--- /dev/null
+From e4d9e513dedb5ac4e166c1053314fa935ddecc8c Mon Sep 17 00:00:00 2001
+From: Mengdong Lin <mengdong.lin@intel.com>
+Date: Thu, 3 Jul 2014 17:02:23 +0800
+Subject: ALSA: hda - restore BCLK M/N value as per CDCLK for HSW/BDW display HDA controller
+
+From: Mengdong Lin <mengdong.lin@intel.com>
+
+commit e4d9e513dedb5ac4e166c1053314fa935ddecc8c upstream.
+
+For HSW/BDW display HD-A controller, hda_set_bclk() is defined to set BCLK
+by programming the M/N values as per the core display clock (CDCLK) queried from
+i915 display driver.
+
+And the audio driver will also set BCLK in azx_first_init() since the display
+driver can turn off the shared power in boot phase if only eDP is connected
+and M/N values will be lost and must be reprogrammed.
+
+Signed-off-by: Mengdong Lin <mengdong.lin@intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_i915.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++
+ sound/pci/hda/hda_i915.h | 2 +
+ sound/pci/hda/hda_intel.c | 50 +++++++----------------------------------
+ 3 files changed, 66 insertions(+), 41 deletions(-)
+
+--- a/sound/pci/hda/hda_i915.c
++++ b/sound/pci/hda/hda_i915.c
+@@ -20,10 +20,20 @@
+ #include <linux/module.h>
+ #include <sound/core.h>
+ #include <drm/i915_powerwell.h>
++#include "hda_priv.h"
+ #include "hda_i915.h"
+
++/* Intel HSW/BDW display HDA controller Extended Mode registers.
++ * EM4 (M value) and EM5 (N Value) are used to convert CDClk (Core Display
++ * Clock) to 24MHz BCLK: BCLK = CDCLK * M / N
++ * The values will be lost when the display power well is disabled.
++ */
++#define ICH6_REG_EM4 0x100c
++#define ICH6_REG_EM5 0x1010
++
+ static int (*get_power)(void);
+ static int (*put_power)(void);
++static int (*get_cdclk)(void);
+
+ int hda_display_power(bool enable)
+ {
+@@ -38,6 +48,43 @@ int hda_display_power(bool enable)
+ return put_power();
+ }
+
++void haswell_set_bclk(struct azx *chip)
++{
++ int cdclk_freq;
++ unsigned int bclk_m, bclk_n;
++
++ if (!get_cdclk)
++ return;
++
++ cdclk_freq = get_cdclk();
++ switch (cdclk_freq) {
++ case 337500:
++ bclk_m = 16;
++ bclk_n = 225;
++ break;
++
++ case 450000:
++ default: /* default CDCLK 450MHz */
++ bclk_m = 4;
++ bclk_n = 75;
++ break;
++
++ case 540000:
++ bclk_m = 4;
++ bclk_n = 90;
++ break;
++
++ case 675000:
++ bclk_m = 8;
++ bclk_n = 225;
++ break;
++ }
++
++ azx_writew(chip, EM4, bclk_m);
++ azx_writew(chip, EM5, bclk_n);
++}
++
++
+ int hda_i915_init(void)
+ {
+ int err = 0;
+@@ -55,6 +102,10 @@ int hda_i915_init(void)
+ return -ENODEV;
+ }
+
++ get_cdclk = symbol_request(i915_get_cdclk_freq);
++ if (!get_cdclk) /* may have abnormal BCLK and audio playback rate */
++ pr_warn("hda-i915: get_cdclk symbol get fail\n");
++
+ pr_debug("HDA driver get symbol successfully from i915 module\n");
+
+ return err;
+@@ -70,6 +121,10 @@ int hda_i915_exit(void)
+ symbol_put(i915_release_power_well);
+ put_power = NULL;
+ }
++ if (get_cdclk) {
++ symbol_put(i915_get_cdclk_freq);
++ get_cdclk = NULL;
++ }
+
+ return 0;
+ }
+--- a/sound/pci/hda/hda_i915.h
++++ b/sound/pci/hda/hda_i915.h
+@@ -18,10 +18,12 @@
+
+ #ifdef CONFIG_SND_HDA_I915
+ int hda_display_power(bool enable);
++void haswell_set_bclk(struct azx *chip);
+ int hda_i915_init(void);
+ int hda_i915_exit(void);
+ #else
+ static inline int hda_display_power(bool enable) { return 0; }
++static inline void haswell_set_bclk(struct azx *chip) { return; }
+ static inline int hda_i915_init(void)
+ {
+ return -ENODEV;
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -62,9 +62,9 @@
+ #include <linux/vga_switcheroo.h>
+ #include <linux/firmware.h>
+ #include "hda_codec.h"
+-#include "hda_i915.h"
+ #include "hda_controller.h"
+ #include "hda_priv.h"
++#include "hda_i915.h"
+
+
+ static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
+@@ -282,21 +282,8 @@ static char *driver_short_names[] = {
+ [AZX_DRIVER_GENERIC] = "HD-Audio Generic",
+ };
+
+-
+-/* Intel HSW/BDW display HDA controller Extended Mode registers.
