drm_plane_find(dev, set->plane_id);
+- if (!plane) {
++ if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
+ ret = -ENOENT;
+ goto out_unlock;
+ }
+@@ -1522,7 +1522,7 @@ int intel_sprite_get_colorkey(struct drm
+ drm_modeset_lock_all(dev);
+
+ plane = drm_plane_find(dev, get->plane_id);
+- if (!plane) {
++ if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
+ ret = -ENOENT;
+ goto out_unlock;
+ }
--- /dev/null
+From 5df0582bf036bb5f9a8ad8db5884fe13a55347d1 Mon Sep 17 00:00:00 2001
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+Date: Wed, 1 Apr 2015 14:22:58 -0700
+Subject: drm/i915/vlv: remove wait for previous GFX clk disable request
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit 5df0582bf036bb5f9a8ad8db5884fe13a55347d1 upstream.
+
+Looks like it was introduced in:
+
+commit 650ad970a39f8b6164fe8613edc150f585315289
+Author: Imre Deak <imre.deak@intel.com>
+Date: Fri Apr 18 16:35:02 2014 +0300
+
+ drm/i915: vlv: factor out vlv_force_gfx_clock and check for pending force-of
+
+but I'm not sure why. It has caused problems for us in the past (see
+85250ddff7a6 "drm/i915/chv: Remove Wait for a previous gfx force-off"
+and 8d4eee9cd7a1 "drm/i915: vlv: increase timeout when forcing on the
+GFX clock") and doesn't seem to be required, so let's just drop it.
+
+References: https://bugs.freedesktop.org/show_bug.cgi?id=89611
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Tested-by: Darren Hart <dvhart@linux.intel.com>
+Reviewed-by: Deepak S <deepak.s@linux.intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_drv.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -1197,21 +1197,7 @@ int vlv_force_gfx_clock(struct drm_i915_
+ u32 val;
+ int err;
+
+- val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
+-
+ #define COND (I915_READ(VLV_GTLC_SURVIVABILITY_REG) & VLV_GFX_CLK_STATUS_BIT)
+- /* Wait for a previous force-off to settle */
+- if (force_on && !IS_CHERRYVIEW(dev_priv->dev)) {
+- /* WARN_ON only for the Valleyview */
+- WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on);
+-
+- err = wait_for(!COND, 20);
+- if (err) {
+- DRM_ERROR("timeout waiting for GFX clock force-off (%08x)\n",
+- I915_READ(VLV_GTLC_SURVIVABILITY_REG));
+- return err;
+- }
+- }
+
+ val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
+ val &= ~VLV_GFX_CLK_FORCE_ON_BIT;
--- /dev/null
+From 9c25210fd30991e68f93e2ec0857de2d967b5766 Mon Sep 17 00:00:00 2001
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+Date: Wed, 1 Apr 2015 14:22:57 -0700
+Subject: drm/i915/vlv: save/restore the power context base reg
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit 9c25210fd30991e68f93e2ec0857de2d967b5766 upstream.
+
+Some BIOSes (e.g. the one on the Minnowboard) don't save/restore this
+reg. If it's unlocked, we can just restore the previous value, and if
+it's locked (in case the BIOS re-programmed it for us) the write will be
+ignored and we'll still have "did it move" sanity check in the PM code to
+warn us if something is still amiss.
