--- /dev/null
+From 5508df89756f8378024828e185724a9bd2348985 Mon Sep 17 00:00:00 2001
+From: Lv Zheng <lv.zheng@intel.com>
+Date: Thu, 10 Mar 2016 10:54:29 +0800
+Subject: ACPICA / Interpreter: Fix a regression triggered because of wrong Linux ECDT support
+
+From: Lv Zheng <lv.zheng@intel.com>
+
+commit 5508df89756f8378024828e185724a9bd2348985 upstream.
+
+It is reported that the following commit triggers regressions:
+ Linux commit: efaed9be998b5ae0afb7458e057e5f4402b43fa0
+ ACPICA commit: 31178590dde82368fdb0f6b0e466b6c0add96c57
+ Subject: ACPICA: Events: Enhance acpi_ev_execute_reg_method() to
+ ensure no _REG evaluations can happen during OS early boot
+ stages
+
+This is because that the ECDT support is not corrected in Linux, and Linux
+requires to execute _REG for ECDT (though this sounds so wrong), we need to
+ensure acpi_gbl_namespace_initialized is set before ECDT probing in order
+for _REG to be executed. Since we have to move
+"acpi_gbl_namespace_initialized = TRUE" to the initialization step
+happening before ECDT probing, acpi_load_tables() is the best candidate for
+now. Thus this patch fixes the regression by doing so.
+
+But if the ECDT support is fixed, Linux will not execute _REG for ECDT, and
+ECDT probing will happen before acpi_load_tables(). At that time, we still
+want to ensure acpi_gbl_namespace_initialized is set after executing
+acpi_ns_initialize_objects() (under the condition of
+acpi_gbl_group_module_level_code = FALSE), this patch also moves
+acpi_ns_initialize_objects() to acpi_load_tables() accordingly.
+
+Since acpi_ns_initialize_objects() doesn't seem to be skippable, this
+patch also removes ACPI_NO_OBJECT_INIT for the one invoked in
+acpi_load_tables(). And since the default region handlers should always be
+installed before loading the tables, this patch also removes useless
+acpi_gbl_group_module_level_code check accordingly. Reported by Chris
+Bainbridge, Fixed by Lv Zheng.
+
+Fixes: efaed9be998b (ACPICA: Events: Enhance acpi_ev_execute_reg_method() to ensure no _REG evaluations can happen during OS early boot stages)
+Reported-and-tested-by: Chris Bainbridge <chris.bainbridge@gmail.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/nsinit.c | 2 ++
+ drivers/acpi/acpica/tbxfload.c | 14 ++++++++++++++
+ drivers/acpi/acpica/utxfinit.c | 25 +++++++++++--------------
+ 3 files changed, 27 insertions(+), 14 deletions(-)
+
+--- a/drivers/acpi/acpica/nsinit.c
++++ b/drivers/acpi/acpica/nsinit.c
+@@ -83,6 +83,8 @@ acpi_status acpi_ns_initialize_objects(v
+
+ ACPI_FUNCTION_TRACE(ns_initialize_objects);
+
++ ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
++ "[Init] Completing Initialization of ACPI Objects\n"));
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ "**** Starting initialization of namespace objects ****\n"));
+ ACPI_DEBUG_PRINT_RAW((ACPI_DB_INIT,
+--- a/drivers/acpi/acpica/tbxfload.c
++++ b/drivers/acpi/acpica/tbxfload.c
+@@ -83,6 +83,20 @@ acpi_status __init acpi_load_tables(void
+ "While loading namespace from ACPI tables"));
+ }
+
++ if (!acpi_gbl_group_module_level_code) {
++ /*
++ * Initialize the objects that remain uninitialized. This
++ * runs the executable AML that may be part of the
++ * declaration of these objects:
++ * operation_regions, buffer_fields, Buffers, and Packages.
++ */
++ status = acpi_ns_initialize_objects();
++ if (ACPI_FAILURE(status)) {
++ return_ACPI_STATUS(status);
++ }
++ }
++
++ acpi_gbl_reg_methods_enabled = TRUE;
+ return_ACPI_STATUS(status);
+ }
+
+--- a/drivers/acpi/acpica/utxfinit.c
++++ b/drivers/acpi/acpica/utxfinit.c
+@@ -267,7 +267,6 @@ acpi_status __init acpi_initialize_objec
+ * initialized, even if they contain executable AML (see the call to
+ * acpi_ns_initialize_objects below).
+ */
+- acpi_gbl_reg_methods_enabled = TRUE;
+ if (!(flags & ACPI_NO_ADDRESS_SPACE_INIT)) {
+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+ "[Init] Executing _REG OpRegion methods\n"));
+@@ -299,20 +298,18 @@ acpi_status __init acpi_initialize_objec
+ */
+ if (acpi_gbl_group_module_level_code) {
+ acpi_ns_exec_module_code_list();
+- }
+
+- /*
+- * Initialize the objects that remain uninitialized. This runs the
+- * executable AML that may be part of the declaration of these objects:
+- * operation_regions, buffer_fields, Buffers, and Packages.
+- */
+- if (!(flags & ACPI_NO_OBJECT_INIT)) {
+- ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+- "[Init] Completing Initialization of ACPI Objects\n"));
+-
+- status = acpi_ns_initialize_objects();
+- if (ACPI_FAILURE(status)) {
+- return_ACPI_STATUS(status);
++ /*
++ * Initialize the objects that remain uninitialized. This
++ * runs the executable AML that may be part of the
++ * declaration of these objects:
++ * operation_regions, buffer_fields, Buffers, and Packages.
++ */
++ if (!(flags & ACPI_NO_OBJECT_INIT)) {
++ status = acpi_ns_initialize_objects();
++ if (ACPI_FAILURE(status)) {
++ return_ACPI_STATUS(status);
++ }
+ }
+ }
+
--- /dev/null
+From 93fce954427effee89e44a976299b15dd75b4bbc Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 11 Mar 2016 10:51:51 +0300
+Subject: drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 93fce954427effee89e44a976299b15dd75b4bbc upstream.
+
+At the end of the function we expect "status" to be zero, but it's
+either -EINVAL or uninitialized.
+
+Fixes: 788bf83db301 ('drm/amdkfd: Add wave control operation to debugger')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c
+@@ -513,7 +513,7 @@ static int dbgdev_wave_control_set_regis
+ union SQ_CMD_BITS *in_reg_sq_cmd,
+ union GRBM_GFX_INDEX_BITS *in_reg_gfx_index)
+ {
+- int status;
++ int status = 0;
+ union SQ_CMD_BITS reg_sq_cmd;
+ union GRBM_GFX_INDEX_BITS reg_gfx_index;
+ struct HsaDbgWaveMsgAMDGen2 *pMsg;
--- /dev/null
+From 263efde31f97c498e1ebad30e4d2906609d7ad6b Mon Sep 17 00:00:00 2001
+From: "cpaul@redhat.com" <cpaul@redhat.com>
+Date: Fri, 22 Apr 2016 16:08:46 -0400
+Subject: drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
+
+From: cpaul@redhat.com <cpaul@redhat.com>
+
+commit 263efde31f97c498e1ebad30e4d2906609d7ad6b upstream.
+
+We can thank KASAN for finding this, otherwise I probably would have spent
+hours on it. This fixes a somewhat harder to trigger kernel panic, occuring
+while enabling MST where the port we were currently updating the payload on
+would have all of it's refs dropped before we finished what we were doing:
+
+==================================================================
+BUG: KASAN: use-after-free in drm_dp_update_payload_part1+0xb3f/0xdb0 [drm_kms_helper] at addr ffff8800d29de018
+Read of size 4 by task Xorg/973
+=============================================================================
+BUG kmalloc-2048 (Tainted: G B W ): kasan: bad access detected
+-----------------------------------------------------------------------------
+
+INFO: Allocated in drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] age=16477 cpu=0 pid=2175
+ ___slab_alloc+0x472/0x490
+ __slab_alloc+0x20/0x40
+ kmem_cache_alloc_trace+0x151/0x190
+ drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper]
+ drm_dp_send_link_address+0x526/0x960 [drm_kms_helper]
+ drm_dp_check_and_send_link_address+0x1ac/0x210 [drm_kms_helper]
+ drm_dp_mst_link_probe_work+0x77/0xd0 [drm_kms_helper]
+ process_one_work+0x562/0x1350
+ worker_thread+0xd9/0x1390
+ kthread+0x1c5/0x260
+ ret_from_fork+0x22/0x40
+INFO: Freed in drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] age=7521 cpu=0 pid=2175
+ __slab_free+0x17f/0x2d0
+ kfree+0x169/0x180
+ drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper]
+ drm_dp_destroy_connector_work+0x2b8/0x490 [drm_kms_helper]
+ process_one_work+0x562/0x1350
+ worker_thread+0xd9/0x1390
+ kthread+0x1c5/0x260
+ ret_from_fork+0x22/0x40
+
+which on this T460s, would eventually lead to kernel panics in somewhat
+random places later in intel_mst_enable_dp() if we got lucky enough.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1796,6 +1796,11 @@ int drm_dp_update_payload_part1(struct d
+ req_payload.start_slot = cur_slots;
+ if (mgr->proposed_vcpis[i]) {
+ port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi);
++ port = drm_dp_get_validated_port_ref(mgr, port);
++ if (!port) {
++ mutex_unlock(&mgr->payload_lock);
++ return -EINVAL;
++ }
+ req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots;
+ req_payload.vcpi = mgr->proposed_vcpis[i]->vcpi;
+ } else {
+@@ -1823,6 +1828,9 @@ int drm_dp_update_payload_part1(struct d
+ mgr->payloads[i].payload_state = req_payload.payload_state;
+ }
+ cur_slots += req_payload.num_slots;
++
++ if (port)
++ drm_dp_put_port(port);
+ }
+
+ for (i = 0; i < mgr->max_payloads; i++) {
--- /dev/null
+From 9dc0487d96a0396367a1451b31873482080b527f Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Wed, 13 Apr 2016 16:50:18 -0400
+Subject: drm/dp/mst: Restore primary hub guid on resume
+
+From: Lyude <cpaul@redhat.com>
+
+commit 9dc0487d96a0396367a1451b31873482080b527f upstream.
