--- /dev/null
+From 96b4026878d9dac71bd4c3d6e05c7fbb16a3e0aa Mon Sep 17 00:00:00 2001
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Date: Fri, 6 Dec 2013 20:29:01 -0200
+Subject: drm/i915: change CRTC assertion on LCPLL disable
+
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+
+commit 96b4026878d9dac71bd4c3d6e05c7fbb16a3e0aa upstream.
+
+Currently, PC8 is enabled at modeset_global_resources, which is called
+after intel_modeset_update_state. Due to this, there's a small race
+condition on the case where we start enabling PC8, then do a modeset
+while PC8 is still being enabled. The racing condition triggers a WARN
+because intel_modeset_update_state will mark the CRTC as enabled, then
+the thread that's still enabling PC8 might look at the data structure
+and think that PC8 is being enabled while a pipe is enabled. Despite
+the WARN, this is not really a bug since we'll wait for the
+PC8-enabling thread to finish when we call modeset_global_resources.
+
+The spec says the CRTC cannot be enabled when we disable LCPLL, so we
+had a check for crtc->base.enabled. If we change to crtc->active we
+will still prevent disabling LCPLL while the CRTC is enabled, and we
+will also prevent the WARN above.
+
+This is a replacement for the previous patch named
+ "drm/i915: get/put PC8 when we get/put a CRTC"
+
+Testcase: igt/pm_pc8/modeset-lpsp-stress-no-wait
+Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
+(cherry picked from commit 798183c54799fbe1e5a5bfabb3a8c0505ffd2149
+from -next due to Dave's report.)
+Reported-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -6009,7 +6009,7 @@ static void assert_can_disable_lcpll(str
+ uint32_t val;
+
+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, base.head)
+- WARN(crtc->base.enabled, "CRTC for pipe %c enabled\n",
++ WARN(crtc->active, "CRTC for pipe %c enabled\n",
+ pipe_name(crtc->pipe));
+
+ WARN(I915_READ(HSW_PWR_WELL_DRIVER), "Power well on\n");
--- /dev/null
+From 4db080f9e93411c3c41ec402244da28e2bbde835 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 4 Dec 2013 11:37:09 +0000
+Subject: drm/i915: Fix erroneous dereference of batch_obj inside reset_status
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 4db080f9e93411c3c41ec402244da28e2bbde835 upstream.
+
+As the rings may be processed and their requests deallocated in a
+different order to the natural retirement during a reset,
+
+/* Whilst this request exists, batch_obj will be on the
+ * active_list, and so will hold the active reference. Only when this
+ * request is retired will the the batch_obj be moved onto the
+ * inactive_list and lose its active reference. Hence we do not need
+ * to explicitly hold another reference here.
+ */
+
+is violated, and the batch_obj may be dereferenced after it had been
+freed on another ring. This can be simply avoided by processing the
+status update prior to deallocating any requests.
+
+Fixes regression (a possible OOPS following a GPU hang) from
+commit aa60c664e6df502578454621c3a9b1f087ff8d25
+Author: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Date: Wed Jun 12 15:13:20 2013 +0300
+
+ drm/i915: find guilty batch buffer on ring resets
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Mika Kuoppala <mika.kuoppala@intel.com>
+Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
+[danvet: Add the code comment Chris supplied.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 34 ++++++++++++++++++++++++----------
+ 1 file changed, 24 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2278,15 +2278,24 @@ static void i915_gem_free_request(struct
+ kfree(request);
+ }
+
+-static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
+- struct intel_ring_buffer *ring)
++static void i915_gem_reset_ring_status(struct drm_i915_private *dev_priv,
++ struct intel_ring_buffer *ring)
+ {
+- u32 completed_seqno;
+- u32 acthd;
++ u32 completed_seqno = ring->get_seqno(ring, false);
++ u32 acthd = intel_ring_get_active_head(ring);
++ struct drm_i915_gem_request *request;
++
++ list_for_each_entry(request, &ring->request_list, list) {
++ if (i915_seqno_passed(completed_seqno, request->seqno))
++ continue;
+
+- acthd = intel_ring_get_active_head(ring);
+- completed_seqno = ring->get_seqno(ring, false);
++ i915_set_reset_status(ring, request, acthd);
++ }
++}
+
++static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
++ struct intel_ring_buffer *ring)
++{
+ while (!list_empty(&ring->request_list)) {
+ struct drm_i915_gem_request *request;
+
+@@ -2294,9 +2303,6 @@ static void i915_gem_reset_ring_lists(st
+ struct drm_i915_gem_request,
+ list);
+
+- if (request->seqno > completed_seqno)
+- i915_set_reset_status(ring, request, acthd);
+-
+ i915_gem_free_request(request);
+ }
+
+@@ -2338,8 +2344,16 @@ void i915_gem_reset(struct drm_device *d
+ struct intel_ring_buffer *ring;
+ int i;
+
++ /*
++ * Before we free the objects from the requests, we need to inspect
++ * them for finding the guilty party. As the requests only borrow
++ * their reference to the objects, the inspection must be done first.
