Linux v4.6.5

12 files changed, 6 insertions, 827 deletions

diff --git a/0001-drm-mgag200-Black-screen-fix-for-G200e-rev-4.patch b/0001-drm-mgag200-Black-screen-fix-for-G200e-rev-4.patch
deleted file mode 100644
index e583d09e8..000000000
--- a/0001-drm-mgag200-Black-screen-fix-for-G200e-rev-4.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 1e5895f2c6068fb9ae5356e3a751a29a22af5f01 Mon Sep 17 00:00:00 2001
-From: Fedora Kernel Team <kernel-team@fedoraproject.org>
-Date: Mon, 20 Jun 2016 14:53:03 +0200
-Subject: [PATCH 1/6] drm/mgag200: Black screen fix for G200e rev 4
-
-Upstream: since drm-fixes-for-v4.7
-commit d3922b69617b62bb2509936b68301f837229d9f0
-
-Author:     Mathieu Larouche <mathieu.larouche@matrox.com>
-AuthorDate: Fri May 27 15:12:50 2016 -0400
-Commit:     Dave Airlie <airlied@redhat.com>
-CommitDate: Wed Jun 1 15:25:04 2016 +1000
-
-    drm/mgag200: Black screen fix for G200e rev 4
-
-    - Fixed black screen for some resolutions of G200e rev4
-    - Fixed testm & testn which had predetermined value.
-
-    Reported-by: Jan Beulich <jbeulich@suse.com>
-
-    Signed-off-by: Mathieu Larouche <mathieu.larouche@matrox.com>
-    Cc: stable@vger.kernel.org
-    Signed-off-by: Dave Airlie <airlied@redhat.com>
----
- drivers/gpu/drm/mgag200/mgag200_mode.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
-index 14e64e0..d347dca 100644
---- a/drivers/gpu/drm/mgag200/mgag200_mode.c
-+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
-@@ -182,7 +182,7 @@ static int mga_g200se_set_plls(struct mga_device *mdev, long clock)
- 			}
- 		}
- 
--		fvv = pllreffreq * testn / testm;
-+		fvv = pllreffreq * (n + 1) / (m + 1);
- 		fvv = (fvv - 800000) / 50000;
- 
- 		if (fvv > 15)
-@@ -202,6 +202,14 @@ static int mga_g200se_set_plls(struct mga_device *mdev, long clock)
- 	WREG_DAC(MGA1064_PIX_PLLC_M, m);
- 	WREG_DAC(MGA1064_PIX_PLLC_N, n);
- 	WREG_DAC(MGA1064_PIX_PLLC_P, p);
-+
-+	if (mdev->unique_rev_id >= 0x04) {
-+		WREG_DAC(0x1a, 0x09);
-+		msleep(20);
-+		WREG_DAC(0x1a, 0x01);
-+
-+	}
-+
- 	return 0;
- }
- 
--- 
-2.7.4
-
diff --git a/0002-drm-nouveau-fbcon-fix-out-of-bounds-memory-accesses.patch b/0002-drm-nouveau-fbcon-fix-out-of-bounds-memory-accesses.patch
deleted file mode 100644
index d1c32b439..000000000
--- a/0002-drm-nouveau-fbcon-fix-out-of-bounds-memory-accesses.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-From 02510a8805db2c3f8ca2926f90c4b3793934404a Mon Sep 17 00:00:00 2001
-From: Fedora Kernel Team <kernel-team@fedoraproject.org>
-Date: Mon, 20 Jun 2016 14:51:45 +0200
-Subject: [PATCH 2/6] drm/nouveau/fbcon: fix out-of-bounds memory accesses
-
-Upstream: drm-fixes for 4.7 (and cc'd 4.6-stable)
-commit f045f459d925138fe7d6193a8c86406bda7e49da
-
-Author:     Ben Skeggs <bskeggs@redhat.com>
-AuthorDate: Thu Jun 2 12:23:31 2016 +1000
-Commit:     Ben Skeggs <bskeggs@redhat.com>
-CommitDate: Thu Jun 2 13:53:44 2016 +1000
-
-    drm/nouveau/fbcon: fix out-of-bounds memory accesses
-
-    Reported by KASAN.
