3.0 patches

21 files changed, 1548 insertions, 2 deletions

diff --git a/queue-3.0/ath9k-initialize-tx-chainmask-before-testing-channel-tx-power-values.patch b/queue-3.0/ath9k-initialize-tx-chainmask-before-testing-channel-tx-power-values.patch
new file mode 100644
index 0000000000..689f7a8ed8
--- /dev/null
+++ b/queue-3.0/ath9k-initialize-tx-chainmask-before-testing-channel-tx-power-values.patch
@@ -0,0 +1,33 @@
+From c1227340ca65c2069222a956a68b6842d460c4f4 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 27 Jul 2011 15:01:02 +0200
+Subject: ath9k: initialize tx chainmask before testing channel tx power values
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit c1227340ca65c2069222a956a68b6842d460c4f4 upstream.
+
+With an uninitialized chainmask, the per-channel power will only contain
+the power limits for a single chain instead of the combined tx power.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/init.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -665,8 +665,10 @@ static void ath9k_init_band_txpower(stru
+ static void ath9k_init_txpower_limits(struct ath_softc *sc)
+ {
+ 	struct ath_hw *ah = sc->sc_ah;
++	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ 	struct ath9k_channel *curchan = ah->curchan;
+ 
++	ah->txchainmask = common->tx_chainmask;
+ 	if (ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ)
+ 		ath9k_init_band_txpower(sc, IEEE80211_BAND_2GHZ);
+ 	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
diff --git a/queue-3.0/ath9k-skip-config_pci_powersave-if-pcie-port-has-aspm-disabled.patch b/queue-3.0/ath9k-skip-config_pci_powersave-if-pcie-port-has-aspm-disabled.patch
new file mode 100644
index 0000000000..44f5a939db
--- /dev/null
+++ b/queue-3.0/ath9k-skip-config_pci_powersave-if-pcie-port-has-aspm-disabled.patch
@@ -0,0 +1,186 @@
+From d4930086bdd0c08a8b3a4d66a9c702297cb74a99 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 29 Jul 2011 15:59:08 +0200
+Subject: ath9k: skip ->config_pci_powersave() if PCIe port has ASPM disabled
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit d4930086bdd0c08a8b3a4d66a9c702297cb74a99 upstream.
+
+We receive many bug reports about system hang during suspend/resume
+when ath9k driver is in use. Adrian Chadd remarked that this problem
+happens on systems that have ASPM disabled.
+
+To do not hit the bug, skip doing ->config_pci_powersave magic if PCIe
+downstream port device, which ath9k device is connected to, has ASPM
+disabled.
+
+Bug was introduced by:
+
+commit 53bc7aa08b48e5cd745f986731cc7dc24eef2a9f
+Author: Vivek Natarajan <vnatarajan@atheros.com>
+Date:   Mon Apr 5 14:48:04 2010 +0530
+
+    ath9k: Add support for newer AR9285 chipsets.
+
+Patch should address:
+https://bugzilla.kernel.org/show_bug.cgi?id=37462
+https://bugzilla.kernel.org/show_bug.cgi?id=37082
+https://bugzilla.redhat.com/show_bug.cgi?id=697157
+
+however I did not receive confirmation about that, except from Camilo
+Mesias, whose system stops hang regularly with this patch (but still
+hangs from time to time, but this is probably some other bug).
+
+Tested-by: Camilo Mesias <camilo@mesias.co.uk>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9002_hw.c |    6 +-----
+ drivers/net/wireless/ath/ath9k/ar9003_hw.c |    6 +-----
+ drivers/net/wireless/ath/ath9k/hw.c        |   11 +++++++++--
+ drivers/net/wireless/ath/ath9k/hw.h        |    3 ++-
+ drivers/net/wireless/ath/ath9k/pci.c       |   27 +++++++++++++++++++++++++++
+ 5 files changed, 40 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+@@ -309,11 +309,7 @@ static void ar9002_hw_configpcipowersave
+ 	u8 i;
+ 	u32 val;
+ 
+-	if (ah->is_pciexpress != true)
+-		return;
+-
+-	/* Do not touch SerDes registers */
+-	if (ah->config.pcie_powersave_enable == 2)
++	if (ah->is_pciexpress != true || ah->aspm_enabled != true)
+ 		return;
+ 
+ 	/* Nothing to do on restore for 11N */
+--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+@@ -351,11 +351,7 @@ static void ar9003_hw_configpcipowersave
+ 					 int restore,
+ 					 int power_off)
+ {
+-	if (ah->is_pciexpress != true)
+-		return;
+-
+-	/* Do not touch SerDes registers */
+-	if (ah->config.pcie_powersave_enable == 2)
++	if (ah->is_pciexpress != true || ah->aspm_enabled != true)
+ 		return;
+ 
+ 	/* Nothing to do on restore for 11N */
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -299,6 +299,14 @@ static void ath9k_hw_disablepcie(struct
+ 	REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
+ }
+ 
++static void ath9k_hw_aspm_init(struct ath_hw *ah)
++{
++	struct ath_common *common = ath9k_hw_common(ah);
++
++	if (common->bus_ops->aspm_init)
++		common->bus_ops->aspm_init(common);
++}
++
+ /* This should work for all families including legacy */
+ static bool ath9k_hw_chip_test(struct ath_hw *ah)
+ {
+@@ -359,7 +367,6 @@ static void ath9k_hw_init_config(struct
+ 	ah->config.additional_swba_backoff = 0;
+ 	ah->config.ack_6mb = 0x0;
+ 	ah->config.cwm_ignore_extcca = 0;
+-	ah->config.pcie_powersave_enable = 0;
+ 	ah->config.pcie_clock_req = 0;
+ 	ah->config.pcie_waen = 0;
+ 	ah->config.analog_shiftreg = 1;
+@@ -577,7 +584,7 @@ static int __ath9k_hw_init(struct ath_hw
+ 
+ 
+ 	if (ah->is_pciexpress)
+-		ath9k_hw_configpcipowersave(ah, 0, 0);
++		ath9k_hw_aspm_init(ah);
+ 	else
+ 		ath9k_hw_disablepcie(ah);
+ 
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -215,7 +215,6 @@ struct ath9k_ops_config {
+ 	int additional_swba_backoff;
+ 	int ack_6mb;
+ 	u32 cwm_ignore_extcca;
+-	u8 pcie_powersave_enable;
+ 	bool pcieSerDesWrite;
+ 	u8 pcie_clock_req;
+ 	u32 pcie_waen;
+@@ -671,6 +670,7 @@ struct ath_hw {
+ 
+ 	bool sw_mgmt_crypto;
+ 	bool is_pciexpress;
++	bool aspm_enabled;
+ 	bool is_monitoring;
+ 	bool need_an_top2_fixup;
+ 	u16 tx_trig_level;
+@@ -870,6 +870,7 @@ struct ath_bus_ops {
+ 	bool (*eeprom_read)(struct ath_common *common, u32 off, u16 *data);
+ 	void (*bt_coex_prep)(struct ath_common *common);
+ 	void (*extn_synch_en)(struct ath_common *common);
++	void (*aspm_init)(struct ath_common *common);
+ };
+ 
+ static inline struct ath_common *ath9k_hw_common(struct ath_hw *ah)
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -16,6 +16,7 @@
+ 
+ #include <linux/nl80211.h>
+ #include <linux/pci.h>
++#include <linux/pci-aspm.h>
+ #include <linux/ath9k_platform.h>
+ #include "ath9k.h"
+ 
+@@ -115,12 +116,38 @@ static void ath_pci_extn_synch_enable(st
+ 	pci_write_config_byte(pdev, sc->sc_ah->caps.pcie_lcr_offset, lnkctl);
+ }
+ 
++static void ath_pci_aspm_init(struct ath_common *common)
++{
++	struct ath_softc *sc = (struct ath_softc *) common->priv;
++	struct ath_hw *ah = sc->sc_ah;
++	struct pci_dev *pdev = to_pci_dev(sc->dev);
++	struct pci_dev *parent;
++	int pos;
++	u8 aspm;
++
++	if (!pci_is_pcie(pdev))
++		return;
++
++	parent = pdev->bus->self;
++	if (WARN_ON(!parent))
++		return;
++
++	pos = pci_pcie_cap(parent);
++	pci_read_config_byte(parent, pos +  PCI_EXP_LNKCTL, &aspm);
++	if (aspm & (PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1)) {
++		ah->aspm_enabled = true;
++		/* Initialize PCIe PM and SERDES registers. */
++		ath9k_hw_configpcipowersave(ah, 0, 0);
++	}
++}
++
+ static const struct ath_bus_ops ath_pci_bus_ops = {
+ 	.ath_bus_type = ATH_PCI,
+ 	.read_cachesize = ath_pci_read_cachesize,
+ 	.eeprom_read = ath_pci_eeprom_read,
+ 	.bt_coex_prep = ath_pci_bt_coex_prep,
+ 	.extn_synch_en = ath_pci_extn_synch_enable,
++	.aspm_init = ath_pci_aspm_init,
+ };
+ 
+ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
diff --git a/queue-3.0/cris-add-missing-declaration-of-kgdb_init-and.patch b/queue-3.0/cris-add-missing-declaration-of-kgdb_init-and.patch
index 64d5f4304f..4dcf8b22ac 100644
--- a/queue-3.0/cris-add-missing-declaration-of-kgdb_init-and.patch
+++ b/queue-3.0/cris-add-missing-declaration-of-kgdb_init-and.patch
@@ -1,8 +1,7 @@
 From 1646ec9db75e151b0479dbfaf972f741d0476ec7 Mon Sep 17 00:00:00 2001
 From: WANG Cong <xiyou.wangcong@gmail.com>
 Date: Wed, 3 Aug 2011 16:21:15 -0700
-Subject: cris: add missing declaration of kgdb_init() and
- breakpoint()
+Subject: cris: add missing declaration of kgdb_init() and breakpoint()
 
 From: WANG Cong <xiyou.wangcong@gmail.com>
 
diff --git a/queue-3.0/drm-i915-fix-typo-in-drm_i915_overlay_put_image-ioctl.patch b/queue-3.0/drm-i915-fix-typo-in-drm_i915_overlay_put_image-ioctl.patch
new file mode 100644
index 0000000000..52ab1068e6
--- /dev/null
+++ b/queue-3.0/drm-i915-fix-typo-in-drm_i915_overlay_put_image-ioctl.patch
@@ -0,0 +1,36 @@
+From 842d452985300f4ec14c68cb86046e8a1a3b7251 Mon Sep 17 00:00:00 2001
+From: Ole Henrik Jahren <olehenja@alumni.ntnu.no>
+Date: Fri, 22 Jul 2011 15:56:01 +0200
+Subject: drm/i915: Fix typo in DRM_I915_OVERLAY_PUT_IMAGE ioctl define
+
+From: Ole Henrik Jahren <olehenja@alumni.ntnu.no>
+
+commit 842d452985300f4ec14c68cb86046e8a1a3b7251 upstream.
