--- /dev/null
+From 4da5caa6a6f82cda3193bca855235b87debf78bd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 26 Oct 2016 12:05:55 +0300
+Subject: drm/dp/mst: Check peer device type before attempting EDID read
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 4da5caa6a6f82cda3193bca855235b87debf78bd upstream.
+
+Only certain types of pdts have the DDC bus registered, so check for
+that before we attempt the EDID read. Othwewise we risk playing around
+with an i2c adapter that doesn't actually exist.
+
+Cc: Carlos Santa <carlos.santa@intel.com>
+Cc: Kirill A. Shutemov <kirill@shutemov.name>
+Tested-by: Carlos Santa <carlos.santa@intel.com>
+Tested-by: Kirill A. Shutemov <kirill@shutemov.name>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97666
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1477472755-15288-5-git-send-email-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1155,7 +1155,9 @@ static void drm_dp_add_port(struct drm_d
+ drm_dp_put_port(port);
+ goto out;
+ }
+- if (port->port_num >= DP_MST_LOGICAL_PORT_0) {
++ if ((port->pdt == DP_PEER_DEVICE_DP_LEGACY_CONV ||
++ port->pdt == DP_PEER_DEVICE_SST_SINK) &&
++ port->port_num >= DP_MST_LOGICAL_PORT_0) {
+ port->cached_edid = drm_get_edid(port->connector, &port->aux.ddc);
+ drm_mode_connector_set_tile_property(port->connector);
+ }
--- /dev/null
+From 7dfcb36a1f17e4c7c7c12b9d8a6902037c7d98dc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 26 Oct 2016 12:05:52 +0300
+Subject: drm/fb-helper: Fix connector ref leak on error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 7dfcb36a1f17e4c7c7c12b9d8a6902037c7d98dc upstream.
+
+We need to drop the connector references already taken when we
+abort in the middle of drm_fb_helper_single_add_all_connectors()
+
+Cc: Carlos Santa <carlos.santa@intel.com>
+Cc: Kirill A. Shutemov <kirill@shutemov.name>
+Tested-by: Carlos Santa <carlos.santa@intel.com>
+Tested-by: Kirill A. Shutemov <kirill@shutemov.name>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1477472755-15288-2-git-send-email-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -124,7 +124,12 @@ int drm_fb_helper_single_add_all_connect
+ return 0;
+ fail:
+ for (i = 0; i < fb_helper->connector_count; i++) {
+- kfree(fb_helper->connector_info[i]);
++ struct drm_fb_helper_connector *fb_helper_connector =
++ fb_helper->connector_info[i];
++
++ drm_connector_unreference(fb_helper_connector->connector);
++
++ kfree(fb_helper_connector);
+ fb_helper->connector_info[i] = NULL;
+ }
+ fb_helper->connector_count = 0;
--- /dev/null
+From a2889606636d135148de101fe3311dfea67baf1c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 26 Oct 2016 17:41:18 +0300
+Subject: drm/fb-helper: Keep references for the current set of used connectors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit a2889606636d135148de101fe3311dfea67baf1c upstream.
+
+The fbdev helper code keeps around two lists of connectors. One is the
+list of all connectors it could use, and that list already holds
+references for all the connectors. However the other list, or rather
+lists, is the one actively being used. That list is tracked per-crtc
+and currently doesn't hold any extra references. Let's grab those
+extra references to avoid oopsing when the connector vanishes. The
+list of all possible connectors should get updated when the hpd happens,
+but the list of actively used connectors would not get updated until
+the next time the fb-helper picks through the set of possible connectors.
+And so we need to hang on to the connectors until that time.
+
+Since we need to clean up in drm_fb_helper_crtc_free() as well,
+let's pull the code to a common place. And while at it let's
+pull in up the modeset->mode cleanup in there as well. The case
+of modeset->fb is a bit less clear. I'm thinking we should probably
+hold a reference to it, but for now I just slapped on a FIXME.
