4.8.7-300.pf7.hu.1

- Merge Fedora upstream changes: Merge branch 'f25' of ssh://pkgs.fedoraproject.org/kernel into f25-pf
- Update pf https://pf.natalenko.name/news/?p=219 to v4.8-pf7.

.gitignore

@@ -1,7 +1,2 @@
-clog
-*.xz
-*.bz2
-*.rpm
-*.orig
-kernel-[234].*/
-perf-man-*.tar.gz
+/_tmp/
+/.build-*.log

0001-HID-input-ignore-System-Control-application-usages-i.patch

@@ -0,0 +1,75 @@
+From 1989dada7ce07848196991c9ebf25ff9c5f14d4e Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Tue, 13 Sep 2016 11:52:37 +0200
+Subject: [PATCH] HID: input: ignore System Control application usages if not
+ System Controls
+
+Microsoft is reusing its report descriptor again and again, and part of it
+looks like this:
+
+0x05, 0x01,                    // Usage Page (Generic Desktop)        299
+0x09, 0x80,                    // Usage (System Control)              301
+0xa1, 0x01,                    // Collection (Application)            303
+0x85, 0x03,                    //  Report ID (3)                      305
+0x19, 0x00,                    //  Usage Minimum (0)                  307
+0x29, 0xff,                    //  Usage Maximum (255)                309
+0x15, 0x00,                    //  Logical Minimum (0)                311
+0x26, 0xff, 0x00,              //  Logical Maximum (255)              313
+0x81, 0x00,                    //  Input (Data,Arr,Abs)               316
+0xc0,                          // End Collection                      318
+
+While there is nothing wrong in term of processing, we do however blindly
+map the full usage range (it's an array) from 0x00 to 0xff, which creates
+some interesting axis, like ABS_X|Y, and a bunch of ABS_MISC + n.
+
+While libinput and other stacks don't care that much (we can detect them),
+joydev is very happy and attaches itself to the mouse or keyboard.
+
+The problem is that joydev now handles the device as a joystick, but given
+that we have a HID array, it sets all the ABS_* values to 0. And in its
+world, 0 means -32767 (minimum value), which sends spurious events to games
+(think Steam).
+
+It looks like hid-microsoft tries to tackle the very same problem with its
+.report_fixup callback. But fixing the report descriptor is an endless task
+and is quite obfuscated.
+
+So take the hammer, and decide that if the application is meant to be
+System Control, any other usage not in the System Control range should
+be ignored.
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1325354
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=28912
+Link: https://github.com/ValveSoftware/steam-for-linux/issues/3384
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1325354
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=37982
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+---
+ drivers/hid/hid-input.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index bcfaf32..058919d 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -604,6 +604,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ 			break;
+ 		}
+
++		/*
++		 * Some lazy vendors declare 255 usages for System Control,
++		 * leading to the creation of ABS_X|Y axis and too many others.
++		 * It wouldn't be a problem if joydev doesn't consider the
++		 * device as a joystick then.
++		 */
++		if (field->application == HID_GD_SYSTEM_CONTROL)
++			goto ignore;
++
+ 		if ((usage->hid & 0xf0) == 0x90) {	/* D-pad */
+ 			switch (usage->hid) {
+ 			case HID_GD_UP:	   usage->hat_dir = 1; break;
+-- 
+2.7.4
+

0001-OOM-detection-regressions-since-4.7.patch

@@ -0,0 +1,121 @@
+From a7f80308bac4013728e33e2bcb9b60eee78f60fb Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@kernel.org>
+Date: Mon, 22 Aug 2016 11:32:49 +0200
+Subject: [PATCH] OOM detection regressions since 4.7
+
+Hi,
+there have been multiple reports [1][2][3][4][5] about pre-mature OOM
+killer invocations since 4.7 which contains oom detection rework. All of
+them were for order-2 (kernel stack) alloaction requests failing because
+of a high fragmentation and compaction failing to make any forward
+progress. While investigating this we have found out that the compaction
+just gives up too early. Vlastimil has been working on compaction
+improvement for quite some time and his series [6] is already sitting
+in mmotm tree. This already helps a lot because it drops some heuristics
+which are more aimed at lower latencies for high orders rather than
+reliability. Joonsoo has then identified further problem with too many
+blocks being marked as unmovable [7] and Vlastimil has prepared a patch
+on top of his series [8] which is also in the mmotm tree now.
+
+That being said, the regression is real and should be fixed for 4.7
+stable users. [6][8] was reported to help and ooms are no longer
+reproducible. I know we are quite late (rc3) in 4.8 but I would vote
+for mergeing those patches and have them in 4.8. For 4.7 I would go
+with a partial revert of the detection rework for high order requests
+(see patch below). This patch is really trivial. If those compaction
+improvements are just too large for 4.8 then we can use the same patch
+as for 4.7 stable for now and revert it in 4.9 after compaction changes
+are merged.
+
+Thoughts?
+
+[1] http://lkml.kernel.org/r/20160731051121.GB307@x4
+[2] http://lkml.kernel.org/r/201608120901.41463.a.miskiewicz@gmail.com
+[3] http://lkml.kernel.org/r/20160801192620.GD31957@dhcp22.suse.cz
+[4] https://lists.opensuse.org/opensuse-kernel/2016-08/msg00021.html
+[5] https://bugzilla.opensuse.org/show_bug.cgi?id=994066
+[6] http://lkml.kernel.org/r/20160810091226.6709-1-vbabka@suse.cz
+[7] http://lkml.kernel.org/r/20160816031222.GC16913@js1304-P5Q-DELUXE
+[8] http://lkml.kernel.org/r/f7a9ea9d-bb88-bfd6-e340-3a933559305a@suse.cz
+---
+ mm/page_alloc.c | 50 ++------------------------------------------------
+ 1 file changed, 2 insertions(+), 48 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 8b3e134..6e35419 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -3254,53 +3254,6 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
+ 	return NULL;
+ }
+ 
+-static inline bool
+-should_compact_retry(struct alloc_context *ac, int order, int alloc_flags,
+-		     enum compact_result compact_result, enum migrate_mode *migrate_mode,
+-		     int compaction_retries)
+-{
+-	int max_retries = MAX_COMPACT_RETRIES;
+-
+-	if (!order)
+-		return false;
+-
+-	/*
+-	 * compaction considers all the zone as desperately out of memory
+-	 * so it doesn't really make much sense to retry except when the
+-	 * failure could be caused by weak migration mode.
+-	 */
+-	if (compaction_failed(compact_result)) {
+-		if (*migrate_mode == MIGRATE_ASYNC) {
+-			*migrate_mode = MIGRATE_SYNC_LIGHT;
+-			return true;
+-		}
+-		return false;
+-	}
+-
+-	/*
+-	 * make sure the compaction wasn't deferred or didn't bail out early
+-	 * due to locks contention before we declare that we should give up.
+-	 * But do not retry if the given zonelist is not suitable for
+-	 * compaction.
+-	 */
+-	if (compaction_withdrawn(compact_result))
+-		return compaction_zonelist_suitable(ac, order, alloc_flags);
+-
+-	/*
+-	 * !costly requests are much more important than __GFP_REPEAT
+-	 * costly ones because they are de facto nofail and invoke OOM
+-	 * killer to move on while costly can fail and users are ready
+-	 * to cope with that. 1/4 retries is rather arbitrary but we
+-	 * would need much more detailed feedback from compaction to
+-	 * make a better decision.
+-	 */
+-	if (order > PAGE_ALLOC_COSTLY_ORDER)
+-		max_retries /= 4;
+-	if (compaction_retries <= max_retries)
+-		return true;
+-
+-	return false;
+-}
+ #else
+ static inline struct page *
+ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
+@@ -3311,6 +3264,8 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
+ 	return NULL;
+ }
+ 
++#endif /* CONFIG_COMPACTION */
++
+ static inline bool
+ should_compact_retry(struct alloc_context *ac, unsigned int order, int alloc_flags,
+ 		     enum compact_result compact_result,
+@@ -3337,7 +3292,6 @@ should_compact_retry(struct alloc_context *ac, unsigned int order, int alloc_fla
+ 	}
+ 	return false;
+ }
+-#endif /* CONFIG_COMPACTION */
+ 
+ /* Perform direct synchronous page reclaim */
+ static int
+-- 
+2.7.4
+

0001-cpupower-Correct-return-type-of-cpu_power_is_cpu_onl.patch

@@ -1,49 +0,0 @@
-From 9f692cbe4a01dd9e3c3e954ec6b59662b68f9ce4 Mon Sep 17 00:00:00 2001
-From: Laura Abbott <labbott@redhat.com>
-Date: Fri, 9 Sep 2016 10:19:02 -0700
-Subject: [PATCH] cpupower: Correct return type of cpu_power_is_cpu_online in
- cpufreq
-To: Thomas Renninger <trenn@suse.com>
-Cc: linux-pm@vger.kernel.org
-Cc: linux-kernel@vger.kernel.org
-
-When converting to a shared library in ac5a181d065d ("cpupower: Add
-cpuidle parts into library"), cpu_freq_cpu_exists was converted to
-cpupower_is_cpu_online. cpu_req_cpu_exists returned 0 on success and
--ENOSYS on failure whereas cpupower_is_cpu_online returns 1 on success.
-Check for the correct return value in cpufreq-set.
-
-See https://bugzilla.redhat.com/show_bug.cgi?id=1374212
-
-Fixes: ac5a181d065d ("cpupower: Add cpuidle parts into library")
-Reported-by: Julian Seward <jseward@acm.org>
-Signed-off-by: Laura Abbott <labbott@redhat.com>
----
- tools/power/cpupower/utils/cpufreq-set.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c
-index b4bf769..8971d71 100644
---- a/tools/power/cpupower/utils/cpufreq-set.c
-+++ b/tools/power/cpupower/utils/cpufreq-set.c
-@@ -296,7 +296,7 @@ int cmd_freq_set(int argc, char **argv)
- 			struct cpufreq_affected_cpus *cpus;
- 
- 			if (!bitmask_isbitset(cpus_chosen, cpu) ||
--			    cpupower_is_cpu_online(cpu))
-+			    cpupower_is_cpu_online(cpu) != 1)
- 				continue;
- 
- 			cpus = cpufreq_get_related_cpus(cpu);
-@@ -316,7 +316,7 @@ int cmd_freq_set(int argc, char **argv)
- 	     cpu <= bitmask_last(cpus_chosen); cpu++) {
- 
- 		if (!bitmask_isbitset(cpus_chosen, cpu) ||
--		    cpupower_is_cpu_online(cpu))
-+		    cpupower_is_cpu_online(cpu) != 1)
- 			continue;
- 
- 		if (cpupower_is_cpu_online(cpu) != 1)
--- 
-2.10.0
-

0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch

@@ -0,0 +1,61 @@
+From 1aab956c7b8872fb6976328316bfad62c6e67cf8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Fri, 21 Oct 2016 16:44:38 +0300
+Subject: [PATCH] drm/i915: Refresh that status of MST capable connectors in
+ ->detect()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Once we've determined that the sink is MST capable we never end up
+running through the full detect cycle again, despite getting HPDs.
+Fix tht by ripping out the incorrect piece of code responsible.
+
+This got broken when I moved the long HPD handling to the ->detect()
+hook, but failed to remove the leftover code.
+
+Cc: Ander Conselvan de Oliveira <conselvan2@gmail.com>
+Cc: drm-intel-fixes@lists.freedesktop.org
+Cc: Rui Tiago Matos <tiagomatos@gmail.com>
+Tested-by: Rui Tiago Matos <tiagomatos@gmail.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98323
+Cc: Kirill A. Shutemov <kirill@shutemov.name>
+Tested-by: Kirill A. Shutemov <kirill@shutemov.name>
+References: https://bugs.freedesktop.org/show_bug.cgi?id=98306
+Fixes: 27d4efc5591a ("drm/i915: Move long hpd handling into the hotplug work")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1477057478-29328-1-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+---
+ drivers/gpu/drm/i915/intel_dp.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index f30db8f..80db8a3 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -4492,21 +4492,11 @@ static enum drm_connector_status
+ intel_dp_detect(struct drm_connector *connector, bool force)
+ {
+ 	struct intel_dp *intel_dp = intel_attached_dp(connector);
+-	struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
+-	struct intel_encoder *intel_encoder = &intel_dig_port->base;
+ 	enum drm_connector_status status = connector->status;
+
+ 	DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
+ 		      connector->base.id, connector->name);
+
+-	if (intel_dp->is_mst) {
+-		/* MST devices are disconnected from a monitor POV */
+-		intel_dp_unset_edid(intel_dp);
+-		if (intel_encoder->type != INTEL_OUTPUT_EDP)
+-			intel_encoder->type = INTEL_OUTPUT_DP;
+-		return connector_status_disconnected;
+-	}
+-
+ 	/* If full detect is not performed yet, do a full detect */
+ 	if (!intel_dp->detect_done)
+ 		status = intel_dp_long_pulse(intel_dp->attached_connector);
+-- 
+2.7.4
+

0001-drm-i915-Reorganize-WM-structs-unions-in-CRTC-state.patch

@@ -0,0 +1,227 @@
+From 0042e1e7a03a2fb5d6c464c03ce84d55b31add11 Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Thu, 12 May 2016 07:05:55 -0700
+Subject: [PATCH 01/17] drm/i915: Reorganize WM structs/unions in CRTC state
+
+Reorganize the nested structures and unions we have for pipe watermark
+data in intel_crtc_state so that platform-specific data can be added in
+a more sensible manner (and save a bit of memory at the same time).
+
+The change basically changes the organization from:
+
+        union {
+                struct intel_pipe_wm ilk;
+                struct intel_pipe_wm skl;
+        } optimal;
+
+        struct intel_pipe_wm intermediate /* ILK-only */
+
+to
+
+        union {
+                struct {
+                        struct intel_pipe_wm intermediate;
+                        struct intel_pipe_wm optimal;
+                } ilk;
+
+                struct {
+                        struct intel_pipe_wm optimal;
+                } skl;
+        }
+
+There should be no functional change here, but it will allow us to add
+more platform-specific fields going forward (and more easily extend to
+other platform types like VLV).
+
+While we're at it, let's move the entire watermark substructure out to
+its own structure definition to make the code slightly more readable.
+
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-2-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_display.c |  2 +-
+ drivers/gpu/drm/i915/intel_drv.h     | 61 +++++++++++++++++++++---------------
+ drivers/gpu/drm/i915/intel_pm.c      | 18 +++++------
+ 3 files changed, 45 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index d19b392..4633aec 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -12027,7 +12027,7 @@ static int intel_crtc_atomic_check(struct drm_crtc *crtc,
+ 		}
+ 	} else if (dev_priv->display.compute_intermediate_wm) {
+ 		if (HAS_PCH_SPLIT(dev_priv) && INTEL_GEN(dev_priv) < 9)
+-			pipe_config->wm.intermediate = pipe_config->wm.optimal.ilk;
++			pipe_config->wm.ilk.intermediate = pipe_config->wm.ilk.optimal;
+ 	}
+ 
+ 	if (INTEL_INFO(dev)->gen >= 9) {
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 4a24b00..5a186bf 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -405,6 +405,40 @@ struct skl_pipe_wm {
+ 	uint32_t linetime;
+ };
+ 
++struct intel_crtc_wm_state {
++	union {
++		struct {
++			/*
++			 * Intermediate watermarks; these can be
++			 * programmed immediately since they satisfy
++			 * both the current configuration we're
++			 * switching away from and the new
++			 * configuration we're switching to.
++			 */
++			struct intel_pipe_wm intermediate;
++
++			/*
++			 * Optimal watermarks, programmed post-vblank
++			 * when this state is committed.
++			 */
++			struct intel_pipe_wm optimal;
++		} ilk;
++
++		struct {
++			/* gen9+ only needs 1-step wm programming */
++			struct skl_pipe_wm optimal;
++		} skl;
++	};
++
++	/*
++	 * Platforms with two-step watermark programming will need to
++	 * update watermark programming post-vblank to switch from the
++	 * safe intermediate watermarks to the optimal final
++	 * watermarks.
++	 */
++	bool need_postvbl_update;
++};
++
+ struct intel_crtc_state {
+ 	struct drm_crtc_state base;
+ 
+@@ -558,32 +592,7 @@ struct intel_crtc_state {
+ 	/* IVB sprite scaling w/a (WaCxSRDisabledForSpriteScaling:ivb) */
+ 	bool disable_lp_wm;
+ 
+-	struct {
+-		/*
+-		 * Optimal watermarks, programmed post-vblank when this state
+-		 * is committed.
+-		 */
+-		union {
+-			struct intel_pipe_wm ilk;
+-			struct skl_pipe_wm skl;
+-		} optimal;
+-
+-		/*
+-		 * Intermediate watermarks; these can be programmed immediately
+-		 * since they satisfy both the current configuration we're
+-		 * switching away from and the new configuration we're switching
+-		 * to.
+-		 */
+-		struct intel_pipe_wm intermediate;
+-
+-		/*
+-		 * Platforms with two-step watermark programming will need to
+-		 * update watermark programming post-vblank to switch from the
+-		 * safe intermediate watermarks to the optimal final
+-		 * watermarks.
+-		 */
+-		bool need_postvbl_update;
+-	} wm;
++	struct intel_crtc_wm_state wm;
+ 
+ 	/* Gamma mode programmed on the pipe */
+ 	uint32_t gamma_mode;
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index a7ef45d..4353fec 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2309,7 +2309,7 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
+ 	int level, max_level = ilk_wm_max_level(dev), usable_level;
+ 	struct ilk_wm_maximums max;
+ 
+-	pipe_wm = &cstate->wm.optimal.ilk;
++	pipe_wm = &cstate->wm.ilk.optimal;
+ 
+ 	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+ 		struct intel_plane_state *ps;
+@@ -2391,7 +2391,7 @@ static int ilk_compute_intermediate_wm(struct drm_device *dev,
+ 				       struct intel_crtc *intel_crtc,
+ 				       struct intel_crtc_state *newstate)
+ {
+-	struct intel_pipe_wm *a = &newstate->wm.intermediate;
++	struct intel_pipe_wm *a = &newstate->wm.ilk.intermediate;
+ 	struct intel_pipe_wm *b = &intel_crtc->wm.active.ilk;
+ 	int level, max_level = ilk_wm_max_level(dev);
+ 
+@@ -2400,7 +2400,7 @@ static int ilk_compute_intermediate_wm(struct drm_device *dev,
+ 	 * currently active watermarks to get values that are safe both before
+ 	 * and after the vblank.
+ 	 */
+-	*a = newstate->wm.optimal.ilk;
++	*a = newstate->wm.ilk.optimal;
+ 	a->pipe_enabled |= b->pipe_enabled;
+ 	a->sprites_enabled |= b->sprites_enabled;
+ 	a->sprites_scaled |= b->sprites_scaled;
+@@ -2429,7 +2429,7 @@ static int ilk_compute_intermediate_wm(struct drm_device *dev,
+ 	 * If our intermediate WM are identical to the final WM, then we can
+ 	 * omit the post-vblank programming; only update if it's different.
+ 	 */
+-	if (memcmp(a, &newstate->wm.optimal.ilk, sizeof(*a)) == 0)
++	if (memcmp(a, &newstate->wm.ilk.optimal, sizeof(*a)) == 0)
+ 		newstate->wm.need_postvbl_update = false;
+ 
+ 	return 0;
+@@ -3678,7 +3678,7 @@ static void skl_update_wm(struct drm_crtc *crtc)
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	struct skl_wm_values *results = &dev_priv->wm.skl_results;
+ 	struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
+-	struct skl_pipe_wm *pipe_wm = &cstate->wm.optimal.skl;
++	struct skl_pipe_wm *pipe_wm = &cstate->wm.skl.optimal;
+ 
+ 
+ 	/* Clear all dirty flags */
+@@ -3757,7 +3757,7 @@ static void ilk_initial_watermarks(struct intel_crtc_state *cstate)
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(cstate->base.crtc);
+ 
+ 	mutex_lock(&dev_priv->wm.wm_mutex);
+-	intel_crtc->wm.active.ilk = cstate->wm.intermediate;
++	intel_crtc->wm.active.ilk = cstate->wm.ilk.intermediate;
+ 	ilk_program_watermarks(dev_priv);
+ 	mutex_unlock(&dev_priv->wm.wm_mutex);
+ }
+@@ -3769,7 +3769,7 @@ static void ilk_optimize_watermarks(struct intel_crtc_state *cstate)
+ 
+ 	mutex_lock(&dev_priv->wm.wm_mutex);
+ 	if (cstate->wm.need_postvbl_update) {
+-		intel_crtc->wm.active.ilk = cstate->wm.optimal.ilk;
++		intel_crtc->wm.active.ilk = cstate->wm.ilk.optimal;
+ 		ilk_program_watermarks(dev_priv);
+ 	}
+ 	mutex_unlock(&dev_priv->wm.wm_mutex);
+@@ -3826,7 +3826,7 @@ static void skl_pipe_wm_get_hw_state(struct drm_crtc *crtc)
+ 	struct skl_wm_values *hw = &dev_priv->wm.skl_hw;
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ 	struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
+-	struct skl_pipe_wm *active = &cstate->wm.optimal.skl;
++	struct skl_pipe_wm *active = &cstate->wm.skl.optimal;
+ 	enum pipe pipe = intel_crtc->pipe;
+ 	int level, i, max_level;
+ 	uint32_t temp;
+@@ -3892,7 +3892,7 @@ static void ilk_pipe_wm_get_hw_state(struct drm_crtc *crtc)
+ 	struct ilk_wm_values *hw = &dev_priv->wm.hw;
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ 	struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
+-	struct intel_pipe_wm *active = &cstate->wm.optimal.ilk;
++	struct intel_pipe_wm *active = &cstate->wm.ilk.optimal;
+ 	enum pipe pipe = intel_crtc->pipe;
+ 	static const i915_reg_t wm0_pipe_reg[] = {
+ 		[PIPE_A] = WM0_PIPEA_ILK,
+-- 
+2.7.4
+

0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch

@@ -0,0 +1,91 @@
+From 0d3f6d297bfb7af24d0508460fdb3d1ec4903fa3 Mon Sep 17 00:00:00 2001
+From: Martin KaFai Lau <kafai@fb.com>
+Date: Wed, 11 Nov 2015 11:51:06 -0800
+Subject: [PATCH] ipv6: Avoid creating RTF_CACHE from a rt that is not managed
+ by fib6 tree
+
+The original bug report:
+https://bugzilla.redhat.com/show_bug.cgi?id=1272571
+
+The setup has a IPv4 GRE tunnel running in a IPSec.  The bug
+happens when ndisc starts sending router solicitation at the gre
+interface.  The simplified oops stack is like:
+
+__lock_acquire+0x1b2/0x1c30
+lock_acquire+0xb9/0x140
+_raw_write_lock_bh+0x3f/0x50
+__ip6_ins_rt+0x2e/0x60
+ip6_ins_rt+0x49/0x50
+~~~~~~~~
+__ip6_rt_update_pmtu.part.54+0x145/0x250
+ip6_rt_update_pmtu+0x2e/0x40
+~~~~~~~~
+ip_tunnel_xmit+0x1f1/0xf40
+__gre_xmit+0x7a/0x90
+ipgre_xmit+0x15a/0x220
+dev_hard_start_xmit+0x2bd/0x480
+__dev_queue_xmit+0x696/0x730
+dev_queue_xmit+0x10/0x20
+neigh_direct_output+0x11/0x20
+ip6_finish_output2+0x21f/0x770
+ip6_finish_output+0xa7/0x1d0
+ip6_output+0x56/0x190
+~~~~~~~~
+ndisc_send_skb+0x1d9/0x400
+ndisc_send_rs+0x88/0xc0
+~~~~~~~~
+
+The rt passed to ip6_rt_update_pmtu() is created by
+icmp6_dst_alloc() and it is not managed by the fib6 tree,
+so its rt6i_table == NULL.  When __ip6_rt_update_pmtu() creates
+a RTF_CACHE clone, the newly created clone also has rt6i_table == NULL
+and it causes the ip6_ins_rt() oops.
+
+During pmtu update, we only want to create a RTF_CACHE clone
+from a rt which is currently managed (or owned) by the
+fib6 tree.  It means either rt->rt6i_node != NULL or
+rt is a RTF_PCPU clone.
+
+It is worth to note that rt6i_table may not be NULL even it is
+not (yet) managed by the fib6 tree (e.g. addrconf_dst_alloc()).
+Hence, rt6i_node is a better check instead of rt6i_table.
+
+Fixes: 45e4fd26683c ("ipv6: Only create RTF_CACHE routes after encountering pmtu")
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Reported-by: Chris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
+Cc: Chris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
+Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipv6/route.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index c8bc9b4..74907c5 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1322,6 +1322,12 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu)
+ 	rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
+ }
+
++static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
++{
++	return !(rt->rt6i_flags & RTF_CACHE) &&
++		(rt->rt6i_flags & RTF_PCPU || rt->rt6i_node);
++}
++
+ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+ 				 const struct ipv6hdr *iph, u32 mtu)
+ {
+@@ -1335,7 +1341,7 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+ 	if (mtu >= dst_mtu(dst))
+ 		return;
+
+-	if (rt6->rt6i_flags & RTF_CACHE) {
++	if (!rt6_cache_allowed_for_pmtu(rt6)) {
+ 		rt6_do_update_pmtu(rt6, mtu);
+ 	} else {
+ 		const struct in6_addr *daddr, *saddr;
+-- 
+2.5.0
+

0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch

@@ -0,0 +1,95 @@
+From 4d1b08a69350d40e0aa14baba4797ef175295718 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Wed, 30 Mar 2016 12:40:54 +0100
+Subject: [PATCH 1/2] net: dsa: mv88e6xxx: Introduce
+ _mv88e6xxx_phy_page_{read,write}
+
+Add versions of the phy_page_read and _write functions to
+be used in a context where the SMI mutex is held.
+
+Tested-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Reviewed-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
+---
+ drivers/net/dsa/mv88e6xxx.c | 49 +++++++++++++++++++++++++++++++++------------
+ 1 file changed, 36 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
+index 512c8c0..3dcfe13 100644
+--- a/drivers/net/dsa/mv88e6xxx.c
++++ b/drivers/net/dsa/mv88e6xxx.c
+@@ -1929,6 +1929,38 @@ static void mv88e6xxx_bridge_work(struct work_struct *work)
+ 	}
+ }
+ 
++static int _mv88e6xxx_phy_page_write(struct dsa_switch *ds, int port, int page,
++				     int reg, int val)
++{
++	int ret;
++
++	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
++	if (ret < 0)
++		goto restore_page_0;
++
++	ret = _mv88e6xxx_phy_write_indirect(ds, port, reg, val);
++restore_page_0:
++	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++
++	return ret;
++}
++
++static int _mv88e6xxx_phy_page_read(struct dsa_switch *ds, int port, int page,
++				    int reg)
++{
++	int ret;
++
++	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
++	if (ret < 0)
++		goto restore_page_0;
++
++	ret = _mv88e6xxx_phy_read_indirect(ds, port, reg);
++restore_page_0:
++	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++
++	return ret;
++}
++
+ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
+ {
+ 	struct mv88e6xxx_priv_state *ps = ds_to_priv(ds);
+@@ -2383,13 +2415,9 @@ int mv88e6xxx_phy_page_read(struct dsa_switch *ds, int port, int page, int reg)
+ 	int ret;
+ 
+ 	mutex_lock(&ps->smi_mutex);
+-	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
+-	if (ret < 0)
+-		goto error;
+-	ret = _mv88e6xxx_phy_read_indirect(ds, port, reg);
+-error:
+-	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++	ret = _mv88e6xxx_phy_page_read(ds, port, page, reg);
+ 	mutex_unlock(&ps->smi_mutex);
++
+ 	return ret;
+ }
+ 
+@@ -2400,14 +2428,9 @@ int mv88e6xxx_phy_page_write(struct dsa_switch *ds, int port, int page,
+ 	int ret;
+ 
+ 	mutex_lock(&ps->smi_mutex);
+-	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
+-	if (ret < 0)
+-		goto error;
+-
+-	ret = _mv88e6xxx_phy_write_indirect(ds, port, reg, val);
+-error:
+-	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++	ret = _mv88e6xxx_phy_page_write(ds, port, page, reg, val);
+ 	mutex_unlock(&ps->smi_mutex);
++
+ 	return ret;
+ }
+ 
+-- 
+2.7.3
+

0001-platform-x86-ideapad-laptop-Add-Lenovo-Yoga-910-13IK.patch

@@ -0,0 +1,40 @@
+From 40c30bbf3377babc4d6bb16b699184236a8bfa27 Mon Sep 17 00:00:00 2001
+From: Brian Masney <masneyb@onstation.org>
+Date: Tue, 11 Oct 2016 19:28:02 -0400
+Subject: [PATCH] platform/x86: ideapad-laptop: Add Lenovo Yoga 910-13IKB to
+ no_hw_rfkill dmi list
+
+The Lenovo Yoga 910-13IKB does not have a hw rfkill switch, and trying
+to read the hw rfkill switch through the ideapad module causes it to
+always report as blocked.
+
+This commit adds the Lenovo Yoga 910-13IKB to the no_hw_rfkill dmi list,
+fixing the WiFI breakage.
+
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Signed-off-by: Darren Hart <dvhart@linux.intel.com>
+---
+ drivers/platform/x86/ideapad-laptop.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index d1a091b..a232394 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -933,6 +933,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 900"),
+ 		},
+ 	},
++	{
++		.ident = "Lenovo YOGA 910-13IKB",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 910-13IKB"),
++		},
++	},
+ 	{}
+ };
+ 
+-- 
+2.7.4
+

0001-selinux-Only-apply-bounds-checking-to-source-types.patch

@@ -0,0 +1,203 @@
+From 7ea59202db8d20806d9ae552acd1875c3a978bcc Mon Sep 17 00:00:00 2001
+From: Stephen Smalley <sds@tycho.nsa.gov>
+Date: Mon, 23 May 2016 10:54:11 -0400
+Subject: [PATCH] selinux: Only apply bounds checking to source types
+
+The current bounds checking of both source and target types
+requires allowing any domain that has access to the child
+domain to also have the same permissions to the parent, which
+is undesirable.  Drop the target bounds checking.
+
+KaiGai Kohei originally removed all use of target bounds in
+commit 7d52a155e38d ("selinux: remove dead code in
+type_attribute_bounds_av()") but this was reverted in
+commit 2ae3ba39389b ("selinux: libsepol: remove dead code in
+check_avtab_hierarchy_callback()") because it would have
+required explicitly allowing the parent any permissions
+to the child that the child is allowed to itself.
+
+This change in contrast retains the logic for the case where both
+source and target types are bounded, thereby allowing access
+if the parent of the source is allowed the corresponding
+permissions to the parent of the target.  Further, this change
+reworks the logic such that we only perform a single computation
+for each case and there is no ambiguity as to how to resolve
+a bounds violation.
+
+Under the new logic, if the source type and target types are both
+bounded, then the parent of the source type must be allowed the same
+permissions to the parent of the target type.  If only the source
+type is bounded, then the parent of the source type must be allowed
+the same permissions to the target type.
+
+Examples of the new logic and comparisons with the old logic:
+1. If we have:
+	typebounds A B;
+then:
+	allow B self:process <permissions>;
+will satisfy the bounds constraint iff:
+	allow A self:process <permissions>;
+is also allowed in policy.
+
+Under the old logic, the allow rule on B satisfies the
+bounds constraint if any of the following three are allowed:
+	allow A B:process <permissions>; or
+	allow B A:process <permissions>; or
+	allow A self:process <permissions>;
+However, either of the first two ultimately require the third to
+satisfy the bounds constraint under the old logic, and therefore
+this degenerates to the same result (but is more efficient - we only
+need to perform one compute_av call).
+
+2. If we have:
+	typebounds A B;
+	typebounds A_exec B_exec;
+then:
+	allow B B_exec:file <permissions>;
+will satisfy the bounds constraint iff:
+	allow A A_exec:file <permissions>;
+is also allowed in policy.
+
+This is essentially the same as #1; it is merely included as
+an example of dealing with object types related to a bounded domain
+in a manner that satisfies the bounds relationship.  Note that
+this approach is preferable to leaving B_exec unbounded and having:
+	allow A B_exec:file <permissions>;
+in policy because that would allow B's entrypoints to be used to
+enter A.  Similarly for _tmp or other related types.
+
+3. If we have:
+	typebounds A B;
+and an unbounded type T, then:
+	allow B T:file <permissions>;
+will satisfy the bounds constraint iff:
+	allow A T:file <permissions>;
+is allowed in policy.
+
+The old logic would have been identical for this example.
+
+4. If we have:
+	typebounds A B;
+and an unbounded domain D, then:
+	allow D B:unix_stream_socket <permissions>;
+is not subject to any bounds constraints under the new logic
+because D is not bounded.  This is desirable so that we can
+allow a domain to e.g. connectto a child domain without having
+to allow it to do the same to its parent.
+
+The old logic would have required:
+	allow D A:unix_stream_socket <permissions>;
+to also be allowed in policy.
+
+Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
+[PM: re-wrapped description to appease checkpatch.pl]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+---
+ security/selinux/ss/services.c | 70 +++++++++++++-----------------------------
+ 1 file changed, 22 insertions(+), 48 deletions(-)
+
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index 89df646..082b20c 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -543,7 +543,7 @@ static void type_attribute_bounds_av(struct context *scontext,
+ 				     struct av_decision *avd)
+ {
+ 	struct context lo_scontext;
+-	struct context lo_tcontext;
++	struct context lo_tcontext, *tcontextp = tcontext;
+ 	struct av_decision lo_avd;
+ 	struct type_datum *source;
+ 	struct type_datum *target;
+@@ -553,67 +553,41 @@ static void type_attribute_bounds_av(struct context *scontext,
+ 				    scontext->type - 1);
+ 	BUG_ON(!source);
+ 
++	if (!source->bounds)
++		return;
++
+ 	target = flex_array_get_ptr(policydb.type_val_to_struct_array,
+ 				    tcontext->type - 1);
+ 	BUG_ON(!target);
+ 
+-	if (source->bounds) {
+-		memset(&lo_avd, 0, sizeof(lo_avd));
+-
+-		memcpy(&lo_scontext, scontext, sizeof(lo_scontext));
+-		lo_scontext.type = source->bounds;
++	memset(&lo_avd, 0, sizeof(lo_avd));
+ 
+-		context_struct_compute_av(&lo_scontext,
+-					  tcontext,
+-					  tclass,
+-					  &lo_avd,
+-					  NULL);
+-		if ((lo_avd.allowed & avd->allowed) == avd->allowed)
+-			return;		/* no masked permission */
+-		masked = ~lo_avd.allowed & avd->allowed;
+-	}
++	memcpy(&lo_scontext, scontext, sizeof(lo_scontext));
++	lo_scontext.type = source->bounds;
+ 
+ 	if (target->bounds) {
+-		memset(&lo_avd, 0, sizeof(lo_avd));
+-
+ 		memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext));
+ 		lo_tcontext.type = target->bounds;
+-
+-		context_struct_compute_av(scontext,
+-					  &lo_tcontext,
+-					  tclass,
+-					  &lo_avd,
+-					  NULL);
+-		if ((lo_avd.allowed & avd->allowed) == avd->allowed)
+-			return;		/* no masked permission */
+-		masked = ~lo_avd.allowed & avd->allowed;
++		tcontextp = &lo_tcontext;
+ 	}
+ 
+-	if (source->bounds && target->bounds) {
+-		memset(&lo_avd, 0, sizeof(lo_avd));
+-		/*
+-		 * lo_scontext and lo_tcontext are already
+-		 * set up.
+-		 */
++	context_struct_compute_av(&lo_scontext,
++				  tcontextp,
++				  tclass,
++				  &lo_avd,
++				  NULL);
+ 
+-		context_struct_compute_av(&lo_scontext,
+-					  &lo_tcontext,
+-					  tclass,
+-					  &lo_avd,
+-					  NULL);
+-		if ((lo_avd.allowed & avd->allowed) == avd->allowed)
+-			return;		/* no masked permission */
+-		masked = ~lo_avd.allowed & avd->allowed;
+-	}
++	masked = ~lo_avd.allowed & avd->allowed;
+ 
+-	if (masked) {
+-		/* mask violated permissions */
+-		avd->allowed &= ~masked;
++	if (likely(!masked))
++		return;		/* no masked permission */
+ 
+-		/* audit masked permissions */
+-		security_dump_masked_av(scontext, tcontext,
+-					tclass, masked, "bounds");
+-	}
++	/* mask violated permissions */
++	avd->allowed &= ~masked;
++
++	/* audit masked permissions */
++	security_dump_masked_av(scontext, tcontext,
++				tclass, masked, "bounds");
+ }
+ 
+ /*
+-- 
+2.7.4
+

0001-udp-fix-poll-issue-with-zero-sized-packets.patch

@@ -0,0 +1,73 @@
+From 9f30f83eb6347afa6b1d1df1065608c2b4485e2b Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 23 Aug 2016 13:59:33 -0700
+Subject: [PATCH] udp: fix poll() issue with zero sized packets
+
+Laura tracked poll() [and friends] regression caused by commit
+e6afc8ace6dd ("udp: remove headers from UDP packets before queueing")
+
+udp_poll() needs to know if there is a valid packet in receive queue,
+even if its payload length is 0.
+
+Change first_packet_length() to return an signed int, and use -1
+as the indication of an empty queue.
+
+Fixes: e6afc8ace6dd ("udp: remove headers from UDP packets before queueing")
+Reported-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Tested-by: Laura Abbott <labbott@redhat.com>
+---
+ net/ipv4/udp.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index e61f7cd..00d18c5 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1182,13 +1182,13 @@ out:
+  *	@sk: socket
+  *
+  *	Drops all bad checksum frames, until a valid one is found.
+- *	Returns the length of found skb, or 0 if none is found.
++ *	Returns the length of found skb, or -1 if none is found.
+  */
+-static unsigned int first_packet_length(struct sock *sk)
++static int first_packet_length(struct sock *sk)
+ {
+ 	struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
+ 	struct sk_buff *skb;
+-	unsigned int res;
++	int res;
+ 
+ 	__skb_queue_head_init(&list_kill);
+ 
+@@ -1203,7 +1203,7 @@ static unsigned int first_packet_length(struct sock *sk)
+ 		__skb_unlink(skb, rcvq);
+ 		__skb_queue_tail(&list_kill, skb);
+ 	}
+-	res = skb ? skb->len : 0;
++	res = skb ? skb->len : -1;
+ 	spin_unlock_bh(&rcvq->lock);
+ 
+ 	if (!skb_queue_empty(&list_kill)) {
+@@ -1232,7 +1232,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+ 
+ 	case SIOCINQ:
+ 	{
+-		unsigned int amount = first_packet_length(sk);
++		int amount = max_t(int, 0, first_packet_length(sk));
+ 
+ 		return put_user(amount, (int __user *)arg);
+ 	}
+@@ -2184,7 +2184,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ 
+ 	/* Check for false positives due to checksum errors */
+ 	if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
+-	    !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
++	    !(sk->sk_shutdown & RCV_SHUTDOWN) && first_packet_length(sk) == -1)
+ 		mask &= ~(POLLIN | POLLRDNORM);
+ 
+ 	return mask;
+-- 
+2.7.4
+

0001-x86-cpu-cacheinfo-Fix-teardown-path.patch

@@ -0,0 +1,86 @@
+From 680ac028240f8747f31c03986fbcf18b2b521e93 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@suse.de>
+Date: Mon, 27 Jul 2015 09:58:05 +0200
+Subject: [PATCH] x86/cpu/cacheinfo: Fix teardown path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Philip Müller reported a hang when booting 32-bit 4.1 kernel on
+an AMD box. A fragment of the splat was enough to pinpoint the
+issue:
+
+  task: f58e0000 ti: f58e8000 task.ti: f58e800
+  EIP: 0060:[<c135a903>] EFLAGS: 00010206 CPU: 0
+  EIP is at free_cache_attributes+0x83/0xd0
+  EAX: 00000001 EBX: f589d46c ECX: 00000090 EDX: 360c2000
+  ESI: 00000000 EDI: c1724a80 EBP: f58e9ec0 ESP: f58e9ea0
+   DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+  CR0: 8005003b CR2: 000000ac CR3: 01731000 CR4: 000006d0
+
+cache_shared_cpu_map_setup() did check sibling CPUs cacheinfo
+descriptor while the respective teardown path
+cache_shared_cpu_map_remove() didn't. Fix that.
+
+From tglx's version: to be on the safe side, move the cacheinfo
+descriptor check to free_cache_attributes(), thus cleaning up
+the hotplug path a little and making this even more robust.
+
+Reported-by: Philip Müller <philm@manjaro.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: <stable@vger.kernel.org> # v4.1+
+Cc: Andre Przywara <andre.przywara@arm.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sudeep Holla <sudeep.holla@arm.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-kernel@vger.kernel.org
+Cc: manjaro-dev@manjaro.org
+Link: http://lkml.kernel.org/r/20150727075805.GA20416@nazgul.tnic
+Link: https://lkml.kernel.org/r/55B47BB8.6080202@manjaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+---
+ drivers/base/cacheinfo.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
+index 764280a91776..e9fd32e91668 100644
+--- a/drivers/base/cacheinfo.c
++++ b/drivers/base/cacheinfo.c
+@@ -148,7 +148,11 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
+ 
+ 			if (sibling == cpu) /* skip itself */
+ 				continue;
++
+ 			sib_cpu_ci = get_cpu_cacheinfo(sibling);
++			if (!sib_cpu_ci->info_list)
++				continue;
++
+ 			sib_leaf = sib_cpu_ci->info_list + index;
+ 			cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map);
+ 			cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map);
+@@ -159,6 +163,9 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
+ 
+ static void free_cache_attributes(unsigned int cpu)
+ {
++	if (!per_cpu_cacheinfo(cpu))
++		return;
++
+ 	cache_shared_cpu_map_remove(cpu);
+ 
+ 	kfree(per_cpu_cacheinfo(cpu));
+@@ -514,8 +521,7 @@ static int cacheinfo_cpu_callback(struct notifier_block *nfb,
+ 		break;
+ 	case CPU_DEAD:
+ 		cache_remove_dev(cpu);
+-		if (per_cpu_cacheinfo(cpu))
+-			free_cache_attributes(cpu);
++		free_cache_attributes(cpu);
+ 		break;
+ 	}
+ 	return notifier_from_errno(rc);
+-- 
+2.4.3
+

0002-drm-i915-Rename-s-skl_compute_pipe_wm-skl_build_pipe.patch

@@ -0,0 +1,60 @@
+From 4d428f0fd6aaaa75382885d897900f619b2dad35 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 11:12:56 +0200
+Subject: [PATCH 02/17] drm/i915: Rename
+ s/skl_compute_pipe_wm/skl_build_pipe_wm/
+
+Upstream: since drm-intel-next-2016-05-22
+commit e7649b54777ba6491204acbe1f1a34fce78637d5
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:05:56 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:32:27 2016 -0700
+
+    drm/i915: Rename s/skl_compute_pipe_wm/skl_build_pipe_wm/
+
+    When we added atomic watermarks, we added a new display vfunc
+    'compute_pipe_wm' that is used to compute any pipe-specific watermark
+    information that we can at atomic check time.  This was a somewhat poor
+    naming choice since we already had a 'skl_compute_pipe_wm' function that
+    doesn't quite fit this model --- the existing SKL function is something
+    that gets used at atomic commit time, after the DDB allocation has been
+    determined.  Let's rename the existing SKL function to avoid confusion.
+
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-3-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_pm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 0da1d60..8f081b2 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3266,9 +3266,9 @@ static void skl_compute_transition_wm(struct intel_crtc_state *cstate,
+ 	}
+ }
+ 
+-static void skl_compute_pipe_wm(struct intel_crtc_state *cstate,
+-				struct skl_ddb_allocation *ddb,
+-				struct skl_pipe_wm *pipe_wm)
++static void skl_build_pipe_wm(struct intel_crtc_state *cstate,
++			      struct skl_ddb_allocation *ddb,
++			      struct skl_pipe_wm *pipe_wm)
+ {
+ 	struct drm_device *dev = cstate->base.crtc->dev;
+ 	const struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -3535,7 +3535,7 @@ static bool skl_update_pipe_wm(struct drm_crtc *crtc,
+ 	struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
+ 
+ 	skl_allocate_pipe_ddb(cstate, ddb);
+-	skl_compute_pipe_wm(cstate, ddb, pipe_wm);
++	skl_build_pipe_wm(cstate, ddb, pipe_wm);
+ 
+ 	if (!memcmp(&intel_crtc->wm.active.skl, pipe_wm, sizeof(*pipe_wm)))
+ 		return false;
+-- 
+2.7.4
+

