--- /dev/null
+From 55441070ca1cbd47ce1ad2959bbf4b47aed9b83b Mon Sep 17 00:00:00 2001
+From: Glenn Ruben Bakke <glennrubenbakke@nordicsemi.no>
+Date: Fri, 22 Apr 2016 18:06:11 +0200
+Subject: Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address
+
+From: Glenn Ruben Bakke <glennrubenbakke@nordicsemi.no>
+
+commit 55441070ca1cbd47ce1ad2959bbf4b47aed9b83b upstream.
+
+The memcpy of ipv6 header destination address to the skb control block
+(sbk->cb) in header_create() results in currupted memory when bt_xmit()
+is issued. The skb->cb is "released" in the return of header_create()
+making room for lower layer to minipulate the skb->cb.
+
+The value retrieved in bt_xmit is not persistent across header creation
+and sending, and the lower layer will overwrite portions of skb->cb,
+making the copied destination address wrong.
+
+The memory corruption will lead to non-working multicast as the first 4
+bytes of the copied destination address is replaced by a value that
+resolves into a non-multicast prefix.
+
+This fix removes the dependency on the skb control block between header
+creation and send, by moving the destination address memcpy to the send
+function path (setup_create, which is called from bt_xmit).
+
+Signed-off-by: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
+Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ net/bluetooth/6lowpan.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -431,15 +431,18 @@ static int setup_header(struct sk_buff *
+ bdaddr_t *peer_addr, u8 *peer_addr_type)
+ {
+ struct in6_addr ipv6_daddr;
++ struct ipv6hdr *hdr;
+ struct lowpan_dev *dev;
+ struct lowpan_peer *peer;
+ bdaddr_t addr, *any = BDADDR_ANY;
+ u8 *daddr = any->b;
+ int err, status = 0;
+
++ hdr = ipv6_hdr(skb);
++
+ dev = lowpan_dev(netdev);
+
+- memcpy(&ipv6_daddr, &lowpan_cb(skb)->addr, sizeof(ipv6_daddr));
++ memcpy(&ipv6_daddr, &hdr->daddr, sizeof(ipv6_daddr));
+
+ if (ipv6_addr_is_multicast(&ipv6_daddr)) {
+ lowpan_cb(skb)->chan = NULL;
+@@ -489,15 +492,9 @@ static int header_create(struct sk_buff
+ unsigned short type, const void *_daddr,
+ const void *_saddr, unsigned int len)
+ {
+- struct ipv6hdr *hdr;
+-
+ if (type != ETH_P_IPV6)
+ return -EINVAL;
+
+- hdr = ipv6_hdr(skb);
+-
+- memcpy(&lowpan_cb(skb)->addr, &hdr->daddr, sizeof(struct in6_addr));
+-
+ return 0;
+ }
+
--- /dev/null
+From 9d746ab68163d642dae13756b2b3145b2e38cb65 Mon Sep 17 00:00:00 2001
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+Date: Tue, 24 May 2016 18:12:43 +0200
+Subject: drm/amdgpu: Fix hdmi deep color support.
+
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+
+commit 9d746ab68163d642dae13756b2b3145b2e38cb65 upstream.
+
+When porting the hdmi deep color detection code from
+radeon-kms to amdgpu-kms apparently some kind of
+copy and paste error happened, attaching an else
+branch to the wrong if statement.
+
+The result is that hdmi deep color mode is always
+disabled, regardless of gpu and display capabilities and
+user wishes, as the code mistakenly thinks that the display
+doesn't provide the required max_tmds_clock limit and falls
+back to 8 bpc.
+
+This patch fixes deep color support, as tested on a
+R9 380 Tonga Pro + suitable display, and should be
+backported to all kernels with amdgpu-kms support.
+
+Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -194,12 +194,12 @@ int amdgpu_connector_get_monitor_bpc(str
+ bpc = 8;
+ DRM_DEBUG("%s: HDMI deep color 10 bpc exceeds max tmds clock. Using %d bpc.\n",
+ connector->name, bpc);
+- } else if (bpc > 8) {
+- /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */
+- DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n",
+- connector->name);
+- bpc = 8;
+ }
++ } else if (bpc > 8) {
++ /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */
++ DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n",
++ connector->name);
++ bpc = 8;
+ }
+ }
+
--- /dev/null
+From 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 May 2016 10:24:41 -0400
+Subject: drm/amdgpu: use drm_mode_vrefresh() rather than mode->vrefresh
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce upstream.
