3.0 patches

8 files changed, 313 insertions, 0 deletions

diff --git a/queue-3.0/drm-radeon-extended-ddc-probing-for-toshiba-l300d-radeon.patch b/queue-3.0/drm-radeon-extended-ddc-probing-for-toshiba-l300d-radeon.patch
new file mode 100644
index 0000000000..1f1a99260a
--- /dev/null
+++ b/queue-3.0/drm-radeon-extended-ddc-probing-for-toshiba-l300d-radeon.patch
@@ -0,0 +1,51 @@
+From f2b60717e692550bf753a5d64a5b69ea430fc832 Mon Sep 17 00:00:00 2001
+From: Thomas Reim <reimth@googlemail.com>
+Date: Wed, 17 Aug 2011 09:03:32 +0000
+Subject: drm/radeon: Extended DDC Probing for Toshiba L300D Radeon Mobility X1100 HDMI-A Connector
+
+From: Thomas Reim <reimth@googlemail.com>
+
+commit f2b60717e692550bf753a5d64a5b69ea430fc832 upstream.
+
+Toshiba Satellite L300D with ATI Mobility Radeon X1100 sends data
+   to i2c bus for a HDMI connector that is not implemented/existent
+   on the notebook's board.
+
+   Fix by applying extented DDC probing for this connector.
+
+   Requires [PATCH] drm/radeon: Extended DDC Probing for Connectors
+   with Improperly Wired DDC Lines
+
+   Tested for kernel 2.6.38 on Toshiba Satellite L300D notebook
+
+   BugLink: http://bugs.launchpad.net/bugs/826677
+
+Signed-off-by: Thomas Reim <reimth@gmail.com>
+Acked-by: Chris Routh <routhy@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -466,6 +466,16 @@ static bool radeon_connector_needs_exten
+ 		    (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
+ 			return true;
+ 	}
++	/* TOSHIBA Satellite L300D with ATI Mobility Radeon x1100
++	 * (RS690M) sends data to i2c bus for a HDMI connector that
++	 * is not implemented */
++	if ((dev->pdev->device == 0x791f) &&
++	    (dev->pdev->subsystem_vendor == 0x1179) &&
++	    (dev->pdev->subsystem_device == 0xff68)) {
++		if ((connector_type == DRM_MODE_CONNECTOR_HDMIA) &&
++		    (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
++			return true;
++	}
+ 
+ 	/* Default: no EDID header probe required for DDC probing */
+ 	return false;
diff --git a/queue-3.0/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch b/queue-3.0/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch
new file mode 100644
index 0000000000..ac5c604ba6
--- /dev/null
+++ b/queue-3.0/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch
@@ -0,0 +1,35 @@
+From 7c4c3960dff109bc5db4c35da481c212dadb5eb5 Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Mon, 22 Aug 2011 21:17:57 +0000
+Subject: drm/ttm: fix ttm_bo_add_ttm(user) failure path
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit 7c4c3960dff109bc5db4c35da481c212dadb5eb5 upstream.
+
+ttm_tt_destroy kfrees passed object, so we need to nullify
+a reference to it.
+
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/ttm/ttm_bo.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -353,8 +353,10 @@ static int ttm_bo_add_ttm(struct ttm_buf
+ 
+ 		ret = ttm_tt_set_user(bo->ttm, current,
+ 				      bo->buffer_start, bo->num_pages);
+-		if (unlikely(ret != 0))
++		if (unlikely(ret != 0)) {
+ 			ttm_tt_destroy(bo->ttm);
++			bo->ttm = NULL;
++		}
+ 		break;
+ 	default:
+ 		printk(KERN_ERR TTM_PFX "Illegal buffer object type\n");
diff --git a/queue-3.0/fuse-check-size-of-fuse_notify_inval_entry-message.patch b/queue-3.0/fuse-check-size-of-fuse_notify_inval_entry-message.patch
new file mode 100644
index 0000000000..b0d5093b9e
--- /dev/null
+++ b/queue-3.0/fuse-check-size-of-fuse_notify_inval_entry-message.patch
@@ -0,0 +1,34 @@
+From c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Wed, 24 Aug 2011 10:20:17 +0200
+Subject: fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae upstream.
+
+FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the
+message processing could overrun and result in a "kernel BUG at
+fs/fuse/dev.c:629!"
+
+Reported-by: Han-Wen Nienhuys <hanwenn@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fuse/dev.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1358,6 +1358,10 @@ static int fuse_notify_inval_entry(struc
+ 	if (outarg.namelen > FUSE_NAME_MAX)
+ 		goto err;
+ 
++	err = -EINVAL;
++	if (size != sizeof(outarg) + outarg.namelen + 1)
++		goto err;
++
+ 	name.name = buf;
+ 	name.len = outarg.namelen;
+ 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
diff --git a/queue-3.0/rt2x00-fix-order-of-entry-flags-modification.patch b/queue-3.0/rt2x00-fix-order-of-entry-flags-modification.patch
new file mode 100644
index 0000000000..c86103041d
--- /dev/null
+++ b/queue-3.0/rt2x00-fix-order-of-entry-flags-modification.patch
@@ -0,0 +1,62 @@
+From df71c9cfceea801e7e26e2c74241758ef9c042e5 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 10 Aug 2011 15:32:23 +0200
+Subject: rt2x00: fix order of entry flags modification
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit df71c9cfceea801e7e26e2c74241758ef9c042e5 upstream.
