--- /dev/null
+From c1227340ca65c2069222a956a68b6842d460c4f4 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 27 Jul 2011 15:01:02 +0200
+Subject: ath9k: initialize tx chainmask before testing channel tx power values
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit c1227340ca65c2069222a956a68b6842d460c4f4 upstream.
+
+With an uninitialized chainmask, the per-channel power will only contain
+the power limits for a single chain instead of the combined tx power.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/init.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -665,8 +665,10 @@ static void ath9k_init_band_txpower(stru
+ static void ath9k_init_txpower_limits(struct ath_softc *sc)
+ {
+ struct ath_hw *ah = sc->sc_ah;
++ struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ struct ath9k_channel *curchan = ah->curchan;
+
++ ah->txchainmask = common->tx_chainmask;
+ if (ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ)
+ ath9k_init_band_txpower(sc, IEEE80211_BAND_2GHZ);
+ if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
--- /dev/null
+From d4930086bdd0c08a8b3a4d66a9c702297cb74a99 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 29 Jul 2011 15:59:08 +0200
+Subject: ath9k: skip ->config_pci_powersave() if PCIe port has ASPM disabled
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit d4930086bdd0c08a8b3a4d66a9c702297cb74a99 upstream.
+
+We receive many bug reports about system hang during suspend/resume
+when ath9k driver is in use. Adrian Chadd remarked that this problem
+happens on systems that have ASPM disabled.
+
+To do not hit the bug, skip doing ->config_pci_powersave magic if PCIe
+downstream port device, which ath9k device is connected to, has ASPM
+disabled.
+
+Bug was introduced by:
+
+commit 53bc7aa08b48e5cd745f986731cc7dc24eef2a9f
+Author: Vivek Natarajan <vnatarajan@atheros.com>
+Date: Mon Apr 5 14:48:04 2010 +0530
+
+ ath9k: Add support for newer AR9285 chipsets.
+
+Patch should address:
+https://bugzilla.kernel.org/show_bug.cgi?id=37462
+https://bugzilla.kernel.org/show_bug.cgi?id=37082
+https://bugzilla.redhat.com/show_bug.cgi?id=697157
+
+however I did not receive confirmation about that, except from Camilo
+Mesias, whose system stops hang regularly with this patch (but still
+hangs from time to time, but this is probably some other bug).
+
+Tested-by: Camilo Mesias <camilo@mesias.co.uk>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9002_hw.c | 6 +-----
+ drivers/net/wireless/ath/ath9k/ar9003_hw.c | 6 +-----
+ drivers/net/wireless/ath/ath9k/hw.c | 11 +++++++++--
+ drivers/net/wireless/ath/ath9k/hw.h | 3 ++-
+ drivers/net/wireless/ath/ath9k/pci.c | 27 +++++++++++++++++++++++++++
+ 5 files changed, 40 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+@@ -309,11 +309,7 @@ static void ar9002_hw_configpcipowersave
+ u8 i;
+ u32 val;
+
+- if (ah->is_pciexpress != true)
+- return;
+-
+- /* Do not touch SerDes registers */
+- if (ah->config.pcie_powersave_enable == 2)
++ if (ah->is_pciexpress != true || ah->aspm_enabled != true)
+ return;
+
+ /* Nothing to do on restore for 11N */
+--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+@@ -351,11 +351,7 @@ static void ar9003_hw_configpcipowersave
+ int restore,
+ int power_off)
+ {
+- if (ah->is_pciexpress != true)
+- return;
+-
+- /* Do not touch SerDes registers */
+- if (ah->config.pcie_powersave_enable == 2)
++ if (ah->is_pciexpress != true || ah->aspm_enabled != true)
+ return;
+
+ /* Nothing to do on restore for 11N */
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -299,6 +299,14 @@ static void ath9k_hw_disablepcie(struct
+ REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
+ }
+
++static void ath9k_hw_aspm_init(struct ath_hw *ah)
++{
++ struct ath_common *common = ath9k_hw_common(ah);
++
++ if (common->bus_ops->aspm_init)
++ common->bus_ops->aspm_init(common);
++}
++
+ /* This should work for all families including legacy */
+ static bool ath9k_hw_chip_test(struct ath_hw *ah)
+ {
+@@ -359,7 +367,6 @@ static void ath9k_hw_init_config(struct
+ ah->config.additional_swba_backoff = 0;
+ ah->config.ack_6mb = 0x0;
+ ah->config.cwm_ignore_extcca = 0;
+- ah->config.pcie_powersave_enable = 0;
+ ah->config.pcie_clock_req = 0;
+ ah->config.pcie_waen = 0;
+ ah->config.analog_shiftreg = 1;
+@@ -577,7 +584,7 @@ static int __ath9k_hw_init(struct ath_hw
+
+
+ if (ah->is_pciexpress)
+- ath9k_hw_configpcipowersave(ah, 0, 0);
++ ath9k_hw_aspm_init(ah);
+ else
+ ath9k_hw_disablepcie(ah);
+
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -215,7 +215,6 @@ struct ath9k_ops_config {
+ int additional_swba_backoff;
+ int ack_6mb;
+ u32 cwm_ignore_extcca;
+- u8 pcie_powersave_enable;
+ bool pcieSerDesWrite;
+ u8 pcie_clock_req;
+ u32 pcie_waen;
+@@ -671,6 +670,7 @@ struct ath_hw {
+
+ bool sw_mgmt_crypto;
+ bool is_pciexpress;
++ bool aspm_enabled;
+ bool is_monitoring;
+ bool need_an_top2_fixup;
+ u16 tx_trig_level;
+@@ -870,6 +870,7 @@ struct ath_bus_ops {
+ bool (*eeprom_read)(struct ath_common *common, u32 off, u16 *data);
+ void (*bt_coex_prep)(struct ath_common *common);
+ void (*extn_synch_en)(struct ath_common *common);
++ void (*aspm_init)(struct ath_common *common);
+ };
+
+ static inline struct ath_common *ath9k_hw_common(struct ath_hw *ah)
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -16,6 +16,7 @@
+
+ #include <linux/nl80211.h>
+ #include <linux/pci.h>
++#include <linux/pci-aspm.h>
