--- /dev/null
+From 55441070ca1cbd47ce1ad2959bbf4b47aed9b83b Mon Sep 17 00:00:00 2001
+From: Glenn Ruben Bakke <glennrubenbakke@nordicsemi.no>
+Date: Fri, 22 Apr 2016 18:06:11 +0200
+Subject: Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address
+
+From: Glenn Ruben Bakke <glennrubenbakke@nordicsemi.no>
+
+commit 55441070ca1cbd47ce1ad2959bbf4b47aed9b83b upstream.
+
+The memcpy of ipv6 header destination address to the skb control block
+(sbk->cb) in header_create() results in currupted memory when bt_xmit()
+is issued. The skb->cb is "released" in the return of header_create()
+making room for lower layer to minipulate the skb->cb.
+
+The value retrieved in bt_xmit is not persistent across header creation
+and sending, and the lower layer will overwrite portions of skb->cb,
+making the copied destination address wrong.
+
+The memory corruption will lead to non-working multicast as the first 4
+bytes of the copied destination address is replaced by a value that
+resolves into a non-multicast prefix.
+
+This fix removes the dependency on the skb control block between header
+creation and send, by moving the destination address memcpy to the send
+function path (setup_create, which is called from bt_xmit).
+
+Signed-off-by: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
+Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ net/bluetooth/6lowpan.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -431,15 +431,18 @@ static int setup_header(struct sk_buff *
+ bdaddr_t *peer_addr, u8 *peer_addr_type)
+ {
+ struct in6_addr ipv6_daddr;
++ struct ipv6hdr *hdr;
+ struct lowpan_dev *dev;
+ struct lowpan_peer *peer;
+ bdaddr_t addr, *any = BDADDR_ANY;
+ u8 *daddr = any->b;
+ int err, status = 0;
+
++ hdr = ipv6_hdr(skb);
++
+ dev = lowpan_dev(netdev);
+
+- memcpy(&ipv6_daddr, &lowpan_cb(skb)->addr, sizeof(ipv6_daddr));
++ memcpy(&ipv6_daddr, &hdr->daddr, sizeof(ipv6_daddr));
+
+ if (ipv6_addr_is_multicast(&ipv6_daddr)) {
+ lowpan_cb(skb)->chan = NULL;
+@@ -489,15 +492,9 @@ static int header_create(struct sk_buff
+ unsigned short type, const void *_daddr,
+ const void *_saddr, unsigned int len)
+ {
+- struct ipv6hdr *hdr;
+-
+ if (type != ETH_P_IPV6)
+ return -EINVAL;
+
+- hdr = ipv6_hdr(skb);
+-
+- memcpy(&lowpan_cb(skb)->addr, &hdr->daddr, sizeof(struct in6_addr));
+-
+ return 0;
+ }
+
--- /dev/null
+From b3daa5ef52c26acd7432c787989bd92d48070c76 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Fri, 6 May 2016 16:46:52 +0300
+Subject: drm: Add helper for DP++ adaptors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit b3daa5ef52c26acd7432c787989bd92d48070c76 upstream.
+
+Add a helper which aids in the identification of DP dual mode
+(aka. DP++) adaptors. There are several types of adaptors
+specified: type 1 DVI, type 1 HDMI, type 2 DVI, type 2 HDMI
+
+Type 1 adaptors have a max TMDS clock limit of 165MHz, type 2 adaptors
+may go as high as 300MHz and they provide a register informing the
+source device what the actual limit is. Supposedly also type 1 adaptors
+may optionally implement this register. This TMDS clock limit is the
+main reason why we need to identify these adaptors.
+
+Type 1 adaptors provide access to their internal registers and the sink
+DDC bus through I2C. Type 2 adaptors provide this access both via I2C
+and I2C-over-AUX. A type 2 source device may choose to implement either
+of these methods. If a source device implements the I2C-over-AUX
+method, then the driver will obviously need specific support for such
+adaptors since the port is driven like an HDMI port, but DDC
+communication happes over the AUX channel.
+
+This helper should be enough to identify the adaptor type (some
+type 1 DVI adaptors may be a slight exception) and the maximum TMDS
+clock limit. Another feature that may be available is control over
+the TMDS output buffers on the adaptor, possibly allowing for some
+power saving when the TMDS link is down.
+
+Other user controllable features that may be available in the adaptors
+are downstream i2c bus speed control when using i2c-over-aux, and
+some control over the CEC pin. I chose not to provide any helper
+functions for those since I have no use for them in i915 at this time.
+The rest of the registers in the adaptor are mostly just information,
+eg. IEEE OUI, hardware and firmware revision, etc.
+
+v2: Pass adaptor type to helper functions to ease driver implementation
+ Fix a bunch of typoes (Paulo)
+ Add DRM_DP_DUAL_MODE_UNKNOWN for the case where we don't (yet) know
+ the type (Paulo)
+ Reject 0x00 and 0xff DP_DUAL_MODE_MAX_TMDS_CLOCK values (Paulo)
+ Adjust drm_dp_dual_mode_detect() type2 vs. type1 detection to
+ ease future LSPCON enabling
+ Remove the unused DP_DUAL_MODE_LAST_RESERVED define
+v3: Fix kernel doc function argument descriptions (Jani)
+ s/NONE/UNKNOWN/ in drm_dp_dual_mode_detect() docs
+ Add kernel doc for enum drm_dp_dual_mode_type
+ Actually build the docs
+ Fix more typoes
+v4: Adjust code indentation of type2 adaptor detection (Shashank)
+ Add debug messages for failurs cases (Shashank)
+v5: EXPORT_SYMBOL(drm_dp_dual_mode_read) (Paulo)
+
+Cc: Tore Anderson <tore@fud.no>
+Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Shashank Sharma <shashank.sharma@intel.com> (v4)
+Link: http://patchwork.freedesktop.org/patch/msgid/1462542412-25533-1-git-send-email-ville.syrjala@linux.intel.com
+(cherry picked from commit ede53344dbfd1dd43bfd73eb6af743d37c56a7c3)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/DocBook/gpu.tmpl | 6
+ drivers/gpu/drm/Makefile | 2
+ drivers/gpu/drm/drm_dp_dual_mode_helper.c | 366 ++++++++++++++++++++++++++++++
+ include/drm/drm_dp_dual_mode_helper.h | 92 +++++++
+ 4 files changed, 465 insertions(+), 1 deletion(-)
+
+--- a/Documentation/DocBook/gpu.tmpl
++++ b/Documentation/DocBook/gpu.tmpl
+@@ -1623,6 +1623,12 @@ void intel_crt_init(struct drm_device *d
+ !Edrivers/gpu/drm/drm_dp_helper.c
+ </sect2>
+ <sect2>
++ <title>Display Port Dual Mode Adaptor Helper Functions Reference</title>
++!Pdrivers/gpu/drm/drm_dp_dual_mode_helper.c dp dual mode helpers
++!Iinclude/drm/drm_dp_dual_mode_helper.h
++!Edrivers/gpu/drm/drm_dp_dual_mode_helper.c
++ </sect2>
++ <sect2>
+ <title>Display Port MST Helper Functions Reference</title>
+ !Pdrivers/gpu/drm/drm_dp_mst_topology.c dp mst helper
+ !Iinclude/drm/drm_dp_mst_helper.h
+--- a/drivers/gpu/drm/Makefile
++++ b/drivers/gpu/drm/Makefile
+@@ -23,7 +23,7 @@ drm-$(CONFIG_AGP) += drm_agpsupport.o
+
+ drm_kms_helper-y := drm_crtc_helper.o drm_dp_helper.o drm_probe_helper.o \
+ drm_plane_helper.o drm_dp_mst_topology.o drm_atomic_helper.o \
+- drm_kms_helper_common.o
++ drm_kms_helper_common.o drm_dp_dual_mode_helper.o
+
+ drm_kms_helper-$(CONFIG_DRM_LOAD_EDID_FIRMWARE) += drm_edid_load.o
+ drm_kms_helper-$(CONFIG_DRM_FBDEV_EMULATION) += drm_fb_helper.o
+--- /dev/null
++++ b/drivers/gpu/drm/drm_dp_dual_mode_helper.c
+@@ -0,0 +1,366 @@
++/*
++ * Copyright © 2016 Intel Corporation
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the "Software"),
++ * to deal in the Software without restriction, including without limitation
++ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
++ * and/or sell copies of the Software, and to permit persons to whom the
++ * Software is furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ * OTHER DEALINGS IN THE SOFTWARE.
++ */
++
++#include <linux/errno.h>
++#include <linux/export.h>
++#include <linux/i2c.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++#include <drm/drm_dp_dual_mode_helper.h>
++#include <drm/drmP.h>
++
++/**
++ * DOC: dp dual mode helpers
++ *
++ * Helper functions to deal with DP dual mode (aka. DP++) adaptors.
++ *
++ * Type 1:
++ * Adaptor registers (if any) and the sink DDC bus may be accessed via I2C.
++ *
++ * Type 2:
++ * Adaptor registers and sink DDC bus can be accessed either via I2C or
++ * I2C-over-AUX. Source devices may choose to implement either of these
++ * access methods.
++ */
++
++#define DP_DUAL_MODE_SLAVE_ADDRESS 0x40
++
++/**
++ * drm_dp_dual_mode_read - Read from the DP dual mode adaptor register(s)
++ * @adapter: I2C adapter for the DDC bus
++ * @offset: register offset
++ * @buffer: buffer for return data
++ * @size: sizo of the buffer
++ *
++ * Reads @size bytes from the DP dual mode adaptor registers
++ * starting at @offset.