+
+v2: Cleanup things drm_fb_helper_crtc_free() too (Chris)
+v3: Don't leak modeset->connectors (Chris)
+
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Carlos Santa <carlos.santa@intel.com>
+Cc: Kirill A. Shutemov <kirill@shutemov.name>
+Tested-by: Carlos Santa <carlos.santa@intel.com> (v1)
+Tested-by: Kirill A. Shutemov <kirill@shutemov.name> (v1)
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97666
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1477492878-4990-1-git-send-email-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 57 +++++++++++++++++++++++-----------------
+ 1 file changed, 33 insertions(+), 24 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -631,6 +631,24 @@ int drm_fb_helper_blank(int blank, struc
+ }
+ EXPORT_SYMBOL(drm_fb_helper_blank);
+
++static void drm_fb_helper_modeset_release(struct drm_fb_helper *helper,
++ struct drm_mode_set *modeset)
++{
++ int i;
++
++ for (i = 0; i < modeset->num_connectors; i++) {
++ drm_connector_unreference(modeset->connectors[i]);
++ modeset->connectors[i] = NULL;
++ }
++ modeset->num_connectors = 0;
++
++ drm_mode_destroy(helper->dev, modeset->mode);
++ modeset->mode = NULL;
++
++ /* FIXME should hold a ref? */
++ modeset->fb = NULL;
++}
++
+ static void drm_fb_helper_crtc_free(struct drm_fb_helper *helper)
+ {
+ int i;
+@@ -638,10 +656,12 @@ static void drm_fb_helper_crtc_free(stru
+ for (i = 0; i < helper->connector_count; i++)
+ kfree(helper->connector_info[i]);
+ kfree(helper->connector_info);
++
+ for (i = 0; i < helper->crtc_count; i++) {
+- kfree(helper->crtc_info[i].mode_set.connectors);
+- if (helper->crtc_info[i].mode_set.mode)
+- drm_mode_destroy(helper->dev, helper->crtc_info[i].mode_set.mode);
++ struct drm_mode_set *modeset = &helper->crtc_info[i].mode_set;
++
++ drm_fb_helper_modeset_release(helper, modeset);
++ kfree(modeset->connectors);
+ }
+ kfree(helper->crtc_info);
+ }
+@@ -1983,7 +2003,6 @@ static void drm_setup_crtcs(struct drm_f
+ struct drm_fb_helper_crtc **crtcs;
+ struct drm_display_mode **modes;
+ struct drm_fb_offset *offsets;
+- struct drm_mode_set *modeset;
+ bool *enabled;
+ int width, height;
+ int i;
+@@ -2031,45 +2050,35 @@ static void drm_setup_crtcs(struct drm_f
+
+ /* need to set the modesets up here for use later */
+ /* fill out the connector<->crtc mappings into the modesets */
+- for (i = 0; i < fb_helper->crtc_count; i++) {
+- modeset = &fb_helper->crtc_info[i].mode_set;
+- modeset->num_connectors = 0;
+- modeset->fb = NULL;
+- }
++ for (i = 0; i < fb_helper->crtc_count; i++)
++ drm_fb_helper_modeset_release(fb_helper,
++ &fb_helper->crtc_info[i].mode_set);
+
+ for (i = 0; i < fb_helper->connector_count; i++) {
+ struct drm_display_mode *mode = modes[i];
+ struct drm_fb_helper_crtc *fb_crtc = crtcs[i];
+ struct drm_fb_offset *offset = &offsets[i];
+- modeset = &fb_crtc->mode_set;
++ struct drm_mode_set *modeset = &fb_crtc->mode_set;
+
+ if (mode && fb_crtc) {
++ struct drm_connector *connector =
++ fb_helper->connector_info[i]->connector;
++
+ DRM_DEBUG_KMS("desired mode %s set on crtc %d (%d,%d)\n",
+ mode->name, fb_crtc->mode_set.crtc->base.id, offset->x, offset->y);
++
+ fb_crtc->desired_mode = mode;
+ fb_crtc->x = offset->x;
+ fb_crtc->y = offset->y;
+- if (modeset->mode)
+- drm_mode_destroy(dev, modeset->mode);
+ modeset->mode = drm_mode_duplicate(dev,
+ fb_crtc->desired_mode);
+- modeset->connectors[modeset->num_connectors++] = fb_helper->connector_info[i]->connector;
++ drm_connector_reference(connector);
++ modeset->connectors[modeset->num_connectors++] = connector;
+ modeset->fb = fb_helper->fb;
+ modeset->x = offset->x;
+ modeset->y = offset->y;
+ }
+ }
+-
+- /* Clear out any old modes if there are no more connected outputs. */
+- for (i = 0; i < fb_helper->crtc_count; i++) {
+- modeset = &fb_helper->crtc_info[i].mode_set;
+- if (modeset->num_connectors == 0) {
+- BUG_ON(modeset->fb);
+- if (modeset->mode)
+- drm_mode_destroy(dev, modeset->mode);
+- modeset->mode = NULL;
+- }
+- }
+ out:
+ kfree(crtcs);
+ kfree(modes);
--- /dev/null
+From 0ce140d45a8398b501934ac289aef0eb7f47c596 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 11 Oct 2016 20:52:47 +0300
+Subject: drm/i915: Clean up DDI DDC/AUX CH sanitation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 0ce140d45a8398b501934ac289aef0eb7f47c596 upstream.