+
+References: https://bugs.freedesktop.org/show_bug.cgi?id=89611
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Tested-by: Darren Hart <dvhart@linux.intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Deepak S <deepak.s@linux.intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_drv.c | 2 ++
+ drivers/gpu/drm/i915/i915_drv.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -1093,6 +1093,7 @@ static void vlv_save_gunit_s0ix_state(st
+ /* Gunit-Display CZ domain, 0x182028-0x1821CF */
+ s->gu_ctl0 = I915_READ(VLV_GU_CTL0);
+ s->gu_ctl1 = I915_READ(VLV_GU_CTL1);
++ s->pcbr = I915_READ(VLV_PCBR);
+ s->clock_gate_dis2 = I915_READ(VLV_GUNIT_CLOCK_GATE2);
+
+ /*
+@@ -1187,6 +1188,7 @@ static void vlv_restore_gunit_s0ix_state
+ /* Gunit-Display CZ domain, 0x182028-0x1821CF */
+ I915_WRITE(VLV_GU_CTL0, s->gu_ctl0);
+ I915_WRITE(VLV_GU_CTL1, s->gu_ctl1);
++ I915_WRITE(VLV_PCBR, s->pcbr);
+ I915_WRITE(VLV_GUNIT_CLOCK_GATE2, s->clock_gate_dis2);
+ }
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -985,6 +985,7 @@ struct vlv_s0ix_state {
+ /* Display 2 CZ domain */
+ u32 gu_ctl0;
+ u32 gu_ctl1;
++ u32 pcbr;
+ u32 clock_gate_dis2;
+ };
+
--- /dev/null
+From 863653fed0f449fb738295255cc834b271cfa088 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Tue, 31 Mar 2015 17:36:57 +0200
+Subject: drm/radeon: add extra check in radeon_ttm_tt_unpin_userptr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit 863653fed0f449fb738295255cc834b271cfa088 upstream.
+
+We somehow try to free the SG table twice.
+
+Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=89734
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_ttm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -598,6 +598,10 @@ static void radeon_ttm_tt_unpin_userptr(
+ enum dma_data_direction direction = write ?
+ DMA_BIDIRECTIONAL : DMA_TO_DEVICE;
+
++ /* double check that we don't free the table twice */
++ if (!ttm->sg->sgl)
++ return;
++
+ /* free the sg table and pages again */
+ dma_unmap_sg(rdev->dev, ttm->sg->sgl, ttm->sg->nents, direction);
+
--- /dev/null
+From 3899ca844b82fb201fb764f56eec483acb59a29c Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 18 Mar 2015 17:05:10 -0400
+Subject: drm/radeon/dpm: fix 120hz handling harder
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 3899ca844b82fb201fb764f56eec483acb59a29c upstream.
+
+Need to expand the check to handle short circuiting
+if the selected state is the same as current state.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=87796
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon.h | 1 +
+ drivers/gpu/drm/radeon/radeon_pm.c | 22 +++++++++++++++++-----
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -1565,6 +1565,7 @@ struct radeon_dpm {
+ int new_active_crtc_count;
+ u32 current_active_crtcs;
+ int current_active_crtc_count;
++ bool single_display;
+ struct radeon_dpm_dynamic_state dyn_state;
+ struct radeon_dpm_fan fan;
+ u32 tdp_limit;
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -704,12 +704,8 @@ static void radeon_dpm_thermal_work_hand
+ radeon_pm_compute_clocks(rdev);
+ }
+
+-static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
+- enum radeon_pm_state_type dpm_state)
++static bool radeon_dpm_single_display(struct radeon_device *rdev)
+ {
+- int i;
+- struct radeon_ps *ps;
+- u32 ui_class;
+ bool single_display = (rdev->pm.dpm.new_active_crtc_count < 2) ?
+ true : false;
+
+@@ -719,6 +715,17 @@ static struct radeon_ps *radeon_dpm_pick
+ single_display = false;
+ }
+
++ return single_display;
++}
++
++static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
++ enum radeon_pm_state_type dpm_state)
++{
++ int i;
++ struct radeon_ps *ps;
++ u32 ui_class;
++ bool single_display = radeon_dpm_single_display(rdev);
++
+ /* certain older asics have a separare 3D performance state,
+ * so try that first if the user selected performance
+ */
+@@ -844,6 +851,7 @@ static void radeon_dpm_change_power_stat
+ struct radeon_ps *ps;
+ enum radeon_pm_state_type dpm_state;
+ int ret;
++ bool single_display = radeon_dpm_single_display(rdev);
+
+ /* if dpm init failed */
+ if (!rdev->pm.dpm_enabled)
+@@ -868,6 +876,9 @@ static void radeon_dpm_change_power_stat
+ /* vce just modifies an existing state so force a change */
+ if (ps->vce_active != rdev->pm.dpm.vce_active)
+ goto force;
++ /* user has made a display change (such as timing) */
++ if (rdev->pm.dpm.single_display != single_display)
++ goto force;
+ if ((rdev->family < CHIP_BARTS) || (rdev->flags & RADEON_IS_IGP)) {
+ /* for pre-BTC and APUs if the num crtcs changed but state is the same,
+ * all we need to do is update the display configuration.
