--- /dev/null
+From 93fce954427effee89e44a976299b15dd75b4bbc Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 11 Mar 2016 10:51:51 +0300
+Subject: drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 93fce954427effee89e44a976299b15dd75b4bbc upstream.
+
+At the end of the function we expect "status" to be zero, but it's
+either -EINVAL or uninitialized.
+
+Fixes: 788bf83db301 ('drm/amdkfd: Add wave control operation to debugger')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c
+@@ -513,7 +513,7 @@ static int dbgdev_wave_control_set_regis
+ union SQ_CMD_BITS *in_reg_sq_cmd,
+ union GRBM_GFX_INDEX_BITS *in_reg_gfx_index)
+ {
+- int status;
++ int status = 0;
+ union SQ_CMD_BITS reg_sq_cmd;
+ union GRBM_GFX_INDEX_BITS reg_gfx_index;
+ struct HsaDbgWaveMsgAMDGen2 *pMsg;
--- /dev/null
+From 263efde31f97c498e1ebad30e4d2906609d7ad6b Mon Sep 17 00:00:00 2001
+From: "cpaul@redhat.com" <cpaul@redhat.com>
+Date: Fri, 22 Apr 2016 16:08:46 -0400
+Subject: drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
+
+From: cpaul@redhat.com <cpaul@redhat.com>
+
+commit 263efde31f97c498e1ebad30e4d2906609d7ad6b upstream.
+
+We can thank KASAN for finding this, otherwise I probably would have spent
+hours on it. This fixes a somewhat harder to trigger kernel panic, occuring
+while enabling MST where the port we were currently updating the payload on
+would have all of it's refs dropped before we finished what we were doing:
+
+==================================================================
+BUG: KASAN: use-after-free in drm_dp_update_payload_part1+0xb3f/0xdb0 [drm_kms_helper] at addr ffff8800d29de018
+Read of size 4 by task Xorg/973
+=============================================================================
+BUG kmalloc-2048 (Tainted: G B W ): kasan: bad access detected
+-----------------------------------------------------------------------------
+
+INFO: Allocated in drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] age=16477 cpu=0 pid=2175
+ ___slab_alloc+0x472/0x490
+ __slab_alloc+0x20/0x40
+ kmem_cache_alloc_trace+0x151/0x190
+ drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper]
+ drm_dp_send_link_address+0x526/0x960 [drm_kms_helper]
+ drm_dp_check_and_send_link_address+0x1ac/0x210 [drm_kms_helper]
+ drm_dp_mst_link_probe_work+0x77/0xd0 [drm_kms_helper]
+ process_one_work+0x562/0x1350
+ worker_thread+0xd9/0x1390
+ kthread+0x1c5/0x260
+ ret_from_fork+0x22/0x40
+INFO: Freed in drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] age=7521 cpu=0 pid=2175
+ __slab_free+0x17f/0x2d0
+ kfree+0x169/0x180
+ drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper]
+ drm_dp_destroy_connector_work+0x2b8/0x490 [drm_kms_helper]
+ process_one_work+0x562/0x1350
+ worker_thread+0xd9/0x1390
+ kthread+0x1c5/0x260
+ ret_from_fork+0x22/0x40
+
+which on this T460s, would eventually lead to kernel panics in somewhat
+random places later in intel_mst_enable_dp() if we got lucky enough.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1786,6 +1786,11 @@ int drm_dp_update_payload_part1(struct d
+ req_payload.start_slot = cur_slots;
+ if (mgr->proposed_vcpis[i]) {
+ port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi);
++ port = drm_dp_get_validated_port_ref(mgr, port);
++ if (!port) {
++ mutex_unlock(&mgr->payload_lock);
++ return -EINVAL;
++ }
+ req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots;
+ } else {
+ port = NULL;
+@@ -1811,6 +1816,9 @@ int drm_dp_update_payload_part1(struct d
+ mgr->payloads[i].payload_state = req_payload.payload_state;
+ }
+ cur_slots += req_payload.num_slots;
++
++ if (port)
++ drm_dp_put_port(port);
+ }
+
+ for (i = 0; i < mgr->max_payloads; i++) {
--- /dev/null
+From 9dc0487d96a0396367a1451b31873482080b527f Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Wed, 13 Apr 2016 16:50:18 -0400
+Subject: drm/dp/mst: Restore primary hub guid on resume
+
+From: Lyude <cpaul@redhat.com>
+
+commit 9dc0487d96a0396367a1451b31873482080b527f upstream.
+
+Some hubs are forgetful, and end up forgetting whatever GUID we set
+previously after we do a suspend/resume cycle. This can lead to
+hotplugging breaking (along with probably other things) since the hub
+will start sending connection notifications with the wrong GUID. As
+such, we need to check on resume whether or not the GUID the hub is
+giving us is valid.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1460580618-7421-1-git-send-email-cpaul@redhat.com
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2116,6 +2116,8 @@ int drm_dp_mst_topology_mgr_resume(struc
+
+ if (mgr->mst_primary) {
+ int sret;
++ u8 guid[16];
++
+ sret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, mgr->dpcd, DP_RECEIVER_CAP_SIZE);
+ if (sret != DP_RECEIVER_CAP_SIZE) {
+ DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
+@@ -2130,6 +2132,16 @@ int drm_dp_mst_topology_mgr_resume(struc
+ ret = -1;
+ goto out_unlock;
+ }
++
++ /* Some hubs forget their guids after they resume */
++ sret = drm_dp_dpcd_read(mgr->aux, DP_GUID, guid, 16);
++ if (sret != 16) {
++ DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
++ ret = -1;
++ goto out_unlock;
++ }
++ drm_dp_check_mstb_guid(mgr->mst_primary, guid);
++
+ ret = 0;
+ } else
+ ret = -1;
--- /dev/null
+From deba0a2af9592b2022a0bce7b085a318b53ce1db Mon Sep 17 00:00:00 2001
+From: "cpaul@redhat.com" <cpaul@redhat.com>
+Date: Mon, 4 Apr 2016 19:58:47 -0400
+Subject: drm/dp/mst: Validate port in drm_dp_payload_send_msg()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: cpaul@redhat.com <cpaul@redhat.com>
+
+commit deba0a2af9592b2022a0bce7b085a318b53ce1db upstream.