+
+This is a port of radeon commit:
+3d2d98ee1af0cf6eebfbd6bff4c17d3601ac1284
+drm/radeon: use drm_mode_vrefresh() rather than mode->vrefresh
+to amdgpu.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
+@@ -150,7 +150,7 @@ u32 amdgpu_dpm_get_vrefresh(struct amdgp
+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+ amdgpu_crtc = to_amdgpu_crtc(crtc);
+ if (crtc->enabled && amdgpu_crtc->enabled && amdgpu_crtc->hw_mode.clock) {
+- vrefresh = amdgpu_crtc->hw_mode.vrefresh;
++ vrefresh = drm_mode_vrefresh(&amdgpu_crtc->hw_mode);
+ break;
+ }
+ }
--- /dev/null
+From cpaul@redhat.com Sat Jun 4 13:44:11 2016
+From: Lyude <cpaul@redhat.com>
+Date: Tue, 31 May 2016 12:49:07 -0400
+Subject: drm/atomic: Verify connector->funcs != NULL when clearing states
+To: stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Lyude <cpaul@redhat.com>, David Airlie <airlied@linux.ie>, dri-devel@lists.freedesktop.org (open list:DRM DRIVERS), linux-kernel@vger.kernel.org (open list)
+Message-ID: <1464713347-28982-5-git-send-email-cpaul@redhat.com>
+
+From: Lyude <cpaul@redhat.com>
+
+Unfortunately since we don't have Dave's connector refcounting patch
+here yet, it's very possible that drm_atomic_state_default_clear() could
+get called by intel_display_resume() when
+intel_dp_mst_destroy_connector() isn't completely finished destroying an
+mst connector, but has already finished setting connector->funcs to
+NULL. As such, we need to treat the connector like it's already been
+destroyed and just skip it, otherwise we'll end up dereferencing a NULL
+pointer.
+
+This fix is only required for 4.6 and below. David Airlie's patchseries
+for 4.7 to add connector reference counting provides a more proper fix
+for this.
+
+Changes since v1:
+ - Fix leftover whitespace
+
+Upstream fix: 0552f7651bc2 ("drm/i915/mst: use reference counted
+connectors. (v3)")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Lyude <cpaul@redhat.com>
+---
+ drivers/gpu/drm/drm_atomic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -138,7 +138,7 @@ void drm_atomic_state_default_clear(stru
+ for (i = 0; i < state->num_connector; i++) {
+ struct drm_connector *connector = state->connectors[i];
+
+- if (!connector)
++ if (!connector || !connector->funcs)
+ continue;
+
+ /*
--- /dev/null
+From 255f0e7c418ad95a4baeda017ae6182ba9b3c423 Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Thu, 12 May 2016 10:56:59 -0400
+Subject: drm/fb_helper: Fix references to dev->mode_config.num_connector
+
+From: Lyude <cpaul@redhat.com>
+
+commit 255f0e7c418ad95a4baeda017ae6182ba9b3c423 upstream.
+
+During boot, MST hotplugs are generally expected (even if no physical
+hotplugging occurs) and result in DRM's connector topology changing.
+This means that using num_connector from the current mode configuration
+can lead to the number of connectors changing under us. This can lead to
+some nasty scenarios in fbcon:
+
+- We allocate an array to the size of dev->mode_config.num_connectors.
+- MST hotplug occurs, dev->mode_config.num_connectors gets incremented.
+- We try to loop through each element in the array using the new value
+ of dev->mode_config.num_connectors, and end up going out of bounds
+ since dev->mode_config.num_connectors is now larger then the array we
+ allocated.
+
+fb_helper->connector_count however, will always remain consistent while
+we do a modeset in fb_helper.
+
+Note: This is just polish for 4.7, Dave Airlie's drm_connector
+refcounting fixed these bugs for real. But it's good enough duct-tape
+for stable kernel backporting, since backporting the refcounting
+changes is way too invasive.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+[danvet: Clarify why we need this. Also remove the now unused "dev"
+local variable to appease gcc.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-3-git-send-email-cpaul@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1899,7 +1899,6 @@ static int drm_pick_crtcs(struct drm_fb_
+ int n, int width, int height)
+ {
+ int c, o;
+- struct drm_device *dev = fb_helper->dev;
+ struct drm_connector *connector;
+ const struct drm_connector_helper_funcs *connector_funcs;
+ struct drm_encoder *encoder;
+@@ -1918,7 +1917,7 @@ static int drm_pick_crtcs(struct drm_fb_
+ if (modes[n] == NULL)
+ return best_score;
+
+- crtcs = kzalloc(dev->mode_config.num_connector *
++ crtcs = kzalloc(fb_helper->connector_count *
+ sizeof(struct drm_fb_helper_crtc *), GFP_KERNEL);
+ if (!crtcs)
+ return best_score;
+@@ -1964,7 +1963,7 @@ static int drm_pick_crtcs(struct drm_fb_
+ if (score > best_score) {
+ best_score = score;
+ memcpy(best_crtcs, crtcs,
+- dev->mode_config.num_connector *
++ fb_helper->connector_count *
+ sizeof(struct drm_fb_helper_crtc *));
+ }
+ }
--- /dev/null
+From 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 Mon Sep 17 00:00:00 2001
+From: Itai Handler <itai_handler@hotmail.com>
+Date: Tue, 3 Nov 2015 00:20:56 +0200
+Subject: drm/gma500: Fix possible out of bounds read
+
+From: Itai Handler <itai_handler@hotmail.com>
+
+commit 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 upstream.