0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch

@@ -0,0 +1,104 @@
+From a878e3fa9657646ff85468075823870fbbd5745f Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Wed, 30 Mar 2016 12:41:22 +0100
+Subject: [PATCH 2/2] net: dsa: mv88e6xxx: Clear the PDOWN bit on setup
+
+Some of the vendor-specific bootloaders set up this part
+of the initialization for us, so this was never added.
+However, since upstream bootloaders don't initialize the
+chip specifically, they leave the fiber MII's PDOWN flag
+set, which means that the CPU port doesn't connect.
+
+This patch checks whether this flag has been clear prior
+by something else, and if not make us clear it.
+
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
+---
+ drivers/net/dsa/mv88e6xxx.c | 36 ++++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/mv88e6xxx.h |  8 ++++++++
+ 2 files changed, 44 insertions(+)
+
+diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
+index 3dcfe13..a4e3750 100644
+--- a/drivers/net/dsa/mv88e6xxx.c
++++ b/drivers/net/dsa/mv88e6xxx.c
+@@ -1961,6 +1961,25 @@ restore_page_0:
+ 	return ret;
+ }
+ 
++static int mv88e6xxx_power_on_serdes(struct dsa_switch *ds)
++{
++	int ret;
++
++	ret = _mv88e6xxx_phy_page_read(ds, REG_FIBER_SERDES, PAGE_FIBER_SERDES,
++				       MII_BMCR);
++	if (ret < 0)
++		return ret;
++
++	if (ret & BMCR_PDOWN) {
++		ret &= ~BMCR_PDOWN;
++		ret = _mv88e6xxx_phy_page_write(ds, REG_FIBER_SERDES,
++						PAGE_FIBER_SERDES, MII_BMCR,
++						ret);
++	}
++
++	return ret;
++}
++
+ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
+ {
+ 	struct mv88e6xxx_priv_state *ps = ds_to_priv(ds);
+@@ -2064,6 +2083,23 @@ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
+ 			goto abort;
+ 	}
+ 
++	/* If this port is connected to a SerDes, make sure the SerDes is not
++	 * powered down.
++	 */
++	if (mv88e6xxx_6352_family(ds)) {
++		ret = _mv88e6xxx_reg_read(ds, REG_PORT(port), PORT_STATUS);
++		if (ret < 0)
++			goto abort;
++		ret &= PORT_STATUS_CMODE_MASK;
++		if ((ret == PORT_STATUS_CMODE_100BASE_X) ||
++		    (ret == PORT_STATUS_CMODE_1000BASE_X) ||
++		    (ret == PORT_STATUS_CMODE_SGMII)) {
++			ret = mv88e6xxx_power_on_serdes(ds);
++			if (ret < 0)
++				goto abort;
++		}
++	}
++
+ 	/* Port Control 2: don't force a good FCS, set the maximum frame size to
+ 	 * 10240 bytes, enable secure 802.1q tags, don't discard tagged or
+ 	 * untagged frames on this port, do a destination address lookup on all
+diff --git a/drivers/net/dsa/mv88e6xxx.h b/drivers/net/dsa/mv88e6xxx.h
+index ca08f91..adc7f0d 100644
+--- a/drivers/net/dsa/mv88e6xxx.h
++++ b/drivers/net/dsa/mv88e6xxx.h
+@@ -28,6 +28,10 @@
+ #define SMI_CMD_OP_45_READ_DATA_INC	((3 << 10) | SMI_CMD_BUSY)
+ #define SMI_DATA		0x01
+ 
++/* Fiber/SERDES Registers are located at SMI address F, page 1 */
++#define REG_FIBER_SERDES	0x0f
++#define PAGE_FIBER_SERDES	0x01
++
+ #define REG_PORT(p)		(0x10 + (p))
+ #define PORT_STATUS		0x00
+ #define PORT_STATUS_PAUSE_EN	BIT(15)
+@@ -45,6 +49,10 @@
+ #define PORT_STATUS_MGMII	BIT(6) /* 6185 */
+ #define PORT_STATUS_TX_PAUSED	BIT(5)
+ #define PORT_STATUS_FLOW_CTRL	BIT(4)
++#define PORT_STATUS_CMODE_MASK	0x0f
++#define PORT_STATUS_CMODE_100BASE_X	0x8
++#define PORT_STATUS_CMODE_1000BASE_X	0x9
++#define PORT_STATUS_CMODE_SGMII		0xa
+ #define PORT_PCS_CTRL		0x01
+ #define PORT_PCS_CTRL_RGMII_DELAY_RXCLK	BIT(15)
+ #define PORT_PCS_CTRL_RGMII_DELAY_TXCLK	BIT(14)
+-- 
+2.7.3
+

0003-drm-i915-gen9-Cache-plane-data-rates-in-CRTC-state.patch

@@ -0,0 +1,214 @@
+From 0206aec944641c69815562407b73b6f9df22f041 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 11:13:09 +0200
+Subject: [PATCH 03/17] drm/i915/gen9: Cache plane data rates in CRTC state
+
+Upstream: since drm-intel-next-2016-05-22
+commit a1de91e5f3039dfc32ac2b77ffb280a68646cbc7
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:05:57 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:32:35 2016 -0700
+
+    drm/i915/gen9: Cache plane data rates in CRTC state
+
+    This will be important when we start calculating CRTC data rates for
+    in-flight CRTC states since it will allow us to calculate the total data
+    rate without needing to grab the plane state for any planes that aren't
+    updated by the transaction.
+
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-4-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_drv.h |  4 ++
+ drivers/gpu/drm/i915/intel_pm.c  | 92 ++++++++++++++++++++++++++--------------
+ 2 files changed, 63 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 7d19baf..7c00ab6 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -385,6 +385,10 @@ struct intel_crtc_wm_state {
+ 		struct {
+ 			/* gen9+ only needs 1-step wm programming */
+ 			struct skl_pipe_wm optimal;
++
++			/* cached plane data rate */
++			unsigned plane_data_rate[I915_MAX_PLANES];
++			unsigned plane_y_data_rate[I915_MAX_PLANES];
+ 		} skl;
+ 	};
+ 
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 8f081b2..854f0a4 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2879,6 +2879,14 @@ skl_plane_relative_data_rate(const struct intel_crtc_state *cstate,
+ 	struct intel_plane_state *intel_pstate = to_intel_plane_state(pstate);
+ 	struct drm_framebuffer *fb = pstate->fb;
+ 	uint32_t width = 0, height = 0;
++	unsigned format = fb ? fb->pixel_format : DRM_FORMAT_XRGB8888;
++
++	if (!intel_pstate->visible)
++		return 0;
++	if (pstate->plane->type == DRM_PLANE_TYPE_CURSOR)
++		return 0;
++	if (y && format != DRM_FORMAT_NV12)
++		return 0;
+ 
+ 	width = drm_rect_width(&intel_pstate->src) >> 16;
+ 	height = drm_rect_height(&intel_pstate->src) >> 16;
+@@ -2887,17 +2895,17 @@ skl_plane_relative_data_rate(const struct intel_crtc_state *cstate,
+ 		swap(width, height);
+ 
+ 	/* for planar format */
+-	if (fb->pixel_format == DRM_FORMAT_NV12) {
++	if (format == DRM_FORMAT_NV12) {
+ 		if (y)  /* y-plane data rate */
+ 			return width * height *
+-				drm_format_plane_cpp(fb->pixel_format, 0);
++				drm_format_plane_cpp(format, 0);
+ 		else    /* uv-plane data rate */
+ 			return (width / 2) * (height / 2) *
+-				drm_format_plane_cpp(fb->pixel_format, 1);
++				drm_format_plane_cpp(format, 1);
+ 	}
+ 
+ 	/* for packed formats */
+-	return width * height * drm_format_plane_cpp(fb->pixel_format, 0);
++	return width * height * drm_format_plane_cpp(format, 0);
+ }
+ 
+ /*
+@@ -2906,32 +2914,34 @@ skl_plane_relative_data_rate(const struct intel_crtc_state *cstate,
+  *   3 * 4096 * 8192  * 4 < 2^32
+  */
+ static unsigned int
+-skl_get_total_relative_data_rate(const struct intel_crtc_state *cstate)
++skl_get_total_relative_data_rate(struct intel_crtc_state *cstate)
+ {
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(cstate->base.crtc);
+ 	struct drm_device *dev = intel_crtc->base.dev;
+ 	const struct intel_plane *intel_plane;
+-	unsigned int total_data_rate = 0;
++	unsigned int rate, total_data_rate = 0;
+ 
++	/* Calculate and cache data rate for each plane */
+ 	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+ 		const struct drm_plane_state *pstate = intel_plane->base.state;
++		int id = skl_wm_plane_id(intel_plane);
+ 
+-		if (pstate->fb == NULL)
+-			continue;
++		/* packed/uv */
++		rate = skl_plane_relative_data_rate(cstate, pstate, 0);
++		cstate->wm.skl.plane_data_rate[id] = rate;
+ 
+-		if (intel_plane->base.type == DRM_PLANE_TYPE_CURSOR)
+-			continue;
++		/* y-plane */
++		rate = skl_plane_relative_data_rate(cstate, pstate, 1);
++		cstate->wm.skl.plane_y_data_rate[id] = rate;
++	}
+ 
+-		/* packed/uv */
+-		total_data_rate += skl_plane_relative_data_rate(cstate,
+-								pstate,
+-								0);
++	/* Calculate CRTC's total data rate from cached values */
++	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
++		int id = skl_wm_plane_id(intel_plane);
+ 
+-		if (pstate->fb->pixel_format == DRM_FORMAT_NV12)
+-			/* y-plane */
+-			total_data_rate += skl_plane_relative_data_rate(cstate,
+-									pstate,
+-									1);
++		/* packed/uv */
++		total_data_rate += cstate->wm.skl.plane_data_rate[id];
++		total_data_rate += cstate->wm.skl.plane_y_data_rate[id];
+ 	}
+ 
+ 	return total_data_rate;
+@@ -2995,6 +3005,8 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 	 * FIXME: we may not allocate every single block here.
+ 	 */
+ 	total_data_rate = skl_get_total_relative_data_rate(cstate);
++	if (total_data_rate == 0)
++		return;
+ 
+ 	start = alloc->start;
+ 	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+@@ -3009,7 +3021,7 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 		if (plane->type == DRM_PLANE_TYPE_CURSOR)
+ 			continue;
+ 
+-		data_rate = skl_plane_relative_data_rate(cstate, pstate, 0);
++		data_rate = cstate->wm.skl.plane_data_rate[id];
+ 
+ 		/*
+ 		 * allocation for (packed formats) or (uv-plane part of planar format):
+@@ -3028,20 +3040,16 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 		/*
+ 		 * allocation for y_plane part of planar format:
+ 		 */
+-		if (pstate->fb->pixel_format == DRM_FORMAT_NV12) {
+-			y_data_rate = skl_plane_relative_data_rate(cstate,
+-								   pstate,
+-								   1);
+-			y_plane_blocks = y_minimum[id];
+-			y_plane_blocks += div_u64((uint64_t)alloc_size * y_data_rate,
+-						total_data_rate);
+-
+-			ddb->y_plane[pipe][id].start = start;
+-			ddb->y_plane[pipe][id].end = start + y_plane_blocks;
+-
+-			start += y_plane_blocks;
+-		}
++		y_data_rate = cstate->wm.skl.plane_y_data_rate[id];
++
++		y_plane_blocks = y_minimum[id];
++		y_plane_blocks += div_u64((uint64_t)alloc_size * y_data_rate,
++					total_data_rate);
+ 
++		ddb->y_plane[pipe][id].start = start;
++		ddb->y_plane[pipe][id].end = start + y_plane_blocks;
++
++		start += y_plane_blocks;
+ 	}
+ 
+ }
+@@ -3820,10 +3828,28 @@ void skl_wm_get_hw_state(struct drm_device *dev)
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	struct skl_ddb_allocation *ddb = &dev_priv->wm.skl_hw.ddb;
+ 	struct drm_crtc *crtc;
++	struct intel_crtc *intel_crtc;
+ 
+ 	skl_ddb_get_hw_state(dev_priv, ddb);
+ 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+ 		skl_pipe_wm_get_hw_state(crtc);
++
++	/* Calculate plane data rates */
++	for_each_intel_crtc(dev, intel_crtc) {
++		struct intel_crtc_state *cstate = intel_crtc->config;
++		struct intel_plane *intel_plane;
++
++		for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
++			const struct drm_plane_state *pstate =
++				intel_plane->base.state;
++			int id = skl_wm_plane_id(intel_plane);
++
++			cstate->wm.skl.plane_data_rate[id] =
++				skl_plane_relative_data_rate(cstate, pstate, 0);
++			cstate->wm.skl.plane_y_data_rate[id] =
++				skl_plane_relative_data_rate(cstate, pstate, 1);
++		}
++	}
+ }
+ 
+ static void ilk_pipe_wm_get_hw_state(struct drm_crtc *crtc)
+-- 
+2.7.4
+

0004-drm-i915-gen9-Allow-calculation-of-data-rate-for-in-.patch

@@ -0,0 +1,141 @@
+From a75a3c793e2cd3e7648597f2c77d87453f520f31 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 11:13:23 +0200
+Subject: [PATCH 04/17] drm/i915/gen9: Allow calculation of data rate for
+ in-flight state (v2)
+
+Upstream: since drm-intel-next-2016-05-22
+commit 9c74d82621c553f0da1f41bd5d90f5eab5659fdb
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:05:58 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:32:49 2016 -0700
+
+    drm/i915/gen9: Allow calculation of data rate for in-flight state (v2)
+
+    Our skl_get_total_relative_data_rate() function gets passed a crtc state
+    object to calculate the data rate for, but it currently always looks
+    up the committed plane states that correspond to that CRTC.  Let's
+    check whether the CRTC state is an in-flight state (meaning
+    cstate->state is non-NULL) and if so, use the corresponding in-flight
+    plane states.
+
+    We'll soon be using this function exclusively for in-flight states; at
+    that time we'll be able to simplify the function a bit, but for now we
+    allow it to be used in either mode.
+
+    v2:
+     - Rebase on top of changes to cache plane data rates.
+
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-5-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_pm.c | 74 +++++++++++++++++++++++++++++++++--------
+ 1 file changed, 60 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 854f0a4..b863bfc 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2914,25 +2914,69 @@ skl_plane_relative_data_rate(const struct intel_crtc_state *cstate,
+  *   3 * 4096 * 8192  * 4 < 2^32
+  */
+ static unsigned int
+-skl_get_total_relative_data_rate(struct intel_crtc_state *cstate)
++skl_get_total_relative_data_rate(struct intel_crtc_state *intel_cstate)
+ {
+-	struct intel_crtc *intel_crtc = to_intel_crtc(cstate->base.crtc);
+-	struct drm_device *dev = intel_crtc->base.dev;
++	struct drm_crtc_state *cstate = &intel_cstate->base;
++	struct drm_atomic_state *state = cstate->state;
++	struct drm_crtc *crtc = cstate->crtc;
++	struct drm_device *dev = crtc->dev;
++	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ 	const struct intel_plane *intel_plane;
+ 	unsigned int rate, total_data_rate = 0;
++	int id;
+ 
+ 	/* Calculate and cache data rate for each plane */
+-	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+-		const struct drm_plane_state *pstate = intel_plane->base.state;
+-		int id = skl_wm_plane_id(intel_plane);
++	/*
++	 * FIXME: At the moment this function can be called on either an
++	 * in-flight or a committed state object.  If it's in-flight then we
++	 * only want to re-calculate the plane data rate for planes that are
++	 * part of the transaction (i.e., we don't want to grab any additional
++	 * plane states if we don't have to).  If we're operating on committed
++	 * state, we'll just go ahead and recalculate the plane data rate for
++	 * all planes.
++	 *
++	 * Once we finish moving our DDB allocation to the atomic check phase,
++	 * we'll only be calling this function on in-flight state objects, so
++	 * the 'else' branch here will go away.
++	 */
++	if (state) {
++		struct drm_plane *plane;
++		struct drm_plane_state *pstate;
++		int i;
++
++		for_each_plane_in_state(state, plane, pstate, i) {
++			intel_plane = to_intel_plane(plane);
++			id = skl_wm_plane_id(intel_plane);
++
++			if (intel_plane->pipe != intel_crtc->pipe)
++				continue;
++
++			/* packed/uv */
++			rate = skl_plane_relative_data_rate(intel_cstate,
++							    pstate, 0);
++			intel_cstate->wm.skl.plane_data_rate[id] = rate;
++
++			/* y-plane */
++			rate = skl_plane_relative_data_rate(intel_cstate,
++							    pstate, 1);
++			intel_cstate->wm.skl.plane_y_data_rate[id] = rate;
++		}
++	} else {
++		for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
++			const struct drm_plane_state *pstate =
++				intel_plane->base.state;
++			int id = skl_wm_plane_id(intel_plane);
+ 
+-		/* packed/uv */
+-		rate = skl_plane_relative_data_rate(cstate, pstate, 0);
+-		cstate->wm.skl.plane_data_rate[id] = rate;
++			/* packed/uv */
++			rate = skl_plane_relative_data_rate(intel_cstate,
++							    pstate, 0);
++			intel_cstate->wm.skl.plane_data_rate[id] = rate;
+ 
+-		/* y-plane */
+-		rate = skl_plane_relative_data_rate(cstate, pstate, 1);
+-		cstate->wm.skl.plane_y_data_rate[id] = rate;
++			/* y-plane */
++			rate = skl_plane_relative_data_rate(intel_cstate,
++							    pstate, 1);
++			intel_cstate->wm.skl.plane_y_data_rate[id] = rate;
++		}
+ 	}
+ 
+ 	/* Calculate CRTC's total data rate from cached values */
+@@ -2940,10 +2984,12 @@ skl_get_total_relative_data_rate(struct intel_crtc_state *cstate)
+ 		int id = skl_wm_plane_id(intel_plane);
+ 
+ 		/* packed/uv */
+-		total_data_rate += cstate->wm.skl.plane_data_rate[id];
+-		total_data_rate += cstate->wm.skl.plane_y_data_rate[id];
++		total_data_rate += intel_cstate->wm.skl.plane_data_rate[id];
++		total_data_rate += intel_cstate->wm.skl.plane_y_data_rate[id];
+ 	}
+ 
++	WARN_ON(cstate->plane_mask && total_data_rate == 0);
++
+ 	return total_data_rate;
+ }
+ 
+-- 
+2.7.4
+

0005-drm-i915-gen9-Store-plane-minimum-blocks-in-CRTC-wm-.patch

@@ -0,0 +1,67 @@
+From cd21ce996b94fd149b3487398e5250e9f0cc8811 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 12:39:24 +0200
+Subject: [PATCH 05/17] drm/i915/gen9: Store plane minimum blocks in CRTC wm
+ state (v2)
+
+Upstream: since drm-intel-next-2016-05-22
+commit 86a2100a8b96594902bb59b90614377df4f64ce0
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:05:59 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:32:56 2016 -0700
+
+    drm/i915/gen9: Store plane minimum blocks in CRTC wm state (v2)
+
+    This will eventually allow us to re-use old values without
+    re-calculating them for unchanged planes (which also helps us avoid
+    re-grabbing extra plane states).
+
+    v2:
+     -  Drop unnecessary memset's; they were meant for a later patch (which
+        got reworked anyway to not need them, but were mis-rebased into this
+        one.  (Maarten)
+
+    Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-6-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_drv.h | 4 ++++
+ drivers/gpu/drm/i915/intel_pm.c  | 4 ++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 7c00ab6..d246308 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -389,6 +389,10 @@ struct intel_crtc_wm_state {
+ 			/* cached plane data rate */
+ 			unsigned plane_data_rate[I915_MAX_PLANES];
+ 			unsigned plane_y_data_rate[I915_MAX_PLANES];
++
++			/* minimum block allocation */
++			uint16_t minimum_blocks[I915_MAX_PLANES];
++			uint16_t minimum_y_blocks[I915_MAX_PLANES];
+ 		} skl;
+ 	};
+ 
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index b863bfc..00db6e9 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3006,8 +3006,8 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 	enum pipe pipe = intel_crtc->pipe;
+ 	struct skl_ddb_entry *alloc = &ddb->pipe[pipe];
+ 	uint16_t alloc_size, start, cursor_blocks;
+-	uint16_t minimum[I915_MAX_PLANES];
+-	uint16_t y_minimum[I915_MAX_PLANES];
++	uint16_t *minimum = cstate->wm.skl.minimum_blocks;
++	uint16_t *y_minimum = cstate->wm.skl.minimum_y_blocks;
+ 	unsigned int total_data_rate;
+ 
+ 	skl_ddb_get_pipe_allocation_limits(dev, cstate, config, alloc);
+-- 
+2.7.4
+

0006-drm-i915-Track-whether-an-atomic-transaction-changes.patch

@@ -0,0 +1,68 @@
+From 00edb23bcefa3ad6931f2a2855fe0801a55523f7 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 12:39:40 +0200
+Subject: [PATCH 06/17] drm/i915: Track whether an atomic transaction changes
+ the active CRTC's
+
+Upstream: since drm-intel-next-2016-05-22
+commit 8b4a7d0597cd9910d7127ffae6ae91d21853a8a2
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:06:00 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:33:10 2016 -0700
+
+    drm/i915: Track whether an atomic transaction changes the active CRTC's
+
+    For the purposes of DDB re-allocation we need to know whether a
+    transaction changes the list of CRTC's that are active.  While
+    state->modeset could be used for this purpose, that would be slightly
+    too aggressive since it would lead us to re-allocate the DDB when a
+    CRTC's mode changes, but not its final active state.
+
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-7-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_display.c |  3 +++
+ drivers/gpu/drm/i915/intel_drv.h     | 10 ++++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 7d855ba..f53df81 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13183,6 +13183,9 @@ static int intel_modeset_checks(struct drm_atomic_state *state)
+ 			intel_state->active_crtcs |= 1 << i;
+ 		else
+ 			intel_state->active_crtcs &= ~(1 << i);
++
++		if (crtc_state->active != crtc->state->active)
++			intel_state->active_pipe_changes |= drm_crtc_mask(crtc);
+ 	}
+ 
+ 	/*
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index d246308..672ca56 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -256,6 +256,16 @@ struct intel_atomic_state {
+ 
+ 	bool dpll_set, modeset;
+ 
++	/*
++	 * Does this transaction change the pipes that are active?  This mask
++	 * tracks which CRTC's have changed their active state at the end of
++	 * the transaction (not counting the temporary disable during modesets).
++	 * This mask should only be non-zero when intel_state->modeset is true,
++	 * but the converse is not necessarily true; simply changing a mode may
++	 * not flip the final active status of any CRTC's
++	 */
++	unsigned int active_pipe_changes;
++
+ 	unsigned int active_crtcs;
+ 	unsigned int min_pixclk[I915_MAX_PIPES];
+ 
+-- 
+2.7.4
+

0007-drm-i915-gen9-Allow-skl_allocate_pipe_ddb-to-operate.patch

@@ -0,0 +1,352 @@
+From 99dd9c3733696d4a2536b21988c9b1b8f5195c5b Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 12:40:00 +0200
+Subject: [PATCH 07/17] drm/i915/gen9: Allow skl_allocate_pipe_ddb() to operate
+ on in-flight state (v3)
+
+Upstream: since drm-intel-next-2016-05-22
+commit c107acfeb03187873657ccc8af4fc5c704b3626b
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:06:01 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:33:16 2016 -0700
+
+    drm/i915/gen9: Allow skl_allocate_pipe_ddb() to operate on in-flight state (v3)
+
+    We eventually want to calculate watermark values at atomic 'check' time
+    instead of atomic 'commit' time so that any requested configurations
+    that result in impossible watermark requirements are properly rejected.
+    The first step along this path is to allocate the DDB at atomic 'check'
+    time.  As we perform this transition, allow the main allocation function
+    to operate successfully on either an in-flight state or an
+    already-commited state.  Once we complete the transition in a future
+    patch, we'll come back and remove the unnecessary logic for the
+    already-committed case.
+
+    v2: Rebase/refactor; we should no longer need to grab extra plane states
+        while allocating the DDB since we can pull cached data rates and
+        minimum block counts from the CRTC state for any planes that aren't
+        being modified by this transaction.
+
+    v3:
+     - Simplify memsets to clear DDB plane entries.  (Maarten)
+     - Drop a redundant memset of plane[pipe][PLANE_CURSOR] that was added
+       by an earlier Coccinelle patch.  (Maarten)
+     - Assign *num_active at the top of skl_ddb_get_pipe_allocation_limits()
+       so that no code paths return without setting it.  (kbuild robot)
+
+    Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-8-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/i915_drv.h |   6 ++
+ drivers/gpu/drm/i915/intel_pm.c | 179 +++++++++++++++++++++++++++++-----------
+ 2 files changed, 139 insertions(+), 46 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index daba7eb..804af6f 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -281,6 +281,12 @@ struct i915_hotplug {
+ 			    &dev->mode_config.plane_list,	\
+ 			    base.head)
+ 
++#define for_each_intel_plane_mask(dev, intel_plane, plane_mask)		\
++	list_for_each_entry(intel_plane, &dev->mode_config.plane_list,	\
++			    base.head)					\
++		for_each_if ((plane_mask) &				\
++			     (1 << drm_plane_index(&intel_plane->base)))
++
+ #define for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane)	\
+ 	list_for_each_entry(intel_plane,				\
+ 			    &(dev)->mode_config.plane_list,		\
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 00db6e9..ee82b1f 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2788,13 +2788,25 @@ skl_wm_plane_id(const struct intel_plane *plane)
+ static void
+ skl_ddb_get_pipe_allocation_limits(struct drm_device *dev,
+ 				   const struct intel_crtc_state *cstate,
+-				   const struct intel_wm_config *config,
+-				   struct skl_ddb_entry *alloc /* out */)
++				   struct intel_wm_config *config,
++				   struct skl_ddb_entry *alloc, /* out */
++				   int *num_active /* out */)
+ {
++	struct drm_atomic_state *state = cstate->base.state;
++	struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
++	struct drm_i915_private *dev_priv = to_i915(dev);
+ 	struct drm_crtc *for_crtc = cstate->base.crtc;
+ 	struct drm_crtc *crtc;
+ 	unsigned int pipe_size, ddb_size;
+ 	int nth_active_pipe;
++	int pipe = to_intel_crtc(for_crtc)->pipe;
++
++	if (intel_state && intel_state->active_pipe_changes)
++		*num_active = hweight32(intel_state->active_crtcs);
++	else if (intel_state)
++		*num_active = hweight32(dev_priv->active_crtcs);
++	else
++		*num_active = config->num_pipes_active;
+ 
+ 	if (!cstate->base.active) {
+ 		alloc->start = 0;
+@@ -2809,25 +2821,56 @@ skl_ddb_get_pipe_allocation_limits(struct drm_device *dev,
+ 
+ 	ddb_size -= 4; /* 4 blocks for bypass path allocation */
+ 
+-	nth_active_pipe = 0;
+-	for_each_crtc(dev, crtc) {
+-		if (!to_intel_crtc(crtc)->active)
+-			continue;
++	/*
++	 * FIXME: At the moment we may be called on either in-flight or fully
++	 * committed cstate's.  Once we fully move DDB allocation in the check
++	 * phase, we'll only be called on in-flight states and the 'else'
++	 * branch here will go away.
++	 *
++	 * The 'else' branch is slightly racy here, but it was racy to begin
++	 * with; since it's going away soon, no effort is made to address that.
++	 */
++	if (state) {
++		/*
++		 * If the state doesn't change the active CRTC's, then there's
++		 * no need to recalculate; the existing pipe allocation limits
++		 * should remain unchanged.  Note that we're safe from racing
++		 * commits since any racing commit that changes the active CRTC
++		 * list would need to grab _all_ crtc locks, including the one
++		 * we currently hold.
++		 */
++		if (!intel_state->active_pipe_changes) {
++			*alloc = dev_priv->wm.skl_hw.ddb.pipe[pipe];
++			return;
++		}
+ 
+-		if (crtc == for_crtc)
+-			break;
++		nth_active_pipe = hweight32(intel_state->active_crtcs &
++					    (drm_crtc_mask(for_crtc) - 1));
++		pipe_size = ddb_size / hweight32(intel_state->active_crtcs);
++		alloc->start = nth_active_pipe * ddb_size / *num_active;
++		alloc->end = alloc->start + pipe_size;
++	} else {
++		nth_active_pipe = 0;
++		for_each_crtc(dev, crtc) {
++			if (!to_intel_crtc(crtc)->active)
++				continue;
+ 
+-		nth_active_pipe++;
+-	}
++			if (crtc == for_crtc)
++				break;
++
++			nth_active_pipe++;
++		}
+ 
+-	pipe_size = ddb_size / config->num_pipes_active;
+-	alloc->start = nth_active_pipe * ddb_size / config->num_pipes_active;
+-	alloc->end = alloc->start + pipe_size;
++		pipe_size = ddb_size / config->num_pipes_active;
++		alloc->start = nth_active_pipe * ddb_size /
++			config->num_pipes_active;
++		alloc->end = alloc->start + pipe_size;
++	}
+ }
+ 
+-static unsigned int skl_cursor_allocation(const struct intel_wm_config *config)
++static unsigned int skl_cursor_allocation(int num_active)
+ {
+-	if (config->num_pipes_active == 1)
++	if (num_active == 1)
+ 		return 32;
+ 
+ 	return 8;
+@@ -2993,33 +3036,44 @@ skl_get_total_relative_data_rate(struct intel_crtc_state *intel_cstate)
+ 	return total_data_rate;
+ }
+ 
+-static void
++static int
+ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 		      struct skl_ddb_allocation *ddb /* out */)
+ {
++	struct drm_atomic_state *state = cstate->base.state;
+ 	struct drm_crtc *crtc = cstate->base.crtc;
+ 	struct drm_device *dev = crtc->dev;
+ 	struct drm_i915_private *dev_priv = to_i915(dev);
+ 	struct intel_wm_config *config = &dev_priv->wm.config;
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ 	struct intel_plane *intel_plane;
++	struct drm_plane *plane;
++	struct drm_plane_state *pstate;
+ 	enum pipe pipe = intel_crtc->pipe;
+ 	struct skl_ddb_entry *alloc = &ddb->pipe[pipe];
+ 	uint16_t alloc_size, start, cursor_blocks;
+ 	uint16_t *minimum = cstate->wm.skl.minimum_blocks;
+ 	uint16_t *y_minimum = cstate->wm.skl.minimum_y_blocks;
+ 	unsigned int total_data_rate;
++	int num_active;
++	int id, i;
++
++	if (!cstate->base.active) {
++		ddb->pipe[pipe].start = ddb->pipe[pipe].end = 0;
++		memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
++		memset(ddb->y_plane[pipe], 0, sizeof(ddb->y_plane[pipe]));
++		return 0;
++	}
+ 
+-	skl_ddb_get_pipe_allocation_limits(dev, cstate, config, alloc);
++	skl_ddb_get_pipe_allocation_limits(dev, cstate, config, alloc,
++					   &num_active);
+ 	alloc_size = skl_ddb_entry_size(alloc);
+ 	if (alloc_size == 0) {
+ 		memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
+-		memset(&ddb->plane[pipe][PLANE_CURSOR], 0,
+-		       sizeof(ddb->plane[pipe][PLANE_CURSOR]));
+-		return;
++		return 0;
+ 	}
+ 
+-	cursor_blocks = skl_cursor_allocation(config);
++	cursor_blocks = skl_cursor_allocation(num_active);
+ 	ddb->plane[pipe][PLANE_CURSOR].start = alloc->end - cursor_blocks;
+ 	ddb->plane[pipe][PLANE_CURSOR].end = alloc->end;
+ 
+@@ -3027,21 +3081,55 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 	alloc->end -= cursor_blocks;
+ 
+ 	/* 1. Allocate the mininum required blocks for each active plane */
+-	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+-		struct drm_plane *plane = &intel_plane->base;
+-		struct drm_framebuffer *fb = plane->state->fb;
+-		int id = skl_wm_plane_id(intel_plane);
++	/*
++	 * TODO: Remove support for already-committed state once we
++	 * only allocate DDB on in-flight states.
++	 */
++	if (state) {
++		for_each_plane_in_state(state, plane, pstate, i) {
++			intel_plane = to_intel_plane(plane);
++			id = skl_wm_plane_id(intel_plane);
+ 
+-		if (!to_intel_plane_state(plane->state)->visible)
+-			continue;
++			if (intel_plane->pipe != pipe)
++				continue;
+ 
+-		if (plane->type == DRM_PLANE_TYPE_CURSOR)
+-			continue;
++			if (!to_intel_plane_state(pstate)->visible) {
++				minimum[id] = 0;
++				y_minimum[id] = 0;
++				continue;
++			}
++			if (plane->type == DRM_PLANE_TYPE_CURSOR) {
++				minimum[id] = 0;
++				y_minimum[id] = 0;
++				continue;
++			}
+ 
+-		minimum[id] = 8;
+-		alloc_size -= minimum[id];
+-		y_minimum[id] = (fb->pixel_format == DRM_FORMAT_NV12) ? 8 : 0;
+-		alloc_size -= y_minimum[id];
++			minimum[id] = 8;
++			if (pstate->fb->pixel_format == DRM_FORMAT_NV12)
++				y_minimum[id] = 8;
++			else
++				y_minimum[id] = 0;
++		}
++	} else {
++		for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
++			struct drm_plane *plane = &intel_plane->base;
++			struct drm_framebuffer *fb = plane->state->fb;
++			int id = skl_wm_plane_id(intel_plane);
++
++			if (!to_intel_plane_state(plane->state)->visible)
++				continue;
++
++			if (plane->type == DRM_PLANE_TYPE_CURSOR)
++				continue;
++
++			minimum[id] = 8;
++			y_minimum[id] = (fb->pixel_format == DRM_FORMAT_NV12) ? 8 : 0;
++		}
++	}
++
++	for (i = 0; i < PLANE_CURSOR; i++) {
++		alloc_size -= minimum[i];
++		alloc_size -= y_minimum[i];
+ 	}
+ 
+ 	/*
+@@ -3052,21 +3140,14 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 	 */
+ 	total_data_rate = skl_get_total_relative_data_rate(cstate);
+ 	if (total_data_rate == 0)
+-		return;
++		return 0;
+ 
+ 	start = alloc->start;
+ 	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+-		struct drm_plane *plane = &intel_plane->base;
+-		struct drm_plane_state *pstate = intel_plane->base.state;
+ 		unsigned int data_rate, y_data_rate;
+ 		uint16_t plane_blocks, y_plane_blocks = 0;
+ 		int id = skl_wm_plane_id(intel_plane);
+ 
+-		if (!to_intel_plane_state(pstate)->visible)
+-			continue;
+-		if (plane->type == DRM_PLANE_TYPE_CURSOR)
+-			continue;
+-
+ 		data_rate = cstate->wm.skl.plane_data_rate[id];
+ 
+ 		/*
+@@ -3078,8 +3159,11 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 		plane_blocks += div_u64((uint64_t)alloc_size * data_rate,
+ 					total_data_rate);
+ 
+-		ddb->plane[pipe][id].start = start;
+-		ddb->plane[pipe][id].end = start + plane_blocks;
++		/* Leave disabled planes at (0,0) */
++		if (data_rate) {
++			ddb->plane[pipe][id].start = start;
++			ddb->plane[pipe][id].end = start + plane_blocks;
++		}
+ 
+ 		start += plane_blocks;
+ 
+@@ -3092,12 +3176,15 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 		y_plane_blocks += div_u64((uint64_t)alloc_size * y_data_rate,
+ 					total_data_rate);
+ 
+-		ddb->y_plane[pipe][id].start = start;
+-		ddb->y_plane[pipe][id].end = start + y_plane_blocks;
++		if (y_data_rate) {
++			ddb->y_plane[pipe][id].start = start;
++			ddb->y_plane[pipe][id].end = start + y_plane_blocks;
++		}
+ 
+ 		start += y_plane_blocks;
+ 	}
+ 
++	return 0;
+ }
+ 
+ static uint32_t skl_pipe_pixel_rate(const struct intel_crtc_state *config)
+@@ -3588,7 +3675,7 @@ static bool skl_update_pipe_wm(struct drm_crtc *crtc,
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ 	struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
+ 
+-	skl_allocate_pipe_ddb(cstate, ddb);
++	WARN_ON(skl_allocate_pipe_ddb(cstate, ddb) != 0);
+ 	skl_build_pipe_wm(cstate, ddb, pipe_wm);
+ 
+ 	if (!memcmp(&intel_crtc->wm.active.skl, pipe_wm, sizeof(*pipe_wm)))
+-- 
+2.7.4
+

0008-drm-i915-Add-distrust_bios_wm-flag-to-dev_priv-v2.patch

@@ -0,0 +1,84 @@
+From 7207eecfcb3095442bce30227b551003edc7b908 Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Thu, 12 May 2016 07:06:02 -0700
+Subject: [PATCH 08/17] drm/i915: Add distrust_bios_wm flag to dev_priv (v2)
+
+SKL-style platforms can't fully trust the watermark/DDB settings
+programmed by the BIOS and need to do extra sanitization on their first
+atomic update.  Add a flag to dev_priv that is set during hardware
+readout and cleared at the end of the first commit.
+
+Note that for the somewhat common case where everything is turned off
+when the driver starts up, we don't need to bother with a recompute...we
+know exactly what the DDB should be (all zero's) so just setup the DDB
+directly in that case.
+
+v2:
+ - Move clearing of distrust_bios_wm up below the swap_state call since
+   it's a more natural / self-explanatory location.  (Maarten)
+ - Use dev_priv->active_crtcs to test whether any CRTC's are turned on
+   during HW WM readout rather than trying to count the active CRTC's
+   again ourselves.  (Maarten)
+
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-9-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/i915_drv.h      | 7 +++++++
+ drivers/gpu/drm/i915/intel_display.c | 1 +
+ drivers/gpu/drm/i915/intel_pm.c      | 8 ++++++++
+ 3 files changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 611c128..e21960d 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1981,6 +1981,13 @@ struct drm_i915_private {
+ 		 * cstate->wm.need_postvbl_update.
+ 		 */
+ 		struct mutex wm_mutex;
++
++		/*
++		 * Set during HW readout of watermarks/DDB.  Some platforms
++		 * need to know when we're still using BIOS-provided values
++		 * (which we don't fully trust).
++		 */
++		bool distrust_bios_wm;
+ 	} wm;
+ 
+ 	struct i915_runtime_pm pm;
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index f26d1c5..a9d2e30 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13621,6 +13621,7 @@ static int intel_atomic_commit(struct drm_device *dev,
+ 
+ 	drm_atomic_helper_swap_state(dev, state);
+ 	dev_priv->wm.config = intel_state->wm_config;
++	dev_priv->wm.distrust_bios_wm = false;
+ 	intel_shared_dpll_commit(state);
+ 
+ 	if (intel_state->modeset) {
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index f009d43..a49faa7 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -4026,6 +4026,14 @@ void skl_wm_get_hw_state(struct drm_device *dev)
+ 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+ 		skl_pipe_wm_get_hw_state(crtc);
+ 
++	if (dev_priv->active_crtcs) {
++		/* Fully recompute DDB on first atomic commit */
++		dev_priv->wm.distrust_bios_wm = true;
++	} else {
++		/* Easy/common case; just sanitize DDB now if everything off */
++		memset(ddb, 0, sizeof(*ddb));
++	}
++
+ 	/* Calculate plane data rates */
+ 	for_each_intel_crtc(dev, intel_crtc) {
+ 		struct intel_crtc_state *cstate = intel_crtc->config;
+-- 
+2.7.4
+