+
+Some hubs are forgetful, and end up forgetting whatever GUID we set
+previously after we do a suspend/resume cycle. This can lead to
+hotplugging breaking (along with probably other things) since the hub
+will start sending connection notifications with the wrong GUID. As
+such, we need to check on resume whether or not the GUID the hub is
+giving us is valid.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1460580618-7421-1-git-send-email-cpaul@redhat.com
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2128,6 +2128,8 @@ int drm_dp_mst_topology_mgr_resume(struc
+
+ if (mgr->mst_primary) {
+ int sret;
++ u8 guid[16];
++
+ sret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, mgr->dpcd, DP_RECEIVER_CAP_SIZE);
+ if (sret != DP_RECEIVER_CAP_SIZE) {
+ DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
+@@ -2142,6 +2144,16 @@ int drm_dp_mst_topology_mgr_resume(struc
+ ret = -1;
+ goto out_unlock;
+ }
++
++ /* Some hubs forget their guids after they resume */
++ sret = drm_dp_dpcd_read(mgr->aux, DP_GUID, guid, 16);
++ if (sret != 16) {
++ DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
++ ret = -1;
++ goto out_unlock;
++ }
++ drm_dp_check_mstb_guid(mgr->mst_primary, guid);
++
+ ret = 0;
+ } else
+ ret = -1;
--- /dev/null
+From deba0a2af9592b2022a0bce7b085a318b53ce1db Mon Sep 17 00:00:00 2001
+From: "cpaul@redhat.com" <cpaul@redhat.com>
+Date: Mon, 4 Apr 2016 19:58:47 -0400
+Subject: drm/dp/mst: Validate port in drm_dp_payload_send_msg()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: cpaul@redhat.com <cpaul@redhat.com>
+
+commit deba0a2af9592b2022a0bce7b085a318b53ce1db upstream.
+
+With the joys of things running concurrently, there's always a chance
+that the port we get passed in drm_dp_payload_send_msg() isn't actually
+valid anymore. Because of this, we need to make sure we validate the
+reference to the port before we use it otherwise we risk running into
+various race conditions. For instance, on the Dell MST monitor I have
+here for testing, hotplugging it enough times causes us to kernel panic:
+
+[drm:intel_mst_enable_dp] 1
+[drm:drm_dp_update_payload_part2] payload 0 1
+[drm:intel_get_hpd_pins] hotplug event received, stat 0x00200000, dig 0x10101011, pins 0x00000020
+[drm:intel_hpd_irq_handler] digital hpd port B - short
+[drm:intel_dp_hpd_pulse] got hpd irq on port B - short
+[drm:intel_dp_check_mst_status] got esi 00 10 00
+[drm:drm_dp_update_payload_part2] payload 1 1
+general protection fault: 0000 [#1] SMP
+…
+Call Trace:
+ [<ffffffffa012b632>] drm_dp_update_payload_part2+0xc2/0x130 [drm_kms_helper]
+ [<ffffffffa032ef08>] intel_mst_enable_dp+0xf8/0x180 [i915]
+ [<ffffffffa0310dbd>] haswell_crtc_enable+0x3ed/0x8c0 [i915]
+ [<ffffffffa030c84d>] intel_atomic_commit+0x5ad/0x1590 [i915]
+ [<ffffffffa01db877>] ? drm_atomic_set_crtc_for_connector+0x57/0xe0 [drm]
+ [<ffffffffa01dc4e7>] drm_atomic_commit+0x37/0x60 [drm]
+ [<ffffffffa0130a3a>] drm_atomic_helper_set_config+0x7a/0xb0 [drm_kms_helper]
+ [<ffffffffa01cc482>] drm_mode_set_config_internal+0x62/0x100 [drm]
+ [<ffffffffa01d02ad>] drm_mode_setcrtc+0x3cd/0x4e0 [drm]
+ [<ffffffffa01c18e3>] drm_ioctl+0x143/0x510 [drm]
+ [<ffffffffa01cfee0>] ? drm_mode_setplane+0x1b0/0x1b0 [drm]
+ [<ffffffff810f79a7>] ? hrtimer_start_range_ns+0x1b7/0x3a0
+ [<ffffffff81212962>] do_vfs_ioctl+0x92/0x570
+ [<ffffffff81590852>] ? __sys_recvmsg+0x42/0x80
+ [<ffffffff81212eb9>] SyS_ioctl+0x79/0x90
+ [<ffffffff816b4e32>] entry_SYSCALL_64_fastpath+0x1a/0xa4
+RIP [<ffffffffa012b026>] drm_dp_payload_send_msg+0x146/0x1f0 [drm_kms_helper]
+
+Which occurs because of the hotplug event shown in the log, which ends
+up causing DRM's dp helpers to drop the port we're updating the payload
+on and panic.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+Reviewed-by: David Airlie <airlied@linux.ie>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1672,13 +1672,19 @@ static int drm_dp_payload_send_msg(struc
+ u8 sinks[DRM_DP_MAX_SDP_STREAMS];
+ int i;
+
++ port = drm_dp_get_validated_port_ref(mgr, port);
++ if (!port)
++ return -EINVAL;
++
+ port_num = port->port_num;
+ mstb = drm_dp_get_validated_mstb_ref(mgr, port->parent);
+ if (!mstb) {
+ mstb = drm_dp_get_last_connected_port_and_mstb(mgr, port->parent, &port_num);
+
+- if (!mstb)
++ if (!mstb) {
++ drm_dp_put_port(port);
+ return -EINVAL;
++ }
+ }
+
+ txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
+@@ -1707,6 +1713,7 @@ static int drm_dp_payload_send_msg(struc
+ kfree(txmsg);
+ fail_put:
+ drm_dp_put_mst_branch_device(mstb);
++ drm_dp_put_port(port);
+ return ret;
+ }
+
--- /dev/null
+From 7d3fdfff23852fe458a0d0979a3555fe60f1e563 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 11 Jan 2016 20:48:32 +0200
+Subject: drm/i915: Cleanup phys status page too
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 7d3fdfff23852fe458a0d0979a3555fe60f1e563 upstream.
+
+Restore the lost phys status page cleanup.
+
+Fixes the following splat with DMA_API_DEBUG=y:
+
+WARNING: CPU: 0 PID: 21615 at ../lib/dma-debug.c:974 dma_debug_device_change+0x190/0x1f0()
+pci 0000:00:02.0: DMA-API: device driver has pending DMA allocations while released from device [count=1]
+ One of leaked entries details: [device address=0x0000000023163000] [size=4096 bytes] [mapped with DMA_BIDIRECTIONAL] [mapped as coherent]
+Modules linked in: i915(-) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm sha256_generic hmac drbg ctr ccm sch_fq_codel binfmt_misc joydev mousedev arc4 ath5k iTCO_wdt mac80211 smsc_ircc2 ath snd_intel8x0m snd_intel8x0 snd_ac97_codec ac97_bus psmouse snd_pcm input_leds i2c_i801 pcspkr snd_timer cfg80211 snd soundcore i2c_core ehci_pci firewire_ohci ehci_hcd firewire_core lpc_ich 8139too rfkill crc_itu_t mfd_core mii usbcore rng_core intel_agp intel_gtt usb_common agpgart irda crc_ccitt fujitsu_laptop led_class parport_pc video parport evdev backlight
+CPU: 0 PID: 21615 Comm: rmmod Tainted: G U 4.4.0-rc4-mgm-ovl+ #4
+Hardware name: FUJITSU SIEMENS LIFEBOOK S6120/FJNB16C, BIOS Version 1.26 05/10/2004
+ e31a3de0 e31a3de0 e31a3d9c c128d4bd e31a3dd0 c1045a0c c15e00c4 e31a3dfc
+ 0000546f c15dfad2 000003ce c12b3740 000003ce c12b3740 00000000 00000001
+ f61fb8a0 e31a3de8 c1045a83 00000009 e31a3de0 c15e00c4 e31a3dfc e31a3e4c
+Call Trace:
+ [<c128d4bd>] dump_stack+0x16/0x19
+ [<c1045a0c>] warn_slowpath_common+0x8c/0xd0
+ [<c12b3740>] ? dma_debug_device_change+0x190/0x1f0
+ [<c12b3740>] ? dma_debug_device_change+0x190/0x1f0
+ [<c1045a83>] warn_slowpath_fmt+0x33/0x40
+ [<c12b3740>] dma_debug_device_change+0x190/0x1f0
+ [<c1065499>] notifier_call_chain+0x59/0x70
+ [<c10655af>] __blocking_notifier_call_chain+0x3f/0x80
+ [<c106560f>] blocking_notifier_call_chain+0x1f/0x30
+ [<c134cfb3>] __device_release_driver+0xc3/0xf0
+ [<c134d0d7>] driver_detach+0x97/0xa0
+ [<c134c440>] bus_remove_driver+0x40/0x90
+ [<c134db18>] driver_unregister+0x28/0x60
+ [<c1079e8c>] ? trace_hardirqs_on_caller+0x12c/0x1d0
+ [<c12c0618>] pci_unregister_driver+0x18/0x80
+ [<f83e96e7>] drm_pci_exit+0x87/0xb0 [drm]
+ [<f8b3be2d>] i915_exit+0x1b/0x1ee [i915]
+ [<c10b999c>] SyS_delete_module+0x14c/0x210
+ [<c1079e8c>] ? trace_hardirqs_on_caller+0x12c/0x1d0
+ [<c115a9bd>] ? ____fput+0xd/0x10
+ [<c1002014>] do_fast_syscall_32+0xa4/0x450
+ [<c149f6fa>] sysenter_past_esp+0x3b/0x5d
+---[ end trace c2ecbc77760f10a0 ]---
+Mapped at:
+ [<c12b3183>] debug_dma_alloc_coherent+0x33/0x90
+ [<f83e989c>] drm_pci_alloc+0x18c/0x1e0 [drm]
+ [<f8acd59f>] intel_init_ring_buffer+0x2af/0x490 [i915]
+ [<f8acd8b0>] intel_init_render_ring_buffer+0x130/0x750 [i915]
+ [<f8aaea4e>] i915_gem_init_rings+0x1e/0x110 [i915]
+
+v2: s/BUG_ON/WARN_ON/ since dim doens't like the former anymore
+
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Fixes: 5c6c600 ("drm/i915: Remove DRI1 ring accessors and API")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> (v1)
+Link: http://patchwork.freedesktop.org/patch/msgid/1452538112-5331-1-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -1901,6 +1901,17 @@ i915_dispatch_execbuffer(struct drm_i915
+ return 0;
+ }
+
++static void cleanup_phys_status_page(struct intel_engine_cs *ring)
++{
++ struct drm_i915_private *dev_priv = to_i915(ring->dev);
++
++ if (!dev_priv->status_page_dmah)
++ return;
++
++ drm_pci_free(ring->dev, dev_priv->status_page_dmah);
++ ring->status_page.page_addr = NULL;
++}
++
+ static void cleanup_status_page(struct intel_engine_cs *ring)
+ {
+ struct drm_i915_gem_object *obj;
+@@ -1917,9 +1928,9 @@ static void cleanup_status_page(struct i
+
+ static int init_status_page(struct intel_engine_cs *ring)
+ {
+- struct drm_i915_gem_object *obj;
++ struct drm_i915_gem_object *obj = ring->status_page.obj;
+
+- if ((obj = ring->status_page.obj) == NULL) {
++ if (obj == NULL) {
+ unsigned flags;
+ int ret;
+
+@@ -2164,7 +2175,7 @@ static int intel_init_ring_buffer(struct
+ if (ret)
+ goto error;
+ } else {
+- BUG_ON(ring->id != RCS);
++ WARN_ON(ring->id != RCS);
+ ret = init_phys_status_page(ring);
+ if (ret)
+ goto error;
+@@ -2210,7 +2221,12 @@ void intel_cleanup_ring_buffer(struct in
+ if (ring->cleanup)
+ ring->cleanup(ring);
+
+- cleanup_status_page(ring);
++ if (I915_NEED_GFX_HWS(ring->dev)) {
++ cleanup_status_page(ring);
++ } else {
++ WARN_ON(ring->id != RCS);
++ cleanup_phys_status_page(ring);
++ }
+
+ i915_cmd_parser_fini_ring(ring);
+ i915_gem_batch_pool_fini(&ring->batch_pool);
--- /dev/null
+From d43f3ebf12f59c57782ec652da65ef61c2662b40 Mon Sep 17 00:00:00 2001
+From: Akash Goel <akash.goel@intel.com>
+Date: Fri, 11 Mar 2016 14:56:42 +0530
+Subject: drm/i915: Fixup the free space logic in ring_prepare
+
+From: Akash Goel <akash.goel@intel.com>
+
+commit d43f3ebf12f59c57782ec652da65ef61c2662b40 upstream.
