--- /dev/null
+From 1c4672ce4eeaeaadeea8adabaad21262b7172607 Mon Sep 17 00:00:00 2001
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Date: Tue, 13 Dec 2016 18:57:44 -0200
+Subject: drm/i915: disable PSR by default on HSW/BDW
+
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+
+commit 1c4672ce4eeaeaadeea8adabaad21262b7172607 upstream.
+
+We've been ignoring the poor bugzilla reporters that say PSR causes
+system lockups and all other sorts of problems. The earliest bug
+report is from April, so I think we can use the "revert the offending
+commit if no fixes are presented within 8 months" rule here.
+
+Fixes: 9b58e352b463 ("drm/i915: Enable PSR by default on Haswell and Broadwell.")
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97602
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97515
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96736
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96704
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96569
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=95176
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94985
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Jim Bride <jim.bride@linux.intel.com>
+Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1481662664-18986-1-git-send-email-paulo.r.zanoni@intel.com
+(cherry picked from commit 2ee7dc497e348eecbb82adbb1ea9e9a7e29fe921)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_psr.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+After we merged this, we closed even more fd.o bugs...
+
+--- a/drivers/gpu/drm/i915/intel_psr.c
++++ b/drivers/gpu/drm/i915/intel_psr.c
+@@ -825,13 +825,9 @@ void intel_psr_init(struct drm_device *d
+ dev_priv->psr_mmio_base = IS_HASWELL(dev_priv) ?
+ HSW_EDP_PSR_BASE : BDW_EDP_PSR_BASE;
+
+- /* Per platform default */
+- if (i915.enable_psr == -1) {
+- if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+- i915.enable_psr = 1;
+- else
+- i915.enable_psr = 0;
+- }
++ /* Per platform default: all disabled. */
++ if (i915.enable_psr == -1)
++ i915.enable_psr = 0;
+
+ /* Set link_standby x link_off defaults */
+ if (IS_HASWELL(dev) || IS_BROADWELL(dev))
--- /dev/null
+From 2ef32dee97fcf41987722a37eb6ff1a983915e99 Mon Sep 17 00:00:00 2001
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Date: Tue, 8 Nov 2016 18:22:11 -0200
+Subject: drm/i915/gen9: fix the WM memory bandwidth WA for Y tiling cases
+
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+
+commit 2ef32dee97fcf41987722a37eb6ff1a983915e99 upstream.
+
+The previous spec version said "double Ytile planes minimum lines",
+and I interpreted this as referring to what the spec calls "Y tile
+minimum", but in fact it was referring to what the spec calls "Minimum
+Scanlines for Y tile". I noticed that Mahesh Kumar had a different
+interpretation, so I sent and email to the spec authors and got
+clarification on the correct meaning. Also, BSpec was updated and
+should be clear now.
+
+Fixes: ee3d532fcb64 ("drm/i915/gen9: unconditionally apply the memory bandwidth WA")
+Cc: stable@vger.kernel.org
+Cc: Mahesh Kumar <mahesh1.kumar@intel.com>
+Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1478636531-6081-1-git-send-email-paulo.r.zanoni@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_pm.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3617,6 +3617,9 @@ static int skl_compute_plane_wm(const st
+ y_min_scanlines = 4;
+ }
+
++ if (apply_memory_bw_wa)
++ y_min_scanlines *= 2;
++
+ plane_bytes_per_line = width * cpp;
+ if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
+ fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
+@@ -3637,8 +3640,6 @@ static int skl_compute_plane_wm(const st
+ plane_blocks_per_line);
+
+ y_tile_minimum = plane_blocks_per_line * y_min_scanlines;
+- if (apply_memory_bw_wa)
+- y_tile_minimum *= 2;
+
+ if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
+ fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
--- /dev/null
+From ee3d532fcb64872bc20be0ee58f7afdb9fa82abe Mon Sep 17 00:00:00 2001
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Date: Tue, 11 Oct 2016 15:25:38 -0300
+Subject: drm/i915/gen9: unconditionally apply the memory bandwidth WA
+
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+
+commit ee3d532fcb64872bc20be0ee58f7afdb9fa82abe upstream.
+
+Mahesh Kumar is already working on a proper implementation for the
+workaround, but while we still don't have it, let's just
+unconditionally apply the workaround for everybody and we hope we can
+close all those numerous bugzilla tickets. Also, I'm not sure how easy
+it will be to backport the final implementation to the stable Kernels,
+and this patch here is probably easier to backport.
+
+At the present moment I still don't have confirmation that this patch
+fixes any of the bugs listed below, but we should definitely try
+testing all of them again.
+
+v2: s/intel_needs_memory_bw_wa/skl_needs_memory_bw_wa/ (Lyude).
+v3: Rebase (dev -> dev_priv change on ilk_wm_max_level).