+
+With the joys of things running concurrently, there's always a chance
+that the port we get passed in drm_dp_payload_send_msg() isn't actually
+valid anymore. Because of this, we need to make sure we validate the
+reference to the port before we use it otherwise we risk running into
+various race conditions. For instance, on the Dell MST monitor I have
+here for testing, hotplugging it enough times causes us to kernel panic:
+
+[drm:intel_mst_enable_dp] 1
+[drm:drm_dp_update_payload_part2] payload 0 1
+[drm:intel_get_hpd_pins] hotplug event received, stat 0x00200000, dig 0x10101011, pins 0x00000020
+[drm:intel_hpd_irq_handler] digital hpd port B - short
+[drm:intel_dp_hpd_pulse] got hpd irq on port B - short
+[drm:intel_dp_check_mst_status] got esi 00 10 00
+[drm:drm_dp_update_payload_part2] payload 1 1
+general protection fault: 0000 [#1] SMP
+…
+Call Trace:
+ [<ffffffffa012b632>] drm_dp_update_payload_part2+0xc2/0x130 [drm_kms_helper]
+ [<ffffffffa032ef08>] intel_mst_enable_dp+0xf8/0x180 [i915]
+ [<ffffffffa0310dbd>] haswell_crtc_enable+0x3ed/0x8c0 [i915]
+ [<ffffffffa030c84d>] intel_atomic_commit+0x5ad/0x1590 [i915]
+ [<ffffffffa01db877>] ? drm_atomic_set_crtc_for_connector+0x57/0xe0 [drm]
+ [<ffffffffa01dc4e7>] drm_atomic_commit+0x37/0x60 [drm]
+ [<ffffffffa0130a3a>] drm_atomic_helper_set_config+0x7a/0xb0 [drm_kms_helper]
+ [<ffffffffa01cc482>] drm_mode_set_config_internal+0x62/0x100 [drm]
+ [<ffffffffa01d02ad>] drm_mode_setcrtc+0x3cd/0x4e0 [drm]
+ [<ffffffffa01c18e3>] drm_ioctl+0x143/0x510 [drm]
+ [<ffffffffa01cfee0>] ? drm_mode_setplane+0x1b0/0x1b0 [drm]
+ [<ffffffff810f79a7>] ? hrtimer_start_range_ns+0x1b7/0x3a0
+ [<ffffffff81212962>] do_vfs_ioctl+0x92/0x570
+ [<ffffffff81590852>] ? __sys_recvmsg+0x42/0x80
+ [<ffffffff81212eb9>] SyS_ioctl+0x79/0x90
+ [<ffffffff816b4e32>] entry_SYSCALL_64_fastpath+0x1a/0xa4
+RIP [<ffffffffa012b026>] drm_dp_payload_send_msg+0x146/0x1f0 [drm_kms_helper]
+
+Which occurs because of the hotplug event shown in the log, which ends
+up causing DRM's dp helpers to drop the port we're updating the payload
+on and panic.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+Reviewed-by: David Airlie <airlied@linux.ie>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1665,13 +1665,19 @@ static int drm_dp_payload_send_msg(struc
+ struct drm_dp_mst_branch *mstb;
+ int len, ret, port_num;
+
++ port = drm_dp_get_validated_port_ref(mgr, port);
++ if (!port)
++ return -EINVAL;
++
+ port_num = port->port_num;
+ mstb = drm_dp_get_validated_mstb_ref(mgr, port->parent);
+ if (!mstb) {
+ mstb = drm_dp_get_last_connected_port_and_mstb(mgr, port->parent, &port_num);
+
+- if (!mstb)
++ if (!mstb) {
++ drm_dp_put_port(port);
+ return -EINVAL;
++ }
+ }
+
+ txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
+@@ -1697,6 +1703,7 @@ static int drm_dp_payload_send_msg(struc
+ kfree(txmsg);
+ fail_put:
+ drm_dp_put_mst_branch_device(mstb);
++ drm_dp_put_port(port);
+ return ret;
+ }
+
--- /dev/null
+From 7d3fdfff23852fe458a0d0979a3555fe60f1e563 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 11 Jan 2016 20:48:32 +0200
+Subject: drm/i915: Cleanup phys status page too
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 7d3fdfff23852fe458a0d0979a3555fe60f1e563 upstream.
+
+Restore the lost phys status page cleanup.
+
+Fixes the following splat with DMA_API_DEBUG=y:
+
+WARNING: CPU: 0 PID: 21615 at ../lib/dma-debug.c:974 dma_debug_device_change+0x190/0x1f0()
+pci 0000:00:02.0: DMA-API: device driver has pending DMA allocations while released from device [count=1]
+ One of leaked entries details: [device address=0x0000000023163000] [size=4096 bytes] [mapped with DMA_BIDIRECTIONAL] [mapped as coherent]
+Modules linked in: i915(-) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm sha256_generic hmac drbg ctr ccm sch_fq_codel binfmt_misc joydev mousedev arc4 ath5k iTCO_wdt mac80211 smsc_ircc2 ath snd_intel8x0m snd_intel8x0 snd_ac97_codec ac97_bus psmouse snd_pcm input_leds i2c_i801 pcspkr snd_timer cfg80211 snd soundcore i2c_core ehci_pci firewire_ohci ehci_hcd firewire_core lpc_ich 8139too rfkill crc_itu_t mfd_core mii usbcore rng_core intel_agp intel_gtt usb_common agpgart irda crc_ccitt fujitsu_laptop led_class parport_pc video parport evdev backlight
+CPU: 0 PID: 21615 Comm: rmmod Tainted: G U 4.4.0-rc4-mgm-ovl+ #4
+Hardware name: FUJITSU SIEMENS LIFEBOOK S6120/FJNB16C, BIOS Version 1.26 05/10/2004
+ e31a3de0 e31a3de0 e31a3d9c c128d4bd e31a3dd0 c1045a0c c15e00c4 e31a3dfc
+ 0000546f c15dfad2 000003ce c12b3740 000003ce c12b3740 00000000 00000001
+ f61fb8a0 e31a3de8 c1045a83 00000009 e31a3de0 c15e00c4 e31a3dfc e31a3e4c
+Call Trace:
+ [<c128d4bd>] dump_stack+0x16/0x19
+ [<c1045a0c>] warn_slowpath_common+0x8c/0xd0
+ [<c12b3740>] ? dma_debug_device_change+0x190/0x1f0
+ [<c12b3740>] ? dma_debug_device_change+0x190/0x1f0
+ [<c1045a83>] warn_slowpath_fmt+0x33/0x40
+ [<c12b3740>] dma_debug_device_change+0x190/0x1f0
+ [<c1065499>] notifier_call_chain+0x59/0x70
+ [<c10655af>] __blocking_notifier_call_chain+0x3f/0x80
+ [<c106560f>] blocking_notifier_call_chain+0x1f/0x30
+ [<c134cfb3>] __device_release_driver+0xc3/0xf0
+ [<c134d0d7>] driver_detach+0x97/0xa0
+ [<c134c440>] bus_remove_driver+0x40/0x90
+ [<c134db18>] driver_unregister+0x28/0x60
+ [<c1079e8c>] ? trace_hardirqs_on_caller+0x12c/0x1d0
+ [<c12c0618>] pci_unregister_driver+0x18/0x80
+ [<f83e96e7>] drm_pci_exit+0x87/0xb0 [drm]
+ [<f8b3be2d>] i915_exit+0x1b/0x1ee [i915]
+ [<c10b999c>] SyS_delete_module+0x14c/0x210