++ *
++ * Returns:
++ * 0 on success, negative error code on failure
++ */
++ssize_t drm_dp_dual_mode_read(struct i2c_adapter *adapter,
++ u8 offset, void *buffer, size_t size)
++{
++ struct i2c_msg msgs[] = {
++ {
++ .addr = DP_DUAL_MODE_SLAVE_ADDRESS,
++ .flags = 0,
++ .len = 1,
++ .buf = &offset,
++ },
++ {
++ .addr = DP_DUAL_MODE_SLAVE_ADDRESS,
++ .flags = I2C_M_RD,
++ .len = size,
++ .buf = buffer,
++ },
++ };
++ int ret;
++
++ ret = i2c_transfer(adapter, msgs, ARRAY_SIZE(msgs));
++ if (ret < 0)
++ return ret;
++ if (ret != ARRAY_SIZE(msgs))
++ return -EPROTO;
++
++ return 0;
++}
++EXPORT_SYMBOL(drm_dp_dual_mode_read);
++
++/**
++ * drm_dp_dual_mode_write - Write to the DP dual mode adaptor register(s)
++ * @adapter: I2C adapter for the DDC bus
++ * @offset: register offset
++ * @buffer: buffer for write data
++ * @size: sizo of the buffer
++ *
++ * Writes @size bytes to the DP dual mode adaptor registers
++ * starting at @offset.
++ *
++ * Returns:
++ * 0 on success, negative error code on failure
++ */
++ssize_t drm_dp_dual_mode_write(struct i2c_adapter *adapter,
++ u8 offset, const void *buffer, size_t size)
++{
++ struct i2c_msg msg = {
++ .addr = DP_DUAL_MODE_SLAVE_ADDRESS,
++ .flags = 0,
++ .len = 1 + size,
++ .buf = NULL,
++ };
++ void *data;
++ int ret;
++
++ data = kmalloc(msg.len, GFP_TEMPORARY);
++ if (!data)
++ return -ENOMEM;
++
++ msg.buf = data;
++
++ memcpy(data, &offset, 1);
++ memcpy(data + 1, buffer, size);
++
++ ret = i2c_transfer(adapter, &msg, 1);
++
++ kfree(data);
++
++ if (ret < 0)
++ return ret;
++ if (ret != 1)
++ return -EPROTO;
++
++ return 0;
++}
++EXPORT_SYMBOL(drm_dp_dual_mode_write);
++
++static bool is_hdmi_adaptor(const char hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN])
++{
++ static const char dp_dual_mode_hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN] =
++ "DP-HDMI ADAPTOR\x04";
++
++ return memcmp(hdmi_id, dp_dual_mode_hdmi_id,
++ sizeof(dp_dual_mode_hdmi_id)) == 0;
++}
++
++static bool is_type2_adaptor(uint8_t adaptor_id)
++{
++ return adaptor_id == (DP_DUAL_MODE_TYPE_TYPE2 |
++ DP_DUAL_MODE_REV_TYPE2);
++}
++
++/**
++ * drm_dp_dual_mode_detect - Identify the DP dual mode adaptor
++ * @adapter: I2C adapter for the DDC bus
++ *
++ * Attempt to identify the type of the DP dual mode adaptor used.
++ *
++ * Note that when the answer is @DRM_DP_DUAL_MODE_UNKNOWN it's not
++ * certain whether we're dealing with a native HDMI port or
++ * a type 1 DVI dual mode adaptor. The driver will have to use
++ * some other hardware/driver specific mechanism to make that
++ * distinction.
++ *
++ * Returns:
++ * The type of the DP dual mode adaptor used
++ */
++enum drm_dp_dual_mode_type drm_dp_dual_mode_detect(struct i2c_adapter *adapter)
++{
++ char hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN] = {};
++ uint8_t adaptor_id = 0x00;
++ ssize_t ret;
++
++ /*
++ * Let's see if the adaptor is there the by reading the
++ * HDMI ID registers.
++ *
++ * Note that type 1 DVI adaptors are not required to implemnt
++ * any registers, and that presents a problem for detection.
++ * If the i2c transfer is nacked, we may or may not be dealing
++ * with a type 1 DVI adaptor. Some other mechanism of detecting
++ * the presence of the adaptor is required. One way would be
++ * to check the state of the CONFIG1 pin, Another method would
++ * simply require the driver to know whether the port is a DP++
++ * port or a native HDMI port. Both of these methods are entirely
++ * hardware/driver specific so we can't deal with them here.
++ */
++ ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_HDMI_ID,
++ hdmi_id, sizeof(hdmi_id));
++ if (ret)
++ return DRM_DP_DUAL_MODE_UNKNOWN;
++
++ /*
++ * Sigh. Some (maybe all?) type 1 adaptors are broken and ack
++ * the offset but ignore it, and instead they just always return
++ * data from the start of the HDMI ID buffer. So for a broken
++ * type 1 HDMI adaptor a single byte read will always give us
++ * 0x44, and for a type 1 DVI adaptor it should give 0x00
++ * (assuming it implements any registers). Fortunately neither
++ * of those values will match the type 2 signature of the
++ * DP_DUAL_MODE_ADAPTOR_ID register so we can proceed with
++ * the type 2 adaptor detection safely even in the presence
++ * of broken type 1 adaptors.
++ */
++ ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_ADAPTOR_ID,
++ &adaptor_id, sizeof(adaptor_id));
++ if (ret == 0) {
++ if (is_type2_adaptor(adaptor_id)) {
++ if (is_hdmi_adaptor(hdmi_id))
++ return DRM_DP_DUAL_MODE_TYPE2_HDMI;
++ else
++ return DRM_DP_DUAL_MODE_TYPE2_DVI;
++ }
++ }
++
++ if (is_hdmi_adaptor(hdmi_id))
++ return DRM_DP_DUAL_MODE_TYPE1_HDMI;
++ else
++ return DRM_DP_DUAL_MODE_TYPE1_DVI;
++}
++EXPORT_SYMBOL(drm_dp_dual_mode_detect);
++
++/**
++ * drm_dp_dual_mode_max_tmds_clock - Max TMDS clock for DP dual mode adaptor
++ * @type: DP dual mode adaptor type
++ * @adapter: I2C adapter for the DDC bus
++ *
++ * Determine the max TMDS clock the adaptor supports based on the
++ * type of the dual mode adaptor and the DP_DUAL_MODE_MAX_TMDS_CLOCK
++ * register (on type2 adaptors). As some type 1 adaptors have
++ * problems with registers (see comments in drm_dp_dual_mode_detect())
++ * we don't read the register on those, instead we simply assume
++ * a 165 MHz limit based on the specification.
++ *
++ * Returns:
++ * Maximum supported TMDS clock rate for the DP dual mode adaptor in kHz.
++ */
++int drm_dp_dual_mode_max_tmds_clock(enum drm_dp_dual_mode_type type,
++ struct i2c_adapter *adapter)
++{
++ uint8_t max_tmds_clock;
++ ssize_t ret;
++
++ /* native HDMI so no limit */
++ if (type == DRM_DP_DUAL_MODE_NONE)
++ return 0;
++
++ /*
++ * Type 1 adaptors are limited to 165MHz
++ * Type 2 adaptors can tells us their limit
++ */
++ if (type < DRM_DP_DUAL_MODE_TYPE2_DVI)
++ return 165000;
++
++ ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_MAX_TMDS_CLOCK,
++ &max_tmds_clock, sizeof(max_tmds_clock));
++ if (ret || max_tmds_clock == 0x00 || max_tmds_clock == 0xff) {
++ DRM_DEBUG_KMS("Failed to query max TMDS clock\n");
++ return 165000;
++ }
++
++ return max_tmds_clock * 5000 / 2;
++}
++EXPORT_SYMBOL(drm_dp_dual_mode_max_tmds_clock);
++
++/**
++ * drm_dp_dual_mode_get_tmds_output - Get the state of the TMDS output buffers in the DP dual mode adaptor
++ * @type: DP dual mode adaptor type
++ * @adapter: I2C adapter for the DDC bus
++ * @enabled: current state of the TMDS output buffers
++ *
++ * Get the state of the TMDS output buffers in the adaptor. For
++ * type2 adaptors this is queried from the DP_DUAL_MODE_TMDS_OEN
++ * register. As some type 1 adaptors have problems with registers
++ * (see comments in drm_dp_dual_mode_detect()) we don't read the
++ * register on those, instead we simply assume that the buffers
++ * are always enabled.
++ *
++ * Returns:
++ * 0 on success, negative error code on failure
++ */
++int drm_dp_dual_mode_get_tmds_output(enum drm_dp_dual_mode_type type,
++ struct i2c_adapter *adapter,
++ bool *enabled)
++{
++ uint8_t tmds_oen;
++ ssize_t ret;
++
++ if (type < DRM_DP_DUAL_MODE_TYPE2_DVI) {
++ *enabled = true;
++ return 0;
++ }
++
++ ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_TMDS_OEN,
++ &tmds_oen, sizeof(tmds_oen));
++ if (ret) {
++ DRM_DEBUG_KMS("Failed to query state of TMDS output buffers\n");
++ return ret;
++ }
++
++ *enabled = !(tmds_oen & DP_DUAL_MODE_TMDS_DISABLE);
++
++ return 0;
++}
++EXPORT_SYMBOL(drm_dp_dual_mode_get_tmds_output);
++
++/**
++ * drm_dp_dual_mode_set_tmds_output - Enable/disable TMDS output buffers in the DP dual mode adaptor
++ * @type: DP dual mode adaptor type
++ * @adapter: I2C adapter for the DDC bus
++ * @enable: enable (as opposed to disable) the TMDS output buffers
++ *
++ * Set the state of the TMDS output buffers in the adaptor. For
++ * type2 this is set via the DP_DUAL_MODE_TMDS_OEN register. As
++ * some type 1 adaptors have problems with registers (see comments
++ * in drm_dp_dual_mode_detect()) we avoid touching the register,
++ * making this function a no-op on type 1 adaptors.