+
+Now that we use the AUX and GMBUS assignment from VBT for all ports,
+let's clean up the sanitization of the port information a bit.
+Previosuly we only did this for port E, and only complained about a
+non-standard assignment for the other ports. But as we know that
+non-standard assignments are a fact of life, let's expand the
+sanitization to all the ports.
+
+v2: Include a commit message, fix up the comments a bit
+v3: Don't clobber other ports if the current port has no alternate aux ch/ddc pin
+
+Cc: Maarten Maathuis <madman2003@gmail.com>
+Tested-by: Maarten Maathuis <madman2003@gmail.com>
+References: https://bugs.freedesktop.org/show_bug.cgi?id=97877
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1476208368-5710-4-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Jim Bride <jim.bride@linux.intel.com> (v2)
+(cherry picked from commit 9454fa871edf15c20a0371548b3ec0d6d944a498)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_bios.c | 122 +++++++++++++++++++++++---------------
+ 1 file changed, 77 insertions(+), 45 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_bios.c
++++ b/drivers/gpu/drm/i915/intel_bios.c
+@@ -907,6 +907,77 @@ static u8 translate_iboost(u8 val)
+ return mapping[val];
+ }
+
++static void sanitize_ddc_pin(struct drm_i915_private *dev_priv,
++ enum port port)
++{
++ const struct ddi_vbt_port_info *info =
++ &dev_priv->vbt.ddi_port_info[port];
++ enum port p;
++
++ if (!info->alternate_ddc_pin)
++ return;
++
++ for_each_port_masked(p, (1 << port) - 1) {
++ struct ddi_vbt_port_info *i = &dev_priv->vbt.ddi_port_info[p];
++
++ if (info->alternate_ddc_pin != i->alternate_ddc_pin)
++ continue;
++
++ DRM_DEBUG_KMS("port %c trying to use the same DDC pin (0x%x) as port %c, "
++ "disabling port %c DVI/HDMI support\n",
++ port_name(p), i->alternate_ddc_pin,
++ port_name(port), port_name(p));
++
++ /*
++ * If we have multiple ports supposedly sharing the
++ * pin, then dvi/hdmi couldn't exist on the shared
++ * port. Otherwise they share the same ddc bin and
++ * system couldn't communicate with them separately.
++ *
++ * Due to parsing the ports in alphabetical order,
++ * a higher port will always clobber a lower one.
++ */
++ i->supports_dvi = false;
++ i->supports_hdmi = false;
++ i->alternate_ddc_pin = 0;
++ }
++}
++
++static void sanitize_aux_ch(struct drm_i915_private *dev_priv,
++ enum port port)
++{
++ const struct ddi_vbt_port_info *info =
++ &dev_priv->vbt.ddi_port_info[port];
++ enum port p;
++
++ if (!info->alternate_aux_channel)
++ return;
++
++ for_each_port_masked(p, (1 << port) - 1) {
++ struct ddi_vbt_port_info *i = &dev_priv->vbt.ddi_port_info[p];
++
++ if (info->alternate_aux_channel != i->alternate_aux_channel)
++ continue;
++
++ DRM_DEBUG_KMS("port %c trying to use the same AUX CH (0x%x) as port %c, "
++ "disabling port %c DP support\n",
++ port_name(p), i->alternate_aux_channel,
++ port_name(port), port_name(p));
++
++ /*
++ * If we have multiple ports supposedlt sharing the
++ * aux channel, then DP couldn't exist on the shared
++ * port. Otherwise they share the same aux channel
++ * and system couldn't communicate with them separately.
++ *
++ * Due to parsing the ports in alphabetical order,
++ * a higher port will always clobber a lower one.
++ */
++ i->supports_dp = false;
++ i->alternate_aux_channel = 0;
++ }
++}
++
+ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
+ const struct bdb_header *bdb)
+ {
+@@ -981,54 +1052,15 @@ static void parse_ddi_port(struct drm_i9
+ DRM_DEBUG_KMS("Port %c is internal DP\n", port_name(port));
+
+ if (is_dvi) {
+- if (port == PORT_E) {
+- info->alternate_ddc_pin = ddc_pin;
+- /* if DDIE share ddc pin with other port, then
+- * dvi/hdmi couldn't exist on the shared port.