+
+Fix possible out of bounds read, by adding missing comma.
+The code may read pass the end of the dsi_errors array
+when the most significant bit (bit #31) in the intr_stat register
+is set.
+This bug has been detected using CppCheck (static analysis tool).
+
+Signed-off-by: Itai Handler <itai_handler@hotmail.com>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c
++++ b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c
+@@ -72,7 +72,7 @@ static const char *const dsi_errors[] =
+ "RX Prot Violation",
+ "HS Generic Write FIFO Full",
+ "LP Generic Write FIFO Full",
+- "Generic Read Data Avail"
++ "Generic Read Data Avail",
+ "Special Packet Sent",
+ "Tearing Effect",
+ };
--- /dev/null
+From 7045c3689f148a0c95f42bae8ef3eb2829ac7de9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Fri, 13 May 2016 17:55:17 +0300
+Subject: drm/i915: Don't leave old junk in ilk active watermarks on readout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 7045c3689f148a0c95f42bae8ef3eb2829ac7de9 upstream.
+
+When we read out the watermark state from the hardware we're supposed to
+transfer that into the active watermarks, but currently we fail to any
+part of the active watermarks that isn't explicitly written. Let's clear
+it all upfront.
+
+Looks like this has been like this since the beginning, when I added the
+readout. No idea why I didn't clear it up.
+
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Fixes: 243e6a44b9ca ("drm/i915: Init HSW watermark tracking in intel_modeset_setup_hw_state()")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463151318-14719-2-git-send-email-ville.syrjala@linux.intel.com
+(cherry picked from commit 15606534bf0a65d8a74a90fd57b8712d147dbca6)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_pm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3812,6 +3812,8 @@ static void ilk_pipe_wm_get_hw_state(str
+ if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+ hw->wm_linetime[pipe] = I915_READ(PIPE_WM_LINETIME(pipe));
+
++ memset(active, 0, sizeof(*active));
++
+ active->pipe_enabled = intel_crtc->active;
+
+ if (active->pipe_enabled) {
--- /dev/null
+From 14a3842a1d5945067d1dd0788f314e14d5b18e5b Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Thu, 12 May 2016 10:56:58 -0400
+Subject: drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config()
+
+From: Lyude <cpaul@redhat.com>
+
+commit 14a3842a1d5945067d1dd0788f314e14d5b18e5b upstream.
+
+During boot time, MST devices usually send a ton of hotplug events
+irregardless of whether or not any physical hotplugs actually occurred.
+Hotplugs mean connectors being created/destroyed, and the number of DRM
+connectors changing under us. This isn't a problem if we use
+fb_helper->connector_count since we only set it once in the code,
+however if we use num_connector from struct drm_mode_config we risk it's
+value changing under us. On top of that, there's even a chance that
+dev->mode_config.num_connector != fb_helper->connector_count. If the
+number of connectors happens to increase under us, we'll end up using
+the wrong array size for memcpy and start writing beyond the actual
+length of the array, occasionally resulting in kernel panics.
+
+Note: This is just polish for 4.7, Dave Airlie's drm_connector
+refcounting fixed these bugs for real. But it's good enough duct-tape
+for stable kernel backporting, since backporting the refcounting
+changes is way too invasive.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+[danvet: Clarify why we need this.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-2-git-send-email-cpaul@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_fbdev.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -368,12 +368,12 @@ static bool intel_fb_initial_config(stru
+ uint64_t conn_configured = 0, mask;
+ int pass = 0;
+
+- save_enabled = kcalloc(dev->mode_config.num_connector, sizeof(bool),
++ save_enabled = kcalloc(fb_helper->connector_count, sizeof(bool),
+ GFP_KERNEL);
+ if (!save_enabled)
+ return false;
+
+- memcpy(save_enabled, enabled, dev->mode_config.num_connector);
++ memcpy(save_enabled, enabled, fb_helper->connector_count);
+ mask = (1 << fb_helper->connector_count) - 1;
+ retry:
+ for (i = 0; i < fb_helper->connector_count; i++) {
+@@ -507,7 +507,7 @@ retry:
+ if (fallback) {
+ bail:
+ DRM_DEBUG_KMS("Not using firmware configuration\n");
+- memcpy(enabled, save_enabled, dev->mode_config.num_connector);
++ memcpy(enabled, save_enabled, fb_helper->connector_count);
+ kfree(save_enabled);
+ return false;
+ }
--- /dev/null
+From a7442b93cf32c1e1ddb721a26cd1f92302e2a222 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 9 Mar 2016 12:52:53 +0100
+Subject: drm/i915: Fix races on fbdev
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit a7442b93cf32c1e1ddb721a26cd1f92302e2a222 upstream.