0009-drm-i915-gen9-Compute-DDB-allocation-at-atomic-check.patch

@@ -0,0 +1,244 @@
+From fbf53d8f1b7d1bcea1411f1f2cd0df6a6cc95332 Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Thu, 12 May 2016 07:06:03 -0700
+Subject: [PATCH 09/17] drm/i915/gen9: Compute DDB allocation at atomic check
+ time (v4)
+
+Calculate the DDB blocks needed to satisfy the current atomic
+transaction at atomic check time.  This is a prerequisite to calculating
+SKL watermarks during the 'check' phase and rejecting any configurations
+that we can't find valid watermarks for.
+
+Due to the nature of DDB allocation, it's possible for the addition of a
+new CRTC to make the watermark configuration already in use on another,
+unchanged CRTC become invalid.  A change in which CRTC's are active
+triggers a recompute of the entire DDB, which unfortunately means we
+need to disallow any other atomic commits from racing with such an
+update.  If the active CRTC's change, we need to grab the lock on all
+CRTC's and run all CRTC's through their 'check' handler to recompute and
+re-check their per-CRTC DDB allocations.
+
+Note that with this patch we only compute the DDB allocation but we
+don't actually use the computed values during watermark programming yet.
+For ease of review/testing/bisecting, we still recompute the DDB at
+watermark programming time and just WARN() if it doesn't match the
+precomputed values.  A future patch will switch over to using the
+precomputed values once we're sure they're being properly computed.
+
+Another clarifying note:  DDB allocation itself shouldn't ever fail with
+the algorithm we use today (i.e., we have enough DDB blocks on BXT to
+support the minimum needs of the worst-case scenario of every pipe/plane
+enabled at full size).  However the watermarks calculations based on the
+DDB may fail and we'll be moving those to the atomic check as well in
+future patches.
+
+v2:
+ - Skip DDB calculations in the rare case where our transaction doesn't
+   actually touch any CRTC's at all.  Assuming at least one CRTC state
+   is present in our transaction, then it means we can't race with any
+   transactions that would update dev_priv->active_crtcs (which requires
+   _all_ CRTC locks).
+
+v3:
+ - Also calculate DDB during initial hw readout, to prevent using
+   incorrect bios values. (Maarten)
+
+v4:
+ - Use new distrust_bios_wm flag instead of skip_initial_wm (which was
+   never actually set).
+ - Set intel_state->active_pipe_changes instead of just realloc_pipes
+
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Lyude Paul <cpaul@redhat.com>
+Cc: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-10-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/i915_drv.h      |  5 +++
+ drivers/gpu/drm/i915/intel_display.c | 18 ++++++++
+ drivers/gpu/drm/i915/intel_drv.h     |  3 ++
+ drivers/gpu/drm/i915/intel_pm.c      | 79 ++++++++++++++++++++++++++++++++++++
+ 4 files changed, 105 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index e21960d..b908a41 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -339,6 +339,10 @@ struct i915_hotplug {
+ #define for_each_intel_crtc(dev, intel_crtc) \
+ 	list_for_each_entry(intel_crtc, &dev->mode_config.crtc_list, base.head)
+ 
++#define for_each_intel_crtc_mask(dev, intel_crtc, crtc_mask) \
++	list_for_each_entry(intel_crtc, &dev->mode_config.crtc_list, base.head) \
++		for_each_if ((crtc_mask) & (1 << drm_crtc_index(&intel_crtc->base)))
++
+ #define for_each_intel_encoder(dev, intel_encoder)		\
+ 	list_for_each_entry(intel_encoder,			\
+ 			    &(dev)->mode_config.encoder_list,	\
+@@ -594,6 +598,7 @@ struct drm_i915_display_funcs {
+ 				       struct intel_crtc_state *newstate);
+ 	void (*initial_watermarks)(struct intel_crtc_state *cstate);
+ 	void (*optimize_watermarks)(struct intel_crtc_state *cstate);
++	int (*compute_global_watermarks)(struct drm_atomic_state *state);
+ 	void (*update_wm)(struct drm_crtc *crtc);
+ 	int (*modeset_calc_cdclk)(struct drm_atomic_state *state);
+ 	void (*modeset_commit_cdclk)(struct drm_atomic_state *state);
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index a9d2e30..ecad0ef 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13342,6 +13342,7 @@ static int intel_modeset_checks(struct drm_atomic_state *state)
+ static void calc_watermark_data(struct drm_atomic_state *state)
+ {
+ 	struct drm_device *dev = state->dev;
++	struct drm_i915_private *dev_priv = to_i915(dev);
+ 	struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
+ 	struct drm_crtc *crtc;
+ 	struct drm_crtc_state *cstate;
+@@ -13371,6 +13372,10 @@ static void calc_watermark_data(struct drm_atomic_state *state)
+ 		    pstate->crtc_h != pstate->src_h >> 16)
+ 			intel_state->wm_config.sprites_scaled = true;
+ 	}
++
++	/* Is there platform-specific watermark information to calculate? */
++	if (dev_priv->display.compute_global_watermarks)
++		dev_priv->display.compute_global_watermarks(state);
+ }
+ 
+ /**
+@@ -13739,6 +13744,19 @@ static int intel_atomic_commit(struct drm_device *dev,
+ 		intel_modeset_verify_crtc(crtc, old_crtc_state, crtc->state);
+ 	}
+ 
++	/*
++	 * Temporary sanity check: make sure our pre-computed DDB matches the
++	 * one we actually wind up programming.
++	 *
++	 * Not a great place to put this, but the easiest place we have access
++	 * to both the pre-computed and final DDB's; we'll be removing this
++	 * check in the next patch anyway.
++	 */
++	WARN(IS_GEN9(dev) &&
++	     memcmp(&intel_state->ddb, &dev_priv->wm.skl_results.ddb,
++		    sizeof(intel_state->ddb)),
++	     "Pre-computed DDB does not match final DDB!\n");
++
+ 	if (intel_state->modeset)
+ 		intel_display_power_put(dev_priv, POWER_DOMAIN_MODESET);
+ 
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index d19e83e..2218290 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -312,6 +312,9 @@ struct intel_atomic_state {
+ 	 * don't bother calculating intermediate watermarks.
+ 	 */
+ 	bool skip_intermediate_wm;
++
++	/* Gen9+ only */
++	struct skl_ddb_allocation ddb;
+ };
+ 
+ struct intel_plane_state {
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index a49faa7..cfa4f80 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3812,6 +3812,84 @@ static void skl_clear_wm(struct skl_wm_values *watermarks, enum pipe pipe)
+ 
+ }
+ 
++static int
++skl_compute_ddb(struct drm_atomic_state *state)
++{
++	struct drm_device *dev = state->dev;
++	struct drm_i915_private *dev_priv = to_i915(dev);
++	struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
++	struct intel_crtc *intel_crtc;
++	unsigned realloc_pipes = dev_priv->active_crtcs;
++	int ret;
++
++	/*
++	 * If this is our first atomic update following hardware readout,
++	 * we can't trust the DDB that the BIOS programmed for us.  Let's
++	 * pretend that all pipes switched active status so that we'll
++	 * ensure a full DDB recompute.
++	 */
++	if (dev_priv->wm.distrust_bios_wm)
++		intel_state->active_pipe_changes = ~0;
++
++	/*
++	 * If the modeset changes which CRTC's are active, we need to
++	 * recompute the DDB allocation for *all* active pipes, even
++	 * those that weren't otherwise being modified in any way by this
++	 * atomic commit.  Due to the shrinking of the per-pipe allocations
++	 * when new active CRTC's are added, it's possible for a pipe that
++	 * we were already using and aren't changing at all here to suddenly
++	 * become invalid if its DDB needs exceeds its new allocation.
++	 *
++	 * Note that if we wind up doing a full DDB recompute, we can't let
++	 * any other display updates race with this transaction, so we need
++	 * to grab the lock on *all* CRTC's.
++	 */
++	if (intel_state->active_pipe_changes)
++		realloc_pipes = ~0;
++
++	for_each_intel_crtc_mask(dev, intel_crtc, realloc_pipes) {
++		struct intel_crtc_state *cstate;
++
++		cstate = intel_atomic_get_crtc_state(state, intel_crtc);
++		if (IS_ERR(cstate))
++			return PTR_ERR(cstate);
++
++		ret = skl_allocate_pipe_ddb(cstate, &intel_state->ddb);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int
++skl_compute_wm(struct drm_atomic_state *state)
++{
++	struct drm_crtc *crtc;
++	struct drm_crtc_state *cstate;
++	int ret, i;
++	bool changed = false;
++
++	/*
++	 * If this transaction isn't actually touching any CRTC's, don't
++	 * bother with watermark calculation.  Note that if we pass this
++	 * test, we're guaranteed to hold at least one CRTC state mutex,
++	 * which means we can safely use values like dev_priv->active_crtcs
++	 * since any racing commits that want to update them would need to
++	 * hold _all_ CRTC state mutexes.
++	 */
++	for_each_crtc_in_state(state, crtc, cstate, i)
++		changed = true;
++	if (!changed)
++		return 0;
++
++	ret = skl_compute_ddb(state);
++	if (ret)
++		return ret;
++
++	return 0;
++}
++
+ static void skl_update_wm(struct drm_crtc *crtc)
+ {
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+@@ -7384,6 +7462,7 @@ void intel_init_pm(struct drm_device *dev)
+ 	if (INTEL_INFO(dev)->gen >= 9) {
+ 		skl_setup_wm_latency(dev);
+ 		dev_priv->display.update_wm = skl_update_wm;
++		dev_priv->display.compute_global_watermarks = skl_compute_wm;
+ 	} else if (HAS_PCH_SPLIT(dev)) {
+ 		ilk_setup_wm_latency(dev);
+ 
+-- 
+2.7.4
+

0010-drm-i915-gen9-Drop-re-allocation-of-DDB-at-atomic-co.patch

@@ -0,0 +1,379 @@
+From a9abdc6767855e1668301a1dcc4b5fa8bed1ddfa Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Thu, 12 May 2016 07:06:04 -0700
+Subject: [PATCH 10/17] drm/i915/gen9: Drop re-allocation of DDB at atomic
+ commit (v2)
+
+Now that we're properly pre-allocating the DDB during the atomic check
+phase and we trust that the allocation is appropriate, let's actually
+use the allocation computed and not duplicate that work during the
+commit phase.
+
+v2:
+ - Significant rebasing now that we can use cached data rates and
+   minimum block allocations to avoid grabbing additional plane states.
+
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-11-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_display.c |  14 +--
+ drivers/gpu/drm/i915/intel_pm.c      | 224 +++++++++++------------------------
+ 2 files changed, 67 insertions(+), 171 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index ecad0ef..4db10d7 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13627,6 +13627,7 @@ static int intel_atomic_commit(struct drm_device *dev,
+ 	drm_atomic_helper_swap_state(dev, state);
+ 	dev_priv->wm.config = intel_state->wm_config;
+ 	dev_priv->wm.distrust_bios_wm = false;
++	dev_priv->wm.skl_results.ddb = intel_state->ddb;
+ 	intel_shared_dpll_commit(state);
+ 
+ 	if (intel_state->modeset) {
+@@ -13744,19 +13745,6 @@ static int intel_atomic_commit(struct drm_device *dev,
+ 		intel_modeset_verify_crtc(crtc, old_crtc_state, crtc->state);
+ 	}
+ 
+-	/*
+-	 * Temporary sanity check: make sure our pre-computed DDB matches the
+-	 * one we actually wind up programming.
+-	 *
+-	 * Not a great place to put this, but the easiest place we have access
+-	 * to both the pre-computed and final DDB's; we'll be removing this
+-	 * check in the next patch anyway.
+-	 */
+-	WARN(IS_GEN9(dev) &&
+-	     memcmp(&intel_state->ddb, &dev_priv->wm.skl_results.ddb,
+-		    sizeof(intel_state->ddb)),
+-	     "Pre-computed DDB does not match final DDB!\n");
+-
+ 	if (intel_state->modeset)
+ 		intel_display_power_put(dev_priv, POWER_DOMAIN_MODESET);
+ 
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index cfa4f80..0f0d4e1 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2849,7 +2849,6 @@ skl_wm_plane_id(const struct intel_plane *plane)
+ static void
+ skl_ddb_get_pipe_allocation_limits(struct drm_device *dev,
+ 				   const struct intel_crtc_state *cstate,
+-				   struct intel_wm_config *config,
+ 				   struct skl_ddb_entry *alloc, /* out */
+ 				   int *num_active /* out */)
+ {
+@@ -2857,24 +2856,22 @@ skl_ddb_get_pipe_allocation_limits(struct drm_device *dev,
+ 	struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
+ 	struct drm_i915_private *dev_priv = to_i915(dev);
+ 	struct drm_crtc *for_crtc = cstate->base.crtc;
+-	struct drm_crtc *crtc;
+ 	unsigned int pipe_size, ddb_size;
+ 	int nth_active_pipe;
+ 	int pipe = to_intel_crtc(for_crtc)->pipe;
+ 
+-	if (intel_state && intel_state->active_pipe_changes)
+-		*num_active = hweight32(intel_state->active_crtcs);
+-	else if (intel_state)
+-		*num_active = hweight32(dev_priv->active_crtcs);
+-	else
+-		*num_active = config->num_pipes_active;
+-
+-	if (!cstate->base.active) {
++	if (WARN_ON(!state) || !cstate->base.active) {
+ 		alloc->start = 0;
+ 		alloc->end = 0;
++		*num_active = hweight32(dev_priv->active_crtcs);
+ 		return;
+ 	}
+ 
++	if (intel_state->active_pipe_changes)
++		*num_active = hweight32(intel_state->active_crtcs);
++	else
++		*num_active = hweight32(dev_priv->active_crtcs);
++
+ 	if (IS_BROXTON(dev))
+ 		ddb_size = BXT_DDB_SIZE;
+ 	else
+@@ -2883,50 +2880,23 @@ skl_ddb_get_pipe_allocation_limits(struct drm_device *dev,
+ 	ddb_size -= 4; /* 4 blocks for bypass path allocation */
+ 
+ 	/*
+-	 * FIXME: At the moment we may be called on either in-flight or fully
+-	 * committed cstate's.  Once we fully move DDB allocation in the check
+-	 * phase, we'll only be called on in-flight states and the 'else'
+-	 * branch here will go away.
+-	 *
+-	 * The 'else' branch is slightly racy here, but it was racy to begin
+-	 * with; since it's going away soon, no effort is made to address that.
++	 * If the state doesn't change the active CRTC's, then there's
++	 * no need to recalculate; the existing pipe allocation limits
++	 * should remain unchanged.  Note that we're safe from racing
++	 * commits since any racing commit that changes the active CRTC
++	 * list would need to grab _all_ crtc locks, including the one
++	 * we currently hold.
+ 	 */
+-	if (state) {
+-		/*
+-		 * If the state doesn't change the active CRTC's, then there's
+-		 * no need to recalculate; the existing pipe allocation limits
+-		 * should remain unchanged.  Note that we're safe from racing
+-		 * commits since any racing commit that changes the active CRTC
+-		 * list would need to grab _all_ crtc locks, including the one
+-		 * we currently hold.
+-		 */
+-		if (!intel_state->active_pipe_changes) {
+-			*alloc = dev_priv->wm.skl_hw.ddb.pipe[pipe];
+-			return;
+-		}
+-
+-		nth_active_pipe = hweight32(intel_state->active_crtcs &
+-					    (drm_crtc_mask(for_crtc) - 1));
+-		pipe_size = ddb_size / hweight32(intel_state->active_crtcs);
+-		alloc->start = nth_active_pipe * ddb_size / *num_active;
+-		alloc->end = alloc->start + pipe_size;
+-	} else {
+-		nth_active_pipe = 0;
+-		for_each_crtc(dev, crtc) {
+-			if (!to_intel_crtc(crtc)->active)
+-				continue;
+-
+-			if (crtc == for_crtc)
+-				break;
+-
+-			nth_active_pipe++;
+-		}
+-
+-		pipe_size = ddb_size / config->num_pipes_active;
+-		alloc->start = nth_active_pipe * ddb_size /
+-			config->num_pipes_active;
+-		alloc->end = alloc->start + pipe_size;
++	if (!intel_state->active_pipe_changes) {
++		*alloc = dev_priv->wm.skl_hw.ddb.pipe[pipe];
++		return;
+ 	}
++
++	nth_active_pipe = hweight32(intel_state->active_crtcs &
++				    (drm_crtc_mask(for_crtc) - 1));
++	pipe_size = ddb_size / hweight32(intel_state->active_crtcs);
++	alloc->start = nth_active_pipe * ddb_size / *num_active;
++	alloc->end = alloc->start + pipe_size;
+ }
+ 
+ static unsigned int skl_cursor_allocation(int num_active)
+@@ -3025,62 +2995,33 @@ skl_get_total_relative_data_rate(struct intel_crtc_state *intel_cstate)
+ 	struct drm_crtc *crtc = cstate->crtc;
+ 	struct drm_device *dev = crtc->dev;
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
++	const struct drm_plane *plane;
+ 	const struct intel_plane *intel_plane;
++	struct drm_plane_state *pstate;
+ 	unsigned int rate, total_data_rate = 0;
+ 	int id;
++	int i;
++
++	if (WARN_ON(!state))
++		return 0;
+ 
+ 	/* Calculate and cache data rate for each plane */
+-	/*
+-	 * FIXME: At the moment this function can be called on either an
+-	 * in-flight or a committed state object.  If it's in-flight then we
+-	 * only want to re-calculate the plane data rate for planes that are
+-	 * part of the transaction (i.e., we don't want to grab any additional
+-	 * plane states if we don't have to).  If we're operating on committed
+-	 * state, we'll just go ahead and recalculate the plane data rate for
+-	 * all planes.
+-	 *
+-	 * Once we finish moving our DDB allocation to the atomic check phase,
+-	 * we'll only be calling this function on in-flight state objects, so
+-	 * the 'else' branch here will go away.
+-	 */
+-	if (state) {
+-		struct drm_plane *plane;
+-		struct drm_plane_state *pstate;
+-		int i;
+-
+-		for_each_plane_in_state(state, plane, pstate, i) {
+-			intel_plane = to_intel_plane(plane);
+-			id = skl_wm_plane_id(intel_plane);
+-
+-			if (intel_plane->pipe != intel_crtc->pipe)
+-				continue;
+-
+-			/* packed/uv */
+-			rate = skl_plane_relative_data_rate(intel_cstate,
+-							    pstate, 0);
+-			intel_cstate->wm.skl.plane_data_rate[id] = rate;
+-
+-			/* y-plane */
+-			rate = skl_plane_relative_data_rate(intel_cstate,
+-							    pstate, 1);
+-			intel_cstate->wm.skl.plane_y_data_rate[id] = rate;
+-		}
+-	} else {
+-		for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+-			const struct drm_plane_state *pstate =
+-				intel_plane->base.state;
+-			int id = skl_wm_plane_id(intel_plane);
++	for_each_plane_in_state(state, plane, pstate, i) {
++		id = skl_wm_plane_id(to_intel_plane(plane));
++		intel_plane = to_intel_plane(plane);
+ 
+-			/* packed/uv */
+-			rate = skl_plane_relative_data_rate(intel_cstate,
+-							    pstate, 0);
+-			intel_cstate->wm.skl.plane_data_rate[id] = rate;
++		if (intel_plane->pipe != intel_crtc->pipe)
++			continue;
+ 
+-			/* y-plane */
+-			rate = skl_plane_relative_data_rate(intel_cstate,
+-							    pstate, 1);
+-			intel_cstate->wm.skl.plane_y_data_rate[id] = rate;
+-		}
++		/* packed/uv */
++		rate = skl_plane_relative_data_rate(intel_cstate,
++						    pstate, 0);
++		intel_cstate->wm.skl.plane_data_rate[id] = rate;
++
++		/* y-plane */
++		rate = skl_plane_relative_data_rate(intel_cstate,
++						    pstate, 1);
++		intel_cstate->wm.skl.plane_y_data_rate[id] = rate;
+ 	}
+ 
+ 	/* Calculate CRTC's total data rate from cached values */
+@@ -3104,8 +3045,6 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 	struct drm_atomic_state *state = cstate->base.state;
+ 	struct drm_crtc *crtc = cstate->base.crtc;
+ 	struct drm_device *dev = crtc->dev;
+-	struct drm_i915_private *dev_priv = to_i915(dev);
+-	struct intel_wm_config *config = &dev_priv->wm.config;
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ 	struct intel_plane *intel_plane;
+ 	struct drm_plane *plane;
+@@ -3119,6 +3058,9 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 	int num_active;
+ 	int id, i;
+ 
++	if (WARN_ON(!state))
++		return 0;
++
+ 	if (!cstate->base.active) {
+ 		ddb->pipe[pipe].start = ddb->pipe[pipe].end = 0;
+ 		memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
+@@ -3126,8 +3068,7 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 		return 0;
+ 	}
+ 
+-	skl_ddb_get_pipe_allocation_limits(dev, cstate, config, alloc,
+-					   &num_active);
++	skl_ddb_get_pipe_allocation_limits(dev, cstate, alloc, &num_active);
+ 	alloc_size = skl_ddb_entry_size(alloc);
+ 	if (alloc_size == 0) {
+ 		memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
+@@ -3139,53 +3080,31 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
+ 	ddb->plane[pipe][PLANE_CURSOR].end = alloc->end;
+ 
+ 	alloc_size -= cursor_blocks;
+-	alloc->end -= cursor_blocks;
+ 
+ 	/* 1. Allocate the mininum required blocks for each active plane */
+-	/*
+-	 * TODO: Remove support for already-committed state once we
+-	 * only allocate DDB on in-flight states.
+-	 */
+-	if (state) {
+-		for_each_plane_in_state(state, plane, pstate, i) {
+-			intel_plane = to_intel_plane(plane);
+-			id = skl_wm_plane_id(intel_plane);
+-
+-			if (intel_plane->pipe != pipe)
+-				continue;
+-
+-			if (!to_intel_plane_state(pstate)->visible) {
+-				minimum[id] = 0;
+-				y_minimum[id] = 0;
+-				continue;
+-			}
+-			if (plane->type == DRM_PLANE_TYPE_CURSOR) {
+-				minimum[id] = 0;
+-				y_minimum[id] = 0;
+-				continue;
+-			}
+-
+-			minimum[id] = 8;
+-			if (pstate->fb->pixel_format == DRM_FORMAT_NV12)
+-				y_minimum[id] = 8;
+-			else
+-				y_minimum[id] = 0;
+-		}
+-	} else {
+-		for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+-			struct drm_plane *plane = &intel_plane->base;
+-			struct drm_framebuffer *fb = plane->state->fb;
+-			int id = skl_wm_plane_id(intel_plane);
+-
+-			if (!to_intel_plane_state(plane->state)->visible)
+-				continue;
++	for_each_plane_in_state(state, plane, pstate, i) {
++		intel_plane = to_intel_plane(plane);
++		id = skl_wm_plane_id(intel_plane);
+ 
+-			if (plane->type == DRM_PLANE_TYPE_CURSOR)
+-				continue;
++		if (intel_plane->pipe != pipe)
++			continue;
+ 
+-			minimum[id] = 8;
+-			y_minimum[id] = (fb->pixel_format == DRM_FORMAT_NV12) ? 8 : 0;
++		if (!to_intel_plane_state(pstate)->visible) {
++			minimum[id] = 0;
++			y_minimum[id] = 0;
++			continue;
++		}
++		if (plane->type == DRM_PLANE_TYPE_CURSOR) {
++			minimum[id] = 0;
++			y_minimum[id] = 0;
++			continue;
+ 		}
++
++		minimum[id] = 8;
++		if (pstate->fb->pixel_format == DRM_FORMAT_NV12)
++			y_minimum[id] = 8;
++		else
++			y_minimum[id] = 0;
+ 	}
+ 
+ 	for (i = 0; i < PLANE_CURSOR; i++) {
+@@ -3736,7 +3655,6 @@ static bool skl_update_pipe_wm(struct drm_crtc *crtc,
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ 	struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
+ 
+-	WARN_ON(skl_allocate_pipe_ddb(cstate, ddb) != 0);
+ 	skl_build_pipe_wm(cstate, ddb, pipe_wm);
+ 
+ 	if (!memcmp(&intel_crtc->wm.active.skl, pipe_wm, sizeof(*pipe_wm)))
+@@ -3800,16 +3718,6 @@ static void skl_clear_wm(struct skl_wm_values *watermarks, enum pipe pipe)
+ 	memset(watermarks->plane_trans[pipe],
+ 	       0, sizeof(uint32_t) * I915_MAX_PLANES);
+ 	watermarks->plane_trans[pipe][PLANE_CURSOR] = 0;
+-
+-	/* Clear ddb entries for pipe */
+-	memset(&watermarks->ddb.pipe[pipe], 0, sizeof(struct skl_ddb_entry));
+-	memset(&watermarks->ddb.plane[pipe], 0,
+-	       sizeof(struct skl_ddb_entry) * I915_MAX_PLANES);
+-	memset(&watermarks->ddb.y_plane[pipe], 0,
+-	       sizeof(struct skl_ddb_entry) * I915_MAX_PLANES);
+-	memset(&watermarks->ddb.plane[pipe][PLANE_CURSOR], 0,
+-	       sizeof(struct skl_ddb_entry));
+-
+ }
+ 
+ static int
+-- 
+2.7.4
+

0011-drm-i915-gen9-Calculate-plane-WM-s-from-state.patch

@@ -0,0 +1,91 @@
+From eacd0ecb98a93e3ff83a4479eadeb9cda05d3579 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 12:41:01 +0200
+Subject: [PATCH 11/17] drm/i915/gen9: Calculate plane WM's from state
+
+Upstream: since drm-intel-next-2016-05-22
+commit 33815fa55b31a5de4b197c09926ecab3dfb79732
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:06:05 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:34:12 2016 -0700
+
+    drm/i915/gen9: Calculate plane WM's from state
+
+    In a future patch we'll want to calculate plane watermarks for in-flight
+    atomic state rather than the already-committed state.
+
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-12-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_pm.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 80f9f18..3164f30 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3179,16 +3179,14 @@ static bool skl_ddb_allocation_changed(const struct skl_ddb_allocation *new_ddb,
+ 
+ static bool skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ 				 struct intel_crtc_state *cstate,
+-				 struct intel_plane *intel_plane,
++				 struct intel_plane_state *intel_pstate,
+ 				 uint16_t ddb_allocation,
+ 				 int level,
+ 				 uint16_t *out_blocks, /* out */
+ 				 uint8_t *out_lines /* out */)
+ {
+-	struct drm_plane *plane = &intel_plane->base;
+-	struct drm_framebuffer *fb = plane->state->fb;
+-	struct intel_plane_state *intel_pstate =
+-					to_intel_plane_state(plane->state);
++	struct drm_plane_state *pstate = &intel_pstate->base;
++	struct drm_framebuffer *fb = pstate->fb;
+ 	uint32_t latency = dev_priv->wm.skl_latency[level];
+ 	uint32_t method1, method2;
+ 	uint32_t plane_bytes_per_line, plane_blocks_per_line;
+@@ -3203,7 +3201,7 @@ static bool skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ 	width = drm_rect_width(&intel_pstate->src) >> 16;
+ 	height = drm_rect_height(&intel_pstate->src) >> 16;
+ 
+-	if (intel_rotation_90_or_270(plane->state->rotation))
++	if (intel_rotation_90_or_270(pstate->rotation))
+ 		swap(width, height);
+ 
+ 	cpp = drm_format_plane_cpp(fb->pixel_format, 0);
+@@ -3223,7 +3221,7 @@ static bool skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ 	    fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
+ 		uint32_t min_scanlines = 4;
+ 		uint32_t y_tile_minimum;
+-		if (intel_rotation_90_or_270(plane->state->rotation)) {
++		if (intel_rotation_90_or_270(pstate->rotation)) {
+ 			int cpp = (fb->pixel_format == DRM_FORMAT_NV12) ?
+ 				drm_format_plane_cpp(fb->pixel_format, 1) :
+ 				drm_format_plane_cpp(fb->pixel_format, 0);
+@@ -3277,17 +3275,19 @@ static void skl_compute_wm_level(const struct drm_i915_private *dev_priv,
+ 	struct drm_device *dev = dev_priv->dev;
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(cstate->base.crtc);
+ 	struct intel_plane *intel_plane;
++	struct intel_plane_state *intel_pstate;
+ 	uint16_t ddb_blocks;
+ 	enum pipe pipe = intel_crtc->pipe;
+ 
+ 	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+ 		int i = skl_wm_plane_id(intel_plane);
+ 
++		intel_pstate = to_intel_plane_state(intel_plane->base.state);
+ 		ddb_blocks = skl_ddb_entry_size(&ddb->plane[pipe][i]);
+ 
+ 		result->plane_en[i] = skl_compute_plane_wm(dev_priv,
+ 						cstate,
+-						intel_plane,
++						intel_pstate,
+ 						ddb_blocks,
+ 						level,
+ 						&result->plane_res_b[i],
+-- 
+2.7.4
+

0012-drm-i915-gen9-Allow-watermark-calculation-on-in-flig.patch

@@ -0,0 +1,156 @@
+From c3d2591095045a8230361d55fadf15ce5dc9127d Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 12:41:12 +0200
+Subject: [PATCH 12/17] drm/i915/gen9: Allow watermark calculation on in-flight
+ atomic state (v3)
+
+Upstream: since drm-intel-next-2016-05-22
+commit f4a967523ec7215a3ec867b7ed2e916bd34840e1
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:06:06 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:34:23 2016 -0700
+
+    drm/i915/gen9: Allow watermark calculation on in-flight atomic state (v3)
+
+    In an upcoming patch we'll move this calculation to the atomic 'check'
+    phase so that the display update can be rejected early if no valid
+    watermark programming is possible.
+
+    v2:
+     - Drop intel_pstate_for_cstate_plane() helper and add note about how
+       the code needs to evolve in the future if we start allowing more than
+       one pending commit against a CRTC.  (Maarten)
+
+    v3:
+     - Only have skl_compute_wm_level calculate watermarks for enabled
+       planes; we can just set the other planes on a CRTC to disabled
+       without having to look at the plane state.  This is important because
+       despite our CRTC lock we can still have racing commits that modify
+       a disabled plane's property without turning it on.  (Maarten)
+
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-13-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_pm.c | 61 ++++++++++++++++++++++++++++++++---------
+ 1 file changed, 48 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 3164f30..cd29ab6 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3266,23 +3266,56 @@ static bool skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ 	return true;
+ }
+ 
+-static void skl_compute_wm_level(const struct drm_i915_private *dev_priv,
+-				 struct skl_ddb_allocation *ddb,
+-				 struct intel_crtc_state *cstate,
+-				 int level,
+-				 struct skl_wm_level *result)
++static int
++skl_compute_wm_level(const struct drm_i915_private *dev_priv,
++		     struct skl_ddb_allocation *ddb,
++		     struct intel_crtc_state *cstate,
++		     int level,
++		     struct skl_wm_level *result)
+ {
+ 	struct drm_device *dev = dev_priv->dev;
++	struct drm_atomic_state *state = cstate->base.state;
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(cstate->base.crtc);
++	struct drm_plane *plane;
+ 	struct intel_plane *intel_plane;
+ 	struct intel_plane_state *intel_pstate;
+ 	uint16_t ddb_blocks;
+ 	enum pipe pipe = intel_crtc->pipe;
+ 
+-	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
++	/*
++	 * We'll only calculate watermarks for planes that are actually
++	 * enabled, so make sure all other planes are set as disabled.
++	 */
++	memset(result, 0, sizeof(*result));
++
++	for_each_intel_plane_mask(dev, intel_plane, cstate->base.plane_mask) {
+ 		int i = skl_wm_plane_id(intel_plane);
+ 
+-		intel_pstate = to_intel_plane_state(intel_plane->base.state);
++		plane = &intel_plane->base;
++		intel_pstate = NULL;
++		if (state)
++			intel_pstate =
++				intel_atomic_get_existing_plane_state(state,
++								      intel_plane);
++
++		/*
++		 * Note: If we start supporting multiple pending atomic commits
++		 * against the same planes/CRTC's in the future, plane->state
++		 * will no longer be the correct pre-state to use for the
++		 * calculations here and we'll need to change where we get the
++		 * 'unchanged' plane data from.
++		 *
++		 * For now this is fine because we only allow one queued commit
++		 * against a CRTC.  Even if the plane isn't modified by this
++		 * transaction and we don't have a plane lock, we still have
++		 * the CRTC's lock, so we know that no other transactions are
++		 * racing with us to update it.
++		 */
++		if (!intel_pstate)
++			intel_pstate = to_intel_plane_state(plane->state);
++
++		WARN_ON(!intel_pstate->base.fb);
++
+ 		ddb_blocks = skl_ddb_entry_size(&ddb->plane[pipe][i]);
+ 
+ 		result->plane_en[i] = skl_compute_plane_wm(dev_priv,
+@@ -3293,6 +3326,8 @@ static void skl_compute_wm_level(const struct drm_i915_private *dev_priv,
+ 						&result->plane_res_b[i],
+ 						&result->plane_res_l[i]);
+ 	}
++
++	return 0;
+ }
+ 
+ static uint32_t
+@@ -3587,14 +3622,14 @@ static void skl_flush_wm_values(struct drm_i915_private *dev_priv,
+ 	}
+ }
+ 
+-static bool skl_update_pipe_wm(struct drm_crtc *crtc,
++static bool skl_update_pipe_wm(struct drm_crtc_state *cstate,
+ 			       struct skl_ddb_allocation *ddb, /* out */
+ 			       struct skl_pipe_wm *pipe_wm /* out */)
+ {
+-	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+-	struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
++	struct intel_crtc *intel_crtc = to_intel_crtc(cstate->crtc);
++	struct intel_crtc_state *intel_cstate = to_intel_crtc_state(cstate);
+ 
+-	skl_build_pipe_wm(cstate, ddb, pipe_wm);
++	skl_build_pipe_wm(intel_cstate, ddb, pipe_wm);
+ 
+ 	if (!memcmp(&intel_crtc->wm.active.skl, pipe_wm, sizeof(*pipe_wm)))
+ 		return false;
+@@ -3634,7 +3669,7 @@ static void skl_update_other_pipe_wm(struct drm_device *dev,
+ 		if (!intel_crtc->active)
+ 			continue;
+ 
+-		wm_changed = skl_update_pipe_wm(&intel_crtc->base,
++		wm_changed = skl_update_pipe_wm(intel_crtc->base.state,
+ 						&r->ddb, &pipe_wm);
+ 
+ 		/*
+@@ -3752,7 +3787,7 @@ static void skl_update_wm(struct drm_crtc *crtc)
+ 
+ 	skl_clear_wm(results, intel_crtc->pipe);
+ 
+-	if (!skl_update_pipe_wm(crtc, &results->ddb, pipe_wm))
++	if (!skl_update_pipe_wm(crtc->state, &results->ddb, pipe_wm))
+ 		return;
+ 
+ 	skl_compute_wm_results(dev, pipe_wm, results, intel_crtc);
+-- 
+2.7.4
+

0013-drm-i915-gen9-Use-a-bitmask-to-track-dirty-pipe-wate.patch

@@ -0,0 +1,91 @@
+From b43247a865f73fa3b73a878236b5055bfb864169 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 12:41:23 +0200
+Subject: [PATCH 13/17] drm/i915/gen9: Use a bitmask to track dirty pipe
+ watermarks
+
+Upstream: since drm-intel-next-2016-05-22
+commit 2b4b9f35d94b1b533bc23110b040b04316480b28
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:06:07 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:34:40 2016 -0700
+
+    drm/i915/gen9: Use a bitmask to track dirty pipe watermarks
+
+    Slightly easier to work with than an array of bools.
+
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-14-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/i915_drv.h |  2 +-
+ drivers/gpu/drm/i915/intel_pm.c | 10 +++++-----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 237df9f..67c76b6 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1615,7 +1615,7 @@ struct skl_ddb_allocation {
+ };
+ 
+ struct skl_wm_values {
+-	bool dirty[I915_MAX_PIPES];
++	unsigned dirty_pipes;
+ 	struct skl_ddb_allocation ddb;
+ 	uint32_t wm_linetime[I915_MAX_PIPES];
+ 	uint32_t plane[I915_MAX_PIPES][I915_MAX_PLANES][8];
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index cd29ab6..611c5a1 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3455,7 +3455,7 @@ static void skl_write_wm_values(struct drm_i915_private *dev_priv,
+ 		int i, level, max_level = ilk_wm_max_level(dev);
+ 		enum pipe pipe = crtc->pipe;
+ 
+-		if (!new->dirty[pipe])
++		if ((new->dirty_pipes & drm_crtc_mask(&crtc->base)) == 0)
+ 			continue;
+ 
+ 		I915_WRITE(PIPE_WM_LINETIME(pipe), new->wm_linetime[pipe]);
+@@ -3680,7 +3680,7 @@ static void skl_update_other_pipe_wm(struct drm_device *dev,
+ 		WARN_ON(!wm_changed);
+ 
+ 		skl_compute_wm_results(dev, &pipe_wm, r, intel_crtc);
+-		r->dirty[intel_crtc->pipe] = true;
++		r->dirty_pipes |= drm_crtc_mask(&intel_crtc->base);
+ 	}
+ }
+ 
+@@ -3783,7 +3783,7 @@ static void skl_update_wm(struct drm_crtc *crtc)
+ 
+ 
+ 	/* Clear all dirty flags */
+-	memset(results->dirty, 0, sizeof(bool) * I915_MAX_PIPES);
++	results->dirty_pipes = 0;
+ 
+ 	skl_clear_wm(results, intel_crtc->pipe);
+ 
+@@ -3791,7 +3791,7 @@ static void skl_update_wm(struct drm_crtc *crtc)
+ 		return;
+ 
+ 	skl_compute_wm_results(dev, pipe_wm, results, intel_crtc);
+-	results->dirty[intel_crtc->pipe] = true;
++	results->dirty_pipes |= drm_crtc_mask(&intel_crtc->base);
+ 
+ 	skl_update_other_pipe_wm(dev, crtc, results);
+ 	skl_write_wm_values(dev_priv, results);
+@@ -3952,7 +3952,7 @@ static void skl_pipe_wm_get_hw_state(struct drm_crtc *crtc)
+ 	if (!intel_crtc->active)
+ 		return;
+ 
+-	hw->dirty[pipe] = true;
++	hw->dirty_pipes |= drm_crtc_mask(crtc);
+ 
+ 	active->linetime = hw->wm_linetime[pipe];
+ 
+-- 
+2.7.4
+

0014-drm-i915-gen9-Propagate-watermark-calculation-failur.patch

@@ -0,0 +1,254 @@
+From 2dda82bdd570042820241e71c02ea36081835f67 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 12:41:35 +0200
+Subject: [PATCH 14/17] drm/i915/gen9: Propagate watermark calculation failures
+ up the call chain
+
+Upstream: since drm-intel-next-2016-05-22
+commit 55994c2c38a1101f84cdf277b228f830af8a9c1b
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:06:08 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:34:48 2016 -0700
+
+    drm/i915/gen9: Propagate watermark calculation failures up the call chain
+
+    Once we move watermark calculation to the atomic check phase, we'll want
+    to start rejecting display configurations that exceed out watermark
+    limits.  At the moment we just assume that there's always a valid set of
+    watermarks, even though this may not actually be true.  Let's prepare by
+    passing return codes up through the call stack in preparation.
+
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-15-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_display.c | 10 ++--
+ drivers/gpu/drm/i915/intel_pm.c      | 90 ++++++++++++++++++++++--------------
+ 2 files changed, 61 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index b484fda..9ac2346 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13222,7 +13222,7 @@ static int intel_modeset_checks(struct drm_atomic_state *state)
+  * phase.  The code here should be run after the per-crtc and per-plane 'check'
+  * handlers to ensure that all derived state has been updated.
+  */
+-static void calc_watermark_data(struct drm_atomic_state *state)
++static int calc_watermark_data(struct drm_atomic_state *state)
+ {
+ 	struct drm_device *dev = state->dev;
+ 	struct drm_i915_private *dev_priv = to_i915(dev);
+@@ -13258,7 +13258,9 @@ static void calc_watermark_data(struct drm_atomic_state *state)
+ 
+ 	/* Is there platform-specific watermark information to calculate? */
+ 	if (dev_priv->display.compute_global_watermarks)
+-		dev_priv->display.compute_global_watermarks(state);
++		return dev_priv->display.compute_global_watermarks(state);
++
++	return 0;
+ }
+ 
+ /**
+@@ -13345,9 +13347,7 @@ static int intel_atomic_check(struct drm_device *dev,
+ 		return ret;
+ 
+ 	intel_fbc_choose_crtc(dev_priv, state);
+-	calc_watermark_data(state);
+-
+-	return 0;
++	return calc_watermark_data(state);
+ }
+ 
+ static int intel_atomic_prepare_commit(struct drm_device *dev,
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 611c5a1..ec22d93 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3177,13 +3177,14 @@ static bool skl_ddb_allocation_changed(const struct skl_ddb_allocation *new_ddb,
+ 	return false;
+ }
+ 
+-static bool skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+-				 struct intel_crtc_state *cstate,
+-				 struct intel_plane_state *intel_pstate,
+-				 uint16_t ddb_allocation,
+-				 int level,
+-				 uint16_t *out_blocks, /* out */
+-				 uint8_t *out_lines /* out */)
++static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
++				struct intel_crtc_state *cstate,
++				struct intel_plane_state *intel_pstate,
++				uint16_t ddb_allocation,
++				int level,
++				uint16_t *out_blocks, /* out */
++				uint8_t *out_lines, /* out */
++				bool *enabled /* out */)
+ {
+ 	struct drm_plane_state *pstate = &intel_pstate->base;
+ 	struct drm_framebuffer *fb = pstate->fb;
+@@ -3195,8 +3196,10 @@ static bool skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ 	uint8_t cpp;
+ 	uint32_t width = 0, height = 0;
+ 
+-	if (latency == 0 || !cstate->base.active || !intel_pstate->visible)
+-		return false;
++	if (latency == 0 || !cstate->base.active || !intel_pstate->visible) {
++		*enabled = false;
++		return 0;
++	}
+ 
+ 	width = drm_rect_width(&intel_pstate->src) >> 16;
+ 	height = drm_rect_height(&intel_pstate->src) >> 16;
+@@ -3257,13 +3260,16 @@ static bool skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ 			res_blocks++;
+ 	}
+ 
+-	if (res_blocks >= ddb_allocation || res_lines > 31)
+-		return false;
++	if (res_blocks >= ddb_allocation || res_lines > 31) {
++		*enabled = false;
++		return 0;
++	}
+ 
+ 	*out_blocks = res_blocks;
+ 	*out_lines = res_lines;
++	*enabled = true;
+ 
+-	return true;
++	return 0;
+ }
+ 
+ static int
+@@ -3281,6 +3287,7 @@ skl_compute_wm_level(const struct drm_i915_private *dev_priv,
+ 	struct intel_plane_state *intel_pstate;
+ 	uint16_t ddb_blocks;
+ 	enum pipe pipe = intel_crtc->pipe;
++	int ret;
+ 
+ 	/*
+ 	 * We'll only calculate watermarks for planes that are actually
+@@ -3318,13 +3325,16 @@ skl_compute_wm_level(const struct drm_i915_private *dev_priv,
+ 
+ 		ddb_blocks = skl_ddb_entry_size(&ddb->plane[pipe][i]);
+ 
+-		result->plane_en[i] = skl_compute_plane_wm(dev_priv,
+-						cstate,
+-						intel_pstate,
+-						ddb_blocks,
+-						level,
+-						&result->plane_res_b[i],
+-						&result->plane_res_l[i]);
++		ret = skl_compute_plane_wm(dev_priv,
++					   cstate,
++					   intel_pstate,
++					   ddb_blocks,
++					   level,
++					   &result->plane_res_b[i],
++					   &result->plane_res_l[i],
++					   &result->plane_en[i]);
++		if (ret)
++			return ret;
+ 	}
+ 
+ 	return 0;
+@@ -3361,21 +3371,26 @@ static void skl_compute_transition_wm(struct intel_crtc_state *cstate,
+ 	}
+ }
+ 
+-static void skl_build_pipe_wm(struct intel_crtc_state *cstate,
+-			      struct skl_ddb_allocation *ddb,
+-			      struct skl_pipe_wm *pipe_wm)
++static int skl_build_pipe_wm(struct intel_crtc_state *cstate,
++			     struct skl_ddb_allocation *ddb,
++			     struct skl_pipe_wm *pipe_wm)
+ {
+ 	struct drm_device *dev = cstate->base.crtc->dev;
+ 	const struct drm_i915_private *dev_priv = dev->dev_private;
+ 	int level, max_level = ilk_wm_max_level(dev);
++	int ret;
+ 
+ 	for (level = 0; level <= max_level; level++) {
+-		skl_compute_wm_level(dev_priv, ddb, cstate,
+-				     level, &pipe_wm->wm[level]);
++		ret = skl_compute_wm_level(dev_priv, ddb, cstate,
++					   level, &pipe_wm->wm[level]);
++		if (ret)
++			return ret;
+ 	}
+ 	pipe_wm->linetime = skl_compute_linetime_wm(cstate);
+ 
+ 	skl_compute_transition_wm(cstate, &pipe_wm->trans_wm);
++
++	return 0;
+ }
+ 
+ static void skl_compute_wm_results(struct drm_device *dev,
+@@ -3622,21 +3637,27 @@ static void skl_flush_wm_values(struct drm_i915_private *dev_priv,
+ 	}
+ }
+ 
+-static bool skl_update_pipe_wm(struct drm_crtc_state *cstate,
+-			       struct skl_ddb_allocation *ddb, /* out */
+-			       struct skl_pipe_wm *pipe_wm /* out */)
++static int skl_update_pipe_wm(struct drm_crtc_state *cstate,
++			      struct skl_ddb_allocation *ddb, /* out */
++			      struct skl_pipe_wm *pipe_wm, /* out */
++			      bool *changed /* out */)
+ {
+ 	struct intel_crtc *intel_crtc = to_intel_crtc(cstate->crtc);
+ 	struct intel_crtc_state *intel_cstate = to_intel_crtc_state(cstate);
++	int ret;
+ 
+-	skl_build_pipe_wm(intel_cstate, ddb, pipe_wm);
++	ret = skl_build_pipe_wm(intel_cstate, ddb, pipe_wm);
++	if (ret)
++		return ret;
+ 
+ 	if (!memcmp(&intel_crtc->wm.active.skl, pipe_wm, sizeof(*pipe_wm)))
+-		return false;
++		*changed = false;
++	else
++		*changed = true;
+ 
+ 	intel_crtc->wm.active.skl = *pipe_wm;
+ 
+-	return true;
++	return 0;
+ }
+ 
+ static void skl_update_other_pipe_wm(struct drm_device *dev,
+@@ -3669,8 +3690,8 @@ static void skl_update_other_pipe_wm(struct drm_device *dev,
+ 		if (!intel_crtc->active)
+ 			continue;
+ 
+-		wm_changed = skl_update_pipe_wm(intel_crtc->base.state,
+-						&r->ddb, &pipe_wm);
++		skl_update_pipe_wm(intel_crtc->base.state,
++				   &r->ddb, &pipe_wm, &wm_changed);
+ 
+ 		/*
+ 		 * If we end up re-computing the other pipe WM values, it's
+@@ -3780,14 +3801,15 @@ static void skl_update_wm(struct drm_crtc *crtc)
+ 	struct skl_wm_values *results = &dev_priv->wm.skl_results;
+ 	struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
+ 	struct skl_pipe_wm *pipe_wm = &cstate->wm.skl.optimal;
+-
++	bool wm_changed;
+ 
+ 	/* Clear all dirty flags */
+ 	results->dirty_pipes = 0;
+ 
+ 	skl_clear_wm(results, intel_crtc->pipe);
+ 
+-	if (!skl_update_pipe_wm(crtc->state, &results->ddb, pipe_wm))
++	skl_update_pipe_wm(crtc->state, &results->ddb, pipe_wm, &wm_changed);
++	if (!wm_changed)
+ 		return;
+ 
+ 	skl_compute_wm_results(dev, pipe_wm, results, intel_crtc);
+-- 
+2.7.4
+