+ #include <linux/ath9k_platform.h>
+ #include "ath9k.h"
+
+@@ -115,12 +116,38 @@ static void ath_pci_extn_synch_enable(st
+ pci_write_config_byte(pdev, sc->sc_ah->caps.pcie_lcr_offset, lnkctl);
+ }
+
++static void ath_pci_aspm_init(struct ath_common *common)
++{
++ struct ath_softc *sc = (struct ath_softc *) common->priv;
++ struct ath_hw *ah = sc->sc_ah;
++ struct pci_dev *pdev = to_pci_dev(sc->dev);
++ struct pci_dev *parent;
++ int pos;
++ u8 aspm;
++
++ if (!pci_is_pcie(pdev))
++ return;
++
++ parent = pdev->bus->self;
++ if (WARN_ON(!parent))
++ return;
++
++ pos = pci_pcie_cap(parent);
++ pci_read_config_byte(parent, pos + PCI_EXP_LNKCTL, &aspm);
++ if (aspm & (PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1)) {
++ ah->aspm_enabled = true;
++ /* Initialize PCIe PM and SERDES registers. */
++ ath9k_hw_configpcipowersave(ah, 0, 0);
++ }
++}
++
+ static const struct ath_bus_ops ath_pci_bus_ops = {
+ .ath_bus_type = ATH_PCI,
+ .read_cachesize = ath_pci_read_cachesize,
+ .eeprom_read = ath_pci_eeprom_read,
+ .bt_coex_prep = ath_pci_bt_coex_prep,
+ .extn_synch_en = ath_pci_extn_synch_enable,
++ .aspm_init = ath_pci_aspm_init,
+ };
+
+ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
From 1646ec9db75e151b0479dbfaf972f741d0476ec7 Mon Sep 17 00:00:00 2001
From: WANG Cong <xiyou.wangcong@gmail.com>
Date: Wed, 3 Aug 2011 16:21:15 -0700
-Subject: cris: add missing declaration of kgdb_init() and
- breakpoint()
+Subject: cris: add missing declaration of kgdb_init() and breakpoint()
From: WANG Cong <xiyou.wangcong@gmail.com>
--- /dev/null
+From 842d452985300f4ec14c68cb86046e8a1a3b7251 Mon Sep 17 00:00:00 2001
+From: Ole Henrik Jahren <olehenja@alumni.ntnu.no>
+Date: Fri, 22 Jul 2011 15:56:01 +0200
+Subject: drm/i915: Fix typo in DRM_I915_OVERLAY_PUT_IMAGE ioctl define
+
+From: Ole Henrik Jahren <olehenja@alumni.ntnu.no>
+
+commit 842d452985300f4ec14c68cb86046e8a1a3b7251 upstream.
+
+Because of a typo, calling ioctl with DRM_IOCTL_I915_OVERLAY_PUT_IMAGE
+is broken if the macro is used directly. When using libdrm the bug is
+not hit, since libdrm handles the ioctl encoding internally.
+
+The typo also leads to the .cmd and .cmd_drv fields of the drm_ioctl
+structure for DRM_I915_OVERLAY_PUT_IMAGE having inconsistent content.
+
+Signed-off-by: Ole Henrik Jahren <olehenja@alumni.ntnu.no>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/drm/i915_drm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/drm/i915_drm.h
++++ b/include/drm/i915_drm.h
+@@ -237,7 +237,7 @@ typedef struct _drm_i915_sarea {
+ #define DRM_IOCTL_I915_GEM_GET_APERTURE DRM_IOR (DRM_COMMAND_BASE + DRM_I915_GEM_GET_APERTURE, struct drm_i915_gem_get_aperture)
+ #define DRM_IOCTL_I915_GET_PIPE_FROM_CRTC_ID DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GET_PIPE_FROM_CRTC_ID, struct drm_i915_get_pipe_from_crtc_id)
+ #define DRM_IOCTL_I915_GEM_MADVISE DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_MADVISE, struct drm_i915_gem_madvise)
+-#define DRM_IOCTL_I915_OVERLAY_PUT_IMAGE DRM_IOW(DRM_COMMAND_BASE + DRM_IOCTL_I915_OVERLAY_ATTRS, struct drm_intel_overlay_put_image)
++#define DRM_IOCTL_I915_OVERLAY_PUT_IMAGE DRM_IOW(DRM_COMMAND_BASE + DRM_I915_OVERLAY_PUT_IMAGE, struct drm_intel_overlay_put_image)
+ #define DRM_IOCTL_I915_OVERLAY_ATTRS DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_OVERLAY_ATTRS, struct drm_intel_overlay_attrs)
+
+ /* Allow drivers to submit batchbuffers directly to hardware, relying
--- /dev/null
+From a65e34c79c88895766ab1f8a5afa451eed26622b Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Mon, 25 Jul 2011 10:04:56 -0700
+Subject: drm/i915: Hold mode_config->mutex during hotplug processing
+
+From: Keith Packard <keithp@keithp.com>
+
+commit a65e34c79c88895766ab1f8a5afa451eed26622b upstream.
+
+Hotplug detection is a mode setting operation and must hold the
+struct_mutex or risk colliding with other mode setting operations.
+
+In particular, the display port hotplug function attempts to re-train
+the link if the monitor is supposed to be running when plugged back
+in. If that happens while mode setting is underway, the link will get
+scrambled, leaving it in an inconsistent state.
+
+This is a special case -- usually the driver mode setting entry points
+are covered by the upper level DRM code, but in this case the function
+is invoked as a work function not under the control of DRM.
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_irq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -306,6 +306,7 @@ static void i915_hotplug_work_func(struc
+ struct drm_mode_config *mode_config = &dev->mode_config;
+ struct intel_encoder *encoder;
+
++ mutex_lock(&mode_config->mutex);
+ DRM_DEBUG_KMS("running encoder hotplug functions\n");
+
+ list_for_each_entry(encoder, &mode_config->encoder_list, base.head)
+@@ -314,6 +315,8 @@ static void i915_hotplug_work_func(struc
+
+ /* Just fire off a uevent and let userspace tell us what to do */
+ drm_helper_hpd_irq_event(dev);
++
++ mutex_unlock(&mode_config->mutex);
+ }
+
+ static void i915_handle_rps_change(struct drm_device *dev)
--- /dev/null
+From f3234706a77bd6e1592ae71fb3268e04cb030dba Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Fri, 22 Jul 2011 10:44:39 -0700
+Subject: drm/i915: Initialize RCS ring status page address in intel_render_ring_init_dri
+
+From: Keith Packard <keithp@keithp.com>
+
+commit f3234706a77bd6e1592ae71fb3268e04cb030dba upstream.