++ *
++ * Returns:
++ * 0 on success, negative error code on failure
++ */
++int drm_dp_dual_mode_set_tmds_output(enum drm_dp_dual_mode_type type,
++ struct i2c_adapter *adapter, bool enable)
++{
++ uint8_t tmds_oen = enable ? 0 : DP_DUAL_MODE_TMDS_DISABLE;
++ ssize_t ret;
++
++ if (type < DRM_DP_DUAL_MODE_TYPE2_DVI)
++ return 0;
++
++ ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN,
++ &tmds_oen, sizeof(tmds_oen));
++ if (ret) {
++ DRM_DEBUG_KMS("Failed to %s TMDS output buffers\n",
++ enable ? "enable" : "disable");
++ return ret;
++ }
++
++ return 0;
++}
++EXPORT_SYMBOL(drm_dp_dual_mode_set_tmds_output);
++
++/**
++ * drm_dp_get_dual_mode_type_name - Get the name of the DP dual mode adaptor type as a string
++ * @type: DP dual mode adaptor type
++ *
++ * Returns:
++ * String representation of the DP dual mode adaptor type
++ */
++const char *drm_dp_get_dual_mode_type_name(enum drm_dp_dual_mode_type type)
++{
++ switch (type) {
++ case DRM_DP_DUAL_MODE_NONE:
++ return "none";
++ case DRM_DP_DUAL_MODE_TYPE1_DVI:
++ return "type 1 DVI";
++ case DRM_DP_DUAL_MODE_TYPE1_HDMI:
++ return "type 1 HDMI";
++ case DRM_DP_DUAL_MODE_TYPE2_DVI:
++ return "type 2 DVI";
++ case DRM_DP_DUAL_MODE_TYPE2_HDMI:
++ return "type 2 HDMI";
++ default:
++ WARN_ON(type != DRM_DP_DUAL_MODE_UNKNOWN);
++ return "unknown";
++ }
++}
++EXPORT_SYMBOL(drm_dp_get_dual_mode_type_name);
+--- /dev/null
++++ b/include/drm/drm_dp_dual_mode_helper.h
+@@ -0,0 +1,92 @@
++/*
++ * Copyright © 2016 Intel Corporation
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the "Software"),
++ * to deal in the Software without restriction, including without limitation
++ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
++ * and/or sell copies of the Software, and to permit persons to whom the
++ * Software is furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ * OTHER DEALINGS IN THE SOFTWARE.
++ */
++
++#ifndef DRM_DP_DUAL_MODE_HELPER_H
++#define DRM_DP_DUAL_MODE_HELPER_H
++
++#include <linux/types.h>
++
++/*
++ * Optional for type 1 DVI adaptors
++ * Mandatory for type 1 HDMI and type 2 adaptors
++ */
++#define DP_DUAL_MODE_HDMI_ID 0x00 /* 00-0f */
++#define DP_DUAL_MODE_HDMI_ID_LEN 16
++/*
++ * Optional for type 1 adaptors
++ * Mandatory for type 2 adaptors
++ */
++#define DP_DUAL_MODE_ADAPTOR_ID 0x10
++#define DP_DUAL_MODE_REV_MASK 0x07
++#define DP_DUAL_MODE_REV_TYPE2 0x00
++#define DP_DUAL_MODE_TYPE_MASK 0xf0
++#define DP_DUAL_MODE_TYPE_TYPE2 0xa0
++#define DP_DUAL_MODE_IEEE_OUI 0x11 /* 11-13*/
++#define DP_DUAL_IEEE_OUI_LEN 3
++#define DP_DUAL_DEVICE_ID 0x14 /* 14-19 */
++#define DP_DUAL_DEVICE_ID_LEN 6
++#define DP_DUAL_MODE_HARDWARE_REV 0x1a
++#define DP_DUAL_MODE_FIRMWARE_MAJOR_REV 0x1b
++#define DP_DUAL_MODE_FIRMWARE_MINOR_REV 0x1c
++#define DP_DUAL_MODE_MAX_TMDS_CLOCK 0x1d
++#define DP_DUAL_MODE_I2C_SPEED_CAP 0x1e
++#define DP_DUAL_MODE_TMDS_OEN 0x20
++#define DP_DUAL_MODE_TMDS_DISABLE 0x01
++#define DP_DUAL_MODE_HDMI_PIN_CTRL 0x21
++#define DP_DUAL_MODE_CEC_ENABLE 0x01
++#define DP_DUAL_MODE_I2C_SPEED_CTRL 0x22
++
++struct i2c_adapter;
++
++ssize_t drm_dp_dual_mode_read(struct i2c_adapter *adapter,
++ u8 offset, void *buffer, size_t size);
++ssize_t drm_dp_dual_mode_write(struct i2c_adapter *adapter,
++ u8 offset, const void *buffer, size_t size);
++
++/**
++ * enum drm_dp_dual_mode_type - Type of the DP dual mode adaptor
++ * @DRM_DP_DUAL_MODE_NONE: No DP dual mode adaptor
++ * @DRM_DP_DUAL_MODE_UNKNOWN: Could be either none or type 1 DVI adaptor
++ * @DRM_DP_DUAL_MODE_TYPE1_DVI: Type 1 DVI adaptor
++ * @DRM_DP_DUAL_MODE_TYPE1_HDMI: Type 1 HDMI adaptor
++ * @DRM_DP_DUAL_MODE_TYPE2_DVI: Type 2 DVI adaptor
++ * @DRM_DP_DUAL_MODE_TYPE2_HDMI: Type 2 HDMI adaptor
++ */
++enum drm_dp_dual_mode_type {
++ DRM_DP_DUAL_MODE_NONE,
++ DRM_DP_DUAL_MODE_UNKNOWN,
++ DRM_DP_DUAL_MODE_TYPE1_DVI,
++ DRM_DP_DUAL_MODE_TYPE1_HDMI,
++ DRM_DP_DUAL_MODE_TYPE2_DVI,
++ DRM_DP_DUAL_MODE_TYPE2_HDMI,
++};
++
++enum drm_dp_dual_mode_type drm_dp_dual_mode_detect(struct i2c_adapter *adapter);
++int drm_dp_dual_mode_max_tmds_clock(enum drm_dp_dual_mode_type type,
++ struct i2c_adapter *adapter);
++int drm_dp_dual_mode_get_tmds_output(enum drm_dp_dual_mode_type type,
++ struct i2c_adapter *adapter, bool *enabled);
++int drm_dp_dual_mode_set_tmds_output(enum drm_dp_dual_mode_type type,
++ struct i2c_adapter *adapter, bool enable);
++const char *drm_dp_get_dual_mode_type_name(enum drm_dp_dual_mode_type type);
++
++#endif
--- /dev/null
+From 9d746ab68163d642dae13756b2b3145b2e38cb65 Mon Sep 17 00:00:00 2001
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+Date: Tue, 24 May 2016 18:12:43 +0200
+Subject: drm/amdgpu: Fix hdmi deep color support.
+
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+
+commit 9d746ab68163d642dae13756b2b3145b2e38cb65 upstream.
+
+When porting the hdmi deep color detection code from
+radeon-kms to amdgpu-kms apparently some kind of
+copy and paste error happened, attaching an else
+branch to the wrong if statement.
+
+The result is that hdmi deep color mode is always
+disabled, regardless of gpu and display capabilities and
+user wishes, as the code mistakenly thinks that the display
+doesn't provide the required max_tmds_clock limit and falls
+back to 8 bpc.
+
+This patch fixes deep color support, as tested on a
+R9 380 Tonga Pro + suitable display, and should be
+backported to all kernels with amdgpu-kms support.
+
+Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -194,12 +194,12 @@ int amdgpu_connector_get_monitor_bpc(str
+ bpc = 8;
+ DRM_DEBUG("%s: HDMI deep color 10 bpc exceeds max tmds clock. Using %d bpc.\n",
+ connector->name, bpc);
+- } else if (bpc > 8) {
+- /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */
+- DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n",
+- connector->name);
+- bpc = 8;
+ }
++ } else if (bpc > 8) {
++ /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */
++ DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n",
++ connector->name);
++ bpc = 8;
+ }
+ }
+
--- /dev/null
+From 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 May 2016 10:24:41 -0400
+Subject: drm/amdgpu: use drm_mode_vrefresh() rather than mode->vrefresh
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce upstream.
+
+This is a port of radeon commit:
+3d2d98ee1af0cf6eebfbd6bff4c17d3601ac1284
+drm/radeon: use drm_mode_vrefresh() rather than mode->vrefresh
+to amdgpu.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
+@@ -150,7 +150,7 @@ u32 amdgpu_dpm_get_vrefresh(struct amdgp
+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+ amdgpu_crtc = to_amdgpu_crtc(crtc);
+ if (crtc->enabled && amdgpu_crtc->enabled && amdgpu_crtc->hw_mode.clock) {
+- vrefresh = amdgpu_crtc->hw_mode.vrefresh;
++ vrefresh = drm_mode_vrefresh(&amdgpu_crtc->hw_mode);
+ break;
+ }
+ }
--- /dev/null
+From cpaul@redhat.com Sat Jun 4 13:44:11 2016
+From: Lyude <cpaul@redhat.com>
+Date: Tue, 31 May 2016 12:49:07 -0400
+Subject: drm/atomic: Verify connector->funcs != NULL when clearing states
+To: stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Lyude <cpaul@redhat.com>, David Airlie <airlied@linux.ie>, dri-devel@lists.freedesktop.org (open list:DRM DRIVERS), linux-kernel@vger.kernel.org (open list)
+Message-ID: <1464713347-28982-5-git-send-email-cpaul@redhat.com>
+
+From: Lyude <cpaul@redhat.com>
+
+Unfortunately since we don't have Dave's connector refcounting patch
+here yet, it's very possible that drm_atomic_state_default_clear() could
+get called by intel_display_resume() when
+intel_dp_mst_destroy_connector() isn't completely finished destroying an
+mst connector, but has already finished setting connector->funcs to
+NULL. As such, we need to treat the connector like it's already been
+destroyed and just skip it, otherwise we'll end up dereferencing a NULL
+pointer.