+
+The ->lastclose callback invokes intel_fbdev_restore_mode() and has
+been witnessed to run before intel_fbdev_initial_config_async()
+has finished.
+
+We might likewise receive hotplug events before we've had a chance to
+fully set up the fbdev.
+
+Fix by waiting for the asynchronous thread to finish.
+
+v2:
+An async_synchronize_full() was also added to intel_fbdev_set_suspend()
+in v1 which turned out to be entirely gratuitous. It caused a deadlock
+on suspend (discovered by CI, thanks to Damien Lespiau and Tomi Sarvela
+for CI support) and was unnecessary since a device is never suspended
+until its ->probe callback (and all asynchronous tasks it scheduled)
+have finished. See dpm_prepare(), which calls wait_for_device_probe(),
+which calls async_synchronize_full().
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93580
+Reported-by: Gustav Fägerlind <gustav.fagerlind@gmail.com>
+Reported-by: "Li, Weinan Z" <weinan.z.li@intel.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20160309115147.67B2B6E0D3@gabe.freedesktop.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_dma.c | 8 +++-----
+ drivers/gpu/drm/i915/intel_fbdev.c | 3 +++
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -437,11 +437,9 @@ static int i915_load_modeset_init(struct
+ * Some ports require correctly set-up hpd registers for detection to
+ * work properly (leading to ghost connected connector status), e.g. VGA
+ * on gm45. Hence we can only set up the initial fbdev config after hpd
+- * irqs are fully enabled. Now we should scan for the initial config
+- * only once hotplug handling is enabled, but due to screwed-up locking
+- * around kms/fbdev init we can't protect the fdbev initial config
+- * scanning against hotplug events. Hence do this first and ignore the
+- * tiny window where we will loose hotplug notifactions.
++ * irqs are fully enabled. We protect the fbdev initial config scanning
++ * against hotplug events by waiting in intel_fbdev_output_poll_changed
++ * until the asynchronous thread has finished.
+ */
+ intel_fbdev_initial_config_async(dev);
+
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -797,6 +797,8 @@ void intel_fbdev_set_suspend(struct drm_
+ void intel_fbdev_output_poll_changed(struct drm_device *dev)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
++
++ async_synchronize_full();
+ if (dev_priv->fbdev)
+ drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper);
+ }
+@@ -808,6 +810,7 @@ void intel_fbdev_restore_mode(struct drm
+ struct intel_fbdev *ifbdev = dev_priv->fbdev;
+ struct drm_fb_helper *fb_helper;
+
++ async_synchronize_full();
+ if (!ifbdev)
+ return;
+
--- /dev/null
+From caed361d83b204b7766924b80463bf7502ee7986 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 9 Mar 2016 19:07:25 +0200
+Subject: drm/i915: Fix watermarks for VLV/CHV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit caed361d83b204b7766924b80463bf7502ee7986 upstream.
+
+commit 92826fcdfc14 ("drm/i915: Calculate watermark related members in the crtc_state, v4.")
+broke thigns by removing the pre vs. post wm update distinction. We also
+lost the pre plane wm update entirely for VLV/CHV from the crtc enable
+path.
+
+This caused underruns on modeset and plane enable/disable on CHV,
+and often those can lead to a dead pipe.
+
+So let's bring back the pre vs. post thing, and let's toss in an
+explicit wm update to valleyview_crtc_enable() to avoid having to
+put it into the common code.
+
+This is more or less a partial revert of the offending commit.