0015-drm-i915-gen9-Calculate-watermarks-during-atomic-che.patch

@@ -0,0 +1,302 @@
+From 664f87c5bfcc7798bd5b16e14792f1e9ba2956ea Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Thu, 12 May 2016 15:11:40 -0700
+Subject: [PATCH 15/17] drm/i915/gen9: Calculate watermarks during atomic
+ 'check' (v2)
+
+Moving watermark calculation into the check phase will allow us to to
+reject display configurations for which there are no valid watermark
+values before we start trying to program the hardware (although those
+tests will come in a subsequent patch).
+
+Another advantage of moving this calculation to the check phase is that
+we can calculate the watermarks in a single shot as part of the atomic
+transaction.  The watermark interfaces we inherited from our legacy
+modesetting days are a bit broken in the atomic design because they use
+per-crtc entry points but actually re-calculate and re-program something
+that is really more of a global state.  That worked okay in the legacy
+modesetting world because operations only ever updated a single CRTC at
+a time.  However in the atomic world, a transaction can involve multiple
+CRTC's, which means we wind up computing and programming the watermarks
+NxN times (where N is the number of CRTC's involved).  With this patch
+we eliminate the redundant re-calculation of watermark data for atomic
+states (which was the cause of the WARN_ON(!wm_changed) problems that
+have plagued us for a while).
+
+We still need to work on the 'commit' side of watermark handling so that
+we aren't doing redundant NxN programming of watermarks, but that's
+content for future patches.
+
+v2:
+ - Bail out of skl_write_wm_values() if the CRTC isn't active.  Now that
+   we set dirty_pipes to ~0 if the active pipes change (because
+   we need to deal with DDB changes), we can now wind up here for
+   disabled pipes, whereas we couldn't before.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89055
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92181
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Tested-by: Daniel Stone <daniels@collabora.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463091100-13747-1-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_display.c |   2 +-
+ drivers/gpu/drm/i915/intel_drv.h     |   2 +-
+ drivers/gpu/drm/i915/intel_pm.c      | 140 +++++++++++++----------------------
+ 3 files changed, 54 insertions(+), 90 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 2190bac..a75daac 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13627,7 +13627,7 @@ static int intel_atomic_commit(struct drm_device *dev,
+ 	drm_atomic_helper_swap_state(dev, state);
+ 	dev_priv->wm.config = intel_state->wm_config;
+ 	dev_priv->wm.distrust_bios_wm = false;
+-	dev_priv->wm.skl_results.ddb = intel_state->ddb;
++	dev_priv->wm.skl_results = intel_state->wm_results;
+ 	intel_shared_dpll_commit(state);
+ 
+ 	if (intel_state->modeset) {
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 2218290..ab0be7a 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -314,7 +314,7 @@ struct intel_atomic_state {
+ 	bool skip_intermediate_wm;
+ 
+ 	/* Gen9+ only */
+-	struct skl_ddb_allocation ddb;
++	struct skl_wm_values wm_results;
+ };
+ 
+ struct intel_plane_state {
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 342aa66..b072417 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3221,23 +3221,6 @@ static uint32_t skl_wm_method2(uint32_t pixel_rate, uint32_t pipe_htotal,
+ 	return ret;
+ }
+ 
+-static bool skl_ddb_allocation_changed(const struct skl_ddb_allocation *new_ddb,
+-				       const struct intel_crtc *intel_crtc)
+-{
+-	struct drm_device *dev = intel_crtc->base.dev;
+-	struct drm_i915_private *dev_priv = dev->dev_private;
+-	const struct skl_ddb_allocation *cur_ddb = &dev_priv->wm.skl_hw.ddb;
+-
+-	/*
+-	 * If ddb allocation of pipes changed, it may require recalculation of
+-	 * watermarks
+-	 */
+-	if (memcmp(new_ddb->pipe, cur_ddb->pipe, sizeof(new_ddb->pipe)))
+-		return true;
+-
+-	return false;
+-}
+-
+ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ 				struct intel_crtc_state *cstate,
+ 				struct intel_plane_state *intel_pstate,
+@@ -3533,6 +3516,8 @@ static void skl_write_wm_values(struct drm_i915_private *dev_priv,
+ 
+ 		if ((new->dirty_pipes & drm_crtc_mask(&crtc->base)) == 0)
+ 			continue;
++		if (!crtc->active)
++			continue;
+ 
+ 		I915_WRITE(PIPE_WM_LINETIME(pipe), new->wm_linetime[pipe]);
+ 
+@@ -3716,66 +3701,9 @@ static int skl_update_pipe_wm(struct drm_crtc_state *cstate,
+ 	else
+ 		*changed = true;
+ 
+-	intel_crtc->wm.active.skl = *pipe_wm;
+-
+ 	return 0;
+ }
+ 
+-static void skl_update_other_pipe_wm(struct drm_device *dev,
+-				     struct drm_crtc *crtc,
+-				     struct skl_wm_values *r)
+-{
+-	struct intel_crtc *intel_crtc;
+-	struct intel_crtc *this_crtc = to_intel_crtc(crtc);
+-
+-	/*
+-	 * If the WM update hasn't changed the allocation for this_crtc (the
+-	 * crtc we are currently computing the new WM values for), other
+-	 * enabled crtcs will keep the same allocation and we don't need to
+-	 * recompute anything for them.
+-	 */
+-	if (!skl_ddb_allocation_changed(&r->ddb, this_crtc))
+-		return;
+-
+-	/*
+-	 * Otherwise, because of this_crtc being freshly enabled/disabled, the
+-	 * other active pipes need new DDB allocation and WM values.
+-	 */
+-	for_each_intel_crtc(dev, intel_crtc) {
+-		struct skl_pipe_wm pipe_wm = {};
+-		bool wm_changed;
+-
+-		if (this_crtc->pipe == intel_crtc->pipe)
+-			continue;
+-
+-		if (!intel_crtc->active)
+-			continue;
+-
+-		skl_update_pipe_wm(intel_crtc->base.state,
+-				   &r->ddb, &pipe_wm, &wm_changed);
+-
+-		/*
+-		 * If we end up re-computing the other pipe WM values, it's
+-		 * because it was really needed, so we expect the WM values to
+-		 * be different.
+-		 */
+-		WARN_ON(!wm_changed);
+-
+-		skl_compute_wm_results(dev, &pipe_wm, r, intel_crtc);
+-		r->dirty_pipes |= drm_crtc_mask(&intel_crtc->base);
+-	}
+-}
+-
+-static void skl_clear_wm(struct skl_wm_values *watermarks, enum pipe pipe)
+-{
+-	watermarks->wm_linetime[pipe] = 0;
+-	memset(watermarks->plane[pipe], 0,
+-	       sizeof(uint32_t) * 8 * I915_MAX_PLANES);
+-	memset(watermarks->plane_trans[pipe],
+-	       0, sizeof(uint32_t) * I915_MAX_PLANES);
+-	watermarks->plane_trans[pipe][PLANE_CURSOR] = 0;
+-}
+-
+ static int
+ skl_compute_ddb(struct drm_atomic_state *state)
+ {
+@@ -3783,6 +3711,7 @@ skl_compute_ddb(struct drm_atomic_state *state)
+ 	struct drm_i915_private *dev_priv = to_i915(dev);
+ 	struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
+ 	struct intel_crtc *intel_crtc;
++	struct skl_ddb_allocation *ddb = &intel_state->wm_results.ddb;
+ 	unsigned realloc_pipes = dev_priv->active_crtcs;
+ 	int ret;
+ 
+@@ -3808,8 +3737,10 @@ skl_compute_ddb(struct drm_atomic_state *state)
+ 	 * any other display updates race with this transaction, so we need
+ 	 * to grab the lock on *all* CRTC's.
+ 	 */
+-	if (intel_state->active_pipe_changes)
++	if (intel_state->active_pipe_changes) {
+ 		realloc_pipes = ~0;
++		intel_state->wm_results.dirty_pipes = ~0;
++	}
+ 
+ 	for_each_intel_crtc_mask(dev, intel_crtc, realloc_pipes) {
+ 		struct intel_crtc_state *cstate;
+@@ -3818,7 +3749,7 @@ skl_compute_ddb(struct drm_atomic_state *state)
+ 		if (IS_ERR(cstate))
+ 			return PTR_ERR(cstate);
+ 
+-		ret = skl_allocate_pipe_ddb(cstate, &intel_state->ddb);
++		ret = skl_allocate_pipe_ddb(cstate, ddb);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -3831,8 +3762,11 @@ skl_compute_wm(struct drm_atomic_state *state)
+ {
+ 	struct drm_crtc *crtc;
+ 	struct drm_crtc_state *cstate;
+-	int ret, i;
++	struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
++	struct skl_wm_values *results = &intel_state->wm_results;
++	struct skl_pipe_wm *pipe_wm;
+ 	bool changed = false;
++	int ret, i;
+ 
+ 	/*
+ 	 * If this transaction isn't actually touching any CRTC's, don't
+@@ -3847,10 +3781,45 @@ skl_compute_wm(struct drm_atomic_state *state)
+ 	if (!changed)
+ 		return 0;
+ 
++	/* Clear all dirty flags */
++	results->dirty_pipes = 0;
++
+ 	ret = skl_compute_ddb(state);
+ 	if (ret)
+ 		return ret;
+ 
++	/*
++	 * Calculate WM's for all pipes that are part of this transaction.
++	 * Note that the DDB allocation above may have added more CRTC's that
++	 * weren't otherwise being modified (and set bits in dirty_pipes) if
++	 * pipe allocations had to change.
++	 *
++	 * FIXME:  Now that we're doing this in the atomic check phase, we
++	 * should allow skl_update_pipe_wm() to return failure in cases where
++	 * no suitable watermark values can be found.
++	 */
++	for_each_crtc_in_state(state, crtc, cstate, i) {
++		struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
++		struct intel_crtc_state *intel_cstate =
++			to_intel_crtc_state(cstate);
++
++		pipe_wm = &intel_cstate->wm.skl.optimal;
++		ret = skl_update_pipe_wm(cstate, &results->ddb, pipe_wm,
++					 &changed);
++		if (ret)
++			return ret;
++
++		if (changed)
++			results->dirty_pipes |= drm_crtc_mask(crtc);
++
++		if ((results->dirty_pipes & drm_crtc_mask(crtc)) == 0)
++			/* This pipe's WM's did not change */
++			continue;
++
++		intel_cstate->update_wm_pre = true;
++		skl_compute_wm_results(crtc->dev, pipe_wm, results, intel_crtc);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -3862,26 +3831,21 @@ static void skl_update_wm(struct drm_crtc *crtc)
+ 	struct skl_wm_values *results = &dev_priv->wm.skl_results;
+ 	struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
+ 	struct skl_pipe_wm *pipe_wm = &cstate->wm.skl.optimal;
+-	bool wm_changed;
+-
+-	/* Clear all dirty flags */
+-	results->dirty_pipes = 0;
+ 
+-	skl_clear_wm(results, intel_crtc->pipe);
+-
+-	skl_update_pipe_wm(crtc->state, &results->ddb, pipe_wm, &wm_changed);
+-	if (!wm_changed)
++	if ((results->dirty_pipes & drm_crtc_mask(crtc)) == 0)
+ 		return;
+ 
+-	skl_compute_wm_results(dev, pipe_wm, results, intel_crtc);
+-	results->dirty_pipes |= drm_crtc_mask(&intel_crtc->base);
++	intel_crtc->wm.active.skl = *pipe_wm;
++
++	mutex_lock(&dev_priv->wm.wm_mutex);
+ 
+-	skl_update_other_pipe_wm(dev, crtc, results);
+ 	skl_write_wm_values(dev_priv, results);
+ 	skl_flush_wm_values(dev_priv, results);
+ 
+ 	/* store the new configuration */
+ 	dev_priv->wm.skl_hw = *results;
++
++	mutex_unlock(&dev_priv->wm.wm_mutex);
+ }
+ 
+ static void ilk_compute_wm_config(struct drm_device *dev,
+-- 
+2.7.4
+

0016-drm-i915-gen9-Reject-display-updates-that-exceed-wm-.patch

@@ -0,0 +1,63 @@
+From 7731c187f1f77501b7dddf419a06c1b42b0f1388 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 20 Jun 2016 12:42:00 +0200
+Subject: [PATCH 16/17] drm/i915/gen9: Reject display updates that exceed wm
+ limitations (v2)
+
+Upstream: since drm-intel-next-2016-05-22
+commit 6b6bada7d476b586d85b1f9df43125804877e09f
+
+Author:     Matt Roper <matthew.d.roper@intel.com>
+AuthorDate: Thu May 12 07:06:10 2016 -0700
+Commit:     Matt Roper <matthew.d.roper@intel.com>
+CommitDate: Fri May 13 07:36:04 2016 -0700
+
+    drm/i915/gen9: Reject display updates that exceed wm limitations (v2)
+
+    If we can't find any valid level 0 watermark values for the requested
+    atomic transaction, reject the configuration before we try to start
+    programming the hardware.
+
+    v2:
+     - Add extra debugging output when we reject level 0 watermarks so that
+       we can more easily debug how/why they were rejected.
+
+    Cc: Lyude Paul <cpaul@redhat.com>
+    Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+    Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-17-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/intel_pm.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 73e5242..70dcd2e 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3245,7 +3245,22 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ 
+ 	if (res_blocks >= ddb_allocation || res_lines > 31) {
+ 		*enabled = false;
+-		return 0;
++
++		/*
++		 * If there are no valid level 0 watermarks, then we can't
++		 * support this display configuration.
++		 */
++		if (level) {
++			return 0;
++		} else {
++			DRM_DEBUG_KMS("Requested display configuration exceeds system watermark limitations\n");
++			DRM_DEBUG_KMS("Plane %d.%d: blocks required = %u/%u, lines required = %u/31\n",
++				      to_intel_crtc(cstate->base.crtc)->pipe,
++				      skl_wm_plane_id(to_intel_plane(pstate->plane)),
++				      res_blocks, ddb_allocation, res_lines);
++
++			return -EINVAL;
++		}
+ 	}
+ 
+ 	*out_blocks = res_blocks;
+-- 
+2.7.4
+

0017-drm-i915-Remove-wm_config-from-dev_priv-intel_atomic.patch

@@ -0,0 +1,105 @@
+From 73a35468564f4e47deade0a4a5eb7ec289611ebc Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Thu, 12 May 2016 07:06:11 -0700
+Subject: [PATCH 17/17] drm/i915: Remove wm_config from
+ dev_priv/intel_atomic_state
+
+We calculate the watermark config into intel_atomic_state and then save
+it into dev_priv, but never actually use it from there.  This is
+left-over from some early ILK-style watermark programming designs that
+got changed over time.
+
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463061971-19638-18-git-send-email-matthew.d.roper@intel.com
+---
+ drivers/gpu/drm/i915/i915_drv.h      |  3 ---
+ drivers/gpu/drm/i915/intel_display.c | 31 -------------------------------
+ drivers/gpu/drm/i915/intel_drv.h     |  1 -
+ 3 files changed, 35 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index e7bde72..608f8e4 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1961,9 +1961,6 @@ struct drm_i915_private {
+ 		 */
+ 		uint16_t skl_latency[8];
+ 
+-		/* Committed wm config */
+-		struct intel_wm_config config;
+-
+ 		/*
+ 		 * The skl_wm_values structure is a bit too big for stack
+ 		 * allocation, so we keep the staging struct where we store
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index a75daac..9c109c6 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13343,35 +13343,6 @@ static int calc_watermark_data(struct drm_atomic_state *state)
+ {
+ 	struct drm_device *dev = state->dev;
+ 	struct drm_i915_private *dev_priv = to_i915(dev);
+-	struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
+-	struct drm_crtc *crtc;
+-	struct drm_crtc_state *cstate;
+-	struct drm_plane *plane;
+-	struct drm_plane_state *pstate;
+-
+-	/*
+-	 * Calculate watermark configuration details now that derived
+-	 * plane/crtc state is all properly updated.
+-	 */
+-	drm_for_each_crtc(crtc, dev) {
+-		cstate = drm_atomic_get_existing_crtc_state(state, crtc) ?:
+-			crtc->state;
+-
+-		if (cstate->active)
+-			intel_state->wm_config.num_pipes_active++;
+-	}
+-	drm_for_each_legacy_plane(plane, dev) {
+-		pstate = drm_atomic_get_existing_plane_state(state, plane) ?:
+-			plane->state;
+-
+-		if (!to_intel_plane_state(pstate)->visible)
+-			continue;
+-
+-		intel_state->wm_config.sprites_enabled = true;
+-		if (pstate->crtc_w != pstate->src_w >> 16 ||
+-		    pstate->crtc_h != pstate->src_h >> 16)
+-			intel_state->wm_config.sprites_scaled = true;
+-	}
+ 
+ 	/* Is there platform-specific watermark information to calculate? */
+ 	if (dev_priv->display.compute_global_watermarks)
+@@ -13625,7 +13596,6 @@ static int intel_atomic_commit(struct drm_device *dev,
+ 	}
+ 
+ 	drm_atomic_helper_swap_state(dev, state);
+-	dev_priv->wm.config = intel_state->wm_config;
+ 	dev_priv->wm.distrust_bios_wm = false;
+ 	dev_priv->wm.skl_results = intel_state->wm_results;
+ 	intel_shared_dpll_commit(state);
+@@ -15405,7 +15375,6 @@ retry:
+ 	}
+ 
+ 	/* Write calculated watermark values back */
+-	to_i915(dev)->wm.config = to_intel_atomic_state(state)->wm_config;
+ 	for_each_crtc_in_state(state, crtc, cstate, i) {
+ 		struct intel_crtc_state *cs = to_intel_crtc_state(cstate);
+ 
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index ab0be7a..8d73c20 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -305,7 +305,6 @@ struct intel_atomic_state {
+ 	unsigned int min_pixclk[I915_MAX_PIPES];
+ 
+ 	struct intel_shared_dpll_config shared_dpll[I915_NUM_PLLS];
+-	struct intel_wm_config wm_config;
+ 
+ 	/*
+ 	 * Current watermarks can't be trusted during hardware readout, so
+-- 
+2.7.4
+

ALSA-timer-Fix-leak-in-SNDRV_TIMER_IOCTL_PARAMS.patch

@@ -0,0 +1,33 @@
+From 527a5767c165abd2b4dba99da992c51ca7547562 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kangjielu@gmail.com>
+Date: Tue, 3 May 2016 16:44:07 -0400
+Subject: [PATCH 1/3] ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The stack object “tread” has a total size of 32 bytes. Its field
+“event” and “val” both contain 4 bytes padding. These 8 bytes
+padding bytes are sent to user without being initialized.
+
+Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ sound/core/timer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 6469bedda2f3..964f5ebf495e 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1739,6 +1739,7 @@ static int snd_timer_user_params(struct file *file,
+ 	if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) {
+ 		if (tu->tread) {
+ 			struct snd_timer_tread tread;
++			memset(&tread, 0, sizeof(tread));
+ 			tread.event = SNDRV_TIMER_EVENT_EARLY;
+ 			tread.tstamp.tv_sec = 0;
+ 			tread.tstamp.tv_nsec = 0;
+-- 
+2.5.5
+

ALSA-timer-Fix-leak-in-events-via-snd_timer_user_cca.patch

@@ -0,0 +1,34 @@
+From addd6e9f0e25efb00d813d54528607c75b77c416 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kangjielu@gmail.com>
+Date: Tue, 3 May 2016 16:44:20 -0400
+Subject: [PATCH 2/3] ALSA: timer: Fix leak in events via
+ snd_timer_user_ccallback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The stack object “r1” has a total size of 32 bytes. Its field
+“event” and “val” both contain 4 bytes padding. These 8 bytes
+padding bytes are sent to user without being initialized.
+
+Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ sound/core/timer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 964f5ebf495e..e98fa5feb731 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1225,6 +1225,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri,
+ 		tu->tstamp = *tstamp;
+ 	if ((tu->filter & (1 << event)) == 0 || !tu->tread)
+ 		return;
++	memset(&r1, 0, sizeof(r1));
+ 	r1.event = event;
+ 	r1.tstamp = *tstamp;
+ 	r1.val = resolution;
+-- 
+2.5.5
+

ALSA-timer-Fix-leak-in-events-via-snd_timer_user_tin.patch

@@ -0,0 +1,34 @@
+From b06a443b5679e9a0298e2f206ddb60845569f62f Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kangjielu@gmail.com>
+Date: Tue, 3 May 2016 16:44:32 -0400
+Subject: [PATCH 3/3] ALSA: timer: Fix leak in events via
+ snd_timer_user_tinterrupt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The stack object “r1” has a total size of 32 bytes. Its field
+“event” and “val” both contain 4 bytes padding. These 8 bytes
+padding bytes are sent to user without being initialized.
+
+Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ sound/core/timer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index e98fa5feb731..c69a27155433 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1268,6 +1268,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri,
+ 	}
+ 	if ((tu->filter & (1 << SNDRV_TIMER_EVENT_RESOLUTION)) &&
+ 	    tu->last_resolution != resolution) {
++		memset(&r1, 0, sizeof(r1));
+ 		r1.event = SNDRV_TIMER_EVENT_RESOLUTION;
+ 		r1.tstamp = tstamp;
+ 		r1.val = resolution;
+-- 
+2.5.5
+

ARM-OMAP4-Fix-crashes.patch

@@ -0,0 +1,97 @@
+From patchwork Wed Oct 26 15:17:01 2016
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [3/5] ARM: OMAP4+: Fix bad fallthrough for cpuidle
+From: Tony Lindgren <tony@atomide.com>
+X-Patchwork-Id: 9397501
+Message-Id: <20161026151703.24730-4-tony@atomide.com>
+To: linux-omap@vger.kernel.org
+Cc: Nishanth Menon <nm@ti.com>, Dmitry Lifshitz <lifshitz@compulab.co.il>,
+ Dave Gerlach <d-gerlach@ti.com>,
+ Enric Balletbo Serra <eballetbo@gmail.com>, 
+ "Dr . H . Nikolaus Schaller" <hns@goldelico.com>,
+ Pau Pajuel <ppajuel@gmail.com>, Grazvydas Ignotas <notasas@gmail.com>,
+ Benoit Cousson <bcousson@baylibre.com>,
+ Santosh Shilimkar <ssantosh@kernel.org>,
+ Javier Martinez Canillas <javier@dowhile0.org>,
+ Robert Nelson <robertcnelson@gmail.com>,
+ Marek Belisko <marek@goldelico.com>, linux-arm-kernel@lists.infradead.org
+Date: Wed, 26 Oct 2016 08:17:01 -0700
+
+We don't want to fall through to a bunch of errors for retention
+if PM_OMAP4_CPU_OSWR_DISABLE is not configured for a SoC.
+
+Fixes: 6099dd37c669 ("ARM: OMAP5 / DRA7: Enable CPU RET on suspend")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+---
+ arch/arm/mach-omap2/omap-mpuss-lowpower.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
+--- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
++++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
+@@ -244,10 +244,9 @@ int omap4_enter_lowpower(unsigned int cpu, unsigned int power_state)
+ 		save_state = 1;
+ 		break;
+ 	case PWRDM_POWER_RET:
+-		if (IS_PM44XX_ERRATUM(PM_OMAP4_CPU_OSWR_DISABLE)) {
++		if (IS_PM44XX_ERRATUM(PM_OMAP4_CPU_OSWR_DISABLE))
+ 			save_state = 0;
+-			break;
+-		}
++		break;
+ 	default:
+ 		/*
+ 		 * CPUx CSWR is invalid hardware state. Also CPUx OSWR
+From 5a78ff7bf7e25191144b550961001bbf6c734da4 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Thu, 11 Aug 2016 17:44:54 +0800
+Subject: [PATCH 04152/16809] Revert "gpu: drm: omapdrm: dss-of: add missing
+ of_node_put after calling of_parse_phandle"
+
+This reverts
+commit 2ab9f5879162499e1c4e48613287e3f59e593c4f
+Author: Peter Chen <peter.chen@nxp.com>
+Date:   Fri Jul 15 11:17:03 2016 +0800
+    gpu: drm: omapdrm: dss-of: add missing of_node_put after calling of_parse_phandle
+
+The of_get_next_parent will drop refcount on the passed node, so the reverted
+patch is wrong, thanks for Tomi Valkeinen points it.
+
+Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Acked-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: http://patchwork.freedesktop.org/patch/msgid/1470908694-16362-1-git-send-email-peter.chen@nxp.com
+---
+ drivers/gpu/drm/omapdrm/dss/dss-of.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/dss/dss-of.c b/drivers/gpu/drm/omapdrm/dss/dss-of.c
+index e256d87..dfd4e96 100644
+--- a/drivers/gpu/drm/omapdrm/dss/dss-of.c
++++ b/drivers/gpu/drm/omapdrm/dss/dss-of.c
+@@ -125,16 +125,15 @@ u32 dss_of_port_get_port_number(struct device_node *port)
+ 
+ static struct device_node *omapdss_of_get_remote_port(const struct device_node *node)
+ {
+-	struct device_node *np, *np_parent;
++	struct device_node *np;
+ 
+ 	np = of_parse_phandle(node, "remote-endpoint", 0);
+ 	if (!np)
+ 		return NULL;
+ 
+-	np_parent = of_get_next_parent(np);
+-	of_node_put(np);
++	np = of_get_next_parent(np);
+ 
+-	return np_parent;
++	return np;
+ }
+ 
+ struct device_node *
+-- 
+2.9.3
+

ARM-mvebu-change-order-of-ethernet-DT-nodes-on-Armada-38x.patch

@@ -0,0 +1,101 @@
+From patchwork Wed Jan 27 15:08:19 2016
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/2] ARM: mvebu: change order of ethernet DT nodes on Armada 38x
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+X-Patchwork-Id: 8134751
+Message-Id: <1453907300-28283-2-git-send-email-thomas.petazzoni@free-electrons.com>
+To: Jason Cooper <jason@lakedaemon.net>, Andrew Lunn <andrew@lunn.ch>,
+	Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>,
+	Gregory Clement <gregory.clement@free-electrons.com>
+Cc: Nadav Haklai <nadavh@marvell.com>, Lior Amsalem <alior@marvell.com>,
+	Thomas Petazzoni <thomas.petazzoni@free-electrons.com>,
+	linux-arm-kernel@lists.infradead.org
+Date: Wed, 27 Jan 2016 16:08:19 +0100
+
+On Armada 38x, the available network interfaces are:
+
+ - port 0, at 0x70000
+ - port 1, at 0x30000
+ - port 2, at 0x34000
+
+Due to the rule saying that DT nodes should be ordered by register
+addresses, the network interfaces are probed in this order:
+
+ - port 1, at 0x30000, which gets named eth0
+ - port 2, at 0x34000, which gets named eth1
+ - port 0, at 0x70000, which gets named eth2
+
+(if all three ports are enabled at the board level)
+
+Unfortunately, the network subsystem doesn't provide any way to rename
+network interfaces from the kernel (it can only be done from
+userspace). So, the default naming of the network interfaces is very
+confusing as it doesn't match the datasheet, nor the naming of the
+interfaces in the bootloader, nor the naming of the interfaces on
+labels printed on the board.
+
+For example, on the Armada 388 GP, the board has two ports, labelled
+GE0 and GE1. One has to know that GE0 is eth1 and GE1 is eth0, which
+isn't really obvious.
+
+In order to solve this, this patch proposes to exceptionaly violate
+the rule of "order DT nodes by register address", and put the 0x70000
+node before the 0x30000 node, so that network interfaces get named in
+a more natural way.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+---
+arch/arm/boot/dts/armada-38x.dtsi | 30 +++++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
+index e8b7f67..b50784d 100644
+--- a/arch/arm/boot/dts/armada-38x.dtsi
++++ b/arch/arm/boot/dts/armada-38x.dtsi
+@@ -429,6 +429,27 @@
+ 				reg = <0x22000 0x1000>;
+ 			};
+ 
++			/*
++			 * As a special exception to the "order by
++			 * register address" rule, the eth0 node is
++			 * placed here to ensure that it gets
++			 * registered as the first interface, since
++			 * the network subsystem doesn't allow naming
++			 * interfaces using DT aliases. Without this,
++			 * the ordering of interfaces is different
++			 * from the one used in U-Boot and the
++			 * labeling of interfaces on the boards, which
++			 * is very confusing for users.
++			 */
++			eth0: ethernet@70000 {
++				compatible = "marvell,armada-370-neta";
++				reg = <0x70000 0x4000>;
++				interrupts-extended = <&mpic 8>;
++				clocks = <&gateclk 4>;
++				tx-csum-limit = <9800>;
++				status = "disabled";
++			};
++
+ 			eth1: ethernet@30000 {
+ 				compatible = "marvell,armada-370-neta";
+ 				reg = <0x30000 0x4000>;
+@@ -493,15 +514,6 @@
+ 				};
+ 			};
+ 
+-			eth0: ethernet@70000 {
+-				compatible = "marvell,armada-370-neta";
+-				reg = <0x70000 0x4000>;
+-				interrupts-extended = <&mpic 8>;
+-				clocks = <&gateclk 4>;
+-				tx-csum-limit = <9800>;
+-				status = "disabled";
+-			};
+-
+ 			mdio: mdio@72004 {
+ 				#address-cells = <1>;
+ 				#size-cells = <0>;

Fix-tegra-to-use-stdout-path-for-serial-console.patch

@@ -0,0 +1,318 @@
+From 15b8caef5f380d9465876478ff5e365bc6afa5b6 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Sun, 6 Mar 2016 10:59:13 +0000
+Subject: [PATCH] Fix tegra to use stdout-path for serial console
+
+---
+ arch/arm/boot/dts/tegra114-dalmore.dts         | 4 ++++
+ arch/arm/boot/dts/tegra124-jetson-tk1.dts      | 4 ++++
+ arch/arm/boot/dts/tegra124-nyan.dtsi           | 4 ++++
+ arch/arm/boot/dts/tegra124-venice2.dts         | 4 ++++
+ arch/arm/boot/dts/tegra20-harmony.dts          | 4 ++++
+ arch/arm/boot/dts/tegra20-iris-512.dts         | 4 ++++
+ arch/arm/boot/dts/tegra20-medcom-wide.dts      | 4 ++++
+ arch/arm/boot/dts/tegra20-paz00.dts            | 4 ++++
+ arch/arm/boot/dts/tegra20-seaboard.dts         | 4 ++++
+ arch/arm/boot/dts/tegra20-tamonten.dtsi        | 4 ++++
+ arch/arm/boot/dts/tegra20-trimslice.dts        | 4 ++++
+ arch/arm/boot/dts/tegra20-ventana.dts          | 4 ++++
+ arch/arm/boot/dts/tegra20-whistler.dts         | 4 ++++
+ arch/arm/boot/dts/tegra30-apalis-eval.dts      | 4 ++++
+ arch/arm/boot/dts/tegra30-beaver.dts           | 4 ++++
+ arch/arm/boot/dts/tegra30-cardhu.dtsi          | 4 ++++
+ arch/arm/boot/dts/tegra30-colibri-eval-v3.dts  | 4 ++++
+ arch/arm64/boot/dts/nvidia/tegra132-norrin.dts | 5 ++++-
+ arch/arm64/boot/dts/nvidia/tegra210-p2530.dtsi | 4 ++++
+ 19 files changed, 76 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/tegra114-dalmore.dts b/arch/arm/boot/dts/tegra114-dalmore.dts
+index 8b7aa0d..b5748ee 100644
+--- a/arch/arm/boot/dts/tegra114-dalmore.dts
++++ b/arch/arm/boot/dts/tegra114-dalmore.dts
+@@ -18,6 +18,10 @@
+ 		serial0 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra124-jetson-tk1.dts b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
+index 66b4451..abf046a 100644
+--- a/arch/arm/boot/dts/tegra124-jetson-tk1.dts
++++ b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
+@@ -15,6 +15,10 @@
+ 		serial0 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x0 0x80000000 0x0 0x80000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra124-nyan.dtsi b/arch/arm/boot/dts/tegra124-nyan.dtsi
+index ec1aa64..e2cd39e 100644
+--- a/arch/arm/boot/dts/tegra124-nyan.dtsi
++++ b/arch/arm/boot/dts/tegra124-nyan.dtsi
+@@ -8,6 +8,10 @@
+ 		serial0 = &uarta;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x0 0x80000000 0x0 0x80000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra124-venice2.dts b/arch/arm/boot/dts/tegra124-venice2.dts
+index cfbdf42..604f4b7 100644
+--- a/arch/arm/boot/dts/tegra124-venice2.dts
++++ b/arch/arm/boot/dts/tegra124-venice2.dts
+@@ -13,6 +13,10 @@
+ 		serial0 = &uarta;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x0 0x80000000 0x0 0x80000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra20-harmony.dts b/arch/arm/boot/dts/tegra20-harmony.dts
+index b926a07..4b73c76 100644
+--- a/arch/arm/boot/dts/tegra20-harmony.dts
++++ b/arch/arm/boot/dts/tegra20-harmony.dts
+@@ -13,6 +13,10 @@
+ 		serial0 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x00000000 0x40000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra20-iris-512.dts b/arch/arm/boot/dts/tegra20-iris-512.dts
+index 1dd7d7b..bb56dfe 100644
+--- a/arch/arm/boot/dts/tegra20-iris-512.dts
++++ b/arch/arm/boot/dts/tegra20-iris-512.dts
+@@ -11,6 +11,10 @@
+ 		serial1 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	host1x@50000000 {
+ 		hdmi@54280000 {
+ 			status = "okay";
+diff --git a/arch/arm/boot/dts/tegra20-medcom-wide.dts b/arch/arm/boot/dts/tegra20-medcom-wide.dts
+index 9b87526..34c6588 100644
+--- a/arch/arm/boot/dts/tegra20-medcom-wide.dts
++++ b/arch/arm/boot/dts/tegra20-medcom-wide.dts
+@@ -10,6 +10,10 @@
+ 		serial0 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	pwm@7000a000 {
+ 		status = "okay";
+ 	};
+diff --git a/arch/arm/boot/dts/tegra20-paz00.dts b/arch/arm/boot/dts/tegra20-paz00.dts
+index ed7e100..81a10a9 100644
+--- a/arch/arm/boot/dts/tegra20-paz00.dts
++++ b/arch/arm/boot/dts/tegra20-paz00.dts
+@@ -14,6 +14,10 @@
+ 		serial1 = &uartc;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x00000000 0x20000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra20-seaboard.dts b/arch/arm/boot/dts/tegra20-seaboard.dts
+index aea8994..0aed748 100644
+--- a/arch/arm/boot/dts/tegra20-seaboard.dts
++++ b/arch/arm/boot/dts/tegra20-seaboard.dts
+@@ -13,6 +13,10 @@
+ 		serial0 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x00000000 0x40000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+index 13d4e61..025e9e8 100644
+--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi
++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+@@ -10,6 +10,10 @@
+ 		serial0 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x00000000 0x20000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra20-trimslice.dts b/arch/arm/boot/dts/tegra20-trimslice.dts
+index d99af4e..69d25ca 100644
+--- a/arch/arm/boot/dts/tegra20-trimslice.dts
++++ b/arch/arm/boot/dts/tegra20-trimslice.dts
+@@ -13,6 +13,10 @@
+ 		serial0 = &uarta;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x00000000 0x40000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra20-ventana.dts b/arch/arm/boot/dts/tegra20-ventana.dts
+index 04c58e9..c61533a 100644
+--- a/arch/arm/boot/dts/tegra20-ventana.dts
++++ b/arch/arm/boot/dts/tegra20-ventana.dts
+@@ -13,6 +13,10 @@
+ 		serial0 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x00000000 0x40000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra20-whistler.dts b/arch/arm/boot/dts/tegra20-whistler.dts
+index 340d811..bd76585 100644
+--- a/arch/arm/boot/dts/tegra20-whistler.dts
++++ b/arch/arm/boot/dts/tegra20-whistler.dts
+@@ -13,6 +13,10 @@
+ 		serial0 = &uarta;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x00000000 0x20000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra30-apalis-eval.dts b/arch/arm/boot/dts/tegra30-apalis-eval.dts
+index f2879cf..b914bcb 100644
+--- a/arch/arm/boot/dts/tegra30-apalis-eval.dts
++++ b/arch/arm/boot/dts/tegra30-apalis-eval.dts
+@@ -17,6 +17,10 @@
+ 		serial3 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	pcie-controller@00003000 {
+ 		status = "okay";
+ 
+diff --git a/arch/arm/boot/dts/tegra30-beaver.dts b/arch/arm/boot/dts/tegra30-beaver.dts
+index 3dede39..1eca3b2 100644
+--- a/arch/arm/boot/dts/tegra30-beaver.dts
++++ b/arch/arm/boot/dts/tegra30-beaver.dts
+@@ -12,6 +12,10 @@
+ 		serial0 = &uarta;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x80000000 0x7ff00000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra30-cardhu.dtsi b/arch/arm/boot/dts/tegra30-cardhu.dtsi
+index bb1ca15..de9d6cc 100644
+--- a/arch/arm/boot/dts/tegra30-cardhu.dtsi
++++ b/arch/arm/boot/dts/tegra30-cardhu.dtsi
+@@ -35,6 +35,10 @@
+ 		serial1 = &uartc;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts b/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
+index 3ff019f..93e1ffd 100644
+--- a/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
++++ b/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
+@@ -15,6 +15,10 @@
+ 		serial2 = &uartd;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	host1x@50000000 {
+ 		dc@54200000 {
+ 			rgb {
+diff --git a/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts b/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
+index 62f33fc..3c0b4d7 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
+@@ -10,9 +10,12 @@
+ 	aliases {
+ 		rtc0 = "/i2c@0,7000d000/as3722@40";
+ 		rtc1 = "/rtc@0,7000e000";
++		serial0 = &uarta;
+ 	};
+ 
+-	chosen { };
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
+ 
+ 	memory {
+ 		device_type = "memory";
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2530.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2530.dtsi
+index ece0dec..73ba582 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2530.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2530.dtsi
+@@ -9,6 +9,10 @@
+ 		serial0 = &uarta;
+ 	};
+ 
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
+ 	memory {
+ 		device_type = "memory";
+ 		reg = <0x0 0x80000000 0x0 0xc0000000>;
+-- 
+2.5.0
+

HID-chicony-Add-support-for-Acer-Aspire-Switch-12.patch

@@ -0,0 +1,103 @@
+From 98f07385212073536f303c07ece455acdd4d267f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=D0=9D=D0=B8=D0=BA=D0=BE=D0=BB=D0=B0=D0=B9=20=D0=9A=D1=83?=
+ =?UTF-8?q?=D0=B4=D1=80=D1=8F=D0=B2=D1=86=D0=B5=D0=B2?=
+ <nkudriavtsev@gmail.com>
+Date: Tue, 21 Jul 2015 13:31:52 +0300
+Subject: [PATCH] HID: chicony: Add support for Acer Aspire Switch 12
+
+Acer Aspire Switch 12 keyboard Chicony's controller reports too big usage
+index on the 1st interface. The patch fixes the report. The work based on
+solution from drivers/hid/hid-holtek-mouse.c
+
+Bug report: https://bugzilla.kernel.org/show_bug.cgi?id=101721
+
+Signed-off-by: Nicholas Kudriavtsev <nkudriavtsev@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+---
+ drivers/hid/hid-chicony.c | 26 ++++++++++++++++++++++++++
+ drivers/hid/hid-core.c    |  1 +
+ drivers/hid/hid-ids.h     |  1 +
+ 3 files changed, 28 insertions(+)
+
+diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c
+index b613d5a79684..bc3cec199fee 100644
+--- a/drivers/hid/hid-chicony.c
++++ b/drivers/hid/hid-chicony.c
+@@ -20,6 +20,7 @@
+ #include <linux/input.h>
+ #include <linux/hid.h>
+ #include <linux/module.h>
++#include <linux/usb.h>
+ 
+ #include "hid-ids.h"
+ 
+@@ -57,10 +58,34 @@ static int ch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ 	return 1;
+ }
+ 
++static __u8 *ch_switch12_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++		unsigned int *rsize)
++{
++	struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
++	
++	if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
++		/* Change usage maximum and logical maximum from 0x7fff to
++		 * 0x2fff, so they don't exceed HID_MAX_USAGES */
++		switch (hdev->product) {
++		case USB_DEVICE_ID_CHICONY_ACER_SWITCH12:
++			if (*rsize >= 128 && rdesc[64] == 0xff && rdesc[65] == 0x7f
++					&& rdesc[69] == 0xff && rdesc[70] == 0x7f) {
++				hid_info(hdev, "Fixing up report descriptor\n");
++				rdesc[65] = rdesc[70] = 0x2f;
++			}
++			break;
++		}
++
++	}
++	return rdesc;
++}
++
++
+ static const struct hid_device_id ch_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, ch_devices);
+@@ -68,6 +93,7 @@ MODULE_DEVICE_TABLE(hid, ch_devices);
+ static struct hid_driver ch_driver = {
+ 	.name = "chicony",
+ 	.id_table = ch_devices,
++	.report_fixup = ch_switch12_report_fixup,
+ 	.input_mapping = ch_input_mapping,
+ };
+ module_hid_driver(ch_driver);
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index e6fce23b121a..f90ca6574221 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1807,6 +1807,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_CP2112) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index b3b225b75d0a..79210ca8eff1 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -233,6 +233,7 @@
+ #define USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE	0x1053
+ #define USB_DEVICE_ID_CHICONY_WIRELESS2	0x1123
+ #define USB_DEVICE_ID_CHICONY_AK1D	0x1125
++#define USB_DEVICE_ID_CHICONY_ACER_SWITCH12	0x1421
+ 
+ #define USB_VENDOR_ID_CHUNGHWAT		0x2247
+ #define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH	0x0001
+-- 
+2.4.3
+