+ [<c1079e8c>] ? trace_hardirqs_on_caller+0x12c/0x1d0
+ [<c115a9bd>] ? ____fput+0xd/0x10
+ [<c1002014>] do_fast_syscall_32+0xa4/0x450
+ [<c149f6fa>] sysenter_past_esp+0x3b/0x5d
+---[ end trace c2ecbc77760f10a0 ]---
+Mapped at:
+ [<c12b3183>] debug_dma_alloc_coherent+0x33/0x90
+ [<f83e989c>] drm_pci_alloc+0x18c/0x1e0 [drm]
+ [<f8acd59f>] intel_init_ring_buffer+0x2af/0x490 [i915]
+ [<f8acd8b0>] intel_init_render_ring_buffer+0x130/0x750 [i915]
+ [<f8aaea4e>] i915_gem_init_rings+0x1e/0x110 [i915]
+
+v2: s/BUG_ON/WARN_ON/ since dim doens't like the former anymore
+
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Fixes: 5c6c600 ("drm/i915: Remove DRI1 ring accessors and API")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> (v1)
+Link: http://patchwork.freedesktop.org/patch/msgid/1452538112-5331-1-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -1922,6 +1922,17 @@ i915_dispatch_execbuffer(struct drm_i915
+ return 0;
+ }
+
++static void cleanup_phys_status_page(struct intel_engine_cs *ring)
++{
++ struct drm_i915_private *dev_priv = to_i915(ring->dev);
++
++ if (!dev_priv->status_page_dmah)
++ return;
++
++ drm_pci_free(ring->dev, dev_priv->status_page_dmah);
++ ring->status_page.page_addr = NULL;
++}
++
+ static void cleanup_status_page(struct intel_engine_cs *ring)
+ {
+ struct drm_i915_gem_object *obj;
+@@ -1938,9 +1949,9 @@ static void cleanup_status_page(struct i
+
+ static int init_status_page(struct intel_engine_cs *ring)
+ {
+- struct drm_i915_gem_object *obj;
++ struct drm_i915_gem_object *obj = ring->status_page.obj;
+
+- if ((obj = ring->status_page.obj) == NULL) {
++ if (obj == NULL) {
+ unsigned flags;
+ int ret;
+
+@@ -2134,7 +2145,7 @@ static int intel_init_ring_buffer(struct
+ if (ret)
+ goto error;
+ } else {
+- BUG_ON(ring->id != RCS);
++ WARN_ON(ring->id != RCS);
+ ret = init_phys_status_page(ring);
+ if (ret)
+ goto error;
+@@ -2179,7 +2190,12 @@ void intel_cleanup_ring_buffer(struct in
+ if (ring->cleanup)
+ ring->cleanup(ring);
+
+- cleanup_status_page(ring);
++ if (I915_NEED_GFX_HWS(ring->dev)) {
++ cleanup_status_page(ring);
++ } else {
++ WARN_ON(ring->id != RCS);
++ cleanup_phys_status_page(ring);
++ }
+
+ i915_cmd_parser_fini_ring(ring);
+ i915_gem_batch_pool_fini(&ring->batch_pool);
--- /dev/null
+From d43f3ebf12f59c57782ec652da65ef61c2662b40 Mon Sep 17 00:00:00 2001
+From: Akash Goel <akash.goel@intel.com>
+Date: Fri, 11 Mar 2016 14:56:42 +0530
+Subject: drm/i915: Fixup the free space logic in ring_prepare
+
+From: Akash Goel <akash.goel@intel.com>
+
+commit d43f3ebf12f59c57782ec652da65ef61c2662b40 upstream.
+
+Currently for the case where there is enough space at the end of Ring
+buffer for accommodating only the base request, the wrapround is done
+immediately and as a result the base request gets added at the start
+of Ring buffer. But there may not be enough free space at the beginning
+to accommodate the base request, as before the wraparound, the wait was
+effectively done for the reserved_size free space from the start of
+Ring buffer. In such a case there is a potential of Ring buffer overflow,
+the instructions at the head of Ring (ACTHD) can get overwritten.
+
+Since the base request can fit in the remaining space, there is no need
+to wraparound immediately. The wraparound will anyway happen later when
+the reserved part starts getting used.
+
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Akash Goel <akash.goel@intel.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: http://patchwork.freedesktop.org/patch/msgid/1457688402-10411-1-git-send-email-akash.goel@intel.com
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+(cherry picked from commit 782f6bc0aba037436d6a04d19b23f8b61020a576)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_lrc.c | 6 +++---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -776,11 +776,11 @@ static int logical_ring_prepare(struct d
+ if (unlikely(total_bytes > remain_usable)) {
+ /*
+ * The base request will fit but the reserved space
+- * falls off the end. So only need to to wait for the
+- * reserved size after flushing out the remainder.
++ * falls off the end. So don't need an immediate wrap
++ * and only need to effectively wait for the reserved
++ * size space from the start of ringbuffer.
+ */
+ wait_bytes = remain_actual + ringbuf->reserved_size;
+- need_wrap = true;
+ } else if (total_bytes > ringbuf->space) {
+ /* No wrapping required, just waiting. */
+ wait_bytes = total_bytes;
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -2357,11 +2357,11 @@ static int __intel_ring_prepare(struct i
+ if (unlikely(total_bytes > remain_usable)) {
+ /*
+ * The base request will fit but the reserved space
+- * falls off the end. So only need to to wait for the
+- * reserved size after flushing out the remainder.
++ * falls off the end. So don't need an immediate wrap
++ * and only need to effectively wait for the reserved
++ * size space from the start of ringbuffer.
+ */
+ wait_bytes = remain_actual + ringbuf->reserved_size;
+- need_wrap = true;
+ } else if (total_bytes > ringbuf->space) {
+ /* No wrapping required, just waiting. */
+ wait_bytes = total_bytes;
--- /dev/null
+From fa5a7970d372c9c9beb3a0ce79ee1d0c23387d0a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 15 Oct 2015 17:01:58 +0300
+Subject: drm/i915: skl_update_scaler() wants a rotation bitmask instead of bit number
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit fa5a7970d372c9c9beb3a0ce79ee1d0c23387d0a upstream.