+
+Physically-addressed hardware status pages are initialized early in
+the driver load process by i915_init_phys_hws. For UMS environments,
+the ring structure is not initialized until the X server starts. At
+that point, the entire ring structure is re-initialized with all new
+values. Any values set in the ring structure (including
+ring->status_page.page_addr) will be lost when the ring is
+re-initialized.
+
+This patch moves the initialization of the status_page.page_addr value
+to intel_render_ring_init_dri.
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_dma.c | 6 ++----
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 3 +++
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -61,7 +61,6 @@ static void i915_write_hws_pga(struct dr
+ static int i915_init_phys_hws(struct drm_device *dev)
+ {
+ drm_i915_private_t *dev_priv = dev->dev_private;
+- struct intel_ring_buffer *ring = LP_RING(dev_priv);
+
+ /* Program Hardware Status Page */
+ dev_priv->status_page_dmah =
+@@ -71,10 +70,9 @@ static int i915_init_phys_hws(struct drm
+ DRM_ERROR("Can not allocate hardware status page\n");
+ return -ENOMEM;
+ }
+- ring->status_page.page_addr =
+- (void __force __iomem *)dev_priv->status_page_dmah->vaddr;
+
+- memset_io(ring->status_page.page_addr, 0, PAGE_SIZE);
++ memset_io((void __force __iomem *)dev_priv->status_page_dmah->vaddr,
++ 0, PAGE_SIZE);
+
+ i915_write_hws_pga(dev);
+
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -1319,6 +1319,9 @@ int intel_render_ring_init_dri(struct dr
+ ring->get_seqno = pc_render_get_seqno;
+ }
+
++ if (!I915_NEED_GFX_HWS(dev))
++ ring->status_page.page_addr = dev_priv->status_page_dmah->vaddr;
++
+ ring->dev = dev;
+ INIT_LIST_HEAD(&ring->active_list);
+ INIT_LIST_HEAD(&ring->request_list);
--- /dev/null
+From 9c54c0dd948d715ccfd79e97d852f80eeb53254a Mon Sep 17 00:00:00 2001
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+Date: Wed, 15 Jun 2011 23:32:33 +0200
+Subject: drm/i915: load the LUT before pipe enable on ILK+
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit 9c54c0dd948d715ccfd79e97d852f80eeb53254a upstream.
+
+Per the specs and to address
+https://bugs.freedesktop.org/show_bug.cgi?id=36888.
+
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2699,14 +2699,18 @@ static void ironlake_crtc_enable(struct
+ I915_WRITE(PF_WIN_SZ(pipe), dev_priv->pch_pf_size);
+ }
+
++ /*
++ * On ILK+ LUT must be loaded before the pipe is running but with
++ * clocks enabled
++ */
++ intel_crtc_load_lut(crtc);
++
+ intel_enable_pipe(dev_priv, pipe, is_pch_port);
+ intel_enable_plane(dev_priv, plane, pipe);
+
+ if (is_pch_port)
+ ironlake_pch_enable(crtc);
+
+- intel_crtc_load_lut(crtc);
+-
+ mutex_lock(&dev->struct_mutex);
+ intel_update_fbc(dev);
+ mutex_unlock(&dev->struct_mutex);
--- /dev/null
+From 302983e9059e9ef5de3ca7671918eeb237c5971e Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Wed, 13 Jul 2011 16:32:32 -0400
+Subject: drm/i915/pch: Fix integer math bugs in panel fitting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Adam Jackson <ajax@redhat.com>
+
+commit 302983e9059e9ef5de3ca7671918eeb237c5971e upstream.
+
+Consider a 1600x900 panel, upscaling a 1360x768 mode, full-aspect. The
+old math would give you:
+
+ scaled_width = 1600 * 768; /* 1228800 */
+ scaled_height = 1360 * 900; /* 1224000 */
+ if (scaled_width > scaled_height) { /* pillarbox, and true */
+ width = 1224000 / 768; /* int(1593.75) = 1593 */
+ x = (1600 - 1593 + 1) / 2; /* 4 */
+ y = 0;
+ height = 768;
+ } /* ... */
+
+This is broken. The total width of scanout would then be 1593 + 4 + 4,
+or 1601, which is wider than the panel itself. The hardware very
+dutifully implements this, and you end up with a black 45° diagonal from
+the top-left corner to the bottom edge of the screen. It's a cool
+effect and all, but not what you wanted. Similar things happen for the
+letterbox case.
+
+The problem is that you have an integer number of pixels, which means
+it's usually impossible to upscale equally on both axes. 1360/768 is
+1.7708, 1600/900 is 1.7777. Since we're constrained on the one axis,
+the other one wants to come out as an even number of pixels (the panel
+is almost certainly even on both axes, and the x/y offsets will be
+applied on both sides). In the math above, if 'width' comes out even,
+rounding down is correct; if it's odd, you'd rather round up. So just
+increment width/height in those cases.
+
+Tested on a Lenovo T500 (Ironlake).
+
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+Tested-By: Daniel Manrique <daniel.manrique@canonical.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38851
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_panel.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -83,11 +83,15 @@ intel_pch_panel_fitting(struct drm_devic
+ u32 scaled_height = mode->hdisplay * adjusted_mode->vdisplay;
+ if (scaled_width > scaled_height) { /* pillar */
+ width = scaled_height / mode->vdisplay;
++ if (width & 1)
++ width++;
+ x = (adjusted_mode->hdisplay - width + 1) / 2;
+ y = 0;
+ height = adjusted_mode->vdisplay;
+ } else if (scaled_width < scaled_height) { /* letter */
+ height = scaled_width / mode->hdisplay;
++ if (height & 1)
++ height++;
+ y = (adjusted_mode->vdisplay - height + 1) / 2;
+ x = 0;
+ width = adjusted_mode->hdisplay;
--- /dev/null
+From e384fab8c6f3ca88600bcb2ebdf0eb2f90864fab Mon Sep 17 00:00:00 2001
+From: Thomas Reim <reimth@gmail.com>
+Date: Fri, 29 Jul 2011 14:28:58 +0000
+Subject: drm/radeon: Extended DDC Probing for Connectors with Improperly Wired DDC Lines (here: Asus M2A-VM HDMI)
+
+From: Thomas Reim <reimth@gmail.com>
+
+commit e384fab8c6f3ca88600bcb2ebdf0eb2f90864fab upstream.
+
+ Some integrated ATI Radeon chipset implementations with add-on HDMI card
+ (e. g. Asus M2A-VM HDMI) indicate the availability of a DDC even
+ when the add-on card is not plugged in or HDMI is disabled in BIOS setup.