-
-    Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
-    Cc: stable@vger.kernel.org
----
- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 1 +
- drivers/gpu/drm/nouveau/nv04_fbcon.c    | 7 ++-----
- drivers/gpu/drm/nouveau/nv50_fbcon.c    | 6 ++----
- drivers/gpu/drm/nouveau/nvc0_fbcon.c    | 6 ++----
- 4 files changed, 7 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
-index 59f27e7..bd89c86 100644
---- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
-@@ -557,6 +557,7 @@ nouveau_fbcon_init(struct drm_device *dev)
- 	if (ret)
- 		goto fini;
- 
-+	fbcon->helper.fbdev->pixmap.buf_align = 4;
- 	return 0;
- 
- fini:
-diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
-index 789dc29..8f715fe 100644
---- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
-@@ -82,7 +82,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	uint32_t fg;
- 	uint32_t bg;
- 	uint32_t dsize;
--	uint32_t width;
- 	uint32_t *data = (uint32_t *)image->data;
- 	int ret;
- 
-@@ -93,9 +92,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	if (ret)
- 		return ret;
- 
--	width = ALIGN(image->width, 8);
--	dsize = ALIGN(width * image->height, 32) >> 5;
--
- 	if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
- 	    info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
- 		fg = ((uint32_t *) info->pseudo_palette)[image->fg_color];
-@@ -111,10 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 			 ((image->dx + image->width) & 0xffff));
- 	OUT_RING(chan, bg);
- 	OUT_RING(chan, fg);
--	OUT_RING(chan, (image->height << 16) | width);
-+	OUT_RING(chan, (image->height << 16) | image->width);
- 	OUT_RING(chan, (image->height << 16) | image->width);
- 	OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
- 
-+	dsize = ALIGN(image->width * image->height, 32) >> 5;
- 	while (dsize) {
- 		int iter_len = dsize > 128 ? 128 : dsize;
- 
-diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
-index e05499d..a4e259a 100644
---- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
-@@ -95,7 +95,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	struct nouveau_fbdev *nfbdev = info->par;
- 	struct nouveau_drm *drm = nouveau_drm(nfbdev->dev);
- 	struct nouveau_channel *chan = drm->channel;
--	uint32_t width, dwords, *data = (uint32_t *)image->data;
-+	uint32_t dwords, *data = (uint32_t *)image->data;
- 	uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));
- 	uint32_t *palette = info->pseudo_palette;
- 	int ret;
-@@ -107,9 +107,6 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	if (ret)
- 		return ret;
- 
--	width = ALIGN(image->width, 32);
--	dwords = (width * image->height) >> 5;
--
- 	BEGIN_NV04(chan, NvSub2D, 0x0814, 2);
- 	if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
- 	    info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
-@@ -128,6 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	OUT_RING(chan, 0);
- 	OUT_RING(chan, image->dy);
- 
-+	dwords = ALIGN(image->width * image->height, 32) >> 5;
- 	while (dwords) {
- 		int push = dwords > 2047 ? 2047 : dwords;
- 
-diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
-index c97395b..f28315e 100644
---- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
-@@ -95,7 +95,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	struct nouveau_fbdev *nfbdev = info->par;
- 	struct nouveau_drm *drm = nouveau_drm(nfbdev->dev);
- 	struct nouveau_channel *chan = drm->channel;
--	uint32_t width, dwords, *data = (uint32_t *)image->data;
-+	uint32_t dwords, *data = (uint32_t *)image->data;
- 	uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));
- 	uint32_t *palette = info->pseudo_palette;
- 	int ret;
-@@ -107,9 +107,6 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	if (ret)
- 		return ret;
- 
--	width = ALIGN(image->width, 32);
--	dwords = (width * image->height) >> 5;
--
- 	BEGIN_NVC0(chan, NvSub2D, 0x0814, 2);
- 	if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
- 	    info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
-@@ -128,6 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	OUT_RING  (chan, 0);
- 	OUT_RING  (chan, image->dy);
- 
-+	dwords = ALIGN(image->width * image->height, 32) >> 5;
- 	while (dwords) {
- 		int push = dwords > 2047 ? 2047 : dwords;
- 
--- 
-2.7.4
-
diff --git a/0003-drm-nouveau-disp-sor-gf119-both-links-use-the-same-t.patch b/0003-drm-nouveau-disp-sor-gf119-both-links-use-the-same-t.patch
deleted file mode 100644
index b93bdff17..000000000
--- a/0003-drm-nouveau-disp-sor-gf119-both-links-use-the-same-t.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From de35f524e89daf8862d49724b9045f9254bfdfea Mon Sep 17 00:00:00 2001
-From: Fedora Kernel Team <kernel-team@fedoraproject.org>
-Date: Mon, 20 Jun 2016 14:52:01 +0200
-Subject: [PATCH 3/6] drm/nouveau/disp/sor/gf119: both links use the same
- training register
-
-Upstream: drm-fixes for 4.7 (and cc'd 4.6-stable)
-commit a8953c52b95167b5d21a66f0859751570271d834
-
-Author:     Ben Skeggs <bskeggs@redhat.com>
-AuthorDate: Fri Jun 3 14:37:40 2016 +1000
-Commit:     Ben Skeggs <bskeggs@redhat.com>
-CommitDate: Tue Jun 7 08:11:14 2016 +1000
-
-    drm/nouveau/disp/sor/gf119: both links use the same training register
-
-    It appears that, for whatever reason, both link A and B use the same
-    register to control the training pattern.  It's a little odd, as the
-    GPUs before this (Tesla/Fermi1) have per-link registers, as do newer
-    GPUs (Maxwell).