+- * EM4 (M value) and EM5 (N Value) are used to convert CDClk (Core Display
+- * Clock) to 24MHz BCLK: BCLK = CDCLK * M / N
+- * The values will be lost when the display power well is disabled.
+- */
+-#define ICH6_REG_EM4 0x100c
+-#define ICH6_REG_EM5 0x1010
+-
+ struct hda_intel {
+ struct azx chip;
+-
+- /* HSW/BDW display HDA controller to restore BCLK from CDCLK */
+- unsigned int bclk_m;
+- unsigned int bclk_n;
+ };
+
+
+@@ -592,22 +579,6 @@ static int param_set_xint(const char *va
+ #define azx_del_card_list(chip) /* NOP */
+ #endif /* CONFIG_PM */
+
+-static void haswell_save_bclk(struct azx *chip)
+-{
+- struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
+-
+- hda->bclk_m = azx_readw(chip, EM4);
+- hda->bclk_n = azx_readw(chip, EM5);
+-}
+-
+-static void haswell_restore_bclk(struct azx *chip)
+-{
+- struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
+-
+- azx_writew(chip, EM4, hda->bclk_m);
+- azx_writew(chip, EM5, hda->bclk_n);
+-}
+-
+ #if defined(CONFIG_PM_SLEEP) || defined(SUPPORT_VGA_SWITCHEROO)
+ /*
+ * power management
+@@ -635,12 +606,6 @@ static int azx_suspend(struct device *de
+ chip->irq = -1;
+ }
+
+- /* Save BCLK M/N values before they become invalid in D3.
+- * Will test if display power well can be released now.
+- */
+- if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+- haswell_save_bclk(chip);
+-
+ if (chip->msi)
+ pci_disable_msi(chip->pci);
+ pci_disable_device(pci);
+@@ -662,7 +627,7 @@ static int azx_resume(struct device *dev
+
+ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
+ hda_display_power(true);
+- haswell_restore_bclk(chip);
++ haswell_set_bclk(chip);
+ }
+ pci_set_power_state(pci, PCI_D0);
+ pci_restore_state(pci);
+@@ -707,10 +672,9 @@ static int azx_runtime_suspend(struct de
+ azx_stop_chip(chip);
+ azx_enter_link_reset(chip);
+ azx_clear_irq_pending(chip);
+- if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
+- haswell_save_bclk(chip);
++ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+ hda_display_power(false);
+- }
++
+ return 0;
+ }
+
+@@ -730,7 +694,7 @@ static int azx_runtime_resume(struct dev
+
+ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
+ hda_display_power(true);
+- haswell_restore_bclk(chip);
++ haswell_set_bclk(chip);
+ }
+
+ /* Read STATESTS before controller reset */
+@@ -1426,6 +1390,10 @@ static int azx_first_init(struct azx *ch
+
+ /* initialize chip */
+ azx_init_pci(chip);
++
++ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
++ haswell_set_bclk(chip);
++
+ azx_init_chip(chip, (probe_only[dev] & 2) == 0);
+
+ /* codec detection */
--- /dev/null
+From e694788d73efe139b24f78b036deb97fe57fa8cb Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Tue, 10 Jun 2014 09:54:24 +0300
+Subject: Bluetooth: Fix check for connection encryption
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit e694788d73efe139b24f78b036deb97fe57fa8cb upstream.
+
+The conn->link_key variable tracks the type of link key in use. It is
+set whenever we respond to a link key request as well as when we get a
+link key notification event.