+ In this case, drm_get_edid() and drm_edid_block_valid() periodically
+ dump data and kernel errors into system log files and onto terminals.
+ For these connectors DDC probing is extended by a check for a correct
+ EDID header. Only in case a valid EDID header is also found, the
+ (HDMI or DVI) connector will be used by the Radeon driver. This prevents
+ the kernel driver from useless flooding of logs and terminal sessions with
+ EDID dumps and error messages.
+ This patch adds a flag 'requires_extended_probe' to the radeon_connector
+ structure. In function radeon_connector_needs_extended_probe() this flag
+ can be set on a chipset family/vendor/connector type specific basis.
+ In addition, function radeon_ddc_probe() has been adapted to perform
+ extended DDC probing if required by the connector's flag.
+ Requires function drm_edid_header_is_valid() in DRM module provided by
+ [PATCH] drm: Separate EDID Header Check from EDID Block Check.
+
+ Tested for kernel 2.6.35, 2.6.38 and 3.0 on Asus M2A-VM HDMI board
+
+ BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=668196
+ BugLink: http://bugs.launchpad.net/bugs/7228066
+
+Signed-off-by: Thomas Reim <reimth@gmail.com>
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Acked-by: Stephen Michaels <Stephen.Micheals@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 45 +++++++++++++++++++++++++++--
+ drivers/gpu/drm/radeon/radeon_display.c | 9 +++++
+ drivers/gpu/drm/radeon/radeon_i2c.c | 32 +++++++++++++++-----
+ drivers/gpu/drm/radeon/radeon_mode.h | 6 +++
+ 4 files changed, 80 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -430,6 +430,36 @@ int radeon_connector_set_property(struct
+ return 0;
+ }
+
++/*
++ * Some integrated ATI Radeon chipset implementations (e. g.
++ * Asus M2A-VM HDMI) may indicate the availability of a DDC,
++ * even when there's no monitor connected. For these connectors
++ * following DDC probe extension will be applied: check also for the
++ * availability of EDID with at least a correct EDID header. Only then,
++ * DDC is assumed to be available. This prevents drm_get_edid() and
++ * drm_edid_block_valid() from periodically dumping data and kernel
++ * errors into the logs and onto the terminal.
++ */
++static bool radeon_connector_needs_extended_probe(struct radeon_device *dev,
++ uint32_t supported_device,
++ int connector_type)
++{
++ /* Asus M2A-VM HDMI board sends data to i2c bus even,
++ * if HDMI add-on card is not plugged in or HDMI is disabled in
++ * BIOS. Valid DDC can only be assumed, if also a valid EDID header
++ * can be retrieved via i2c bus during DDC probe */
++ if ((dev->pdev->device == 0x791e) &&
++ (dev->pdev->subsystem_vendor == 0x1043) &&
++ (dev->pdev->subsystem_device == 0x826d)) {
++ if ((connector_type == DRM_MODE_CONNECTOR_HDMIA) &&
++ (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
++ return true;
++ }
++
++ /* Default: no EDID header probe required for DDC probing */
++ return false;
++}
++
+ static void radeon_fixup_lvds_native_mode(struct drm_encoder *encoder,
+ struct drm_connector *connector)
+ {
+@@ -661,7 +691,8 @@ radeon_vga_detect(struct drm_connector *
+ ret = connector_status_disconnected;
+
+ if (radeon_connector->ddc_bus)
+- dret = radeon_ddc_probe(radeon_connector);
++ dret = radeon_ddc_probe(radeon_connector,
++ radeon_connector->requires_extended_probe);
+ if (dret) {
+ if (radeon_connector->edid) {
+ kfree(radeon_connector->edid);
+@@ -833,7 +864,8 @@ radeon_dvi_detect(struct drm_connector *
+ bool dret = false;
+
+ if (radeon_connector->ddc_bus)
+- dret = radeon_ddc_probe(radeon_connector);
++ dret = radeon_ddc_probe(radeon_connector,
++ radeon_connector->requires_extended_probe);
+ if (dret) {
+ if (radeon_connector->edid) {
+ kfree(radeon_connector->edid);
+@@ -1251,7 +1283,8 @@ radeon_dp_detect(struct drm_connector *c
+ if (radeon_dp_getdpcd(radeon_connector))
+ ret = connector_status_connected;
+ } else {
+- if (radeon_ddc_probe(radeon_connector))
++ if (radeon_ddc_probe(radeon_connector,
++ radeon_connector->requires_extended_probe))
+ ret = connector_status_connected;
+ }
+ }
+@@ -1406,6 +1439,9 @@ radeon_add_atom_connector(struct drm_dev
+ radeon_connector->shared_ddc = shared_ddc;
+ radeon_connector->connector_object_id = connector_object_id;
+ radeon_connector->hpd = *hpd;
++ radeon_connector->requires_extended_probe =
++ radeon_connector_needs_extended_probe(rdev, supported_device,
++ connector_type);
+ radeon_connector->router = *router;
+ if (router->ddc_valid || router->cd_valid) {
+ radeon_connector->router_bus = radeon_i2c_lookup(rdev, &router->i2c_info);
+@@ -1752,6 +1788,9 @@ radeon_add_legacy_connector(struct drm_d
+ radeon_connector->devices = supported_device;
+ radeon_connector->connector_object_id = connector_object_id;
+ radeon_connector->hpd = *hpd;
++ radeon_connector->requires_extended_probe =
++ radeon_connector_needs_extended_probe(rdev, supported_device,
++ connector_type);
+ switch (connector_type) {
+ case DRM_MODE_CONNECTOR_VGA:
+ drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -777,8 +777,17 @@ static int radeon_ddc_dump(struct drm_co
+ if (!radeon_connector->ddc_bus)
+ return -1;
+ edid = drm_get_edid(connector, &radeon_connector->ddc_bus->adapter);
++ /* Log EDID retrieval status here. In particular with regard to
++ * connectors with requires_extended_probe flag set, that will prevent
++ * function radeon_dvi_detect() to fetch EDID on this connector,
++ * as long as there is no valid EDID header found */
+ if (edid) {
++ DRM_INFO("Radeon display connector %s: Found valid EDID",
++ drm_get_connector_name(connector));
+ kfree(edid);
++ } else {
++ DRM_INFO("Radeon display connector %s: No monitor connected or invalid EDID",
++ drm_get_connector_name(connector));
+ }
+ return ret;
+ }
+--- a/drivers/gpu/drm/radeon/radeon_i2c.c
++++ b/drivers/gpu/drm/radeon/radeon_i2c.c
+@@ -32,17 +32,17 @@
+ * radeon_ddc_probe
+ *
+ */
+-bool radeon_ddc_probe(struct radeon_connector *radeon_connector)
++bool radeon_ddc_probe(struct radeon_connector *radeon_connector, bool requires_extended_probe)
+ {
+- u8 out_buf[] = { 0x0, 0x0};
+- u8 buf[2];
++ u8 out = 0x0;
++ u8 buf[8];
+ int ret;
+ struct i2c_msg msgs[] = {
+ {
+ .addr = 0x50,
+ .flags = 0,
+ .len = 1,
+- .buf = out_buf,
++ .buf = &out,
+ },
+ {
+ .addr = 0x50,
+@@ -52,15 +52,31 @@ bool radeon_ddc_probe(struct radeon_conn
+ }
+ };
+
++ /* Read 8 bytes from i2c for extended probe of EDID header */
++ if (requires_extended_probe)
++ msgs[1].len = 8;
++
+ /* on hw with routers, select right port */
+ if (radeon_connector->router.ddc_valid)
+ radeon_router_select_ddc_port(radeon_connector);
+
+ ret = i2c_transfer(&radeon_connector->ddc_bus->adapter, msgs, 2);
+- if (ret == 2)
+- return true;
+-
+- return false;
++ if (ret != 2)
++ /* Couldn't find an accessible DDC on this connector */
++ return false;
++ if (requires_extended_probe) {
++ /* Probe also for valid EDID header
++ * EDID header starts with:
++ * 0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0x00.