+
+Because of a typo, calling ioctl with DRM_IOCTL_I915_OVERLAY_PUT_IMAGE
+is broken if the macro is used directly. When using libdrm the bug is
+not hit, since libdrm handles the ioctl encoding internally.
+
+The typo also leads to the .cmd and .cmd_drv fields of the drm_ioctl
+structure for DRM_I915_OVERLAY_PUT_IMAGE having inconsistent content.
+
+Signed-off-by: Ole Henrik Jahren <olehenja@alumni.ntnu.no>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/drm/i915_drm.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/drm/i915_drm.h
++++ b/include/drm/i915_drm.h
+@@ -237,7 +237,7 @@ typedef struct _drm_i915_sarea {
+ #define DRM_IOCTL_I915_GEM_GET_APERTURE	DRM_IOR  (DRM_COMMAND_BASE + DRM_I915_GEM_GET_APERTURE, struct drm_i915_gem_get_aperture)
+ #define DRM_IOCTL_I915_GET_PIPE_FROM_CRTC_ID DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GET_PIPE_FROM_CRTC_ID, struct drm_i915_get_pipe_from_crtc_id)
+ #define DRM_IOCTL_I915_GEM_MADVISE	DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_MADVISE, struct drm_i915_gem_madvise)
+-#define DRM_IOCTL_I915_OVERLAY_PUT_IMAGE	DRM_IOW(DRM_COMMAND_BASE + DRM_IOCTL_I915_OVERLAY_ATTRS, struct drm_intel_overlay_put_image)
++#define DRM_IOCTL_I915_OVERLAY_PUT_IMAGE	DRM_IOW(DRM_COMMAND_BASE + DRM_I915_OVERLAY_PUT_IMAGE, struct drm_intel_overlay_put_image)
+ #define DRM_IOCTL_I915_OVERLAY_ATTRS	DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_OVERLAY_ATTRS, struct drm_intel_overlay_attrs)
+ 
+ /* Allow drivers to submit batchbuffers directly to hardware, relying
diff --git a/queue-3.0/drm-i915-hold-mode_config-mutex-during-hotplug-processing.patch b/queue-3.0/drm-i915-hold-mode_config-mutex-during-hotplug-processing.patch
new file mode 100644
index 0000000000..e0da913711
--- /dev/null
+++ b/queue-3.0/drm-i915-hold-mode_config-mutex-during-hotplug-processing.patch
@@ -0,0 +1,48 @@
+From a65e34c79c88895766ab1f8a5afa451eed26622b Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Mon, 25 Jul 2011 10:04:56 -0700
+Subject: drm/i915: Hold mode_config->mutex during hotplug processing
+
+From: Keith Packard <keithp@keithp.com>
+
+commit a65e34c79c88895766ab1f8a5afa451eed26622b upstream.
+
+Hotplug detection is a mode setting operation and must hold the
+struct_mutex or risk colliding with other mode setting operations.
+
+In particular, the display port hotplug function attempts to re-train
+the link if the monitor is supposed to be running when plugged back
+in. If that happens while mode setting is underway, the link will get
+scrambled, leaving it in an inconsistent state.
+
+This is a special case -- usually the driver mode setting entry points
+are covered by the upper level DRM code, but in this case the function
+is invoked as a work function not under the control of DRM.
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_irq.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -306,6 +306,7 @@ static void i915_hotplug_work_func(struc
+ 	struct drm_mode_config *mode_config = &dev->mode_config;
+ 	struct intel_encoder *encoder;
+ 
++	mutex_lock(&mode_config->mutex);
+ 	DRM_DEBUG_KMS("running encoder hotplug functions\n");
+ 
+ 	list_for_each_entry(encoder, &mode_config->encoder_list, base.head)
+@@ -314,6 +315,8 @@ static void i915_hotplug_work_func(struc
+ 
+ 	/* Just fire off a uevent and let userspace tell us what to do */
+ 	drm_helper_hpd_irq_event(dev);
++
++	mutex_unlock(&mode_config->mutex);
+ }
+ 
+ static void i915_handle_rps_change(struct drm_device *dev)
diff --git a/queue-3.0/drm-i915-initialize-rcs-ring-status-page-address-in.patch b/queue-3.0/drm-i915-initialize-rcs-ring-status-page-address-in.patch
new file mode 100644
index 0000000000..c6f06a91f9
--- /dev/null
+++ b/queue-3.0/drm-i915-initialize-rcs-ring-status-page-address-in.patch
@@ -0,0 +1,63 @@
+From f3234706a77bd6e1592ae71fb3268e04cb030dba Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Fri, 22 Jul 2011 10:44:39 -0700
+Subject: drm/i915: Initialize RCS ring status page address in intel_render_ring_init_dri
+
+From: Keith Packard <keithp@keithp.com>
+
+commit f3234706a77bd6e1592ae71fb3268e04cb030dba upstream.
+
+Physically-addressed hardware status pages are initialized early in
+the driver load process by i915_init_phys_hws. For UMS environments,
+the ring structure is not initialized until the X server starts. At
+that point, the entire ring structure is re-initialized with all new
+values. Any values set in the ring structure (including
+ring->status_page.page_addr) will be lost when the ring is
+re-initialized.
+
+This patch moves the initialization of the status_page.page_addr value
+to intel_render_ring_init_dri.