+
+Currently for the case where there is enough space at the end of Ring
+buffer for accommodating only the base request, the wrapround is done
+immediately and as a result the base request gets added at the start
+of Ring buffer. But there may not be enough free space at the beginning
+to accommodate the base request, as before the wraparound, the wait was
+effectively done for the reserved_size free space from the start of
+Ring buffer. In such a case there is a potential of Ring buffer overflow,
+the instructions at the head of Ring (ACTHD) can get overwritten.
+
+Since the base request can fit in the remaining space, there is no need
+to wraparound immediately. The wraparound will anyway happen later when
+the reserved part starts getting used.
+
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Akash Goel <akash.goel@intel.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: http://patchwork.freedesktop.org/patch/msgid/1457688402-10411-1-git-send-email-akash.goel@intel.com
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+(cherry picked from commit 782f6bc0aba037436d6a04d19b23f8b61020a576)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_lrc.c | 6 +++---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -781,11 +781,11 @@ static int logical_ring_prepare(struct d
+ if (unlikely(total_bytes > remain_usable)) {
+ /*
+ * The base request will fit but the reserved space
+- * falls off the end. So only need to to wait for the
+- * reserved size after flushing out the remainder.
++ * falls off the end. So don't need an immediate wrap
++ * and only need to effectively wait for the reserved
++ * size space from the start of ringbuffer.
+ */
+ wait_bytes = remain_actual + ringbuf->reserved_size;
+- need_wrap = true;
+ } else if (total_bytes > ringbuf->space) {
+ /* No wrapping required, just waiting. */
+ wait_bytes = total_bytes;
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -2390,11 +2390,11 @@ static int __intel_ring_prepare(struct i
+ if (unlikely(total_bytes > remain_usable)) {
+ /*
+ * The base request will fit but the reserved space
+- * falls off the end. So only need to to wait for the
+- * reserved size after flushing out the remainder.
++ * falls off the end. So don't need an immediate wrap
++ * and only need to effectively wait for the reserved
++ * size space from the start of ringbuffer.
+ */
+ wait_bytes = remain_actual + ringbuf->reserved_size;
+- need_wrap = true;
+ } else if (total_bytes > ringbuf->space) {
+ /* No wrapping required, just waiting. */
+ wait_bytes = total_bytes;
--- /dev/null
+From 1b3e885a05d4f0a35dde035724e7c6453d2cbe71 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 13 Apr 2016 17:35:11 +0100
+Subject: drm/i915: Force ringbuffers to not be at offset 0
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 1b3e885a05d4f0a35dde035724e7c6453d2cbe71 upstream.
+
+For reasons unknown Sandybridge GT1 (at least) will eventually hang when
+it encounters a ring wraparound at offset 0. The test case that
+reproduces the bug reliably forces a large number of interrupted context
+switches, thereby causing very frequent ring wraparounds, but there are
+similar bug reports in the wild with the same symptoms, seqno writes
+stop just before the wrap and the ringbuffer at address 0. It is also
+timing crucial, but adding various delays hasn't helped pinpoint where
+the window lies.
+
+Whether the fault is restricted to the ringbuffer itself or the GTT
+addressing is unclear, but moving the ringbuffer fixes all the hangs I
+have been able to reproduce.
+
+References: (e.g.) https://bugs.freedesktop.org/show_bug.cgi?id=93262
+Testcase: igt/gem_exec_whisper/render-contexts-interruptible #snb-gt1
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1460565315-7748-12-git-send-email-chris@chris-wilson.co.uk
+(cherry picked from commit a687a43a48f0f91ba37dce5a14b467258ed6f035)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -2031,10 +2031,12 @@ int intel_pin_and_map_ringbuffer_obj(str
+ {
+ struct drm_i915_private *dev_priv = to_i915(dev);
+ struct drm_i915_gem_object *obj = ringbuf->obj;
++ /* Ring wraparound at offset 0 sometimes hangs. No idea why. */
++ unsigned flags = PIN_OFFSET_BIAS | 4096;
+ int ret;
+
+ if (HAS_LLC(dev_priv) && !obj->stolen) {
+- ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, 0);
++ ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, flags);
+ if (ret)
+ return ret;
+
+@@ -2050,7 +2052,8 @@ int intel_pin_and_map_ringbuffer_obj(str
+ return -ENOMEM;
+ }
+ } else {
+- ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, PIN_MAPPABLE);
++ ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE,
++ flags | PIN_MAPPABLE);
+ if (ret)
+ return ret;
+
--- /dev/null
+From d919161b67b1ed4a374dae685840a601bbeb1347 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 8 Dec 2015 19:59:36 +0200
+Subject: drm/i915: Pass the correct encoder to intel_ddi_clk_select() with MST
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit d919161b67b1ed4a374dae685840a601bbeb1347 upstream.
+
+We're supposed to pass the primary DP encoder to intel_ddi_clk_select(),
+not the fake MST encoder. Do so.
+
+There's no real bug here though, since intel_ddi_clk_select() only
+checks if the encoder type is EDP (which it isn't for either the
+primary DP encoder or the fake MST encoder), and it gets the DDI port
+via intel_ddi_get_encoder_port() (which knows how to do the
+fake->primary->port dance itself).
+
+Fixes: e404ba8 ("drm/i915: Setup DDI clk for MST on SKL")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1449597590-6971-2-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp_mst.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -184,7 +184,7 @@ static void intel_mst_pre_enable_dp(stru
+ intel_mst->port = found->port;
+
+ if (intel_dp->active_mst_links == 0) {
+- intel_ddi_clk_select(encoder, intel_crtc->config);
++ intel_ddi_clk_select(&intel_dig_port->base, intel_crtc->config);
+
+ intel_dp_set_link_params(intel_dp, intel_crtc->config);
+
--- /dev/null
+From a41c8882592fb80458959b10e37632ce030b68ca Mon Sep 17 00:00:00 2001
+From: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Date: Thu, 28 Jan 2016 15:19:23 -0800
+Subject: drm/i915/skl: Fix DMC load on Skylake J0 and K0
+
+From: Mat Martineau <mathew.j.martineau@linux.intel.com>
+
+commit a41c8882592fb80458959b10e37632ce030b68ca upstream.
+
+The driver does not load firmware for unknown steppings, so these new
+steppings must be added to the list.
+
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1454023163-25469-1-git-send-email-mathew.j.martineau@linux.intel.com
+Cc: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_csr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_csr.c
++++ b/drivers/gpu/drm/i915/intel_csr.c
+@@ -177,7 +177,8 @@ static const struct stepping_info kbl_st
+ static const struct stepping_info skl_stepping_info[] = {
+ {'A', '0'}, {'B', '0'}, {'C', '0'},
+ {'D', '0'}, {'E', '0'}, {'F', '0'},
+- {'G', '0'}, {'H', '0'}, {'I', '0'}
++ {'G', '0'}, {'H', '0'}, {'I', '0'},
++ {'J', '0'}, {'K', '0'}
+ };
+
+ static const struct stepping_info bxt_stepping_info[] = {
--- /dev/null
+From 510650e8b2ab965931b35e9813467439d4df0b9c Mon Sep 17 00:00:00 2001
+From: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Date: Tue, 5 Apr 2016 15:56:17 +0300
+Subject: drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs
+
+From: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+
+commit 510650e8b2ab965931b35e9813467439d4df0b9c upstream.