++ * Only the first 6 bytes must be valid as
++ * drm_edid_block_valid() can fix the last 2 bytes */
++ if (drm_edid_header_is_valid(buf) < 6) {
++ /* Couldn't find an accessible EDID on this
++ * connector */
++ return false;
++ }
++ }
++ return true;
+ }
+
+ /* bit banging i2c */
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -438,6 +438,9 @@ struct radeon_connector {
+ struct radeon_i2c_chan *ddc_bus;
+ /* some systems have an hdmi and vga port with a shared ddc line */
+ bool shared_ddc;
++ /* for some Radeon chip families we apply an additional EDID header
++ check as part of the DDC probe */
++ bool requires_extended_probe;
+ bool use_digital;
+ /* we need to mind the EDID between detect
+ and get modes due to analog/digital/tvencoder */
+@@ -514,7 +517,8 @@ extern void radeon_i2c_put_byte(struct r
+ u8 val);
+ extern void radeon_router_select_ddc_port(struct radeon_connector *radeon_connector);
+ extern void radeon_router_select_cd_port(struct radeon_connector *radeon_connector);
+-extern bool radeon_ddc_probe(struct radeon_connector *radeon_connector);
++extern bool radeon_ddc_probe(struct radeon_connector *radeon_connector,
++ bool requires_extended_probe);
+ extern int radeon_ddc_get_modes(struct radeon_connector *radeon_connector);
+
+ extern struct drm_encoder *radeon_best_encoder(struct drm_connector *connector);
--- /dev/null
+From a81b31e9fc98e067b7e7f1244861c97e44268e2d Mon Sep 17 00:00:00 2001
+From: Thomas Reim <reimth@gmail.com>
+Date: Fri, 29 Jul 2011 14:29:00 +0000
+Subject: drm/radeon: Extended DDC Probing for ECS A740GM-M DVI-D Connector
+
+From: Thomas Reim <reimth@gmail.com>
+
+commit a81b31e9fc98e067b7e7f1244861c97e44268e2d upstream.
+
+ ECS A740GM-M with ATI RADEON 2100 sends data to i2c bus
+ for a DVI connector that is not implemented/existent on the board.
+
+ Fix by applying extented DDC probing for this connector.
+
+ Requires [PATCH] drm/radeon: Extended DDC Probing for Connectors
+ with Improperly Wired DDC Lines
+
+ Tested for kernel 2.6.38 on Asus ECS A740GM-M board
+
+ BugLink: http://bugs.launchpad.net/bugs/810926
+
+Signed-off-by: Thomas Reim <reimth@gmail.com>
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Acked-by: Stephen Michaels <Stephen.Micheals@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -455,6 +455,15 @@ static bool radeon_connector_needs_exten
+ (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
+ return true;
+ }
++ /* ECS A740GM-M with ATI RADEON 2100 sends data to i2c bus
++ * for a DVI connector that is not implemented */
++ if ((dev->pdev->device == 0x796e) &&
++ (dev->pdev->subsystem_vendor == 0x1019) &&
++ (dev->pdev->subsystem_device == 0x2615)) {
++ if ((connector_type == DRM_MODE_CONNECTOR_DVID) &&
++ (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
++ return true;
++ }
+
+ /* Default: no EDID header probe required for DDC probing */
+ return false;
--- /dev/null
+From d522d9cc5bdd41214084383fc3e6d882f6916a78 Mon Sep 17 00:00:00 2001
+From: Thomas Reim <reimth@gmail.com>
+Date: Fri, 29 Jul 2011 14:28:59 +0000
+Subject: drm/radeon: Log Subsystem Vendor and Device Information
+
+From: Thomas Reim <reimth@gmail.com>
+
+commit d522d9cc5bdd41214084383fc3e6d882f6916a78 upstream.
+
+ Log PCI subsystem vendor and subsystem device ID in addition to
+ PCI vendor and device ID during kernel mode initialisation. This helps
+ to better identify radeon devices of third-party vendors, e. g. for
+ bug analysis.
+
+ Tested for kernel 2.6.35, 2.6.38 and 3.0 on Asus M2A-VM HDMI board
+
+Signed-off-by: Thomas Reim <reimth@gmail.com>
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Acked-by: Stephen Michaels <Stephen.Micheals@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -704,8 +704,9 @@ int radeon_device_init(struct radeon_dev
+ rdev->gpu_lockup = false;
+ rdev->accel_working = false;
+
+- DRM_INFO("initializing kernel modesetting (%s 0x%04X:0x%04X).\n",
+- radeon_family_name[rdev->family], pdev->vendor, pdev->device);
++ DRM_INFO("initializing kernel modesetting (%s 0x%04X:0x%04X 0x%04X:0x%04X).\n",
++ radeon_family_name[rdev->family], pdev->vendor, pdev->device,
++ pdev->subsystem_vendor, pdev->subsystem_device);
+
+ /* mutex initialization are all done here so we
+ * can recall function without having locking issues */
--- /dev/null
+From 051963d4832ed61e5ae74f5330b0a94489e101b9 Mon Sep 17 00:00:00 2001
+From: Thomas Reim <reimth@gmail.com>
+Date: Fri, 29 Jul 2011 14:28:57 +0000
+Subject: drm: Separate EDID Header Check from EDID Block Check
+
+From: Thomas Reim <reimth@gmail.com>
+
+commit 051963d4832ed61e5ae74f5330b0a94489e101b9 upstream.