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_dma.c         |    6 ++----
+ drivers/gpu/drm/i915/intel_ringbuffer.c |    3 +++
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -61,7 +61,6 @@ static void i915_write_hws_pga(struct dr
+ static int i915_init_phys_hws(struct drm_device *dev)
+ {
+ 	drm_i915_private_t *dev_priv = dev->dev_private;
+-	struct intel_ring_buffer *ring = LP_RING(dev_priv);
+ 
+ 	/* Program Hardware Status Page */
+ 	dev_priv->status_page_dmah =
+@@ -71,10 +70,9 @@ static int i915_init_phys_hws(struct drm
+ 		DRM_ERROR("Can not allocate hardware status page\n");
+ 		return -ENOMEM;
+ 	}
+-	ring->status_page.page_addr =
+-		(void __force __iomem *)dev_priv->status_page_dmah->vaddr;
+ 
+-	memset_io(ring->status_page.page_addr, 0, PAGE_SIZE);
++	memset_io((void __force __iomem *)dev_priv->status_page_dmah->vaddr,
++		  0, PAGE_SIZE);
+ 
+ 	i915_write_hws_pga(dev);
+ 
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -1319,6 +1319,9 @@ int intel_render_ring_init_dri(struct dr
+ 		ring->get_seqno = pc_render_get_seqno;
+ 	}
+ 
++	if (!I915_NEED_GFX_HWS(dev))
++		ring->status_page.page_addr = dev_priv->status_page_dmah->vaddr;
++
+ 	ring->dev = dev;
+ 	INIT_LIST_HEAD(&ring->active_list);
+ 	INIT_LIST_HEAD(&ring->request_list);
diff --git a/queue-3.0/drm-i915-load-the-lut-before-pipe-enable-on-ilk.patch b/queue-3.0/drm-i915-load-the-lut-before-pipe-enable-on-ilk.patch
new file mode 100644
index 0000000000..3888f227fb
--- /dev/null
+++ b/queue-3.0/drm-i915-load-the-lut-before-pipe-enable-on-ilk.patch
@@ -0,0 +1,43 @@
+From 9c54c0dd948d715ccfd79e97d852f80eeb53254a Mon Sep 17 00:00:00 2001
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+Date: Wed, 15 Jun 2011 23:32:33 +0200
+Subject: drm/i915: load the LUT before pipe enable on ILK+
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit 9c54c0dd948d715ccfd79e97d852f80eeb53254a upstream.
+
+Per the specs and to address
+https://bugs.freedesktop.org/show_bug.cgi?id=36888.
+
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2699,14 +2699,18 @@ static void ironlake_crtc_enable(struct
+ 		I915_WRITE(PF_WIN_SZ(pipe), dev_priv->pch_pf_size);
+ 	}
+ 
++	/*
++	 * On ILK+ LUT must be loaded before the pipe is running but with
++	 * clocks enabled
++	 */
++	intel_crtc_load_lut(crtc);
++
+ 	intel_enable_pipe(dev_priv, pipe, is_pch_port);
+ 	intel_enable_plane(dev_priv, plane, pipe);
+ 
+ 	if (is_pch_port)
+ 		ironlake_pch_enable(crtc);
+ 
+-	intel_crtc_load_lut(crtc);
+-
+ 	mutex_lock(&dev->struct_mutex);
+ 	intel_update_fbc(dev);
+ 	mutex_unlock(&dev->struct_mutex);
diff --git a/queue-3.0/drm-i915-pch-fix-integer-math-bugs-in-panel-fitting.patch b/queue-3.0/drm-i915-pch-fix-integer-math-bugs-in-panel-fitting.patch
new file mode 100644
index 0000000000..4908ca76ce
--- /dev/null
+++ b/queue-3.0/drm-i915-pch-fix-integer-math-bugs-in-panel-fitting.patch
@@ -0,0 +1,71 @@
+From 302983e9059e9ef5de3ca7671918eeb237c5971e Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Wed, 13 Jul 2011 16:32:32 -0400
+Subject: drm/i915/pch: Fix integer math bugs in panel fitting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Adam Jackson <ajax@redhat.com>
+
+commit 302983e9059e9ef5de3ca7671918eeb237c5971e upstream.
+
+Consider a 1600x900 panel, upscaling a 1360x768 mode, full-aspect.  The
+old math would give you:
+
+    scaled_width  = 1600 * 768;         /* 1228800 */
+    scaled_height = 1360 * 900;         /* 1224000 */
+    if (scaled_width > scaled_height) { /* pillarbox, and true */
+        width  = 1224000 / 768;         /* int(1593.75) = 1593 */
+        x      = (1600 - 1593 + 1) / 2; /* 4 */
+        y      = 0;
+        height = 768;
+    } /* ... */
+
+This is broken.  The total width of scanout would then be 1593 + 4 + 4,
+or 1601, which is wider than the panel itself.  The hardware very
+dutifully implements this, and you end up with a black 45° diagonal from
+the top-left corner to the bottom edge of the screen.  It's a cool
+effect and all, but not what you wanted.  Similar things happen for the
+letterbox case.
+
+The problem is that you have an integer number of pixels, which means
+it's usually impossible to upscale equally on both axes.  1360/768 is
+1.7708, 1600/900 is 1.7777.  Since we're constrained on the one axis,
+the other one wants to come out as an even number of pixels (the panel
+is almost certainly even on both axes, and the x/y offsets will be
+applied on both sides).  In the math above, if 'width' comes out even,
+rounding down is correct; if it's odd, you'd rather round up.  So just
+increment width/height in those cases.
+
+Tested on a Lenovo T500 (Ironlake).
+
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+Tested-By: Daniel Manrique <daniel.manrique@canonical.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38851
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_panel.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -83,11 +83,15 @@ intel_pch_panel_fitting(struct drm_devic
+ 			u32 scaled_height = mode->hdisplay * adjusted_mode->vdisplay;
+ 			if (scaled_width > scaled_height) { /* pillar */
+ 				width = scaled_height / mode->vdisplay;
++				if (width & 1)
++				    	width++;
+ 				x = (adjusted_mode->hdisplay - width + 1) / 2;
+ 				y = 0;
+ 				height = adjusted_mode->vdisplay;
+ 			} else if (scaled_width < scaled_height) { /* letter */
+ 				height = scaled_width / mode->hdisplay;
++				if (height & 1)
++				    height++;
+ 				y = (adjusted_mode->vdisplay - height + 1) / 2;
+ 				x = 0;
+ 				width = adjusted_mode->hdisplay;
diff --git a/queue-3.0/drm-radeon-extended-ddc-probing-for-connectors-with.patch b/queue-3.0/drm-radeon-extended-ddc-probing-for-connectors-with.patch
new file mode 100644
index 0000000000..8f0d87b018
--- /dev/null
+++ b/queue-3.0/drm-radeon-extended-ddc-probing-for-connectors-with.patch
@@ -0,0 +1,236 @@
+From e384fab8c6f3ca88600bcb2ebdf0eb2f90864fab Mon Sep 17 00:00:00 2001
+From: Thomas Reim <reimth@gmail.com>
+Date: Fri, 29 Jul 2011 14:28:58 +0000
+Subject: drm/radeon: Extended DDC Probing for Connectors with Improperly Wired DDC Lines (here: Asus M2A-VM HDMI)
+
+From: Thomas Reim <reimth@gmail.com>
+
+commit e384fab8c6f3ca88600bcb2ebdf0eb2f90864fab upstream.
+
+    Some integrated ATI Radeon chipset implementations with add-on HDMI card
+    (e. g. Asus M2A-VM HDMI) indicate the availability of a DDC even
+    when the add-on card is not plugged in or HDMI is disabled in BIOS setup.
+    In this case, drm_get_edid() and drm_edid_block_valid() periodically
+    dump data and kernel errors into system log files and onto terminals.
+    For these connectors DDC probing is extended by a check for a correct
+    EDID header. Only in case a valid EDID header is also found, the
+    (HDMI or DVI) connector will be used by the Radeon driver. This prevents
+    the kernel driver from useless flooding of logs and terminal sessions with
+    EDID dumps and error messages.
+    This patch adds a flag 'requires_extended_probe' to the radeon_connector
+    structure. In function radeon_connector_needs_extended_probe() this flag
+    can be set on a chipset family/vendor/connector type specific basis.
+    In addition, function radeon_ddc_probe() has been adapted to perform
+    extended DDC probing if required by the connector's flag.
+    Requires function drm_edid_header_is_valid() in DRM module provided by
+    [PATCH] drm: Separate EDID Header Check from EDID Block Check.
+
+    Tested for kernel 2.6.35, 2.6.38 and 3.0 on Asus M2A-VM HDMI board
+
+    BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=668196
+    BugLink: http://bugs.launchpad.net/bugs/7228066
+
+Signed-off-by: Thomas Reim <reimth@gmail.com>
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Acked-by: Stephen Michaels <Stephen.Micheals@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c |   45 +++++++++++++++++++++++++++--
+ drivers/gpu/drm/radeon/radeon_display.c    |    9 +++++
+ drivers/gpu/drm/radeon/radeon_i2c.c        |   32 +++++++++++++++-----
+ drivers/gpu/drm/radeon/radeon_mode.h       |    6 +++
+ 4 files changed, 80 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -430,6 +430,36 @@ int radeon_connector_set_property(struct
+ 	return 0;
+ }
+ 
++/*
++ * Some integrated ATI Radeon chipset implementations (e. g.