+
+These two events do not however always guarantee that encryption is
+enabled: getting a link key request and responding to it may only mean
+that the remote side has requested authentication but not encryption. On
+the other hand, the encrypt change event is a certain guarantee that
+encryption is enabled. The real encryption state is already tracked in
+the conn->link_mode variable through the HCI_LM_ENCRYPT bit.
+
+This patch fixes a check for encryption in the hci_conn_auth function to
+use the proper conn->link_mode value and thereby eliminates the chance
+of a false positive result.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_conn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -821,7 +821,7 @@ static int hci_conn_auth(struct hci_conn
+ /* If we're already encrypted set the REAUTH_PEND flag,
+ * otherwise set the ENCRYPT_PEND.
+ */
+- if (conn->key_type != 0xff)
++ if (conn->link_mode & HCI_LM_ENCRYPT)
+ set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
+ else
+ set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
--- /dev/null
+From b62b65055bcc5372d5c3f4103629176cb8db3678 Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Thu, 5 Jun 2014 12:19:54 +0300
+Subject: Bluetooth: Fix incorrectly overriding conn->src_type
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit b62b65055bcc5372d5c3f4103629176cb8db3678 upstream.
+
+The src_type member of struct hci_conn should always reflect the address
+type of the src_member. It should never be overridden. There is already
+code in place in the command status handler of HCI_LE_Create_Connection
+to copy the right initiator address into conn->init_addr_type.
+
+Without this patch, if privacy is enabled, we will send the wrong
+address type in the SMP identity address information PDU (it'll e.g.
+contain our public address but a random address type).
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_conn.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -584,11 +584,6 @@ static void hci_req_add_le_create_conn(s
+ if (hci_update_random_address(req, false, &own_addr_type))
+ return;
+
+- /* Save the address type used for this connnection attempt so we able
+- * to retrieve this information if we need it.
+- */
+- conn->src_type = own_addr_type;
+-
+ cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
+ cp.scan_window = cpu_to_le16(hdev->le_scan_window);
+ bacpy(&cp.peer_addr, &conn->dst);
--- /dev/null
+From 50143a433b70e3145bcf8a4a4e54f0c11bdee32b Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Tue, 10 Jun 2014 14:05:57 +0300
+Subject: Bluetooth: Fix indicating discovery state when canceling inquiry
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit 50143a433b70e3145bcf8a4a4e54f0c11bdee32b upstream.
+
+When inquiry is canceled through the HCI_Cancel_Inquiry command there is
+no Inquiry Complete event generated. Instead, all we get is the command
+complete for the HCI_Inquiry_Cancel command. This means that we must
+call the hci_discovery_set_state() function from the respective command
+complete handler in order to ensure that user space knows the correct
+discovery state.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_event.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -48,6 +48,10 @@ static void hci_cc_inquiry_cancel(struct
+ smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
+ wake_up_bit(&hdev->flags, HCI_INQUIRY);
+
++ hci_dev_lock(hdev);
++ hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
++ hci_dev_unlock(hdev);
++
+ hci_conn_check_pending(hdev);
+ }
+
--- /dev/null
+From ba15a58b179ed76a7e887177f2b06de12c58ec8f Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Mon, 9 Jun 2014 13:58:14 +0300
+Subject: Bluetooth: Fix SSP acceptor just-works confirmation without MITM
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit ba15a58b179ed76a7e887177f2b06de12c58ec8f upstream.
+
+From the Bluetooth Core Specification 4.1 page 1958:
+
+"if both devices have set the Authentication_Requirements parameter to
+one of the MITM Protection Not Required options, authentication stage 1
+shall function as if both devices set their IO capabilities to
+DisplayOnly (e.g., Numeric comparison with automatic confirmation on
+both devices)"
+
+So far our implementation has done user confirmation for all just-works
+cases regardless of the MITM requirements, however following the
+specification to the word means that we should not be doing confirmation
+when neither side has the MITM flag set.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Tested-by: Szymon Janc <szymon.janc@tieto.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_event.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3503,8 +3503,11 @@ static void hci_user_confirm_request_evt
+
+ /* If we're not the initiators request authorization to
+ * proceed from user space (mgmt_user_confirm with
+- * confirm_hint set to 1). */
+- if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
++ * confirm_hint set to 1). The exception is if neither
++ * side had MITM in which case we do auto-accept.