+
+This fix is only required for 4.6 and below. David Airlie's patchseries
+for 4.7 to add connector reference counting provides a more proper fix
+for this.
+
+Changes since v1:
+ - Fix leftover whitespace
+
+Upstream fix: 0552f7651bc2 ("drm/i915/mst: use reference counted
+connectors. (v3)")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Lyude <cpaul@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_atomic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -139,7 +139,7 @@ void drm_atomic_state_default_clear(stru
+ for (i = 0; i < state->num_connector; i++) {
+ struct drm_connector *connector = state->connectors[i];
+
+- if (!connector)
++ if (!connector || !connector->funcs)
+ continue;
+
+ /*
--- /dev/null
+From 255f0e7c418ad95a4baeda017ae6182ba9b3c423 Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Thu, 12 May 2016 10:56:59 -0400
+Subject: drm/fb_helper: Fix references to dev->mode_config.num_connector
+
+From: Lyude <cpaul@redhat.com>
+
+commit 255f0e7c418ad95a4baeda017ae6182ba9b3c423 upstream.
+
+During boot, MST hotplugs are generally expected (even if no physical
+hotplugging occurs) and result in DRM's connector topology changing.
+This means that using num_connector from the current mode configuration
+can lead to the number of connectors changing under us. This can lead to
+some nasty scenarios in fbcon:
+
+- We allocate an array to the size of dev->mode_config.num_connectors.
+- MST hotplug occurs, dev->mode_config.num_connectors gets incremented.
+- We try to loop through each element in the array using the new value
+ of dev->mode_config.num_connectors, and end up going out of bounds
+ since dev->mode_config.num_connectors is now larger then the array we
+ allocated.
+
+fb_helper->connector_count however, will always remain consistent while
+we do a modeset in fb_helper.
+
+Note: This is just polish for 4.7, Dave Airlie's drm_connector
+refcounting fixed these bugs for real. But it's good enough duct-tape
+for stable kernel backporting, since backporting the refcounting
+changes is way too invasive.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+[danvet: Clarify why we need this. Also remove the now unused "dev"
+local variable to appease gcc.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-3-git-send-email-cpaul@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1895,7 +1895,6 @@ static int drm_pick_crtcs(struct drm_fb_
+ int n, int width, int height)
+ {
+ int c, o;
+- struct drm_device *dev = fb_helper->dev;
+ struct drm_connector *connector;
+ const struct drm_connector_helper_funcs *connector_funcs;
+ struct drm_encoder *encoder;
+@@ -1914,7 +1913,7 @@ static int drm_pick_crtcs(struct drm_fb_
+ if (modes[n] == NULL)
+ return best_score;
+
+- crtcs = kzalloc(dev->mode_config.num_connector *
++ crtcs = kzalloc(fb_helper->connector_count *
+ sizeof(struct drm_fb_helper_crtc *), GFP_KERNEL);
+ if (!crtcs)
+ return best_score;
+@@ -1960,7 +1959,7 @@ static int drm_pick_crtcs(struct drm_fb_
+ if (score > best_score) {
+ best_score = score;
+ memcpy(best_crtcs, crtcs,
+- dev->mode_config.num_connector *
++ fb_helper->connector_count *
+ sizeof(struct drm_fb_helper_crtc *));
+ }
+ }
--- /dev/null
+From 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 Mon Sep 17 00:00:00 2001
+From: Itai Handler <itai_handler@hotmail.com>
+Date: Tue, 3 Nov 2015 00:20:56 +0200
+Subject: drm/gma500: Fix possible out of bounds read
+
+From: Itai Handler <itai_handler@hotmail.com>
+
+commit 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 upstream.
+
+Fix possible out of bounds read, by adding missing comma.
+The code may read pass the end of the dsi_errors array
+when the most significant bit (bit #31) in the intr_stat register
+is set.
+This bug has been detected using CppCheck (static analysis tool).
+
+Signed-off-by: Itai Handler <itai_handler@hotmail.com>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c
++++ b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c
+@@ -72,7 +72,7 @@ static const char *const dsi_errors[] =
+ "RX Prot Violation",
+ "HS Generic Write FIFO Full",
+ "LP Generic Write FIFO Full",
+- "Generic Read Data Avail"
++ "Generic Read Data Avail",
+ "Special Packet Sent",
+ "Tearing Effect",
+ };
--- /dev/null
+From cpaul@redhat.com Sat Jun 4 13:43:28 2016
+From: Lyude <cpaul@redhat.com>
+Date: Tue, 31 May 2016 12:49:06 -0400
+Subject: drm/i915: Discard previous atomic state on resume if connectors change
+To: stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Lyude <cpaul@redhat.com>, Daniel Vetter <daniel.vetter@intel.com>, Jani Nikula <jani.nikula@linux.intel.com>, David Airlie <airlied@linux.ie>, intel-gfx@lists.freedesktop.org (open list:INTEL DRM DRIVERS (excluding Poulsbo, Moorestow...), dri-devel@lists.freedesktop.org (open list:INTEL DRM DRIVERS (excluding Poulsbo, Moorestow...), linux-kernel@vger.kernel.org (open list)))
+Message-ID: <1464713347-28982-4-git-send-email-cpaul@redhat.com>
+
+
+From: Lyude <cpaul@redhat.com>
+
+If an MST device is disconnected while the machine is suspended, the
+number of connectors will change as well after we call
+intel_dp_mst_resume(). This means that any previous atomic state we had
+before suspending is no longer valid, since it'll still be pointing to
+missing connectors. We need to check for this before committing the
+state, otherwise we'll kernel panic on resume whenever if any MST
+display was disconnected before we started resuming:
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
+IP: [<ffffffffa01588ef>] drm_atomic_helper_check_modeset+0x29f/0xb40 [drm_kms_helper]
+Call Trace:
+ [<ffffffffa02354f4>] intel_atomic_check+0x34/0x1180 [i915]
+ [<ffffffff810e6c3f>] ? mark_held_locks+0x6f/0xa0
+ [<ffffffff810e6d99>] ? trace_hardirqs_on_caller+0x129/0x1b0
+ [<ffffffffa00ff1d2>] drm_atomic_check_only+0x192/0x620 [drm]
+ [<ffffffff813ee001>] ? pci_pm_thaw+0x21/0x90
+ [<ffffffffa00ff677>] drm_atomic_commit+0x17/0x60 [drm]
+ [<ffffffffa023e0ad>] intel_display_resume+0xbd/0x160 [i915]
+ [<ffffffff813ee070>] ? pci_pm_thaw+0x90/0x90
+ [<ffffffffa01b60d8>] i915_drm_resume+0xd8/0x160 [i915]
+ [<ffffffffa01b6185>] i915_pm_resume+0x25/0x30 [i915]
+ [<ffffffff813ee0d4>] pci_pm_resume+0x64/0xa0
+ [<ffffffff814d9ea0>] dpm_run_callback+0x90/0x190
+ [<ffffffff814da455>] device_resume+0xd5/0x1f0
+ [<ffffffff814da58d>] async_resume+0x1d/0x50
+ [<ffffffff810b6718>] async_run_entry_fn+0x48/0x150
+ [<ffffffff810acc19>] process_one_work+0x1e9/0x5c0
+ [<ffffffff810acb96>] ? process_one_work+0x166/0x5c0
+ [<ffffffff810ad038>] worker_thread+0x48/0x4e0
+ [<ffffffff810acff0>] ? process_one_work+0x5c0/0x5c0
+ [<ffffffff810b3794>] kthread+0xe4/0x100
+ [<ffffffff81742672>] ret_from_fork+0x22/0x50
+ [<ffffffff810b36b0>] ? kthread_create_on_node+0x200/0x200
+
+Changes since v1:
+ - Move drm_atomic_state_free() call down so we're holding the
+ appropriate locks when destroying the atomic state
+Changes since v2:
+ - Check that state != NULL before we start accessing it's members
+
+This fix is only required for 4.6 and below. David Airlie's patchseries
+for 4.7 to add connector reference counting provides a more proper fix
+for this.
+
+Upstream fix: 0552f7651bc2 ("drm/i915/mst: use reference counted
+connectors. (v3)")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Lyude <cpaul@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_display.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -15958,6 +15958,18 @@ void intel_display_resume(struct drm_dev
+ retry:
+ ret = drm_modeset_lock_all_ctx(dev, &ctx);
+
++ /*
++ * With MST, the number of connectors can change between suspend and
++ * resume, which means that the state we want to restore might now be
++ * impossible to use since it'll be pointing to non-existant
++ * connectors.
++ */
++ if (ret == 0 && state &&
++ state->num_connector != dev->mode_config.num_connector) {
++ drm_atomic_state_free(state);
++ state = NULL;
++ }
++
+ if (ret == 0 && !setup) {
+ setup = true;
+
--- /dev/null
+From 7045c3689f148a0c95f42bae8ef3eb2829ac7de9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Fri, 13 May 2016 17:55:17 +0300
+Subject: drm/i915: Don't leave old junk in ilk active watermarks on readout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 7045c3689f148a0c95f42bae8ef3eb2829ac7de9 upstream.
+
+When we read out the watermark state from the hardware we're supposed to
+transfer that into the active watermarks, but currently we fail to any
+part of the active watermarks that isn't explicitly written. Let's clear
+it all upfront.
+
+Looks like this has been like this since the beginning, when I added the
+readout. No idea why I didn't clear it up.