++ * Asus M2A-VM HDMI) may indicate the availability of a DDC,
++ * even when there's no monitor connected. For these connectors
++ * following DDC probe extension will be applied: check also for the
++ * availability of EDID with at least a correct EDID header. Only then,
++ * DDC is assumed to be available. This prevents drm_get_edid() and
++ * drm_edid_block_valid() from periodically dumping data and kernel
++ * errors into the logs and onto the terminal.
++ */
++static bool radeon_connector_needs_extended_probe(struct radeon_device *dev,
++				     uint32_t supported_device,
++				     int connector_type)
++{
++	/* Asus M2A-VM HDMI board sends data to i2c bus even,
++	 * if HDMI add-on card is not plugged in or HDMI is disabled in
++	 * BIOS. Valid DDC can only be assumed, if also a valid EDID header
++	 * can be retrieved via i2c bus during DDC probe */
++	if ((dev->pdev->device == 0x791e) &&
++	    (dev->pdev->subsystem_vendor == 0x1043) &&
++	    (dev->pdev->subsystem_device == 0x826d)) {
++		if ((connector_type == DRM_MODE_CONNECTOR_HDMIA) &&
++		    (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
++			return true;
++	}
++
++	/* Default: no EDID header probe required for DDC probing */
++	return false;
++}
++
+ static void radeon_fixup_lvds_native_mode(struct drm_encoder *encoder,
+ 					  struct drm_connector *connector)
+ {
+@@ -661,7 +691,8 @@ radeon_vga_detect(struct drm_connector *
+ 		ret = connector_status_disconnected;
+ 
+ 	if (radeon_connector->ddc_bus)
+-		dret = radeon_ddc_probe(radeon_connector);
++		dret = radeon_ddc_probe(radeon_connector,
++					radeon_connector->requires_extended_probe);
+ 	if (dret) {
+ 		if (radeon_connector->edid) {
+ 			kfree(radeon_connector->edid);
+@@ -833,7 +864,8 @@ radeon_dvi_detect(struct drm_connector *
+ 	bool dret = false;
+ 
+ 	if (radeon_connector->ddc_bus)
+-		dret = radeon_ddc_probe(radeon_connector);
++		dret = radeon_ddc_probe(radeon_connector,
++					radeon_connector->requires_extended_probe);
+ 	if (dret) {
+ 		if (radeon_connector->edid) {
+ 			kfree(radeon_connector->edid);
+@@ -1251,7 +1283,8 @@ radeon_dp_detect(struct drm_connector *c
+ 				if (radeon_dp_getdpcd(radeon_connector))
+ 					ret = connector_status_connected;
+ 			} else {
+-				if (radeon_ddc_probe(radeon_connector))
++				if (radeon_ddc_probe(radeon_connector,
++						     radeon_connector->requires_extended_probe))
+ 					ret = connector_status_connected;
+ 			}
+ 		}
+@@ -1406,6 +1439,9 @@ radeon_add_atom_connector(struct drm_dev
+ 	radeon_connector->shared_ddc = shared_ddc;
+ 	radeon_connector->connector_object_id = connector_object_id;
+ 	radeon_connector->hpd = *hpd;
++	radeon_connector->requires_extended_probe =
++		radeon_connector_needs_extended_probe(rdev, supported_device,
++							connector_type);
+ 	radeon_connector->router = *router;
+ 	if (router->ddc_valid || router->cd_valid) {
+ 		radeon_connector->router_bus = radeon_i2c_lookup(rdev, &router->i2c_info);
+@@ -1752,6 +1788,9 @@ radeon_add_legacy_connector(struct drm_d
+ 	radeon_connector->devices = supported_device;
+ 	radeon_connector->connector_object_id = connector_object_id;
+ 	radeon_connector->hpd = *hpd;
++	radeon_connector->requires_extended_probe =
++		radeon_connector_needs_extended_probe(rdev, supported_device,
++							connector_type);
+ 	switch (connector_type) {
+ 	case DRM_MODE_CONNECTOR_VGA:
+ 		drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -777,8 +777,17 @@ static int radeon_ddc_dump(struct drm_co
+ 	if (!radeon_connector->ddc_bus)
+ 		return -1;
+ 	edid = drm_get_edid(connector, &radeon_connector->ddc_bus->adapter);
++	/* Log EDID retrieval status here. In particular with regard to
++	 * connectors with requires_extended_probe flag set, that will prevent
++	 * function radeon_dvi_detect() to fetch EDID on this connector,
++	 * as long as there is no valid EDID header found */
+ 	if (edid) {
++		DRM_INFO("Radeon display connector %s: Found valid EDID",
++				drm_get_connector_name(connector));
+ 		kfree(edid);
++	} else {
++		DRM_INFO("Radeon display connector %s: No monitor connected or invalid EDID",
++				drm_get_connector_name(connector));
+ 	}
+ 	return ret;
+ }
+--- a/drivers/gpu/drm/radeon/radeon_i2c.c
++++ b/drivers/gpu/drm/radeon/radeon_i2c.c
+@@ -32,17 +32,17 @@
+  * radeon_ddc_probe
+  *
+  */
+-bool radeon_ddc_probe(struct radeon_connector *radeon_connector)
++bool radeon_ddc_probe(struct radeon_connector *radeon_connector, bool requires_extended_probe)
+ {
+-	u8 out_buf[] = { 0x0, 0x0};
+-	u8 buf[2];
++	u8 out = 0x0;
++	u8 buf[8];
+ 	int ret;
+ 	struct i2c_msg msgs[] = {
+ 		{
+ 			.addr = 0x50,
+ 			.flags = 0,
+ 			.len = 1,
+-			.buf = out_buf,
++			.buf = &out,
+ 		},
+ 		{
+ 			.addr = 0x50,
+@@ -52,15 +52,31 @@ bool radeon_ddc_probe(struct radeon_conn
+ 		}
+ 	};
+ 
++	/* Read 8 bytes from i2c for extended probe of EDID header */
++	if (requires_extended_probe)
++		msgs[1].len = 8;
++
+ 	/* on hw with routers, select right port */
+ 	if (radeon_connector->router.ddc_valid)
+ 		radeon_router_select_ddc_port(radeon_connector);
+ 
+ 	ret = i2c_transfer(&radeon_connector->ddc_bus->adapter, msgs, 2);
+-	if (ret == 2)
+-		return true;
+-
+-	return false;
++	if (ret != 2)
++		/* Couldn't find an accessible DDC on this connector */
++		return false;
++	if (requires_extended_probe) {
++		/* Probe also for valid EDID header
++		 * EDID header starts with:
++		 * 0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0x00.
++		 * Only the first 6 bytes must be valid as
++		 * drm_edid_block_valid() can fix the last 2 bytes */
++		if (drm_edid_header_is_valid(buf) < 6) {
++			/* Couldn't find an accessible EDID on this
++			 * connector */
++			return false;
++		}
++	}
++	return true;
+ }
+ 
+ /* bit banging i2c */
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -438,6 +438,9 @@ struct radeon_connector {
+ 	struct radeon_i2c_chan *ddc_bus;
+ 	/* some systems have an hdmi and vga port with a shared ddc line */
+ 	bool shared_ddc;
++	/* for some Radeon chip families we apply an additional EDID header
++	   check as part of the DDC probe */
++	bool requires_extended_probe;
+ 	bool use_digital;
+ 	/* we need to mind the EDID between detect
+ 	   and get modes due to analog/digital/tvencoder */
+@@ -514,7 +517,8 @@ extern void radeon_i2c_put_byte(struct r
+ 				u8 val);
+ extern void radeon_router_select_ddc_port(struct radeon_connector *radeon_connector);
+ extern void radeon_router_select_cd_port(struct radeon_connector *radeon_connector);
+-extern bool radeon_ddc_probe(struct radeon_connector *radeon_connector);
++extern bool radeon_ddc_probe(struct radeon_connector *radeon_connector,
++			bool requires_extended_probe);
+ extern int radeon_ddc_get_modes(struct radeon_connector *radeon_connector);
+ 
+ extern struct drm_encoder *radeon_best_encoder(struct drm_connector *connector);
diff --git a/queue-3.0/drm-radeon-extended-ddc-probing-for-ecs-a740gm-m-dvi-d.patch b/queue-3.0/drm-radeon-extended-ddc-probing-for-ecs-a740gm-m-dvi-d.patch
new file mode 100644
index 0000000000..2ea74bd2ac
--- /dev/null
+++ b/queue-3.0/drm-radeon-extended-ddc-probing-for-ecs-a740gm-m-dvi-d.patch
@@ -0,0 +1,49 @@
+From a81b31e9fc98e067b7e7f1244861c97e44268e2d Mon Sep 17 00:00:00 2001
+From: Thomas Reim <reimth@gmail.com>
+Date: Fri, 29 Jul 2011 14:29:00 +0000
+Subject: drm/radeon: Extended DDC Probing for ECS A740GM-M DVI-D Connector
+
+From: Thomas Reim <reimth@gmail.com>
+
+commit a81b31e9fc98e067b7e7f1244861c97e44268e2d upstream.