+
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: drm-intel-fixes@lists.freedesktop.org
+Fixes: 92826fcdfc14 ("drm/i915: Calculate watermark related members in the crtc_state, v4.")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1457543247-13987-4-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_atomic.c | 3 ++-
+ drivers/gpu/drm/i915/intel_display.c | 21 +++++++++++++++------
+ drivers/gpu/drm/i915/intel_drv.h | 2 +-
+ 3 files changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_atomic.c
++++ b/drivers/gpu/drm/i915/intel_atomic.c
+@@ -96,7 +96,8 @@ intel_crtc_duplicate_state(struct drm_cr
+ crtc_state->update_pipe = false;
+ crtc_state->disable_lp_wm = false;
+ crtc_state->disable_cxsr = false;
+- crtc_state->wm_changed = false;
++ crtc_state->update_wm_pre = false;
++ crtc_state->update_wm_post = false;
+
+ return &crtc_state->base;
+ }
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4816,7 +4816,7 @@ static void intel_post_plane_update(stru
+
+ crtc->wm.cxsr_allowed = true;
+
+- if (pipe_config->wm_changed && pipe_config->base.active)
++ if (pipe_config->update_wm_post && pipe_config->base.active)
+ intel_update_watermarks(&crtc->base);
+
+ if (atomic->update_fbc)
+@@ -4850,7 +4850,7 @@ static void intel_pre_plane_update(struc
+ intel_set_memory_cxsr(dev_priv, false);
+ }
+
+- if (!needs_modeset(&pipe_config->base) && pipe_config->wm_changed)
++ if (!needs_modeset(&pipe_config->base) && pipe_config->update_wm_pre)
+ intel_update_watermarks(&crtc->base);
+ }
+
+@@ -6229,6 +6229,7 @@ static void valleyview_crtc_enable(struc
+
+ intel_crtc_load_lut(crtc);
+
++ intel_update_watermarks(crtc);
+ intel_enable_pipe(intel_crtc);
+
+ assert_vblank_disabled(crtc);
+@@ -11881,8 +11882,14 @@ int intel_plane_atomic_calc_changes(stru
+ plane->base.id, was_visible, visible,
+ turn_off, turn_on, mode_changed);
+
+- if (turn_on || turn_off) {
+- pipe_config->wm_changed = true;
++ if (turn_on) {
++ pipe_config->update_wm_pre = true;
++
++ /* must disable cxsr around plane enable/disable */
++ if (plane->type != DRM_PLANE_TYPE_CURSOR)
++ pipe_config->disable_cxsr = true;
++ } else if (turn_off) {
++ pipe_config->update_wm_post = true;
+
+ /* must disable cxsr around plane enable/disable */
+ if (plane->type != DRM_PLANE_TYPE_CURSOR) {
+@@ -11891,7 +11898,9 @@ int intel_plane_atomic_calc_changes(stru
+ pipe_config->disable_cxsr = true;
+ }
+ } else if (intel_wm_need_update(plane, plane_state)) {
+- pipe_config->wm_changed = true;
++ /* FIXME bollocks */
++ pipe_config->update_wm_pre = true;
++ pipe_config->update_wm_post = true;
+ }
+
+ if (visible || was_visible)
+@@ -12036,7 +12045,7 @@ static int intel_crtc_atomic_check(struc
+ }
+
+ if (mode_changed && !crtc_state->active)
+- pipe_config->wm_changed = true;
++ pipe_config->update_wm_post = true;
+
+ if (mode_changed && crtc_state->enable &&
+ dev_priv->display.crtc_compute_clock &&
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -367,7 +367,7 @@ struct intel_crtc_state {
+
+ bool update_pipe; /* can a fast modeset be performed? */
+ bool disable_cxsr;
+- bool wm_changed; /* watermarks are updated */
++ bool update_wm_pre, update_wm_post; /* watermarks are updated */
+
+ /* Pipe source size (ie. panel fitter input size)
+ * All planes will be positioned inside this space,
--- /dev/null
+From 03b7b5f983091bca17e9c163832fcde56971d7d1 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed, 18 May 2016 18:47:11 +0200
+Subject: drm/i915/psr: Try to program link training times correctly
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 03b7b5f983091bca17e9c163832fcde56971d7d1 upstream.
+
+The default of 0 is 500us of link training, but that's not enough for
+some platforms. Decoding this correctly means we're using 2.5ms of
+link training on these platforms, which fixes flickering issues
+associated with enabling PSR.
+
+v2: Unbotch the math a bit.
+
+v3: Drop debug hunk.
+
+v4: Improve commit message.
+
+Tested-by: Lyude <cpaul@redhat.com>
+Cc: Lyude <cpaul@redhat.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=95176
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Sonika Jindal <sonika.jindal@intel.com>
+Cc: Durgadoss R <durgadoss.r@intel.com>
+Cc: "Pandiyan, Dhinakaran" <dhinakaran.pandiyan@intel.com>
+Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Tested-by: fritsch@kodi.tv
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463590036-17824-2-git-send-email-daniel.vetter@ffwll.ch
+(cherry picked from commit 50db139018f9c94376d5f4db94a3bae65fdfac14)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_psr.c | 57 ++++++++++++++++++++++++++++++++-------
+ 1 file changed, 48 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_psr.c
++++ b/drivers/gpu/drm/i915/intel_psr.c
+@@ -275,19 +275,58 @@ static void hsw_psr_enable_source(struct
+ * with the 5 or 6 idle patterns.