+@@ -930,6 +941,7 @@ force:
+
+ rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
+ rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
++ rdev->pm.dpm.single_display = single_display;
+
+ /* wait for the rings to drain */
+ for (i = 0; i < RADEON_NUM_RINGS; i++) {
--- /dev/null
+From 22e2e86560c5fca6f9b9d078f221fcdab9947a5e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Tue, 31 Mar 2015 17:36:58 +0200
+Subject: drm/radeon: fix wait in radeon_mn_invalidate_range_start
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit 22e2e86560c5fca6f9b9d078f221fcdab9947a5e upstream.
+
+We need to wait for all fences, not just the exclusive one.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_mn.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_mn.c
++++ b/drivers/gpu/drm/radeon/radeon_mn.c
+@@ -122,7 +122,6 @@ static void radeon_mn_invalidate_range_s
+ it = interval_tree_iter_first(&rmn->objects, start, end);
+ while (it) {
+ struct radeon_bo *bo;
+- struct fence *fence;
+ int r;
+
+ bo = container_of(it, struct radeon_bo, mn_it);
+@@ -134,12 +133,10 @@ static void radeon_mn_invalidate_range_s
+ continue;
+ }
+
+- fence = reservation_object_get_excl(bo->tbo.resv);
+- if (fence) {
+- r = radeon_fence_wait((struct radeon_fence *)fence, false);
+- if (r)
+- DRM_ERROR("(%d) failed to wait for user bo\n", r);
+- }
++ r = reservation_object_wait_timeout_rcu(bo->tbo.resv, true,
++ false, MAX_SCHEDULE_TIMEOUT);
++ if (r)
++ DRM_ERROR("(%d) failed to wait for user bo\n", r);
+
+ radeon_ttm_placement_from_domain(bo, RADEON_GEM_DOMAIN_CPU);
+ r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
--- /dev/null
+From 7ee8e4f3983c4ff700958a6099c8fd212ea67b94 Mon Sep 17 00:00:00 2001
+From: Wenbo Wang <wenbo.wang@memblaze.com>
+Date: Fri, 20 Mar 2015 01:04:54 -0400
+Subject: Fix bug in blk_rq_merge_ok
+
+From: Wenbo Wang <wenbo.wang@memblaze.com>
+
+commit 7ee8e4f3983c4ff700958a6099c8fd212ea67b94 upstream.
+
+Use the right array index to reference the last
+element of rq->biotail->bi_io_vec[]
+
+Signed-off-by: Wenbo Wang <wenbo.wang@memblaze.com>
+Reviewed-by: Chong Yuan <chong.yuan@memblaze.com>
+Fixes: 66cb45aa41315 ("block: add support for limiting gaps in SG lists")
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-merge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -609,7 +609,7 @@ bool blk_rq_merge_ok(struct request *rq,
+ if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS)) {
+ struct bio_vec *bprev;
+
+- bprev = &rq->biotail->bi_io_vec[bio->bi_vcnt - 1];
++ bprev = &rq->biotail->bi_io_vec[rq->biotail->bi_vcnt - 1];
+ if (bvec_gap_to_prev(bprev, bio->bi_io_vec[0].bv_offset))
+ return false;
+ }
--- /dev/null
+From a1b7f2f6367944d445c6853035830a35c6343939 Mon Sep 17 00:00:00 2001
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Date: Thu, 26 Feb 2015 09:55:03 +0100
+Subject: PCI/AER: Avoid info leak in __print_tlp_header()
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+commit a1b7f2f6367944d445c6853035830a35c6343939 upstream.
+
+Commit fab4c256a58b ("PCI/AER: Add a TLP header print helper") introduced
+the helper function __print_tlp_header(), but contrary to the intention,
+the behaviour did change: Since we're taking the address of the parameter
+t, the first 4 or 8 bytes printed will be the value of the pointer t
+itself, and the remaining 12 or 8 bytes will be who-knows-what (something
+from the stack).