+- * Otherwise they share the same ddc bin and system
+- * couldn't communicate with them seperately. */
+- if (ddc_pin == DDC_PIN_B) {
+- dev_priv->vbt.ddi_port_info[PORT_B].supports_dvi = 0;
+- dev_priv->vbt.ddi_port_info[PORT_B].supports_hdmi = 0;
+- } else if (ddc_pin == DDC_PIN_C) {
+- dev_priv->vbt.ddi_port_info[PORT_C].supports_dvi = 0;
+- dev_priv->vbt.ddi_port_info[PORT_C].supports_hdmi = 0;
+- } else if (ddc_pin == DDC_PIN_D) {
+- dev_priv->vbt.ddi_port_info[PORT_D].supports_dvi = 0;
+- dev_priv->vbt.ddi_port_info[PORT_D].supports_hdmi = 0;
+- }
+- } else if (ddc_pin == DDC_PIN_B && port != PORT_B)
+- DRM_DEBUG_KMS("Unexpected DDC pin for port B\n");
+- else if (ddc_pin == DDC_PIN_C && port != PORT_C)
+- DRM_DEBUG_KMS("Unexpected DDC pin for port C\n");
+- else if (ddc_pin == DDC_PIN_D && port != PORT_D)
+- DRM_DEBUG_KMS("Unexpected DDC pin for port D\n");
++ info->alternate_ddc_pin = ddc_pin;
++
++ sanitize_ddc_pin(dev_priv, port);
+ }
+
+ if (is_dp) {
+- if (port == PORT_E) {
+- info->alternate_aux_channel = aux_channel;
+- /* if DDIE share aux channel with other port, then
+- * DP couldn't exist on the shared port. Otherwise
+- * they share the same aux channel and system
+- * couldn't communicate with them seperately. */
+- if (aux_channel == DP_AUX_A)
+- dev_priv->vbt.ddi_port_info[PORT_A].supports_dp = 0;
+- else if (aux_channel == DP_AUX_B)
+- dev_priv->vbt.ddi_port_info[PORT_B].supports_dp = 0;
+- else if (aux_channel == DP_AUX_C)
+- dev_priv->vbt.ddi_port_info[PORT_C].supports_dp = 0;
+- else if (aux_channel == DP_AUX_D)
+- dev_priv->vbt.ddi_port_info[PORT_D].supports_dp = 0;
+- }
+- else if (aux_channel == DP_AUX_A && port != PORT_A)
+- DRM_DEBUG_KMS("Unexpected AUX channel for port A\n");
+- else if (aux_channel == DP_AUX_B && port != PORT_B)
+- DRM_DEBUG_KMS("Unexpected AUX channel for port B\n");
+- else if (aux_channel == DP_AUX_C && port != PORT_C)
+- DRM_DEBUG_KMS("Unexpected AUX channel for port C\n");
+- else if (aux_channel == DP_AUX_D && port != PORT_D)
+- DRM_DEBUG_KMS("Unexpected AUX channel for port D\n");
++ info->alternate_aux_channel = aux_channel;
++
++ sanitize_aux_ch(dev_priv, port);
+ }
+
+ if (bdb->version >= 158) {
--- /dev/null
+From 537b4b462caa8bfb9726d9695b8e56e2d5e6b41e Mon Sep 17 00:00:00 2001
+From: Lucas Stach <dev@lynxeye.de>
+Date: Mon, 24 Oct 2016 23:32:04 +0200
+Subject: drm/radeon: drop register readback in cayman_cp_int_cntl_setup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lucas Stach <dev@lynxeye.de>
+
+commit 537b4b462caa8bfb9726d9695b8e56e2d5e6b41e upstream.
+
+The read is taking a considerable amount of time (about 50us on this
+machine). The register does not ever hold anything other than the ring
+ID that is updated in this exact function, so there is no need for
+the read modify write cycle.
+
+This chops off a big chunk of the time spent in hardirq disabled
+context, as this function is called multiple times in the interrupt
+handler. With this change applied radeon won't show up in the list
+of the worst IRQ latency offenders anymore, where it was a regular
+before.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Lucas Stach <dev@lynxeye.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1396,9 +1396,7 @@ static void cayman_pcie_gart_fini(struct
+ void cayman_cp_int_cntl_setup(struct radeon_device *rdev,
+ int ring, u32 cp_int_cntl)
+ {
+- u32 srbm_gfx_cntl = RREG32(SRBM_GFX_CNTL) & ~3;
+-
+- WREG32(SRBM_GFX_CNTL, srbm_gfx_cntl | (ring & 3));
++ WREG32(SRBM_GFX_CNTL, RINGID(ring));
+ WREG32(CP_INT_CNTL, cp_int_cntl);
+ }
+
--- /dev/null
+From fb9a5b0c1c9893db2e0d18544fd49e19d784a87d Mon Sep 17 00:00:00 2001
+From: Tom St Denis <tom.stdenis@amd.com>
+Date: Thu, 13 Oct 2016 12:38:07 -0400
+Subject: drm/radeon/si_dpm: Limit clocks on HD86xx part
+
+From: Tom St Denis <tom.stdenis@amd.com>
+
+commit fb9a5b0c1c9893db2e0d18544fd49e19d784a87d upstream.