+
+Experiments with heaven 4.0 benchmark and skylake gt3e (rev 0xa)
+suggest that WaForceContextSaveRestoreNonCoherent is needed for all
+revs. Extending this to all revs cures a gpu hang with rev 0xa when
+running heaven4.0 gpu benchmark.
+
+We have been here before, with problems enabling gt4e and extending
+up to revision F0 instead of false claims of bspec of E0 only. See
+commit <e238659ddd88> ("drm/i915/skl: Default to noncoherent access
+up to F0"). In retrospect we should have covered this with this big
+blanket back then already, as E0 vs F0 discrepancy was suspicious
+enough.
+
+Previously the WaForceEnableNonCoherent has been tied to
+context non-coherence, atleast in relevant hsds. So keep this tie
+and extended this alongside.
+
+Cc: Abdiel Janulgue <abdiel.janulgue@linux.intel.com>
+Cc: Ben Widawsky <benjamin.widawsky@intel.com>
+Cc: Timo Aaltonen <tjaalton@ubuntu.com>
+Reported-by: Mike Lothian <mike@fireburn.co.uk>
+References: https://bugs.freedesktop.org/show_bug.cgi?id=93491
+Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
+Reviewed-by: Ben Widawsky <benjamin.widawsky@intel.com>
+Tested-by: Timo Aaltonen <tjaalton@ubuntu.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1459860977-27751-2-git-send-email-mika.kuoppala@intel.com
+(cherry picked from commit 97ea6be161c55dec896b65c95157d953c330ae05)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -951,7 +951,7 @@ static int gen9_init_workarounds(struct
+
+ /* WaForceContextSaveRestoreNonCoherent:skl,bxt */
+ tmp = HDC_FORCE_CONTEXT_SAVE_RESTORE_NON_COHERENT;
+- if (IS_SKL_REVID(dev, SKL_REVID_F0, SKL_REVID_F0) ||
++ if (IS_SKL_REVID(dev, SKL_REVID_F0, REVID_FOREVER) ||
+ IS_BXT_REVID(dev, BXT_REVID_B0, REVID_FOREVER))
+ tmp |= HDC_FORCE_CSR_NON_COHERENT_OVR_DISABLE;
+ WA_SET_BIT_MASKED(HDC_CHICKEN0, tmp);
+@@ -1044,7 +1044,8 @@ static int skl_init_workarounds(struct i
+ WA_SET_BIT_MASKED(HIZ_CHICKEN,
+ BDW_HIZ_POWER_COMPILER_CLOCK_GATING_DISABLE);
+
+- if (IS_SKL_REVID(dev, 0, SKL_REVID_F0)) {
++ /* This is tied to WaForceContextSaveRestoreNonCoherent */
++ if (IS_SKL_REVID(dev, 0, REVID_FOREVER)) {
+ /*
+ *Use Force Non-Coherent whenever executing a 3D context. This
+ * is a workaround for a possible hang in the unlikely event
--- /dev/null
+From fa5a7970d372c9c9beb3a0ce79ee1d0c23387d0a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 15 Oct 2015 17:01:58 +0300
+Subject: drm/i915: skl_update_scaler() wants a rotation bitmask instead of bit number
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit fa5a7970d372c9c9beb3a0ce79ee1d0c23387d0a upstream.
+
+Pass BIT(DRM_ROTATE_0) instead of DRM_ROTATE_0 to skl_update_scaler().
+The former is a mask, the latter just the bit number.
+
+Fortunately the only thing skl_update_scaler() does with the rotation
+is check if it's 90/270 degrees or not, and so in this case it would
+still do the right thing.
+
+Cc: Chandra Konduru <chandra.konduru@intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1444917718-28495-1-git-send-email-ville.syrjala@linux.intel.com
+Fixes: 6156a45602f9 ("drm/i915: skylake primary plane scaling using shared scalers")
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4455,7 +4455,7 @@ int skl_update_scaler_crtc(struct intel_
+ intel_crtc->base.base.id, intel_crtc->pipe, SKL_CRTC_INDEX);
+
+ return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX,
+- &state->scaler_state.scaler_id, DRM_ROTATE_0,
++ &state->scaler_state.scaler_id, BIT(DRM_ROTATE_0),
+ state->pipe_src_w, state->pipe_src_h,
+ adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay);
+ }
--- /dev/null
+From f1ecaf8f9c9924badd4c8f690e39632d31edb500 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 14 Jan 2016 14:53:34 +0200
+Subject: drm/i915: Start WM computation from scratch on ILK-BDW
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit f1ecaf8f9c9924badd4c8f690e39632d31edb500 upstream.
+
+ilk_compute_pipe_wm() assumes as zeroed pipe_wm structure when it
+starts. We used to pass such a zeroed struct in, but this got broken
+when the pipe_wm structure got embedded in the crtc state.
+
+To fix it without too much fuzz, we need to resort to a memset().
+
+Fixes: 4e0963c7663b ("drm/i915: Calculate pipe watermarks into CRTC state (v3)")
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1452776015-22076-1-git-send-email-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_pm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2281,6 +2281,7 @@ static int ilk_compute_pipe_wm(struct in
+ return PTR_ERR(cstate);
+
+ pipe_wm = &cstate->wm.optimal.ilk;
++ memset(pipe_wm, 0, sizeof(*pipe_wm));
+
+ for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+ ps = drm_atomic_get_plane_state(state,
--- /dev/null
+From 31318a922395ec9e78d6e2ddf70779355afc7594 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 14 Apr 2016 14:39:02 +0300
+Subject: drm/i915: Use fw_domains_put_with_fifo() on HSW
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 31318a922395ec9e78d6e2ddf70779355afc7594 upstream.
+
+HSW still has the wake FIFO, so let's check it.
+
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Deepak S <deepak.s@linux.intel.com>
+Fixes: 05a2fb157e44 ("drm/i915: Consolidate forcewake code")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1460633942-24013-1-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
+(cherry picked from commit 3d7d0c85e41afb5a05e98b3a8a72c38357f02594)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_uncore.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_uncore.c
++++ b/drivers/gpu/drm/i915/intel_uncore.c
+@@ -1155,7 +1155,11 @@ static void intel_uncore_fw_domains_init
+ } else if (IS_HASWELL(dev) || IS_BROADWELL(dev)) {
+ dev_priv->uncore.funcs.force_wake_get =
+ fw_domains_get_with_thread_status;
+- dev_priv->uncore.funcs.force_wake_put = fw_domains_put;
++ if (IS_HASWELL(dev))
++ dev_priv->uncore.funcs.force_wake_put =
++ fw_domains_put_with_fifo;
++ else
++ dev_priv->uncore.funcs.force_wake_put = fw_domains_put;
+ fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER,
+ FORCEWAKE_MT, FORCEWAKE_ACK_HSW);
+ } else if (IS_IVYBRIDGE(dev)) {
--- /dev/null
+From d890565c44447db08fd9d07f5b02928a07a88c7e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 14 Jan 2016 14:53:35 +0200
+Subject: drm/i915: Use the active wm config for merging on ILK-BDW
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit d890565c44447db08fd9d07f5b02928a07a88c7e upstream.
+
+ilk_program_watermarks() is supposed to merge the active watermarks from
+all pipes. Thus we need to use the active config too instead of some
+precomputed stuff.
+
+Fixes: aa363136866c ("drm/i915: Calculate watermark configuration during atomic check (v2)")
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1452776015-22076-2-git-send-email-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_pm.c | 32 ++++++++++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3606,23 +3606,43 @@ static void skl_update_wm(struct drm_crt
+ dev_priv->wm.skl_hw = *results;
+ }
+
++static void ilk_compute_wm_config(struct drm_device *dev,
++ struct intel_wm_config *config)
++{
++ struct intel_crtc *crtc;
++
++ /* Compute the currently _active_ config */
++ for_each_intel_crtc(dev, crtc) {
++ const struct intel_pipe_wm *wm = &crtc->wm.active.ilk;
++
++ if (!wm->pipe_enabled)
++ continue;
++
++ config->sprites_enabled |= wm->sprites_enabled;
++ config->sprites_scaled |= wm->sprites_scaled;
++ config->num_pipes_active++;
++ }
++}
++
+ static void ilk_program_watermarks(struct drm_i915_private *dev_priv)
+ {
+ struct drm_device *dev = dev_priv->dev;
+ struct intel_pipe_wm lp_wm_1_2 = {}, lp_wm_5_6 = {}, *best_lp_wm;
+ struct ilk_wm_maximums max;
+- struct intel_wm_config *config = &dev_priv->wm.config;
++ struct intel_wm_config config = {};
+ struct ilk_wm_values results = {};
+ enum intel_ddb_partitioning partitioning;
+
+- ilk_compute_wm_maximums(dev, 1, config, INTEL_DDB_PART_1_2, &max);
+- ilk_wm_merge(dev, config, &max, &lp_wm_1_2);
++ ilk_compute_wm_config(dev, &config);
++
++ ilk_compute_wm_maximums(dev, 1, &config, INTEL_DDB_PART_1_2, &max);
++ ilk_wm_merge(dev, &config, &max, &lp_wm_1_2);
+
+ /* 5/6 split only in single pipe config on IVB+ */
+ if (INTEL_INFO(dev)->gen >= 7 &&
+- config->num_pipes_active == 1 && config->sprites_enabled) {
+- ilk_compute_wm_maximums(dev, 1, config, INTEL_DDB_PART_5_6, &max);
+- ilk_wm_merge(dev, config, &max, &lp_wm_5_6);
++ config.num_pipes_active == 1 && config.sprites_enabled) {
++ ilk_compute_wm_maximums(dev, 1, &config, INTEL_DDB_PART_5_6, &max);
++ ilk_wm_merge(dev, &config, &max, &lp_wm_5_6);
+
+ best_lp_wm = ilk_find_best_result(dev, &lp_wm_1_2, &lp_wm_5_6);
+ } else {
--- /dev/null
+From 221004c66a58949a0f25c937a6789c0839feb530 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Tue, 19 Apr 2016 19:19:11 +0800
+Subject: drm: Loongson-3 doesn't fully support wc memory
+
+From: Huacai Chen <chenhc@lemote.com>
+
+commit 221004c66a58949a0f25c937a6789c0839feb530 upstream.