+
+We want to show the values of the four members of the struct
+aer_header_log_regs; that can be done without ugly and error-prone casts.
+On little-endian this should produce the same output as originally
+intended, and since no-one has complained about getting garbage output so
+far, I think big-endian should be ok too.
+
+Fixes: fab4c256a58b ("PCI/AER: Add a TLP header print helper")
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/pcie/aer/aerdrv_errprint.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+--- a/drivers/pci/pcie/aer/aerdrv_errprint.c
++++ b/drivers/pci/pcie/aer/aerdrv_errprint.c
+@@ -132,16 +132,8 @@ static const char *aer_agent_string[] =
+ static void __print_tlp_header(struct pci_dev *dev,
+ struct aer_header_log_regs *t)
+ {
+- unsigned char *tlp = (unsigned char *)&t;
+-
+- dev_err(&dev->dev, " TLP Header:"
+- " %02x%02x%02x%02x %02x%02x%02x%02x"
+- " %02x%02x%02x%02x %02x%02x%02x%02x\n",
+- *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp,
+- *(tlp + 7), *(tlp + 6), *(tlp + 5), *(tlp + 4),
+- *(tlp + 11), *(tlp + 10), *(tlp + 9),
+- *(tlp + 8), *(tlp + 15), *(tlp + 14),
+- *(tlp + 13), *(tlp + 12));
++ dev_err(&dev->dev, " TLP Header: %08x %08x %08x %08x\n",
++ t->dw0, t->dw1, t->dw2, t->dw3);
+ }
+
+ static void __aer_print_error(struct pci_dev *dev,
--- /dev/null
+From bc3b5b47c80da8838758731d423179262c9c36ec Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 25 Feb 2015 16:23:22 +0300
+Subject: PCI: cpcihp: Add missing curly braces in cpci_configure_slot()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit bc3b5b47c80da8838758731d423179262c9c36ec upstream.
+
+I don't have this hardware but it looks like we weren't adding bridge
+devices as intended. Maybe the bridge is always the last device?
+
+Fixes: 05b125004815 ("PCI: cpcihp: Iterate over all devices in slot, not functions 0-7")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Yijing Wang <wangyijing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/hotplug/cpci_hotplug_pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/hotplug/cpci_hotplug_pci.c
++++ b/drivers/pci/hotplug/cpci_hotplug_pci.c
+@@ -286,11 +286,12 @@ int cpci_configure_slot(struct slot *slo
+ }
+ parent = slot->dev->bus;
+
+- list_for_each_entry(dev, &parent->devices, bus_list)
++ list_for_each_entry(dev, &parent->devices, bus_list) {
+ if (PCI_SLOT(dev->devfn) != PCI_SLOT(slot->devfn))
+ continue;
+ if (pci_is_bridge(dev))
+ pci_hp_add_bridge(dev);
++ }
+
+
+ pci_assign_unassigned_bridge_resources(parent->self);
--- /dev/null
+From 8647ca9ad5a0065ad53a2ad7e39163592b6ed35e Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Tue, 24 Mar 2015 11:12:45 -0500
+Subject: PCI: Don't look for ACPI hotplug parameters if ACPI is disabled
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 8647ca9ad5a0065ad53a2ad7e39163592b6ed35e upstream.
+
+Booting a v3.18 or newer Xen domU kernel with PCI devices passed through
+results in an oops (this is a 32-bit 3.13.11 dom0 with a 64-bit 4.4.0
+hypervisor and 32-bit domU):
+
+ BUG: unable to handle kernel paging request at 0030303e
+ IP: [<c06ed0e6>] acpi_ns_validate_handle+0x12/0x1a
+ Call Trace:
+ [<c06eda4d>] ? acpi_evaluate_object+0x31/0x1fc
+ [<c06b78e1>] ? pci_get_hp_params+0x111/0x4e0
+ [<c0407bc7>] ? xen_force_evtchn_callback+0x17/0x30
+ [<c04085fb>] ? xen_restore_fl_direct_reloc+0x4/0x4
+ [<c0699d34>] ? pci_device_add+0x24/0x450
+
+Don't look for ACPI configuration information if ACPI has been disabled.