-
-    Fixes the third DP output on NVS 510 (GK107).
-
-    Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
-    Cc: stable@vger.kernel.org
----
- drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
-index b4b41b1..5111560 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
-@@ -40,8 +40,7 @@ static int
- gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
- {
- 	struct nvkm_device *device = outp->base.disp->engine.subdev.device;
--	const u32 loff = gf119_sor_loff(outp);
--	nvkm_mask(device, 0x61c110 + loff, 0x0f0f0f0f, 0x01010101 * pattern);
-+	nvkm_mask(device, 0x61c110, 0x0f0f0f0f, 0x01010101 * pattern);
- 	return 0;
- }
- 
--- 
-2.7.4
-
diff --git a/0004-drm-nouveau-disp-sor-gm107-training-pattern-register.patch b/0004-drm-nouveau-disp-sor-gm107-training-pattern-register.patch
deleted file mode 100644
index a0b6171d8..000000000
--- a/0004-drm-nouveau-disp-sor-gm107-training-pattern-register.patch
+++ /dev/null
@@ -1,195 +0,0 @@
-From eb4668302adce316f53896b0fd8144ffe380a3ad Mon Sep 17 00:00:00 2001
-From: Fedora Kernel Team <kernel-team@fedoraproject.org>
-Date: Mon, 20 Jun 2016 14:52:06 +0200
-Subject: [PATCH 4/6] drm/nouveau/disp/sor/gm107: training pattern registers
- are like gm200
-
-Upstream: drm-fixes for 4.7 (and cc'd 4.6-stable)
-commit 4691409b3e2250ed66aa8dcefa23fe765daf7add
-
-Author:     Ben Skeggs <bskeggs@redhat.com>
-AuthorDate: Fri Jun 3 15:05:52 2016 +1000
-Commit:     Ben Skeggs <bskeggs@redhat.com>
-CommitDate: Tue Jun 7 08:11:25 2016 +1000
-
-    drm/nouveau/disp/sor/gm107: training pattern registers are like gm200
-
-    Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
-    Cc: stable@vger.kernel.org
----
- drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild    |  1 +
- drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c   |  2 +-
- drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h  |  9 +++-
- .../gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c    |  2 +-
- .../nvkm/engine/disp/{gm107.c => sorgm107.c}       | 50 +++++++++++-----------
- .../gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c    | 15 +------
- 6 files changed, 36 insertions(+), 43 deletions(-)
- copy drivers/gpu/drm/nouveau/nvkm/engine/disp/{gm107.c => sorgm107.c} (55%)
-
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild b/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild
-index a74c5dd..e2a64ed 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild
-@@ -18,6 +18,7 @@ nvkm-y += nvkm/engine/disp/piornv50.o
- nvkm-y += nvkm/engine/disp/sornv50.o
- nvkm-y += nvkm/engine/disp/sorg94.o
- nvkm-y += nvkm/engine/disp/sorgf119.o
-+nvkm-y += nvkm/engine/disp/sorgm107.o
- nvkm-y += nvkm/engine/disp/sorgm200.o
- nvkm-y += nvkm/engine/disp/dport.o
- 
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
-index b694414..f4b9cf8 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
-@@ -36,7 +36,7 @@ gm107_disp = {
- 	.outp.internal.crt = nv50_dac_output_new,
- 	.outp.internal.tmds = nv50_sor_output_new,
- 	.outp.internal.lvds = nv50_sor_output_new,
--	.outp.internal.dp = gf119_sor_dp_new,
-+	.outp.internal.dp = gm107_sor_dp_new,
- 	.dac.nr = 3,
- 	.dac.power = nv50_dac_power,
- 	.dac.sense = nv50_dac_sense,
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h
-index e9067ba..4e983f6 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h
-@@ -62,7 +62,12 @@ int g94_sor_dp_lnk_pwr(struct nvkm_output_dp *, int);
- int gf119_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
- 		     struct nvkm_output **);
- int gf119_sor_dp_lnk_ctl(struct nvkm_output_dp *, int, int, bool);
-+int gf119_sor_dp_drv_ctl(struct nvkm_output_dp *, int, int, int, int);
- 
--int  gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
--		      struct nvkm_output **);
-+int gm107_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
-+		     struct nvkm_output **);
-+int gm107_sor_dp_pattern(struct nvkm_output_dp *, int);
-+
-+int gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
-+		     struct nvkm_output **);
- #endif
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
-index 5111560..22706c0 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
-@@ -63,7 +63,7 @@ gf119_sor_dp_lnk_ctl(struct nvkm_output_dp *outp, int nr, int bw, bool ef)
- 	return 0;
- }
- 
--static int
-+int
- gf119_sor_dp_drv_ctl(struct nvkm_output_dp *outp,
- 		     int ln, int vs, int pe, int pc)
- {
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c
-similarity index 55%
-copy from drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
-copy to drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c
-index b694414..37790b2 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c
-@@ -1,5 +1,5 @@
- /*
-- * Copyright 2012 Red Hat Inc.