+
+In rt2800usb_work_txdone we check flags in order:
+
+- ENTRY_OWNER_DEVICE_DATA
+- ENTRY_DATA_STATUS_PENDING
+- ENTRY_DATA_IO_FAILED
+
+Modify flags in separate order in rt2x00usb_interrupt_txdone, to avoid
+processing entries in _txdone with wrong flags or skip processing
+ready entries.
+
+Reported-by: Justin Piszcz <jpiszcz@lucidpixels.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2x00usb.c |   17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
++++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
+@@ -262,23 +262,20 @@ static void rt2x00usb_interrupt_txdone(s
+ 	struct queue_entry *entry = (struct queue_entry *)urb->context;
+ 	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+ 
+-	if (!test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
++	if (!test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+ 		return;
+-
+-	if (rt2x00dev->ops->lib->tx_dma_done)
+-		rt2x00dev->ops->lib->tx_dma_done(entry);
+-
+-	/*
+-	 * Report the frame as DMA done
+-	 */
+-	rt2x00lib_dmadone(entry);
+-
+ 	/*
+ 	 * Check if the frame was correctly uploaded
+ 	 */
+ 	if (urb->status)
+ 		set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
++	/*
++	 * Report the frame as DMA done
++	 */
++	rt2x00lib_dmadone(entry);
+ 
++	if (rt2x00dev->ops->lib->tx_dma_done)
++		rt2x00dev->ops->lib->tx_dma_done(entry);
+ 	/*
+ 	 * Schedule the delayed work for reading the TX status
+ 	 * from the device.
diff --git a/queue-3.0/series b/queue-3.0/series
index ebdd2a8037..cd5c1cfbdd 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -23,3 +23,10 @@ xen-blkfront-drop-name-and-minor-adjustments-for-emulated.patch
 xen-blkfront-fix-one-off-warning-about-name-clash.patch
 xen-x86-replace-order-based-range-checking-of-m2p-table-by.patch
 xen-do-not-enable-pv-ipis-when-vector-callback-not-present.patch
+x86-olpc-wait-for-last-byte-of-ec-command-to-be-accepted.patch
+x86-32-vdso-on-system-call-restart-after-sysenter-use-int.patch
+x86-uv-remove-uv-delay-in-starting-slave-cpus.patch
+drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch
+drm-radeon-extended-ddc-probing-for-toshiba-l300d-radeon.patch
+fuse-check-size-of-fuse_notify_inval_entry-message.patch
+rt2x00-fix-order-of-entry-flags-modification.patch
diff --git a/queue-3.0/x86-32-vdso-on-system-call-restart-after-sysenter-use-int.patch b/queue-3.0/x86-32-vdso-on-system-call-restart-after-sysenter-use-int.patch
new file mode 100644
index 0000000000..8c9bc217ba
--- /dev/null
+++ b/queue-3.0/x86-32-vdso-on-system-call-restart-after-sysenter-use-int.patch
@@ -0,0 +1,39 @@
+From 7ca0758cdb7c241cb4e0490a8d95f0eb5b861daf Mon Sep 17 00:00:00 2001
+From: "H. Peter Anvin" <hpa@linux.intel.com>
+Date: Mon, 22 Aug 2011 13:27:06 -0700
+Subject: x86-32, vdso: On system call restart after SYSENTER, use int $0x80
+
+From: "H. Peter Anvin" <hpa@linux.intel.com>
+
+commit 7ca0758cdb7c241cb4e0490a8d95f0eb5b861daf upstream.
+
+When we enter a 32-bit system call via SYSENTER or SYSCALL, we shuffle
+the arguments to match the int $0x80 calling convention.  This was
+probably a design mistake, but it's what it is now.  This causes
+errors if the system call as to be restarted.
+
+For SYSENTER, we have to invoke the instruction from the vdso as the
+return address is hardcoded.  Accordingly, we can simply replace the
+jump in the vdso with an int $0x80 instruction and use the slower
+entry point for a post-restart.