+
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/drm/drm_cache.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/drm/drm_cache.h
++++ b/include/drm/drm_cache.h
+@@ -39,6 +39,8 @@ static inline bool drm_arch_can_wc_memor
+ {
+ #if defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE)
+ return false;
++#elif defined(CONFIG_MIPS) && defined(CONFIG_CPU_LOONGSON3)
++ return false;
+ #else
+ return true;
+ #endif
--- /dev/null
+From 28dca90533750c7e31e8641c3df426bad9c12941 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Fri, 22 Apr 2016 10:05:21 +1000
+Subject: drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+commit 28dca90533750c7e31e8641c3df426bad9c12941 upstream.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+@@ -1807,6 +1807,8 @@ gf100_gr_init(struct gf100_gr *gr)
+
+ gf100_gr_mmio(gr, gr->func->mmio);
+
++ nvkm_mask(device, TPC_UNIT(0, 0, 0x05c), 0x00000001, 0x00000001);
++
+ memcpy(tpcnr, gr->tpc_nr, sizeof(gr->tpc_nr));
+ for (i = 0, gpc = -1; i < gr->tpc_total; i++) {
+ do {
--- /dev/null
+From bcb31eba4a4ea356fd61cbd5dec5511c3883f57e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 14 Apr 2016 14:15:16 -0400
+Subject: drm/radeon: add a quirk for a XFX R9 270X
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit bcb31eba4a4ea356fd61cbd5dec5511c3883f57e upstream.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=76490
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2931,6 +2931,7 @@ static struct si_dpm_quirk si_dpm_quirk_
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 },
++ { PCI_VENDOR_ID_ATI, 0x6810, 0x1682, 0x9275, 0, 120000 },
+ { 0, 0, 0, 0 },
+ };
+
--- /dev/null
+From 7403c515c49c033fec33df0814fffdc977e6acdc Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 13 Apr 2016 12:08:27 -0400
+Subject: drm/radeon: fix initial connector audio value
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 7403c515c49c033fec33df0814fffdc977e6acdc upstream.
+
+This got lost somewhere along the way. This fixes
+audio not working until set_property was called.
+
+Noticed-by: Hyungwon Hwang <hyungwon.hwang7@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -1996,10 +1996,12 @@ radeon_add_atom_connector(struct drm_dev
+ rdev->mode_info.dither_property,
+ RADEON_FMT_DITHER_DISABLE);
+
+- if (radeon_audio != 0)
++ if (radeon_audio != 0) {
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.audio_property,
+ RADEON_AUDIO_AUTO);
++ radeon_connector->audio = RADEON_AUDIO_AUTO;
++ }
+ if (ASIC_IS_DCE5(rdev))
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.output_csc_property,
+@@ -2124,6 +2126,7 @@ radeon_add_atom_connector(struct drm_dev
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.audio_property,
+ RADEON_AUDIO_AUTO);
++ radeon_connector->audio = RADEON_AUDIO_AUTO;
+ }
+ if (connector_type == DRM_MODE_CONNECTOR_DVII) {
+ radeon_connector->dac_load_detect = true;
+@@ -2179,6 +2182,7 @@ radeon_add_atom_connector(struct drm_dev
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.audio_property,
+ RADEON_AUDIO_AUTO);
++ radeon_connector->audio = RADEON_AUDIO_AUTO;
+ }
+ if (ASIC_IS_DCE5(rdev))
+ drm_object_attach_property(&radeon_connector->base.base,
+@@ -2231,6 +2235,7 @@ radeon_add_atom_connector(struct drm_dev
+ drm_object_attach_property(&radeon_connector->base.base,
+ rdev->mode_info.audio_property,
+ RADEON_AUDIO_AUTO);
++ radeon_connector->audio = RADEON_AUDIO_AUTO;
+ }
+ if (ASIC_IS_DCE5(rdev))
+ drm_object_attach_property(&radeon_connector->base.base,
--- /dev/null
+From 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 Mon Sep 17 00:00:00 2001
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Date: Thu, 14 Apr 2016 13:34:03 -0400
+Subject: drm/radeon: fix vertical bars appear on monitor (v2)
+
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+
+commit 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 upstream.
+
+When crtc/timing is disabled on boot the dig block
+should be stopped in order ignore timing from crtc,
+reset the steering fifo otherwise we get display
+corruption or hung in dp sst mode.
+
+v2: agd: fix coding style
+
+Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 154 ++++++++++++++++++++++++++++++++-
+ drivers/gpu/drm/radeon/evergreen_reg.h | 46 +++++++++
+ 2 files changed, 199 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2608,10 +2608,152 @@ static void evergreen_agp_enable(struct
+ WREG32(VM_CONTEXT1_CNTL, 0);
+ }
+
++static const unsigned ni_dig_offsets[] =
++{
++ NI_DIG0_REGISTER_OFFSET,
++ NI_DIG1_REGISTER_OFFSET,
++ NI_DIG2_REGISTER_OFFSET,
++ NI_DIG3_REGISTER_OFFSET,
++ NI_DIG4_REGISTER_OFFSET,
++ NI_DIG5_REGISTER_OFFSET
++};
++
++static const unsigned ni_tx_offsets[] =
++{
++ NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1,
++ NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1
++};
++
++static const unsigned evergreen_dp_offsets[] =
++{
++ EVERGREEN_DP0_REGISTER_OFFSET,
++ EVERGREEN_DP1_REGISTER_OFFSET,
++ EVERGREEN_DP2_REGISTER_OFFSET,
++ EVERGREEN_DP3_REGISTER_OFFSET,
++ EVERGREEN_DP4_REGISTER_OFFSET,
++ EVERGREEN_DP5_REGISTER_OFFSET
++};
++
++
++/*
++ * Assumption is that EVERGREEN_CRTC_MASTER_EN enable for requested crtc
++ * We go from crtc to connector and it is not relible since it
++ * should be an opposite direction .If crtc is enable then
++ * find the dig_fe which selects this crtc and insure that it enable.
++ * if such dig_fe is found then find dig_be which selects found dig_be and
++ * insure that it enable and in DP_SST mode.
++ * if UNIPHY_PLL_CONTROL1.enable then we should disconnect timing
++ * from dp symbols clocks .
++ */
++static bool evergreen_is_dp_sst_stream_enabled(struct radeon_device *rdev,
++ unsigned crtc_id, unsigned *ret_dig_fe)
++{
++ unsigned i;
++ unsigned dig_fe;
++ unsigned dig_be;
++ unsigned dig_en_be;
++ unsigned uniphy_pll;
++ unsigned digs_fe_selected;
++ unsigned dig_be_mode;
++ unsigned dig_fe_mask;
++ bool is_enabled = false;
++ bool found_crtc = false;
++
++ /* loop through all running dig_fe to find selected crtc */
++ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
++ dig_fe = RREG32(NI_DIG_FE_CNTL + ni_dig_offsets[i]);
++ if (dig_fe & NI_DIG_FE_CNTL_SYMCLK_FE_ON &&
++ crtc_id == NI_DIG_FE_CNTL_SOURCE_SELECT(dig_fe)) {
++ /* found running pipe */
++ found_crtc = true;
++ dig_fe_mask = 1 << i;
++ dig_fe = i;
++ break;
++ }
++ }
++
++ if (found_crtc) {
++ /* loop through all running dig_be to find selected dig_fe */
++ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
++ dig_be = RREG32(NI_DIG_BE_CNTL + ni_dig_offsets[i]);
++ /* if dig_fe_selected by dig_be? */
++ digs_fe_selected = NI_DIG_BE_CNTL_FE_SOURCE_SELECT(dig_be);
++ dig_be_mode = NI_DIG_FE_CNTL_MODE(dig_be);
++ if (dig_fe_mask & digs_fe_selected &&
++ /* if dig_be in sst mode? */
++ dig_be_mode == NI_DIG_BE_DPSST) {
++ dig_en_be = RREG32(NI_DIG_BE_EN_CNTL +
++ ni_dig_offsets[i]);
++ uniphy_pll = RREG32(NI_DCIO_UNIPHY0_PLL_CONTROL1 +
++ ni_tx_offsets[i]);
++ /* dig_be enable and tx is running */
++ if (dig_en_be & NI_DIG_BE_EN_CNTL_ENABLE &&
++ dig_en_be & NI_DIG_BE_EN_CNTL_SYMBCLK_ON &&
++ uniphy_pll & NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE) {
++ is_enabled = true;
++ *ret_dig_fe = dig_fe;
++ break;
++ }
++ }
++ }
++ }
++
++ return is_enabled;
++}
++
++/*
++ * Blank dig when in dp sst mode
++ * Dig ignores crtc timing
++ */
++static void evergreen_blank_dp_output(struct radeon_device *rdev,
++ unsigned dig_fe)
++{
++ unsigned stream_ctrl;
++ unsigned fifo_ctrl;
++ unsigned counter = 0;
++
++ if (dig_fe >= ARRAY_SIZE(evergreen_dp_offsets)) {
++ DRM_ERROR("invalid dig_fe %d\n", dig_fe);
++ return;
++ }
++
++ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++ evergreen_dp_offsets[dig_fe]);
++ if (!(stream_ctrl & EVERGREEN_DP_VID_STREAM_CNTL_ENABLE)) {
++ DRM_ERROR("dig %d , should be enable\n", dig_fe);
++ return;
++ }
++
++ stream_ctrl &=~EVERGREEN_DP_VID_STREAM_CNTL_ENABLE;
++ WREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++ evergreen_dp_offsets[dig_fe], stream_ctrl);
++
++ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++ evergreen_dp_offsets[dig_fe]);
++ while (counter < 32 && stream_ctrl & EVERGREEN_DP_VID_STREAM_STATUS) {
++ msleep(1);
++ counter++;
++ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++ evergreen_dp_offsets[dig_fe]);
++ }
++ if (counter >= 32 )
++ DRM_ERROR("counter exceeds %d\n", counter);
++
++ fifo_ctrl = RREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe]);
++ fifo_ctrl |= EVERGREEN_DP_STEER_FIFO_RESET;
++ WREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe], fifo_ctrl);
++
++}
++
+ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *save)
+ {
+ u32 crtc_enabled, tmp, frame_count, blackout;
+ int i, j;
++ unsigned dig_fe;
+
+ if (!ASIC_IS_NODCE(rdev)) {
+ save->vga_render_control = RREG32(VGA_RENDER_CONTROL);
+@@ -2651,7 +2793,17 @@ void evergreen_mc_stop(struct radeon_dev
+ break;
+ udelay(1);
+ }
+-
++ /*we should disable dig if it drives dp sst*/
++ /*but we are in radeon_device_init and the topology is unknown*/
++ /*and it is available after radeon_modeset_init*/
++ /*the following method radeon_atom_encoder_dpms_dig*/
++ /*does the job if we initialize it properly*/
++ /*for now we do it this manually*/
++ /**/
++ if (ASIC_IS_DCE5(rdev) &&
++ evergreen_is_dp_sst_stream_enabled(rdev, i ,&dig_fe))
++ evergreen_blank_dp_output(rdev, dig_fe);
++ /*we could remove 6 lines below*/
+ /* XXX this is a hack to avoid strange behavior with EFI on certain systems */
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
+ tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
+--- a/drivers/gpu/drm/radeon/evergreen_reg.h
++++ b/drivers/gpu/drm/radeon/evergreen_reg.h
+@@ -250,8 +250,43 @@
+
+ /* HDMI blocks at 0x7030, 0x7c30, 0x10830, 0x11430, 0x12030, 0x12c30 */
+ #define EVERGREEN_HDMI_BASE 0x7030
++/*DIG block*/
++#define NI_DIG0_REGISTER_OFFSET (0x7000 - 0x7000)
++#define NI_DIG1_REGISTER_OFFSET (0x7C00 - 0x7000)
++#define NI_DIG2_REGISTER_OFFSET (0x10800 - 0x7000)
++#define NI_DIG3_REGISTER_OFFSET (0x11400 - 0x7000)
++#define NI_DIG4_REGISTER_OFFSET (0x12000 - 0x7000)
++#define NI_DIG5_REGISTER_OFFSET (0x12C00 - 0x7000)
++
++
++#define NI_DIG_FE_CNTL 0x7000
++# define NI_DIG_FE_CNTL_SOURCE_SELECT(x) ((x) & 0x3)
++# define NI_DIG_FE_CNTL_SYMCLK_FE_ON (1<<24)
++
++
++#define NI_DIG_BE_CNTL 0x7140
++# define NI_DIG_BE_CNTL_FE_SOURCE_SELECT(x) (((x) >> 8 ) & 0x3F)
++# define NI_DIG_FE_CNTL_MODE(x) (((x) >> 16) & 0x7 )
++
++#define NI_DIG_BE_EN_CNTL 0x7144
++# define NI_DIG_BE_EN_CNTL_ENABLE (1 << 0)
++# define NI_DIG_BE_EN_CNTL_SYMBCLK_ON (1 << 8)
++# define NI_DIG_BE_DPSST 0
+
+ /* Display Port block */
++#define EVERGREEN_DP0_REGISTER_OFFSET (0x730C - 0x730C)
++#define EVERGREEN_DP1_REGISTER_OFFSET (0x7F0C - 0x730C)
++#define EVERGREEN_DP2_REGISTER_OFFSET (0x10B0C - 0x730C)
++#define EVERGREEN_DP3_REGISTER_OFFSET (0x1170C - 0x730C)
++#define EVERGREEN_DP4_REGISTER_OFFSET (0x1230C - 0x730C)
++#define EVERGREEN_DP5_REGISTER_OFFSET (0x12F0C - 0x730C)
++
++
++#define EVERGREEN_DP_VID_STREAM_CNTL 0x730C
++# define EVERGREEN_DP_VID_STREAM_CNTL_ENABLE (1 << 0)
++# define EVERGREEN_DP_VID_STREAM_STATUS (1 <<16)
++#define EVERGREEN_DP_STEER_FIFO 0x7310
++# define EVERGREEN_DP_STEER_FIFO_RESET (1 << 0)
+ #define EVERGREEN_DP_SEC_CNTL 0x7280
+ # define EVERGREEN_DP_SEC_STREAM_ENABLE (1 << 0)
+ # define EVERGREEN_DP_SEC_ASP_ENABLE (1 << 4)
+@@ -266,4 +301,15 @@
+ # define EVERGREEN_DP_SEC_N_BASE_MULTIPLE(x) (((x) & 0xf) << 24)
+ # define EVERGREEN_DP_SEC_SS_EN (1 << 28)
+
++/*DCIO_UNIPHY block*/
++#define NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1 (0x6600 -0x6600)
++#define NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1 (0x6640 -0x6600)
++#define NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1 (0x6680 - 0x6600)
++#define NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1 (0x66C0 - 0x6600)
++#define NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1 (0x6700 - 0x6600)
++#define NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1 (0x6740 - 0x6600)
++
++#define NI_DCIO_UNIPHY0_PLL_CONTROL1 0x6618
++# define NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE (1 << 0)
++
+ #endif
--- /dev/null
+From b5dcec693f87cb8475f2291c0075b2422addd3d6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= <jglisse@redhat.com>
+Date: Tue, 19 Apr 2016 09:07:50 -0400
+Subject: drm/radeon: forbid mapping of userptr bo through radeon device file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jérôme Glisse <jglisse@redhat.com>
+
+commit b5dcec693f87cb8475f2291c0075b2422addd3d6 upstream.
+
+Allowing userptr bo which are basicly a list of page from some vma
+(so either anonymous page or file backed page) would lead to serious
+corruption of kernel structures and counters (because we overwrite
+the page->mapping field when mapping buffer).
+
+This will already block if the buffer was populated before anyone does
+try to mmap it because then TTM_PAGE_FLAG_SG would be set in in the
+ttm_tt flags. But that flag is check before ttm_tt_populate in the ttm
+vm fault handler.
+
+So to be safe just add a check to verify_access() callback.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_ttm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -235,6 +235,8 @@ static int radeon_verify_access(struct t
+ {
+ struct radeon_bo *rbo = container_of(bo, struct radeon_bo, tbo);
+
++ if (radeon_ttm_tt_has_userptr(bo->ttm))
++ return -EPERM;
+ return drm_vma_node_verify_access(&rbo->gem_base.vma_node, filp);
+ }
+
--- /dev/null
+From 56fc350224f16901db709cd8cba86bac751aa2a2 Mon Sep 17 00:00:00 2001
+From: Flora Cui <Flora.Cui@amd.com>
+Date: Wed, 20 Apr 2016 10:23:47 +0800
+Subject: drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Flora Cui <Flora.Cui@amd.com>
+
+commit 56fc350224f16901db709cd8cba86bac751aa2a2 upstream.
+
+Fixes the following scenario:
+
+1. Page table bo allocated in vram and linked to man->lru.
+ tbo->list_kref.refcount=2
+2. Page table bo is swapped out and removed from man->lru.
+ tbo->list_kref.refcount=1
+3. Command submission from userspace. Page table bo is moved
+ to vram. ttm_bo_move_to_lru_tail() link it to man->lru and
+ don't increase the kref count.
+
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Flora Cui <Flora.Cui@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_bo.c | 17 ++++-------------
+ 1 file changed, 4 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru);
+
+ void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo)
+ {
+- struct ttm_bo_device *bdev = bo->bdev;
+- struct ttm_mem_type_manager *man;
++ int put_count = 0;
+
+ lockdep_assert_held(&bo->resv->lock.base);
+
+- if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) {
+- list_del_init(&bo->swap);
+- list_del_init(&bo->lru);
+-
+- } else {
+- if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG))
+- list_move_tail(&bo->swap, &bo->glob->swap_lru);
+-
+- man = &bdev->man[bo->mem.mem_type];
+- list_move_tail(&bo->lru, &man->lru);
+- }
++ put_count = ttm_bo_del_from_lru(bo);
++ ttm_bo_list_ref_sub(bo, put_count, true);
++ ttm_bo_add_to_lru(bo);
+ }
+ EXPORT_SYMBOL(ttm_bo_move_to_lru_tail);
+
--- /dev/null
+From c4fc1956fa31003bfbe4f597e359d751568e2954 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Fri, 29 Apr 2016 15:42:25 +0200
+Subject: EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit c4fc1956fa31003bfbe4f597e359d751568e2954 upstream.
+
+Both of these drivers can return NOTIFY_BAD, but this terminates
+processing other callbacks that were registered later on the chain.
+Since the driver did nothing to log the error it seems wrong to prevent
+other interested parties from seeing it. E.g. neither of them had even
+bothered to check the type of the error to see if it was a memory error
+before the return NOTIFY_BAD.
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Acked-by: Aristeu Rozanski <aris@redhat.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/72937355dd92318d2630979666063f8a2853495b.1461864507.git.tony.luck@intel.com
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/i7core_edac.c | 2 +-
+ drivers/edac/sb_edac.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1866,7 +1866,7 @@ static int i7core_mce_check_error(struct
+
+ i7_dev = get_i7core_dev(mce->socketid);
+ if (!i7_dev)
+- return NOTIFY_BAD;
++ return NOTIFY_DONE;
+
+ mci = i7_dev->mci;
+ pvt = mci->pvt_info;
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -3168,7 +3168,7 @@ static int sbridge_mce_check_error(struc
+
+ mci = get_mci_for_node_id(mce->socketid);
+ if (!mci)
+- return NOTIFY_BAD;
++ return NOTIFY_DONE;
+ pvt = mci->pvt_info;
+
+ /*
--- /dev/null
+From 609d5a1b2b35bb62b4b3750396e55453160c2a17 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Wed, 13 Apr 2016 13:59:14 +1000
+Subject: i2c: cpm: Fix build break due to incompatible pointer types
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit 609d5a1b2b35bb62b4b3750396e55453160c2a17 upstream.