+
+I don't think this is the best fix, because we can boot plain Linux (no
+Xen) with "acpi=off", and we don't need this check in pci_get_hp_params().
+There should be a better fix that would make Xen domU work the same way.
+The domU kernel has ACPI support but it has no AML. There should be a way
+to initialize the ACPI data structures so things fail gracefully rather
+than oopsing. This is an interim fix to address the regression.
+
+Fixes: 6cd33649fa83 ("PCI: Add pci_configure_device() during enumeration")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=96301
+Reported-by: Michael D Labriola <mlabriol@gdeb.com>
+Tested-by: Michael D Labriola <mlabriol@gdeb.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/pci-acpi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -248,6 +248,9 @@ int pci_get_hp_params(struct pci_dev *de
+ acpi_handle handle, phandle;
+ struct pci_bus *pbus;
+
++ if (acpi_pci_disabled)
++ return -ENODEV;
++
+ handle = NULL;
+ for (pbus = dev->bus; pbus; pbus = pbus->parent) {
+ handle = acpi_pci_get_bridge_handle(pbus);
--- /dev/null
+From a43f32d647273023edddb0dc8f91c4c6378b252b Mon Sep 17 00:00:00 2001
+From: "Matwey V. Kornilov" <matwey@sai.msu.ru>
+Date: Thu, 19 Feb 2015 20:41:48 +0300
+Subject: PCI: spear: Drop __initdata from spear13xx_pcie_driver
+
+From: "Matwey V. Kornilov" <matwey@sai.msu.ru>
+
+commit a43f32d647273023edddb0dc8f91c4c6378b252b upstream.
+
+Struct spear13xx_pcie_driver was in initdata, but we passed a pointer to it
+to platform_driver_register(), which can use the pointer at arbitrary times
+in the future, even after the initdata is freed. That leads to crashes.
+
+Move spear13xx_pcie_driver and things referenced by it
+(spear13xx_pcie_probe() and dw_pcie_host_init()) out of initdata.
+
+[bhelgaas: changelog]
+Fixes: 6675ef212dac ("PCI: spear: Fix Section mismatch compilation warning for probe()")
+Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pcie-designware.c | 2 +-
+ drivers/pci/host/pcie-spear13xx.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/pci/host/pcie-designware.c
++++ b/drivers/pci/host/pcie-designware.c
+@@ -342,7 +342,7 @@ static const struct irq_domain_ops msi_d
+ .map = dw_pcie_msi_map,
+ };
+
+-int __init dw_pcie_host_init(struct pcie_port *pp)
++int dw_pcie_host_init(struct pcie_port *pp)
+ {
+ struct device_node *np = pp->dev->of_node;
+ struct platform_device *pdev = to_platform_device(pp->dev);
+--- a/drivers/pci/host/pcie-spear13xx.c
++++ b/drivers/pci/host/pcie-spear13xx.c
+@@ -269,7 +269,7 @@ static struct pcie_host_ops spear13xx_pc
+ .host_init = spear13xx_pcie_host_init,
+ };
+
+-static int __init spear13xx_add_pcie_port(struct pcie_port *pp,
++static int spear13xx_add_pcie_port(struct pcie_port *pp,
+ struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -299,7 +299,7 @@ static int __init spear13xx_add_pcie_por
+ return 0;
+ }
+
+-static int __init spear13xx_pcie_probe(struct platform_device *pdev)
++static int spear13xx_pcie_probe(struct platform_device *pdev)
+ {
+ struct spear13xx_pcie *spear13xx_pcie;
+ struct pcie_port *pp;
+@@ -370,7 +370,7 @@ static const struct of_device_id spear13
+ };
+ MODULE_DEVICE_TABLE(of, spear13xx_pcie_of_match);
+
+-static struct platform_driver spear13xx_pcie_driver __initdata = {
++static struct platform_driver spear13xx_pcie_driver = {
+ .probe = spear13xx_pcie_probe,
+ .driver = {
+ .name = "spear-pcie",
--- /dev/null
+From d10b730f97a7f1fa58c9ec300828f87157cd6b95 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Wed, 8 Apr 2015 10:04:55 -0500
+Subject: Revert "sparc/PCI: Clip bridge windows to fit in upstream windows"
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit d10b730f97a7f1fa58c9ec300828f87157cd6b95 upstream.