+
+Pass BIT(DRM_ROTATE_0) instead of DRM_ROTATE_0 to skl_update_scaler().
+The former is a mask, the latter just the bit number.
+
+Fortunately the only thing skl_update_scaler() does with the rotation
+is check if it's 90/270 degrees or not, and so in this case it would
+still do the right thing.
+
+Cc: Chandra Konduru <chandra.konduru@intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1444917718-28495-1-git-send-email-ville.syrjala@linux.intel.com
+Fixes: 6156a45602f9 ("drm/i915: skylake primary plane scaling using shared scalers")
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4447,7 +4447,7 @@ int skl_update_scaler_crtc(struct intel_
+ intel_crtc->base.base.id, intel_crtc->pipe, SKL_CRTC_INDEX);
+
+ return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX,
+- &state->scaler_state.scaler_id, DRM_ROTATE_0,
++ &state->scaler_state.scaler_id, BIT(DRM_ROTATE_0),
+ state->pipe_src_w, state->pipe_src_h,
+ adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay);
+ }
--- /dev/null
+From 31318a922395ec9e78d6e2ddf70779355afc7594 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 14 Apr 2016 14:39:02 +0300
+Subject: drm/i915: Use fw_domains_put_with_fifo() on HSW
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 31318a922395ec9e78d6e2ddf70779355afc7594 upstream.
+
+HSW still has the wake FIFO, so let's check it.
+
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Deepak S <deepak.s@linux.intel.com>
+Fixes: 05a2fb157e44 ("drm/i915: Consolidate forcewake code")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1460633942-24013-1-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
+(cherry picked from commit 3d7d0c85e41afb5a05e98b3a8a72c38357f02594)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_uncore.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_uncore.c
++++ b/drivers/gpu/drm/i915/intel_uncore.c
+@@ -1132,7 +1132,11 @@ static void intel_uncore_fw_domains_init
+ } else if (IS_HASWELL(dev) || IS_BROADWELL(dev)) {
+ dev_priv->uncore.funcs.force_wake_get =
+ fw_domains_get_with_thread_status;
+- dev_priv->uncore.funcs.force_wake_put = fw_domains_put;
++ if (IS_HASWELL(dev))
++ dev_priv->uncore.funcs.force_wake_put =
++ fw_domains_put_with_fifo;
++ else
++ dev_priv->uncore.funcs.force_wake_put = fw_domains_put;
+ fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER,
+ FORCEWAKE_MT, FORCEWAKE_ACK_HSW);
+ } else if (IS_IVYBRIDGE(dev)) {
--- /dev/null
+From 221004c66a58949a0f25c937a6789c0839feb530 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Tue, 19 Apr 2016 19:19:11 +0800
+Subject: drm: Loongson-3 doesn't fully support wc memory
+
+From: Huacai Chen <chenhc@lemote.com>
+
+commit 221004c66a58949a0f25c937a6789c0839feb530 upstream.
+
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/drm/drm_cache.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/drm/drm_cache.h
++++ b/include/drm/drm_cache.h
+@@ -39,6 +39,8 @@ static inline bool drm_arch_can_wc_memor
+ {
+ #if defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE)
+ return false;
++#elif defined(CONFIG_MIPS) && defined(CONFIG_CPU_LOONGSON3)
++ return false;
+ #else
+ return true;
+ #endif
--- /dev/null
+From 28dca90533750c7e31e8641c3df426bad9c12941 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Fri, 22 Apr 2016 10:05:21 +1000
+Subject: drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+commit 28dca90533750c7e31e8641c3df426bad9c12941 upstream.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+@@ -1717,6 +1717,8 @@ gf100_gr_init(struct gf100_gr *gr)
+
+ gf100_gr_mmio(gr, gr->func->mmio);
+
++ nvkm_mask(device, TPC_UNIT(0, 0, 0x05c), 0x00000001, 0x00000001);
++
+ memcpy(tpcnr, gr->tpc_nr, sizeof(gr->tpc_nr));
+ for (i = 0, gpc = -1; i < gr->tpc_total; i++) {
+ do {
--- /dev/null
+From bcb31eba4a4ea356fd61cbd5dec5511c3883f57e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 14 Apr 2016 14:15:16 -0400
+Subject: drm/radeon: add a quirk for a XFX R9 270X
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit bcb31eba4a4ea356fd61cbd5dec5511c3883f57e upstream.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=76490
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2931,6 +2931,7 @@ static struct si_dpm_quirk si_dpm_quirk_
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 },
++ { PCI_VENDOR_ID_ATI, 0x6810, 0x1682, 0x9275, 0, 120000 },
+ { 0, 0, 0, 0 },
+ };
+
--- /dev/null
+From 7403c515c49c033fec33df0814fffdc977e6acdc Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 13 Apr 2016 12:08:27 -0400
+Subject: drm/radeon: fix initial connector audio value
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 7403c515c49c033fec33df0814fffdc977e6acdc upstream.
+
+This got lost somewhere along the way. This fixes
+audio not working until set_property was called.
+
+Noticed-by: Hyungwon Hwang <hyungwon.hwang7@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -1996,10 +1996,12 @@ radeon_add_atom_connector(struct drm_dev
+ rdev->mode_info.dither_property,
+ RADEON_FMT_DITHER_DISABLE);
+
+- if (radeon_audio != 0)
++ if (radeon_audio != 0) {
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.audio_property,
+ RADEON_AUDIO_AUTO);
++ radeon_connector->audio = RADEON_AUDIO_AUTO;
++ }
+ if (ASIC_IS_DCE5(rdev))
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.output_csc_property,
+@@ -2124,6 +2126,7 @@ radeon_add_atom_connector(struct drm_dev
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.audio_property,
+ RADEON_AUDIO_AUTO);
++ radeon_connector->audio = RADEON_AUDIO_AUTO;
+ }
+ if (connector_type == DRM_MODE_CONNECTOR_DVII) {
+ radeon_connector->dac_load_detect = true;
+@@ -2179,6 +2182,7 @@ radeon_add_atom_connector(struct drm_dev
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.audio_property,
+ RADEON_AUDIO_AUTO);
++ radeon_connector->audio = RADEON_AUDIO_AUTO;
+ }
+ if (ASIC_IS_DCE5(rdev))
+ drm_object_attach_property(&radeon_connector->base.base,
+@@ -2231,6 +2235,7 @@ radeon_add_atom_connector(struct drm_dev
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.audio_property,
+ RADEON_AUDIO_AUTO);
++ radeon_connector->audio = RADEON_AUDIO_AUTO;
+ }
+ if (ASIC_IS_DCE5(rdev))
+ drm_object_attach_property(&radeon_connector->base.base,
--- /dev/null
+From 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 Mon Sep 17 00:00:00 2001
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Date: Thu, 14 Apr 2016 13:34:03 -0400
+Subject: drm/radeon: fix vertical bars appear on monitor (v2)
+
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+
+commit 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 upstream.