++ */
++ for_each_ring(ring, dev_priv, i)
++ i915_gem_reset_ring_status(dev_priv, ring);
++
+ for_each_ring(ring, dev_priv, i)
+- i915_gem_reset_ring_lists(dev_priv, ring);
++ i915_gem_reset_ring_cleanup(dev_priv, ring);
+
+ i915_gem_restore_fences(dev);
+ }
--- /dev/null
+From a885b3ccc74d8e38074e1c43a47c354c5ea0b01e Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 17 Dec 2013 14:34:50 +0000
+Subject: drm/i915: Use the correct GMCH_CTRL register for Sandybridge+
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit a885b3ccc74d8e38074e1c43a47c354c5ea0b01e upstream.
+
+The GMCH_CTRL register (or MGCC in the spec) is at a different address
+on Sandybridge, and the address to which we currently write to is
+undefined. These stray writes appear to upset (hard hang) my Ivybridge
+machine whilst it is in UEFI mode.
+
+Note that the register is still marked as locked RO on Sandybridge, so
+vgaarb is still dysfunctional.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -10668,14 +10668,15 @@ void intel_connector_attach_encoder(stru
+ int intel_modeset_vga_set_state(struct drm_device *dev, bool state)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
++ unsigned reg = INTEL_INFO(dev)->gen >= 6 ? SNB_GMCH_CTRL : INTEL_GMCH_CTRL;
+ u16 gmch_ctrl;
+
+- pci_read_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, &gmch_ctrl);
++ pci_read_config_word(dev_priv->bridge_dev, reg, &gmch_ctrl);
+ if (state)
+ gmch_ctrl &= ~INTEL_GMCH_VGA_DISABLE;
+ else
+ gmch_ctrl |= INTEL_GMCH_VGA_DISABLE;
+- pci_write_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, gmch_ctrl);
++ pci_write_config_word(dev_priv->bridge_dev, reg, gmch_ctrl);
+ return 0;
+ }
+
--- /dev/null
+From b67ce39a30976171e7b96b30a94a0216ab89df97 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 13 Dec 2013 09:05:49 -0500
+Subject: drm/radeon: check for 0 count in speaker allocation and SAD code
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b67ce39a30976171e7b96b30a94a0216ab89df97 upstream.
+
+If there is no speaker allocation block or SAD block, bail
+early.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=72283
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/dce6_afmt.c | 4 ++--
+ drivers/gpu/drm/radeon/evergreen_hdmi.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/dce6_afmt.c
++++ b/drivers/gpu/drm/radeon/dce6_afmt.c
+@@ -132,7 +132,7 @@ void dce6_afmt_write_speaker_allocation(
+ }
+
+ sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb);
+- if (sad_count < 0) {
++ if (sad_count <= 0) {
+ DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
+ return;
+ }
+@@ -193,7 +193,7 @@ void dce6_afmt_write_sad_regs(struct drm
+ }
+
+ sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
+- if (sad_count < 0) {
++ if (sad_count <= 0) {
+ DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
+ return;
+ }
+--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
++++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+@@ -81,7 +81,7 @@ static void dce4_afmt_write_speaker_allo
+ }
+
+ sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb);
+- if (sad_count < 0) {
++ if (sad_count <= 0) {
+ DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
+ return;
+ }
+@@ -134,7 +134,7 @@ static void evergreen_hdmi_write_sad_reg
+ }
+
+ sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
+- if (sad_count < 0) {
++ if (sad_count <= 0) {
+ DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
+ return;
+ }
--- /dev/null
+From c745fe611ca42295c9d91d8e305d27983e9132ef Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 9 Dec 2013 17:46:59 -0500
+Subject: drm/radeon/dpm: disable ss on Cayman
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit c745fe611ca42295c9d91d8e305d27983e9132ef upstream.