+
+This reverts commit d63e2e1f3df904bf6bd150bdafb42ddbb3257ea8.
+
+David Ahern reported that d63e2e1f3df9 breaks booting on an 8-socket T5
+sparc system. He also verified that the system boots with d63e2e1f3df9
+reverted. Yinghai has some fixes, but they need a little more polishing
+than we can do before v4.0.
+
+Link: http://lkml.kernel.org/r/5514391F.2030300@oracle.com # report
+Link: http://lkml.kernel.org/r/1427857069-6789-1-git-send-email-yinghai@kernel.org # patches
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sparc/kernel/pci.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/arch/sparc/kernel/pci.c
++++ b/arch/sparc/kernel/pci.c
+@@ -639,10 +639,7 @@ static void pci_claim_bus_resources(stru
+ (unsigned long long)r->end,
+ (unsigned int)r->flags);
+
+- if (pci_claim_resource(dev, i) == 0)
+- continue;
+-
+- pci_claim_bridge_resource(dev, i);
++ pci_claim_resource(dev, i);
+ }
+ }
+
--- /dev/null
+From 6436a123a147db51a0b06024a8350f4c230e73ff Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe@perches.com>
+Date: Mon, 23 Mar 2015 18:01:35 -0700
+Subject: selinux: fix sel_write_enforce broken return value
+
+From: Joe Perches <joe@perches.com>
+
+commit 6436a123a147db51a0b06024a8350f4c230e73ff upstream.
+
+Return a negative error value like the rest of the entries in this function.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+[PM: tweaked subject line]
+Signed-off-by: Paul Moore <pmoore@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/selinux/selinuxfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct
+ goto out;
+
+ /* No partial writes. */
+- length = EINVAL;
++ length = -EINVAL;
+ if (*ppos != 0)
+ goto out;
+
alsa-bebob-fix-to-processing-in-big-endian-machine-for-sending-cue.patch
alsa-hda-realtek-make-more-stable-to-get-pin-sense-for-alc283.patch
alsa-hda-fix-headphone-pin-config-for-lifebook-t731.patch
+pci-aer-avoid-info-leak-in-__print_tlp_header.patch
+pci-cpcihp-add-missing-curly-braces-in-cpci_configure_slot.patch
+revert-sparc-pci-clip-bridge-windows-to-fit-in-upstream-windows.patch
+pci-don-t-look-for-acpi-hotplug-parameters-if-acpi-is-disabled.patch
+pci-spear-drop-__initdata-from-spear13xx_pcie_driver.patch
+arc-sa_siginfo-ucontext-regs-off-by-one.patch
+arc-signal-handling-robustify.patch
+arm-sunxi-have-arch_sunxi-select-reset_controller-for-clock-driver-usage.patch
+selinux-fix-sel_write_enforce-broken-return-value.patch
+blk-mq-fix-use-of-incorrect-goto-label-in-blk_mq_init_queue-error-path.patch
+blkmq-fix-null-pointer-deref-when-all-reserved-tags-in.patch
+fix-bug-in-blk_rq_merge_ok.patch
+block-fix-blk_stack_limits-regression-due-to-lcm-change.patch
+drm-fixup-racy-refcounting-in-plane_force_disable.patch
+drm-edid-set-eld-for-firmware-and-debugfs-override-edids.patch
+drm-i915-reject-the-colorkey-ioctls-for-primary-and-cursor-planes.patch
+drm-radeon-dpm-fix-120hz-handling-harder.patch
+drm-radeon-add-extra-check-in-radeon_ttm_tt_unpin_userptr.patch
+drm-radeon-fix-wait-in-radeon_mn_invalidate_range_start.patch
+drm-i915-chv-remove-wait-for-a-previous-gfx-force-off.patch
+drm-i915-vlv-save-restore-the-power-context-base-reg.patch
+drm-i915-vlv-remove-wait-for-previous-gfx-clk-disable-request.patch
+drm-amdkfd-initialize-only-amdkfd-s-assigned-pipelines.patch
+drm-i915-align-initial-plane-backing-objects-correctly.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