+ */
+ uint32_t idle_frames = max(6, dev_priv->vbt.psr.idle_frames);
+- uint32_t val = 0x0;
++ uint32_t val = EDP_PSR_ENABLE;
++
++ val |= max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT;
++ val |= idle_frames << EDP_PSR_IDLE_FRAME_SHIFT;
+
+ if (IS_HASWELL(dev))
+ val |= EDP_PSR_MIN_LINK_ENTRY_TIME_8_LINES;
+
+- I915_WRITE(EDP_PSR_CTL, val |
+- max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT |
+- idle_frames << EDP_PSR_IDLE_FRAME_SHIFT |
+- EDP_PSR_ENABLE);
+-
+- if (dev_priv->psr.psr2_support)
+- I915_WRITE(EDP_PSR2_CTL, EDP_PSR2_ENABLE |
+- EDP_SU_TRACK_ENABLE | EDP_PSR2_TP2_TIME_100);
++ if (dev_priv->vbt.psr.tp1_wakeup_time > 5)
++ val |= EDP_PSR_TP1_TIME_2500us;
++ else if (dev_priv->vbt.psr.tp1_wakeup_time > 1)
++ val |= EDP_PSR_TP1_TIME_500us;
++ else if (dev_priv->vbt.psr.tp1_wakeup_time > 0)
++ val |= EDP_PSR_TP1_TIME_100us;
++ else
++ val |= EDP_PSR_TP1_TIME_0us;
++
++ if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 5)
++ val |= EDP_PSR_TP2_TP3_TIME_2500us;
++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 1)
++ val |= EDP_PSR_TP2_TP3_TIME_500us;
++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 0)
++ val |= EDP_PSR_TP2_TP3_TIME_100us;
++ else
++ val |= EDP_PSR_TP2_TP3_TIME_0us;
++
++ if (intel_dp_source_supports_hbr2(intel_dp) &&
++ drm_dp_tps3_supported(intel_dp->dpcd))
++ val |= EDP_PSR_TP1_TP3_SEL;
++ else
++ val |= EDP_PSR_TP1_TP2_SEL;
++
++ I915_WRITE(EDP_PSR_CTL, val);
++
++ if (!dev_priv->psr.psr2_support)
++ return;
++
++ /* FIXME: selective update is probably totally broken because it doesn't
++ * mesh at all with our frontbuffer tracking. And the hw alone isn't
++ * good enough. */
++ val = EDP_PSR2_ENABLE | EDP_SU_TRACK_ENABLE;
++
++ if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 5)
++ val |= EDP_PSR2_TP2_TIME_2500;
++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 1)
++ val |= EDP_PSR2_TP2_TIME_500;
++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 0)
++ val |= EDP_PSR2_TP2_TIME_100;
++ else
++ val |= EDP_PSR2_TP2_TIME_50;
++
++ I915_WRITE(EDP_PSR2_CTL, val);
+ }
+
+ static bool intel_psr_match_conditions(struct intel_dp *intel_dp)
--- /dev/null
+From 310944d148e3600dcff8b346bee7fa01d34903b1 Mon Sep 17 00:00:00 2001
+From: Philipp Zabel <p.zabel@pengutronix.de>
+Date: Thu, 12 May 2016 15:00:44 +0200
+Subject: drm/imx: Match imx-ipuv3-crtc components using device node in platform data
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+commit 310944d148e3600dcff8b346bee7fa01d34903b1 upstream.
+
+The component master driver imx-drm-core matches component devices using
+their of_node. Since commit 950b410dd1ab ("gpu: ipu-v3: Fix imx-ipuv3-crtc
+module autoloading"), the imx-ipuv3-crtc dev->of_node is not set during
+probing. Before that, of_node was set and caused an of: modalias to be
+used instead of the platform: modalias, which broke module autoloading.
+
+On the other hand, if dev->of_node is not set yet when the imx-ipuv3-crtc
+probe function calls component_add, component matching in imx-drm-core
+fails. While dev->of_node will be set once the next component tries to
+bring up the component master, imx-drm-core component binding will never
+succeed if one of the crtc devices is probed last.
+
+Add of_node to the component platform data and match against the
+pdata->of_node instead of dev->of_node in imx-drm-core to work around
+this problem.