+
+Limit clocks on a specific HD86xx part to avoid
+crashes (while awaiting an appropriate PP fix).
+
+Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -3021,6 +3021,12 @@ static void si_apply_state_adjust_rules(
+ max_sclk = 75000;
+ max_mclk = 80000;
+ }
++ /* limit clocks on HD8600 series */
++ if (rdev->pdev->device == 0x6660 &&
++ rdev->pdev->revision == 0x83) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
+
+ if (rps->vce_active) {
+ rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
--- /dev/null
+From 7dc86ef5ac91642dfc3eb93ee0f0458e702a343e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 14 Oct 2016 16:38:02 -0400
+Subject: drm/radeon/si_dpm: workaround for SI kickers
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 7dc86ef5ac91642dfc3eb93ee0f0458e702a343e upstream.
+
+Consolidate existing quirks. Fixes stability issues
+on some kickers.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 59 +++++++++++++++++++++++++++++-----------
+ 1 file changed, 43 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2999,6 +2999,49 @@ static void si_apply_state_adjust_rules(
+ int i;
+ struct si_dpm_quirk *p = si_dpm_quirk_list;
+
++ /* limit all SI kickers */
++ if (rdev->family == CHIP_PITCAIRN) {
++ if ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->device == 0x6810) ||
++ (rdev->pdev->device == 0x6811) ||
++ (rdev->pdev->device == 0x6816) ||
++ (rdev->pdev->device == 0x6817) ||
++ (rdev->pdev->device == 0x6806))
++ max_mclk = 120000;
++ } else if (rdev->family == CHIP_VERDE) {
++ if ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->revision == 0x87) ||
++ (rdev->pdev->device == 0x6820) ||
++ (rdev->pdev->device == 0x6821) ||
++ (rdev->pdev->device == 0x6822) ||
++ (rdev->pdev->device == 0x6823) ||
++ (rdev->pdev->device == 0x682A) ||
++ (rdev->pdev->device == 0x682B)) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
++ } else if (rdev->family == CHIP_OLAND) {
++ if ((rdev->pdev->revision == 0xC7) ||
++ (rdev->pdev->revision == 0x80) ||
++ (rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->device == 0x6604) ||
++ (rdev->pdev->device == 0x6605)) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
++ } else if (rdev->family == CHIP_HAINAN) {
++ if ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->revision == 0xC3) ||
++ (rdev->pdev->device == 0x6664) ||
++ (rdev->pdev->device == 0x6665) ||
++ (rdev->pdev->device == 0x6667)) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
++ }
+ /* Apply dpm quirks */
+ while (p && p->chip_device != 0) {
+ if (rdev->pdev->vendor == p->chip_vendor &&
+@@ -3011,22 +3054,6 @@ static void si_apply_state_adjust_rules(
+ }
+ ++p;
+ }
+- /* limit mclk on all R7 370 parts for stability */
+- if (rdev->pdev->device == 0x6811 &&
+- rdev->pdev->revision == 0x81)
+- max_mclk = 120000;
+- /* limit sclk/mclk on Jet parts for stability */
+- if (rdev->pdev->device == 0x6665 &&
+- rdev->pdev->revision == 0xc3) {
+- max_sclk = 75000;
+- max_mclk = 80000;
+- }
+- /* limit clocks on HD8600 series */
+- if (rdev->pdev->device == 0x6660 &&
+- rdev->pdev->revision == 0x83) {
+- max_sclk = 75000;
+- max_mclk = 80000;
+- }
+
+ if (rps->vce_active) {
+ rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
--- /dev/null
+From ea720935cf6686f72def9d322298bf7e9bd53377 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 5 Oct 2016 10:14:42 +0200
+Subject: mac80211: discard multicast and 4-addr A-MSDUs
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit ea720935cf6686f72def9d322298bf7e9bd53377 upstream.