-+ * Copyright 2016 Red Hat Inc.
-  *
-  * Permission is hereby granted, free of charge, to any person obtaining a
-  * copy of this software and associated documentation files (the "Software"),
-@@ -19,35 +19,35 @@
-  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-  * OTHER DEALINGS IN THE SOFTWARE.
-  *
-- * Authors: Ben Skeggs
-+ * Authors: Ben Skeggs <bskeggs@redhat.com>
-  */
- #include "nv50.h"
--#include "rootnv50.h"
-+#include "outpdp.h"
- 
--static const struct nv50_disp_func
--gm107_disp = {
--	.intr = gf119_disp_intr,
--	.uevent = &gf119_disp_chan_uevent,
--	.super = gf119_disp_intr_supervisor,
--	.root = &gm107_disp_root_oclass,
--	.head.vblank_init = gf119_disp_vblank_init,
--	.head.vblank_fini = gf119_disp_vblank_fini,
--	.head.scanoutpos = gf119_disp_root_scanoutpos,
--	.outp.internal.crt = nv50_dac_output_new,
--	.outp.internal.tmds = nv50_sor_output_new,
--	.outp.internal.lvds = nv50_sor_output_new,
--	.outp.internal.dp = gf119_sor_dp_new,
--	.dac.nr = 3,
--	.dac.power = nv50_dac_power,
--	.dac.sense = nv50_dac_sense,
--	.sor.nr = 4,
--	.sor.power = nv50_sor_power,
--	.sor.hda_eld = gf119_hda_eld,
--	.sor.hdmi = gk104_hdmi_ctrl,
-+int
-+gm107_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
-+{
-+	struct nvkm_device *device = outp->base.disp->engine.subdev.device;
-+	const u32 soff = outp->base.or * 0x800;
-+	const u32 data = 0x01010101 * pattern;
-+	if (outp->base.info.sorconf.link & 1)
-+		nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data);
-+	else
-+		nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data);
-+	return 0;
-+}
-+
-+static const struct nvkm_output_dp_func
-+gm107_sor_dp_func = {
-+	.pattern = gm107_sor_dp_pattern,
-+	.lnk_pwr = g94_sor_dp_lnk_pwr,
-+	.lnk_ctl = gf119_sor_dp_lnk_ctl,
-+	.drv_ctl = gf119_sor_dp_drv_ctl,
- };
- 
- int
--gm107_disp_new(struct nvkm_device *device, int index, struct nvkm_disp **pdisp)
-+gm107_sor_dp_new(struct nvkm_disp *disp, int index,
-+		 struct dcb_output *dcbE, struct nvkm_output **poutp)
- {
--	return gf119_disp_new_(&gm107_disp, device, index, pdisp);
-+	return nvkm_output_dp_new_(&gm107_sor_dp_func, disp, index, dcbE, poutp);
- }
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c
-index 2cfbef9..c44fa7e 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c
-@@ -57,19 +57,6 @@ gm200_sor_dp_lane_map(struct nvkm_device *device, u8 lane)
- }
- 
- static int
--gm200_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
--{
--	struct nvkm_device *device = outp->base.disp->engine.subdev.device;
--	const u32 soff = gm200_sor_soff(outp);
--	const u32 data = 0x01010101 * pattern;
--	if (outp->base.info.sorconf.link & 1)
--		nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data);
--	else
--		nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data);
--	return 0;
--}
--
--static int
- gm200_sor_dp_lnk_pwr(struct nvkm_output_dp *outp, int nr)
- {
- 	struct nvkm_device *device = outp->base.disp->engine.subdev.device;
-@@ -129,7 +116,7 @@ gm200_sor_dp_drv_ctl(struct nvkm_output_dp *outp,
- 
- static const struct nvkm_output_dp_func
- gm200_sor_dp_func = {
--	.pattern = gm200_sor_dp_pattern,
-+	.pattern = gm107_sor_dp_pattern,
- 	.lnk_pwr = gm200_sor_dp_lnk_pwr,
- 	.lnk_ctl = gf119_sor_dp_lnk_ctl,
- 	.drv_ctl = gm200_sor_dp_drv_ctl,
--- 
-2.7.4
-
diff --git a/0005-i915-fbc-Disable-on-HSW-by-default-for-now.patch b/0005-i915-fbc-Disable-on-HSW-by-default-for-now.patch
deleted file mode 100644
index d95f2f4d0..000000000
--- a/0005-i915-fbc-Disable-on-HSW-by-default-for-now.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 28d0147bded959b2c4d3eb1aa957452d5dbb0cc9 Mon Sep 17 00:00:00 2001
-From: Fedora Kernel Team <kernel-team@fedoraproject.org>
-Date: Mon, 20 Jun 2016 14:52:10 +0200
-Subject: [PATCH 5/6] i915/fbc: Disable on HSW by default for now
-
-Upstream: posted on dri-devel (and r-b'd)
-
-Author:     cpaul@redhat.com <cpaul@redhat.com>