+
+   ECS A740GM-M with ATI RADEON 2100 sends data to i2c bus
+   for a DVI connector that is not implemented/existent on the board.
+
+   Fix by applying extented DDC probing for this connector.
+
+   Requires [PATCH] drm/radeon: Extended DDC Probing for Connectors
+   with Improperly Wired DDC Lines
+
+   Tested for kernel 2.6.38 on Asus ECS A740GM-M board
+
+   BugLink: http://bugs.launchpad.net/bugs/810926
+
+Signed-off-by: Thomas Reim <reimth@gmail.com>
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Acked-by: Stephen Michaels <Stephen.Micheals@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -455,6 +455,15 @@ static bool radeon_connector_needs_exten
+ 		    (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
+ 			return true;
+ 	}
++	/* ECS A740GM-M with ATI RADEON 2100 sends data to i2c bus
++	 * for a DVI connector that is not implemented */
++	if ((dev->pdev->device == 0x796e) &&
++	    (dev->pdev->subsystem_vendor == 0x1019) &&
++	    (dev->pdev->subsystem_device == 0x2615)) {
++		if ((connector_type == DRM_MODE_CONNECTOR_DVID) &&
++		    (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
++			return true;
++	}
+ 
+ 	/* Default: no EDID header probe required for DDC probing */
+ 	return false;
diff --git a/queue-3.0/drm-radeon-log-subsystem-vendor-and-device-information.patch b/queue-3.0/drm-radeon-log-subsystem-vendor-and-device-information.patch
new file mode 100644
index 0000000000..97bd14216c
--- /dev/null
+++ b/queue-3.0/drm-radeon-log-subsystem-vendor-and-device-information.patch
@@ -0,0 +1,40 @@
+From d522d9cc5bdd41214084383fc3e6d882f6916a78 Mon Sep 17 00:00:00 2001
+From: Thomas Reim <reimth@gmail.com>
+Date: Fri, 29 Jul 2011 14:28:59 +0000
+Subject: drm/radeon: Log Subsystem Vendor and Device Information
+
+From: Thomas Reim <reimth@gmail.com>
+
+commit d522d9cc5bdd41214084383fc3e6d882f6916a78 upstream.
+
+    Log PCI subsystem vendor and subsystem device ID in addition to
+    PCI vendor and device ID during kernel mode initialisation. This helps
+    to better identify radeon devices of third-party vendors, e. g. for
+    bug analysis.
+
+    Tested for kernel 2.6.35, 2.6.38 and 3.0 on Asus M2A-VM HDMI board
+
+Signed-off-by: Thomas Reim <reimth@gmail.com>
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Acked-by: Stephen Michaels <Stephen.Micheals@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -704,8 +704,9 @@ int radeon_device_init(struct radeon_dev
+ 	rdev->gpu_lockup = false;
+ 	rdev->accel_working = false;
+ 
+-	DRM_INFO("initializing kernel modesetting (%s 0x%04X:0x%04X).\n",
+-		radeon_family_name[rdev->family], pdev->vendor, pdev->device);
++	DRM_INFO("initializing kernel modesetting (%s 0x%04X:0x%04X 0x%04X:0x%04X).\n",
++		radeon_family_name[rdev->family], pdev->vendor, pdev->device,
++		pdev->subsystem_vendor, pdev->subsystem_device);
+ 
+ 	/* mutex initialization are all done here so we
+ 	 * can recall function without having locking issues */
diff --git a/queue-3.0/drm-separate-edid-header-check-from-edid-block-check.patch b/queue-3.0/drm-separate-edid-header-check-from-edid-block-check.patch
new file mode 100644
index 0000000000..dc4036b919
--- /dev/null
+++ b/queue-3.0/drm-separate-edid-header-check-from-edid-block-check.patch
@@ -0,0 +1,78 @@
+From 051963d4832ed61e5ae74f5330b0a94489e101b9 Mon Sep 17 00:00:00 2001
+From: Thomas Reim <reimth@gmail.com>
+Date: Fri, 29 Jul 2011 14:28:57 +0000
+Subject: drm: Separate EDID Header Check from EDID Block Check
+
+From: Thomas Reim <reimth@gmail.com>
+
+commit 051963d4832ed61e5ae74f5330b0a94489e101b9 upstream.
+
+    Provides function drm_edid_header_is_valid() for EDID header check
+    and replaces EDID header check part of function drm_edid_block_valid()
+    by a call of drm_edid_header_is_valid().
+    This is a prerequisite to extend DDC probing, e. g. in function
+    radeon_ddc_probe() for Radeon devices, by a central EDID header check.
+
+    Tested for kernel 2.6.35, 2.6.38 and 3.0
+
+Signed-off-by: Thomas Reim <reimth@gmail.com>
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Acked-by: Stephen Michaels <Stephen.Micheals@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_edid.c |   24 ++++++++++++++++++------
+ include/drm/drm_crtc.h     |    1 +
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -127,6 +127,23 @@ static const u8 edid_header[] = {
+ 	0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00
+ };
+ 
++ /*
++ * Sanity check the header of the base EDID block.  Return 8 if the header
++ * is perfect, down to 0 if it's totally wrong.
++ */
++int drm_edid_header_is_valid(const u8 *raw_edid)
++{
++	int i, score = 0;
++
++	for (i = 0; i < sizeof(edid_header); i++)
++		if (raw_edid[i] == edid_header[i])
++			score++;
++
++	return score;
++}
++EXPORT_SYMBOL(drm_edid_header_is_valid);
++
++
+ /*
+  * Sanity check the EDID block (base or extension).  Return 0 if the block
+  * doesn't check out, or 1 if it's valid.
+@@ -139,12 +156,7 @@ drm_edid_block_valid(u8 *raw_edid)
+ 	struct edid *edid = (struct edid *)raw_edid;
+ 
+ 	if (raw_edid[0] == 0x00) {
+-		int score = 0;
+-
+-		for (i = 0; i < sizeof(edid_header); i++)
+-			if (raw_edid[i] == edid_header[i])
+-				score++;
+-
++		int score = drm_edid_header_is_valid(raw_edid);
+ 		if (score == 8) ;
+ 		else if (score >= 6) {
+ 			DRM_DEBUG("Fixing EDID header, your hardware may be failing\n");
+--- a/include/drm/drm_crtc.h
++++ b/include/drm/drm_crtc.h
+@@ -802,6 +802,7 @@ extern struct drm_display_mode *drm_gtf_
+ extern int drm_add_modes_noedid(struct drm_connector *connector,
+ 				int hdisplay, int vdisplay);
+ 
++extern int drm_edid_header_is_valid(const u8 *raw_edid);
+ extern bool drm_edid_is_valid(struct edid *edid);
+ struct drm_display_mode *drm_mode_find_dmt(struct drm_device *dev,
+ 					   int hsize, int vsize, int fresh);
diff --git a/queue-3.0/iwlegacy-set-tx-power-after-rxon_assoc.patch b/queue-3.0/iwlegacy-set-tx-power-after-rxon_assoc.patch
new file mode 100644
index 0000000000..e732063725
--- /dev/null
+++ b/queue-3.0/iwlegacy-set-tx-power-after-rxon_assoc.patch
@@ -0,0 +1,64 @@
+From 17e859a899712d16c3e70b045d61ad9e02c53f8a Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 27 Jul 2011 15:37:43 +0200
+Subject: iwlegacy: set tx power after rxon_assoc
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 17e859a899712d16c3e70b045d61ad9e02c53f8a upstream.
+
+If settings of tx power was deferred during scan or changing channel we
+have to setup them during commit rxon. Fix problem on 3945 (4965 already
+has this fix).
+
+Optimize code to apply tx settings only when tx power was actually
+changed.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlegacy/iwl-3945.c |    6 +++++-
+ drivers/net/wireless/iwlegacy/iwl-4965.c |    8 ++++++--
+ 2 files changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/iwlegacy/iwl-3945.c
++++ b/drivers/net/wireless/iwlegacy/iwl-3945.c
+@@ -1747,7 +1747,11 @@ int iwl3945_commit_rxon(struct iwl_priv
+ 		}
+ 
+ 		memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
+-
++		/*
++		 * We do not commit tx power settings while channel changing,
++		 * do it now if tx power changed.