+
+When crtc/timing is disabled on boot the dig block
+should be stopped in order ignore timing from crtc,
+reset the steering fifo otherwise we get display
+corruption or hung in dp sst mode.
+
+v2: agd: fix coding style
+
+Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 154 ++++++++++++++++++++++++++++++++-
+ drivers/gpu/drm/radeon/evergreen_reg.h | 46 +++++++++
+ 2 files changed, 199 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2608,10 +2608,152 @@ static void evergreen_agp_enable(struct
+ WREG32(VM_CONTEXT1_CNTL, 0);
+ }
+
++static const unsigned ni_dig_offsets[] =
++{
++ NI_DIG0_REGISTER_OFFSET,
++ NI_DIG1_REGISTER_OFFSET,
++ NI_DIG2_REGISTER_OFFSET,
++ NI_DIG3_REGISTER_OFFSET,
++ NI_DIG4_REGISTER_OFFSET,
++ NI_DIG5_REGISTER_OFFSET
++};
++
++static const unsigned ni_tx_offsets[] =
++{
++ NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1
++};
++
++static const unsigned evergreen_dp_offsets[] =
++{
++ EVERGREEN_DP0_REGISTER_OFFSET,
++ EVERGREEN_DP1_REGISTER_OFFSET,
++ EVERGREEN_DP2_REGISTER_OFFSET,
++ EVERGREEN_DP3_REGISTER_OFFSET,
++ EVERGREEN_DP4_REGISTER_OFFSET,
++ EVERGREEN_DP5_REGISTER_OFFSET
++};
++
++
++/*
++ * Assumption is that EVERGREEN_CRTC_MASTER_EN enable for requested crtc
++ * We go from crtc to connector and it is not relible since it
++ * should be an opposite direction .If crtc is enable then
++ * find the dig_fe which selects this crtc and insure that it enable.
++ * if such dig_fe is found then find dig_be which selects found dig_be and
++ * insure that it enable and in DP_SST mode.
++ * if UNIPHY_PLL_CONTROL1.enable then we should disconnect timing
++ * from dp symbols clocks .
++ */
++static bool evergreen_is_dp_sst_stream_enabled(struct radeon_device *rdev,
++ unsigned crtc_id, unsigned *ret_dig_fe)
++{
++ unsigned i;
++ unsigned dig_fe;
++ unsigned dig_be;
++ unsigned dig_en_be;
++ unsigned uniphy_pll;
++ unsigned digs_fe_selected;
++ unsigned dig_be_mode;
++ unsigned dig_fe_mask;
++ bool is_enabled = false;
++ bool found_crtc = false;
++
++ /* loop through all running dig_fe to find selected crtc */
++ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
++ dig_fe = RREG32(NI_DIG_FE_CNTL + ni_dig_offsets[i]);
++ if (dig_fe & NI_DIG_FE_CNTL_SYMCLK_FE_ON &&
++ crtc_id == NI_DIG_FE_CNTL_SOURCE_SELECT(dig_fe)) {
++ /* found running pipe */
++ found_crtc = true;
++ dig_fe_mask = 1 << i;
++ dig_fe = i;
++ break;
++ }
++ }
++
++ if (found_crtc) {
++ /* loop through all running dig_be to find selected dig_fe */
++ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
++ dig_be = RREG32(NI_DIG_BE_CNTL + ni_dig_offsets[i]);
++ /* if dig_fe_selected by dig_be? */
++ digs_fe_selected = NI_DIG_BE_CNTL_FE_SOURCE_SELECT(dig_be);
++ dig_be_mode = NI_DIG_FE_CNTL_MODE(dig_be);
++ if (dig_fe_mask & digs_fe_selected &&
++ /* if dig_be in sst mode? */
++ dig_be_mode == NI_DIG_BE_DPSST) {
++ dig_en_be = RREG32(NI_DIG_BE_EN_CNTL +
++ ni_dig_offsets[i]);
++ uniphy_pll = RREG32(NI_DCIO_UNIPHY0_PLL_CONTROL1 +
++ ni_tx_offsets[i]);
++ /* dig_be enable and tx is running */
++ if (dig_en_be & NI_DIG_BE_EN_CNTL_ENABLE &&
++ dig_en_be & NI_DIG_BE_EN_CNTL_SYMBCLK_ON &&
++ uniphy_pll & NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE) {
++ is_enabled = true;
++ *ret_dig_fe = dig_fe;
++ break;
++ }
++ }
++ }
++ }
++
++ return is_enabled;
++}
++
++/*
++ * Blank dig when in dp sst mode
++ * Dig ignores crtc timing
++ */
++static void evergreen_blank_dp_output(struct radeon_device *rdev,
++ unsigned dig_fe)
++{
++ unsigned stream_ctrl;
++ unsigned fifo_ctrl;
++ unsigned counter = 0;
++
++ if (dig_fe >= ARRAY_SIZE(evergreen_dp_offsets)) {
++ DRM_ERROR("invalid dig_fe %d\n", dig_fe);
++ return;
++ }
++
++ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++ evergreen_dp_offsets[dig_fe]);
++ if (!(stream_ctrl & EVERGREEN_DP_VID_STREAM_CNTL_ENABLE)) {
++ DRM_ERROR("dig %d , should be enable\n", dig_fe);
++ return;
++ }
++
++ stream_ctrl &=~EVERGREEN_DP_VID_STREAM_CNTL_ENABLE;
++ WREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++ evergreen_dp_offsets[dig_fe], stream_ctrl);
++
++ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++ evergreen_dp_offsets[dig_fe]);
++ while (counter < 32 && stream_ctrl & EVERGREEN_DP_VID_STREAM_STATUS) {
++ msleep(1);
++ counter++;
++ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++ evergreen_dp_offsets[dig_fe]);
++ }
++ if (counter >= 32 )
++ DRM_ERROR("counter exceeds %d\n", counter);
++
++ fifo_ctrl = RREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe]);
++ fifo_ctrl |= EVERGREEN_DP_STEER_FIFO_RESET;
++ WREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe], fifo_ctrl);
++
++}
++
+ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *save)
+ {
+ u32 crtc_enabled, tmp, frame_count, blackout;
+ int i, j;
++ unsigned dig_fe;
+
+ if (!ASIC_IS_NODCE(rdev)) {
+ save->vga_render_control = RREG32(VGA_RENDER_CONTROL);
+@@ -2651,7 +2793,17 @@ void evergreen_mc_stop(struct radeon_dev
+ break;
+ udelay(1);
+ }
+-