-AuthorDate: Thu Jun 9 11:58:15 2016 -0400
-Commit:     Rob Clark <rclark@redhat.com>
-CommitDate: Thu Jun 9 15:43:07 2016 -0400
-
-    i915/fbc: Disable on HSW by default for now
-
-    >From https://bugs.freedesktop.org/show_bug.cgi?id=96461 :
-
-    This was kind of a difficult bug to track down. If you're using a
-    Haswell system running GNOME and you have fbc completely enabled and
-    working, playing videos can result in video artifacts. Steps to
-    reproduce:
-
-    - Run GNOME
-    - Ensure FBC is enabled and active
-    - Download a movie, I used the ogg version of Big Buck Bunny for this
-    - Run `gst-launch-1.0 filesrc location='some_movie.ogg' ! decodebin !
-      glimagesink` in a terminal
-    - Watch for about over a minute, you'll see small horizontal lines go
-      down the screen.
-
-    For the time being, disable FBC for Haswell by default.
-
-    Signed-off-by: Lyude <cpaul@redhat.com>
-    Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
-    Cc: stable@vger.kernel.org
----
- drivers/gpu/drm/i915/intel_fbc.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
-index 0f0492f..28f4407 100644
---- a/drivers/gpu/drm/i915/intel_fbc.c
-+++ b/drivers/gpu/drm/i915/intel_fbc.c
-@@ -823,8 +823,7 @@ static bool intel_fbc_can_choose(struct intel_crtc *crtc)
- {
- 	struct drm_i915_private *dev_priv = crtc->base.dev->dev_private;
- 	struct intel_fbc *fbc = &dev_priv->fbc;
--	bool enable_by_default = IS_HASWELL(dev_priv) ||
--				 IS_BROADWELL(dev_priv);
-+	bool enable_by_default = IS_BROADWELL(dev_priv);
- 
- 	if (intel_vgpu_active(dev_priv->dev)) {
- 		fbc->no_fbc_reason = "VGPU is active";
--- 
-2.7.4
-
diff --git a/HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch b/HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch
deleted file mode 100644
index e84272ee7..000000000
--- a/HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 93a2001bdfd5376c3dc2158653034c20392d15c5 Mon Sep 17 00:00:00 2001
-From: Scott Bauer <sbauer@plzdonthack.me>
-Date: Thu, 23 Jun 2016 08:59:47 -0600
-Subject: [PATCH] HID: hiddev: validate num_values for HIDIOCGUSAGES,
- HIDIOCSUSAGES commands
-
-This patch validates the num_values parameter from userland during the
-HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
-to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
-leading to a heap overflow.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
-Signed-off-by: Jiri Kosina <jkosina@suse.cz>
----
- drivers/hid/usbhid/hiddev.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
-index 2f1ddca6f2e0..700145b15088 100644
---- a/drivers/hid/usbhid/hiddev.c
-+++ b/drivers/hid/usbhid/hiddev.c
-@@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
- 					goto inval;
- 			} else if (uref->usage_index >= field->report_count)
- 				goto inval;
--
--			else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
--				 (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
--				  uref->usage_index + uref_multi->num_values > field->report_count))
--				goto inval;
- 		}
- 
-+		if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
-+		    (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
-+		     uref->usage_index + uref_multi->num_values > field->report_count))
-+			goto inval;
-+
- 		switch (cmd) {
- 		case HIDIOCGUSAGE:
- 			uref->value = field->value[uref->usage_index];
--- 
-2.5.5
-
diff --git a/KEYS-potential-uninitialized-variable.patch b/KEYS-potential-uninitialized-variable.patch
deleted file mode 100644
index 23cabbb2e..000000000
--- a/KEYS-potential-uninitialized-variable.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 82a50018782f84e733e718d4b24e1653d19333be Mon Sep 17 00:00:00 2001
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: Wed, 15 Jun 2016 09:31:45 -0400
-Subject: [PATCH] KEYS: potential uninitialized variable
-
-If __key_link_begin() failed then "edit" would be uninitialized.  I've
-added a check to fix that.