HID-hid-input-Fix-accessing-freed-memory-during-devi.patch

@@ -0,0 +1,53 @@
+From 0621809e37936e7c2b3eac9165cf2aad7f9189eb Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Mon, 3 Aug 2015 14:57:30 +0900
+Subject: [PATCH] HID: hid-input: Fix accessing freed memory during device
+ disconnect
+
+During unbinding the driver was dereferencing a pointer to memory
+already freed by power_supply_unregister().
+
+Driver was freeing its internal description of battery through pointers
+stored in power_supply structure. However, because the core owns the
+power supply instance, after calling power_supply_unregister() this
+memory is freed and the driver cannot access these members.
+
+Fix this by storing the pointer to internal description of battery in a
+local variable before calling power_supply_unregister(), so the pointer
+remains valid.
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Reported-by: H.J. Lu <hjl.tools@gmail.com>
+Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+---
+ drivers/hid/hid-input.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 3511bbab..e3c6364 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -462,12 +462,15 @@ out:
+ 
+ static void hidinput_cleanup_battery(struct hid_device *dev)
+ {
++	const struct power_supply_desc *psy_desc;
++
+ 	if (!dev->battery)
+ 		return;
+ 
++	psy_desc = dev->battery->desc;
+ 	power_supply_unregister(dev->battery);
+-	kfree(dev->battery->desc->name);
+-	kfree(dev->battery->desc);
++	kfree(psy_desc->name);
++	kfree(psy_desc);
+ 	dev->battery = NULL;
+ }
+ #else  /* !CONFIG_HID_BATTERY_STRENGTH */
+-- 
+2.4.3
+

HID-wacom-fix-Bamboo-ONE-oops.patch

@@ -0,0 +1,46 @@
+From 580549ef6b3e3fb3b958de490ca99f43a089a2cf Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Fri, 25 Mar 2016 15:26:55 +0100
+Subject: [PATCH] HID: wacom: fix Bamboo ONE oops
+
+Looks like recent changes in the Wacom driver made the Bamboo ONE crashes.
+The tablet behaves as if it was a regular Bamboo device with pen, touch
+and pad, but there is no physical pad connected to it.
+The weird part is that the pad is still sending events and given that
+there is no input node connected to it, we get  anull pointer exception.
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317116
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Acked-by: Ping Cheng <pingc@wacom.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+---
+ drivers/hid/wacom_wac.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index bd198bbd4df0..02c4efea241c 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2426,6 +2426,17 @@ void wacom_setup_device_quirks(struct wacom *wacom)
+ 	}
+ 
+ 	/*
++	 * Hack for the Bamboo One:
++	 * the device presents a PAD/Touch interface as most Bamboos and even
++	 * sends ghosts PAD data on it. However, later, we must disable this
++	 * ghost interface, and we can not detect it unless we set it here
++	 * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH.
++	 */
++	if (features->type == BAMBOO_PEN &&
++	    features->pktlen == WACOM_PKGLEN_BBTOUCH3)
++		features->device_type |= WACOM_DEVICETYPE_PAD;
++
++	/*
+ 	 * Raw Wacom-mode pen and touch events both come from interface
+ 	 * 0, whose HID descriptor has an application usage of 0xFF0D
+ 	 * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back
+-- 
+2.5.5
+

Initialize-msg-shm-IPC-objects-before-doing-ipc_addi.patch

@@ -0,0 +1,117 @@
+From b9a532277938798b53178d5a66af6e2915cb27cf Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 30 Sep 2015 12:48:40 -0400
+Subject: [PATCH] Initialize msg/shm IPC objects before doing ipc_addid()
+
+As reported by Dmitry Vyukov, we really shouldn't do ipc_addid() before
+having initialized the IPC object state.  Yes, we initialize the IPC
+object in a locked state, but with all the lockless RCU lookup work,
+that IPC object lock no longer means that the state cannot be seen.
+
+We already did this for the IPC semaphore code (see commit e8577d1f0329:
+"ipc/sem.c: fully initialize sem_array before making it visible") but we
+clearly forgot about msg and shm.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Cc: Manfred Spraul <manfred@colorfullife.com>
+Cc: Davidlohr Bueso <dbueso@suse.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ ipc/msg.c  | 14 +++++++-------
+ ipc/shm.c  | 13 +++++++------
+ ipc/util.c |  8 ++++----
+ 3 files changed, 18 insertions(+), 17 deletions(-)
+
+diff --git a/ipc/msg.c b/ipc/msg.c
+index 66c4f567eb73..1471db9a7e61 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -137,13 +137,6 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
+ 		return retval;
+ 	}
+ 
+-	/* ipc_addid() locks msq upon success. */
+-	id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
+-	if (id < 0) {
+-		ipc_rcu_putref(msq, msg_rcu_free);
+-		return id;
+-	}
+-
+ 	msq->q_stime = msq->q_rtime = 0;
+ 	msq->q_ctime = get_seconds();
+ 	msq->q_cbytes = msq->q_qnum = 0;
+@@ -153,6 +146,13 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
+ 	INIT_LIST_HEAD(&msq->q_receivers);
+ 	INIT_LIST_HEAD(&msq->q_senders);
+ 
++	/* ipc_addid() locks msq upon success. */
++	id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
++	if (id < 0) {
++		ipc_rcu_putref(msq, msg_rcu_free);
++		return id;
++	}
++
+ 	ipc_unlock_object(&msq->q_perm);
+ 	rcu_read_unlock();
+ 
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 222131e8e38f..41787276e141 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -551,12 +551,6 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ 	if (IS_ERR(file))
+ 		goto no_file;
+ 
+-	id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
+-	if (id < 0) {
+-		error = id;
+-		goto no_id;
+-	}
+-
+ 	shp->shm_cprid = task_tgid_vnr(current);
+ 	shp->shm_lprid = 0;
+ 	shp->shm_atim = shp->shm_dtim = 0;
+@@ -565,6 +559,13 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ 	shp->shm_nattch = 0;
+ 	shp->shm_file = file;
+ 	shp->shm_creator = current;
++
++	id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
++	if (id < 0) {
++		error = id;
++		goto no_id;
++	}
++
+ 	list_add(&shp->shm_clist, &current->sysvshm.shm_clist);
+ 
+ 	/*
+diff --git a/ipc/util.c b/ipc/util.c
+index be4230020a1f..0f401d94b7c6 100644
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -237,6 +237,10 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size)
+ 	rcu_read_lock();
+ 	spin_lock(&new->lock);
+ 
++	current_euid_egid(&euid, &egid);
++	new->cuid = new->uid = euid;
++	new->gid = new->cgid = egid;
++
+ 	id = idr_alloc(&ids->ipcs_idr, new,
+ 		       (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,
+ 		       GFP_NOWAIT);
+@@ -249,10 +253,6 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size)
+ 
+ 	ids->in_use++;
+ 
+-	current_euid_egid(&euid, &egid);
+-	new->cuid = new->uid = euid;
+-	new->gid = new->cgid = egid;
+-
+ 	if (next_id < 0) {
+ 		new->seq = ids->seq++;
+ 		if (ids->seq > IPCID_SEQ_MAX)
+-- 
+2.4.3
+

KEYS-Fix-ASN.1-indefinite-length-object-parsing.patch

@@ -0,0 +1,91 @@
+From 23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 23 Feb 2016 11:03:12 +0000
+Subject: [PATCH] KEYS: Fix ASN.1 indefinite length object parsing
+
+This fixes CVE-2016-0758.
+
+In the ASN.1 decoder, when the length field of an ASN.1 value is extracted,
+it isn't validated against the remaining amount of data before being added
+to the cursor.  With a sufficiently large size indicated, the check:
+
+	datalen - dp < 2
+
+may then fail due to integer overflow.
+
+Fix this by checking the length indicated against the amount of remaining
+data in both places a definite length is determined.
+
+Whilst we're at it, make the following changes:
+
+ (1) Check the maximum size of extended length does not exceed the capacity
+     of the variable it's being stored in (len) rather than the type that
+     variable is assumed to be (size_t).
+
+ (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the
+     integer 0.
+
+ (3) To reduce confusion, move the initialisation of len outside of:
+
+	for (len = 0; n > 0; n--) {
+
+     since it doesn't have anything to do with the loop counter n.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Acked-by: David Woodhouse <David.Woodhouse@intel.com>
+Acked-by: Peter Jones <pjones@redhat.com>
+---
+ lib/asn1_decoder.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c
+index 2b3f46c049d4..554522934c44 100644
+--- a/lib/asn1_decoder.c
++++ b/lib/asn1_decoder.c
+@@ -74,7 +74,7 @@ next_tag:
+ 
+ 	/* Extract a tag from the data */
+ 	tag = data[dp++];
+-	if (tag == 0) {
++	if (tag == ASN1_EOC) {
+ 		/* It appears to be an EOC. */
+ 		if (data[dp++] != 0)
+ 			goto invalid_eoc;
+@@ -96,10 +96,8 @@ next_tag:
+ 
+ 	/* Extract the length */
+ 	len = data[dp++];
+-	if (len <= 0x7f) {
+-		dp += len;
+-		goto next_tag;
+-	}
++	if (len <= 0x7f)
++		goto check_length;
+ 
+ 	if (unlikely(len == ASN1_INDEFINITE_LENGTH)) {
+ 		/* Indefinite length */
+@@ -110,14 +108,18 @@ next_tag:
+ 	}
+ 
+ 	n = len - 0x80;
+-	if (unlikely(n > sizeof(size_t) - 1))
++	if (unlikely(n > sizeof(len) - 1))
+ 		goto length_too_long;
+ 	if (unlikely(n > datalen - dp))
+ 		goto data_overrun_error;
+-	for (len = 0; n > 0; n--) {
++	len = 0;
++	for (; n > 0; n--) {
+ 		len <<= 8;
+ 		len |= data[dp++];
+ 	}
++check_length:
++	if (len > datalen - dp)
++		goto data_overrun_error;
+ 	dp += len;
+ 	goto next_tag;
+ 
+-- 
+2.5.5
+

MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch

@@ -121,6 +121,8 @@ index e2ec54e2b952..8dab549985d8 100644
  $(obj)/configs.o: $(obj)/config_data.h
  
  # config_data.h contains the same information as ikconfig.h but gzipped.
+ # Info from config_data can be extracted from /proc/config*
+ targets += config_data.gz
 diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c
 new file mode 100644
 index 000000000000..fe4a6f2bf10a

PatchList.txt

@@ -76,3 +76,4 @@ firmware-Drop-WARN-from-usermodehelper_read_trylock-.patch
 
 drm-i915-turn-off-wc-mmaps.patch
 
+i8042-skip-selftest-asus-laptops.patch

RDS-verify-the-underlying-transport-exists-before-cr.patch

@@ -0,0 +1,79 @@
+From 74e98eb085889b0d2d4908f59f6e00026063014f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Tue, 8 Sep 2015 10:53:40 -0400
+Subject: [PATCH] RDS: verify the underlying transport exists before creating a
+ connection
+
+There was no verification that an underlying transport exists when creating
+a connection, this would cause dereferencing a NULL ptr.
+
+It might happen on sockets that weren't properly bound before attempting to
+send a message, which will cause a NULL ptr deref:
+
+[135546.047719] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
+[135546.051270] Modules linked in:
+[135546.051781] CPU: 4 PID: 15650 Comm: trinity-c4 Not tainted 4.2.0-next-20150902-sasha-00041-gbaa1222-dirty #2527
+[135546.053217] task: ffff8800835bc000 ti: ffff8800bc708000 task.ti: ffff8800bc708000
+[135546.054291] RIP: __rds_conn_create (net/rds/connection.c:194)
+[135546.055666] RSP: 0018:ffff8800bc70fab0  EFLAGS: 00010202
+[135546.056457] RAX: dffffc0000000000 RBX: 0000000000000f2c RCX: ffff8800835bc000
+[135546.057494] RDX: 0000000000000007 RSI: ffff8800835bccd8 RDI: 0000000000000038
+[135546.058530] RBP: ffff8800bc70fb18 R08: 0000000000000001 R09: 0000000000000000
+[135546.059556] R10: ffffed014d7a3a23 R11: ffffed014d7a3a21 R12: 0000000000000000
+[135546.060614] R13: 0000000000000001 R14: ffff8801ec3d0000 R15: 0000000000000000
+[135546.061668] FS:  00007faad4ffb700(0000) GS:ffff880252000000(0000) knlGS:0000000000000000
+[135546.062836] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[135546.063682] CR2: 000000000000846a CR3: 000000009d137000 CR4: 00000000000006a0
+[135546.064723] Stack:
+[135546.065048]  ffffffffafe2055c ffffffffafe23fc1 ffffed00493097bf ffff8801ec3d0008
+[135546.066247]  0000000000000000 00000000000000d0 0000000000000000 ac194a24c0586342
+[135546.067438]  1ffff100178e1f78 ffff880320581b00 ffff8800bc70fdd0 ffff880320581b00
+[135546.068629] Call Trace:
+[135546.069028] ? __rds_conn_create (include/linux/rcupdate.h:856 net/rds/connection.c:134)
+[135546.069989] ? rds_message_copy_from_user (net/rds/message.c:298)
+[135546.071021] rds_conn_create_outgoing (net/rds/connection.c:278)
+[135546.071981] rds_sendmsg (net/rds/send.c:1058)
+[135546.072858] ? perf_trace_lock (include/trace/events/lock.h:38)
+[135546.073744] ? lockdep_init (kernel/locking/lockdep.c:3298)
+[135546.074577] ? rds_send_drop_to (net/rds/send.c:976)
+[135546.075508] ? __might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3795)
+[135546.076349] ? __might_fault (mm/memory.c:3795)
+[135546.077179] ? rds_send_drop_to (net/rds/send.c:976)
+[135546.078114] sock_sendmsg (net/socket.c:611 net/socket.c:620)
+[135546.078856] SYSC_sendto (net/socket.c:1657)
+[135546.079596] ? SYSC_connect (net/socket.c:1628)
+[135546.080510] ? trace_dump_stack (kernel/trace/trace.c:1926)
+[135546.081397] ? ring_buffer_unlock_commit (kernel/trace/ring_buffer.c:2479 kernel/trace/ring_buffer.c:2558 kernel/trace/ring_buffer.c:2674)
+[135546.082390] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749)
+[135546.083410] ? trace_event_raw_event_sys_enter (include/trace/events/syscalls.h:16)
+[135546.084481] ? do_audit_syscall_entry (include/trace/events/syscalls.h:16)
+[135546.085438] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749)
+[135546.085515] rds_ib_laddr_check(): addr 36.74.25.172 ret -99 node type -1
+
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/rds/connection.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 9b2de5e67d79..49adeef8090c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -190,6 +190,12 @@ new_conn:
+ 		}
+ 	}
+ 
++	if (trans == NULL) {
++		kmem_cache_free(rds_conn_slab, conn);
++		conn = ERR_PTR(-ENODEV);
++		goto out;
++	}
++
+ 	conn->c_trans = trans;
+ 
+ 	ret = trans->conn_alloc(conn, gfp);
+-- 
+2.4.3
+

USB-usbfs-fix-potential-infoleak-in-devio.patch

@@ -0,0 +1,41 @@
+From 7adc5cbc25dcc47dc3856108d9823d08da75da9d Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kangjielu@gmail.com>
+Date: Tue, 3 May 2016 16:32:16 -0400
+Subject: [PATCH] USB: usbfs: fix potential infoleak in devio
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
+are padding bytes which are not initialized and leaked to userland
+via “copy_to_user”.
+
+Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/devio.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 52c4461dfccd..9b7f1f75e887 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1316,10 +1316,11 @@ static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
+ 
+ static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
+ {
+-	struct usbdevfs_connectinfo ci = {
+-		.devnum = ps->dev->devnum,
+-		.slow = ps->dev->speed == USB_SPEED_LOW
+-	};
++	struct usbdevfs_connectinfo ci;
++
++	memset(&ci, 0, sizeof(ci));
++	ci.devnum = ps->dev->devnum;
++	ci.slow = ps->dev->speed == USB_SPEED_LOW;
+ 
+ 	if (copy_to_user(arg, &ci, sizeof(ci)))
+ 		return -EFAULT;
+-- 
+2.5.5
+

USB-whiteheat-fix-potential-null-deref-at-probe.patch

@@ -0,0 +1,81 @@
+From 10d98bced414c6fc1d09db123e7f762d91b5ebea Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 23 Sep 2015 11:41:42 -0700
+Subject: [PATCH] USB: whiteheat: fix potential null-deref at probe
+
+Fix potential null-pointer dereference at probe by making sure that the
+required endpoints are present.
+
+The whiteheat driver assumes there are at least five pairs of bulk
+endpoints, of which the final pair is used for the "command port". An
+attempt to bind to an interface with fewer bulk endpoints would
+currently lead to an oops.
+
+Fixes CVE-2015-5257.
+
+Reported-by: Moein Ghasemzadeh <moein@istuary.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+---
+ drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index 6c3734d2b45a..d3ea90bef84d 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -80,6 +80,8 @@ static int  whiteheat_firmware_download(struct usb_serial *serial,
+ static int  whiteheat_firmware_attach(struct usb_serial *serial);
+ 
+ /* function prototypes for the Connect Tech WhiteHEAT serial converter */
++static int whiteheat_probe(struct usb_serial *serial,
++				const struct usb_device_id *id);
+ static int  whiteheat_attach(struct usb_serial *serial);
+ static void whiteheat_release(struct usb_serial *serial);
+ static int  whiteheat_port_probe(struct usb_serial_port *port);
+@@ -116,6 +118,7 @@ static struct usb_serial_driver whiteheat_device = {
+ 	.description =		"Connect Tech - WhiteHEAT",
+ 	.id_table =		id_table_std,
+ 	.num_ports =		4,
++	.probe =		whiteheat_probe,
+ 	.attach =		whiteheat_attach,
+ 	.release =		whiteheat_release,
+ 	.port_probe =		whiteheat_port_probe,
+@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial)
+ /*****************************************************************************
+  * Connect Tech's White Heat serial driver functions
+  *****************************************************************************/
++
++static int whiteheat_probe(struct usb_serial *serial,
++				const struct usb_device_id *id)
++{
++	struct usb_host_interface *iface_desc;
++	struct usb_endpoint_descriptor *endpoint;
++	size_t num_bulk_in = 0;
++	size_t num_bulk_out = 0;
++	size_t min_num_bulk;
++	unsigned int i;
++
++	iface_desc = serial->interface->cur_altsetting;
++
++	for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
++		endpoint = &iface_desc->endpoint[i].desc;
++		if (usb_endpoint_is_bulk_in(endpoint))
++			++num_bulk_in;
++		if (usb_endpoint_is_bulk_out(endpoint))
++			++num_bulk_out;
++	}
++
++	min_num_bulk = COMMAND_PORT + 1;
++	if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
++		return -ENODEV;
++
++	return 0;
++}
++
+ static int whiteheat_attach(struct usb_serial *serial)
+ {
+ 	struct usb_serial_port *command_port;
+-- 
+2.4.3
+

acpi-video-Add-force-native-backlight-quirk-for-Leno.patch

@@ -0,0 +1,81 @@
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 3 Mar 2015 08:31:24 +0100
+Subject: [PATCH] acpi: video: Add force native backlight quirk for Lenovo
+ Ideapad Z570
+
+The Lenovo Ideapad Z570 (which is an Acer in disguise like some other Ideapads)
+has a broken acpi_video interface, this was fixed in commmit a11d342fb8
+("ACPI / video: force vendor backlight on Lenovo Ideapad Z570").
+
+Which stops acpi_video from registering a backlight interface, but this is
+only a partial fix, because for people who have the ideapad-laptop module
+installed that module will now register a backlight interface, which also
+does not work, so we need to use the native intel_backlight interface.
+
+The Lenovo Ideapad 570 is a pre-win8 laptop / too old for the acpi-video code
+to automatically prefer the native backlight interface, so add a quirk for it.
+
+This commit also removes the previous incomplete fix.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1187004
+Cc: Stepan Bujnak <stepanbujnak@fastmail.fm>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/acpi/video.c        | 17 +++++++++++++++++
+ drivers/acpi/video_detect.c |  8 --------
+ 2 files changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 70ea37bea84f..d9bf8ba7d848 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -425,6 +425,12 @@ static int __init video_disable_native_backlight(const struct dmi_system_id *d)
+ 	return 0;
+ }
+ 
++static int __init video_enable_native_backlight(const struct dmi_system_id *d)
++{
++	use_native_backlight_dmi = NATIVE_BACKLIGHT_ON;
++	return 0;
++}
++
+ static struct dmi_system_id video_dmi_table[] __initdata = {
+ 	/*
+ 	 * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
+@@ -566,6 +572,17 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "XPS L521X"),
+ 		},
+ 	},
++
++	/* Non win8 machines which need native backlight nevertheless */
++	{
++	 /* https://bugzilla.redhat.com/show_bug.cgi?id=1187004 */
++	 .callback = video_enable_native_backlight,
++	 .ident = "Lenovo Ideapad Z570",
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "102434U"),
++		},
++	},
+ 	{}
+ };
+ 
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 27c43499977a..c42feb2bacd0 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -174,14 +174,6 @@ static struct dmi_system_id video_detect_dmi_table[] = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5737"),
+ 		},
+ 	},
+-	{
+-	.callback = video_detect_force_vendor,
+-	.ident = "Lenovo IdeaPad Z570",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"),
+-		},
+-	},
+ 	{ },
+ };
+ 

acpi-video-Allow-forcing-native-backlight-on-non-win.patch

@@ -0,0 +1,73 @@
+From: Aaron Lu <aaron.lu@intel.com>
+Date: Wed, 11 Mar 2015 14:14:56 +0800
+Subject: [PATCH] acpi: video: Allow forcing native backlight on non win8
+ machines
+
+The native backlight behavior (so not registering both the acpi-video
+and the vendor backlight driver) can be useful on some non win8 machines
+too, so change the behavior of the video.use_native_backlight=1 or 0
+kernel cmdline option to be: if user has set video.use_native_backlight=1
+or 0, use that no matter if it is a win8 system or not. Also, we will
+put some known systems into the DMI table to make them either use native
+backlight interface or not, and the use_native_backlight_dmi is used to
+reflect that.
+
+Original-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/acpi/video.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index db70d550f526..70ea37bea84f 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -82,9 +82,15 @@ module_param(allow_duplicates, bool, 0644);
+  * For Windows 8 systems: used to decide if video module
+  * should skip registering backlight interface of its own.
+  */
+-static int use_native_backlight_param = -1;
++enum {
++	NATIVE_BACKLIGHT_NOT_SET = -1,
++	NATIVE_BACKLIGHT_OFF,
++	NATIVE_BACKLIGHT_ON,
++};
++
++static int use_native_backlight_param = NATIVE_BACKLIGHT_NOT_SET;
+ module_param_named(use_native_backlight, use_native_backlight_param, int, 0444);
+-static bool use_native_backlight_dmi = true;
++static int use_native_backlight_dmi = NATIVE_BACKLIGHT_NOT_SET;
+ 
+ static int register_count;
+ static struct mutex video_list_lock;
+@@ -237,15 +243,16 @@ static void acpi_video_switch_brightness(struct work_struct *work);
+ 
+ static bool acpi_video_use_native_backlight(void)
+ {
+-	if (use_native_backlight_param != -1)
++	if (use_native_backlight_param != NATIVE_BACKLIGHT_NOT_SET)
+ 		return use_native_backlight_param;
+-	else
++	else if (use_native_backlight_dmi != NATIVE_BACKLIGHT_NOT_SET)
+ 		return use_native_backlight_dmi;
++	return acpi_osi_is_win8();
+ }
+ 
+ bool acpi_video_verify_backlight_support(void)
+ {
+-	if (acpi_osi_is_win8() && acpi_video_use_native_backlight() &&
++	if (acpi_video_use_native_backlight() &&
+ 	    backlight_device_registered(BACKLIGHT_RAW))
+ 		return false;
+ 	return acpi_video_backlight_support();
+@@ -414,7 +421,7 @@ static int __init video_set_bqc_offset(const struct dmi_system_id *d)
+ 
+ static int __init video_disable_native_backlight(const struct dmi_system_id *d)
+ {
+-	use_native_backlight_dmi = false;
++	use_native_backlight_dmi = NATIVE_BACKLIGHT_OFF;
+ 	return 0;
+ }
+ 

antenna_select.patch

@@ -0,0 +1,227 @@
+From c18d8f5095715c56bb3cd9cba64242542632054b Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Wed, 16 Mar 2016 13:33:34 -0500
+Subject: rtlwifi: rtl8723be: Add antenna select module parameter
+
+A number of new laptops have been delivered with only a single antenna.
+In principle, this is OK; however, a problem arises when the on-board
+EEPROM is programmed to use the other antenna connection. The option
+of opening the computer and moving the connector is not always possible
+as it will void the warranty in some cases. In addition, this solution
+breaks the Windows driver when the box dual boots Linux and Windows.
+
+A fix involving a new module parameter has been developed.  This commit
+adds the new parameter and implements the changes needed for the driver.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Stable <stable@vger.kernel.org> [V4.0+]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 5 +++++
+ drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c | 3 +++
+ drivers/net/wireless/realtek/rtlwifi/wifi.h         | 3 +++
+ 3 files changed, 11 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+index c983d2f..5a3df91 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+@@ -2684,6 +2684,7 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
+ 					      bool auto_load_fail, u8 *hwinfo)
+ {
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
++	struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;
+ 	u8 value;
+ 	u32 tmpu_32;
+ 
+@@ -2702,6 +2703,10 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
+ 		rtlpriv->btcoexist.btc_info.ant_num = ANT_X2;
+ 	}
+ 
++	/* override ant_num / ant_path */
++	if (mod_params->ant_sel)
++		rtlpriv->btcoexist.btc_info.ant_num =
++			(mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1);
+ }
+ 
+ void rtl8723be_bt_reg_init(struct ieee80211_hw *hw)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
+index a78eaed..2101793 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
+@@ -273,6 +273,7 @@ static struct rtl_mod_params rtl8723be_mod_params = {
+ 	.msi_support = false,
+ 	.disable_watchdog = false,
+ 	.debug = DBG_EMERG,
++	.ant_sel = 0,
+ };
+ 
+ static struct rtl_hal_cfg rtl8723be_hal_cfg = {
+@@ -394,6 +395,7 @@ module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
+ module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444);
+ module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog,
+ 		   bool, 0444);
++module_param_named(ant_sel, rtl8723be_mod_params.ant_sel, int, 0444);
+ MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+ MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+ MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+@@ -402,6 +404,7 @@ MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
+ MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
+ MODULE_PARM_DESC(disable_watchdog,
+ 		 "Set to 1 to disable the watchdog (default 0)\n");
++MODULE_PARM_DESC(ant_sel, "Set to 1 or 2 to force antenna number (default 0)\n");
+ 
+ static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index 554d814..93bd7fc 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -2246,6 +2246,9 @@ struct rtl_mod_params {
+ 
+ 	/* default 0: 1 means do not disable interrupts */
+ 	bool int_clear;
++
++	/* select antenna */
++	int ant_sel;
+ };
+ 
+ struct rtl_hal_usbint_cfg {
+-- 
+cgit v0.12
+
+From baa1702290953295e421f0f433e2b1ff4815827c Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Wed, 16 Mar 2016 13:33:35 -0500
+Subject: rtlwifi: btcoexist: Implement antenna selection
+
+The previous patch added an option to rtl8723be to manually select the
+antenna for those cases when only a single antenna is present, and the
+on-board EEPROM is incorrectly programmed. This patch implements the
+necessary changes in the Bluetooth coexistence driver.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Stable <stable@vger.kernel.org> [V4.0+]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../realtek/rtlwifi/btcoexist/halbtc8723b2ant.c    |  9 ++++++--
+ .../realtek/rtlwifi/btcoexist/halbtcoutsrc.c       | 27 +++++++++++++++++++++-
+ .../realtek/rtlwifi/btcoexist/halbtcoutsrc.h       |  2 +-
+ .../wireless/realtek/rtlwifi/btcoexist/rtl_btc.c   |  5 +++-
+ 4 files changed, 38 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c
+index c43ab59..77cbd10 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c
++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c
+@@ -1203,7 +1203,6 @@ static void btc8723b2ant_set_ant_path(struct btc_coexist *btcoexist,
+ 
+ 		/* Force GNT_BT to low */
+ 		btcoexist->btc_write_1byte_bitmask(btcoexist, 0x765, 0x18, 0x0);
+-		btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0);
+ 
+ 		if (board_info->btdm_ant_pos == BTC_ANTENNA_AT_MAIN_PORT) {
+ 			/* tell firmware "no antenna inverse" */
+@@ -1211,19 +1210,25 @@ static void btc8723b2ant_set_ant_path(struct btc_coexist *btcoexist,
+ 			h2c_parameter[1] = 1;  /* ext switch type */
+ 			btcoexist->btc_fill_h2c(btcoexist, 0x65, 2,
+ 						h2c_parameter);
++			btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0);
+ 		} else {
+ 			/* tell firmware "antenna inverse" */
+ 			h2c_parameter[0] = 1;
+ 			h2c_parameter[1] = 1;  /* ext switch type */
+ 			btcoexist->btc_fill_h2c(btcoexist, 0x65, 2,
+ 						h2c_parameter);
++			btcoexist->btc_write_2byte(btcoexist, 0x948, 0x280);
+ 		}
+ 	}
+ 
+ 	/* ext switch setting */
+ 	if (use_ext_switch) {
+ 		/* fixed internal switch S1->WiFi, S0->BT */
+-		btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0);
++		if (board_info->btdm_ant_pos == BTC_ANTENNA_AT_MAIN_PORT)
++			btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0);
++		else
++			btcoexist->btc_write_2byte(btcoexist, 0x948, 0x280);
++
+ 		switch (antpos_type) {
+ 		case BTC_ANT_WIFI_AT_MAIN:
+ 			/* ext switch main at wifi */
+diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
+index b2791c8..babd149 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
+@@ -965,13 +965,38 @@ void exhalbtc_set_chip_type(u8 chip_type)
+ 	}
+ }
+ 
+-void exhalbtc_set_ant_num(u8 type, u8 ant_num)
++void exhalbtc_set_ant_num(struct rtl_priv *rtlpriv, u8 type, u8 ant_num)
+ {
+ 	if (BT_COEX_ANT_TYPE_PG == type) {
+ 		gl_bt_coexist.board_info.pg_ant_num = ant_num;
+ 		gl_bt_coexist.board_info.btdm_ant_num = ant_num;
++		/* The antenna position:
++		 * Main (default) or Aux for pgAntNum=2 && btdmAntNum =1.
++		 * The antenna position should be determined by
++		 * auto-detect mechanism.
++		 * The following is assumed to main,
++		 * and those must be modified
++		 * if y auto-detect mechanism is ready
++		 */
++		if ((gl_bt_coexist.board_info.pg_ant_num == 2) &&
++		    (gl_bt_coexist.board_info.btdm_ant_num == 1))
++			gl_bt_coexist.board_info.btdm_ant_pos =
++						       BTC_ANTENNA_AT_MAIN_PORT;
++		else
++			gl_bt_coexist.board_info.btdm_ant_pos =
++						       BTC_ANTENNA_AT_MAIN_PORT;
+ 	} else if (BT_COEX_ANT_TYPE_ANTDIV == type) {
+ 		gl_bt_coexist.board_info.btdm_ant_num = ant_num;
++		gl_bt_coexist.board_info.btdm_ant_pos =
++						       BTC_ANTENNA_AT_MAIN_PORT;
++	} else if (type == BT_COEX_ANT_TYPE_DETECTED) {
++		gl_bt_coexist.board_info.btdm_ant_num = ant_num;
++		if (rtlpriv->cfg->mod_params->ant_sel == 1)
++			gl_bt_coexist.board_info.btdm_ant_pos =
++				BTC_ANTENNA_AT_AUX_PORT;
++		else
++			gl_bt_coexist.board_info.btdm_ant_pos =
++				BTC_ANTENNA_AT_MAIN_PORT;
+ 	}
+ }
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h
+index 0a903ea..f41ca57 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h
++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h
+@@ -535,7 +535,7 @@ void exhalbtc_set_bt_patch_version(u16 bt_hci_version, u16 bt_patch_version);
+ void exhalbtc_update_min_bt_rssi(char bt_rssi);
+ void exhalbtc_set_bt_exist(bool bt_exist);
+ void exhalbtc_set_chip_type(u8 chip_type);
+-void exhalbtc_set_ant_num(u8 type, u8 ant_num);
++void exhalbtc_set_ant_num(struct rtl_priv *rtlpriv, u8 type, u8 ant_num);
+ void exhalbtc_display_bt_coex_info(struct btc_coexist *btcoexist);
+ void exhalbtc_signal_compensation(struct btc_coexist *btcoexist,
+ 				  u8 *rssi_wifi, u8 *rssi_bt);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c
+index b9b0cb7..d3fd921 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c
++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c
+@@ -72,7 +72,10 @@ void rtl_btc_init_hal_vars(struct rtl_priv *rtlpriv)
+ 		 __func__, bt_type);
+ 	exhalbtc_set_chip_type(bt_type);
+ 
+-	exhalbtc_set_ant_num(BT_COEX_ANT_TYPE_PG, ant_num);
++	if (rtlpriv->cfg->mod_params->ant_sel == 1)
++		exhalbtc_set_ant_num(rtlpriv, BT_COEX_ANT_TYPE_DETECTED, 1);
++	else
++		exhalbtc_set_ant_num(rtlpriv, BT_COEX_ANT_TYPE_PG, ant_num);
+ }
+ 
+ void rtl_btc_init_hw_config(struct rtl_priv *rtlpriv)
+-- 
+cgit v0.12
+

arcmsr-buffer-overflow-in-archmsr_iop_message_xfer.patch

@@ -1,41 +0,0 @@
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: 2016-09-15 13:44:56
-Subject: [patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer()
-
-We need to put an upper bound on "user_len" so the memcpy() doesn't
-overflow.
-
-Reported-by: Marco Grassi <marco.gra@gmail.com>
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Reviewed-by: Tomas Henzl <thenzl@redhat.com>
-
-diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
-index 7640498..110eca9 100644
---- a/drivers/scsi/arcmsr/arcmsr_hba.c
-+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
-@@ -2388,7 +2388,8 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
- 	}
- 	case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
- 		unsigned char *ver_addr;
--		int32_t user_len, cnt2end;
-+		uint32_t user_len;
-+		int32_t cnt2end;
- 		uint8_t *pQbuffer, *ptmpuserbuffer;
- 		ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC);
- 		if (!ver_addr) {
-@@ -2397,6 +2398,11 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
- 		}
- 		ptmpuserbuffer = ver_addr;
- 		user_len = pcmdmessagefld->cmdmessage.Length;
-+		if (user_len > ARCMSR_API_DATA_BUFLEN) {
-+			retvalue = ARCMSR_MESSAGE_FAIL;
-+			kfree(ver_addr);
-+			goto message_out;
-+		}
- 		memcpy(ptmpuserbuffer,
- 			pcmdmessagefld->messagedatabuffer, user_len);
- 		spin_lock_irqsave(&acb->wqbuffer_lock, flags);
---
-To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html

arm-revert-mmc-omap_hsmmc-Use-dma_request_chan-for-reque.patch

@@ -0,0 +1,100 @@
+From bb3e08008c0e48fd4f51a0f0957eecae61a24d69 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Tue, 1 Nov 2016 09:35:30 +0000
+Subject: [PATCH] Revert "mmc: omap_hsmmc: Use dma_request_chan() for
+ requesting DMA channel"
+
+This reverts commit 81eef6ca92014845d40e3f1310e42b7010303acc.
+---
+ drivers/mmc/host/omap_hsmmc.c | 50 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 24ebc9a..3563321 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -32,6 +32,7 @@
+ #include <linux/of_irq.h>
+ #include <linux/of_gpio.h>
+ #include <linux/of_device.h>
++#include <linux/omap-dmaengine.h>
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/core.h>
+ #include <linux/mmc/mmc.h>
+@@ -1992,6 +1993,8 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 	struct resource *res;
+ 	int ret, irq;
+ 	const struct of_device_id *match;
++	dma_cap_mask_t mask;
++	unsigned tx_req, rx_req;
+ 	const struct omap_mmc_of_data *data;
+ 	void __iomem *base;
+ 
+@@ -2121,17 +2124,44 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 
+ 	omap_hsmmc_conf_bus_power(host);
+ 
+-	host->rx_chan = dma_request_chan(&pdev->dev, "rx");
+-	if (IS_ERR(host->rx_chan)) {
+-		dev_err(mmc_dev(host->mmc), "RX DMA channel request failed\n");
+-		ret = PTR_ERR(host->rx_chan);
++	if (!pdev->dev.of_node) {
++		res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "tx");
++		if (!res) {
++			dev_err(mmc_dev(host->mmc), "cannot get DMA TX channel\n");
++			ret = -ENXIO;
++			goto err_irq;
++		}
++		tx_req = res->start;
++
++		res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "rx");
++		if (!res) {
++			dev_err(mmc_dev(host->mmc), "cannot get DMA RX channel\n");
++			ret = -ENXIO;
++			goto err_irq;
++		}
++		rx_req = res->start;
++	}
++
++	dma_cap_zero(mask);
++	dma_cap_set(DMA_SLAVE, mask);
++
++	host->rx_chan =
++		dma_request_slave_channel_compat(mask, omap_dma_filter_fn,
++						 &rx_req, &pdev->dev, "rx");
++
++	if (!host->rx_chan) {
++		dev_err(mmc_dev(host->mmc), "unable to obtain RX DMA engine channel\n");
++		ret = -ENXIO;
+ 		goto err_irq;
+ 	}
+ 
+-	host->tx_chan = dma_request_chan(&pdev->dev, "tx");
+-	if (IS_ERR(host->tx_chan)) {
+-		dev_err(mmc_dev(host->mmc), "TX DMA channel request failed\n");
+-		ret = PTR_ERR(host->tx_chan);
++	host->tx_chan =
++		dma_request_slave_channel_compat(mask, omap_dma_filter_fn,
++						 &tx_req, &pdev->dev, "tx");
++
++	if (!host->tx_chan) {
++		dev_err(mmc_dev(host->mmc), "unable to obtain TX DMA engine channel\n");
++		ret = -ENXIO;
+ 		goto err_irq;
+ 	}
+ 
+@@ -2189,9 +2219,9 @@ err_slot_name:
+ 	mmc_remove_host(mmc);
+ err_irq:
+ 	device_init_wakeup(&pdev->dev, false);
+-	if (!IS_ERR_OR_NULL(host->tx_chan))
++	if (host->tx_chan)
+ 		dma_release_channel(host->tx_chan);
+-	if (!IS_ERR_OR_NULL(host->rx_chan))
++	if (host->rx_chan)
+ 		dma_release_channel(host->rx_chan);
+ 	pm_runtime_dont_use_autosuspend(host->dev);
+ 	pm_runtime_put_sync(host->dev);
+-- 
+2.9.3
+

arm64-mm-Fix-memmap-to-be-initialized-for-the-entire-section.patch

@@ -0,0 +1,93 @@
+From patchwork Thu Oct  6 09:52:07 2016
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: arm64: mm: Fix memmap to be initialized for the entire section
+From: Robert Richter <rrichter@cavium.com>
+X-Patchwork-Id: 9364537
+Message-Id: <1475747527-32387-1-git-send-email-rrichter@cavium.com>
+To: Catalin Marinas <catalin.marinas@arm.com>, Will Deacon
+ <will.deacon@arm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>, linux-efi@vger.kernel.org,
+ David Daney <david.daney@cavium.com>,
+ Ard Biesheuvel <ard.biesheuvel@linaro.org>,
+ linux-kernel@vger.kernel.org, Robert Richter <rrichter@cavium.com>,
+ Hanjun Guo <hanjun.guo@linaro.org>, linux-arm-kernel@lists.infradead.org
+Date: Thu, 6 Oct 2016 11:52:07 +0200
+
+There is a memory setup problem on ThunderX systems with certain
+memory configurations. The symptom is
+
+ kernel BUG at mm/page_alloc.c:1848!
+
+This happens for some configs with 64k page size enabled. The bug
+triggers for page zones with some pages in the zone not assigned to
+this particular zone. In my case some pages that are marked as nomap
+were not reassigned to the new zone of node 1, so those are still
+assigned to node 0.
+
+The reason for the mis-configuration is a change in pfn_valid() which
+reports pages marked nomap as invalid:
+
+ 68709f45385a arm64: only consider memblocks with NOMAP cleared for linear mapping
+
+This causes pages marked as nomap being no long reassigned to the new
+zone in memmap_init_zone() by calling __init_single_pfn().
+
+Fixing this by restoring the old behavior of pfn_valid() to use
+memblock_is_memory(). Also changing users of pfn_valid() in arm64 code
+to use memblock_is_map_memory() where necessary. This only affects
+code in ioremap.c. The code in mmu.c still can use the new version of
+pfn_valid().
+
+Should be marked stable v4.5..
+
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ arch/arm64/mm/init.c    | 2 +-
+ arch/arm64/mm/ioremap.c | 5 +++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index bbb7ee76e319..25b8659c2a9f 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -147,7 +147,7 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max)
+ #ifdef CONFIG_HAVE_ARCH_PFN_VALID
+ int pfn_valid(unsigned long pfn)
+ {
+-	return memblock_is_map_memory(pfn << PAGE_SHIFT);
++	return memblock_is_memory(pfn << PAGE_SHIFT);
+ }
+ EXPORT_SYMBOL(pfn_valid);
+ #endif
+diff --git a/arch/arm64/mm/ioremap.c b/arch/arm64/mm/ioremap.c
+index 01e88c8bcab0..c17c220b0c48 100644
+--- a/arch/arm64/mm/ioremap.c
++++ b/arch/arm64/mm/ioremap.c
+@@ -21,6 +21,7 @@
+  */
+ 
+ #include <linux/export.h>
++#include <linux/memblock.h>
+ #include <linux/mm.h>
+ #include <linux/vmalloc.h>
+ #include <linux/io.h>
+@@ -55,7 +56,7 @@ static void __iomem *__ioremap_caller(phys_addr_t phys_addr, size_t size,
+ 	/*
+ 	 * Don't allow RAM to be mapped.
+ 	 */
+-	if (WARN_ON(pfn_valid(__phys_to_pfn(phys_addr))))
++	if (WARN_ON(memblock_is_map_memory(phys_addr)))
+ 		return NULL;
+ 
+ 	area = get_vm_area_caller(size, VM_IOREMAP, caller);
+@@ -96,7 +97,7 @@ EXPORT_SYMBOL(__iounmap);
+ void __iomem *ioremap_cache(phys_addr_t phys_addr, size_t size)
+ {
+ 	/* For normal memory we already have a cacheable mapping. */
+-	if (pfn_valid(__phys_to_pfn(phys_addr)))
++	if (memblock_is_map_memory(phys_addr))
+ 		return (void __iomem *)__phys_to_virt(phys_addr);
+ 
+ 	return __ioremap_caller(phys_addr, size, __pgprot(PROT_NORMAL),