++ /*we should disable dig if it drives dp sst*/
++ /*but we are in radeon_device_init and the topology is unknown*/
++ /*and it is available after radeon_modeset_init*/
++ /*the following method radeon_atom_encoder_dpms_dig*/
++ /*does the job if we initialize it properly*/
++ /*for now we do it this manually*/
++ /**/
++ if (ASIC_IS_DCE5(rdev) &&
++ evergreen_is_dp_sst_stream_enabled(rdev, i ,&dig_fe))
++ evergreen_blank_dp_output(rdev, dig_fe);
++ /*we could remove 6 lines below*/
+ /* XXX this is a hack to avoid strange behavior with EFI on certain systems */
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
+ tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
+--- a/drivers/gpu/drm/radeon/evergreen_reg.h
++++ b/drivers/gpu/drm/radeon/evergreen_reg.h
+@@ -250,8 +250,43 @@
+
+ /* HDMI blocks at 0x7030, 0x7c30, 0x10830, 0x11430, 0x12030, 0x12c30 */
+ #define EVERGREEN_HDMI_BASE 0x7030
++/*DIG block*/
++#define NI_DIG0_REGISTER_OFFSET (0x7000 - 0x7000)
++#define NI_DIG1_REGISTER_OFFSET (0x7C00 - 0x7000)
++#define NI_DIG2_REGISTER_OFFSET (0x10800 - 0x7000)
++#define NI_DIG3_REGISTER_OFFSET (0x11400 - 0x7000)
++#define NI_DIG4_REGISTER_OFFSET (0x12000 - 0x7000)
++#define NI_DIG5_REGISTER_OFFSET (0x12C00 - 0x7000)
++
++
++#define NI_DIG_FE_CNTL 0x7000
++# define NI_DIG_FE_CNTL_SOURCE_SELECT(x) ((x) & 0x3)
++# define NI_DIG_FE_CNTL_SYMCLK_FE_ON (1<<24)
++
++
++#define NI_DIG_BE_CNTL 0x7140
++# define NI_DIG_BE_CNTL_FE_SOURCE_SELECT(x) (((x) >> 8 ) & 0x3F)
++# define NI_DIG_FE_CNTL_MODE(x) (((x) >> 16) & 0x7 )
++
++#define NI_DIG_BE_EN_CNTL 0x7144
++# define NI_DIG_BE_EN_CNTL_ENABLE (1 << 0)
++# define NI_DIG_BE_EN_CNTL_SYMBCLK_ON (1 << 8)
++# define NI_DIG_BE_DPSST 0
+
+ /* Display Port block */
++#define EVERGREEN_DP0_REGISTER_OFFSET (0x730C - 0x730C)
++#define EVERGREEN_DP1_REGISTER_OFFSET (0x7F0C - 0x730C)
++#define EVERGREEN_DP2_REGISTER_OFFSET (0x10B0C - 0x730C)
++#define EVERGREEN_DP3_REGISTER_OFFSET (0x1170C - 0x730C)
++#define EVERGREEN_DP4_REGISTER_OFFSET (0x1230C - 0x730C)
++#define EVERGREEN_DP5_REGISTER_OFFSET (0x12F0C - 0x730C)
++
++
++#define EVERGREEN_DP_VID_STREAM_CNTL 0x730C
++# define EVERGREEN_DP_VID_STREAM_CNTL_ENABLE (1 << 0)
++# define EVERGREEN_DP_VID_STREAM_STATUS (1 <<16)
++#define EVERGREEN_DP_STEER_FIFO 0x7310
++# define EVERGREEN_DP_STEER_FIFO_RESET (1 << 0)
+ #define EVERGREEN_DP_SEC_CNTL 0x7280
+ # define EVERGREEN_DP_SEC_STREAM_ENABLE (1 << 0)
+ # define EVERGREEN_DP_SEC_ASP_ENABLE (1 << 4)
+@@ -266,4 +301,15 @@
+ # define EVERGREEN_DP_SEC_N_BASE_MULTIPLE(x) (((x) & 0xf) << 24)
+ # define EVERGREEN_DP_SEC_SS_EN (1 << 28)
+
++/*DCIO_UNIPHY block*/
++#define NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1 (0x6600 -0x6600)
++#define NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1 (0x6640 -0x6600)
++#define NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1 (0x6680 - 0x6600)
++#define NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1 (0x66C0 - 0x6600)
++#define NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1 (0x6700 - 0x6600)
++#define NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1 (0x6740 - 0x6600)
++
++#define NI_DCIO_UNIPHY0_PLL_CONTROL1 0x6618
++# define NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE (1 << 0)
++
+ #endif
--- /dev/null
+From b5dcec693f87cb8475f2291c0075b2422addd3d6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= <jglisse@redhat.com>
+Date: Tue, 19 Apr 2016 09:07:50 -0400
+Subject: drm/radeon: forbid mapping of userptr bo through radeon device file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jérôme Glisse <jglisse@redhat.com>
+
+commit b5dcec693f87cb8475f2291c0075b2422addd3d6 upstream.
+
+Allowing userptr bo which are basicly a list of page from some vma
+(so either anonymous page or file backed page) would lead to serious
+corruption of kernel structures and counters (because we overwrite
+the page->mapping field when mapping buffer).
+
+This will already block if the buffer was populated before anyone does
+try to mmap it because then TTM_PAGE_FLAG_SG would be set in in the
+ttm_tt flags. But that flag is check before ttm_tt_populate in the ttm
+vm fault handler.
+
+So to be safe just add a check to verify_access() callback.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_ttm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -235,6 +235,8 @@ static int radeon_verify_access(struct t
+ {
+ struct radeon_bo *rbo = container_of(bo, struct radeon_bo, tbo);
+
++ if (radeon_ttm_tt_has_userptr(bo->ttm))
++ return -EPERM;
+ return drm_vma_node_verify_access(&rbo->gem_base.vma_node, filp);
+ }
+
--- /dev/null
+From c4fc1956fa31003bfbe4f597e359d751568e2954 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Fri, 29 Apr 2016 15:42:25 +0200
+Subject: EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit c4fc1956fa31003bfbe4f597e359d751568e2954 upstream.
+
+Both of these drivers can return NOTIFY_BAD, but this terminates
+processing other callbacks that were registered later on the chain.