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94337
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94605
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94884
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=95010
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96226
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96828
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97450
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97830
+Cc: Mahesh Kumar <mahesh1.kumar@intel.com>
+Cc: Lyude <cpaul@redhat.com>
+Cc: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Reviewed-by: Lyude <cpaul@redhat.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1476210338-9797-1-git-send-email-paulo.r.zanoni@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_pm.c | 49 +++++++++++++++++++++++++++++++++-------
+ 1 file changed, 41 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2879,6 +2879,21 @@ skl_wm_plane_id(const struct intel_plane
+ }
+ }
+
++/*
++ * FIXME: We still don't have the proper code detect if we need to apply the WA,
++ * so assume we'll always need it in order to avoid underruns.
++ */
++static bool skl_needs_memory_bw_wa(struct intel_atomic_state *state)
++{
++ struct drm_i915_private *dev_priv = to_i915(state->base.dev);
++
++ if (IS_SKYLAKE(dev_priv) || IS_BROXTON(dev_priv) ||
++ IS_KABYLAKE(dev_priv))
++ return true;
++
++ return false;
++}
++
+ static bool
+ intel_has_sagv(struct drm_i915_private *dev_priv)
+ {
+@@ -2999,9 +3014,10 @@ bool intel_can_enable_sagv(struct drm_at
+ struct drm_device *dev = state->dev;
+ struct drm_i915_private *dev_priv = to_i915(dev);
+ struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
+- struct drm_crtc *crtc;
++ struct intel_crtc *crtc;
++ struct intel_plane *plane;
+ enum pipe pipe;
+- int level, plane;
++ int level, id, latency;
+
+ if (!intel_has_sagv(dev_priv))
+ return false;
+@@ -3019,27 +3035,36 @@ bool intel_can_enable_sagv(struct drm_at
+
+ /* Since we're now guaranteed to only have one active CRTC... */
+ pipe = ffs(intel_state->active_crtcs) - 1;
+- crtc = dev_priv->pipe_to_crtc_mapping[pipe];
++ crtc = to_intel_crtc(dev_priv->pipe_to_crtc_mapping[pipe]);
+
+- if (crtc->state->mode.flags & DRM_MODE_FLAG_INTERLACE)
++ if (crtc->base.state->mode.flags & DRM_MODE_FLAG_INTERLACE)
+ return false;
+
+- for_each_plane(dev_priv, pipe, plane) {
++ for_each_intel_plane_on_crtc(dev, crtc, plane) {
++ id = skl_wm_plane_id(plane);
++
+ /* Skip this plane if it's not enabled */
+- if (intel_state->wm_results.plane[pipe][plane][0] == 0)
++ if (intel_state->wm_results.plane[pipe][id][0] == 0)
+ continue;
+
+ /* Find the highest enabled wm level for this plane */
+ for (level = ilk_wm_max_level(dev);
+- intel_state->wm_results.plane[pipe][plane][level] == 0; --level)
++ intel_state->wm_results.plane[pipe][id][level] == 0; --level)
+ { }
+
++ latency = dev_priv->wm.skl_latency[level];
++
++ if (skl_needs_memory_bw_wa(intel_state) &&
++ plane->base.state->fb->modifier[0] ==
++ I915_FORMAT_MOD_X_TILED)
++ latency += 15;
++
+ /*
+ * If any of the planes on this pipe don't enable wm levels
+ * that incur memory latencies higher then 30µs we can't enable
+ * the SAGV
+ */
+- if (dev_priv->wm.skl_latency[level] < SKL_SAGV_BLOCK_TIME)
++ if (latency < SKL_SAGV_BLOCK_TIME)
+ return false;
+ }
+
+@@ -3549,12 +3574,18 @@ static int skl_compute_plane_wm(const st
+ uint32_t width = 0, height = 0;
+ uint32_t plane_pixel_rate;
+ uint32_t y_tile_minimum, y_min_scanlines;
++ struct intel_atomic_state *state =
++ to_intel_atomic_state(cstate->base.state);
++ bool apply_memory_bw_wa = skl_needs_memory_bw_wa(state);
+
+ if (latency == 0 || !cstate->base.active || !intel_pstate->base.visible) {
+ *enabled = false;
+ return 0;
+ }
+
++ if (apply_memory_bw_wa && fb->modifier[0] == I915_FORMAT_MOD_X_TILED)
++ latency += 15;
++
+ width = drm_rect_width(&intel_pstate->base.src) >> 16;
+ height = drm_rect_height(&intel_pstate->base.src) >> 16;
+
+@@ -3606,6 +3637,8 @@ static int skl_compute_plane_wm(const st
+ plane_blocks_per_line);
+
+ y_tile_minimum = plane_blocks_per_line * y_min_scanlines;
++ if (apply_memory_bw_wa)
++ y_tile_minimum *= 2;
+
+ if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
+ fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
--- /dev/null
+From 4349bd775cc8fd75cb648e3a2036a690f497de5c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Thu, 27 Oct 2016 15:37:44 +0900
+Subject: drm/radeon: Always store CRTC relative radeon_crtc->cursor_x/y values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <michel.daenzer@amd.com>
+
+commit 4349bd775cc8fd75cb648e3a2036a690f497de5c upstream.