arm64-pcie-quirks-xgene.patch

@@ -0,0 +1,508 @@
+From 767b70aa55d013f0c7589955f410d488fed5776a Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Tue, 5 Jul 2016 23:49:39 +0100
+Subject: [PATCH 1/4] Some platforms may not be fully compliant with generic
+ set of PCI config accessors. For these cases we implement the way to
+ overwrite accessors set. Algorithm traverses available quirk list, matches
+ against <oem_id, oem_table_id, domain, bus number> tuple and returns
+ corresponding PCI config ops. oem_id and oem_table_id come from MCFG table
+ standard header. All quirks can be defined using DECLARE_ACPI_MCFG_FIXUP()
+ macro and kept self contained. Example:
+
+/* Custom PCI config ops */
+static struct pci_generic_ecam_ops foo_pci_ops = {
+        .bus_shift      = 24,
+        .pci_ops = {
+                .map_bus = pci_ecam_map_bus,
+                .read = foo_ecam_config_read,
+                .write = foo_ecam_config_write,
+        }
+};
+
+DECLARE_ACPI_MCFG_FIXUP(&foo_pci_ops, <oem_id_str>, <oem_table_id>, <domain_nr>, <bus_nr>);
+
+Signed-off-by: Tomasz Nowicki <tn@semihalf.com>
+Signed-off-by: Dongdong Liu <liudongdong3@huawei.com>
+---
+ drivers/acpi/pci_mcfg.c           | 41 ++++++++++++++++++++++++++++++++++++---
+ include/asm-generic/vmlinux.lds.h |  7 +++++++
+ include/linux/pci-acpi.h          | 20 +++++++++++++++++++
+ 3 files changed, 65 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c
+index d3c3e85..deb0077 100644
+--- a/drivers/acpi/pci_mcfg.c
++++ b/drivers/acpi/pci_mcfg.c
+@@ -22,6 +22,10 @@
+ #include <linux/kernel.h>
+ #include <linux/pci.h>
+ #include <linux/pci-acpi.h>
++#include <linux/pci-ecam.h>
++
++/* Root pointer to the mapped MCFG table */
++static struct acpi_table_mcfg *mcfg_table;
+ 
+ /* Structure to hold entries from the MCFG table */
+ struct mcfg_entry {
+@@ -35,6 +39,38 @@ struct mcfg_entry {
+ /* List to save mcfg entries */
+ static LIST_HEAD(pci_mcfg_list);
+ 
++extern struct pci_cfg_fixup __start_acpi_mcfg_fixups[];
++extern struct pci_cfg_fixup __end_acpi_mcfg_fixups[];
++
++struct pci_ecam_ops *pci_mcfg_get_ops(struct acpi_pci_root *root)
++{
++       int bus_num = root->secondary.start;
++       int domain = root->segment;
++       struct pci_cfg_fixup *f;
++
++       if (!mcfg_table)
++               return &pci_generic_ecam_ops;
++
++       /*
++        * Match against platform specific quirks and return corresponding
++        * CAM ops.
++        *
++        * First match against PCI topology <domain:bus> then use OEM ID and
++        * OEM revision from MCFG table standard header.
++        */
++       for (f = __start_acpi_mcfg_fixups; f < __end_acpi_mcfg_fixups; f++) {
++               if ((f->domain == domain || f->domain == PCI_MCFG_DOMAIN_ANY) &&
++                   (f->bus_num == bus_num || f->bus_num == PCI_MCFG_BUS_ANY) &&
++                   (!strncmp(f->oem_id, mcfg_table->header.oem_id,
++                             ACPI_OEM_ID_SIZE)) &&
++                   (!strncmp(f->oem_table_id, mcfg_table->header.oem_table_id,
++                             ACPI_OEM_TABLE_ID_SIZE)))
++                       return f->ops;
++       }
++       /* No quirks, use ECAM */
++       return &pci_generic_ecam_ops;
++}
++
+ phys_addr_t pci_mcfg_lookup(u16 seg, struct resource *bus_res)
+ {
+ 	struct mcfg_entry *e;
+@@ -54,7 +90,6 @@ phys_addr_t pci_mcfg_lookup(u16 seg, struct resource *bus_res)
+ 
+ static __init int pci_mcfg_parse(struct acpi_table_header *header)
+ {
+-	struct acpi_table_mcfg *mcfg;
+ 	struct acpi_mcfg_allocation *mptr;
+ 	struct mcfg_entry *e, *arr;
+ 	int i, n;
+@@ -64,8 +99,8 @@ static __init int pci_mcfg_parse(struct acpi_table_header *header)
+ 
+ 	n = (header->length - sizeof(struct acpi_table_mcfg)) /
+ 					sizeof(struct acpi_mcfg_allocation);
+-	mcfg = (struct acpi_table_mcfg *)header;
+-	mptr = (struct acpi_mcfg_allocation *) &mcfg[1];
++	mcfg_table = (struct acpi_table_mcfg *)header;
++	mptr = (struct acpi_mcfg_allocation *) &mcfg_table[1];
+ 
+ 	arr = kcalloc(n, sizeof(*arr), GFP_KERNEL);
+ 	if (!arr)
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 6a67ab9..43604fc 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -300,6 +300,13 @@
+ 		VMLINUX_SYMBOL(__end_pci_fixups_suspend_late) = .;	\
+ 	}								\
+ 									\
++	/* ACPI MCFG quirks */						\
++	.acpi_fixup        : AT(ADDR(.acpi_fixup) - LOAD_OFFSET) {	\
++		VMLINUX_SYMBOL(__start_acpi_mcfg_fixups) = .;		\
++		*(.acpi_fixup_mcfg)					\
++		VMLINUX_SYMBOL(__end_acpi_mcfg_fixups) = .;		\
++	}								\
++									\
+ 	/* Built-in firmware blobs */					\
+ 	.builtin_fw        : AT(ADDR(.builtin_fw) - LOAD_OFFSET) {	\
+ 		VMLINUX_SYMBOL(__start_builtin_fw) = .;			\
+diff --git a/include/linux/pci-acpi.h b/include/linux/pci-acpi.h
+index 7d63a66..c8a6559 100644
+--- a/include/linux/pci-acpi.h
++++ b/include/linux/pci-acpi.h
+@@ -25,6 +25,7 @@ static inline acpi_status pci_acpi_remove_pm_notifier(struct acpi_device *dev)
+ extern phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle);
+ 
+ extern phys_addr_t pci_mcfg_lookup(u16 domain, struct resource *bus_res);
++extern struct pci_ecam_ops *pci_mcfg_get_ops(struct acpi_pci_root *root);
+ 
+ static inline acpi_handle acpi_find_root_bridge_handle(struct pci_dev *pdev)
+ {
+@@ -72,6 +73,25 @@ struct acpi_pci_root_ops {
+ 	int (*prepare_resources)(struct acpi_pci_root_info *info);
+ };
+ 
++struct pci_cfg_fixup {
++       struct pci_ecam_ops *ops;
++       char *oem_id;
++       char *oem_table_id;
++       int domain;
++       int bus_num;
++};
++
++#define PCI_MCFG_DOMAIN_ANY    -1
++#define PCI_MCFG_BUS_ANY       -1
++
++/* Designate a routine to fix up buggy MCFG */
++#define DECLARE_ACPI_MCFG_FIXUP(ops, oem_id, oem_table_id, dom, bus)   \
++       static const struct pci_cfg_fixup                               \
++       __mcfg_fixup_##oem_id##oem_table_id##dom##bus                   \
++       __used  __attribute__((__section__(".acpi_fixup_mcfg"),         \
++                               aligned((sizeof(void *))))) =           \
++       { ops, oem_id, oem_table_id, dom, bus };
++
+ extern int acpi_pci_probe_root_resources(struct acpi_pci_root_info *info);
+ extern struct pci_bus *acpi_pci_root_create(struct acpi_pci_root *root,
+ 					    struct acpi_pci_root_ops *ops,
+-- 
+2.7.4
+
+From 4f86a9b006b25dd7336043dab26058ed6fb2802d Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Tue, 5 Jul 2016 23:52:46 +0100
+Subject: [PATCH 2/4] pci_generic_ecam_ops is used by default. Since there are
+ platforms which have non-compliant ECAM space we need to overwrite these
+ accessors prior to PCI buses enumeration. In order to do that we call
+ pci_mcfg_get_ops to retrieve pci_ecam_ops structure so that we can use proper
+ PCI config space accessors and bus_shift.
+
+pci_generic_ecam_ops is still used for platforms free from quirks.
+
+Signed-off-by: Tomasz Nowicki <tn@semihalf.com>
+---
+ arch/arm64/kernel/pci.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/kernel/pci.c b/arch/arm64/kernel/pci.c
+index 94cd43c..a891bda 100644
+--- a/arch/arm64/kernel/pci.c
++++ b/arch/arm64/kernel/pci.c
+@@ -139,6 +139,7 @@ pci_acpi_setup_ecam_mapping(struct acpi_pci_root *root)
+ 	struct pci_config_window *cfg;
+ 	struct resource cfgres;
+ 	unsigned int bsz;
++	struct pci_ecam_ops *ops;
+ 
+ 	/* Use address from _CBA if present, otherwise lookup MCFG */
+ 	if (!root->mcfg_addr)
+@@ -150,12 +151,12 @@ pci_acpi_setup_ecam_mapping(struct acpi_pci_root *root)
+ 		return NULL;
+ 	}
+ 
+-	bsz = 1 << pci_generic_ecam_ops.bus_shift;
++	ops = pci_mcfg_get_ops(root);
++	bsz = 1 << ops->bus_shift;
+ 	cfgres.start = root->mcfg_addr + bus_res->start * bsz;
+ 	cfgres.end = cfgres.start + resource_size(bus_res) * bsz - 1;
+ 	cfgres.flags = IORESOURCE_MEM;
+-	cfg = pci_ecam_create(&root->device->dev, &cfgres, bus_res,
+-			      &pci_generic_ecam_ops);
++	cfg = pci_ecam_create(&root->device->dev, &cfgres, bus_res, ops);
+ 	if (IS_ERR(cfg)) {
+ 		dev_err(&root->device->dev, "%04x:%pR error %ld mapping ECAM\n",
+ 			seg, bus_res, PTR_ERR(cfg));
+-- 
+2.7.4
+
+From cbdbd697bd6d716eb9d1705ee55445432e73eabb Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Tue, 5 Jul 2016 23:53:59 +0100
+Subject: [PATCH 3/4] The ECAM quirk matching criteria per the discussion on
+ https://lkml.org/lkml/2016/6/13/944 includes: OEM ID, OEM Table ID and OEM
+ Revision. So this patch adds OEM Table ID into the check to match platform
+ specific ECAM quirks as well.
+
+This patch also improve strncmp check using strlen and
+min_t to ignore the padding spaces in OEM ID and OEM
+Table ID.
+
+Signed-off-by: Duc Dang <dhdang@apm.com>
+---
+ drivers/acpi/pci_mcfg.c  | 7 +++++--
+ include/linux/pci-acpi.h | 7 ++++---
+ 2 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c
+index deb0077..307ca9a 100644
+--- a/drivers/acpi/pci_mcfg.c
++++ b/drivers/acpi/pci_mcfg.c
+@@ -62,9 +62,12 @@ struct pci_ecam_ops *pci_mcfg_get_ops(struct acpi_pci_root *root)
+                if ((f->domain == domain || f->domain == PCI_MCFG_DOMAIN_ANY) &&
+                    (f->bus_num == bus_num || f->bus_num == PCI_MCFG_BUS_ANY) &&
+                    (!strncmp(f->oem_id, mcfg_table->header.oem_id,
+-                             ACPI_OEM_ID_SIZE)) &&
++                             min_t(size_t, strlen(f->oem_id),
++                                   ACPI_OEM_ID_SIZE))) &&
+                    (!strncmp(f->oem_table_id, mcfg_table->header.oem_table_id,
+-                             ACPI_OEM_TABLE_ID_SIZE)))
++                             min_t(size_t, strlen(f->oem_table_id),
++                                   ACPI_OEM_TABLE_ID_SIZE))) &&
++                   (f->oem_revision == mcfg_table->header.oem_revision))
+                        return f->ops;
+        }
+        /* No quirks, use ECAM */
+diff --git a/include/linux/pci-acpi.h b/include/linux/pci-acpi.h
+index c8a6559..5148c8d 100644
+--- a/include/linux/pci-acpi.h
++++ b/include/linux/pci-acpi.h
+@@ -77,6 +77,7 @@ struct pci_cfg_fixup {
+        struct pci_ecam_ops *ops;
+        char *oem_id;
+        char *oem_table_id;
++       u32 oem_revision;
+        int domain;
+        int bus_num;
+ };
+@@ -85,12 +86,12 @@ struct pci_cfg_fixup {
+ #define PCI_MCFG_BUS_ANY       -1
+ 
+ /* Designate a routine to fix up buggy MCFG */
+-#define DECLARE_ACPI_MCFG_FIXUP(ops, oem_id, oem_table_id, dom, bus)   \
++#define DECLARE_ACPI_MCFG_FIXUP(ops, oem_id, oem_table_id, rev, dom, bus) \
+        static const struct pci_cfg_fixup                               \
+-       __mcfg_fixup_##oem_id##oem_table_id##dom##bus                   \
++       __mcfg_fixup_##oem_id##oem_table_id##rev##dom##bus              \
+        __used  __attribute__((__section__(".acpi_fixup_mcfg"),         \
+                                aligned((sizeof(void *))))) =           \
+-       { ops, oem_id, oem_table_id, dom, bus };
++       { ops, oem_id, oem_table_id, rev, dom, bus };
+ 
+ extern int acpi_pci_probe_root_resources(struct acpi_pci_root_info *info);
+ extern struct pci_bus *acpi_pci_root_create(struct acpi_pci_root *root,
+-- 
+2.7.4
+
+From 78766cf255bc6aafac2f57372a0446f78322da19 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Tue, 5 Jul 2016 23:55:11 +0100
+Subject: [PATCH 4/4] X-Gene PCIe controller does not fully support ECAM. This
+ patch adds required ECAM fixup to allow X-Gene PCIe controller to be
+ functional in ACPI boot mode.
+
+Signed-off-by: Duc Dang <dhdang@apm.com>
+---
+ drivers/pci/host/Makefile         |   2 +-
+ drivers/pci/host/pci-xgene-ecam.c | 194 ++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 195 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/pci/host/pci-xgene-ecam.c
+
+diff --git a/drivers/pci/host/Makefile b/drivers/pci/host/Makefile
+index 9c8698e..3480696 100644
+--- a/drivers/pci/host/Makefile
++++ b/drivers/pci/host/Makefile
+@@ -14,7 +14,7 @@ obj-$(CONFIG_PCIE_SPEAR13XX) += pcie-spear13xx.o
+ obj-$(CONFIG_PCI_KEYSTONE) += pci-keystone-dw.o pci-keystone.o
+ obj-$(CONFIG_PCIE_XILINX) += pcie-xilinx.o
+ obj-$(CONFIG_PCIE_XILINX_NWL) += pcie-xilinx-nwl.o
+-obj-$(CONFIG_PCI_XGENE) += pci-xgene.o
++obj-$(CONFIG_PCI_XGENE) += pci-xgene.o pci-xgene-ecam.o
+ obj-$(CONFIG_PCI_XGENE_MSI) += pci-xgene-msi.o
+ obj-$(CONFIG_PCI_LAYERSCAPE) += pci-layerscape.o
+ obj-$(CONFIG_PCI_VERSATILE) += pci-versatile.o
+diff --git a/drivers/pci/host/pci-xgene-ecam.c b/drivers/pci/host/pci-xgene-ecam.c
+new file mode 100644
+index 0000000..1bea63f
+--- /dev/null
++++ b/drivers/pci/host/pci-xgene-ecam.c
+@@ -0,0 +1,194 @@
++/*
++ * APM X-Gene PCIe ECAM fixup driver
++ *
++ * Copyright (c) 2016, Applied Micro Circuits Corporation
++ * Author:
++ *     Duc Dang <dhdang@apm.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of_address.h>
++#include <linux/of_pci.h>
++#include <linux/pci-acpi.h>
++#include <linux/platform_device.h>
++#include <linux/pci-ecam.h>
++
++#ifdef CONFIG_ACPI
++#define RTDID                  0x160
++#define ROOT_CAP_AND_CTRL      0x5C
++
++/* PCIe IP version */
++#define XGENE_PCIE_IP_VER_UNKN 0
++#define XGENE_PCIE_IP_VER_1    1
++
++#define APM_OEM_ID             "APM"
++#define APM_XGENE_OEM_TABLE_ID "XGENE"
++#define APM_XGENE_OEM_REV      0x00000002
++
++struct xgene_pcie_acpi_root {
++       void __iomem *csr_base;
++       u32 version;
++};
++
++static acpi_status xgene_pcie_find_csr_base(struct acpi_resource *acpi_res,
++                                           void *data)
++{
++       struct xgene_pcie_acpi_root *root = data;
++       struct acpi_resource_fixed_memory32 *fixed32;
++
++       if (acpi_res->type == ACPI_RESOURCE_TYPE_FIXED_MEMORY32) {
++               fixed32 = &acpi_res->data.fixed_memory32;
++               root->csr_base = ioremap(fixed32->address,
++                                        fixed32->address_length);
++               return AE_CTRL_TERMINATE;
++       }
++
++       return AE_OK;
++}
++
++static int xgene_pcie_ecam_init(struct pci_config_window *cfg)
++{
++       struct xgene_pcie_acpi_root *xgene_root;
++       struct device *dev = cfg->parent;
++       struct acpi_device *adev = to_acpi_device(dev);
++       acpi_handle handle = acpi_device_handle(adev);
++
++       xgene_root = devm_kzalloc(dev, sizeof(*xgene_root), GFP_KERNEL);
++       if (!xgene_root)
++               return -ENOMEM;
++
++       acpi_walk_resources(handle, METHOD_NAME__CRS,
++                           xgene_pcie_find_csr_base, xgene_root);
++
++       if (!xgene_root->csr_base) {
++               kfree(xgene_root);
++               return -ENODEV;
++       }
++
++       xgene_root->version = XGENE_PCIE_IP_VER_1;
++
++       cfg->priv = xgene_root;
++
++       return 0;
++}
++
++/*
++ * For Configuration request, RTDID register is used as Bus Number,
++ * Device Number and Function number of the header fields.
++ */
++static void xgene_pcie_set_rtdid_reg(struct pci_bus *bus, uint devfn)
++{
++       struct pci_config_window *cfg = bus->sysdata;
++       struct xgene_pcie_acpi_root *port = cfg->priv;
++       unsigned int b, d, f;
++       u32 rtdid_val = 0;
++
++       b = bus->number;
++       d = PCI_SLOT(devfn);
++       f = PCI_FUNC(devfn);
++
++       if (!pci_is_root_bus(bus))
++               rtdid_val = (b << 8) | (d << 3) | f;
++
++       writel(rtdid_val, port->csr_base + RTDID);
++       /* read the register back to ensure flush */
++       readl(port->csr_base + RTDID);
++}
++
++/*
++ * X-Gene PCIe port uses BAR0-BAR1 of RC's configuration space as
++ * the translation from PCI bus to native BUS.  Entire DDR region
++ * is mapped into PCIe space using these registers, so it can be
++ * reached by DMA from EP devices.  The BAR0/1 of bridge should be
++ * hidden during enumeration to avoid the sizing and resource allocation
++ * by PCIe core.
++ */
++static bool xgene_pcie_hide_rc_bars(struct pci_bus *bus, int offset)
++{
++       if (pci_is_root_bus(bus) && ((offset == PCI_BASE_ADDRESS_0) ||
++                                    (offset == PCI_BASE_ADDRESS_1)))
++               return true;
++
++       return false;
++}
++
++void __iomem *xgene_pcie_ecam_map_bus(struct pci_bus *bus,
++                                     unsigned int devfn, int where)
++{
++       struct pci_config_window *cfg = bus->sysdata;
++       unsigned int busn = bus->number;
++       void __iomem *base;
++
++       if (busn < cfg->busr.start || busn > cfg->busr.end)
++               return NULL;
++
++       if ((pci_is_root_bus(bus) && devfn != 0) ||
++           xgene_pcie_hide_rc_bars(bus, where))
++               return NULL;
++
++       xgene_pcie_set_rtdid_reg(bus, devfn);
++
++       if (busn > cfg->busr.start)
++               base = cfg->win + (1 << cfg->ops->bus_shift);
++       else
++               base = cfg->win;
++
++       return base + where;
++}
++
++static int xgene_pcie_config_read32(struct pci_bus *bus, unsigned int devfn,
++                                   int where, int size, u32 *val)
++{
++       struct pci_config_window *cfg = bus->sysdata;
++       struct xgene_pcie_acpi_root *port = cfg->priv;
++
++       if (pci_generic_config_read32(bus, devfn, where & ~0x3, 4, val) !=
++           PCIBIOS_SUCCESSFUL)
++               return PCIBIOS_DEVICE_NOT_FOUND;
++
++       /*
++       * The v1 controller has a bug in its Configuration Request
++       * Retry Status (CRS) logic: when CRS is enabled and we read the
++       * Vendor and Device ID of a non-existent device, the controller
++       * fabricates return data of 0xFFFF0001 ("device exists but is not
++       * ready") instead of 0xFFFFFFFF ("device does not exist").  This
++       * causes the PCI core to retry the read until it times out.
++       * Avoid this by not claiming to support CRS.
++       */
++       if (pci_is_root_bus(bus) && (port->version == XGENE_PCIE_IP_VER_1) &&
++           ((where & ~0x3) == ROOT_CAP_AND_CTRL))
++               *val &= ~(PCI_EXP_RTCAP_CRSVIS << 16);
++
++       if (size <= 2)
++               *val = (*val >> (8 * (where & 3))) & ((1 << (size * 8)) - 1);
++
++       return PCIBIOS_SUCCESSFUL;
++}
++
++static struct pci_ecam_ops xgene_pcie_ecam_ops = {
++       .bus_shift      = 16,
++       .init           = xgene_pcie_ecam_init,
++       .pci_ops        = {
++               .map_bus        = xgene_pcie_ecam_map_bus,
++               .read           = xgene_pcie_config_read32,
++               .write          = pci_generic_config_write,
++       }
++};
++
++DECLARE_ACPI_MCFG_FIXUP(&xgene_pcie_ecam_ops, APM_OEM_ID,
++                       APM_XGENE_OEM_TABLE_ID, APM_XGENE_OEM_REV,
++                       PCI_MCFG_DOMAIN_ANY, PCI_MCFG_BUS_ANY);
++#endif
+-- 
+2.7.4
+

bcm283x-vc4-fixes.patch

@@ -133,237 +133,6 @@ index 160942a..9ecd6ff 100644
 -- 
 2.9.3
 
-From 107d3188b3723840deddaa5efeffcaf167e462f2 Mon Sep 17 00:00:00 2001
-From: Eric Anholt <eric@anholt.net>
-Date: Wed, 28 Sep 2016 08:42:42 -0700
-Subject: [PATCH 3/4] drm/vc4: Fix races when the CS reads from render targets.
-
-With the introduction of bin/render pipelining, the previous job may
-not be completed when we start binning the next one.  If the previous
-job wrote our VBO, IB, or CS textures, then the binning stage might
-get stale or uninitialized results.
-
-Fixes the major rendering failure in glmark2 -b terrain.
-
-Signed-off-by: Eric Anholt <eric@anholt.net>
-Fixes: ca26d28bbaa3 ("drm/vc4: improve throughput by pipelining binning and rendering jobs")
-Cc: stable@vger.kernel.org
----
- drivers/gpu/drm/vc4/vc4_drv.h       | 19 ++++++++++++++++++-
- drivers/gpu/drm/vc4/vc4_gem.c       | 13 +++++++++++++
- drivers/gpu/drm/vc4/vc4_render_cl.c | 21 +++++++++++++++++----
- drivers/gpu/drm/vc4/vc4_validate.c  | 17 ++++++++++++++---
- 4 files changed, 62 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
-index 428e249..f696b75 100644
---- a/drivers/gpu/drm/vc4/vc4_drv.h
-+++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -122,9 +122,16 @@ to_vc4_dev(struct drm_device *dev)
- struct vc4_bo {
- 	struct drm_gem_cma_object base;
- 
--	/* seqno of the last job to render to this BO. */
-+	/* seqno of the last job to render using this BO. */
- 	uint64_t seqno;
- 
-+	/* seqno of the last job to use the RCL to write to this BO.
-+	 *
-+	 * Note that this doesn't include binner overflow memory
-+	 * writes.
-+	 */
-+	uint64_t write_seqno;
-+
- 	/* List entry for the BO's position in either
- 	 * vc4_exec_info->unref_list or vc4_dev->bo_cache.time_list
- 	 */
-@@ -216,6 +223,9 @@ struct vc4_exec_info {
- 	/* Sequence number for this bin/render job. */
- 	uint64_t seqno;
- 
-+	/* Latest write_seqno of any BO that binning depends on. */
-+	uint64_t bin_dep_seqno;
-+
- 	/* Last current addresses the hardware was processing when the
- 	 * hangcheck timer checked on us.
- 	 */
-@@ -230,6 +240,13 @@ struct vc4_exec_info {
- 	struct drm_gem_cma_object **bo;
- 	uint32_t bo_count;
- 
-+	/* List of BOs that are being written by the RCL.  Other than
-+	 * the binner temporary storage, this is all the BOs written
-+	 * by the job.
-+	 */
-+	struct drm_gem_cma_object *rcl_write_bo[4];
-+	uint32_t rcl_write_bo_count;
-+
- 	/* Pointers for our position in vc4->job_list */
- 	struct list_head head;
- 
-diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
-index b262c5c..ae1609e 100644
---- a/drivers/gpu/drm/vc4/vc4_gem.c
-+++ b/drivers/gpu/drm/vc4/vc4_gem.c
-@@ -471,6 +471,11 @@ vc4_update_bo_seqnos(struct vc4_exec_info *exec, uint64_t seqno)
- 	list_for_each_entry(bo, &exec->unref_list, unref_head) {
- 		bo->seqno = seqno;
- 	}
-+
-+	for (i = 0; i < exec->rcl_write_bo_count; i++) {
-+		bo = to_vc4_bo(&exec->rcl_write_bo[i]->base);
-+		bo->write_seqno = seqno;
-+	}
- }
- 
- /* Queues a struct vc4_exec_info for execution.  If no job is
-@@ -673,6 +678,14 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
- 		goto fail;
- 
- 	ret = vc4_validate_shader_recs(dev, exec);
-+	if (ret)
-+		goto fail;
-+
-+	/* Block waiting on any previous rendering into the CS's VBO,
-+	 * IB, or textures, so that pixels are actually written by the
-+	 * time we try to read them.
-+	 */
-+	ret = vc4_wait_for_seqno(dev, exec->bin_dep_seqno, ~0ull, true);
- 
- fail:
- 	drm_free_large(temp);
-diff --git a/drivers/gpu/drm/vc4/vc4_render_cl.c b/drivers/gpu/drm/vc4/vc4_render_cl.c
-index 0f12418..08886a3 100644
---- a/drivers/gpu/drm/vc4/vc4_render_cl.c
-+++ b/drivers/gpu/drm/vc4/vc4_render_cl.c
-@@ -45,6 +45,8 @@ struct vc4_rcl_setup {
- 
- 	struct drm_gem_cma_object *rcl;
- 	u32 next_offset;
-+
-+	u32 next_write_bo_index;
- };
- 
- static inline void rcl_u8(struct vc4_rcl_setup *setup, u8 val)
-@@ -407,6 +409,8 @@ static int vc4_rcl_msaa_surface_setup(struct vc4_exec_info *exec,
- 	if (!*obj)
- 		return -EINVAL;
- 
-+	exec->rcl_write_bo[exec->rcl_write_bo_count++] = *obj;
-+
- 	if (surf->offset & 0xf) {
- 		DRM_ERROR("MSAA write must be 16b aligned.\n");
- 		return -EINVAL;
-@@ -417,7 +421,8 @@ static int vc4_rcl_msaa_surface_setup(struct vc4_exec_info *exec,
- 
- static int vc4_rcl_surface_setup(struct vc4_exec_info *exec,
- 				 struct drm_gem_cma_object **obj,
--				 struct drm_vc4_submit_rcl_surface *surf)
-+				 struct drm_vc4_submit_rcl_surface *surf,
-+				 bool is_write)
- {
- 	uint8_t tiling = VC4_GET_FIELD(surf->bits,
- 				       VC4_LOADSTORE_TILE_BUFFER_TILING);
-@@ -440,6 +445,9 @@ static int vc4_rcl_surface_setup(struct vc4_exec_info *exec,
- 	if (!*obj)
- 		return -EINVAL;
- 
-+	if (is_write)
-+		exec->rcl_write_bo[exec->rcl_write_bo_count++] = *obj;
-+
- 	if (surf->flags & VC4_SUBMIT_RCL_SURFACE_READ_IS_FULL_RES) {
- 		if (surf == &exec->args->zs_write) {
- 			DRM_ERROR("general zs write may not be a full-res.\n");
-@@ -542,6 +550,8 @@ vc4_rcl_render_config_surface_setup(struct vc4_exec_info *exec,
- 	if (!*obj)
- 		return -EINVAL;
- 
-+	exec->rcl_write_bo[exec->rcl_write_bo_count++] = *obj;
-+
- 	if (tiling > VC4_TILING_FORMAT_LT) {
- 		DRM_ERROR("Bad tiling format\n");
- 		return -EINVAL;
-@@ -599,15 +609,18 @@ int vc4_get_rcl(struct drm_device *dev, struct vc4_exec_info *exec)
- 	if (ret)
- 		return ret;
- 
--	ret = vc4_rcl_surface_setup(exec, &setup.color_read, &args->color_read);
-+	ret = vc4_rcl_surface_setup(exec, &setup.color_read, &args->color_read,
-+				    false);
- 	if (ret)
- 		return ret;
- 
--	ret = vc4_rcl_surface_setup(exec, &setup.zs_read, &args->zs_read);
-+	ret = vc4_rcl_surface_setup(exec, &setup.zs_read, &args->zs_read,
-+				    false);
- 	if (ret)
- 		return ret;
- 
--	ret = vc4_rcl_surface_setup(exec, &setup.zs_write, &args->zs_write);
-+	ret = vc4_rcl_surface_setup(exec, &setup.zs_write, &args->zs_write,
-+				    true);
- 	if (ret)
- 		return ret;
- 
-diff --git a/drivers/gpu/drm/vc4/vc4_validate.c b/drivers/gpu/drm/vc4/vc4_validate.c
-index 9ce1d0a..26503e3 100644
---- a/drivers/gpu/drm/vc4/vc4_validate.c
-+++ b/drivers/gpu/drm/vc4/vc4_validate.c
-@@ -267,6 +267,9 @@ validate_indexed_prim_list(VALIDATE_ARGS)
- 	if (!ib)
- 		return -EINVAL;
- 
-+	exec->bin_dep_seqno = max(exec->bin_dep_seqno,
-+				  to_vc4_bo(&ib->base)->write_seqno);
-+
- 	if (offset > ib->base.size ||
- 	    (ib->base.size - offset) / index_size < length) {
- 		DRM_ERROR("IB access overflow (%d + %d*%d > %zd)\n",
-@@ -555,8 +558,7 @@ static bool
- reloc_tex(struct vc4_exec_info *exec,
- 	  void *uniform_data_u,
- 	  struct vc4_texture_sample_info *sample,
--	  uint32_t texture_handle_index)
--
-+	  uint32_t texture_handle_index, bool is_cs)
- {
- 	struct drm_gem_cma_object *tex;
- 	uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]);
-@@ -714,6 +716,11 @@ reloc_tex(struct vc4_exec_info *exec,
- 
- 	*validated_p0 = tex->paddr + p0;
- 
-+	if (is_cs) {
-+		exec->bin_dep_seqno = max(exec->bin_dep_seqno,
-+					  to_vc4_bo(&tex->base)->write_seqno);
-+	}
-+
- 	return true;
-  fail:
- 	DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0);
-@@ -835,7 +842,8 @@ validate_gl_shader_rec(struct drm_device *dev,
- 			if (!reloc_tex(exec,
- 				       uniform_data_u,
- 				       &validated_shader->texture_samples[tex],
--				       texture_handles_u[tex])) {
-+				       texture_handles_u[tex],
-+				       i == 2)) {
- 				return -EINVAL;
- 			}
- 		}
-@@ -867,6 +875,9 @@ validate_gl_shader_rec(struct drm_device *dev,
- 		uint32_t stride = *(uint8_t *)(pkt_u + o + 5);
- 		uint32_t max_index;
- 
-+		exec->bin_dep_seqno = max(exec->bin_dep_seqno,
-+					  to_vc4_bo(&vbo->base)->write_seqno);
-+
- 		if (state->addr & 0x8)
- 			stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff;
- 
--- 
-2.9.3
-
 From f379f5432e4b74e3d1d894ce2fefbe1b8a3c24fd Mon Sep 17 00:00:00 2001
 From: Eric Anholt <eric@anholt.net>
 Date: Wed, 28 Sep 2016 19:20:44 -0700
@@ -634,3 +403,280 @@ index 9ecd6ff..a4b5370 100644
 -- 
 2.9.3
 
+From c4e634ce412d97f0e61223b2a5b3f8f9600cd4dc Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Fri, 30 Sep 2016 10:07:27 -0700
+Subject: clk: bcm2835: Clamp the PLL's requested rate to the hardware limits.
+
+Fixes setting low-resolution video modes on HDMI.  Now the PLLH_PIX
+divider adjusts itself until the PLLH is within bounds.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index b68bf57..8c7763f 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -502,8 +502,12 @@ static long bcm2835_pll_rate_from_divisors(unsigned long parent_rate,
+ static long bcm2835_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+ 				   unsigned long *parent_rate)
+ {
++	struct bcm2835_pll *pll = container_of(hw, struct bcm2835_pll, hw);
++	const struct bcm2835_pll_data *data = pll->data;
+ 	u32 ndiv, fdiv;
+ 
++	rate = clamp(rate, data->min_rate, data->max_rate);
++
+ 	bcm2835_pll_choose_ndiv_and_fdiv(rate, *parent_rate, &ndiv, &fdiv);
+ 
+ 	return bcm2835_pll_rate_from_divisors(*parent_rate, ndiv, fdiv, 1);
+@@ -608,13 +612,6 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
+ 	u32 ana[4];
+ 	int i;
+ 
+-	if (rate < data->min_rate || rate > data->max_rate) {
+-		dev_err(cprman->dev, "%s: rate out of spec: %lu vs (%lu, %lu)\n",
+-			clk_hw_get_name(hw), rate,
+-			data->min_rate, data->max_rate);
+-		return -EINVAL;
+-	}
+-
+ 	if (rate > data->max_fb_rate) {
+ 		use_fb_prediv = true;
+ 		rate /= 2;
+-- 
+cgit v0.12
+
+From e69fdcca836f0b81a2260b69429c8622a80ea891 Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Wed, 1 Jun 2016 12:05:33 -0700
+Subject: clk: bcm2835: Mark the VPU clock as critical
+
+The VPU clock is also the clock for our AXI bus, so we really can't
+disable it.  This might have happened during boot if, for example,
+uart1 (aux_uart clock) probed and was then disabled before the other
+consumers of the VPU clock had probed.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Acked-by: Martin Sperl <kernel@martin.sperl.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 7a79708..d9db03c 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -443,6 +443,8 @@ struct bcm2835_clock_data {
+ 	/* Number of fractional bits in the divider */
+ 	u32 frac_bits;
+ 
++	u32 flags;
++
+ 	bool is_vpu_clock;
+ 	bool is_mash_clock;
+ };
+@@ -1230,7 +1232,7 @@ static struct clk *bcm2835_register_clock(struct bcm2835_cprman *cprman,
+ 	init.parent_names = parents;
+ 	init.num_parents = data->num_mux_parents;
+ 	init.name = data->name;
+-	init.flags = CLK_IGNORE_UNUSED;
++	init.flags = data->flags | CLK_IGNORE_UNUSED;
+ 
+ 	if (data->is_vpu_clock) {
+ 		init.ops = &bcm2835_vpu_clock_clk_ops;
+@@ -1649,6 +1651,7 @@ static const struct bcm2835_clk_desc clk_desc_array[] = {
+ 		.div_reg = CM_VPUDIV,
+ 		.int_bits = 12,
+ 		.frac_bits = 8,
++		.flags = CLK_IS_CRITICAL,
+ 		.is_vpu_clock = true),
+ 
+ 	/* clocks with per parent mux */
+-- 
+cgit v0.12
+
+From eddcbe8398fc7103fccd22aa6df6917caf0123bf Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Wed, 1 Jun 2016 12:05:34 -0700
+Subject: clk: bcm2835: Mark GPIO clocks enabled at boot as critical
+
+These divide off of PLLD_PER and are used for the ethernet and wifi
+PHYs source PLLs.  Neither of them is currently represented by a phy
+device that would grab the clock for us.
+
+This keeps other drivers from killing the networking PHYs when they
+disable their own clocks and trigger PLLD_PER's refcount going to 0.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Acked-by: Martin Sperl <kernel@martin.sperl.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index d9db03c..400615b 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1239,6 +1239,12 @@ static struct clk *bcm2835_register_clock(struct bcm2835_cprman *cprman,
+ 	} else {
+ 		init.ops = &bcm2835_clock_clk_ops;
+ 		init.flags |= CLK_SET_RATE_GATE | CLK_SET_PARENT_GATE;
++
++		/* If the clock wasn't actually enabled at boot, it's not
++		 * critical.
++		 */
++		if (!(cprman_read(cprman, data->ctl_reg) & CM_ENABLE))
++			init.flags &= ~CLK_IS_CRITICAL;
+ 	}
+ 
+ 	clock = devm_kzalloc(cprman->dev, sizeof(*clock), GFP_KERNEL);
+@@ -1708,13 +1714,15 @@ static const struct bcm2835_clk_desc clk_desc_array[] = {
+ 		.div_reg = CM_GP1DIV,
+ 		.int_bits = 12,
+ 		.frac_bits = 12,
++		.flags = CLK_IS_CRITICAL,
+ 		.is_mash_clock = true),
+ 	[BCM2835_CLOCK_GP2]	= REGISTER_PER_CLK(
+ 		.name = "gp2",
+ 		.ctl_reg = CM_GP2CTL,
+ 		.div_reg = CM_GP2DIV,
+ 		.int_bits = 12,
+-		.frac_bits = 12),
++		.frac_bits = 12,
++		.flags = CLK_IS_CRITICAL),
+ 
+ 	/* HDMI state machine */
+ 	[BCM2835_CLOCK_HSM]	= REGISTER_PER_CLK(
+-- 
+cgit v0.12
+
+From 9e400c5cc5c105e35216ac59a346f20cdd7613be Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Wed, 1 Jun 2016 12:05:35 -0700
+Subject: clk: bcm2835: Mark the CM SDRAM clock's parent as critical
+
+While the SDRAM is being driven by its dedicated PLL most of the time,
+there is a little loop running in the firmware that periodically turns
+on the CM SDRAM clock (using its pre-initialized parent) and switches
+SDRAM to using the CM clock to do PVT recalibration.
+
+This avoids system hangs if we choose SDRAM's parent for some other
+clock, then disable that clock.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Acked-by: Martin Sperl <kernel@martin.sperl.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 400615b..c6420b3 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -36,6 +36,7 @@
+ 
+ #include <linux/clk-provider.h>
+ #include <linux/clkdev.h>
++#include <linux/clk.h>
+ #include <linux/clk/bcm2835.h>
+ #include <linux/debugfs.h>
+ #include <linux/module.h>
+@@ -1801,6 +1802,25 @@ static const struct bcm2835_clk_desc clk_desc_array[] = {
+ 		.ctl_reg = CM_PERIICTL),
+ };
+ 
++/*
++ * Permanently take a reference on the parent of the SDRAM clock.
++ *
++ * While the SDRAM is being driven by its dedicated PLL most of the
++ * time, there is a little loop running in the firmware that
++ * periodically switches the SDRAM to using our CM clock to do PVT
++ * recalibration, with the assumption that the previously configured
++ * SDRAM parent is still enabled and running.
++ */
++static int bcm2835_mark_sdc_parent_critical(struct clk *sdc)
++{
++	struct clk *parent = clk_get_parent(sdc);
++
++	if (IS_ERR(parent))
++		return PTR_ERR(parent);
++
++	return clk_prepare_enable(parent);
++}
++
+ static int bcm2835_clk_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -1810,6 +1830,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
+ 	const struct bcm2835_clk_desc *desc;
+ 	const size_t asize = ARRAY_SIZE(clk_desc_array);
+ 	size_t i;
++	int ret;
+ 
+ 	cprman = devm_kzalloc(dev,
+ 			      sizeof(*cprman) + asize * sizeof(*clks),
+@@ -1840,6 +1861,10 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
+ 			clks[i] = desc->clk_register(cprman, desc->data);
+ 	}
+ 
++	ret = bcm2835_mark_sdc_parent_critical(clks[BCM2835_CLOCK_SDRAM]);
++	if (ret)
++		return ret;
++
+ 	return of_clk_add_provider(dev->of_node, of_clk_src_onecell_get,
+ 				   &cprman->onecell);
+ }
+-- 
+cgit v0.12
+
+From 30772942cc1095c3129eecfa182e2c568e566b9d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 13 Oct 2016 11:54:31 +0300
+Subject: [PATCH] drm/vc4: Fix a couple error codes in vc4_cl_lookup_bos()
+
+If the allocation fails the current code returns success.  If
+copy_from_user() fails it returns the number of bytes remaining instead
+of -EFAULT.
+
+Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+---
+ drivers/gpu/drm/vc4/vc4_gem.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
+index ae1609e..4050540 100644
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -548,14 +548,15 @@ vc4_cl_lookup_bos(struct drm_device *dev,
+ 
+ 	handles = drm_malloc_ab(exec->bo_count, sizeof(uint32_t));
+ 	if (!handles) {
++		ret = -ENOMEM;
+ 		DRM_ERROR("Failed to allocate incoming GEM handles\n");
+ 		goto fail;
+ 	}
+ 
+-	ret = copy_from_user(handles,
+-			     (void __user *)(uintptr_t)args->bo_handles,
+-			     exec->bo_count * sizeof(uint32_t));
+-	if (ret) {
++	if (copy_from_user(handles,
++			   (void __user *)(uintptr_t)args->bo_handles,
++			   exec->bo_count * sizeof(uint32_t))) {
++		ret = -EFAULT;
+ 		DRM_ERROR("Failed to copy in GEM handles\n");
+ 		goto fail;
+ 	}
+-- 
+2.9.3
+

block-blkg_destroy_all-should-clear-q-root_blkg-and-.patch

@@ -0,0 +1,64 @@
+From a08748fb2221ef03d54071e5ddfcc1b0cee6961c Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Sat, 5 Sep 2015 15:47:36 -0400
+Subject: [PATCH] block: blkg_destroy_all() should clear q->root_blkg and
+ ->root_rl.blkg
+
+While making the root blkg unconditional, ec13b1d6f0a0 ("blkcg: always
+create the blkcg_gq for the root blkcg") removed the part which clears
+q->root_blkg and ->root_rl.blkg during q exit.  This leaves the two
+pointers dangling after blkg_destroy_all().  blk-throttle exit path
+performs blkg traversals and dereferences ->root_blkg and can lead to
+the following oops.
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000558
+ IP: [<ffffffff81389746>] __blkg_lookup+0x26/0x70
+ ...
+ task: ffff88001b4e2580 ti: ffff88001ac0c000 task.ti: ffff88001ac0c000
+ RIP: 0010:[<ffffffff81389746>]  [<ffffffff81389746>] __blkg_lookup+0x26/0x70
+ ...
+ Call Trace:
+  [<ffffffff8138d14a>] blk_throtl_drain+0x5a/0x110
+  [<ffffffff8138a108>] blkcg_drain_queue+0x18/0x20
+  [<ffffffff81369a70>] __blk_drain_queue+0xc0/0x170
+  [<ffffffff8136a101>] blk_queue_bypass_start+0x61/0x80
+  [<ffffffff81388c59>] blkcg_deactivate_policy+0x39/0x100
+  [<ffffffff8138d328>] blk_throtl_exit+0x38/0x50
+  [<ffffffff8138a14e>] blkcg_exit_queue+0x3e/0x50
+  [<ffffffff8137016e>] blk_release_queue+0x1e/0xc0
+ ...
+
+While the bug is a straigh-forward use-after-free bug, it is tricky to
+reproduce because blkg release is RCU protected and the rest of exit
+path usually finishes before RCU grace period.
+
+This patch fixes the bug by updating blkg_destro_all() to clear
+q->root_blkg and ->root_rl.blkg.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: "Richard W.M. Jones" <rjones@redhat.com>
+Reported-by: Josh Boyer <jwboyer@fedoraproject.org>
+Link: http://lkml.kernel.org/g/CA+5PVA5rzQ0s4723n5rHBcxQa9t0cW8BPPBekr_9aMRoWt2aYg@mail.gmail.com
+Fixes: ec13b1d6f0a0 ("blkcg: always create the blkcg_gq for the root blkcg")
+Cc: stable@vger.kernel.org # v4.2+
+---
+ block/blk-cgroup.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index d6283b3f5db5..9cc48d1d7abb 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -387,6 +387,9 @@ static void blkg_destroy_all(struct request_queue *q)
+ 		blkg_destroy(blkg);
+ 		spin_unlock(&blkcg->lock);
+ 	}
++
++	q->root_blkg = NULL;
++	q->root_rl.blkg = NULL;
+ }
+ 
+ /*
+-- 
+2.4.3
+

config-arm-generic

@@ -95,12 +95,12 @@ CONFIG_EDAC_LEGACY_SYSFS=y
 
 # Regulators
 CONFIG_REGULATOR=y
-CONFIG_RFKILL_REGULATOR=m
+CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_VIRTUAL_CONSUMER=m
 CONFIG_REGULATOR_USERSPACE_CONSUMER=m
-CONFIG_REGULATOR_GPIO=m
 CONFIG_REGULATOR_PWM=m
+CONFIG_RFKILL_REGULATOR=m
 