+
+Spread spectrum seems to cause hangs when dynamic clock
+switching is enabled. Disable it for now. This does not
+affect performance or the amount of power saved. Tracked
+down by Martin Andersson.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=69723
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/rv770_dpm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/rv770_dpm.c
++++ b/drivers/gpu/drm/radeon/rv770_dpm.c
+@@ -2328,6 +2328,12 @@ void rv770_get_engine_memory_ss(struct r
+ pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
+ ASIC_INTERNAL_MEMORY_SS, 0);
+
++ /* disable ss, causes hangs on some cayman boards */
++ if (rdev->family == CHIP_CAYMAN) {
++ pi->sclk_ss = false;
++ pi->mclk_ss = false;
++ }
++
+ if (pi->sclk_ss || pi->mclk_ss)
+ pi->dynamic_ss = true;
+ else
--- /dev/null
+From e2f6c88fb903e123edfd1106b0b8310d5117f774 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 19 Dec 2013 19:41:46 -0500
+Subject: drm/radeon: fix asic gfx values for scrapper asics
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e2f6c88fb903e123edfd1106b0b8310d5117f774 upstream.
+
+Fixes gfx corruption on certain TN/RL parts.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=60389
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -900,6 +900,10 @@ static void cayman_gpu_init(struct radeo
+ (rdev->pdev->device == 0x999C)) {
+ rdev->config.cayman.max_simds_per_se = 6;
+ rdev->config.cayman.max_backends_per_se = 2;
++ rdev->config.cayman.max_hw_contexts = 8;
++ rdev->config.cayman.sx_max_export_size = 256;
++ rdev->config.cayman.sx_max_export_pos_size = 64;
++ rdev->config.cayman.sx_max_export_smx_size = 192;
+ } else if ((rdev->pdev->device == 0x9903) ||
+ (rdev->pdev->device == 0x9904) ||
+ (rdev->pdev->device == 0x990A) ||
+@@ -910,6 +914,10 @@ static void cayman_gpu_init(struct radeo
+ (rdev->pdev->device == 0x999D)) {
+ rdev->config.cayman.max_simds_per_se = 4;
+ rdev->config.cayman.max_backends_per_se = 2;
++ rdev->config.cayman.max_hw_contexts = 8;
++ rdev->config.cayman.sx_max_export_size = 256;
++ rdev->config.cayman.sx_max_export_pos_size = 64;
++ rdev->config.cayman.sx_max_export_smx_size = 192;
+ } else if ((rdev->pdev->device == 0x9919) ||
+ (rdev->pdev->device == 0x9990) ||
+ (rdev->pdev->device == 0x9991) ||
+@@ -920,9 +928,17 @@ static void cayman_gpu_init(struct radeo
+ (rdev->pdev->device == 0x99A0)) {
+ rdev->config.cayman.max_simds_per_se = 3;
+ rdev->config.cayman.max_backends_per_se = 1;
++ rdev->config.cayman.max_hw_contexts = 4;
++ rdev->config.cayman.sx_max_export_size = 128;
++ rdev->config.cayman.sx_max_export_pos_size = 32;
++ rdev->config.cayman.sx_max_export_smx_size = 96;
+ } else {
+ rdev->config.cayman.max_simds_per_se = 2;
+ rdev->config.cayman.max_backends_per_se = 1;
++ rdev->config.cayman.max_hw_contexts = 4;
++ rdev->config.cayman.sx_max_export_size = 128;
++ rdev->config.cayman.sx_max_export_pos_size = 32;
++ rdev->config.cayman.sx_max_export_smx_size = 96;
+ }
+ rdev->config.cayman.max_texture_channel_caches = 2;
+ rdev->config.cayman.max_gprs = 256;
+@@ -930,10 +946,6 @@ static void cayman_gpu_init(struct radeo
+ rdev->config.cayman.max_gs_threads = 32;
+ rdev->config.cayman.max_stack_entries = 512;
+ rdev->config.cayman.sx_num_of_sets = 8;
+- rdev->config.cayman.sx_max_export_size = 256;
+- rdev->config.cayman.sx_max_export_pos_size = 64;
+- rdev->config.cayman.sx_max_export_smx_size = 192;
+- rdev->config.cayman.max_hw_contexts = 8;
+ rdev->config.cayman.sq_num_cf_insts = 2;
+
+ rdev->config.cayman.sc_prim_fifo_size = 0x40;
drm-i915-hold-mutex-across-i915_gem_release.patch
drm-i915-fix-use-after-free-in-do_switch.patch
drm-i915-don-t-update-the-dri1-breadcrumb-with-modesetting.patch
+drm-radeon-dpm-disable-ss-on-cayman.patch
+drm-radeon-check-for-0-count-in-speaker-allocation-and-sad-code.patch
+drm-radeon-fix-asic-gfx-values-for-scrapper-asics.patch
+drm-i915-fix-erroneous-dereference-of-batch_obj-inside-reset_status.patch
+drm-i915-change-crtc-assertion-on-lcpll-disable.patch
+drm-i915-use-the-correct-gmch_ctrl-register-for-sandybridge.patch