++ */
++ if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
++ (loc_mitm || rem_mitm)) {
+ BT_DBG("Confirming auto-accept as acceptor");
+ confirm_hint = 1;
+ goto confirm;
--- /dev/null
+From 1539fb9bd405ee32282ea0a38404f9e008ac5b7a Mon Sep 17 00:00:00 2001
+From: Zhaowei Yuan <zhaowei.yuan@samsung.com>
+Date: Wed, 18 Jun 2014 14:33:59 +0800
+Subject: drm: fix NULL pointer access by wrong ioctl
+
+From: Zhaowei Yuan <zhaowei.yuan@samsung.com>
+
+commit 1539fb9bd405ee32282ea0a38404f9e008ac5b7a upstream.
+
+If user uses wrong ioctl command with _IOC_NONE and argument size
+greater than 0, it can cause NULL pointer access from memset of line
+463. If _IOC_NONE, don't memset to 0 for kdata.
+
+Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
+Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -419,8 +419,9 @@ long drm_ioctl(struct file *filp,
+ retcode = -EFAULT;
+ goto err_i1;
+ }
+- } else
++ } else if (cmd & IOC_OUT) {
+ memset(kdata, 0, usize);
++ }
+
+ if (ioctl->flags & DRM_UNLOCKED)
+ retcode = func(dev, kdata, file_priv);
--- /dev/null
+From 2e48cecb55435e10c93c6aface1a1c7ef32f4e71 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:03 -0300
+Subject: drm/i2c: tda998x: move drm_i2c_encoder_destroy call
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit 2e48cecb55435e10c93c6aface1a1c7ef32f4e71 upstream.
+
+Currently tda998x_encoder_destroy() calls cec_write() and reg_clear(),
+as part of the release procedure. Such calls need to access the I2C bus
+and therefore, we need to call them before drm_i2c_encoder_destroy()
+which unregisters the I2C device.
+
+This commit moves the latter so it's done afterwards.
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Signed-off-by: Ezequiel García <ezequiel@vanguardiasur.com.ar>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i2c/tda998x_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i2c/tda998x_drv.c
++++ b/drivers/gpu/drm/i2c/tda998x_drv.c
+@@ -1183,7 +1183,6 @@ static void
+ tda998x_encoder_destroy(struct drm_encoder *encoder)
+ {
+ struct tda998x_priv *priv = to_tda998x_priv(encoder);
+- drm_i2c_encoder_destroy(encoder);
+
+ /* disable all IRQs and free the IRQ handler */
+ cec_write(priv, REG_CEC_RXSHPDINTENA, 0);
+@@ -1193,6 +1192,7 @@ tda998x_encoder_destroy(struct drm_encod
+
+ if (priv->cec)
+ i2c_unregister_device(priv->cec);
++ drm_i2c_encoder_destroy(encoder);
+ kfree(priv);
+ }
+
--- /dev/null
+From c149dcb5c60bfea8871f16dfcc0690255eeb825f Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Fri, 4 Jul 2014 10:00:37 +0800
+Subject: drm/i915: provide interface for audio driver to query cdclk
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit c149dcb5c60bfea8871f16dfcc0690255eeb825f upstream.
+
+For Haswell and Broadwell, if the display power well has been disabled,
+the display audio controller divider values EM4 M VALUE and EM5 N VALUE
+will have been lost. The CDCLK frequency is required for reprogramming them
+to generate 24MHz HD-A link BCLK. So provide a private interface for the
+audio driver to query CDCLK.
+
+This is a stopgap solution until a more generic interface between audio
+and display drivers has been implemented.
+
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Damien Lespiau <damien.lespiau@intel.com>
+Signed-off-by: Mengdong Lin <mengdong.lin@intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_pm.c | 21 +++++++++++++++++++++
+ include/drm/i915_powerwell.h | 1 +
+ 2 files changed, 22 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -5734,6 +5734,27 @@ int i915_release_power_well(void)
+ }
+ EXPORT_SYMBOL_GPL(i915_release_power_well);
+
++/*
++ * Private interface for the audio driver to get CDCLK in kHz.
++ *
++ * Caller must request power well using i915_request_power_well() prior to
++ * making the call.