++		 */
++		iwl_legacy_set_tx_power(priv, priv->tx_power_next, false);
+ 		return 0;
+ 	}
+ 
+--- a/drivers/net/wireless/iwlegacy/iwl-4965.c
++++ b/drivers/net/wireless/iwlegacy/iwl-4965.c
+@@ -1237,7 +1237,12 @@ static int iwl4965_commit_rxon(struct iw
+ 
+ 		memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
+ 		iwl_legacy_print_rx_config_cmd(priv, ctx);
+-		goto set_tx_power;
++		/*
++		 * We do not commit tx power settings while channel changing,
++		 * do it now if tx power changed.
++		 */
++		iwl_legacy_set_tx_power(priv, priv->tx_power_next, false);
++		return 0;
+ 	}
+ 
+ 	/* If we are currently associated and the new config requires
+@@ -1317,7 +1322,6 @@ static int iwl4965_commit_rxon(struct iw
+ 
+ 	iwl4965_init_sensitivity(priv);
+ 
+-set_tx_power:
+ 	/* If we issue a new RXON command which required a tune then we must
+ 	 * send a new TXPOWER command or we won't be able to Tx any frames */
+ 	ret = iwl_legacy_set_tx_power(priv, priv->tx_power_next, true);
diff --git a/queue-3.0/net-cap-number-of-elements-for-sendmmsg.patch b/queue-3.0/net-cap-number-of-elements-for-sendmmsg.patch
new file mode 100644
index 0000000000..9ca9892cc3
--- /dev/null
+++ b/queue-3.0/net-cap-number-of-elements-for-sendmmsg.patch
@@ -0,0 +1,36 @@
+From 98382f419f32d2c12d021943b87dea555677144b Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Thu, 4 Aug 2011 14:07:39 +0000
+Subject: net: Cap number of elements for sendmmsg
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 98382f419f32d2c12d021943b87dea555677144b upstream.
+
+To limit the amount of time we can spend in sendmmsg, cap the
+number of elements to UIO_MAXIOV (currently 1024).
+
+For error handling an application using sendmmsg needs to retry at
+the first unsent message, so capping is simpler and requires less
+application logic than returning EINVAL.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1999,6 +1999,9 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ 	struct compat_mmsghdr __user *compat_entry;
+ 	struct msghdr msg_sys;
+ 
++	if (vlen > UIO_MAXIOV)
++		vlen = UIO_MAXIOV;
++
+ 	datagrams = 0;
+ 
+ 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
diff --git a/queue-3.0/net-fix-security_socket_sendmsg-bypass-problem.patch b/queue-3.0/net-fix-security_socket_sendmsg-bypass-problem.patch
new file mode 100644
index 0000000000..a205e68d75
--- /dev/null
+++ b/queue-3.0/net-fix-security_socket_sendmsg-bypass-problem.patch
@@ -0,0 +1,127 @@
+From c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Thu, 4 Aug 2011 14:07:40 +0000
+Subject: net: Fix security_socket_sendmsg() bypass problem.
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a upstream.
+
+The sendmmsg() introduced by commit 228e548e "net: Add sendmmsg socket system
+call" is capable of sending to multiple different destination addresses.
+
+SMACK is using destination's address for checking sendmsg() permission.
+However, security_socket_sendmsg() is called for only once even if multiple
+different destination addresses are passed to sendmmsg().
+
+Therefore, we need to call security_socket_sendmsg() for each destination
+address rather than only the first destination address.
+
+Since calling security_socket_sendmsg() every time when only single destination
+address was passed to sendmmsg() is a waste of time, omit calling
+security_socket_sendmsg() unless destination address of previous datagram and
+that of current datagram differs.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Acked-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c |   43 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 34 insertions(+), 9 deletions(-)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1871,8 +1871,14 @@ SYSCALL_DEFINE2(shutdown, int, fd, int,
+ #define COMPAT_NAMELEN(msg)	COMPAT_MSG(msg, msg_namelen)
+ #define COMPAT_FLAGS(msg)	COMPAT_MSG(msg, msg_flags)
+ 
++struct used_address {
++	struct sockaddr_storage name;
++	unsigned int name_len;
++};
++
+ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+-			 struct msghdr *msg_sys, unsigned flags, int nosec)
++			 struct msghdr *msg_sys, unsigned flags,
++			 struct used_address *used_address)
+ {
+ 	struct compat_msghdr __user *msg_compat =
+ 	    (struct compat_msghdr __user *)msg;
+@@ -1953,8 +1959,28 @@ static int __sys_sendmsg(struct socket *
+ 
+ 	if (sock->file->f_flags & O_NONBLOCK)
+ 		msg_sys->msg_flags |= MSG_DONTWAIT;
+-	err = (nosec ? sock_sendmsg_nosec : sock_sendmsg)(sock, msg_sys,
+-							  total_len);
++	/*
++	 * If this is sendmmsg() and current destination address is same as
++	 * previously succeeded address, omit asking LSM's decision.
++	 * used_address->name_len is initialized to UINT_MAX so that the first
++	 * destination address never matches.
++	 */
++	if (used_address && used_address->name_len == msg_sys->msg_namelen &&
++	    !memcmp(&used_address->name, msg->msg_name,
++		    used_address->name_len)) {
++		err = sock_sendmsg_nosec(sock, msg_sys, total_len);
++		goto out_freectl;
++	}
++	err = sock_sendmsg(sock, msg_sys, total_len);
++	/*
++	 * If this is sendmmsg() and sending to current destination address was
++	 * successful, remember it.
++	 */
++	if (used_address && err >= 0) {
++		used_address->name_len = msg_sys->msg_namelen;
++		memcpy(&used_address->name, msg->msg_name,
++		       used_address->name_len);
++	}
+ 
+ out_freectl:
+ 	if (ctl_buf != ctl)
+@@ -1979,7 +2005,7 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
+ 	if (!sock)
+ 		goto out;
+ 
+-	err = __sys_sendmsg(sock, msg, &msg_sys, flags, 0);
++	err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
+ 
+ 	fput_light(sock->file, fput_needed);
+ out:
+@@ -1998,6 +2024,7 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ 	struct mmsghdr __user *entry;
+ 	struct compat_mmsghdr __user *compat_entry;
+ 	struct msghdr msg_sys;
++	struct used_address used_address;
+ 
+ 	if (vlen > UIO_MAXIOV)
+ 		vlen = UIO_MAXIOV;
+@@ -2008,24 +2035,22 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ 	if (!sock)
+ 		return err;
+ 
++	used_address.name_len = UINT_MAX;
+ 	entry = mmsg;
+ 	compat_entry = (struct compat_mmsghdr __user *)mmsg;
+ 	err = 0;
+ 
+ 	while (datagrams < vlen) {
+-		/*
+-		 * No need to ask LSM for more than the first datagram.
+-		 */
+ 		if (MSG_CMSG_COMPAT & flags) {
+ 			err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
+-					    &msg_sys, flags, datagrams);
++					    &msg_sys, flags, &used_address);
+ 			if (err < 0)
+ 				break;
+ 			err = __put_user(err, &compat_entry->msg_len);
+ 			++compat_entry;
+ 		} else {
+ 			err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
+-					    &msg_sys, flags, datagrams);
++					    &msg_sys, flags, &used_address);
+ 			if (err < 0)
+ 				break;
+ 			err = put_user(err, &entry->msg_len);
diff --git a/queue-3.0/net-sendmmsg-should-only-return-an-error-if-no-messages-were-sent.patch b/queue-3.0/net-sendmmsg-should-only-return-an-error-if-no-messages-were-sent.patch
new file mode 100644
index 0000000000..23501bb8f0
--- /dev/null
+++ b/queue-3.0/net-sendmmsg-should-only-return-an-error-if-no-messages-were-sent.patch
@@ -0,0 +1,80 @@
+From 728ffb86f10873aaf4abd26dde691ee40ae731fe Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Thu, 4 Aug 2011 14:07:38 +0000
+Subject: net: sendmmsg should only return an error if no messages were sent
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 728ffb86f10873aaf4abd26dde691ee40ae731fe upstream.
+
+sendmmsg uses a similar error return strategy as recvmmsg but it
+turns out to be a confusing way to communicate errors.
+
+The current code stores the error code away and returns it on the next
+sendmmsg call. This means a call with completely valid arguments could
+get an error from a previous call.
+
+Change things so we only return an error if no datagrams could be sent.
+If less than the requested number of messages were sent, the application
+must retry starting at the first failed one and if the problem is
+persistent the error will be returned.