+
+ Provides function drm_edid_header_is_valid() for EDID header check
+ and replaces EDID header check part of function drm_edid_block_valid()
+ by a call of drm_edid_header_is_valid().
+ This is a prerequisite to extend DDC probing, e. g. in function
+ radeon_ddc_probe() for Radeon devices, by a central EDID header check.
+
+ Tested for kernel 2.6.35, 2.6.38 and 3.0
+
+Signed-off-by: Thomas Reim <reimth@gmail.com>
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Acked-by: Stephen Michaels <Stephen.Micheals@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_edid.c | 24 ++++++++++++++++++------
+ include/drm/drm_crtc.h | 1 +
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -127,6 +127,23 @@ static const u8 edid_header[] = {
+ 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00
+ };
+
++ /*
++ * Sanity check the header of the base EDID block. Return 8 if the header
++ * is perfect, down to 0 if it's totally wrong.
++ */
++int drm_edid_header_is_valid(const u8 *raw_edid)
++{
++ int i, score = 0;
++
++ for (i = 0; i < sizeof(edid_header); i++)
++ if (raw_edid[i] == edid_header[i])
++ score++;
++
++ return score;
++}
++EXPORT_SYMBOL(drm_edid_header_is_valid);
++
++
+ /*
+ * Sanity check the EDID block (base or extension). Return 0 if the block
+ * doesn't check out, or 1 if it's valid.
+@@ -139,12 +156,7 @@ drm_edid_block_valid(u8 *raw_edid)
+ struct edid *edid = (struct edid *)raw_edid;
+
+ if (raw_edid[0] == 0x00) {
+- int score = 0;
+-
+- for (i = 0; i < sizeof(edid_header); i++)
+- if (raw_edid[i] == edid_header[i])
+- score++;
+-
++ int score = drm_edid_header_is_valid(raw_edid);
+ if (score == 8) ;
+ else if (score >= 6) {
+ DRM_DEBUG("Fixing EDID header, your hardware may be failing\n");
+--- a/include/drm/drm_crtc.h
++++ b/include/drm/drm_crtc.h
+@@ -802,6 +802,7 @@ extern struct drm_display_mode *drm_gtf_
+ extern int drm_add_modes_noedid(struct drm_connector *connector,
+ int hdisplay, int vdisplay);
+
++extern int drm_edid_header_is_valid(const u8 *raw_edid);
+ extern bool drm_edid_is_valid(struct edid *edid);
+ struct drm_display_mode *drm_mode_find_dmt(struct drm_device *dev,
+ int hsize, int vsize, int fresh);
--- /dev/null
+From 17e859a899712d16c3e70b045d61ad9e02c53f8a Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 27 Jul 2011 15:37:43 +0200
+Subject: iwlegacy: set tx power after rxon_assoc
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 17e859a899712d16c3e70b045d61ad9e02c53f8a upstream.
+
+If settings of tx power was deferred during scan or changing channel we
+have to setup them during commit rxon. Fix problem on 3945 (4965 already
+has this fix).
+
+Optimize code to apply tx settings only when tx power was actually
+changed.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlegacy/iwl-3945.c | 6 +++++-
+ drivers/net/wireless/iwlegacy/iwl-4965.c | 8 ++++++--
+ 2 files changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/iwlegacy/iwl-3945.c
++++ b/drivers/net/wireless/iwlegacy/iwl-3945.c
+@@ -1747,7 +1747,11 @@ int iwl3945_commit_rxon(struct iwl_priv
+ }
+
+ memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
+-
++ /*
++ * We do not commit tx power settings while channel changing,
++ * do it now if tx power changed.
++ */
++ iwl_legacy_set_tx_power(priv, priv->tx_power_next, false);
+ return 0;
+ }
+
+--- a/drivers/net/wireless/iwlegacy/iwl-4965.c
++++ b/drivers/net/wireless/iwlegacy/iwl-4965.c
+@@ -1237,7 +1237,12 @@ static int iwl4965_commit_rxon(struct iw
+
+ memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
+ iwl_legacy_print_rx_config_cmd(priv, ctx);
+- goto set_tx_power;
++ /*
++ * We do not commit tx power settings while channel changing,
++ * do it now if tx power changed.
++ */
++ iwl_legacy_set_tx_power(priv, priv->tx_power_next, false);
++ return 0;
+ }
+
+ /* If we are currently associated and the new config requires
+@@ -1317,7 +1322,6 @@ static int iwl4965_commit_rxon(struct iw
+
+ iwl4965_init_sensitivity(priv);
+
+-set_tx_power:
+ /* If we issue a new RXON command which required a tune then we must
+ * send a new TXPOWER command or we won't be able to Tx any frames */
+ ret = iwl_legacy_set_tx_power(priv, priv->tx_power_next, true);
--- /dev/null
+From 98382f419f32d2c12d021943b87dea555677144b Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Thu, 4 Aug 2011 14:07:39 +0000
+Subject: net: Cap number of elements for sendmmsg
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 98382f419f32d2c12d021943b87dea555677144b upstream.
+
+To limit the amount of time we can spend in sendmmsg, cap the
+number of elements to UIO_MAXIOV (currently 1024).
+
+For error handling an application using sendmmsg needs to retry at
+the first unsent message, so capping is simpler and requires less
+application logic than returning EINVAL.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1999,6 +1999,9 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ struct compat_mmsghdr __user *compat_entry;
+ struct msghdr msg_sys;
+
++ if (vlen > UIO_MAXIOV)
++ vlen = UIO_MAXIOV;
++
+ datagrams = 0;
+
+ sock = sockfd_lookup_light(fd, &err, &fput_needed);
--- /dev/null
+From c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Thu, 4 Aug 2011 14:07:40 +0000
+Subject: net: Fix security_socket_sendmsg() bypass problem.