+Since the driver did nothing to log the error it seems wrong to prevent
+other interested parties from seeing it. E.g. neither of them had even
+bothered to check the type of the error to see if it was a memory error
+before the return NOTIFY_BAD.
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Acked-by: Aristeu Rozanski <aris@redhat.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/72937355dd92318d2630979666063f8a2853495b.1461864507.git.tony.luck@intel.com
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/i7core_edac.c | 2 +-
+ drivers/edac/sb_edac.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1866,7 +1866,7 @@ static int i7core_mce_check_error(struct
+
+ i7_dev = get_i7core_dev(mce->socketid);
+ if (!i7_dev)
+- return NOTIFY_BAD;
++ return NOTIFY_DONE;
+
+ mci = i7_dev->mci;
+ pvt = mci->pvt_info;
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2254,7 +2254,7 @@ static int sbridge_mce_check_error(struc
+
+ mci = get_mci_for_node_id(mce->socketid);
+ if (!mci)
+- return NOTIFY_BAD;
++ return NOTIFY_DONE;
+ pvt = mci->pvt_info;
+
+ /*
--- /dev/null
+From 609d5a1b2b35bb62b4b3750396e55453160c2a17 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Wed, 13 Apr 2016 13:59:14 +1000
+Subject: i2c: cpm: Fix build break due to incompatible pointer types
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit 609d5a1b2b35bb62b4b3750396e55453160c2a17 upstream.
+
+Since commit ea8daa7b9784 ("kbuild: Add option to turn incompatible
+pointer check into error"), assignments from an incompatible pointer
+types have become a hard error, eg:
+
+ drivers/i2c/busses/i2c-cpm.c:545:91: error: passing argument 3 of
+ 'dma_alloc_coherent' from incompatible pointer type
+
+Fix the build break by converting txdma & rxdma to dma_addr_t.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: ea8daa7b9784
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-cpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-cpm.c
++++ b/drivers/i2c/busses/i2c-cpm.c
+@@ -116,8 +116,8 @@ struct cpm_i2c {
+ cbd_t __iomem *rbase;
+ u_char *txbuf[CPM_MAXBD];
+ u_char *rxbuf[CPM_MAXBD];
+- u32 txdma[CPM_MAXBD];
+- u32 rxdma[CPM_MAXBD];
++ dma_addr_t txdma[CPM_MAXBD];
++ dma_addr_t rxdma[CPM_MAXBD];
+ };
+
+ static irqreturn_t cpm_i2c_interrupt(int irq, void *dev_id)
--- /dev/null
+From 10ff4c5239a137abfc896ec73ef3d15a0f86a16a Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Sat, 16 Apr 2016 21:14:52 -0400
+Subject: i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+commit 10ff4c5239a137abfc896ec73ef3d15a0f86a16a upstream.
+
+The exynos5 I2C controller driver always prepares and enables a clock
+before using it and then disables unprepares it when the clock is not
+used anymore.
+
+But this can cause a possible ABBA deadlock in some scenarios since a
+driver that uses regmap to access its I2C registers, will first grab
+the regmap lock and then the I2C xfer function will grab the prepare
+lock when preparing the I2C clock. But since the clock driver also
+uses regmap for I2C accesses, preparing a clock will first grab the
+prepare lock and then the regmap lock when using the regmap API.
+
+An example of this happens on the Exynos5422 Odroid XU4 board where a
+s2mps11 PMIC is used and both the s2mps11 regulators and clk drivers
+share the same I2C regmap.
+
+The possible deadlock is reported by the kernel lockdep:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(sec_core:428:(regmap)->lock);
+ lock(prepare_lock);
+ lock(sec_core:428:(regmap)->lock);
+ lock(prepare_lock);
+
+ *** DEADLOCK ***
+
+Fix it by leaving the code prepared on probe and use {en,dis}able in
+the I2C transfer function.
+
+This patch is similar to commit 34e81ad5f0b6 ("i2c: s3c2410: fix ABBA
+deadlock by keeping clock prepared") that fixes the same bug in other
+driver for an I2C controller found in Samsung SoCs.
+
+Reported-by: Anand Moon <linux.amoon@gmail.com>
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Reviewed-by: Anand Moon <linux.amoon@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-exynos5.c | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-exynos5.c
++++ b/drivers/i2c/busses/i2c-exynos5.c
+@@ -671,7 +671,9 @@ static int exynos5_i2c_xfer(struct i2c_a
+ return -EIO;
+ }
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ for (i = 0; i < num; i++, msgs++) {
+ stop = (i == num - 1);
+@@ -695,7 +697,7 @@ static int exynos5_i2c_xfer(struct i2c_a
+ }
+
+ out:
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ return ret;
+ }
+
+@@ -747,7 +749,9 @@ static int exynos5_i2c_probe(struct plat
+ return -ENOENT;
+ }
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_prepare_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ i2c->regs = devm_ioremap_resource(&pdev->dev, mem);
+@@ -799,6 +803,10 @@ static int exynos5_i2c_probe(struct plat
+
+ platform_set_drvdata(pdev, i2c);
+
++ clk_disable(i2c->clk);
++
++ return 0;
++
+ err_clk:
+ clk_disable_unprepare(i2c->clk);
+ return ret;
+@@ -810,6 +818,8 @@ static int exynos5_i2c_remove(struct pla
+
+ i2c_del_adapter(&i2c->adap);
+
++ clk_unprepare(i2c->clk);
++
+ return 0;
+ }
+
+@@ -821,6 +831,8 @@ static int exynos5_i2c_suspend_noirq(str
+
+ i2c->suspended = 1;
+
++ clk_unprepare(i2c->clk);
++
+ return 0;
+ }
+
+@@ -830,7 +842,9 @@ static int exynos5_i2c_resume_noirq(stru
+ struct exynos5_i2c *i2c = platform_get_drvdata(pdev);
+ int ret = 0;
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_prepare_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ ret = exynos5_hsi2c_clock_setup(i2c);
+ if (ret) {
+@@ -839,7 +853,7 @@ static int exynos5_i2c_resume_noirq(stru
+ }
+
+ exynos5_i2c_init(i2c);
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ i2c->suspended = 0;
+
+ return 0;
--- /dev/null
+From 1342e0b7a6c1a060c593037fbac9f4b717f1cb3b Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Mon, 18 Apr 2016 13:57:48 +0300
+Subject: perf intel-pt: Fix segfault tracing transactions
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 1342e0b7a6c1a060c593037fbac9f4b717f1cb3b upstream.
+
+Tracing a workload that uses transactions gave a seg fault as follows:
+
+ perf record -e intel_pt// workload
+ perf report
+ Program received signal SIGSEGV, Segmentation fault.