+
+In mac80211, multicast A-MSDUs are accepted in many cases that
+they shouldn't be accepted in:
+ * drop A-MSDUs with a multicast A1 (RA), as required by the
+ spec in 9.11 (802.11-2012 version)
+ * drop A-MSDUs with a 4-addr header, since the fourth address
+ can't actually be useful for them; unless 4-address frame
+ format is actually requested, even though the fourth address
+ is still not useful in this case, but ignored
+
+Accepting the first case, in particular, is very problematic
+since it allows anyone else with possession of a GTK to send
+unicast frames encapsulated in a multicast A-MSDU, even when
+the AP has client isolation enabled.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2203,16 +2203,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ if (!(status->rx_flags & IEEE80211_RX_AMSDU))
+ return RX_CONTINUE;
+
+- if (ieee80211_has_a4(hdr->frame_control) &&
+- rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+- !rx->sdata->u.vlan.sta)
+- return RX_DROP_UNUSABLE;
++ if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
++ switch (rx->sdata->vif.type) {
++ case NL80211_IFTYPE_AP_VLAN:
++ if (!rx->sdata->u.vlan.sta)
++ return RX_DROP_UNUSABLE;
++ break;
++ case NL80211_IFTYPE_STATION:
++ if (!rx->sdata->u.mgd.use_4addr)
++ return RX_DROP_UNUSABLE;
++ break;
++ default:
++ return RX_DROP_UNUSABLE;
++ }
++ }
+
+- if (is_multicast_ether_addr(hdr->addr1) &&
+- ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+- rx->sdata->u.vlan.sta) ||
+- (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
+- rx->sdata->u.mgd.use_4addr)))
++ if (is_multicast_ether_addr(hdr->addr1))
+ return RX_DROP_UNUSABLE;
+
+ skb->dev = dev;
--- /dev/null
+From 45c7a4908a307a023e237a64a3eadcafc4836493 Mon Sep 17 00:00:00 2001
+From: Jaehoon Chung <jh80.chung@samsung.com>
+Date: Fri, 21 Oct 2016 19:57:57 +0900
+Subject: mmc: dw_mmc-pltfm: fix the potential NULL pointer dereference
+
+From: Jaehoon Chung <jh80.chung@samsung.com>
+
+commit 45c7a4908a307a023e237a64a3eadcafc4836493 upstream.
+
+platform_get_resource can be returned the NULL pointer.
+Then regs->start should be referred to NULL Pointer.
+devm_ioremap_resource() checks whether res is NULL or not.
+
+Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/dw_mmc-pltfm.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/dw_mmc-pltfm.c
++++ b/drivers/mmc/host/dw_mmc-pltfm.c
+@@ -59,12 +59,13 @@ int dw_mci_pltfm_register(struct platfor
+ host->pdata = pdev->dev.platform_data;
+
+ regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- /* Get registers' physical base address */
+- host->phy_regs = regs->start;
+ host->regs = devm_ioremap_resource(&pdev->dev, regs);
+ if (IS_ERR(host->regs))
+ return PTR_ERR(host->regs);
+
++ /* Get registers' physical base address */
++ host->phy_regs = regs->start;
++
+ platform_set_drvdata(pdev, host);
+ return dw_mci_probe(host);
+ }
--- /dev/null
+From 67befc652845c8ffbefc8d173a6e6ced14d472f1 Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Thu, 26 Nov 2015 14:54:04 +0100
+Subject: perf build: Fix traceevent plugins build race
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+commit 67befc652845c8ffbefc8d173a6e6ced14d472f1 upstream.
+
+Ingo reported following build failure:
+
+ $ make clean install
+ ...
+ CC plugin_kmem.o
+ fixdep: error opening depfile: ./.plugin_hrtimer.o.d: No such file or directory
+ /home/mingo/tip/tools/build/Makefile.build:77: recipe for target
+ 'plugin_hrtimer.o' failed
+ make[3]: *** [plugin_hrtimer.o] Error 2
+ Makefile:189: recipe for target 'plugin_hrtimer-in.o' failed
+ make[2]: *** [plugin_hrtimer-in.o] Error 2
+ Makefile.perf:414: recipe for target 'libtraceevent_plugins' failed
+ make[1]: *** [libtraceevent_plugins] Error 2
+ make[1]: *** Waiting for unfinished jobs....
+
+Currently we have the install-traceevent-plugins target being dependent
+on $(LIBTRACEEVENT), which will actualy not build any plugin. So the
+install-traceevent-plugins target itself will try to build plugins,
+but..
+
+Plugins built is also triggered by perf build itself via
+libtraceevent_plugins target.
+
+This might cause a race having one make thread removing temp files from
+another and result in above error. Fixing this by having proper plugins
+build dependency before installing plugins.
+
+Reported-and-Tested-by:: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/r/1448546044-28973-3-git-send-email-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Thomas Backlund <tmb@mageia.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/Makefile.perf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -420,7 +420,7 @@ $(LIBTRACEEVENT)-clean:
+ $(call QUIET_CLEAN, libtraceevent)
+ $(Q)$(MAKE) -C $(TRACE_EVENT_DIR) O=$(OUTPUT) clean >/dev/null
+
+-install-traceevent-plugins: $(LIBTRACEEVENT)
++install-traceevent-plugins: libtraceevent_plugins
+ $(Q)$(MAKE) -C $(TRACE_EVENT_DIR) $(LIBTRACEEVENT_FLAGS) O=$(OUTPUT) install_plugins
+
+ $(LIBAPI): fixdep FORCE
--- /dev/null
+From 579ed34f7b751b8add233cba4cf755258dbdd60a Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@fb.com>
+Date: Thu, 6 Oct 2016 14:13:52 -0700
+Subject: RAID10: ignore discard error
+
+From: Shaohua Li <shli@fb.com>
+
+commit 579ed34f7b751b8add233cba4cf755258dbdd60a upstream.