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a upstream.
+
+The sendmmsg() introduced by commit 228e548e "net: Add sendmmsg socket system
+call" is capable of sending to multiple different destination addresses.
+
+SMACK is using destination's address for checking sendmsg() permission.
+However, security_socket_sendmsg() is called for only once even if multiple
+different destination addresses are passed to sendmmsg().
+
+Therefore, we need to call security_socket_sendmsg() for each destination
+address rather than only the first destination address.
+
+Since calling security_socket_sendmsg() every time when only single destination
+address was passed to sendmmsg() is a waste of time, omit calling
+security_socket_sendmsg() unless destination address of previous datagram and
+that of current datagram differs.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Acked-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c | 43 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 34 insertions(+), 9 deletions(-)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1871,8 +1871,14 @@ SYSCALL_DEFINE2(shutdown, int, fd, int,
+ #define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
+ #define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
+
++struct used_address {
++ struct sockaddr_storage name;
++ unsigned int name_len;
++};
++
+ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+- struct msghdr *msg_sys, unsigned flags, int nosec)
++ struct msghdr *msg_sys, unsigned flags,
++ struct used_address *used_address)
+ {
+ struct compat_msghdr __user *msg_compat =
+ (struct compat_msghdr __user *)msg;
+@@ -1953,8 +1959,28 @@ static int __sys_sendmsg(struct socket *
+
+ if (sock->file->f_flags & O_NONBLOCK)
+ msg_sys->msg_flags |= MSG_DONTWAIT;
+- err = (nosec ? sock_sendmsg_nosec : sock_sendmsg)(sock, msg_sys,
+- total_len);
++ /*
++ * If this is sendmmsg() and current destination address is same as
++ * previously succeeded address, omit asking LSM's decision.
++ * used_address->name_len is initialized to UINT_MAX so that the first
++ * destination address never matches.
++ */
++ if (used_address && used_address->name_len == msg_sys->msg_namelen &&
++ !memcmp(&used_address->name, msg->msg_name,
++ used_address->name_len)) {
++ err = sock_sendmsg_nosec(sock, msg_sys, total_len);
++ goto out_freectl;
++ }
++ err = sock_sendmsg(sock, msg_sys, total_len);
++ /*
++ * If this is sendmmsg() and sending to current destination address was
++ * successful, remember it.
++ */
++ if (used_address && err >= 0) {
++ used_address->name_len = msg_sys->msg_namelen;
++ memcpy(&used_address->name, msg->msg_name,
++ used_address->name_len);
++ }
+
+ out_freectl:
+ if (ctl_buf != ctl)
+@@ -1979,7 +2005,7 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
+ if (!sock)
+ goto out;
+
+- err = __sys_sendmsg(sock, msg, &msg_sys, flags, 0);
++ err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
+
+ fput_light(sock->file, fput_needed);
+ out:
+@@ -1998,6 +2024,7 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ struct mmsghdr __user *entry;
+ struct compat_mmsghdr __user *compat_entry;
+ struct msghdr msg_sys;
++ struct used_address used_address;
+
+ if (vlen > UIO_MAXIOV)
+ vlen = UIO_MAXIOV;
+@@ -2008,24 +2035,22 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ if (!sock)
+ return err;
+
++ used_address.name_len = UINT_MAX;
+ entry = mmsg;
+ compat_entry = (struct compat_mmsghdr __user *)mmsg;
+ err = 0;
+
+ while (datagrams < vlen) {
+- /*
+- * No need to ask LSM for more than the first datagram.
+- */
+ if (MSG_CMSG_COMPAT & flags) {
+ err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
+- &msg_sys, flags, datagrams);
++ &msg_sys, flags, &used_address);
+ if (err < 0)
+ break;
+ err = __put_user(err, &compat_entry->msg_len);
+ ++compat_entry;
+ } else {
+ err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
+- &msg_sys, flags, datagrams);
++ &msg_sys, flags, &used_address);
+ if (err < 0)
+ break;
+ err = put_user(err, &entry->msg_len);
--- /dev/null
+From 728ffb86f10873aaf4abd26dde691ee40ae731fe Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Thu, 4 Aug 2011 14:07:38 +0000
+Subject: net: sendmmsg should only return an error if no messages were sent
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 728ffb86f10873aaf4abd26dde691ee40ae731fe upstream.
+
+sendmmsg uses a similar error return strategy as recvmmsg but it
+turns out to be a confusing way to communicate errors.
+
+The current code stores the error code away and returns it on the next
+sendmmsg call. This means a call with completely valid arguments could
+get an error from a previous call.
+
+Change things so we only return an error if no datagrams could be sent.
+If less than the requested number of messages were sent, the application
+must retry starting at the first failed one and if the problem is
+persistent the error will be returned.
+
+This matches the behaviour of other syscalls like read/write - it
+is not an error if less than the requested number of elements are sent.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c | 27 +++------------------------
+ 1 file changed, 3 insertions(+), 24 deletions(-)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2005,12 +2005,9 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ if (!sock)
+ return err;
+
+- err = sock_error(sock->sk);
+- if (err)
+- goto out_put;
+-
+ entry = mmsg;
+ compat_entry = (struct compat_mmsghdr __user *)mmsg;
++ err = 0;
+
+ while (datagrams < vlen) {
+ /*
+@@ -2037,29 +2034,11 @@ int __sys_sendmmsg(int fd, struct mmsghd
+ ++datagrams;
+ }
+
+-out_put:
+ fput_light(sock->file, fput_needed);
+
+- if (err == 0)
+- return datagrams;
+-
+- if (datagrams != 0) {
+- /*
+- * We may send less entries than requested (vlen) if the
+- * sock is non blocking...
+- */
+- if (err != -EAGAIN) {
+- /*
+- * ... or if sendmsg returns an error after we
+- * send some datagrams, where we record the
+- * error to return on the next call or if the
+- * app asks about it using getsockopt(SO_ERROR).
+- */
+- sock->sk->sk_err = -err;
+- }
+-
++ /* We only return an error if no datagrams were able to be sent */
++ if (datagrams != 0)
+ return datagrams;
+- }
+
+ return err;
+ }
--- /dev/null
+From 00898a47269ae5e6dda04defad00234b96692d95 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 2 Aug 2011 13:29:02 +0200
+Subject: rt2x00: fix usage of NULL queue
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 00898a47269ae5e6dda04defad00234b96692d95 upstream.