-
-Fixes: f70e2e06196a ('KEYS: Do preallocation for __key_link()')
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
----
- security/keys/key.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/security/keys/key.c b/security/keys/key.c
-index bd5a272f28a6..346fbf201c22 100644
---- a/security/keys/key.c
-+++ b/security/keys/key.c
-@@ -597,7 +597,7 @@ int key_reject_and_link(struct key *key,
- 
- 	mutex_unlock(&key_construction_mutex);
- 
--	if (keyring)
-+	if (keyring && link_ret == 0)
- 		__key_link_end(keyring, &key->index_key, edit);
- 
- 	/* wake up anyone waiting for a key to be constructed */
--- 
-2.5.5
-
diff --git a/drm-nouveau-disp-sor-gf119-select-correct-sor-when.patch b/drm-nouveau-disp-sor-gf119-select-correct-sor-when.patch
deleted file mode 100644
index 996b47918..000000000
--- a/drm-nouveau-disp-sor-gf119-select-correct-sor-when.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 217215041b9285af2193a755b56a8f3ed408bfe2 Mon Sep 17 00:00:00 2001
-From: Ben Skeggs <bskeggs@redhat.com>
-Date: Wed, 6 Jul 2016 06:50:36 +1000
-Subject: [PATCH] drm/nouveau/disp/sor/gf119: select correct sor when poking
- training pattern
-
-Fixes a regression caused by a stupid thinko from "disp/sor/gf119: both
-links use the same training register".
-
-Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
-Cc: stable@vger.kernel.org
----
- drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
-index 22706c0..49bd5da 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
-@@ -40,7 +40,8 @@ static int
- gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
- {
- 	struct nvkm_device *device = outp->base.disp->engine.subdev.device;
--	nvkm_mask(device, 0x61c110, 0x0f0f0f0f, 0x01010101 * pattern);
-+	const u32 soff = gf119_sor_soff(outp);
-+	nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, 0x01010101 * pattern);
- 	return 0;
- }
- 
diff --git a/kernel.spec b/kernel.spec
index 2efb6c354..191f6856d 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -42,7 +42,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 201
+%global baserelease 200
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -54,7 +54,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 4
+%define stable_update 5
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -619,9 +619,6 @@ Patch721: tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch
 #CVE-2016-5244 rhbz 1343338 1343337
 Patch722: rds-fix-an-infoleak-in-rds_inc_info_copy.txt
 
-#CVE-2016-4470 rhbz 1341716 1346626
-Patch727: KEYS-potential-uninitialized-variable.patch
-
 #rhbz 1338025
 Patch728: hp-wmi-fix-wifi-cannot-be-hard-unblock.patch
 
@@ -644,26 +641,9 @@ Patch815: 0015-drm-i915-gen9-Calculate-watermarks-during-atomic-che.patch
 Patch816: 0016-drm-i915-gen9-Reject-display-updates-that-exceed-wm-.patch
 Patch817: 0017-drm-i915-Remove-wm_config-from-dev_priv-intel_atomic.patch
 
-#other drm/kms fixes (most Cc-ed stable)
-Patch821: 0001-drm-mgag200-Black-screen-fix-for-G200e-rev-4.patch
-Patch822: 0002-drm-nouveau-fbcon-fix-out-of-bounds-memory-accesses.patch
-Patch823: 0003-drm-nouveau-disp-sor-gf119-both-links-use-the-same-t.patch
-Patch824: 0004-drm-nouveau-disp-sor-gm107-training-pattern-register.patch
-Patch825: 0005-i915-fbc-Disable-on-HSW-by-default-for-now.patch
-
-#CVE-2016-5829 rhbz 1350509 1350513
-Patch826: HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch
-
-#CVE-2016-1237 rhbz 1350845 1350847
-Patch830: posix_acl-Add-set_posix_acl.patch
-Patch831: nfsd-check-permissions-when-setting-ACLs.patch
-
 #CVE-2016-6156 rhbz 1353490 1353491
 Patch832: platform-chrome-cros_ec_dev-double-fetch-bug-in-ioct.patch
 