+
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Fixes: 243e6a44b9ca ("drm/i915: Init HSW watermark tracking in intel_modeset_setup_hw_state()")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463151318-14719-2-git-send-email-ville.syrjala@linux.intel.com
+(cherry picked from commit 15606534bf0a65d8a74a90fd57b8712d147dbca6)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_pm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3845,6 +3845,8 @@ static void ilk_pipe_wm_get_hw_state(str
+ if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+ hw->wm_linetime[pipe] = I915_READ(PIPE_WM_LINETIME(pipe));
+
++ memset(active, 0, sizeof(*active));
++
+ active->pipe_enabled = intel_crtc->active;
+
+ if (active->pipe_enabled) {
--- /dev/null
+From 0c2fb7c6c8fef2092051192095a7788231ba9a42 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 2 May 2016 22:08:24 +0300
+Subject: drm/i915: Enable/disable TMDS output buffers in DP++ adaptor as needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 0c2fb7c6c8fef2092051192095a7788231ba9a42 upstream.
+
+To save a bit of power, let's try to turn off the TMDS output buffers
+in DP++ adaptors when we're not driving the port.
+
+v2: Let's not forget DDI, toss in a debug message while at it
+v3: Just do the TMDS output control based on adaptor type. With the
+ helper getting passed the type, we wouldn't actually have to
+ check at all in the driver, but the check eliminates the debug
+ output more honest
+
+Cc: Tore Anderson <tore@fud.no>
+Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1462216105-20881-4-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Shashank Sharma <shashank.sharma@intel.com>
+(cherry picked from commit b2ccb822d376d1bbbe5d1f9118d1488b25e6bc6d)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ddi.c | 12 ++++++++++++
+ drivers/gpu/drm/i915/intel_drv.h | 1 +
+ drivers/gpu/drm/i915/intel_hdmi.c | 20 ++++++++++++++++++++
+ 3 files changed, 33 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -2309,6 +2309,12 @@ static void intel_ddi_pre_enable(struct
+ enum port port = intel_ddi_get_encoder_port(intel_encoder);
+ int type = intel_encoder->type;
+
++ if (type == INTEL_OUTPUT_HDMI) {
++ struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
++
++ intel_dp_dual_mode_set_tmds_output(intel_hdmi, true);
++ }
++
+ intel_prepare_ddi_buffer(intel_encoder);
+
+ if (type == INTEL_OUTPUT_EDP) {
+@@ -2375,6 +2381,12 @@ static void intel_ddi_post_disable(struc
+ DPLL_CTRL2_DDI_CLK_OFF(port)));
+ else if (INTEL_INFO(dev)->gen < 9)
+ I915_WRITE(PORT_CLK_SEL(port), PORT_CLK_SEL_NONE);
++
++ if (type == INTEL_OUTPUT_HDMI) {
++ struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
++
++ intel_dp_dual_mode_set_tmds_output(intel_hdmi, false);
++ }
+ }
+
+ static void intel_enable_ddi(struct intel_encoder *intel_encoder)
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -1356,6 +1356,7 @@ void intel_hdmi_init_connector(struct in
+ struct intel_hdmi *enc_to_intel_hdmi(struct drm_encoder *encoder);
+ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
+ struct intel_crtc_state *pipe_config);
++void intel_dp_dual_mode_set_tmds_output(struct intel_hdmi *hdmi, bool enable);
+
+
+ /* intel_lvds.c */
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -836,6 +836,22 @@ static void hsw_set_infoframes(struct dr
+ intel_hdmi_set_hdmi_infoframe(encoder, adjusted_mode);
+ }
+
++void intel_dp_dual_mode_set_tmds_output(struct intel_hdmi *hdmi, bool enable)
++{
++ struct drm_i915_private *dev_priv = to_i915(intel_hdmi_to_dev(hdmi));
++ struct i2c_adapter *adapter =
++ intel_gmbus_get_adapter(dev_priv, hdmi->ddc_bus);
++
++ if (hdmi->dp_dual_mode.type < DRM_DP_DUAL_MODE_TYPE2_DVI)
++ return;
++
++ DRM_DEBUG_KMS("%s DP dual mode adaptor TMDS output\n",
++ enable ? "Enabling" : "Disabling");
++
++ drm_dp_dual_mode_set_tmds_output(hdmi->dp_dual_mode.type,
++ adapter, enable);
++}
++
+ static void intel_hdmi_prepare(struct intel_encoder *encoder)
+ {
+ struct drm_device *dev = encoder->base.dev;
+@@ -845,6 +861,8 @@ static void intel_hdmi_prepare(struct in
+ const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
+ u32 hdmi_val;
+
++ intel_dp_dual_mode_set_tmds_output(intel_hdmi, true);
++
+ hdmi_val = SDVO_ENCODING_HDMI;
+ if (!HAS_PCH_SPLIT(dev) && crtc->config->limited_color_range)
+ hdmi_val |= HDMI_COLOR_RANGE_16_235;
+@@ -1143,6 +1161,8 @@ static void intel_disable_hdmi(struct in
+ }
+
+ intel_hdmi->set_infoframes(&encoder->base, false, NULL);
++
++ intel_dp_dual_mode_set_tmds_output(intel_hdmi, false);
+ }
+
+ static void g4x_disable_hdmi(struct intel_encoder *encoder)
--- /dev/null
+From 14a3842a1d5945067d1dd0788f314e14d5b18e5b Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Thu, 12 May 2016 10:56:58 -0400
+Subject: drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config()
+
+From: Lyude <cpaul@redhat.com>
+
+commit 14a3842a1d5945067d1dd0788f314e14d5b18e5b upstream.
+
+During boot time, MST devices usually send a ton of hotplug events
+irregardless of whether or not any physical hotplugs actually occurred.
+Hotplugs mean connectors being created/destroyed, and the number of DRM
+connectors changing under us. This isn't a problem if we use
+fb_helper->connector_count since we only set it once in the code,
+however if we use num_connector from struct drm_mode_config we risk it's
+value changing under us. On top of that, there's even a chance that
+dev->mode_config.num_connector != fb_helper->connector_count. If the
+number of connectors happens to increase under us, we'll end up using
+the wrong array size for memcpy and start writing beyond the actual
+length of the array, occasionally resulting in kernel panics.
+
+Note: This is just polish for 4.7, Dave Airlie's drm_connector
+refcounting fixed these bugs for real. But it's good enough duct-tape
+for stable kernel backporting, since backporting the refcounting
+changes is way too invasive.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+[danvet: Clarify why we need this.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-2-git-send-email-cpaul@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_fbdev.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -366,12 +366,12 @@ static bool intel_fb_initial_config(stru
+ uint64_t conn_configured = 0, mask;
+ int pass = 0;
+
+- save_enabled = kcalloc(dev->mode_config.num_connector, sizeof(bool),
++ save_enabled = kcalloc(fb_helper->connector_count, sizeof(bool),
+ GFP_KERNEL);
+ if (!save_enabled)
+ return false;
+
+- memcpy(save_enabled, enabled, dev->mode_config.num_connector);
++ memcpy(save_enabled, enabled, fb_helper->connector_count);
+ mask = (1 << fb_helper->connector_count) - 1;
+ retry:
+ for (i = 0; i < fb_helper->connector_count; i++) {
+@@ -510,7 +510,7 @@ retry:
+ if (fallback) {
+ bail:
+ DRM_DEBUG_KMS("Not using firmware configuration\n");
+- memcpy(enabled, save_enabled, dev->mode_config.num_connector);
++ memcpy(enabled, save_enabled, fb_helper->connector_count);
+ kfree(save_enabled);
+ return false;
+ }
--- /dev/null
+From caed361d83b204b7766924b80463bf7502ee7986 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 9 Mar 2016 19:07:25 +0200
+Subject: drm/i915: Fix watermarks for VLV/CHV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit caed361d83b204b7766924b80463bf7502ee7986 upstream.
+
+commit 92826fcdfc14 ("drm/i915: Calculate watermark related members in the crtc_state, v4.")
+broke thigns by removing the pre vs. post wm update distinction. We also
+lost the pre plane wm update entirely for VLV/CHV from the crtc enable
+path.
+
+This caused underruns on modeset and plane enable/disable on CHV,
+and often those can lead to a dead pipe.
+
+So let's bring back the pre vs. post thing, and let's toss in an
+explicit wm update to valleyview_crtc_enable() to avoid having to
+put it into the common code.
+
+This is more or less a partial revert of the offending commit.