+
+This is the counterpart of raid10 fix. If a write error occurs, raid10
+will try to rewrite the bio in small chunk size. If the rewrite fails,
+raid10 will record the error in bad block. narrow_write_error will
+always use WRITE for the bio, but actually it could be a discard. Since
+discard bio hasn't payload, write the bio will cause different issues.
+But discard error isn't fatal, we can safely ignore it. This is what
+this patch does.
+
+This issue should exist since discard is added, but only exposed with
+recent arbitrary bio size feature.
+
+Cc: Sitsofe Wheeler <sitsofe@gmail.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -447,6 +447,9 @@ static void raid10_end_write_request(str
+ struct r10conf *conf = r10_bio->mddev->private;
+ int slot, repl;
+ struct md_rdev *rdev = NULL;
++ bool discard_error;
++
++ discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD;
+
+ dev = find_bio_disk(conf, r10_bio, bio, &slot, &repl);
+
+@@ -460,7 +463,7 @@ static void raid10_end_write_request(str
+ /*
+ * this branch is our 'one mirror IO has finished' event handler:
+ */
+- if (bio->bi_error) {
++ if (bio->bi_error && !discard_error) {
+ if (repl)
+ /* Never record new bad blocks to replacement,
+ * just fail it.
+@@ -503,7 +506,7 @@ static void raid10_end_write_request(str
+ if (is_badblock(rdev,
+ r10_bio->devs[slot].addr,
+ r10_bio->sectors,
+- &first_bad, &bad_sectors)) {
++ &first_bad, &bad_sectors) && !discard_error) {
+ bio_put(bio);
+ if (repl)
+ r10_bio->devs[slot].repl_bio = IO_MADE_GOOD;
--- /dev/null
+From 9dc79965b21967caebde575f5f5d8bf1aa2c23ab Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Mon, 24 Oct 2016 16:52:20 +0900
+Subject: Revert "drm/radeon: fix DP link training issue with second 4K monitor"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <michel.daenzer@amd.com>
+
+commit 9dc79965b21967caebde575f5f5d8bf1aa2c23ab upstream.
+
+This reverts commit 1a738347df2ee4977459a8776fe2c62196bdcb1b.
+
+It caused at least some Kaveri laptops to incorrectly report DisplayPort
+connectors as connected.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97857
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_dp_auxch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c
++++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
+@@ -105,7 +105,7 @@ radeon_dp_aux_transfer_native(struct drm
+
+ tmp &= AUX_HPD_SEL(0x7);
+ tmp |= AUX_HPD_SEL(chan->rec.hpd);
+- tmp |= AUX_EN | AUX_LS_READ_EN | AUX_HPD_DISCON(0x1);
++ tmp |= AUX_EN | AUX_LS_READ_EN;
+
+ WREG32(AUX_CONTROL + aux_offset[instance], tmp);
+
--- /dev/null
+From 2bf7dc8443e113844d078fd6541b7f4aa544f92f Mon Sep 17 00:00:00 2001
+From: Ching Huang <ching2048@areca.com.tw>
+Date: Wed, 19 Oct 2016 17:50:26 +0800
+Subject: scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware
+
+From: Ching Huang <ching2048@areca.com.tw>
+
+commit 2bf7dc8443e113844d078fd6541b7f4aa544f92f upstream.
+
+The arcmsr driver failed to pass SYNCHRONIZE CACHE to controller
+firmware. Depending on how drive caches are handled internally by
+controller firmware this could potentially lead to data integrity
+problems.
+
+Ensure that cache flushes are passed to the controller.