-#rbhz 1351205
-Patch833: drm-nouveau-disp-sor-gf119-select-correct-sor-when.patch
-
 #rhbz 1346753
 Patch834: qla2xxx-Fix-NULL-pointer-deref-in-QLA-interrupt.patch
 
@@ -2202,6 +2182,9 @@ fi
 #
 # 
 %changelog
+* Wed Jul 27 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.5-200
+- Linux v4.6.5
+
 * Mon Jul 25 2016 Josh Boyer <jwboyer@fedoraproject.org>
 - CVE-2016-6136 race condition in auditsc.c (rhbz 1353533 1353534)
 
diff --git a/nfsd-check-permissions-when-setting-ACLs.patch b/nfsd-check-permissions-when-setting-ACLs.patch
deleted file mode 100644
index 37ed435e0..000000000
--- a/nfsd-check-permissions-when-setting-ACLs.patch
+++ /dev/null
@@ -1,154 +0,0 @@
-From 999653786df6954a31044528ac3f7a5dadca08f4 Mon Sep 17 00:00:00 2001
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Wed, 22 Jun 2016 19:43:35 +0100
-Subject: [PATCH] nfsd: check permissions when setting ACLs
-
-Use set_posix_acl, which includes proper permission checks, instead of
-calling ->set_acl directly.  Without this anyone may be able to grant
-themselves permissions to a file by setting the ACL.
-
-Lock the inode to make the new checks atomic with respect to set_acl.
-(Also, nfsd was the only caller of set_acl not locking the inode, so I
-suspect this may fix other races.)
-
-This also simplifies the code, and ensures our ACLs are checked by
-posix_acl_valid.
-
-The permission checks and the inode locking were lost with commit
-4ac7249e, which changed nfsd to use the set_acl inode operation directly
-instead of going through xattr handlers.
-
-Reported-by: David Sinquin <david@sinquin.eu>
-[agreunba@redhat.com: use set_posix_acl]
-Fixes: 4ac7249e
-Cc: Christoph Hellwig <hch@infradead.org>
-Cc: Al Viro <viro@zeniv.linux.org.uk>
-Cc: stable@vger.kernel.org
-Signed-off-by: J. Bruce Fields <bfields@redhat.com>
----
- fs/nfsd/nfs2acl.c | 20 ++++++++++----------
- fs/nfsd/nfs3acl.c | 16 +++++++---------
- fs/nfsd/nfs4acl.c | 16 ++++++++--------
- 3 files changed, 25 insertions(+), 27 deletions(-)
-
-diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
-index 1580ea6fd64d..d08cd88155c7 100644
---- a/fs/nfsd/nfs2acl.c
-+++ b/fs/nfsd/nfs2acl.c
-@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp,
- 		goto out;
- 
- 	inode = d_inode(fh->fh_dentry);
--	if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
--		error = -EOPNOTSUPP;
--		goto out_errno;
--	}
- 
- 	error = fh_want_write(fh);
- 	if (error)
- 		goto out_errno;
- 
--	error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
-+	fh_lock(fh);
-+
-+	error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
- 	if (error)
--		goto out_drop_write;
--	error = inode->i_op->set_acl(inode, argp->acl_default,
--				     ACL_TYPE_DEFAULT);
-+		goto out_drop_lock;
-+	error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
- 	if (error)
--		goto out_drop_write;
-+		goto out_drop_lock;
-+
-+	fh_unlock(fh);
- 
- 	fh_drop_write(fh);
- 
-@@ -131,7 +130,8 @@ out:
- 	posix_acl_release(argp->acl_access);
- 	posix_acl_release(argp->acl_default);
- 	return nfserr;
--out_drop_write:
-+out_drop_lock:
-+	fh_unlock(fh);
- 	fh_drop_write(fh);
- out_errno:
- 	nfserr = nfserrno(error);
-diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
-index 01df4cd7c753..0c890347cde3 100644
---- a/fs/nfsd/nfs3acl.c
-+++ b/fs/nfsd/nfs3acl.c
-@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp,
- 		goto out;
- 
- 	inode = d_inode(fh->fh_dentry);
--	if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
--		error = -EOPNOTSUPP;
--		goto out_errno;
--	}
- 
- 	error = fh_want_write(fh);
- 	if (error)
- 		goto out_errno;
- 