+ 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110)
+ at util/intel-pt.c:929
+ 929 ptq->last_branch_rb->nr = 0;
+ (gdb) p ptq->last_branch_rb
+ $1 = (struct branch_stack *) 0x0
+ (gdb) up
+ 1148 intel_pt_reset_last_branch_rb(ptq);
+ (gdb) l
+ 1143 if (ret)
+ 1144 pr_err("Intel Processor Trace: failed to deliver transaction event
+ 1145 ret);
+ 1146
+ 1147 if (pt->synth_opts.callchain)
+ 1148 intel_pt_reset_last_branch_rb(ptq);
+ 1149
+ 1150 return ret;
+ 1151 }
+ 1152
+ (gdb) p pt->synth_opts.callchain
+ $2 = true
+ (gdb)
+ (gdb) bt
+ #0 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110)
+ #1 0x000000000054c1e0 in intel_pt_synth_transaction_sample (ptq=0x1a36110)
+ #2 0x000000000054c5b2 in intel_pt_sample (ptq=0x1a36110)
+
+Caused by checking the 'callchain' flag when it should have been the
+'last_branch' flag. Fix that.
+
+Reported-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Fixes: f14445ee72c5 ("perf intel-pt: Support generating branch stack")
+Link: http://lkml.kernel.org/r/1460977068-11566-1-git-send-email-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/intel-pt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -1127,7 +1127,7 @@ static int intel_pt_synth_transaction_sa
+ pr_err("Intel Processor Trace: failed to deliver transaction event, error %d\n",
+ ret);
+
+- if (pt->synth_opts.callchain)
++ if (pt->synth_opts.last_branch)
+ intel_pt_reset_last_branch_rb(ptq);
+
+ return ret;
--- /dev/null
+From c5857e3f94ab2719dfac649a146cb5dd6f21fcf3 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vz@mleia.com>
+Date: Sun, 6 Mar 2016 03:21:46 +0200
+Subject: pwm: brcmstb: Fix check of devm_ioremap_resource() return code
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+commit c5857e3f94ab2719dfac649a146cb5dd6f21fcf3 upstream.
+
+The change fixes potential oops while accessing iomem on invalid address
+if devm_ioremap_resource() fails due to some reason.
+
+The devm_ioremap_resource() function returns ERR_PTR() and never returns
+NULL, which makes useless a following check for NULL.
+
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Fixes: 3a9f5957020f ("pwm: Add Broadcom BCM7038 PWM controller support")
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pwm/pwm-brcmstb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pwm/pwm-brcmstb.c
++++ b/drivers/pwm/pwm-brcmstb.c
+@@ -274,8 +274,8 @@ static int brcmstb_pwm_probe(struct plat
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ p->base = devm_ioremap_resource(&pdev->dev, res);
+- if (!p->base) {
+- ret = -ENOMEM;
++ if (IS_ERR(p->base)) {
++ ret = PTR_ERR(p->base);
+ goto out_clk;
+ }
+
drm-amdgpu-bump-the-afmt-limit-for-cz-st-polaris.patch
amdgpu-uvd-add-uvd-fw-version-for-amdgpu.patch
drm-amdgpu-fix-regression-on-cik-v2.patch
+drm-radeon-add-a-quirk-for-a-xfx-r9-270x.patch
+drm-radeon-fix-initial-connector-audio-value.patch
+drm-radeon-forbid-mapping-of-userptr-bo-through-radeon-device-file.patch
+drm-radeon-fix-vertical-bars-appear-on-monitor-v2.patch
+drm-loongson-3-doesn-t-fully-support-wc-memory.patch
+drm-nouveau-gr-gf100-select-a-stream-master-to-fixup-tfb-offset-queries.patch
+drm-dp-mst-validate-port-in-drm_dp_payload_send_msg.patch
+drm-dp-mst-restore-primary-hub-guid-on-resume.patch
+drm-dp-mst-get-validated-port-ref-in-drm_dp_update_payload_part1.patch
+pwm-brcmstb-fix-check-of-devm_ioremap_resource-return-code.patch
+drm-i915-cleanup-phys-status-page-too.patch
+drm-i915-skl_update_scaler-wants-a-rotation-bitmask-instead-of-bit-number.patch
+drm-amdkfd-uninitialized-variable-in-dbgdev_wave_control_set_registers.patch
+drm-i915-fixup-the-free-space-logic-in-ring_prepare.patch
+drm-i915-use-fw_domains_put_with_fifo-on-hsw.patch
+perf-intel-pt-fix-segfault-tracing-transactions.patch
+i2c-cpm-fix-build-break-due-to-incompatible-pointer-types.patch
+i2c-exynos5-fix-possible-abba-deadlock-by-keeping-i2c-clock-prepared.patch
+toshiba_acpi-fix-regression-caused-by-hotkey-enabling-value.patch
+edac-i7core-sb_edac-don-t-return-notify_bad-from-mce_decoder-callback.patch
--- /dev/null
+From a30b8f81d9d6fe24eab8a023794548b048f08e3c Mon Sep 17 00:00:00 2001
+From: Azael Avalos <coproscefalo@gmail.com>
+Date: Fri, 22 Apr 2016 09:29:36 -0600
+Subject: toshiba_acpi: Fix regression caused by hotkey enabling value
+
+From: Azael Avalos <coproscefalo@gmail.com>
+
+commit a30b8f81d9d6fe24eab8a023794548b048f08e3c upstream.
+
+Commit 52cbae0127ad ("toshiba_acpi: Change default Hotkey enabling value")
+changed the hotkeys enabling value, as it was the same value Windows uses,
+however, it turns out that the value tells the EC that the driver will now
+take care of the hardware events like the physical RFKill switch or the
+pointing device toggle button.
+
+This patch reverts such commit by changing the default hotkey enabling
+value to 0x09, which enables hotkey events only, making the hardware
+buttons working again.
+
+Fixes bugs 113331 and 114941.
+
+Signed-off-by: Azael Avalos <coproscefalo@gmail.com>
+Signed-off-by: Darren Hart <dvhart@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/toshiba_acpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -131,7 +131,7 @@ MODULE_LICENSE("GPL");
+ /* Field definitions */
+ #define HCI_ACCEL_MASK 0x7fff
+ #define HCI_HOTKEY_DISABLE 0x0b
+-#define HCI_HOTKEY_ENABLE 0x01
++#define HCI_HOTKEY_ENABLE 0x09
+ #define HCI_HOTKEY_SPECIAL_FUNCTIONS 0x10
+ #define HCI_LCD_BRIGHTNESS_BITS 3
+ #define HCI_LCD_BRIGHTNESS_SHIFT (16-HCI_LCD_BRIGHTNESS_BITS)