+
+[mkp: applied by hand and removed unused vars]
+
+Signed-off-by: Ching Huang <ching2048@areca.com.tw>
+Reported-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/arcmsr/arcmsr_hba.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -2545,18 +2545,9 @@ static int arcmsr_queue_command_lck(stru
+ struct AdapterControlBlock *acb = (struct AdapterControlBlock *) host->hostdata;
+ struct CommandControlBlock *ccb;
+ int target = cmd->device->id;
+- int lun = cmd->device->lun;
+- uint8_t scsicmd = cmd->cmnd[0];
+ cmd->scsi_done = done;
+ cmd->host_scribble = NULL;
+ cmd->result = 0;
+- if ((scsicmd == SYNCHRONIZE_CACHE) ||(scsicmd == SEND_DIAGNOSTIC)){
+- if(acb->devstate[target][lun] == ARECA_RAID_GONE) {
+- cmd->result = (DID_NO_CONNECT << 16);
+- }
+- cmd->scsi_done(cmd);
+- return 0;
+- }
+ if (target == 16) {
+ /* virtual device for iop message transfer */
+ arcmsr_handle_virtual_command(acb, cmd);
--- /dev/null
+From 1e793f6fc0db920400574211c48f9157a37e3945 Mon Sep 17 00:00:00 2001
+From: Kashyap Desai <kashyap.desai@broadcom.com>
+Date: Fri, 21 Oct 2016 06:33:32 -0700
+Subject: scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices
+
+From: Kashyap Desai <kashyap.desai@broadcom.com>
+
+commit 1e793f6fc0db920400574211c48f9157a37e3945 upstream.
+
+Commit 02b01e010afe ("megaraid_sas: return sync cache call with
+success") modified the driver to successfully complete SYNCHRONIZE_CACHE
+commands without passing them to the controller. Disk drive caches are
+only explicitly managed by controller firmware when operating in RAID
+mode. So this commit effectively disabled writeback cache flushing for
+any drives used in JBOD mode, leading to data integrity failures.
+
+[mkp: clarified patch description]
+
+Fixes: 02b01e010afeeb49328d35650d70721d2ca3fd59
+Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -1688,16 +1688,13 @@ megasas_queue_command(struct Scsi_Host *
+ goto out_done;
+ }
+
+- switch (scmd->cmnd[0]) {
+- case SYNCHRONIZE_CACHE:
+- /*
+- * FW takes care of flush cache on its own
+- * No need to send it down
+- */
++ /*
++ * FW takes care of flush cache on its own for Virtual Disk.
++ * No need to send it down for VD. For JBOD send SYNCHRONIZE_CACHE to FW.
++ */
++ if ((scmd->cmnd[0] == SYNCHRONIZE_CACHE) && MEGASAS_IS_LOGICAL(scmd)) {
+ scmd->result = DID_OK << 16;
+ goto out_done;
+- default:
+- break;
+ }
+
+ if (instance->instancet->build_and_issue_cmd(instance, scmd)) {
--- /dev/null
+From 4d2b496f19f3c2cfaca1e8fa0710688b5ff3811d Mon Sep 17 00:00:00 2001
+From: "Ewan D. Milne" <emilne@redhat.com>
+Date: Wed, 26 Oct 2016 11:22:53 -0400
+Subject: scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded
+
+From: Ewan D. Milne <emilne@redhat.com>
+
+commit 4d2b496f19f3c2cfaca1e8fa0710688b5ff3811d upstream.
+
+map_storep was not being vfree()'d in the module_exit call.
+
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_debug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -4981,6 +4981,7 @@ static void __exit scsi_debug_exit(void)
+ bus_unregister(&pseudo_lld_bus);
+ root_device_unregister(pseudo_primary);
+
++ vfree(map_storep);
+ vfree(dif_storep);
+ vfree(fake_storep);
+ }
input-i8042-add-xmg-c504-to-keyboard-reset-table.patch
firewire-net-guard-against-rx-buffer-overflows.patch
firewire-net-fix-fragmented-datagram_size-off-by-one.patch
+mac80211-discard-multicast-and-4-addr-a-msdus.patch
+scsi-megaraid_sas-fix-data-integrity-failure-for-jbod-passthrough-devices.patch
+scsi-scsi_debug-fix-memory-leak-if-lbp-enabled-and-module-is-unloaded.patch
+scsi-arcmsr-send-synchronize_cache-command-to-firmware.patch
+mmc-dw_mmc-pltfm-fix-the-potential-null-pointer-dereference.patch
+raid10-ignore-discard-error.patch
+revert-drm-radeon-fix-dp-link-training-issue-with-second-4k-monitor.patch
+drm-radeon-si_dpm-limit-clocks-on-hd86xx-part.patch
+drm-radeon-si_dpm-workaround-for-si-kickers.patch
+drm-radeon-drop-register-readback-in-cayman_cp_int_cntl_setup.patch
+drm-fb-helper-fix-connector-ref-leak-on-error.patch
+drm-fb-helper-keep-references-for-the-current-set-of-used-connectors.patch
+drm-dp-mst-check-peer-device-type-before-attempting-edid-read.patch
+drm-i915-clean-up-ddi-ddc-aux-ch-sanitation.patch
+perf-build-fix-traceevent-plugins-build-race.patch