+
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: drm-intel-fixes@lists.freedesktop.org
+Fixes: 92826fcdfc14 ("drm/i915: Calculate watermark related members in the crtc_state, v4.")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1457543247-13987-4-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_atomic.c | 3 ++-
+ drivers/gpu/drm/i915/intel_display.c | 25 +++++++++++++++++--------
+ drivers/gpu/drm/i915/intel_drv.h | 2 +-
+ 3 files changed, 20 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_atomic.c
++++ b/drivers/gpu/drm/i915/intel_atomic.c
+@@ -96,7 +96,8 @@ intel_crtc_duplicate_state(struct drm_cr
+ crtc_state->update_pipe = false;
+ crtc_state->disable_lp_wm = false;
+ crtc_state->disable_cxsr = false;
+- crtc_state->wm_changed = false;
++ crtc_state->update_wm_pre = false;
++ crtc_state->update_wm_post = false;
+ crtc_state->fb_changed = false;
+
+ return &crtc_state->base;
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4796,7 +4796,7 @@ static void intel_post_plane_update(stru
+
+ crtc->wm.cxsr_allowed = true;
+
+- if (pipe_config->wm_changed && pipe_config->base.active)
++ if (pipe_config->update_wm_post && pipe_config->base.active)
+ intel_update_watermarks(&crtc->base);
+
+ if (atomic->update_fbc)
+@@ -4843,7 +4843,7 @@ static void intel_pre_plane_update(struc
+ intel_set_memory_cxsr(dev_priv, false);
+ }
+
+- if (!needs_modeset(&pipe_config->base) && pipe_config->wm_changed)
++ if (!needs_modeset(&pipe_config->base) && pipe_config->update_wm_pre)
+ intel_update_watermarks(&crtc->base);
+ }
+
+@@ -6210,6 +6210,7 @@ static void valleyview_crtc_enable(struc
+
+ intel_crtc_load_lut(crtc);
+
++ intel_update_watermarks(crtc);
+ intel_enable_pipe(intel_crtc);
+
+ assert_vblank_disabled(crtc);
+@@ -11833,14 +11834,22 @@ int intel_plane_atomic_calc_changes(stru
+ plane->base.id, was_visible, visible,
+ turn_off, turn_on, mode_changed);
+
+- if (turn_on || turn_off) {
+- pipe_config->wm_changed = true;
++ if (turn_on) {
++ pipe_config->update_wm_pre = true;
++
++ /* must disable cxsr around plane enable/disable */
++ if (plane->type != DRM_PLANE_TYPE_CURSOR)
++ pipe_config->disable_cxsr = true;
++ } else if (turn_off) {
++ pipe_config->update_wm_post = true;
+
+ /* must disable cxsr around plane enable/disable */
+ if (plane->type != DRM_PLANE_TYPE_CURSOR)
+ pipe_config->disable_cxsr = true;
+ } else if (intel_wm_need_update(plane, plane_state)) {
+- pipe_config->wm_changed = true;
++ /* FIXME bollocks */
++ pipe_config->update_wm_pre = true;
++ pipe_config->update_wm_post = true;
+ }
+
+ if (visible || was_visible)
+@@ -11940,7 +11949,7 @@ static int intel_crtc_atomic_check(struc
+ }
+
+ if (mode_changed && !crtc_state->active)
+- pipe_config->wm_changed = true;
++ pipe_config->update_wm_post = true;
+
+ if (mode_changed && crtc_state->enable &&
+ dev_priv->display.crtc_compute_clock &&
+@@ -13453,12 +13462,12 @@ static bool needs_vblank_wait(struct int
+ return true;
+
+ /* wm changes, need vblank before final wm's */
+- if (crtc_state->wm_changed)
++ if (crtc_state->update_wm_post)
+ return true;
+
+ /*
+ * cxsr is re-enabled after vblank.
+- * This is already handled by crtc_state->wm_changed,
++ * This is already handled by crtc_state->update_wm_post,
+ * but added for clarity.
+ */
+ if (crtc_state->disable_cxsr)
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -379,7 +379,7 @@ struct intel_crtc_state {
+
+ bool update_pipe; /* can a fast modeset be performed? */
+ bool disable_cxsr;
+- bool wm_changed; /* watermarks are updated */
++ bool update_wm_pre, update_wm_post; /* watermarks are updated */
+ bool fb_changed; /* fb on any of the planes is changed */
+
+ /* Pipe source size (ie. panel fitter input size)
--- /dev/null
+From 9f6151c9039084e18c118831779a99ac8f29e39c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 9 Mar 2016 19:07:24 +0200
+Subject: drm/i915: Pass the correct crtc state to .update_plane()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 9f6151c9039084e18c118831779a99ac8f29e39c upstream.
+
+Pass the current crtc state, not the old crtc state, to the
+.update_plane() hook.
+
+Noticed on BSW when PRIMSIZE was getting programmed to a stale value
+which produced utter garbage on screen eg. wwhen going from 1920x1080
+to 1024x768.
+
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Fixes: a758e6845825 ("drm/i915: Do not use commit_plane for sprite planes.")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1457543247-13987-3-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_atomic_plane.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_atomic_plane.c
++++ b/drivers/gpu/drm/i915/intel_atomic_plane.c
+@@ -195,12 +195,10 @@ static void intel_plane_atomic_update(st
+ struct intel_plane_state *intel_state =
+ to_intel_plane_state(plane->state);
+ struct drm_crtc *crtc = plane->state->crtc ?: old_state->crtc;
+- struct drm_crtc_state *crtc_state =
+- drm_atomic_get_existing_crtc_state(old_state->state, crtc);
+
+ if (intel_state->visible)
+ intel_plane->update_plane(plane,
+- to_intel_crtc_state(crtc_state),
++ to_intel_crtc_state(crtc->state),
+ intel_state);
+ else
+ intel_plane->disable_plane(plane, crtc);
--- /dev/null
+From 03b7b5f983091bca17e9c163832fcde56971d7d1 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed, 18 May 2016 18:47:11 +0200
+Subject: drm/i915/psr: Try to program link training times correctly
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 03b7b5f983091bca17e9c163832fcde56971d7d1 upstream.
+
+The default of 0 is 500us of link training, but that's not enough for
+some platforms. Decoding this correctly means we're using 2.5ms of
+link training on these platforms, which fixes flickering issues
+associated with enabling PSR.
+
+v2: Unbotch the math a bit.
+
+v3: Drop debug hunk.
+
+v4: Improve commit message.
+
+Tested-by: Lyude <cpaul@redhat.com>
+Cc: Lyude <cpaul@redhat.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=95176
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Sonika Jindal <sonika.jindal@intel.com>
+Cc: Durgadoss R <durgadoss.r@intel.com>
+Cc: "Pandiyan, Dhinakaran" <dhinakaran.pandiyan@intel.com>
+Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Tested-by: fritsch@kodi.tv
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463590036-17824-2-git-send-email-daniel.vetter@ffwll.ch
+(cherry picked from commit 50db139018f9c94376d5f4db94a3bae65fdfac14)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_psr.c | 57 ++++++++++++++++++++++++++++++++-------
+ 1 file changed, 48 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_psr.c
++++ b/drivers/gpu/drm/i915/intel_psr.c
+@@ -280,7 +280,10 @@ static void hsw_psr_enable_source(struct
+ * with the 5 or 6 idle patterns.
+ */
+ uint32_t idle_frames = max(6, dev_priv->vbt.psr.idle_frames);
+- uint32_t val = 0x0;
++ uint32_t val = EDP_PSR_ENABLE;
++
++ val |= max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT;
++ val |= idle_frames << EDP_PSR_IDLE_FRAME_SHIFT;
+
+ if (IS_HASWELL(dev))
+ val |= EDP_PSR_MIN_LINK_ENTRY_TIME_8_LINES;
+@@ -288,14 +291,50 @@ static void hsw_psr_enable_source(struct
+ if (dev_priv->psr.link_standby)
+ val |= EDP_PSR_LINK_STANDBY;
+
+- I915_WRITE(EDP_PSR_CTL, val |
+- max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT |
+- idle_frames << EDP_PSR_IDLE_FRAME_SHIFT |
+- EDP_PSR_ENABLE);
+-
+- if (dev_priv->psr.psr2_support)
+- I915_WRITE(EDP_PSR2_CTL, EDP_PSR2_ENABLE |
+- EDP_SU_TRACK_ENABLE | EDP_PSR2_TP2_TIME_100);
++ if (dev_priv->vbt.psr.tp1_wakeup_time > 5)
++ val |= EDP_PSR_TP1_TIME_2500us;
++ else if (dev_priv->vbt.psr.tp1_wakeup_time > 1)
++ val |= EDP_PSR_TP1_TIME_500us;
++ else if (dev_priv->vbt.psr.tp1_wakeup_time > 0)
++ val |= EDP_PSR_TP1_TIME_100us;
++ else
++ val |= EDP_PSR_TP1_TIME_0us;
++
++ if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 5)
++ val |= EDP_PSR_TP2_TP3_TIME_2500us;
++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 1)
++ val |= EDP_PSR_TP2_TP3_TIME_500us;
++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 0)
++ val |= EDP_PSR_TP2_TP3_TIME_100us;
++ else
++ val |= EDP_PSR_TP2_TP3_TIME_0us;
++
++ if (intel_dp_source_supports_hbr2(intel_dp) &&
++ drm_dp_tps3_supported(intel_dp->dpcd))
++ val |= EDP_PSR_TP1_TP3_SEL;
++ else
++ val |= EDP_PSR_TP1_TP2_SEL;
++
++ I915_WRITE(EDP_PSR_CTL, val);
++
++ if (!dev_priv->psr.psr2_support)
++ return;
++
++ /* FIXME: selective update is probably totally broken because it doesn't
++ * mesh at all with our frontbuffer tracking. And the hw alone isn't
++ * good enough. */
++ val = EDP_PSR2_ENABLE | EDP_SU_TRACK_ENABLE;
++
++ if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 5)
++ val |= EDP_PSR2_TP2_TIME_2500;
++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 1)
++ val |= EDP_PSR2_TP2_TIME_500;
++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 0)
++ val |= EDP_PSR2_TP2_TIME_100;
++ else
++ val |= EDP_PSR2_TP2_TIME_50;
++
++ I915_WRITE(EDP_PSR2_CTL, val);
+ }
+
+ static bool intel_psr_match_conditions(struct intel_dp *intel_dp)
--- /dev/null
+From c578d15226c99f0566d5d022f81af6b7d69928db Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 2 May 2016 22:08:23 +0300
+Subject: drm/i915: Respect DP++ adaptor TMDS clock limit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit c578d15226c99f0566d5d022f81af6b7d69928db upstream.
+
+Try to detect the max TMDS clock limit for the DP++ adaptor (if any)
+and take it into account when checking the port clock.
+
+Note that as with the sink (HDMI vs. DVI) TMDS clock limit we'll ignore
+the adaptor TMDS clock limit in the modeset path, in case users are
+already "overclocking" their TMDS links. One subtle change here is that
+we'll have to respect the adaptor TMDS clock limit when we decide whether
+to do 12bpc or 8bpc, otherwise we might end up picking 12bpc and
+accidentally driving the TMDS link out of spec even when the user chose
+a mode that fits wihting the limits at 8bpc. This means you can't
+"overclock" your DP++ dongle at 12bpc anymore, but you can continue to
+do so at 8bpc.