+
+Fixes: 950b410dd1ab ("gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading")
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Tested-by: Fabio Estevam <fabio.estevam@nxp.com>
+Tested-by: Lothar Waßmann <LW@KARO-electronics.de>
+Tested-by: Heiko Schocher <hs@denx.de>
+Tested-by: Chris Ruehl <chris.ruehl@gtsys.com.hk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/imx/imx-drm-core.c | 8 ++++++++
+ drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +-
+ drivers/gpu/ipu-v3/ipu-common.c | 5 +++--
+ include/video/imx-ipu-v3.h | 2 ++
+ 4 files changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/imx/imx-drm-core.c
++++ b/drivers/gpu/drm/imx/imx-drm-core.c
+@@ -26,6 +26,7 @@
+ #include <drm/drm_fb_cma_helper.h>
+ #include <drm/drm_plane_helper.h>
+ #include <drm/drm_of.h>
++#include <video/imx-ipu-v3.h>
+
+ #include "imx-drm.h"
+
+@@ -498,6 +499,13 @@ static int compare_of(struct device *dev
+ {
+ struct device_node *np = data;
+
++ /* Special case for DI, dev->of_node may not be set yet */
++ if (strcmp(dev->driver->name, "imx-ipuv3-crtc") == 0) {
++ struct ipu_client_platformdata *pdata = dev->platform_data;
++
++ return pdata->of_node == np;
++ }
++
+ /* Special case for LDB, one device for two channels */
+ if (of_node_cmp(np->name, "lvds-channel") == 0) {
+ np = of_get_parent(np);
+--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
+@@ -371,7 +371,7 @@ static int ipu_crtc_init(struct ipu_crtc
+
+ ret = imx_drm_add_crtc(drm, &ipu_crtc->base, &ipu_crtc->imx_crtc,
+ &ipu_crtc->plane[0]->base, &ipu_crtc_helper_funcs,
+- ipu_crtc->dev->of_node);
++ pdata->of_node);
+ if (ret) {
+ dev_err(ipu_crtc->dev, "adding crtc failed with %d.\n", ret);
+ goto err_put_resources;
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -997,7 +997,7 @@ struct ipu_platform_reg {
+ };
+
+ /* These must be in the order of the corresponding device tree port nodes */
+-static const struct ipu_platform_reg client_reg[] = {
++static struct ipu_platform_reg client_reg[] = {
+ {
+ .pdata = {
+ .csi = 0,
+@@ -1048,7 +1048,7 @@ static int ipu_add_client_devices(struct
+ mutex_unlock(&ipu_client_id_mutex);
+
+ for (i = 0; i < ARRAY_SIZE(client_reg); i++) {
+- const struct ipu_platform_reg *reg = &client_reg[i];
++ struct ipu_platform_reg *reg = &client_reg[i];
+ struct platform_device *pdev;
+ struct device_node *of_node;
+
+@@ -1070,6 +1070,7 @@ static int ipu_add_client_devices(struct
+
+ pdev->dev.parent = dev;
+
++ reg->pdata.of_node = of_node;
+ ret = platform_device_add_data(pdev, ®->pdata,
+ sizeof(reg->pdata));
+ if (!ret)
+--- a/include/video/imx-ipu-v3.h
++++ b/include/video/imx-ipu-v3.h
+@@ -16,6 +16,7 @@
+ #include <linux/videodev2.h>
+ #include <linux/bitmap.h>
+ #include <linux/fb.h>
++#include <linux/of.h>
+ #include <media/v4l2-mediabus.h>
+ #include <video/videomode.h>
+
+@@ -344,6 +345,7 @@ struct ipu_client_platformdata {
+ int dc;
+ int dp;
+ int dma[2];
++ struct device_node *of_node;
+ };
+
+ #endif /* __DRM_IPU_H__ */
--- /dev/null
+From 1883598d4201361a6d2ce785095695f58071ee11 Mon Sep 17 00:00:00 2001
+From: Charmaine Lee <charmainel@vmware.com>
+Date: Tue, 12 Apr 2016 08:14:23 -0700
+Subject: drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION
+
+From: Charmaine Lee <charmainel@vmware.com>
+
+commit 1883598d4201361a6d2ce785095695f58071ee11 upstream.
+
+Fixes piglit tests nv_conditional_render-* crashes.