++ */
++int i915_get_cdclk_freq(void)
++{
++ struct drm_i915_private *dev_priv;
++
++ if (!hsw_pwr)
++ return -ENODEV;
++
++ dev_priv = container_of(hsw_pwr, struct drm_i915_private,
++ power_domains);
++
++ return intel_ddi_get_cdclk_freq(dev_priv);
++}
++EXPORT_SYMBOL_GPL(i915_get_cdclk_freq);
++
++
+ #define POWER_DOMAIN_MASK (BIT(POWER_DOMAIN_NUM) - 1)
+
+ #define HSW_ALWAYS_ON_POWER_DOMAINS ( \
+--- a/include/drm/i915_powerwell.h
++++ b/include/drm/i915_powerwell.h
+@@ -32,5 +32,6 @@
+ /* For use by hda_i915 driver */
+ extern int i915_request_power_well(void);
+ extern int i915_release_power_well(void);
++extern int i915_get_cdclk_freq(void);
+
+ #endif /* _I915_POWERWELL_H_ */
--- /dev/null
+From eee73b46261325eb140d899b5371f49b02d88f63 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 10 Jun 2014 12:09:29 +0100
+Subject: drm/i95: Initialize active ring->pid to -1
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit eee73b46261325eb140d899b5371f49b02d88f63 upstream.
+
+Otherwise we print out spurious processes on unused rings in the error
+state.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gpu_error.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_gpu_error.c
++++ b/drivers/gpu/drm/i915/i915_gpu_error.c
+@@ -894,6 +894,8 @@ static void i915_gem_record_rings(struct
+ for (i = 0; i < I915_NUM_RINGS; i++) {
+ struct intel_ring_buffer *ring = &dev_priv->ring[i];
+
++ error->ring[i].pid = -1;
++
+ if (ring->dev == NULL)
+ continue;
+
+@@ -901,7 +903,6 @@ static void i915_gem_record_rings(struct
+
+ i915_record_ring_state(dev, ring, &error->ring[i]);
+
+- error->ring[i].pid = -1;
+ request = i915_gem_find_active_request(ring);
+ if (request) {
+ /* We need to copy these to an anonymous buffer
--- /dev/null
+From 4e578080ed3262ed2c3985868539bc66218d25c0 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Wed, 2 Jul 2014 15:47:04 +0200
+Subject: drm/vmwgfx: Fix incorrect write to read-only register v2:
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 4e578080ed3262ed2c3985868539bc66218d25c0 upstream.
+
+Commit "drm/vmwgfx: correct fb_fix_screeninfo.line_length", while fixing a
+vmwgfx fbdev bug, also writes the pitch to a supposedly read-only register:
+SVGA_REG_BYTES_PER_LINE, while it should be (and also in fact is) written to
+SVGA_REG_PITCHLOCK.
+
+This patch is Cc'd stable because of the unknown effects writing to this
+register might have, particularly on older device versions.
+
+v2: Updated log message.
+
+Cc: Christopher Friedt <chrisfriedt@gmail.com>
+Tested-by: Christopher Friedt <chrisfriedt@gmail.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
+- vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+ }
+
drm-i915-hd-audio-don-t-continue-probing-when-nomodeset-is-given.patch
drm-i915-hold-the-table-lock-whilst-walking-the-file-s-idr-and-counting-the-objects-in-debugfs.patch
drm-i915-default-to-having-backlight-if-vbt-not-available.patch
+drm-i95-initialize-active-ring-pid-to-1.patch
+drm-fix-null-pointer-access-by-wrong-ioctl.patch
+drm-i915-provide-interface-for-audio-driver-to-query-cdclk.patch
+alsa-hda-restore-bclk-m-n-value-as-per-cdclk-for-hsw-bdw-display-hda-controller.patch
+drm-vmwgfx-fix-incorrect-write-to-read-only-register-v2.patch
+drm-i2c-tda998x-move-drm_i2c_encoder_destroy-call.patch
+bluetooth-fix-incorrectly-overriding-conn-src_type.patch
+bluetooth-fix-ssp-acceptor-just-works-confirmation-without-mitm.patch
+bluetooth-fix-check-for-connection-encryption.patch
+bluetooth-fix-indicating-discovery-state-when-canceling-inquiry.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