--	error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
-+	fh_lock(fh);
-+
-+	error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
- 	if (error)
--		goto out_drop_write;
--	error = inode->i_op->set_acl(inode, argp->acl_default,
--				     ACL_TYPE_DEFAULT);
-+		goto out_drop_lock;
-+	error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
- 
--out_drop_write:
-+out_drop_lock:
-+	fh_unlock(fh);
- 	fh_drop_write(fh);
- out_errno:
- 	nfserr = nfserrno(error);
-diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
-index 6adabd6049b7..71292a0d6f09 100644
---- a/fs/nfsd/nfs4acl.c
-+++ b/fs/nfsd/nfs4acl.c
-@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
- 	dentry = fhp->fh_dentry;
- 	inode = d_inode(dentry);
- 
--	if (!inode->i_op->set_acl || !IS_POSIXACL(inode))
--		return nfserr_attrnotsupp;
--
- 	if (S_ISDIR(inode->i_mode))
- 		flags = NFS4_ACL_DIR;
- 
-@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
- 	if (host_error < 0)
- 		goto out_nfserr;
- 
--	host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS);
-+	fh_lock(fhp);
-+
-+	host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl);
- 	if (host_error < 0)
--		goto out_release;
-+		goto out_drop_lock;
- 
- 	if (S_ISDIR(inode->i_mode)) {
--		host_error = inode->i_op->set_acl(inode, dpacl,
--						  ACL_TYPE_DEFAULT);
-+		host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl);
- 	}
- 
--out_release:
-+out_drop_lock:
-+	fh_unlock(fhp);
-+
- 	posix_acl_release(pacl);
- 	posix_acl_release(dpacl);
- out_nfserr:
--- 
-2.5.5
-
diff --git a/posix_acl-Add-set_posix_acl.patch b/posix_acl-Add-set_posix_acl.patch
deleted file mode 100644
index c067f7b85..000000000
--- a/posix_acl-Add-set_posix_acl.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From c463b51e8ea1ae47a7bb8cc2777eb550ad3273e2 Mon Sep 17 00:00:00 2001
-From: Andreas Gruenbacher <agruenba@redhat.com>
-Date: Wed, 22 Jun 2016 23:57:25 +0200
-Subject: [PATCH] posix_acl: Add set_posix_acl
-
-Factor out part of posix_acl_xattr_set into a common function that takes
-a posix_acl, which nfsd can also call.
-
-The prototype already exists in include/linux/posix_acl.h.
-
-Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
-Cc: stable@vger.kernel.org
-Cc: Christoph Hellwig <hch@infradead.org>
-Cc: Al Viro <viro@zeniv.linux.org.uk>
-Signed-off-by: J. Bruce Fields <bfields@redhat.com>
----
- fs/posix_acl.c | 22 ++++++++++++++++++++++
- 1 file changed, 22 insertions(+)
-
-diff --git a/fs/posix_acl.c b/fs/posix_acl.c
-index 711dd5170376..f30caace5b84 100644
---- a/fs/posix_acl.c
-+++ b/fs/posix_acl.c
-@@ -786,6 +786,28 @@ posix_acl_xattr_get(const struct xattr_handler *handler,
- 	return error;
- }
- 
-+int
-+set_posix_acl(struct inode *inode, int type, struct posix_acl *acl)
-+{
-+	if (!IS_POSIXACL(inode))
-+		return -EOPNOTSUPP;
-+	if (!inode->i_op->set_acl)
-+		return -EOPNOTSUPP;
-+
-+	if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
-+		return acl ? -EACCES : 0;
-+	if (!inode_owner_or_capable(inode))
-+		return -EPERM;
-+
-+	if (acl) {
-+		int ret = posix_acl_valid(acl);
-+		if (ret)
-+			return ret;
-+	}
-+	return inode->i_op->set_acl(inode, acl, type);
-+}
-+EXPORT_SYMBOL(set_posix_acl);
-+
- static int
- posix_acl_xattr_set(const struct xattr_handler *handler,
- 		    struct dentry *dentry, const char *name,
--- 
-2.5.5
-
diff --git a/sources b/sources
index 56a5aeb91..ee5257660 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 d2927020e24a76da4ab482a8bc3e9ef3  linux-4.6.tar.xz
 fd23b14b9d474c3dfacb6e8ee82d3a51  perf-man-4.6.tar.gz
-c8ff415734155965ae7a2a85ef9c9e03  patch-4.6.4.xz
+ad32c9ec1c69a99811d160d6014f9b2d  patch-4.6.5.xz