+
+This matches the behaviour of other syscalls like read/write - it
+is not an error if less than the requested number of elements are sent.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c |   27 +++------------------------
+ 1 file changed, 3 insertions(+), 24 deletions(-)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2005,12 +2005,9 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ 	if (!sock)
+ 		return err;
+ 
+-	err = sock_error(sock->sk);
+-	if (err)
+-		goto out_put;
+-
+ 	entry = mmsg;
+ 	compat_entry = (struct compat_mmsghdr __user *)mmsg;
++	err = 0;
+ 
+ 	while (datagrams < vlen) {
+ 		/*
+@@ -2037,29 +2034,11 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ 		++datagrams;
+ 	}
+ 
+-out_put:
+ 	fput_light(sock->file, fput_needed);
+ 
+-	if (err == 0)
+-		return datagrams;
+-
+-	if (datagrams != 0) {
+-		/*
+-		 * We may send less entries than requested (vlen) if the
+-		 * sock is non blocking...
+-		 */
+-		if (err != -EAGAIN) {
+-			/*
+-			 * ... or if sendmsg returns an error after we
+-			 * send some datagrams, where we record the
+-			 * error to return on the next call or if the
+-			 * app asks about it using getsockopt(SO_ERROR).
+-			 */
+-			sock->sk->sk_err = -err;
+-		}
+-
++	/* We only return an error if no datagrams were able to be sent */
++	if (datagrams != 0)
+ 		return datagrams;
+-	}
+ 
+ 	return err;
+ }
diff --git a/queue-3.0/rt2x00-fix-usage-of-null-queue.patch b/queue-3.0/rt2x00-fix-usage-of-null-queue.patch
new file mode 100644
index 0000000000..614fe505f5
--- /dev/null
+++ b/queue-3.0/rt2x00-fix-usage-of-null-queue.patch
@@ -0,0 +1,51 @@
+From 00898a47269ae5e6dda04defad00234b96692d95 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 2 Aug 2011 13:29:02 +0200
+Subject: rt2x00: fix usage of NULL queue
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 00898a47269ae5e6dda04defad00234b96692d95 upstream.
+
+We may call rt2x00queue_pause_queue(queue) with queue == NULL. Bug
+was introduced by commit 62fe778412b36791b7897cfa139342906fbbf07b
+"rt2x00: Fix stuck queue in tx failure case" .
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2x00mac.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -113,7 +113,7 @@ void rt2x00mac_tx(struct ieee80211_hw *h
+ 	 * due to possible race conditions in mac80211.
+ 	 */
+ 	if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+-		goto exit_fail;
++		goto exit_free_skb;
+ 
+ 	/*
+ 	 * Use the ATIM queue if appropriate and present.
+@@ -127,7 +127,7 @@ void rt2x00mac_tx(struct ieee80211_hw *h
+ 		ERROR(rt2x00dev,
+ 		      "Attempt to send packet over invalid queue %d.\n"
+ 		      "Please file bug report to %s.\n", qid, DRV_PROJECT);
+-		goto exit_fail;
++		goto exit_free_skb;
+ 	}
+ 
+ 	/*
+@@ -159,6 +159,7 @@ void rt2x00mac_tx(struct ieee80211_hw *h
+ 
+  exit_fail:
+ 	rt2x00queue_pause_queue(queue);
++ exit_free_skb:
+ 	dev_kfree_skb_any(skb);
+ }
+ EXPORT_SYMBOL_GPL(rt2x00mac_tx);
diff --git a/queue-3.0/rt2x00-rt2800-fix-zeroing-skb-structure.patch b/queue-3.0/rt2x00-rt2800-fix-zeroing-skb-structure.patch
new file mode 100644
index 0000000000..ce594f5bbc
--- /dev/null
+++ b/queue-3.0/rt2x00-rt2800-fix-zeroing-skb-structure.patch
@@ -0,0 +1,35 @@
+From b52398b6e4522176dd125722c72c301015d24520 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 30 Jul 2011 13:32:56 +0200
+Subject: rt2x00: rt2800: fix zeroing skb structure
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit b52398b6e4522176dd125722c72c301015d24520 upstream.
+
+We should clear skb->data not skb itself. Bug was introduced by:
+commit 0b8004aa12d13ec750d102ba4082a95f0107c649 "rt2x00: Properly
+reserve room for descriptors in skbs".
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2800lib.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -784,8 +784,7 @@ void rt2800_write_beacon(struct queue_en
+ 	/*
+ 	 * Add space for the TXWI in front of the skb.
+ 	 */
+-	skb_push(entry->skb, TXWI_DESC_SIZE);
+-	memset(entry->skb, 0, TXWI_DESC_SIZE);
++	memset(skb_push(entry->skb, TXWI_DESC_SIZE), 0, TXWI_DESC_SIZE);
+ 
+ 	/*
+ 	 * Register descriptor details in skb frame descriptor.
diff --git a/queue-3.0/rtlwifi-fix-kernel-oops-on-arm-soc.patch b/queue-3.0/rtlwifi-fix-kernel-oops-on-arm-soc.patch
new file mode 100644
index 0000000000..50db54d256
--- /dev/null
+++ b/queue-3.0/rtlwifi-fix-kernel-oops-on-arm-soc.patch
@@ -0,0 +1,59 @@
+From b6b67df3f24c45af0012ee3c8af2f62ca083ae18 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Fri, 29 Jul 2011 10:53:12 -0500
+Subject: rtlwifi: Fix kernel oops on ARM SOC
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit b6b67df3f24c45af0012ee3c8af2f62ca083ae18 upstream.
+
+This driver uses information from the self member of the pci_bus struct to
+get information regarding the bridge to which the PCIe device is attached.
+Unfortunately, this member is not established on all architectures, which
+leads to a kernel oops.
+
+Skipping the entire block that uses the self member to determine the bridge
+vendor will only affect RTL8192DE devices as that driver sets the ASPM support
+flag differently when the bridge vendor is Intel. If the self member is
+available, there is no functional change.
+
+This patch fixes Bugzilla No. 40212.
+
+Reported-by: Hubert Liao <liao.hubertt@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtlwifi/pci.c |   20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -1709,15 +1709,17 @@ static bool _rtl_pci_find_adapter(struct
+ 	pcipriv->ndis_adapter.devnumber = PCI_SLOT(pdev->devfn);
+ 	pcipriv->ndis_adapter.funcnumber = PCI_FUNC(pdev->devfn);
+ 
+-	/*find bridge info */
+-	pcipriv->ndis_adapter.pcibridge_vendorid = bridge_pdev->vendor;
+-	for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
+-		if (bridge_pdev->vendor == pcibridge_vendors[tmp]) {
+-			pcipriv->ndis_adapter.pcibridge_vendor = tmp;
+-			RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+-				 ("Pci Bridge Vendor is found index: %d\n",
+-				  tmp));
+-			break;
++	if (bridge_pdev) {
++		/*find bridge info if available */
++		pcipriv->ndis_adapter.pcibridge_vendorid = bridge_pdev->vendor;
++		for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
++			if (bridge_pdev->vendor == pcibridge_vendors[tmp]) {
++				pcipriv->ndis_adapter.pcibridge_vendor = tmp;
++				RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
++					 ("Pci Bridge Vendor is found index:"
++					 " %d\n", tmp));
++				break;
++			}
+ 		}
+ 	}
+ 
diff --git a/queue-3.0/series b/queue-3.0/series
index 0012d6edd0..a9c8e9dbfc 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -6,3 +6,22 @@ futex-fix-regression-with-read-only-mappings.patch
 wire-up-sendmmsg-syscall.patch
 fix-futex-support.patch
 fix-return-type-of-__atomic64_add_return.patch
+rt2x00-rt2800-fix-zeroing-skb-structure.patch
+rt2x00-fix-usage-of-null-queue.patch
+rtlwifi-fix-kernel-oops-on-arm-soc.patch
+iwlegacy-set-tx-power-after-rxon_assoc.patch
+ath9k-initialize-tx-chainmask-before-testing-channel-tx-power-values.patch
+ath9k-skip-config_pci_powersave-if-pcie-port-has-aspm-disabled.patch
+net-sendmmsg-should-only-return-an-error-if-no-messages-were-sent.patch
+net-cap-number-of-elements-for-sendmmsg.patch
+net-fix-security_socket_sendmsg-bypass-problem.patch
+xen-allow-enable-use-of-vga-console-on-dom0.patch
+drm-separate-edid-header-check-from-edid-block-check.patch
+drm-radeon-extended-ddc-probing-for-connectors-with.patch
+drm-radeon-extended-ddc-probing-for-ecs-a740gm-m-dvi-d.patch
+drm-radeon-log-subsystem-vendor-and-device-information.patch
+drm-i915-pch-fix-integer-math-bugs-in-panel-fitting.patch
+drm-i915-load-the-lut-before-pipe-enable-on-ilk.patch
+drm-i915-fix-typo-in-drm_i915_overlay_put_image-ioctl.patch
+drm-i915-initialize-rcs-ring-status-page-address-in.patch
+drm-i915-hold-mode_config-mutex-during-hotplug-processing.patch
diff --git a/queue-3.0/xen-allow-enable-use-of-vga-console-on-dom0.patch b/queue-3.0/xen-allow-enable-use-of-vga-console-on-dom0.patch
new file mode 100644
index 0000000000..7c34a2982c
--- /dev/null
+++ b/queue-3.0/xen-allow-enable-use-of-vga-console-on-dom0.patch
@@ -0,0 +1,193 @@
+From c2419b4a4727f67af2fc2cd68b0d878b75e781bb Mon Sep 17 00:00:00 2001
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Date: Tue, 31 May 2011 10:50:10 -0400
+Subject: xen: allow enable use of VGA console on dom0
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit c2419b4a4727f67af2fc2cd68b0d878b75e781bb upstream.