+
+We were storing viewport relative coordinates for AVIVO/DCE display
+engines. However, radeon_crtc_cursor_set2 and radeon_cursor_reset pass
+radeon_crtc->cursor_x/y as the x/y parameters of
+radeon_cursor_move_locked, which would break if the CRTC isn't located
+at (0, 0).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_cursor.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_cursor.c
++++ b/drivers/gpu/drm/radeon/radeon_cursor.c
+@@ -146,6 +146,9 @@ static int radeon_cursor_move_locked(str
+ int xorigin = 0, yorigin = 0;
+ int w = radeon_crtc->cursor_width;
+
++ radeon_crtc->cursor_x = x;
++ radeon_crtc->cursor_y = y;
++
+ if (ASIC_IS_AVIVO(rdev)) {
+ /* avivo cursor are offset into the total surface */
+ x += crtc->x;
+@@ -240,9 +243,6 @@ static int radeon_cursor_move_locked(str
+ yorigin * 256);
+ }
+
+- radeon_crtc->cursor_x = x;
+- radeon_crtc->cursor_y = y;
+-
+ if (radeon_crtc->cursor_out_of_bounds) {
+ radeon_crtc->cursor_out_of_bounds = false;
+ if (radeon_crtc->cursor_bo)
powerpc-pci-rpadlpar-fix-device-reference-leaks.patch
s390-topology-always-use-s390-specific-sched_domain_topology_level.patch
s390-pci-fix-dma-address-calculation-in-map_sg.patch
+drm-radeon-always-store-crtc-relative-radeon_crtc-cursor_x-y-values.patch
+drm-i915-disable-psr-by-default-on-hsw-bdw.patch
+drm-i915-gen9-unconditionally-apply-the-memory-bandwidth-wa.patch
+drm-i915-gen9-fix-the-wm-memory-bandwidth-wa-for-y-tiling-cases.patch
+tpm_tis-check-return-values-from-get_burstcount.patch
--- /dev/null
+From 26a137e31ffe6fbfdb008554a8d9b3d55bd5c86e Mon Sep 17 00:00:00 2001
+From: Josh Zimmerman <joshz@google.com>
+Date: Thu, 27 Oct 2016 14:50:09 -0700
+Subject: tpm_tis: Check return values from get_burstcount.
+
+From: Josh Zimmerman <joshz@google.com>
+
+commit 26a137e31ffe6fbfdb008554a8d9b3d55bd5c86e upstream.
+
+If the TPM we're connecting to uses a static burst count, it will report
+a burst count of zero throughout the response read. However, get_burstcount
+assumes that a response of zero indicates that the TPM is not ready to
+receive more data. In this case, it returns a negative error code, which
+is passed on to tpm_tis_{write,read}_bytes as a u16, causing
+them to read/write far too many bytes.
+
+This patch checks for negative return codes and bails out from recv_data
+and tpm_tis_send_data.
+
+Fixes: 1107d065fdf1 (tpm_tis: Introduce intermediate layer for TPM access)
+Signed-off-by: Josh Zimmerman <joshz@google.com>
+Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/char/tpm/tpm_tis_core.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -185,7 +185,12 @@ static int recv_data(struct tpm_chip *ch
+ TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+ chip->timeout_c,
+ &priv->read_queue, true) == 0) {
+- burstcnt = min_t(int, get_burstcount(chip), count - size);
++ burstcnt = get_burstcount(chip);
++ if (burstcnt < 0) {
++ dev_err(&chip->dev, "Unable to read burstcount\n");
++ return burstcnt;
++ }
++ burstcnt = min_t(int, burstcnt, count - size);
+
+ rc = tpm_tis_read_bytes(priv, TPM_DATA_FIFO(priv->locality),
+ burstcnt, buf + size);
+@@ -271,7 +276,13 @@ static int tpm_tis_send_data(struct tpm_
+ }
+
+ while (count < len - 1) {
+- burstcnt = min_t(int, get_burstcount(chip), len - count - 1);
++ burstcnt = get_burstcount(chip);
++ if (burstcnt < 0) {
++ dev_err(&chip->dev, "Unable to read burstcount\n");
++ rc = burstcnt;
++ goto out_err;
++ }
++ burstcnt = min_t(int, burstcnt, len - count - 1);
+ rc = tpm_tis_write_bytes(priv, TPM_DATA_FIFO(priv->locality),
+ burstcnt, buf + count);
+ if (rc < 0)