+
+Since commit ea8daa7b9784 ("kbuild: Add option to turn incompatible
+pointer check into error"), assignments from an incompatible pointer
+types have become a hard error, eg:
+
+ drivers/i2c/busses/i2c-cpm.c:545:91: error: passing argument 3 of
+ 'dma_alloc_coherent' from incompatible pointer type
+
+Fix the build break by converting txdma & rxdma to dma_addr_t.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: ea8daa7b9784
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-cpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-cpm.c
++++ b/drivers/i2c/busses/i2c-cpm.c
+@@ -116,8 +116,8 @@ struct cpm_i2c {
+ cbd_t __iomem *rbase;
+ u_char *txbuf[CPM_MAXBD];
+ u_char *rxbuf[CPM_MAXBD];
+- u32 txdma[CPM_MAXBD];
+- u32 rxdma[CPM_MAXBD];
++ dma_addr_t txdma[CPM_MAXBD];
++ dma_addr_t rxdma[CPM_MAXBD];
+ };
+
+ static irqreturn_t cpm_i2c_interrupt(int irq, void *dev_id)
--- /dev/null
+From 10ff4c5239a137abfc896ec73ef3d15a0f86a16a Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Sat, 16 Apr 2016 21:14:52 -0400
+Subject: i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+commit 10ff4c5239a137abfc896ec73ef3d15a0f86a16a upstream.
+
+The exynos5 I2C controller driver always prepares and enables a clock
+before using it and then disables unprepares it when the clock is not
+used anymore.
+
+But this can cause a possible ABBA deadlock in some scenarios since a
+driver that uses regmap to access its I2C registers, will first grab
+the regmap lock and then the I2C xfer function will grab the prepare
+lock when preparing the I2C clock. But since the clock driver also
+uses regmap for I2C accesses, preparing a clock will first grab the
+prepare lock and then the regmap lock when using the regmap API.
+
+An example of this happens on the Exynos5422 Odroid XU4 board where a
+s2mps11 PMIC is used and both the s2mps11 regulators and clk drivers
+share the same I2C regmap.
+
+The possible deadlock is reported by the kernel lockdep:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(sec_core:428:(regmap)->lock);
+ lock(prepare_lock);
+ lock(sec_core:428:(regmap)->lock);
+ lock(prepare_lock);
+
+ *** DEADLOCK ***
+
+Fix it by leaving the code prepared on probe and use {en,dis}able in
+the I2C transfer function.
+
+This patch is similar to commit 34e81ad5f0b6 ("i2c: s3c2410: fix ABBA
+deadlock by keeping clock prepared") that fixes the same bug in other
+driver for an I2C controller found in Samsung SoCs.
+
+Reported-by: Anand Moon <linux.amoon@gmail.com>
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Reviewed-by: Anand Moon <linux.amoon@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-exynos5.c | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-exynos5.c
++++ b/drivers/i2c/busses/i2c-exynos5.c
+@@ -671,7 +671,9 @@ static int exynos5_i2c_xfer(struct i2c_a
+ return -EIO;
+ }
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ for (i = 0; i < num; i++, msgs++) {
+ stop = (i == num - 1);
+@@ -695,7 +697,7 @@ static int exynos5_i2c_xfer(struct i2c_a
+ }
+
+ out:
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ return ret;
+ }
+
+@@ -747,7 +749,9 @@ static int exynos5_i2c_probe(struct plat
+ return -ENOENT;
+ }
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_prepare_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ i2c->regs = devm_ioremap_resource(&pdev->dev, mem);
+@@ -799,6 +803,10 @@ static int exynos5_i2c_probe(struct plat
+
+ platform_set_drvdata(pdev, i2c);
+
++ clk_disable(i2c->clk);
++
++ return 0;
++
+ err_clk:
+ clk_disable_unprepare(i2c->clk);
+ return ret;
+@@ -810,6 +818,8 @@ static int exynos5_i2c_remove(struct pla
+
+ i2c_del_adapter(&i2c->adap);
+
++ clk_unprepare(i2c->clk);
++
+ return 0;
+ }
+
+@@ -821,6 +831,8 @@ static int exynos5_i2c_suspend_noirq(str
+
+ i2c->suspended = 1;
+
++ clk_unprepare(i2c->clk);
++
+ return 0;
+ }
+
+@@ -830,7 +842,9 @@ static int exynos5_i2c_resume_noirq(stru
+ struct exynos5_i2c *i2c = platform_get_drvdata(pdev);
+ int ret = 0;
+
+- clk_prepare_enable(i2c->clk);
++ ret = clk_prepare_enable(i2c->clk);
++ if (ret)
++ return ret;
+
+ ret = exynos5_hsi2c_clock_setup(i2c);
+ if (ret) {
+@@ -839,7 +853,7 @@ static int exynos5_i2c_resume_noirq(stru
+ }
+
+ exynos5_i2c_init(i2c);
+- clk_disable_unprepare(i2c->clk);
++ clk_disable(i2c->clk);
+ i2c->suspended = 0;
+
+ return 0;
--- /dev/null
+From 6e1c7d6103fe7031035cec321307c6356809adf4 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 15 Apr 2016 14:06:57 +0300
+Subject: mmc: sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 6e1c7d6103fe7031035cec321307c6356809adf4 upstream.
+
+Baytrail eMMC/SD/SDIO host controllers have been known to
+hang. A change to a hardware setting has been found to
+reduce the occurrence of such hangs. This patch ensures
+the correct setting.
+
+This patch applies cleanly to v4.4+. It could go to
+earlier kernels also, so I will send backports to the
+stable list in due course.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/Kconfig | 1
+ drivers/mmc/host/sdhci-acpi.c | 81 ++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 82 insertions(+)
+
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -97,6 +97,7 @@ config MMC_RICOH_MMC
+ config MMC_SDHCI_ACPI
+ tristate "SDHCI support for ACPI enumerated SDHCI controllers"
+ depends on MMC_SDHCI && ACPI
++ select IOSF_MBI if X86
+ help
+ This selects support for ACPI enumerated SDHCI controllers,
+ identified by ACPI Compatibility ID PNP0D40 or specific
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -41,6 +41,11 @@
+ #include <linux/mmc/pm.h>
+ #include <linux/mmc/slot-gpio.h>
+
++#ifdef CONFIG_X86
++#include <asm/cpu_device_id.h>
++#include <asm/iosf_mbi.h>
++#endif
++
+ #include "sdhci.h"
+
+ enum {
+@@ -146,6 +151,75 @@ static const struct sdhci_acpi_chip sdhc
+ .ops = &sdhci_acpi_ops_int,
+ };
+
++#ifdef CONFIG_X86
++
++static bool sdhci_acpi_byt(void)
++{
++ static const struct x86_cpu_id byt[] = {
++ { X86_VENDOR_INTEL, 6, 0x37 },
++ {}
++ };
++
++ return x86_match_cpu(byt);
++}
++
++#define BYT_IOSF_SCCEP 0x63
++#define BYT_IOSF_OCP_NETCTRL0 0x1078
++#define BYT_IOSF_OCP_TIMEOUT_BASE GENMASK(10, 8)
++
++static void sdhci_acpi_byt_setting(struct device *dev)
++{
++ u32 val = 0;
++
++ if (!sdhci_acpi_byt())
++ return;
++
++ if (iosf_mbi_read(BYT_IOSF_SCCEP, MBI_CR_READ, BYT_IOSF_OCP_NETCTRL0,
++ &val)) {
++ dev_err(dev, "%s read error\n", __func__);
++ return;
++ }
++
++ if (!(val & BYT_IOSF_OCP_TIMEOUT_BASE))
++ return;
++
++ val &= ~BYT_IOSF_OCP_TIMEOUT_BASE;
++
++ if (iosf_mbi_write(BYT_IOSF_SCCEP, MBI_CR_WRITE, BYT_IOSF_OCP_NETCTRL0,
++ val)) {
++ dev_err(dev, "%s write error\n", __func__);
++ return;
++ }
++
++ dev_dbg(dev, "%s completed\n", __func__);
++}
++
++static bool sdhci_acpi_byt_defer(struct device *dev)
++{
++ if (!sdhci_acpi_byt())
++ return false;
++
++ if (!iosf_mbi_available())
++ return true;
++
++ sdhci_acpi_byt_setting(dev);
++
++ return false;
++}
++
++#else
++
++static inline void sdhci_acpi_byt_setting(struct device *dev)
++{
++}
++
++static inline bool sdhci_acpi_byt_defer(struct device *dev)
++{
++ return false;
++}
++
++#endif
++
+ static int bxt_get_cd(struct mmc_host *mmc)
+ {
+ int gpio_cd = mmc_gpio_get_cd(mmc);
+@@ -337,6 +411,9 @@ static int sdhci_acpi_probe(struct platf
+ if (acpi_bus_get_status(device) || !device->status.present)
+ return -ENODEV;
+
++ if (sdhci_acpi_byt_defer(dev))
++ return -EPROBE_DEFER;
++
+ hid = acpi_device_hid(device);
+ uid = device->pnp.unique_id;
+
+@@ -460,6 +537,8 @@ static int sdhci_acpi_resume(struct devi
+ {
+ struct sdhci_acpi_host *c = dev_get_drvdata(dev);
+
++ sdhci_acpi_byt_setting(&c->pdev->dev);
++
+ return sdhci_resume_host(c->host);
+ }
+
+@@ -483,6 +562,8 @@ static int sdhci_acpi_runtime_resume(str
+ {
+ struct sdhci_acpi_host *c = dev_get_drvdata(dev);
+
++ sdhci_acpi_byt_setting(&c->pdev->dev);
++
+ return sdhci_runtime_resume_host(c->host);
+ }
+
--- /dev/null
+From 1342e0b7a6c1a060c593037fbac9f4b717f1cb3b Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Mon, 18 Apr 2016 13:57:48 +0300
+Subject: perf intel-pt: Fix segfault tracing transactions
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 1342e0b7a6c1a060c593037fbac9f4b717f1cb3b upstream.