+
+Note that for simplicity we'll use the I2C access method for all dual
+mode adaptors including type 2. Otherwise we'd have to start mixing
+DP AUX and HDMI together. In the future we may need to do that if we
+come across any board designs that don't hook up the DDC pins to the
+DP++ connectors. Such boards would obviously only work with type 2
+dual mode adaptors, and not type 1.
+
+v2: Store adaptor type under indel_hdmi->dp_dual_mode
+ Deal with DRM_DP_DUAL_MODE_UNKNOWN
+ Pass adaptor type to drm_dp_dual_mode_max_tmds_clock(),
+ and use it for type1 adaptors as well
+
+Reported-by: Tore Anderson <tore@fud.no>
+Fixes: 7a0baa623446 ("Revert "drm/i915: Disable 12bpc hdmi for now"")
+Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1462216105-20881-3-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Shashank Sharma <shashank.sharma@intel.com>
+(cherry picked from commit b1ba124d8e95cca48d33502a4a76b1ed09d213ce)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_drv.h | 5 +++
+ drivers/gpu/drm/i915/intel_hdmi.c | 58 ++++++++++++++++++++++++++++++++------
+ 2 files changed, 55 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -33,6 +33,7 @@
+ #include <drm/drm_crtc.h>
+ #include <drm/drm_crtc_helper.h>
+ #include <drm/drm_fb_helper.h>
++#include <drm/drm_dp_dual_mode_helper.h>
+ #include <drm/drm_dp_mst_helper.h>
+ #include <drm/drm_rect.h>
+ #include <drm/drm_atomic.h>
+@@ -703,6 +704,10 @@ struct cxsr_latency {
+ struct intel_hdmi {
+ i915_reg_t hdmi_reg;
+ int ddc_bus;
++ struct {
++ enum drm_dp_dual_mode_type type;
++ int max_tmds_clock;
++ } dp_dual_mode;
+ bool limited_color_range;
+ bool color_range_auto;
+ bool has_hdmi_sink;
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -1168,27 +1168,42 @@ static void pch_post_disable_hdmi(struct
+ intel_disable_hdmi(encoder);
+ }
+
+-static int hdmi_port_clock_limit(struct intel_hdmi *hdmi, bool respect_dvi_limit)
++static int intel_hdmi_source_max_tmds_clock(struct drm_i915_private *dev_priv)
+ {
+- struct drm_device *dev = intel_hdmi_to_dev(hdmi);
+-
+- if ((respect_dvi_limit && !hdmi->has_hdmi_sink) || IS_G4X(dev))
++ if (IS_G4X(dev_priv))
+ return 165000;
+- else if (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)
++ else if (IS_HASWELL(dev_priv) || INTEL_INFO(dev_priv)->gen >= 8)
+ return 300000;
+ else
+ return 225000;
+ }
+
++static int hdmi_port_clock_limit(struct intel_hdmi *hdmi,
++ bool respect_downstream_limits)
++{
++ struct drm_device *dev = intel_hdmi_to_dev(hdmi);
++ int max_tmds_clock = intel_hdmi_source_max_tmds_clock(to_i915(dev));
++
++ if (respect_downstream_limits) {
++ if (hdmi->dp_dual_mode.max_tmds_clock)
++ max_tmds_clock = min(max_tmds_clock,
++ hdmi->dp_dual_mode.max_tmds_clock);
++ if (!hdmi->has_hdmi_sink)
++ max_tmds_clock = min(max_tmds_clock, 165000);
++ }
++
++ return max_tmds_clock;
++}
++
+ static enum drm_mode_status
+ hdmi_port_clock_valid(struct intel_hdmi *hdmi,
+- int clock, bool respect_dvi_limit)
++ int clock, bool respect_downstream_limits)
+ {
+ struct drm_device *dev = intel_hdmi_to_dev(hdmi);
+
+ if (clock < 25000)
+ return MODE_CLOCK_LOW;
+- if (clock > hdmi_port_clock_limit(hdmi, respect_dvi_limit))
++ if (clock > hdmi_port_clock_limit(hdmi, respect_downstream_limits))
+ return MODE_CLOCK_HIGH;
+
+ /* BXT DPLL can't generate 223-240 MHz */
+@@ -1312,7 +1327,7 @@ bool intel_hdmi_compute_config(struct in
+ * within limits.
+ */
+ if (pipe_config->pipe_bpp > 8*3 && pipe_config->has_hdmi_sink &&
+- hdmi_port_clock_valid(intel_hdmi, clock_12bpc, false) == MODE_OK &&
++ hdmi_port_clock_valid(intel_hdmi, clock_12bpc, true) == MODE_OK &&
+ hdmi_12bpc_possible(pipe_config)) {
+ DRM_DEBUG_KMS("picking bpc to 12 for HDMI output\n");
+ desired_bpp = 12*3;
+@@ -1352,10 +1367,35 @@ intel_hdmi_unset_edid(struct drm_connect
+ intel_hdmi->has_audio = false;
+ intel_hdmi->rgb_quant_range_selectable = false;
+
++ intel_hdmi->dp_dual_mode.type = DRM_DP_DUAL_MODE_NONE;
++ intel_hdmi->dp_dual_mode.max_tmds_clock = 0;
++
+ kfree(to_intel_connector(connector)->detect_edid);
+ to_intel_connector(connector)->detect_edid = NULL;
+ }
+
++static void
++intel_hdmi_dp_dual_mode_detect(struct drm_connector *connector)
++{
++ struct drm_i915_private *dev_priv = to_i915(connector->dev);
++ struct intel_hdmi *hdmi = intel_attached_hdmi(connector);
++ struct i2c_adapter *adapter =
++ intel_gmbus_get_adapter(dev_priv, hdmi->ddc_bus);
++ enum drm_dp_dual_mode_type type = drm_dp_dual_mode_detect(adapter);
++
++ if (type == DRM_DP_DUAL_MODE_NONE ||
++ type == DRM_DP_DUAL_MODE_UNKNOWN)
++ return;
++
++ hdmi->dp_dual_mode.type = type;
++ hdmi->dp_dual_mode.max_tmds_clock =
++ drm_dp_dual_mode_max_tmds_clock(type, adapter);
++
++ DRM_DEBUG_KMS("DP dual mode adaptor (%s) detected (max TMDS clock: %d kHz)\n",
++ drm_dp_get_dual_mode_type_name(type),
++ hdmi->dp_dual_mode.max_tmds_clock);
++}
++
+ static bool
+ intel_hdmi_set_edid(struct drm_connector *connector, bool force)
+ {
+@@ -1371,6 +1411,8 @@ intel_hdmi_set_edid(struct drm_connector
+ intel_gmbus_get_adapter(dev_priv,
+ intel_hdmi->ddc_bus));
+
++ intel_hdmi_dp_dual_mode_detect(connector);
++
+ intel_display_power_put(dev_priv, POWER_DOMAIN_GMBUS);
+ }
+
--- /dev/null
+From 310944d148e3600dcff8b346bee7fa01d34903b1 Mon Sep 17 00:00:00 2001
+From: Philipp Zabel <p.zabel@pengutronix.de>
+Date: Thu, 12 May 2016 15:00:44 +0200
+Subject: drm/imx: Match imx-ipuv3-crtc components using device node in platform data
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+commit 310944d148e3600dcff8b346bee7fa01d34903b1 upstream.
+
+The component master driver imx-drm-core matches component devices using
+their of_node. Since commit 950b410dd1ab ("gpu: ipu-v3: Fix imx-ipuv3-crtc
+module autoloading"), the imx-ipuv3-crtc dev->of_node is not set during
+probing. Before that, of_node was set and caused an of: modalias to be
+used instead of the platform: modalias, which broke module autoloading.
+
+On the other hand, if dev->of_node is not set yet when the imx-ipuv3-crtc
+probe function calls component_add, component matching in imx-drm-core
+fails. While dev->of_node will be set once the next component tries to
+bring up the component master, imx-drm-core component binding will never
+succeed if one of the crtc devices is probed last.
+
+Add of_node to the component platform data and match against the
+pdata->of_node instead of dev->of_node in imx-drm-core to work around
+this problem.