+
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Link: http://lkml.kernel.org/r/CA%2B55aFztZ=r5wa0x26KJQxvZOaQq8s2v3u50wCyJcA-Sc4g8gQ@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/vdso/vdso32/sysenter.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/vdso/vdso32/sysenter.S
++++ b/arch/x86/vdso/vdso32/sysenter.S
+@@ -43,7 +43,7 @@ __kernel_vsyscall:
+ 	.space 7,0x90
+ 
+ 	/* 14: System call restart point is here! (SYSENTER_RETURN-2) */
+-	jmp .Lenter_kernel
++	int $0x80
+ 	/* 16: System call normal return point is here! */
+ VDSO32_SYSENTER_RETURN:	/* Symbol used by sysenter.c via vdso32-syms.h */
+ 	pop %ebp
diff --git a/queue-3.0/x86-olpc-wait-for-last-byte-of-ec-command-to-be-accepted.patch b/queue-3.0/x86-olpc-wait-for-last-byte-of-ec-command-to-be-accepted.patch
new file mode 100644
index 0000000000..0c7bff20bf
--- /dev/null
+++ b/queue-3.0/x86-olpc-wait-for-last-byte-of-ec-command-to-be-accepted.patch
@@ -0,0 +1,51 @@
+From a3ea14df0e383f44dcb2e61badb71180dbffe526 Mon Sep 17 00:00:00 2001
+From: Paul Fox <pgf@laptop.org>
+Date: Tue, 26 Jul 2011 16:42:26 +0100
+Subject: x86, olpc: Wait for last byte of EC command to be accepted
+
+From: Paul Fox <pgf@laptop.org>
+
+commit a3ea14df0e383f44dcb2e61badb71180dbffe526 upstream.
+
+When executing EC commands, only waiting when there are still
+more bytes to write is usually fine. However, if the system
+suspends very quickly after a call to olpc_ec_cmd(), the last
+data byte may not yet be transferred to the EC, and the command
+will not complete.
+
+This solves a bug where the SCI wakeup mask was not correctly
+written when going into suspend.
+
+It means that sometimes, on XO-1.5 (but not XO-1), the
+devices that were marked as wakeup sources can't wake up
+the system. e.g. you ask for wifi wakeups, suspend, but then
+incoming wifi frames don't wake up the system as they should.
+
+Signed-off-by: Paul Fox <pgf@laptop.org>
+Signed-off-by: Daniel Drake <dsd@laptop.org>
+Acked-by: Andres Salomon <dilinger@queued.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/platform/olpc/olpc.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/platform/olpc/olpc.c
++++ b/arch/x86/platform/olpc/olpc.c
+@@ -157,13 +157,13 @@ restart:
+ 	if (inbuf && inlen) {
+ 		/* write data to EC */
+ 		for (i = 0; i < inlen; i++) {
++			pr_devel("olpc-ec:  sending cmd arg 0x%x\n", inbuf[i]);
++			outb(inbuf[i], 0x68);
+ 			if (wait_on_ibf(0x6c, 0)) {
+ 				printk(KERN_ERR "olpc-ec:  timeout waiting for"
+ 						" EC accept data!\n");
+ 				goto err;
+ 			}
+-			pr_devel("olpc-ec:  sending cmd arg 0x%x\n", inbuf[i]);
+-			outb(inbuf[i], 0x68);
+ 		}
+ 	}
+ 	if (outbuf && outlen) {
diff --git a/queue-3.0/x86-uv-remove-uv-delay-in-starting-slave-cpus.patch b/queue-3.0/x86-uv-remove-uv-delay-in-starting-slave-cpus.patch
new file mode 100644
index 0000000000..8703056ff6
--- /dev/null
+++ b/queue-3.0/x86-uv-remove-uv-delay-in-starting-slave-cpus.patch
@@ -0,0 +1,34 @@
+From 05e33fc20ea5e493a2a1e7f1d04f43cdf89f83ed Mon Sep 17 00:00:00 2001
+From: Jack Steiner <steiner@sgi.com>
+Date: Fri, 5 Aug 2011 09:09:00 -0500
+Subject: x86, UV: Remove UV delay in starting slave cpus
+
+From: Jack Steiner <steiner@sgi.com>
+
+commit 05e33fc20ea5e493a2a1e7f1d04f43cdf89f83ed upstream.
+
+Delete the 10 msec delay between the INIT and SIPI when starting
+slave cpus. I can find no requirement for this delay. BIOS also
+has similar code sequences without the delay.
+
+Removing the delay reduces boot time by 40 sec. Every bit helps.
+
+Signed-off-by: Jack Steiner <steiner@sgi.com>
+Link: http://lkml.kernel.org/r/20110805140900.GA6774@sgi.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -207,7 +207,6 @@ static int __cpuinit uv_wakeup_secondary
+ 	    ((start_rip << UVH_IPI_INT_VECTOR_SHFT) >> 12) |
+ 	    APIC_DM_INIT;
+ 	uv_write_global_mmr64(pnode, UVH_IPI_INT, val);
+-	mdelay(10);
+ 
+ 	val = (1UL << UVH_IPI_INT_SEND_SHFT) |
+ 	    (phys_apicid << UVH_IPI_INT_APIC_ID_SHFT) |