 # ARM VExpress
 CONFIG_ARCH_VEXPRESS=y
@@ -170,6 +170,7 @@ CONFIG_SERIAL_MVEBU_CONSOLE=y
 CONFIG_MVEBU_DEVBUS=y
 CONFIG_MVEBU_MBUS=y
 CONFIG_PCI_MVEBU=y
+CONFIG_PCI_AARDVARK=y
 CONFIG_PCIE_ARMADA_8K=y
 CONFIG_MV_XOR=y
 CONFIG_CRYPTO_DEV_MV_CESA=m
@@ -195,9 +196,9 @@ CONFIG_USB_MV_UDC=m
 CONFIG_USB_XHCI_MVEBU=m
 CONFIG_PHY_MVEBU_SATA=y
 CONFIG_AHCI_MVEBU=m
+CONFIG_I2C_PXA=m
 # CONFIG_CACHE_FEROCEON_L2 is not set
 # CONFIG_CACHE_FEROCEON_L2_WRITETHROUGH is not set
-# CONFIG_PCI_AARDVARK is not set
 
 # Rockchips
 CONFIG_ARCH_ROCKCHIP=y

config-arm64

@@ -101,7 +101,7 @@ CONFIG_ACPI_CUSTOM_METHOD=m
 CONFIG_ACPI_NFIT=m
 # CONFIG_ACPI_NFIT_DEBUG is not set
 CONFIG_PCC=y
-CONFIG_ACPI_CPPC_CPUFREQ=y
+# CONFIG_ACPI_CPPC_CPUFREQ is not set
 CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_THERMAL=y
 CONFIG_I2C_SCMI=m

config-armv7

@@ -518,7 +518,6 @@ CONFIG_MACH_MMP2_DT=y
 CONFIG_SERIAL_PXA=y
 CONFIG_SERIAL_PXA_CONSOLE=y
 CONFIG_KEYBOARD_PXA27x=y
-CONFIG_I2C_PXA=m
 # CONFIG_I2C_PXA_SLAVE is not set
 CONFIG_SND_MMP_SOC=y
 CONFIG_SND_PXA910_SOC=m

config-armv7-generic

@@ -209,11 +209,11 @@ CONFIG_I2C_SUN6I_P2WI=m
 CONFIG_GPIO_PCF857X=m
 CONFIG_TOUCHSCREEN_SUN4I=m
 CONFIG_MFD_AXP20X=y
-CONFIG_MFD_AXP20X_I2C=m
-CONFIG_MFD_AXP20X_RSB=m
+CONFIG_MFD_AXP20X_I2C=y
+CONFIG_MFD_AXP20X_RSB=y
 CONFIG_AXP20X_POWER=m
 CONFIG_INPUT_AXP20X_PEK=m
-CONFIG_REGULATOR_AXP20X=m
+CONFIG_REGULATOR_AXP20X=y
 CONFIG_AXP288_FUEL_GAUGE=m
 CONFIG_AXP288_ADC=m
 CONFIG_EXTCON_AXP288=m
@@ -228,14 +228,14 @@ CONFIG_RTC_DRV_SUN6I=m
 CONFIG_MTD_NAND_SUNXI=m
 CONFIG_SERIO_SUN4I_PS2=m
 CONFIG_KEYBOARD_SUN4I_LRADC=m
-CONFIG_PWM_SUN4I=m
+CONFIG_PWM_SUN4I=y
 CONFIG_CAN_SUN4I=m
 CONFIG_USB_MUSB_SUNXI=m
 CONFIG_CRYPTO_DEV_SUN4I_SS=m
 CONFIG_SND_SUN4I_CODEC=m
 CONFIG_SND_SUN4I_SPDIF=m
 CONFIG_SND_SUN4I_I2S=m
-CONFIG_SUNXI_RSB=m
+CONFIG_SUNXI_RSB=y
 CONFIG_NVMEM_SUNXI_SID=m
 
 # Exynos
@@ -330,6 +330,9 @@ CONFIG_SND_SOC_SAMSUNG_SMDK_SPDIF=m
 CONFIG_SND_SOC_SAMSUNG_SMDK_WM8994=m
 CONFIG_SND_SOC_SMDK_WM8994_PCM=m
 CONFIG_SND_SOC_SNOW=m
+CONFIG_SND_SOC_MAX98090=m
+CONFIG_SND_SOC_MAX98095=m
+CONFIG_SND_SAMSUNG_I2S=m
 CONFIG_SND_SOC_ODROIDX2=m
 CONFIG_EXYNOS_AUDSS_CLK_CON=m
 # CONFIG_EXYNOS_IOMMU_DEBUG is not set
@@ -351,6 +354,8 @@ CONFIG_CHARGER_MAX8997=m
 CONFIG_LEDS_MAX8997=m
 CONFIG_RTC_DRV_MAX8997=m
 CONFIG_EXTCON_MAX8997=m
+CONFIG_SND_SOC_ARNDALE_RT5631_ALC5631=m
+CONFIG_SND_SOC_RT5631=m
 
 # Tegra
 CONFIG_ARCH_TEGRA_114_SOC=y
@@ -401,11 +406,11 @@ CONFIG_USB_EHCI_HCD_ORION=m
 CONFIG_MVPP2=m
 CONFIG_COMMON_CLK_SI5351=m
 CONFIG_RTC_DRV_ARMADA38X=m
+CONFIG_I2C_PXA=m
 # CONFIG_CACHE_FEROCEON_L2 is not set
 # CONFIG_CACHE_FEROCEON_L2_WRITETHROUGH is not set
 CONFIG_LEDS_NS2=m
-CONFIG_SERIAL_MVEBU_UART=y
-# CONFIG_SERIAL_MVEBU_CONSOLE is not set
+CONFIG_LEDS_PCA963X=m
 # CONFIG_PCIE_ARMADA_8K is not set
 
 # DRM panels

config-local

@@ -1,2 +1,70 @@
 # This file is intentionally left empty in the stock kernel. Its a nicety
 # added for those wanting to do custom rebuilds with altered config opts.
+
+CONFIG_IOSCHED_BFQ=m
+
+CONFIG_SCHED_BFS=y
+# BFS successor see https://pf.natalenko.name/news/?p=207
+CONFIG_SCHED_MUQSS=y
+
+CONFIG_SMT_NICE=n
+CONFIG_CGROUP_BFQIO=y
+CONFIG_BFQ_GROUP_IOSCHED=y
+CONFIG_ZCACHE=y
+CONFIG_ZCACHE_WRITEBACK=y
+# CONFIG_ZCACHE_DEBUG is not set
+CONFIG_KSM=y
+CONFIG_UKSM=y
+
+# TuxOnIce:
+# https://groups.google.com/forum/#!msg/chakra-devel/0azu1a22LTs/bEwKElM2CYMJ
+CONFIG_TOI_CORE=y
+CONFIG_TOI_FILE=y
+CONFIG_TOI_SWAP=y
+CONFIG_TOI_CRYPTO=y
+CONFIG_TOI_USERUI=y
+CONFIG_TOI_USERUI_DEFAULT_PATH="/usr/sbin/tuxoniceui"
+CONFIG_TOI_DEFAULT_IMAGE_SIZE_LIMIT=-2
+# CONFIG_TOI_KEEP_IMAGE is not set
+CONFIG_TOI_REPLACE_SWSUSP=y
+# CONFIG_TOI_IGNORE_LATE_INITCALL is not set
+CONFIG_TOI_DEFAULT_WAIT=25
+CONFIG_TOI_DEFAULT_EXTRA_PAGES_ALLOWANCE=7500
+# CONFIG_TOI_CHECKSUM is not set
+CONFIG_TOI=y
+CONFIG_TOI_EXPORTS=y
+CONFIG_TOI_ZRAM_SUPPORT=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_TOI_INCREMENTAL=y
+
+# TuxOnIce - ftrace: Answer for me to try resolve TuxOnIce problem finding ftrace: https://pf.natalenko.name/forum/index.php?topic=257.0
+CONFIG_HAVE_KPROBES_ON_FTRACE=y
+# CONFIG_PSTORE_FTRACE is not set
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_FTRACE=y
+CONFIG_FTRACE_SYSCALLS=y
+CONFIG_DYNAMIC_FTRACE=y
+CONFIG_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_FTRACE_MCOUNT_RECORD=y
+# CONFIG_FTRACE_STARTUP_TEST is not set
+
+# Ulatencyd: Settings from https://wiki.archlinux.org/index.php/Ulatencyd
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_MEM_RES_CTLR=y
+CONFIG_CGROUP_MEM_RES_CTLR_SWAP=y
+CONFIG_CGROUP_MEM_RES_CTLR_SWAP_ENABLED=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_FAIR_GROUP_SCHED=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+
+CONFIG_ZRAM_LZ4_COMPRESS=y
+CONFIG_ZRAM_DEBUG=n
+
+CONFIG_MNATIVE=y

criu-no-expert.patch

@@ -12,15 +12,6 @@ diff --git a/init/Kconfig b/init/Kconfig
 index 648bb79d6b73..860ca236975f 100644
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1137,7 +1137,7 @@ config CGROUP_WRITEBACK
- endif # CGROUPS
- 
- config CHECKPOINT_RESTORE
--	bool "Checkpoint/restore support" if EXPERT
-+	bool "Checkpoint/restore support"
- 	select PROC_CHILDREN
- 	default n
- 	help
 @@ -1149,7 +1149,7 @@ config CHECKPOINT_RESTORE
  	  If unsure, say N here.
  

dcache-Handle-escaped-paths-in-prepend_path.patch

@@ -0,0 +1,65 @@
+From c0ea161a6e7158281f64bc6d41126da43cb08f14 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Sat, 15 Aug 2015 13:36:12 -0500
+Subject: [PATCH 1/2] dcache: Handle escaped paths in prepend_path
+
+commit cde93be45a8a90d8c264c776fab63487b5038a65 upstream.
+
+A rename can result in a dentry that by walking up d_parent
+will never reach it's mnt_root.  For lack of a better term
+I call this an escaped path.
+
+prepend_path is called by four different functions __d_path,
+d_absolute_path, d_path, and getcwd.
+
+__d_path only wants to see paths are connected to the root it passes
+in.  So __d_path needs prepend_path to return an error.
+
+d_absolute_path similarly wants to see paths that are connected to
+some root.  Escaped paths are not connected to any mnt_root so
+d_absolute_path needs prepend_path to return an error greater
+than 1.  So escaped paths will be treated like paths on lazily
+unmounted mounts.
+
+getcwd needs to prepend "(unreachable)" so getcwd also needs
+prepend_path to return an error.
+
+d_path is the interesting hold out.  d_path just wants to print
+something, and does not care about the weird cases.  Which raises
+the question what should be printed?
+
+Given that <escaped_path>/<anything> should result in -ENOENT I
+believe it is desirable for escaped paths to be printed as empty
+paths.  As there are not really any meaninful path components when
+considered from the perspective of a mount tree.
+
+So tweak prepend_path to return an empty path with an new error
+code of 3 when it encounters an escaped path.
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+---
+ fs/dcache.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 9b5fe503f6cb..e3b44ca75a1b 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2926,6 +2926,13 @@ restart:
+ 
+ 		if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
+ 			struct mount *parent = ACCESS_ONCE(mnt->mnt_parent);
++			/* Escaped? */
++			if (dentry != vfsmnt->mnt_root) {
++				bptr = *buffer;
++				blen = *buflen;
++				error = 3;
++				break;
++			}
+ 			/* Global root? */
+ 			if (mnt != parent) {
+ 				dentry = ACCESS_ONCE(mnt->mnt_mountpoint);
+-- 
+2.4.3
+

drm-vmwgfx-Allow-dropped-masters-render-node-like-ac.patch

@@ -0,0 +1,60 @@
+From a19afebb883f2a02ecf4b8d5a114ce6957a59238 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Wed, 26 Aug 2015 05:49:21 -0700
+Subject: [PATCH 2/2] drm/vmwgfx: Allow dropped masters render-node like access
+ on legacy nodes v2
+
+Applications like gnome-shell may try to render after dropping master
+privileges. Since the driver should now be safe against this scenario,
+allow those applications to use their legacy node like a render node.
+
+v2: Add missing return statement.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c     | 7 ++++++-
+ drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 6 ++++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index a4766acd0ea2..d022b509f1ac 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -993,10 +993,15 @@ static struct vmw_master *vmw_master_check(struct drm_device *dev,
+ 	}
+ 
+ 	/*
+-	 * Check if we were previously master, but now dropped.
++	 * Check if we were previously master, but now dropped. In that
++	 * case, allow at least render node functionality.
+ 	 */
+ 	if (vmw_fp->locked_master) {
+ 		mutex_unlock(&dev->master_mutex);
++
++		if (flags & DRM_RENDER_ALLOW)
++			return NULL;
++
+ 		DRM_ERROR("Dropped master trying to access ioctl that "
+ 			  "requires authentication.\n");
+ 		return ERR_PTR(-EACCES);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+index 4d0c98edeb6a..7fc3e8abd0c4 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+@@ -906,6 +906,12 @@ vmw_surface_handle_reference(struct vmw_private *dev_priv,
+ 				  "surface reference.\n");
+ 			return -EACCES;
+ 		}
++		if (ACCESS_ONCE(vmw_fpriv(file_priv)->locked_master)) {
++			DRM_ERROR("Locked master refused legacy "
++				  "surface reference.\n");
++			return -EACCES;
++		}
++
+ 		handle = u_handle;
+ 	}
+ 
+-- 
+2.4.3
+

iSCSI-let-session-recovery_tmo-sysfs-writes-persist.patch

@@ -0,0 +1,89 @@
+From 9c8108a4d3a837c51a29f28229a06d97654eaeb6 Mon Sep 17 00:00:00 2001
+From: Chris Leech <cleech@redhat.com>
+Date: Tue, 16 Jun 2015 16:07:13 -0700
+Subject: iSCSI: let session recovery_tmo sysfs writes persist across recovery
+
+The iSCSI session recovery_tmo setting is writeable in sysfs, but it's
+also set every time a connection is established when parameters are set
+from iscsid over netlink.  That results in the timeout being reset to
+the default value after every recovery.
+
+The DM multipath tools want to use the sysfs interface to lower the
+default timeout when there are multiple paths to fail over.  It has
+caused confusion that we have a writeable sysfs value that seem to keep
+resetting itself.
+
+This patch adds an in-kernel flag that gets set once a sysfs write
+occurs, and then ignores netlink parameter setting once it's been
+modified via the sysfs interface.  My thinking here is that the sysfs
+interface is much simpler for external tools to influence the session
+timeout, but if we're going to allow it to be modified directly we
+should ensure that setting is maintained.
+
+Signed-off-by: Chris Leech <cleech@redhat.com>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 55647aa..4c25539 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2042,6 +2042,7 @@ iscsi_alloc_session(struct Scsi_Host *shost, struct iscsi_transport *transport,
+ 	session->transport = transport;
+ 	session->creator = -1;
+ 	session->recovery_tmo = 120;
++	session->recovery_tmo_sysfs_override = false;
+ 	session->state = ISCSI_SESSION_FREE;
+ 	INIT_DELAYED_WORK(&session->recovery_work, session_recovery_timedout);
+ 	INIT_LIST_HEAD(&session->sess_list);
+@@ -2786,7 +2787,8 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ 	switch (ev->u.set_param.param) {
+ 	case ISCSI_PARAM_SESS_RECOVERY_TMO:
+ 		sscanf(data, "%d", &value);
+-		session->recovery_tmo = value;
++		if (!session->recovery_tmo_sysfs_override)
++			session->recovery_tmo = value;
+ 		break;
+ 	default:
+ 		err = transport->set_param(conn, ev->u.set_param.param,
+@@ -4049,13 +4051,15 @@ store_priv_session_##field(struct device *dev,				\
+ 	if ((session->state == ISCSI_SESSION_FREE) ||			\
+ 	    (session->state == ISCSI_SESSION_FAILED))			\
+ 		return -EBUSY;						\
+-	if (strncmp(buf, "off", 3) == 0)				\
++	if (strncmp(buf, "off", 3) == 0) {				\
+ 		session->field = -1;					\
+-	else {								\
++		session->field##_sysfs_override = true;			\
++	} else {							\
+ 		val = simple_strtoul(buf, &cp, 0);			\
+ 		if (*cp != '\0' && *cp != '\n')				\
+ 			return -EINVAL;					\
+ 		session->field = val;					\
++		session->field##_sysfs_override = true;			\
+ 	}								\
+ 	return count;							\
+ }
+@@ -4066,6 +4070,7 @@ store_priv_session_##field(struct device *dev,				\
+ static ISCSI_CLASS_ATTR(priv_sess, field, S_IRUGO | S_IWUSR,		\
+ 			show_priv_session_##field,			\
+ 			store_priv_session_##field)
++
+ iscsi_priv_session_rw_attr(recovery_tmo, "%d");
+ 
+ static struct attribute *iscsi_session_attrs[] = {
+diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
+index 2555ee5..6183d20 100644
+--- a/include/scsi/scsi_transport_iscsi.h
++++ b/include/scsi/scsi_transport_iscsi.h
+@@ -241,6 +241,7 @@ struct iscsi_cls_session {
+ 
+ 	/* recovery fields */
+ 	int recovery_tmo;
++	bool recovery_tmo_sysfs_override;
+ 	struct delayed_work recovery_work;
+ 
+ 	unsigned int target_id;
+-- 
+cgit v0.10.2
+

kernel-panic-TPROXY-vanilla-4.7.1.patch

@@ -0,0 +1,85 @@
+From patchwork Wed Aug 17 16:04:31 2016
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: kernel panic TPROXY , vanilla 4.7.1
+From: Eric Dumazet <eric.dumazet@gmail.com>
+X-Patchwork-Id: 660174
+X-Patchwork-Delegate: davem@davemloft.net
+Message-Id: <1471449871.29842.3.camel@edumazet-glaptop3.roam.corp.google.com>
+To: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
+Cc: Linux Kernel Network Developers <netdev@vger.kernel.org>,
+ netfilter-devel@vger.kernel.org
+Date: Wed, 17 Aug 2016 09:04:31 -0700
+
+On Wed, 2016-08-17 at 08:42 -0700, Eric Dumazet wrote:
+> On Wed, 2016-08-17 at 17:31 +0300, Denys Fedoryshchenko wrote:
+> > Hi!
+> > 
+> > Tried to run squid on latest kernel, and hit a panic
+> > Sometimes it just shows warning in dmesg (but doesnt work properly)
+> > [   75.701666] IPv4: Attempt to release TCP socket in state 10 
+> > ffff88102d430780
+> > [   83.866974] squid (2700) used greatest stack depth: 12912 bytes left
+> > [   87.506644] IPv4: Attempt to release TCP socket in state 10 
+> > ffff880078a48780
+> > [  114.704295] IPv4: Attempt to release TCP socket in state 10 
+> > ffff881029f8ad00
+> > 
+> > I cannot catch yet oops/panic message, netconsole not working.
+> > 
+> > After triggering warning message 3 times, i am unable to run squid 
+> > anymore (without reboot), and in netstat it doesnt show port running.
+> > 
+> > firewall is:
+> > *mangle
+> > -A PREROUTING -p tcp -m socket -j DIVERT
+> > -A PREROUTING -p tcp -m tcp --dport 80 -i eno1 -j TPROXY --on-port 3129 
+> > --on-ip 0.0.0.0 --tproxy-mark 0x1/0x1
+> > -A DIVERT -j MARK --set-xmark 0x1/0xffffffff
+> > -A DIVERT -j ACCEPT
+> > 
+> > routing
+> > ip rule add fwmark 1 lookup 100
+> > ip route add local default dev eno1 table 100
+> > 
+> > 
+> > squid config is default with tproxy option
+> > http_port 3129 tproxy
+> > 
+> 
+> Hmppff... sorry for this, I will send a fix.
+> 
+> Thanks for the report !
+> 
+
+
+Could you try the following ?
+
+Thanks !
+
+ net/netfilter/xt_TPROXY.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
+index 7f4414d26a66..663c4c3c9072 100644
+--- a/net/netfilter/xt_TPROXY.c
++++ b/net/netfilter/xt_TPROXY.c
+@@ -127,6 +127,8 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
+ 						    daddr, dport,
+ 						    in->ifindex);
+ 
++			if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
++				sk = NULL;
+ 			/* NOTE: we return listeners even if bound to
+ 			 * 0.0.0.0, those are filtered out in
+ 			 * xt_socket, since xt_TPROXY needs 0 bound
+@@ -195,6 +197,8 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
+ 						   daddr, ntohs(dport),
+ 						   in->ifindex);
+ 
++			if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
++				sk = NULL;
+ 			/* NOTE: we return listeners even if bound to
+ 			 * 0.0.0.0, those are filtered out in
+ 			 * xt_socket, since xt_TPROXY needs 0 bound

kernel.build.koji.epel7

@@ -0,0 +1 @@
+time fedpkg --dist epel7 build --scratch --srpm --arches x86_64 i686

kernel.build.koji.f25

@@ -0,0 +1 @@
+fedpkg --dist f25 build --scratch --srpm --arch=x86_64

kernel.spec

@@ -24,7 +24,7 @@ Summary: The Linux kernel
 %global zipsed -e 's/\.ko$/\.ko.xz/'
 %endif
 
-# define buildid .local
+%define buildid .pf7.hu.1
 
 # baserelease defines which build revision of this kernel version we're
 # building.  We used to call this fedora_build, but the magical name
@@ -42,7 +42,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 1
+%global baserelease 300
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -54,7 +54,8 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 0
+#+Hu Pf against 4.8.7 v4.8-pf6: https://pf.natalenko.name/news/?p=219
+%define stable_update 7
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -354,7 +355,10 @@ Summary: The Linux kernel
 Name: kernel%{?variant}
 Group: System Environment/Kernel
 License: GPLv2 and Redistributable, no modification permitted
-URL: http://www.kernel.org/
+#URL: http://www.kernel.org/
+# Hubbitus patched fork of Fedora Kernel. Post-factum (https://pf.natalenko.name/) branch.
+# Binaries could be found at: http://hubbitus.info/wiki/Repository
+URL: https://github.com/Hubbitus/kernel/
 Version: %{rpmversion}
 Release: %{pkg_release}
 # DO NOT CHANGE THE 'ExclusiveArch' LINE TO TEMPORARILY EXCLUDE AN ARCHITECTURE BUILD.
@@ -467,7 +471,8 @@ Source2001: cpupower.config
 # For a stable release kernel
 %if 0%{?stable_update}
 %if 0%{?stable_base}
-%define    stable_patch_00  patch-4.%{base_sublevel}.%{stable_base}.xz
+#*Hu %%define    stable_patch_00  patch-4.%%{base_sublevel}.%%{stable_base}.xz
+%global stable_patch_00 https://pf.natalenko.name/sources/4.8/patch-4.8-pf7.xz
 Source5000: %{stable_patch_00}
 %endif
 
@@ -513,6 +518,14 @@ Patch425: arm64-pcie-quirks.patch
 # http://www.spinics.net/lists/linux-tegra/msg26029.html
 Patch426: usb-phy-tegra-Add-38.4MHz-clock-table-entry.patch
 
+# Fix OMAP4 (pandaboard)
+Patch427: arm-revert-mmc-omap_hsmmc-Use-dma_request_chan-for-reque.patch
+Patch428: ARM-OMAP4-Fix-crashes.patch
+
+# Not particularly happy we don't yet have a proper upstream resolution this is the right direction
+# https://www.spinics.net/lists/arm-kernel/msg535191.html
+Patch429: arm64-mm-Fix-memmap-to-be-initialized-for-the-entire-section.patch
+
 # http://patchwork.ozlabs.org/patch/587554/
 Patch430: ARM-tegra-usb-no-reset.patch
 
@@ -520,6 +533,8 @@ Patch431: bcm2837-initial-support.patch
 
 Patch432: bcm283x-vc4-fixes.patch
 
+Patch433: AllWinner-net-emac.patch
+
 Patch460: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch
 
 Patch466: input-kill-stupid-messages.patch
@@ -615,14 +630,23 @@ Patch846: security-selinux-overlayfs-support.patch
 #rhbz 1360688
 Patch847: rc-core-fix-repeat-events.patch
 
-#rhbz 1374212
-Patch848: 0001-cpupower-Correct-return-type-of-cpu_power_is_cpu_onl.patch
-
 #ongoing complaint, full discussion delayed until ksummit/plumbers
 Patch849: 0001-iio-Use-event-header-from-kernel-tree.patch
 
-#CVE-2016-7425 rhbz 1377330 1377331
-Patch850: arcmsr-buffer-overflow-in-archmsr_iop_message_xfer.patch
+# CVE-2016-9083 CVE-2016-9084 rhbz 1389258 1389259 1389285
+Patch850: v3-vfio-pci-Fix-integer-overflows-bitmask-check.patch
+
+#rhbz 1325354
+Patch852: 0001-HID-input-ignore-System-Control-application-usages-i.patch
+
+#rhbz 1392885
+Patch853: 0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch
+
+#rhbz 1390308
+Patch854: nouveau-add-maxwell-to-backlight-init.patch
+
+#rhbz 1385823
+Patch855: 0001-platform-x86-ideapad-laptop-Add-Lenovo-Yoga-910-13IK.patch
 
 # END OF PATCH DEFINITIONS
 
@@ -1005,14 +1029,16 @@ fi 2>/dev/null
 patch_command='patch -p1 -F1 -s'
 ApplyPatch()
 {
-  local patch=$1
+#Hu basename to allow use URLs in patches
+  local patch=$( basename $1 )
+  local patchURL=$1
   shift
   if [ ! -f $RPM_SOURCE_DIR/$patch ]; then
     exit 1
   fi
-  if ! grep -E "^Patch[0-9]+: $patch\$" %{_specdir}/${RPM_PACKAGE_NAME%%%%%{?variant}}.spec ; then
+  if ! grep -E "^Patch[0-9]+: $patchURL\$" %{_specdir}/${RPM_PACKAGE_NAME%%%%%{?variant}}.spec ; then
     if [ "${patch:0:8}" != "patch-4." ] ; then
-      echo "ERROR: Patch  $patch  not listed as a source patch in specfile"
+      echo "ERROR: Patch [$patch] not listed as a source patch in specfile"
       exit 1
     fi
   fi 2>/dev/null
@@ -1189,6 +1215,8 @@ fi
 %if 0%{?stable_base}
 # This is special because the kernel spec is hell and nothing is consistent
 xzcat %{SOURCE5000} | patch -p1 -F1 -s
+#+Hu: Place for manual hotfixes!
+#patch -p1 < %%{SOURCE5002}
 git commit -a -m "Stable update"
 %endif
 
@@ -1239,7 +1267,7 @@ touch .scmversion
 # only deal with configs if we are going to build for the arch
 %ifnarch %nobuildarches
 
-mkdir configs
+mkdir -p configs
 
 %if !%{debugbuildsenabled}
 rm -f kernel-%{version}-*debug.config
@@ -1248,7 +1276,7 @@ rm -f kernel-%{version}-*debug.config
 %define make make %{?cross_opts}
 
 # now run oldconfig over all the config files
-for i in *.config
+for i in %{all_arch_configs}
 do
   mv $i .config
   Arch=`head -1 .config | cut -b 3-`
@@ -1699,9 +1727,9 @@ chmod +x tools/power/cpupower/utils/version-gen.sh
 pushd tools/thermal/tmon/
 %{make}
 popd
-pushd tools/iio/
-%{make}
-popd
+#-Hu1 pushd tools/iio/
+#-Hu1 %{make}
+#-Hu1 popd
 %endif
 
 # In the modsign case, we do 3 things.  1) We check the "flavour" and hard
@@ -1869,9 +1897,9 @@ install -m644 %{SOURCE2001} %{buildroot}%{_sysconfdir}/sysconfig/cpupower
 pushd tools/thermal/tmon
 make INSTALL_ROOT=%{buildroot} install
 popd
-pushd tools/iio
-make INSTALL_ROOT=%{buildroot} install
-popd
+#-Hu1 pushd tools/iio
+#-Hu1 make INSTALL_ROOT=%{buildroot} install
+#-Hu1 popd
 %endif
 
 %if %{with_bootwrapper}
@@ -2063,9 +2091,9 @@ fi
 %{_mandir}/man8/turbostat*
 %endif
 %{_bindir}/tmon
-%{_bindir}/iio_event_monitor
-%{_bindir}/iio_generic_buffer
-%{_bindir}/lsiio
+#-Hu1 %{_bindir}/iio_event_monitor
+#-Hu1 %{_bindir}/iio_generic_buffer
+#-Hu1 %{_bindir}/lsiio
 %endif
 
 %if %{with_debuginfo}
@@ -2160,6 +2188,117 @@ fi
 #
 #
 %changelog
+* Mon Nov 21 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.8.7-300.pf7.hu.1
+- Merge Fedora upstream changes.
+- Update pf https://pf.natalenko.name/news/?p=219 to v4.8-pf7.
+
+* Mon Nov 21 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.10-300
+- Linux v4.8.10
+
+* Sun Nov 20 2016 Peter Robinson <pbrobinson@fedoraproject.org>
+- Minor ARM config tweaks
+
+* Tue Nov 15 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.8-300
+- Linux v4.8.8
+- Fix crash in tcp_collapse CVE-2016-8645 (rhbz 1393904 1393908)
+
+* Mon Nov 14 2016 Laura Abbott <labbott@fedoraproject.org>
+- Fix for some Yoga laptop WIFI (rhbz 1385823)
+
+* Fri Nov 11 2016 Justin M. Forbes <jforbes@fedoraproject.org>
+- Nouveau: Add Maxwell to backlight initialization (rhbz 1390308)
+
+* Thu Nov 10 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.7-300
+- Linux v4.8.7
+- Fixes cve-2016-8630 (rhbz 1393350 1393358)
+- Refresh status of MST capable connectors (rhbz 1392885)
+
+* Wed Nov 09 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.8.6-301.pf6.hu.1
+- Rebase Fedora changes - kernel 4.8.6.
+- Update pf patch to v4.8-pf6 - https://pf.natalenko.name/news/?p=217
+
+* Wed Nov  2 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.6-301
+- dm raid: fix compat_features validation (rhbz 1391279)
+
+* Tue Nov  1 2016 Peter Robinson <pbrobinson@fedoraproject.org> 4.8.6-300
+- Linux v4.8.6
+- Add revert to fix omap4 mmc (panda)
+- Other minor omap4 fixes
+- Adjust config for some AllWinner devices that don't like modular bits
+- Add patch for aarch64 memory regions
+
+* Mon Oct 31 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.8.5-300.pf5.hu.3
+- CONFIG_SCHED_MUQSS=y
+
+* Mon Oct 31 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.8.5-300.pf5.hu.2
+- Try build with CONFIG_SCHED_MUQSS=n by suggestipon of Oleksandr Natalenko in mail.
+
+* Sun Oct 30 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.8.5-300.pf5.hu.1
+- Kernel 4.8.5.
+- Pull Fedora changes.
+- Update pf patch to v4.8-pf5 https://pf.natalenko.name/news/?p=213.
+
+* Sat Oct 29 2016 Peter Robinson <pbrobinson@fedoraproject.org>
+- Minor VC4 bug fix
+
+* Fri Oct 28 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.5-300
+- Linux v4.8.5
+
+* Thu Oct 27 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.8.4-301.pf4.hu.1
+- Pull Fedora changes. Step to 4.8.4.
+- Due to the error build on epel http://koji.fedoraproject.org/koji/getfile?taskID=16206974&name=build.log&offset=-4000 DISABLE build tools/iio!
+- Upodate pf to 4.8-pf4 - https://pf.natalenko.name/news/?p=211.
+
+* Thu Oct 27 2016 Justin M. Forbes <jforbes@fedoraproject.org>
+- CVE-2016-9083 CVE-2016-9084 vfio multiple flaws (rhbz 1389258 1389259 1389285)
+- Skylake i915 fixes from 4.9
+- Fix MS input devices identified as joysticks (rhbz 1325354)
+
+* Mon Oct 24 2016 Peter Robinson <pbrobinson@fedoraproject.org> 4.8.4-301
+- Upstream fix for Raspberry Pi to fix setting low-resolution video modes on HDMI
+- A collection of other clock fixes in -next for the RPi
+
+* Mon Oct 24 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.4-300
+- Linux v4.8.4
+
+* Sat Oct 22 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.8.2-300.pf2.hu.1
+- Update to v4.8-pf2 - https://pf.natalenko.name/news/?p=207
+    There BFS CPU scheduler has been replaced by its successor, MuQSS. Detailes: https://ck-hack.blogspot.de/2016/10/muqss-multiple-queue-skiplist-scheduler.html
+- Change naming scheme to 4.8.0-300.pf2.hu.1 from 4.8.0-300.hu.1.pf2
+
+
+* Thu Oct 20 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.3-300
+- Linux v4.8.3
+- CVE-2016-5195 (rhbz 1384344 1387080)
+
+* Tue Oct 18 2016 Justin M. Forbes <jforbes@fedoraproject.org>
+- Fix memory corruption caused by p8_ghash
+- Make __xfs_xattr_put_listen preperly report errors (rhbz 1384606)
+
+* Tue Oct 18 2016 Peter Robinson <pbrobinson@fedoraproject.org>
+- Disable ACPI_CPPC_CPUFREQ on aarch64
+- Add ethernet driver for AllWinner sun8i-emac (H3/OrangePi and Pine64)
+
+* Mon Oct 17 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.2-300
+- Linux v4.8.2
+- i8042 - skip selftest on ASUS laptops
+
+* Sat Oct 15 2016 Peter Robinson <pbrobinson@fedoraproject.org>
+- Build in AXP20X_I2C (should fix rhbz 1352140)
+
+* Tue Oct 11 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.8.0-1.hu.1.pf1
+- Step to build kernels for Fedora 25.
+- Use new pf patch v4.8-pf1 - https://pf.natalenko.name/news/?p=204
+
+* Fri Oct 07 2016 Justin M. Forbes <jforbes@fedoraproject.org>
+- update baserelease for Fedora 25
+
+* Fri Oct 07 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.1-1
+- Linux v4.8.1
+
+* Tue Oct 04 2016 Josh Boyer <jwboyer@fedoraproject.org>
+- Add patch to fix Xorg starting with virtio (rhbz 1366842)
+
 * Mon Oct 03 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.0-1
 - Disable debugging options.
 - Linux v4.8
@@ -2201,6 +2340,13 @@ fi
 - Linux v4.8-rc7-37-gd2ffb01
 - Reenable debugging options.
 
+#* Tue Sep 20 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.7.4-200.hu.2.pf4
+#- Add patch1 http://ck.kolivas.org/patches/bfs/4.0/4.7/Pending/bfs497-build_other_arches.patch from Oleksand Natalenko
+
+#* Mon Sep 19 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.7.4-200.hu.1.pf4
+#- Merge Fedora upstream: kernel 4.7.4.
+#- Update pf patch: 4.7-pf4 - https://pf.natalenko.name/news/?p=195
+
 * Mon Sep 19 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.0-0.rc7.git0.1
 - Linux v4.8-rc7
 - Disable debugging options.
@@ -2958,6 +3104,11 @@ fi
   independent from each other
 - sign modules on all archs
 
+#* Tue Mar 08 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.4.4-301.hu.1.pf6
+#- Merge Fedora changes.
+#- Step to kernel 4.4.4.
+#- Update pf patch: v4.4-pf6 - https://pf.natalenko.name/news/?p=161
+
 * Mon Mar  7 2016 Peter Robinson <pbrobinson@fedoraproject.org> 4.5.0-0.rc7.git0.2
 - Disble ARM_PATCH_IDIV as a work around to fix rhbz 1303147
 
@@ -2996,6 +3147,10 @@ fi
 - Fix tegra nouveau module load (thank kwizart for reference)
 - PowerPC Little Endian ToC fix
 
+#* Mon Feb 22 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.4.2-300.hu.1.pf5
+#- Merge upstream changes. Step to 4.4.2!
+#- Update pf patch to v4.4-pf5
+
 * Sun Feb 21 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.5.0-0.rc5.git0.1
 - Disable debugging options.
 - Linux v4.5-rc5
@@ -3069,10 +3224,17 @@ fi
 * Wed Jan 27 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.5.0-0.rc1.git0.2
 - Only apply KEY_FLAG_KEEP to a key if a parent keyring has it set (rhbz 1301099)
 
+#* Tue Jan 26 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.3.3-303.hu.2.pf4
+#- While Fedora step to 4.3.4, pf is still 4.3.4. But merging Fedora patch changes.
+
 * Mon Jan 25 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.5.0-0.rc1.git0.1
 - Disable debugging options.
 - Linux v4.5-rc1
 
+#* Sat Jan 23 2016 Pavel Alexeev <Pahan@Hubbitus.info> - 4.3.3-303.hu.1.pf4
+#- Merge Fedora 15 patches.
+#- 4.3.3-303.hu.1.pf4
+
 * Fri Jan 22 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.5.0-0.rc0.git9.1
 - Linux v4.4-10454-g3e1e21c
 
@@ -3335,6 +3497,15 @@ fi
 - Disable Exynos IOMMU as it crashes
 - Minor ARMv7 update for battiery/charging
 
+#* Sat Nov 07 2015 Pavel Alexeev <Pahan@Hubbitus.info> - 4.2.5-300.hu.1.pf3
+#- Update to Fedora23.
+#- Merge fc23 branch.
+#- Adjust hibernate-Disable-in-a-signed-modules-environment.patch.
+
+#* Thu Nov 05 2015 Pavel Alexeev <Pahan@Hubbitus.info> - 4.2.5-201.hu.1.pf3.fc22
+#- Update to pf3 - v4.2-pf3: https://pf.natalenko.name/forum/index.php?topic=363.0
+#- 4.2.5-201.hu.1.pf3
+
 * Thu Nov 05 2015 Laura Abbott <labbott@redhat.com> - 4.4.0-0.rc0.git3.1
 - Linux v4.3-6681-g8e483ed
 
@@ -3514,6 +3685,10 @@ fi
 * Fri Sep 11 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.3.0-0.rc0.git12.1
 - Linux v4.2-10963-g519f526d391b
 
+#* Sun Sep 13 2015 Pavel Alexeev <Pahan@Hubbitus.info> - 4.1.6-201.hu.1.pf4.fc22
+#- Update pf to v4.1-pf4 - https://pf.natalenko.name/forum/index.php?topic=345.0
+#- Possible kernel-3.19-bfs-compat-hubbitus.patch will not needed anymore (https://pf.natalenko.name/forum/index.php?topic=332.0).
+
 * Wed Sep 09 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.3.0-0.rc0.git11.1
 - Linux v4.2-10774-g26d2177e977c
 
@@ -3656,6 +3831,9 @@ fi
 * Mon Aug 03 2015 Josh Boyer <jwboyer@fedoraproject.org>
 - Revert upstream commit 1c220c69ce to fix i686 booting (rhbz 1247382)
 
+#* Sat Aug 01 2015 Pavel Alexeev <Pahan@Hubbitus.info> - 4.1.2-200.hu.2.pf1
+#- Merge Fedora changes, but stay at 4.1.2 as PF patch is.
+
 * Fri Jul 31 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.2.0-0.rc4.git4.1
 - Linux v4.2-rc4-111-g8400935737bf
 
@@ -3699,6 +3877,10 @@ fi
 * Mon Jul 20 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.2.0-0.rc3.git0.1
 - Linux v4.2-rc3
 
+#* Sat Jul 18 2015 Pavel Alexeev <Pahan@Hubbitus.info> - 4.1.2-200.hu.1.pf1.fc22
+#- Linux 4.1.2
+#- Update PF patch to v4.1-pf1
+
 * Fri Jul 17 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.2.0-0.rc2.git2.1
 - Linux v4.2-rc2-190-g21bdb584af8c
 
@@ -3708,6 +3890,9 @@ fi
 * Wed Jul 15 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.2.0-0.rc2.git1.1
 - Linux v4.2-rc2-77-gf760b87f8f12
 
+* Wed Jul 15 2015 Josh Boyer <jwboyer@fedoraproject.org>
+- Drop kdbus as it wasn't merged in time for f23
+
 * Tue Jul 14 2015 Peter Robinson <pbrobinson@fedoraproject.org>
 - Update AMD Seattle a0 eth driver for 4.2
 
@@ -3744,6 +3929,9 @@ fi
 * Wed Jul 01 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.2.0-0.rc0.git4.1
 - Linux v4.1-11549-g05a8256c586a
 
+#* Tue Jun 30 2015 Pavel Alexeev <Pahan@Hubbitus.info> - 4.0.5.hu.2.pf6.fc22
+#- Pf still against 4.0.5 v4.0-pf6: https://pf.natalenko.name/forum/index.php?topic=324, so just ne build to incorporate upstream fedora patches.
+
 * Tue Jun 30 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.2.0-0.rc0.git3.1
 - Linux v4.1-11355-g6aaf0da8728c
 - Add patch to fix KVM sleeping in atomic issue (rhbz 1237143)
@@ -3778,6 +3966,10 @@ fi
 * Mon Jun 15 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.1.0-0.rc8.git0.1
 - Linux v4.1-rc8
 