+
+Fixes: 950b410dd1ab ("gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading")
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Tested-by: Fabio Estevam <fabio.estevam@nxp.com>
+Tested-by: Lothar Waßmann <LW@KARO-electronics.de>
+Tested-by: Heiko Schocher <hs@denx.de>
+Tested-by: Chris Ruehl <chris.ruehl@gtsys.com.hk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/imx/imx-drm-core.c | 8 ++++++++
+ drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +-
+ drivers/gpu/ipu-v3/ipu-common.c | 5 +++--
+ include/video/imx-ipu-v3.h | 2 ++
+ 4 files changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/imx/imx-drm-core.c
++++ b/drivers/gpu/drm/imx/imx-drm-core.c
+@@ -25,6 +25,7 @@
+ #include <drm/drm_fb_cma_helper.h>
+ #include <drm/drm_plane_helper.h>
+ #include <drm/drm_of.h>
++#include <video/imx-ipu-v3.h>
+
+ #include "imx-drm.h"
+
+@@ -444,6 +445,13 @@ static int compare_of(struct device *dev
+ {
+ struct device_node *np = data;
+
++ /* Special case for DI, dev->of_node may not be set yet */
++ if (strcmp(dev->driver->name, "imx-ipuv3-crtc") == 0) {
++ struct ipu_client_platformdata *pdata = dev->platform_data;
++
++ return pdata->of_node == np;
++ }
++
+ /* Special case for LDB, one device for two channels */
+ if (of_node_cmp(np->name, "lvds-channel") == 0) {
+ np = of_get_parent(np);
+--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
+@@ -473,7 +473,7 @@ static int ipu_crtc_init(struct ipu_crtc
+
+ ret = imx_drm_add_crtc(drm, &ipu_crtc->base, &ipu_crtc->imx_crtc,
+ &ipu_crtc->plane[0]->base, &ipu_crtc_helper_funcs,
+- ipu_crtc->dev->of_node);
++ pdata->of_node);
+ if (ret) {
+ dev_err(ipu_crtc->dev, "adding crtc failed with %d.\n", ret);
+ goto err_put_resources;
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -997,7 +997,7 @@ struct ipu_platform_reg {
+ };
+
+ /* These must be in the order of the corresponding device tree port nodes */
+-static const struct ipu_platform_reg client_reg[] = {
++static struct ipu_platform_reg client_reg[] = {
+ {
+ .pdata = {
+ .csi = 0,
+@@ -1048,7 +1048,7 @@ static int ipu_add_client_devices(struct
+ mutex_unlock(&ipu_client_id_mutex);
+
+ for (i = 0; i < ARRAY_SIZE(client_reg); i++) {
+- const struct ipu_platform_reg *reg = &client_reg[i];
++ struct ipu_platform_reg *reg = &client_reg[i];
+ struct platform_device *pdev;
+ struct device_node *of_node;
+
+@@ -1070,6 +1070,7 @@ static int ipu_add_client_devices(struct
+
+ pdev->dev.parent = dev;
+
++ reg->pdata.of_node = of_node;
+ ret = platform_device_add_data(pdev, ®->pdata,
+ sizeof(reg->pdata));
+ if (!ret)
+--- a/include/video/imx-ipu-v3.h
++++ b/include/video/imx-ipu-v3.h
+@@ -16,6 +16,7 @@
+ #include <linux/videodev2.h>
+ #include <linux/bitmap.h>
+ #include <linux/fb.h>
++#include <linux/of.h>
+ #include <media/v4l2-mediabus.h>
+ #include <video/videomode.h>
+
+@@ -345,6 +346,7 @@ struct ipu_client_platformdata {
+ int dc;
+ int dp;
+ int dma[2];
++ struct device_node *of_node;
+ };
+
+ #endif /* __DRM_IPU_H__ */
--- /dev/null
+From 93cd16817ae5ddcfc548784b51c76bf6d7923442 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Tue, 3 May 2016 11:24:35 +0200
+Subject: drm/vmwgfx: Kill some lockdep warnings
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 93cd16817ae5ddcfc548784b51c76bf6d7923442 upstream.
+
+Some global KMS state that is elsewhere protected by the mode_config
+mutex here needs to be protected with a local mutex. Remove corresponding
+lockdep checks and introduce a new driver-private global_kms_state_mutex,
+and make sure its locking order is *after* the crtc locks in order to
+avoid having to release those when the new mutex is taken.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Brian Paul <brianp@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 1 +
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 1 +
+ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 27 +++++++++++++--------------
+ drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 3 +++
+ drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 3 +++
+ 5 files changed, 21 insertions(+), 14 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -628,6 +628,7 @@ static int vmw_driver_load(struct drm_de
+ mutex_init(&dev_priv->cmdbuf_mutex);
+ mutex_init(&dev_priv->release_mutex);
+ mutex_init(&dev_priv->binding_mutex);
++ mutex_init(&dev_priv->global_kms_state_mutex);
+ rwlock_init(&dev_priv->resource_lock);
+ ttm_lock_init(&dev_priv->reservation_sem);
+ spin_lock_init(&dev_priv->hw_lock);
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+@@ -412,6 +412,7 @@ struct vmw_private {
+ struct drm_property *implicit_placement_property;
+ unsigned num_implicit;
+ struct vmw_framebuffer *implicit_fb;
++ struct mutex global_kms_state_mutex;
+
+ /*
+ * Context and surface management.
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -2143,13 +2143,13 @@ int vmw_kms_fbdev_init_data(struct vmw_p
+ void vmw_kms_del_active(struct vmw_private *dev_priv,
+ struct vmw_display_unit *du)
+ {
+- lockdep_assert_held_once(&dev_priv->dev->mode_config.mutex);
+-
++ mutex_lock(&dev_priv->global_kms_state_mutex);
+ if (du->active_implicit) {
+ if (--(dev_priv->num_implicit) == 0)
+ dev_priv->implicit_fb = NULL;
+ du->active_implicit = false;
+ }
++ mutex_unlock(&dev_priv->global_kms_state_mutex);
+ }
+
+ /**
+@@ -2165,8 +2165,7 @@ void vmw_kms_add_active(struct vmw_priva
+ struct vmw_display_unit *du,
+ struct vmw_framebuffer *vfb)
+ {
+- lockdep_assert_held_once(&dev_priv->dev->mode_config.mutex);
+-
++ mutex_lock(&dev_priv->global_kms_state_mutex);
+ WARN_ON_ONCE(!dev_priv->num_implicit && dev_priv->implicit_fb);
+
+ if (!du->active_implicit && du->is_implicit) {
+@@ -2174,6 +2173,7 @@ void vmw_kms_add_active(struct vmw_priva
+ du->active_implicit = true;
+ dev_priv->num_implicit++;
+ }
++ mutex_unlock(&dev_priv->global_kms_state_mutex);
+ }
+
+ /**
+@@ -2190,16 +2190,13 @@ bool vmw_kms_crtc_flippable(struct vmw_p
+ struct drm_crtc *crtc)
+ {
+ struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
++ bool ret;
+
+- lockdep_assert_held_once(&dev_priv->dev->mode_config.mutex);
+-
+- if (!du->is_implicit)
+- return true;
+-
+- if (dev_priv->num_implicit != 1)
+- return false;
++ mutex_lock(&dev_priv->global_kms_state_mutex);
++ ret = !du->is_implicit || dev_priv->num_implicit == 1;
++ mutex_unlock(&dev_priv->global_kms_state_mutex);
+
+- return true;
++ return ret;
+ }
+
+ /**
+@@ -2214,16 +2211,18 @@ void vmw_kms_update_implicit_fb(struct v
+ struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
+ struct vmw_framebuffer *vfb;
+
+- lockdep_assert_held_once(&dev_priv->dev->mode_config.mutex);
++ mutex_lock(&dev_priv->global_kms_state_mutex);
+
+ if (!du->is_implicit)
+- return;
++ goto out_unlock;
+
+ vfb = vmw_framebuffer_to_vfb(crtc->primary->fb);
+ WARN_ON_ONCE(dev_priv->num_implicit != 1 &&
+ dev_priv->implicit_fb != vfb);
+
+ dev_priv->implicit_fb = vfb;
++out_unlock:
++ mutex_unlock(&dev_priv->global_kms_state_mutex);
+ }
+
+ /**
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+@@ -285,14 +285,17 @@ static int vmw_sou_crtc_set_config(struc
+ }
+
+ /* Only one active implicit frame-buffer at a time. */
++ mutex_lock(&dev_priv->global_kms_state_mutex);
+ if (sou->base.is_implicit &&
+ dev_priv->implicit_fb && vfb &&
+ !(dev_priv->num_implicit == 1 &&
+ sou->base.active_implicit) &&
+ dev_priv->implicit_fb != vfb) {
++ mutex_unlock(&dev_priv->global_kms_state_mutex);
+ DRM_ERROR("Multiple implicit framebuffers not supported.\n");
+ return -EINVAL;
+ }
++ mutex_unlock(&dev_priv->global_kms_state_mutex);
+
+ /* since they always map one to one these are safe */
+ connector = &sou->base.connector;
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+@@ -553,12 +553,15 @@ static int vmw_stdu_crtc_set_config(stru
+ }
+
+ /* Only one active implicit frame-buffer at a time. */
++ mutex_lock(&dev_priv->global_kms_state_mutex);
+ if (!turning_off && stdu->base.is_implicit && dev_priv->implicit_fb &&
+ !(dev_priv->num_implicit == 1 && stdu->base.active_implicit)
+ && dev_priv->implicit_fb != vfb) {
++ mutex_unlock(&dev_priv->global_kms_state_mutex);
+ DRM_ERROR("Multiple implicit framebuffers not supported.\n");
+ return -EINVAL;
+ }
++ mutex_unlock(&dev_priv->global_kms_state_mutex);
+
+ /* Since they always map one to one these are safe */
+ connector = &stdu->base.connector;
xen-events-don-t-move-disabled-irqs.patch
xen-use-same-main-loop-for-counting-and-remapping-pages.patch
sunrpc-fix-stripping-of-padded-mic-tokens.patch
+drm-gma500-fix-possible-out-of-bounds-read.patch
+drm-vmwgfx-kill-some-lockdep-warnings.patch
+drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch
+drm-amdgpu-fix-hdmi-deep-color-support.patch
+drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch
+drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch
+drm-i915-discard-previous-atomic-state-on-resume-if-connectors-change.patch
+drm-atomic-verify-connector-funcs-null-when-clearing-states.patch
+bluetooth-6lowpan-fix-memory-corruption-of-ipv6-destination-address.patch
+drm-i915-psr-try-to-program-link-training-times-correctly.patch
+drm-i915-respect-dp-adaptor-tmds-clock-limit.patch
+drm-i915-enable-disable-tmds-output-buffers-in-dp-adaptor-as-needed.patch
+drm-i915-don-t-leave-old-junk-in-ilk-active-watermarks-on-readout.patch
+drm-i915-fix-watermarks-for-vlv-chv.patch
+drm-add-helper-for-dp-adaptors.patch
+drm-imx-match-imx-ipuv3-crtc-components-using-device-node-in-platform-data.patch
+drm-i915-pass-the-correct-crtc-state-to-.update_plane.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