+
+Tracing a workload that uses transactions gave a seg fault as follows:
+
+ perf record -e intel_pt// workload
+ perf report
+ Program received signal SIGSEGV, Segmentation fault.
+ 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110)
+ at util/intel-pt.c:929
+ 929 ptq->last_branch_rb->nr = 0;
+ (gdb) p ptq->last_branch_rb
+ $1 = (struct branch_stack *) 0x0
+ (gdb) up
+ 1148 intel_pt_reset_last_branch_rb(ptq);
+ (gdb) l
+ 1143 if (ret)
+ 1144 pr_err("Intel Processor Trace: failed to deliver transaction event
+ 1145 ret);
+ 1146
+ 1147 if (pt->synth_opts.callchain)
+ 1148 intel_pt_reset_last_branch_rb(ptq);
+ 1149
+ 1150 return ret;
+ 1151 }
+ 1152
+ (gdb) p pt->synth_opts.callchain
+ $2 = true
+ (gdb)
+ (gdb) bt
+ #0 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110)
+ #1 0x000000000054c1e0 in intel_pt_synth_transaction_sample (ptq=0x1a36110)
+ #2 0x000000000054c5b2 in intel_pt_sample (ptq=0x1a36110)
+
+Caused by checking the 'callchain' flag when it should have been the
+'last_branch' flag. Fix that.
+
+Reported-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Fixes: f14445ee72c5 ("perf intel-pt: Support generating branch stack")
+Link: http://lkml.kernel.org/r/1460977068-11566-1-git-send-email-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/intel-pt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -1127,7 +1127,7 @@ static int intel_pt_synth_transaction_sa
+ pr_err("Intel Processor Trace: failed to deliver transaction event, error %d\n",
+ ret);
+
+- if (pt->synth_opts.callchain)
++ if (pt->synth_opts.last_branch)
+ intel_pt_reset_last_branch_rb(ptq);
+
+ return ret;
--- /dev/null
+From c5857e3f94ab2719dfac649a146cb5dd6f21fcf3 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vz@mleia.com>
+Date: Sun, 6 Mar 2016 03:21:46 +0200
+Subject: pwm: brcmstb: Fix check of devm_ioremap_resource() return code
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+commit c5857e3f94ab2719dfac649a146cb5dd6f21fcf3 upstream.
+
+The change fixes potential oops while accessing iomem on invalid address
+if devm_ioremap_resource() fails due to some reason.
+
+The devm_ioremap_resource() function returns ERR_PTR() and never returns
+NULL, which makes useless a following check for NULL.
+
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Fixes: 3a9f5957020f ("pwm: Add Broadcom BCM7038 PWM controller support")
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pwm/pwm-brcmstb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pwm/pwm-brcmstb.c
++++ b/drivers/pwm/pwm-brcmstb.c
+@@ -274,8 +274,8 @@ static int brcmstb_pwm_probe(struct plat
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ p->base = devm_ioremap_resource(&pdev->dev, res);
+- if (!p->base) {
+- ret = -ENOMEM;
++ if (IS_ERR(p->base)) {
++ ret = PTR_ERR(p->base);
+ goto out_clk;
+ }
+
drm-amdgpu-bump-the-afmt-limit-for-cz-st-polaris.patch
amdgpu-uvd-add-uvd-fw-version-for-amdgpu.patch
drm-amdgpu-fix-regression-on-cik-v2.patch
+drm-radeon-add-a-quirk-for-a-xfx-r9-270x.patch
+drm-radeon-fix-initial-connector-audio-value.patch
+drm-radeon-forbid-mapping-of-userptr-bo-through-radeon-device-file.patch
+drm-radeon-fix-vertical-bars-appear-on-monitor-v2.patch
+drm-loongson-3-doesn-t-fully-support-wc-memory.patch
+drm-nouveau-gr-gf100-select-a-stream-master-to-fixup-tfb-offset-queries.patch
+drm-dp-mst-validate-port-in-drm_dp_payload_send_msg.patch
+drm-dp-mst-restore-primary-hub-guid-on-resume.patch
+drm-dp-mst-get-validated-port-ref-in-drm_dp_update_payload_part1.patch
+pwm-brcmstb-fix-check-of-devm_ioremap_resource-return-code.patch
+drm-i915-pass-the-correct-encoder-to-intel_ddi_clk_select-with-mst.patch
+drm-i915-cleanup-phys-status-page-too.patch
+drm-i915-use-the-active-wm-config-for-merging-on-ilk-bdw.patch
+drm-i915-start-wm-computation-from-scratch-on-ilk-bdw.patch
+drm-i915-skl_update_scaler-wants-a-rotation-bitmask-instead-of-bit-number.patch
+drm-amdkfd-uninitialized-variable-in-dbgdev_wave_control_set_registers.patch
+drm-i915-skl-fix-dmc-load-on-skylake-j0-and-k0.patch
+drm-i915-skl-fix-spurious-gpu-hang-with-gt3-gt4-revs.patch
+drm-i915-fixup-the-free-space-logic-in-ring_prepare.patch
+drm-i915-force-ringbuffers-to-not-be-at-offset-0.patch
+drm-i915-use-fw_domains_put_with_fifo-on-hsw.patch
+drm-ttm-fix-kref-count-mess-in-ttm_bo_move_to_lru_tail.patch
+video-arm-clcd-runtime-check-for-versatile.patch
+perf-intel-pt-fix-segfault-tracing-transactions.patch
+i2c-cpm-fix-build-break-due-to-incompatible-pointer-types.patch
+i2c-exynos5-fix-possible-abba-deadlock-by-keeping-i2c-clock-prepared.patch
+acpica-interpreter-fix-a-regression-triggered-because-of-wrong-linux-ecdt-support.patch
+mmc-sdhci-acpi-reduce-baytrail-emmc-sd-sdio-hangs.patch
+toshiba_acpi-fix-regression-caused-by-hotkey-enabling-value.patch
+edac-i7core-sb_edac-don-t-return-notify_bad-from-mce_decoder-callback.patch
--- /dev/null
+From a30b8f81d9d6fe24eab8a023794548b048f08e3c Mon Sep 17 00:00:00 2001
+From: Azael Avalos <coproscefalo@gmail.com>
+Date: Fri, 22 Apr 2016 09:29:36 -0600
+Subject: toshiba_acpi: Fix regression caused by hotkey enabling value
+
+From: Azael Avalos <coproscefalo@gmail.com>
+
+commit a30b8f81d9d6fe24eab8a023794548b048f08e3c upstream.
+
+Commit 52cbae0127ad ("toshiba_acpi: Change default Hotkey enabling value")
+changed the hotkeys enabling value, as it was the same value Windows uses,
+however, it turns out that the value tells the EC that the driver will now
+take care of the hardware events like the physical RFKill switch or the
+pointing device toggle button.
+
+This patch reverts such commit by changing the default hotkey enabling
+value to 0x09, which enables hotkey events only, making the hardware
+buttons working again.
+
+Fixes bugs 113331 and 114941.
+
+Signed-off-by: Azael Avalos <coproscefalo@gmail.com>
+Signed-off-by: Darren Hart <dvhart@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/toshiba_acpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -133,7 +133,7 @@ MODULE_LICENSE("GPL");
+ /* Field definitions */
+ #define HCI_ACCEL_MASK 0x7fff
+ #define HCI_HOTKEY_DISABLE 0x0b
+-#define HCI_HOTKEY_ENABLE 0x01
++#define HCI_HOTKEY_ENABLE 0x09
+ #define HCI_HOTKEY_SPECIAL_FUNCTIONS 0x10
+ #define HCI_LCD_BRIGHTNESS_BITS 3
+ #define HCI_LCD_BRIGHTNESS_SHIFT (16-HCI_LCD_BRIGHTNESS_BITS)
--- /dev/null
+From f36fdacc5fcdca7b0c0d89f031fcdc89717e0be3 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 23 Feb 2016 11:01:38 +0100
+Subject: video: ARM CLCD: runtime check for Versatile
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit f36fdacc5fcdca7b0c0d89f031fcdc89717e0be3 upstream.
+
+The current compile-time check for inversed IENB/CNTL does not
+work in multiplatform boots: as soon as versatile is included
+in the build, the IENB/CNTL is switched and breaks graphics.
+Convert this to a runtime switch.
+
+Cc: Rob Herring <robh@kernel.org>
+Cc: Russell King <linux@arm.linux.org.uk>
+Fixes: a29da136de34 ("ARM: versatile: convert to multi-platform")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/amba-clcd.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/video/fbdev/amba-clcd.c
++++ b/drivers/video/fbdev/amba-clcd.c
+@@ -440,13 +440,14 @@ static int clcdfb_register(struct clcd_f
+ fb->off_ienb = CLCD_PL111_IENB;
+ fb->off_cntl = CLCD_PL111_CNTL;
+ } else {
+-#ifdef CONFIG_ARCH_VERSATILE
+- fb->off_ienb = CLCD_PL111_IENB;
+- fb->off_cntl = CLCD_PL111_CNTL;
+-#else
+- fb->off_ienb = CLCD_PL110_IENB;
+- fb->off_cntl = CLCD_PL110_CNTL;
+-#endif
++ if (of_machine_is_compatible("arm,versatile-ab") ||
++ of_machine_is_compatible("arm,versatile-pb")) {
++ fb->off_ienb = CLCD_PL111_IENB;
++ fb->off_cntl = CLCD_PL111_CNTL;
++ } else {
++ fb->off_ienb = CLCD_PL110_IENB;
++ fb->off_cntl = CLCD_PL110_CNTL;
++ }
+ }
+
+ fb->clk = clk_get(&fb->dev->dev, NULL);