+#* Sun Jun 14 2015 Pavel Alexeev <Pahan@Hubbitus.info> - 4.0.4-303.hu.1.pf6.fc22
+#- Upgrade to Fedora 22. Start f22-pf branch for kernels. First attempt build. Port changes from f21.
+#- 4.0.4-303.hu.1.pf6
+
 * Fri Jun 12 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.1.0-0.rc7.git1.1
 - Linux v4.1-rc7-72-gdf5f4158415b
 

kvm-vmx-more-complete-state-update-on-APICv-on-off.patch

@@ -0,0 +1,112 @@
+From: Roman Kagan <rkagan@virtuozzo.com>
+Subject: [PATCH v3] kvm:vmx: more complete state update on APICv on/off
+Date: 2016-05-18 14:48:20 GMT (1 day, 21 hours and 23 minutes ago)
+
+The function to update APICv on/off state (in particular, to deactivate
+it when enabling Hyper-V SynIC), used to be incomplete: it didn't adjust
+APICv-related fields among secondary processor-based VM-execution
+controls.
+
+As a result, Windows 2012 guests would get stuck when SynIC-based
+auto-EOI interrupt intersected with e.g. an IPI in the guest.
+
+In addition, the MSR intercept bitmap wasn't updated to correspond to
+whether "virtualize x2APIC mode" was enabled.  This path used not to be
+triggered, since Windows didn't use x2APIC but rather their own
+synthetic APIC access MSRs; however it represented a security risk
+because the guest running in a SynIC-enabled VM could switch to x2APIC
+and thus obtain direct access to host APIC MSRs (thanks to Yang Zhang
+<yang.zhang.wz@gmail.com> for spotting this).
+
+The patch fixes those omissions.
+
+Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>
+Cc: Steve Rutherford <srutherford@google.com>
+Cc: Yang Zhang <yang.zhang.wz@gmail.com>
+---
+v2 -> v3:
+ - only switch to x2apic msr bitmap if virtualize x2apic mode is on in vmcs
+
+v1 -> v2:
+ - only update relevant bits in the secondary exec control
+ - update msr intercept bitmap (also make x2apic msr bitmap always
+   correspond to APICv)
+
+ arch/x86/kvm/vmx.c | 48 ++++++++++++++++++++++++++++++------------------
+ 1 file changed, 30 insertions(+), 18 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index ee1c8a9..cef741a 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2418,7 +2418,9 @@ static void vmx_set_msr_bitmap(struct kvm_vcpu *vcpu)
+
+ 	if (is_guest_mode(vcpu))
+ 		msr_bitmap = vmx_msr_bitmap_nested;
+-	else if (vcpu->arch.apic_base & X2APIC_ENABLE) {
++	else if (cpu_has_secondary_exec_ctrls() &&
++		 (vmcs_read32(SECONDARY_VM_EXEC_CONTROL) &
++		  SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE)) {
+ 		if (is_long_mode(vcpu))
+ 			msr_bitmap = vmx_msr_bitmap_longmode_x2apic;
+ 		else
+@@ -4783,6 +4785,19 @@ static void vmx_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+
+ 	vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, vmx_pin_based_exec_ctrl(vmx));
++	if (cpu_has_secondary_exec_ctrls()) {
++		if (kvm_vcpu_apicv_active(vcpu))
++			vmcs_set_bits(SECONDARY_VM_EXEC_CONTROL,
++				      SECONDARY_EXEC_APIC_REGISTER_VIRT |
++				      SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++		else
++			vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL,
++					SECONDARY_EXEC_APIC_REGISTER_VIRT |
++					SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++	}
++
++	if (cpu_has_vmx_msr_bitmap())
++		vmx_set_msr_bitmap(vcpu);
+ }
+
+ static u32 vmx_exec_control(struct vcpu_vmx *vmx)
+@@ -6329,23 +6344,20 @@ static __init int hardware_setup(void)
+
+ 	set_bit(0, vmx_vpid_bitmap); /* 0 is reserved for host */
+
+-	if (enable_apicv) {
+-		for (msr = 0x800; msr <= 0x8ff; msr++)
+-			vmx_disable_intercept_msr_read_x2apic(msr);
+-
+-		/* According SDM, in x2apic mode, the whole id reg is used.
+-		 * But in KVM, it only use the highest eight bits. Need to
+-		 * intercept it */
+-		vmx_enable_intercept_msr_read_x2apic(0x802);
+-		/* TMCCT */
+-		vmx_enable_intercept_msr_read_x2apic(0x839);
+-		/* TPR */
+-		vmx_disable_intercept_msr_write_x2apic(0x808);
+-		/* EOI */
+-		vmx_disable_intercept_msr_write_x2apic(0x80b);
+-		/* SELF-IPI */
+-		vmx_disable_intercept_msr_write_x2apic(0x83f);
+-	}
++	for (msr = 0x800; msr <= 0x8ff; msr++)
++		vmx_disable_intercept_msr_read_x2apic(msr);
++
++	/* According SDM, in x2apic mode, the whole id reg is used.  But in
++	 * KVM, it only use the highest eight bits. Need to intercept it */
++	vmx_enable_intercept_msr_read_x2apic(0x802);
++	/* TMCCT */
++	vmx_enable_intercept_msr_read_x2apic(0x839);
++	/* TPR */
++	vmx_disable_intercept_msr_write_x2apic(0x808);
++	/* EOI */
++	vmx_disable_intercept_msr_write_x2apic(0x80b);
++	/* SELF-IPI */
++	vmx_disable_intercept_msr_write_x2apic(0x83f);
+
+ 	if (enable_ept) {
+ 		kvm_mmu_set_mask_ptes(0ull,
+-- 
+2.5.5

mm-thp-kvm-fix-memory-corruption-in-KVM-with-THP-ena.patch

@@ -0,0 +1,126 @@
+From 94f984ff563d1777652b822d7a282cacc1e481c2 Mon Sep 17 00:00:00 2001
+From: Andrea Arcangeli <aarcange@redhat.com>
+Date: Wed, 27 Apr 2016 12:04:46 -0500
+Subject: [PATCH] mm: thp: kvm: fix memory corruption in KVM with THP enabled
+
+After the THP refcounting change, obtaining a compound pages from
+get_user_pages() no longer allows us to assume the entire compound
+page is immediately mappable from a secondary MMU.
+
+A secondary MMU doesn't want to call get_user_pages() more than once
+for each compound page, in order to know if it can map the whole
+compound page. So a secondary MMU needs to know from a single
+get_user_pages() invocation when it can map immediately the entire
+compound page to avoid a flood of unnecessary secondary MMU faults and
+spurious atomic_inc()/atomic_dec() (pages don't have to be pinned by
+MMU notifier users).
+
+Ideally instead of the page->_mapcount < 1 check, get_user_pages()
+should return the granularity of the "page" mapping in the "mm" passed
+to get_user_pages(). However it's non trivial change to pass the "pmd"
+status belonging to the "mm" walked by get_user_pages up the stack (up
+to the caller of get_user_pages). So the fix just checks if there is
+not a single pte mapping on the page returned by get_user_pages, and
+in turn if the caller can assume that the whole compound page is
+mapped in the current "mm" (in a pmd_trans_huge()). In such case the
+entire compound page is safe to map into the secondary MMU without
+additional get_user_pages() calls on the surrounding tail/head
+pages. In addition of being faster, not having to run other
+get_user_pages() calls also reduces the memory footprint of the
+secondary MMU fault in case the pmd split happened as result of memory
+pressure.
+
+Without this fix after a MADV_DONTNEED (like invoked by QEMU during
+postcopy live migration or balloning) or after generic swapping (with
+a failure in split_huge_page() that would only result in pmd splitting
+and not a physical page split), KVM would map the whole compound page
+into the shadow pagetables, despite regular faults or userfaults (like
+UFFDIO_COPY) may map regular pages into the primary MMU as result of
+the pte faults, leading to the guest mode and userland mode going out
+of sync and not working on the same memory at all times.
+
+Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
+---
+ arch/arm/kvm/mmu.c         |  2 +-
+ arch/x86/kvm/mmu.c         |  4 ++--
+ include/linux/page-flags.h | 22 ++++++++++++++++++++++
+ 3 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index aba61fd..8dafe97 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -997,7 +997,7 @@ static bool transparent_hugepage_adjust(kvm_pfn_t *pfnp, phys_addr_t *ipap)
+ 	kvm_pfn_t pfn = *pfnp;
+ 	gfn_t gfn = *ipap >> PAGE_SHIFT;
+
+-	if (PageTransCompound(pfn_to_page(pfn))) {
++	if (PageTransCompoundMap(pfn_to_page(pfn))) {
+ 		unsigned long mask;
+ 		/*
+ 		 * The address we faulted on is backed by a transparent huge
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 1e7a49b..3a371f7 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2767,7 +2767,7 @@ static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
+ 	 */
+ 	if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn) &&
+ 	    level == PT_PAGE_TABLE_LEVEL &&
+-	    PageTransCompound(pfn_to_page(pfn)) &&
++	    PageTransCompoundMap(pfn_to_page(pfn)) &&
+ 	    !has_wrprotected_page(vcpu, gfn, PT_DIRECTORY_LEVEL)) {
+ 		unsigned long mask;
+ 		/*
+@@ -4621,7 +4621,7 @@ restart:
+ 		 */
+ 		if (sp->role.direct &&
+ 			!kvm_is_reserved_pfn(pfn) &&
+-			PageTransCompound(pfn_to_page(pfn))) {
++			PageTransCompoundMap(pfn_to_page(pfn))) {
+ 			drop_spte(kvm, sptep);
+ 			need_tlb_flush = 1;
+ 			goto restart;
+diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
+index 19724e6..522bd6d 100644
+--- a/include/linux/page-flags.h
++++ b/include/linux/page-flags.h
+@@ -517,6 +517,27 @@ static inline int PageTransCompound(struct page *page)
+ }
+
+ /*
++ * PageTransCompoundMap is the same as PageTransCompound, but it also
++ * guarantees the primary MMU has the entire compound page mapped
++ * through pmd_trans_huge, which in turn guarantees the secondary MMUs
++ * can also map the entire compound page. This allows the secondary
++ * MMUs to call get_user_pages() only once for each compound page and
++ * to immediately map the entire compound page with a single secondary
++ * MMU fault. If there will be a pmd split later, the secondary MMUs
++ * will get an update through the MMU notifier invalidation through
++ * split_huge_pmd().
++ *
++ * Unlike PageTransCompound, this is safe to be called only while
++ * split_huge_pmd() cannot run from under us, like if protected by the
++ * MMU notifier, otherwise it may result in page->_mapcount < 0 false
++ * positives.
++ */
++static inline int PageTransCompoundMap(struct page *page)
++{
++	return PageTransCompound(page) && atomic_read(&page->_mapcount) < 0;
++}
++
++/*
+  * PageTransTail returns true for both transparent huge pages
+  * and hugetlbfs pages, so it should only be called when it's known
+  * that hugetlbfs pages aren't involved.
+@@ -559,6 +580,7 @@ static inline int TestClearPageDoubleMap(struct page *page)
+ #else
+ TESTPAGEFLAG_FALSE(TransHuge)
+ TESTPAGEFLAG_FALSE(TransCompound)
++TESTPAGEFLAG_FALSE(TransCompoundMap)
+ TESTPAGEFLAG_FALSE(TransTail)
+ TESTPAGEFLAG_FALSE(DoubleMap)
+ 	TESTSETFLAG_FALSE(DoubleMap)
+-- 
+2.7.4
+

net-inet-fix-race-in-reqsk_queue_unlink.patch

@@ -0,0 +1,76 @@
+From patchwork Thu Oct  1 12:39:26 2015
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [net] inet: fix race in reqsk_queue_unlink()
+From: Eric Dumazet <eric.dumazet@gmail.com>
+X-Patchwork-Id: 524966
+Message-Id: <1443703166.32531.47.camel@edumazet-glaptop2.roam.corp.google.com>
+To: David Miller <davem@davemloft.net>
+Cc: netdev <netdev@vger.kernel.org>, Yuchung Cheng <ycheng@google.com>
+Date: Thu, 01 Oct 2015 05:39:26 -0700
+
+From: Eric Dumazet <edumazet@google.com>
+
+reqsk_timer_handler() tests if icsk_accept_queue.listen_opt
+is NULL at its beginning.
+
+By the time it calls inet_csk_reqsk_queue_drop() and
+reqsk_queue_unlink(), listener might have been closed and
+inet_csk_listen_stop() had called reqsk_queue_yank_acceptq()
+which sets icsk_accept_queue.listen_opt to NULL
+
+We therefore need to correctly check listen_opt being NULL
+after holding syn_wait_lock for proper synchronization.
+
+Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer")
+Fixes: b357a364c57c ("inet: fix possible panic in reqsk_queue_unlink()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+---
+ net/ipv4/inet_connection_sock.c |   19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+
+
+--
+To unsubscribe from this list: send the line "unsubscribe netdev" in
+the body of a message to majordomo@vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 7bb9c39e0a4d..61b45a17fc73 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -577,21 +577,22 @@ EXPORT_SYMBOL(inet_rtx_syn_ack);
+ static bool reqsk_queue_unlink(struct request_sock_queue *queue,
+ 			       struct request_sock *req)
+ {
+-	struct listen_sock *lopt = queue->listen_opt;
+ 	struct request_sock **prev;
++	struct listen_sock *lopt;
+ 	bool found = false;
+ 
+ 	spin_lock(&queue->syn_wait_lock);
+-
+-	for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL;
+-	     prev = &(*prev)->dl_next) {
+-		if (*prev == req) {
+-			*prev = req->dl_next;
+-			found = true;
+-			break;
++	lopt = queue->listen_opt;
++	if (lopt) {
++		for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL;
++		     prev = &(*prev)->dl_next) {
++			if (*prev == req) {
++				*prev = req->dl_next;
++				found = true;
++				break;
++			}
+ 		}
+ 	}
+-
+ 	spin_unlock(&queue->syn_wait_lock);
+ 	if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
+ 		reqsk_put(req);

netfilter-x_tables-check-for-size-overflow.patch

@@ -0,0 +1,31 @@
+Subject:    [PATCH nf] netfilter: x_tables: check for size overflow
+From:       Florian Westphal <fw () strlen ! de>
+Date:       2016-03-10 0:56:23
+
+Ben Hawkes says:
+ integer overflow in xt_alloc_table_info, which on 32-bit systems can
+ lead to small structure allocation and a copy_from_user based heap
+ corruption.
+
+Reported-by: Ben Hawkes <hawkes@google.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+---
+ net/netfilter/x_tables.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index c8a0b7d..17a9a9f 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -659,6 +659,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
+ 	struct xt_table_info *info = NULL;
+ 	size_t sz = sizeof(*info) + size;
+ 
++	if (sz < sizeof(*info))
++		return NULL;
++
+ 	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
+ 	if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
+ 		return NULL;
+-- 
+2.4.10

nouveau-add-maxwell-to-backlight-init.patch

@@ -0,0 +1,24 @@
+From bbe1f94a8b3f2e8622dd400a6827d3242005d951 Mon Sep 17 00:00:00 2001
+From: Faris Alsalama <farisbenbrahem@gmail.com>
+Date: Sat, 21 May 2016 14:41:43 -0400
+Subject: drm/nouveau/kms: add Maxwell to backlight initialization
+
+Signed-off-by: Faris Alsalama <farisbenbrahem@gmail.com>
+Acked-by: Acked-by: Pierre Moreau <pierre.morrow@free.fr>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
+index f5101be..5e2c568 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
+@@ -232,6 +232,7 @@ nouveau_backlight_init(struct drm_device *dev)
+ 		case NV_DEVICE_INFO_V0_TESLA:
+ 		case NV_DEVICE_INFO_V0_FERMI:
+ 		case NV_DEVICE_INFO_V0_KEPLER:
++		case NV_DEVICE_INFO_V0_MAXWELL:
+ 			return nv50_backlight_init(connector);
+ 		default:
+ 			break;
+-- 
+cgit v0.10.2
+

nv46-Change-mc-subdev-oclass-from-nv44-to-nv4c.patch

@@ -0,0 +1,33 @@
+From 16f4f5f0dc33698b841bce71cbc0dd991935b7e1 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 23 Jul 2015 17:20:12 +0200
+Subject: [PATCH] nv46: Change mc subdev oclass from nv44 to nv4c
+
+MSI interrupts appear to not work for nv46 based cards. Change the mc
+subdev oclass for these cards from nv44 to nv4c, the nv4c mc code is
+identical to the nv44 mc code except that it does not use msi
+(it does not define a msi_rearm callback).
+
+BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=90435
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/device/nv40.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/nv40.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/nv40.c
+index c6301361d14f..b4ad791b4851 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/nv40.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/nv40.c
+@@ -265,7 +265,7 @@ nv40_identify(struct nvkm_device *device)
+ 		device->oclass[NVDEV_SUBDEV_CLK    ] = &nv40_clk_oclass;
+ 		device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
+ 		device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
+-		device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
++		device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
+ 		device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
+ 		device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
+ 		device->oclass[NVDEV_SUBDEV_FB     ] =  nv46_fb_oclass;
+-- 
+2.4.3
+

ovl-fix-permission-checking-for-setattr.patch

@@ -0,0 +1,46 @@
+From acff81ec2c79492b180fade3c2894425cd35a545 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <miklos@szeredi.hu>
+Date: Fri, 4 Dec 2015 19:18:48 +0100
+Subject: [PATCH] ovl: fix permission checking for setattr
+
+[Al Viro] The bug is in being too enthusiastic about optimizing ->setattr()
+away - instead of "copy verbatim with metadata" + "chmod/chown/utimes"
+(with the former being always safe and the latter failing in case of
+insufficient permissions) it tries to combine these two.  Note that copyup
+itself will have to do ->setattr() anyway; _that_ is where the elevated
+capabilities are right.  Having these two ->setattr() (one to set verbatim
+copy of metadata, another to do what overlayfs ->setattr() had been asked
+to do in the first place) combined is where it breaks.
+
+Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+---
+ fs/overlayfs/inode.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index ec0c2a050043..961284936917 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -49,13 +49,13 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
+ 	if (err)
+ 		goto out;
+ 
+-	upperdentry = ovl_dentry_upper(dentry);
+-	if (upperdentry) {
++	err = ovl_copy_up(dentry);
++	if (!err) {
++		upperdentry = ovl_dentry_upper(dentry);
++
+ 		mutex_lock(&upperdentry->d_inode->i_mutex);
+ 		err = notify_change(upperdentry, attr, NULL);
+ 		mutex_unlock(&upperdentry->d_inode->i_mutex);
+-	} else {
+-		err = ovl_copy_up_last(dentry, attr, false);
+ 	}
+ 	ovl_drop_write(dentry);
+ out:
+-- 
+2.5.0
+

rds-fix-an-infoleak-in-rds_inc_info_copy.txt

@@ -0,0 +1,31 @@
+From 4116def2337991b39919f3b448326e21c40e0dbb Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kangjielu@gmail.com>
+Date: Thu, 2 Jun 2016 04:11:20 -0400
+Subject: rds: fix an infoleak in rds_inc_info_copy
+
+The last field "flags" of object "minfo" is not initialized.
+Copying this object out may leak kernel stack data.
+Assign 0 to it to avoid leak.
+
+Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/rds/recv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/recv.c b/net/rds/recv.c
+index c0be1ec..8413f6c 100644
+--- a/net/rds/recv.c
++++ b/net/rds/recv.c
+@@ -561,5 +561,7 @@ void rds_inc_info_copy(struct rds_incoming *inc,
+ 		minfo.fport = inc->i_hdr.h_dport;
+ 	}
+ 
++	minfo.flags = 0;
++
+ 	rds_info_copy(iter, &minfo, sizeof(minfo));
+ }
+-- 
+cgit v0.12
+

regulator-axp20x-module-alias.patch

@@ -0,0 +1,26 @@
+From d4ea7d86457a8d0ea40ce77bdeda1fc966cc35ec Mon Sep 17 00:00:00 2001
+From: Ian Campbell <ijc@hellion.org.uk>
+Date: Sat, 1 Aug 2015 18:13:25 +0100
+Subject: regulator: axp20x: Add module alias
+
+This allows the module to be autoloaded.
+
+Together with 07949bf9c63c ("cpufreq: dt: allow driver to boot
+automatically") this is sufficient to allow a modular kernel (such
+as Debian's) to enable cpufreq on a Cubietruck.
+
+Signed-off-by: Ian Campbell <ijc@hellion.org.uk>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+
+diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
+index 6468291..01bf347 100644
+--- a/drivers/regulator/axp20x-regulator.c
++++ b/drivers/regulator/axp20x-regulator.c
+@@ -405,3 +405,4 @@ module_platform_driver(axp20x_regulator_driver);
+ MODULE_LICENSE("GPL v2");
+ MODULE_AUTHOR("Carlo Caione <carlo@caione.org>");
+ MODULE_DESCRIPTION("Regulator Driver for AXP20X PMIC");
++MODULE_ALIAS("platform:axp20x-regulator");
+-- 
+cgit v0.10.2
+

revert-stmmac-Fix-eth0-No-PHY-found-regression.patch

@@ -0,0 +1,87 @@
+From 44f947bb8ef5f4add9f2d84e1ff53afd8f2f5537 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Wed, 16 Mar 2016 15:21:44 +0000
+Subject: [PATCH 1/2] Revert "stmmac: Fix 'eth0: No PHY found' regression"
+
+This reverts commit 88f8b1bb41c6208f81b6a480244533ded7b59493.
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c     | 11 ++++++++++-
+ drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c |  9 +--------
+ include/linux/stmmac.h                                |  1 -
+ 3 files changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+index efb54f3..0faf163 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+@@ -199,12 +199,21 @@ int stmmac_mdio_register(struct net_device *ndev)
+ 	struct stmmac_priv *priv = netdev_priv(ndev);
+ 	struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
+ 	int addr, found;
+-	struct device_node *mdio_node = priv->plat->mdio_node;
++	struct device_node *mdio_node = NULL;
++	struct device_node *child_node = NULL;
+ 
+ 	if (!mdio_bus_data)
+ 		return 0;
+ 
+ 	if (IS_ENABLED(CONFIG_OF)) {
++		for_each_child_of_node(priv->device->of_node, child_node) {
++			if (of_device_is_compatible(child_node,
++						    "snps,dwmac-mdio")) {
++				mdio_node = child_node;
++				break;
++			}
++		}
++
+ 		if (mdio_node) {
+ 			netdev_dbg(ndev, "FOUND MDIO subnode\n");
+ 		} else {
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 4514ba7..6a52fa1 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -110,7 +110,6 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
+ 	struct device_node *np = pdev->dev.of_node;
+ 	struct plat_stmmacenet_data *plat;
+ 	struct stmmac_dma_cfg *dma_cfg;
+-	struct device_node *child_node = NULL;
+ 
+ 	plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL);
+ 	if (!plat)
+@@ -141,19 +140,13 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
+ 		plat->phy_node = of_node_get(np);
+ 	}
+ 
+-	for_each_child_of_node(np, child_node)
+-		if (of_device_is_compatible(child_node,	"snps,dwmac-mdio")) {
+-			plat->mdio_node = child_node;
+-			break;
+-		}
+-
+ 	/* "snps,phy-addr" is not a standard property. Mark it as deprecated
+ 	 * and warn of its use. Remove this when phy node support is added.
+ 	 */
+ 	if (of_property_read_u32(np, "snps,phy-addr", &plat->phy_addr) == 0)
+ 		dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n");
+ 
+-	if ((plat->phy_node && !of_phy_is_fixed_link(np)) || !plat->mdio_node)
++	if ((plat->phy_node && !of_phy_is_fixed_link(np)) || plat->phy_bus_name)
+ 		plat->mdio_bus_data = NULL;
+ 	else
+ 		plat->mdio_bus_data =
+diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
+index 881a79d..eead8ab 100644
+--- a/include/linux/stmmac.h
++++ b/include/linux/stmmac.h
+@@ -100,7 +100,6 @@ struct plat_stmmacenet_data {
+ 	int interface;
+ 	struct stmmac_mdio_bus_data *mdio_bus_data;
+ 	struct device_node *phy_node;
+-	struct device_node *mdio_node;
+ 	struct stmmac_dma_cfg *dma_cfg;
+ 	int clk_csr;
+ 	int has_gmac;
+-- 
+2.5.0
+

scripts/add-changelog.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Emulate the changelog part of rpmdev-bumpspec without the bumping of the
+# rev. Because Laura keeps typoing her name and the date.
+
+CURDATE=`date +"%a %b %d %Y"`
+PACKAGER=`rpmdev-packager`
+CHANGELOG="%changelog\n* $CURDATE $PACKAGER\n- $1\n"
+
+awk -v CHANGE="$CHANGELOG" '/%changelog/ {print CHANGE} \
+			!/%changelog/ { print $0 }' \
+			< kernel.spec > kernel.spec.tmp
+mv kernel.spec.tmp kernel.spec

scripts/fixup-bumpspec.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+# rpmdev-bumpspec 'helpfully' bumps the release which we don't always want.
+# This script fixes it up.
+
+RELEASE=`grep "%global baserelease" kernel.spec | cut -d ' ' -f 3`
+export RELEASE=$(($RELEASE-1))
+perl -p -i -e 's|%global baserelease.*|%global baserelease $ENV{'RELEASE'}|' kernel.spec
+TODAY=`date +"%a %b %d %Y"`
+awk -v DATE="$TODAY" 'START { marked = 0; } $0 ~ DATE { if (marked == 1) { print $0 } else {out=$1; for(i = 2; i <= NF - 2; i++) { out=out" "$i } print out; marked = 1;  } } $0 !~ DATE { print $0; }' < kernel.spec > kernel.spec.tmp
+mv kernel.spec.tmp kernel.spec

scripts/kernel-version.sh

@@ -0,0 +1,8 @@
+VER=$(grep patch sources | head -n1 | awk '{ print $2 }' | sed s/patch-// | sed s/-git.*// | sed s/.xz//)
+
+if [ -z "$VER" ] ;
+then
+    VER=$(grep linux sources | head -1 | awk '{ print $2 }' | sed s/linux-// | sed s/.tar.xz//)
+fi
+
+

scripts/rawhide-rc.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Generate a commit for a rawhide RC release
+
+source scripts/kernel-version.sh
+
+make release
+# fixup the release because rpmdev-bumpspec *sigh*
+scripts/fixup-bumpspec.sh
+fedpkg commit -c
+
+# Figure out what is our RC
+RC=`grep "%define rcrev" kernel.spec| cut -d ' ' -f 3`
+RC=$(($RC+1))
+BASE=`grep "%define base_sublevel" kernel.spec| cut -d ' ' -f 3`
+
+# Kill all patches
+awk '!/patch/ { print $0 }' < sources > sources.tmp
+mv sources.tmp sources
+
+# Grab the tarball
+if [ ! -f patch-4.$BASE-rc$RC.xz ]; then
+	wget https://cdn.kernel.org/pub/linux/kernel/v4.x/testing/patch-4.$BASE-rc$RC.xz
+	if [ ! $? -eq 0 ]; then
+		exit 1
+	fi
+	fedpkg upload patch-4.$BASE-rc$RC.xz
+fi
+
+# bump rcrev in the spec and set git snapshot to 0
+RC=$RC perl -p -i -e 's|%define rcrev.*|%global rcrev $ENV{'RC'}|' kernel.spec
+
+perl -p -i -e 's|%define gitrev.*|%define gitrev 0|' kernel.spec
+
+perl -p -i -e 's|%global baserelease.*|%global baserelease 0|' kernel.spec
+
+rpmdev-bumpspec -c "Linux v4.$BASE-rc$RC" kernel.spec

scripts/rawhide-snapshot.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+# A coffeeproof rawhide script. You should be able to run this before the
+# coffee has kicked in and generate a good rawhide commit.
+#
+# - Updates the local Fedora tree to master and verifies that you are working
+#   off of the correct master
+# - Updates the upstream tree to the latest master.
+# - Generates a git snapshot via generate-git-snapshot.sh
+# - Clears out old git snapshots from the sources
+# - Uploads the new snapshot
+
+source scripts/kernel-version.sh
+
+git fetch origin
+if [ "$(git rev-parse origin/master)" != "$(git rev-parse HEAD)" ]; then
+	echo "I just did a git fetch and this branch does not match master"
+	echo "Re-check out this branch to work off of the latest master"
+	exit 1
+fi
+
+if [ ! -d "$LINUX_GIT" ]; then
+	echo "error: set \$LINUX_GIT to point at an upstream git tree"
+	exit 1
+fi
+
+git -C $LINUX_GIT pull
+if [ ! $? -eq 0 ]; then
+	echo "Git pull failed. Is your tree clean/correct?"
+	exit 1
+fi
+
+git -C $LINUX_GIT describe --tags HEAD | grep -q "\-g"
+if [ ! $? -eq 0 ]; then
+	echo "Trying to snapshot off of a tagged git."
+	echo "I don't think this is what you want"
+	exit 1
+fi
+
+if [ "$(git -C $LINUX_GIT rev-parse origin/master)" == `cat gitrev` ]; then
+	echo "Last snapshot commit matches current master. Nothing to do"
+	echo "\o/"
+	exit 0
+fi
+
+GIT=`grep "%define gitrev" kernel.spec | cut -d ' ' -f 3`
+if [ "$GIT" -eq 0 ]; then
+	make debug
+	./scripts/fixup-bumpspec.sh
+	fedpkg commit -c
+fi
+
+./scripts/generate-git-snapshot.sh
+
+#Nuke the old patch from the source
+awk '!/git/ { print $0 }' < sources > sources.tmp
+mv sources.tmp sources
+
+GIT=`grep "%define gitrev" kernel.spec | cut -d ' ' -f 3`
+fedpkg upload patch-$VER-git$GIT.xz

scripts/stable-update.sh

@@ -0,0 +1,67 @@
+#!/bin/sh
+#
+# Author: Laura Abbott <labbott@fedoraproject.org>
+#
+# Apply a stable patch update to the Fedora tree. This takes care of
+# - Downloading the patch from kernel.org
+# - Uploading the source file
+# - Removing old patch files
+# - Updating the spec file stable version
+# - Adding a proper changelog entry
+#
+# Based on steps from https://fedoraproject.org/wiki/Kernel/DayToDay#Stable_kernel_update
+#
+# Args: Stable version to update (e.g. 4.7.7, 4.8.1)
+
+if [ $# -lt 1 ]; then
+	echo "Need a version"
+	exit 1
+fi
+
+VERSION=`echo $1 | cut -d . -f 1`
+if [ -z $VERSION ]; then
+	echo "Malformed version $1"
+	exit 1
+fi
+PATCHLEVEL=`echo $1 | cut -d . -f 2`
+if [ -z $VERSION ]; then
+	echo "Malformed version $1"
+	exit 1
+fi
+SUBLEVEL=`echo $1 | cut -d . -f 3`
+if [ -z $VERSION ]; then
+	echo "Malformed version $1"
+	exit 1
+fi
+
+if [ ! -f patch-$1.xz ]; then
+	wget https://cdn.kernel.org/pub/linux/kernel/v4.x/patch-$1.xz
+	if [ ! $? -eq 0 ]; then
+		echo "Download fail"
+		exit 1
+	fi
+fi
+
+grep $1 sources &> /dev/null
+if [ ! $? -eq 0 ]; then
+	fedpkg upload patch-$1.xz
+
+	# Cryptic awk: search for the previous patch level (if one exists) and
+	# remove it from the source file
+	awk -v VER=$VERSION.$PATCHLEVEL.$((SUBLEVEL-1)) '$0 !~ VER { print $0; }' < sources > sources.tmp
+	mv sources.tmp sources
+fi
+
+# Update the stable level
+awk -v STABLE=$SUBLEVEL '/%define stable_update/ \
+			{ print "%define stable_update " STABLE } \
+			!/%define stable_update/ { print $0 }' \
+			< kernel.spec > kernel.spec.tmp
+mv kernel.spec.tmp kernel.spec
+
+# Reset the base release for use with rpmdev-bumpspec
+BASERELEASE=`cat kernel.spec | grep "%global baserelease" | cut -d ' ' -f 3 | head -c 1`00
+BASERELEASE=$(($BASERELEASE-1))
+BASERELEASE=$BASERELEASE perl -p -i -e 's|%global baserelease.*|%global baserelease $ENV{'BASERELEASE'}|' kernel.spec
+
+rpmdev-bumpspec -c "Linux v$1" kernel.spec

si2157-Bounds-check-firmware.patch

@@ -0,0 +1,39 @@
+From 526fbce5b0e44c67a97c57656b3be9911f0a9b9b Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@fedoraproject.org>
+Date: Tue, 29 Sep 2015 16:59:20 -0700
+Subject: [PATCH 2/2] si2157: Bounds check firmware
+To: Antti Palosaari <crope@iki.fi>
+To: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Cc: Olli Salonen <olli.salonen@iki.fi>
+Cc: linux-media@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+
+When reading the firmware and sending commands, the length
+must be bounds checked to avoid overrunning the size of the command
+buffer and smashing the stack if the firmware is not in the
+expected format. Add the proper check.
+
+Cc: stable@kernel.org
+Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
+---
+ drivers/media/tuners/si2157.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
+index 5073821..ce157ed 100644
+--- a/drivers/media/tuners/si2157.c
++++ b/drivers/media/tuners/si2157.c
+@@ -166,6 +166,10 @@ static int si2157_init(struct dvb_frontend *fe)
+ 
+ 	for (remaining = fw->size; remaining > 0; remaining -= 17) {
+ 		len = fw->data[fw->size - remaining];
++		if (len > SI2157_ARGLEN) {
++			dev_err(&client->dev, "Bad firmware length\n");
++			goto err_release_firmware;
++		}
+ 		memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
+ 		cmd.wlen = len;
+ 		cmd.rlen = 1;
+-- 
+2.4.3
+

si2168-Bounds-check-firmware.patch

@@ -0,0 +1,50 @@
+From 43018528944fa4965a4048fee91d76b47dcaf60e Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@fedoraproject.org>
+Date: Mon, 28 Sep 2015 14:10:34 -0700
+Subject: [PATCH 1/2] si2168: Bounds check firmware
+To: Antti Palosaari <crope@iki.fi>
+To: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Cc: Olli Salonen <olli.salonen@iki.fi>
+Cc: linux-media@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: Stuart Auchterlonie <sauchter@redhat.com>
+
+
+When reading the firmware and sending commands, the length must
+be bounds checked to avoid overrunning the size of the command
+buffer and smashing the stack if the firmware is not in the expected
+format:
+
+si2168 11-0064: found a 'Silicon Labs Si2168-B40'
+si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
+si2168 11-0064: firmware download failed -95
+Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f
+
+Add the proper check.
+
+Cc: stable@kernel.org
+Reported-by: Stuart Auchterlonie <sauchter@redhat.com>
+Reviewed-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
+---
+ drivers/media/dvb-frontends/si2168.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c
+index 81788c5..821a8f4 100644
+--- a/drivers/media/dvb-frontends/si2168.c
++++ b/drivers/media/dvb-frontends/si2168.c
+@@ -502,6 +502,10 @@ static int si2168_init(struct dvb_frontend *fe)
+ 		/* firmware is in the new format */
+ 		for (remaining = fw->size; remaining > 0; remaining -= 17) {
+ 			len = fw->data[fw->size - remaining];
++			if (len > SI2168_ARGLEN) {
++				ret = -EINVAL;
++				break;
++			}
+ 			memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
+ 			cmd.wlen = len;
+ 			cmd.rlen = 1;
+-- 
+2.4.3
+

sources

@@ -1,2 +1,3 @@
 c1af0afbd3df35c1ccdc7a5118cd2d07  linux-4.8.tar.xz
 0dad03f586e835d538d3e0d2cbdb9a28  perf-man-4.8.tar.gz
+37eadcdaefae51ced736747cb817aa58  patch-4.8.10.xz

stmmac-fix-MDIO-settings.patch

@@ -0,0 +1,235 @@
+From d55a02f460ffd64a5ba7f331489af87edeebf8da Mon Sep 17 00:00:00 2001
+From: Giuseppe CAVALLARO <peppe.cavallaro@st.com>
+Date: Wed, 16 Mar 2016 10:38:49 +0100
+Subject: [PATCH 2/2] stmmac: fix MDIO settings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Initially the phy_bus_name was added to manipulate the
+driver name but it was recently just used to manage the
+fixed-link and then to take some decision at run-time.
+So the patch uses the is_pseudo_fixed_link and removes
+the phy_bus_name variable not necessary anymore.
+
+The driver can manage the mdio registration by using phy-handle,
+dwmac-mdio and own parameter e.g. snps,phy-addr.
+This patch takes care about all these possible configurations
+and fixes the mdio registration in case of there is a real
+transceiver or a switch (that needs to be managed by using
+fixed-link).
+
+Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Reviewed-by: Andreas Färber <afaerber@suse.de>
+Tested-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Cc: Gabriel Fernandez <gabriel.fernandez@linaro.org>
+Cc: Dinh Nguyen <dinh.linux@gmail.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Phil Reid <preid@electromag.com.au>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  | 11 +--
+ drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c  | 19 +----
+ .../net/ethernet/stmicro/stmmac/stmmac_platform.c  | 84 +++++++++++++++++-----
+ include/linux/stmmac.h                             |  2 +-
+ 4 files changed, 71 insertions(+), 45 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index c21015b..389d7d0 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -271,7 +271,6 @@ static void stmmac_eee_ctrl_timer(unsigned long arg)
+  */
+ bool stmmac_eee_init(struct stmmac_priv *priv)
+ {
+-	char *phy_bus_name = priv->plat->phy_bus_name;
+ 	unsigned long flags;
+ 	bool ret = false;
+ 
+@@ -283,7 +282,7 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
+ 		goto out;
+ 
+ 	/* Never init EEE in case of a switch is attached */
+-	if (phy_bus_name && (!strcmp(phy_bus_name, "fixed")))
++	if (priv->phydev->is_pseudo_fixed_link)
+ 		goto out;
+ 
+ 	/* MAC core supports the EEE feature. */
+@@ -820,12 +819,8 @@ static int stmmac_init_phy(struct net_device *dev)
+ 		phydev = of_phy_connect(dev, priv->plat->phy_node,
+ 					&stmmac_adjust_link, 0, interface);
+ 	} else {
+-		if (priv->plat->phy_bus_name)
+-			snprintf(bus_id, MII_BUS_ID_SIZE, "%s-%x",
+-				 priv->plat->phy_bus_name, priv->plat->bus_id);
+-		else
+-			snprintf(bus_id, MII_BUS_ID_SIZE, "stmmac-%x",
+-				 priv->plat->bus_id);
++		snprintf(bus_id, MII_BUS_ID_SIZE, "stmmac-%x",
++			 priv->plat->bus_id);
+ 
+ 		snprintf(phy_id_fmt, MII_BUS_ID_SIZE + 3, PHY_ID_FMT, bus_id,
+ 			 priv->plat->phy_addr);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+index 0faf163..3f5512f 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+@@ -198,29 +198,12 @@ int stmmac_mdio_register(struct net_device *ndev)
+ 	struct mii_bus *new_bus;
+ 	struct stmmac_priv *priv = netdev_priv(ndev);
+ 	struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
++	struct device_node *mdio_node = priv->plat->mdio_node;
+ 	int addr, found;
+-	struct device_node *mdio_node = NULL;
+-	struct device_node *child_node = NULL;
+ 
+ 	if (!mdio_bus_data)
+ 		return 0;
+ 
+-	if (IS_ENABLED(CONFIG_OF)) {
+-		for_each_child_of_node(priv->device->of_node, child_node) {
+-			if (of_device_is_compatible(child_node,
+-						    "snps,dwmac-mdio")) {
+-				mdio_node = child_node;
+-				break;
+-			}
+-		}
+-
+-		if (mdio_node) {
+-			netdev_dbg(ndev, "FOUND MDIO subnode\n");
+-		} else {
+-			netdev_warn(ndev, "No MDIO subnode found\n");
+-		}
+-	}
+-
+ 	new_bus = mdiobus_alloc();
+ 	if (new_bus == NULL)
+ 		return -ENOMEM;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 6a52fa1..190fb6d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -96,6 +96,69 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries)
+ }
+ 
+ /**
++ * stmmac_dt_phy - parse device-tree driver parameters to allocate PHY resources
++ * @plat: driver data platform structure
++ * @np: device tree node
++ * @dev: device pointer
++ * Description:
++ * The mdio bus will be allocated in case of a phy transceiver is on board;
++ * it will be NULL if the fixed-link is configured.
++ * If there is the "snps,dwmac-mdio" sub-node the mdio will be allocated
++ * in any case (for DSA, mdio must be registered even if fixed-link).
++ * The table below sums the supported configurations:
++ *	-------------------------------
++ *	snps,phy-addr	|     Y
++ *	-------------------------------
++ *	phy-handle	|     Y
++ *	-------------------------------
++ *	fixed-link	|     N
++ *	-------------------------------
++ *	snps,dwmac-mdio	|
++ *	  even if	|     Y
++ *	fixed-link	|
++ *	-------------------------------
++ *
++ * It returns 0 in case of success otherwise -ENODEV.
++ */
++static int stmmac_dt_phy(struct plat_stmmacenet_data *plat,
++			 struct device_node *np, struct device *dev)
++{
++	bool mdio = true;
++
++	/* If phy-handle property is passed from DT, use it as the PHY */
++	plat->phy_node = of_parse_phandle(np, "phy-handle", 0);
++	if (plat->phy_node)
++		dev_dbg(dev, "Found phy-handle subnode\n");
++
++	/* If phy-handle is not specified, check if we have a fixed-phy */
++	if (!plat->phy_node && of_phy_is_fixed_link(np)) {
++		if ((of_phy_register_fixed_link(np) < 0))
++			return -ENODEV;
++
++		dev_dbg(dev, "Found fixed-link subnode\n");
++		plat->phy_node = of_node_get(np);
++		mdio = false;
++	}
++
++	/* If snps,dwmac-mdio is passed from DT, always register the MDIO */
++	for_each_child_of_node(np, plat->mdio_node) {
++		if (of_device_is_compatible(plat->mdio_node, "snps,dwmac-mdio"))
++			break;
++	}
++
++	if (plat->mdio_node) {
++		dev_dbg(dev, "Found MDIO subnode\n");
++		mdio = true;
++	}
++
++	if (mdio)
++		plat->mdio_bus_data =
++			devm_kzalloc(dev, sizeof(struct stmmac_mdio_bus_data),
++				     GFP_KERNEL);
++	return 0;
++}
++
++/**
+  * stmmac_probe_config_dt - parse device-tree driver parameters
+  * @pdev: platform_device structure
+  * @plat: driver data platform structure
+@@ -129,30 +192,15 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
+ 	/* Default to phy auto-detection */
+ 	plat->phy_addr = -1;
+ 
+-	/* If we find a phy-handle property, use it as the PHY */
+-	plat->phy_node = of_parse_phandle(np, "phy-handle", 0);
+-
+-	/* If phy-handle is not specified, check if we have a fixed-phy */
+-	if (!plat->phy_node && of_phy_is_fixed_link(np)) {
+-		if ((of_phy_register_fixed_link(np) < 0))
+-			return ERR_PTR(-ENODEV);
+-
+-		plat->phy_node = of_node_get(np);
+-	}
+-
+ 	/* "snps,phy-addr" is not a standard property. Mark it as deprecated
+ 	 * and warn of its use. Remove this when phy node support is added.
+ 	 */
+ 	if (of_property_read_u32(np, "snps,phy-addr", &plat->phy_addr) == 0)
+ 		dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n");
+ 
+-	if ((plat->phy_node && !of_phy_is_fixed_link(np)) || plat->phy_bus_name)
+-		plat->mdio_bus_data = NULL;
+-	else
+-		plat->mdio_bus_data =
+-			devm_kzalloc(&pdev->dev,
+-				     sizeof(struct stmmac_mdio_bus_data),
+-				     GFP_KERNEL);
++	/* To Configure PHY by using all device-tree supported properties */
++	if (stmmac_dt_phy(plat, np, &pdev->dev))
++		return ERR_PTR(-ENODEV);
+ 
+ 	of_property_read_u32(np, "tx-fifo-depth", &plat->tx_fifo_size);
+ 
+diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
+index eead8ab..8b1ff2b 100644
+--- a/include/linux/stmmac.h
++++ b/include/linux/stmmac.h
+@@ -94,12 +94,12 @@ struct stmmac_dma_cfg {
+ };
+ 
+ struct plat_stmmacenet_data {
+-	char *phy_bus_name;
+ 	int bus_id;
+ 	int phy_addr;
+ 	int interface;
+ 	struct stmmac_mdio_bus_data *mdio_bus_data;
+ 	struct device_node *phy_node;
++	struct device_node *mdio_node;
+ 	struct stmmac_dma_cfg *dma_cfg;
+ 	int clk_csr;
+ 	int has_gmac;
+-- 
+2.5.0
+