+
+Get the information about the VGA console hardware from Xen, and put
+it into the form the bootloader normally generates, so that the rest
+of the kernel can deal with VGA as usual.
+
+[ Impact: make VGA console work in dom0 ]
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+[v1: Rebased on 2.6.39]
+[v2: Removed incorrect comments and fixed compile warnings]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/Makefile       |    2 -
+ arch/x86/xen/enlighten.c    |    8 +++++
+ arch/x86/xen/vga.c          |   67 ++++++++++++++++++++++++++++++++++++++++++++
+ arch/x86/xen/xen-ops.h      |   11 +++++++
+ include/xen/interface/xen.h |   39 +++++++++++++++++++++++++
+ 5 files changed, 126 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/xen/Makefile
++++ b/arch/x86/xen/Makefile
+@@ -18,5 +18,5 @@ obj-y		:= enlighten.o setup.o multicalls
+ obj-$(CONFIG_SMP)		+= smp.o
+ obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o
+ obj-$(CONFIG_XEN_DEBUG_FS)	+= debugfs.o
+-
++obj-$(CONFIG_XEN_DOM0)		+= vga.o
+ obj-$(CONFIG_SWIOTLB_XEN)	+= pci-swiotlb-xen.o
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1248,6 +1248,14 @@ asmlinkage void __init xen_start_kernel(
+ 		if (pci_xen)
+ 			x86_init.pci.arch_init = pci_xen_init;
+ 	} else {
++		const struct dom0_vga_console_info *info =
++			(void *)((char *)xen_start_info +
++				 xen_start_info->console.dom0.info_off);
++
++		xen_init_vga(info, xen_start_info->console.dom0.info_size);
++		xen_start_info->console.domU.mfn = 0;
++		xen_start_info->console.domU.evtchn = 0;
++
+ 		/* Make sure ACS will be enabled */
+ 		pci_request_acs();
+ 	}
+--- /dev/null
++++ b/arch/x86/xen/vga.c
+@@ -0,0 +1,67 @@
++#include <linux/screen_info.h>
++#include <linux/init.h>
++
++#include <asm/bootparam.h>
++#include <asm/setup.h>
++
++#include <xen/interface/xen.h>
++
++#include "xen-ops.h"
++
++void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size)
++{
++	struct screen_info *screen_info = &boot_params.screen_info;
++
++	/* This is drawn from a dump from vgacon:startup in
++	 * standard Linux. */
++	screen_info->orig_video_mode = 3;
++	screen_info->orig_video_isVGA = 1;
++	screen_info->orig_video_lines = 25;
++	screen_info->orig_video_cols = 80;
++	screen_info->orig_video_ega_bx = 3;
++	screen_info->orig_video_points = 16;
++	screen_info->orig_y = screen_info->orig_video_lines - 1;
++
++	switch (info->video_type) {
++	case XEN_VGATYPE_TEXT_MODE_3:
++		if (size < offsetof(struct dom0_vga_console_info, u.text_mode_3)
++		    + sizeof(info->u.text_mode_3))
++			break;
++		screen_info->orig_video_lines = info->u.text_mode_3.rows;
++		screen_info->orig_video_cols = info->u.text_mode_3.columns;
++		screen_info->orig_x = info->u.text_mode_3.cursor_x;
++		screen_info->orig_y = info->u.text_mode_3.cursor_y;
++		screen_info->orig_video_points =
++			info->u.text_mode_3.font_height;
++		break;
++
++	case XEN_VGATYPE_VESA_LFB:
++		if (size < offsetof(struct dom0_vga_console_info,
++				    u.vesa_lfb.gbl_caps))
++			break;
++		screen_info->orig_video_isVGA = VIDEO_TYPE_VLFB;
++		screen_info->lfb_width = info->u.vesa_lfb.width;
++		screen_info->lfb_height = info->u.vesa_lfb.height;
++		screen_info->lfb_depth = info->u.vesa_lfb.bits_per_pixel;
++		screen_info->lfb_base = info->u.vesa_lfb.lfb_base;
++		screen_info->lfb_size = info->u.vesa_lfb.lfb_size;
++		screen_info->lfb_linelength = info->u.vesa_lfb.bytes_per_line;
++		screen_info->red_size = info->u.vesa_lfb.red_size;
++		screen_info->red_pos = info->u.vesa_lfb.red_pos;
++		screen_info->green_size = info->u.vesa_lfb.green_size;
++		screen_info->green_pos = info->u.vesa_lfb.green_pos;
++		screen_info->blue_size = info->u.vesa_lfb.blue_size;
++		screen_info->blue_pos = info->u.vesa_lfb.blue_pos;
++		screen_info->rsvd_size = info->u.vesa_lfb.rsvd_size;
++		screen_info->rsvd_pos = info->u.vesa_lfb.rsvd_pos;
++		if (size >= offsetof(struct dom0_vga_console_info,
++				     u.vesa_lfb.gbl_caps)
++		    + sizeof(info->u.vesa_lfb.gbl_caps))
++			screen_info->capabilities = info->u.vesa_lfb.gbl_caps;
++		if (size >= offsetof(struct dom0_vga_console_info,
++				     u.vesa_lfb.mode_attrs)
++		    + sizeof(info->u.vesa_lfb.mode_attrs))
++			screen_info->vesa_attributes = info->u.vesa_lfb.mode_attrs;
++		break;
++	}
++}
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -88,6 +88,17 @@ static inline void xen_uninit_lock_cpu(i
+ }
+ #endif
+ 
++struct dom0_vga_console_info;
++
++#ifdef CONFIG_XEN_DOM0
++void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size);
++#else
++static inline void __init xen_init_vga(const struct dom0_vga_console_info *info,
++				       size_t size)
++{
++}
++#endif
++
+ /* Declare an asm function, along with symbols needed to make it
+    inlineable */
+ #define DECL_ASM(ret, name, ...)		\
+--- a/include/xen/interface/xen.h
++++ b/include/xen/interface/xen.h
+@@ -450,6 +450,45 @@ struct start_info {
+ 	int8_t cmd_line[MAX_GUEST_CMDLINE];
+ };
+ 
++struct dom0_vga_console_info {
++	uint8_t video_type;
++#define XEN_VGATYPE_TEXT_MODE_3 0x03
++#define XEN_VGATYPE_VESA_LFB    0x23
++
++	union {
++		struct {
++			/* Font height, in pixels. */
++			uint16_t font_height;
++			/* Cursor location (column, row). */
++			uint16_t cursor_x, cursor_y;
++			/* Number of rows and columns (dimensions in characters). */
++			uint16_t rows, columns;
++		} text_mode_3;
++
++		struct {
++			/* Width and height, in pixels. */
++			uint16_t width, height;
++			/* Bytes per scan line. */
++			uint16_t bytes_per_line;
++			/* Bits per pixel. */
++			uint16_t bits_per_pixel;
++			/* LFB physical address, and size (in units of 64kB). */
++			uint32_t lfb_base;
++			uint32_t lfb_size;
++			/* RGB mask offsets and sizes, as defined by VBE 1.2+ */
++			uint8_t  red_pos, red_size;
++			uint8_t  green_pos, green_size;
++			uint8_t  blue_pos, blue_size;
++			uint8_t  rsvd_pos, rsvd_size;
++
++			/* VESA capabilities (offset 0xa, VESA command 0x4f00). */
++			uint32_t gbl_caps;
++			/* Mode attributes (offset 0x0, VESA command 0x4f01). */
++			uint16_t mode_attrs;
++		} vesa_lfb;
++	} u;
++};
++
+ /* These flags are passed in the 'flags' field of start_info_t. */
+ #define SIF_PRIVILEGED    (1<<0)  /* Is the domain privileged? */
+ #define SIF_INITDOMAIN    (1<<1)  /* Is this the initial control domain? */