+
+Signed-off-by: Charmaine Lee <charmainel@vmware.com>
+Reviewed-by: Brian Paul <brianp@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -3285,7 +3285,7 @@ static const struct vmw_cmd_entry vmw_cm
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_READBACK_QUERY, &vmw_cmd_invalid,
+ true, false, true),
+- VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_PREDICATION, &vmw_cmd_invalid,
++ VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_PREDICATION, &vmw_cmd_dx_cid_check,
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_VIEWPORTS, &vmw_cmd_dx_cid_check,
+ true, false, true),
--- /dev/null
+From 7851496a32319237456919575e5f4ba62f74cc7d Mon Sep 17 00:00:00 2001
+From: Sinclair Yeh <syeh@vmware.com>
+Date: Thu, 21 Apr 2016 11:29:31 -0700
+Subject: drm/vmwgfx: Fix order of operation
+
+From: Sinclair Yeh <syeh@vmware.com>
+
+commit 7851496a32319237456919575e5f4ba62f74cc7d upstream.
+
+mode->hdisplay * (var->bits_per_pixel + 7) gets evaluated before
+the division, potentially making the pitch larger than it should
+be.
+
+Since the original intention is to do a div-round-up, just use
+the macro instead.
+
+Signed-off-by: Sinclair Yeh <syeh@vmware.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -573,9 +573,9 @@ static int vmw_fb_set_par(struct fb_info
+ mode = old_mode;
+ old_mode = NULL;
+ } else if (!vmw_kms_validate_mode_vram(vmw_priv,
+- mode->hdisplay *
+- (var->bits_per_pixel + 7) / 8,
+- mode->vdisplay)) {
++ mode->hdisplay *
++ DIV_ROUND_UP(var->bits_per_pixel, 8),
++ mode->vdisplay)) {
+ drm_mode_destroy(vmw_priv->dev, mode);
+ return -EINVAL;
+ }
--- /dev/null
+From e02e58843153ce80a9fe7588def89b2638d40e64 Mon Sep 17 00:00:00 2001
+From: Charmaine Lee <charmainel@vmware.com>
+Date: Tue, 12 Apr 2016 08:19:08 -0700
+Subject: drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands.
+
+From: Charmaine Lee <charmainel@vmware.com>
+
+commit e02e58843153ce80a9fe7588def89b2638d40e64 upstream.
+
+Instead of calling vmw_cmd_ok, call vmw_cmd_dx_cid_check to
+validate the context id for query commands.
+
+Signed-off-by: Charmaine Lee <charmainel@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -3273,15 +3273,15 @@ static const struct vmw_cmd_entry vmw_cm
+ &vmw_cmd_dx_cid_check, true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_DEFINE_QUERY, &vmw_cmd_dx_define_query,
+ true, false, true),
+- VMW_CMD_DEF(SVGA_3D_CMD_DX_DESTROY_QUERY, &vmw_cmd_ok,
++ VMW_CMD_DEF(SVGA_3D_CMD_DX_DESTROY_QUERY, &vmw_cmd_dx_cid_check,
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_BIND_QUERY, &vmw_cmd_dx_bind_query,
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_QUERY_OFFSET,
+- &vmw_cmd_ok, true, false, true),
+- VMW_CMD_DEF(SVGA_3D_CMD_DX_BEGIN_QUERY, &vmw_cmd_ok,
++ &vmw_cmd_dx_cid_check, true, false, true),
++ VMW_CMD_DEF(SVGA_3D_CMD_DX_BEGIN_QUERY, &vmw_cmd_dx_cid_check,
+ true, false, true),
+- VMW_CMD_DEF(SVGA_3D_CMD_DX_END_QUERY, &vmw_cmd_ok,
++ VMW_CMD_DEF(SVGA_3D_CMD_DX_END_QUERY, &vmw_cmd_dx_cid_check,
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_READBACK_QUERY, &vmw_cmd_invalid,
+ true, false, true),
xen-events-don-t-move-disabled-irqs.patch
xen-use-same-main-loop-for-counting-and-remapping-pages.patch
sunrpc-fix-stripping-of-padded-mic-tokens.patch
+drm-gma500-fix-possible-out-of-bounds-read.patch
+drm-vmwgfx-enable-svga_3d_cmd_dx_set_predication.patch
+drm-vmwgfx-use-vmw_cmd_dx_cid_check-for-query-commands.patch
+drm-vmwgfx-fix-order-of-operation.patch
+drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch
+drm-amdgpu-fix-hdmi-deep-color-support.patch
+drm-i915-fix-races-on-fbdev.patch
+drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch
+drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch
+drm-atomic-verify-connector-funcs-null-when-clearing-states.patch
+bluetooth-6lowpan-fix-memory-corruption-of-ipv6-destination-address.patch
+drm-i915-psr-try-to-program-link-training-times-correctly.patch
+drm-i915-don-t-leave-old-junk-in-ilk-active-watermarks-on-readout.patch
+drm-i915-fix-watermarks-for-vlv-chv.patch
+drm-imx-match-imx-ipuv3-crtc-components-using-device-node-in-platform-data.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