+
+We may call rt2x00queue_pause_queue(queue) with queue == NULL. Bug
+was introduced by commit 62fe778412b36791b7897cfa139342906fbbf07b
+"rt2x00: Fix stuck queue in tx failure case" .
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2x00mac.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -113,7 +113,7 @@ void rt2x00mac_tx(struct ieee80211_hw *h
+ * due to possible race conditions in mac80211.
+ */
+ if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+- goto exit_fail;
++ goto exit_free_skb;
+
+ /*
+ * Use the ATIM queue if appropriate and present.
+@@ -127,7 +127,7 @@ void rt2x00mac_tx(struct ieee80211_hw *h
+ ERROR(rt2x00dev,
+ "Attempt to send packet over invalid queue %d.\n"
+ "Please file bug report to %s.\n", qid, DRV_PROJECT);
+- goto exit_fail;
++ goto exit_free_skb;
+ }
+
+ /*
+@@ -159,6 +159,7 @@ void rt2x00mac_tx(struct ieee80211_hw *h
+
+ exit_fail:
+ rt2x00queue_pause_queue(queue);
++ exit_free_skb:
+ dev_kfree_skb_any(skb);
+ }
+ EXPORT_SYMBOL_GPL(rt2x00mac_tx);
--- /dev/null
+From b52398b6e4522176dd125722c72c301015d24520 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 30 Jul 2011 13:32:56 +0200
+Subject: rt2x00: rt2800: fix zeroing skb structure
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit b52398b6e4522176dd125722c72c301015d24520 upstream.
+
+We should clear skb->data not skb itself. Bug was introduced by:
+commit 0b8004aa12d13ec750d102ba4082a95f0107c649 "rt2x00: Properly
+reserve room for descriptors in skbs".
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2800lib.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -784,8 +784,7 @@ void rt2800_write_beacon(struct queue_en
+ /*
+ * Add space for the TXWI in front of the skb.
+ */
+- skb_push(entry->skb, TXWI_DESC_SIZE);
+- memset(entry->skb, 0, TXWI_DESC_SIZE);
++ memset(skb_push(entry->skb, TXWI_DESC_SIZE), 0, TXWI_DESC_SIZE);
+
+ /*
+ * Register descriptor details in skb frame descriptor.
--- /dev/null
+From b6b67df3f24c45af0012ee3c8af2f62ca083ae18 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Fri, 29 Jul 2011 10:53:12 -0500
+Subject: rtlwifi: Fix kernel oops on ARM SOC
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit b6b67df3f24c45af0012ee3c8af2f62ca083ae18 upstream.
+
+This driver uses information from the self member of the pci_bus struct to
+get information regarding the bridge to which the PCIe device is attached.
+Unfortunately, this member is not established on all architectures, which
+leads to a kernel oops.
+
+Skipping the entire block that uses the self member to determine the bridge
+vendor will only affect RTL8192DE devices as that driver sets the ASPM support
+flag differently when the bridge vendor is Intel. If the self member is
+available, there is no functional change.
+
+This patch fixes Bugzilla No. 40212.
+
+Reported-by: Hubert Liao <liao.hubertt@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtlwifi/pci.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -1709,15 +1709,17 @@ static bool _rtl_pci_find_adapter(struct
+ pcipriv->ndis_adapter.devnumber = PCI_SLOT(pdev->devfn);
+ pcipriv->ndis_adapter.funcnumber = PCI_FUNC(pdev->devfn);
+
+- /*find bridge info */
+- pcipriv->ndis_adapter.pcibridge_vendorid = bridge_pdev->vendor;
+- for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
+- if (bridge_pdev->vendor == pcibridge_vendors[tmp]) {
+- pcipriv->ndis_adapter.pcibridge_vendor = tmp;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- ("Pci Bridge Vendor is found index: %d\n",
+- tmp));
+- break;
++ if (bridge_pdev) {
++ /*find bridge info if available */
++ pcipriv->ndis_adapter.pcibridge_vendorid = bridge_pdev->vendor;
++ for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
++ if (bridge_pdev->vendor == pcibridge_vendors[tmp]) {
++ pcipriv->ndis_adapter.pcibridge_vendor = tmp;
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
++ ("Pci Bridge Vendor is found index:"
++ " %d\n", tmp));
++ break;
++ }
+ }
+ }
+
wire-up-sendmmsg-syscall.patch
fix-futex-support.patch
fix-return-type-of-__atomic64_add_return.patch
+rt2x00-rt2800-fix-zeroing-skb-structure.patch
+rt2x00-fix-usage-of-null-queue.patch
+rtlwifi-fix-kernel-oops-on-arm-soc.patch
+iwlegacy-set-tx-power-after-rxon_assoc.patch
+ath9k-initialize-tx-chainmask-before-testing-channel-tx-power-values.patch
+ath9k-skip-config_pci_powersave-if-pcie-port-has-aspm-disabled.patch
+net-sendmmsg-should-only-return-an-error-if-no-messages-were-sent.patch
+net-cap-number-of-elements-for-sendmmsg.patch
+net-fix-security_socket_sendmsg-bypass-problem.patch
+xen-allow-enable-use-of-vga-console-on-dom0.patch
+drm-separate-edid-header-check-from-edid-block-check.patch
+drm-radeon-extended-ddc-probing-for-connectors-with.patch
+drm-radeon-extended-ddc-probing-for-ecs-a740gm-m-dvi-d.patch
+drm-radeon-log-subsystem-vendor-and-device-information.patch
+drm-i915-pch-fix-integer-math-bugs-in-panel-fitting.patch
+drm-i915-load-the-lut-before-pipe-enable-on-ilk.patch
+drm-i915-fix-typo-in-drm_i915_overlay_put_image-ioctl.patch
+drm-i915-initialize-rcs-ring-status-page-address-in.patch
+drm-i915-hold-mode_config-mutex-during-hotplug-processing.patch
--- /dev/null
+From c2419b4a4727f67af2fc2cd68b0d878b75e781bb Mon Sep 17 00:00:00 2001
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Date: Tue, 31 May 2011 10:50:10 -0400
+Subject: xen: allow enable use of VGA console on dom0
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit c2419b4a4727f67af2fc2cd68b0d878b75e781bb upstream.
+
+Get the information about the VGA console hardware from Xen, and put
+it into the form the bootloader normally generates, so that the rest
+of the kernel can deal with VGA as usual.
+
+[ Impact: make VGA console work in dom0 ]
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+[v1: Rebased on 2.6.39]
+[v2: Removed incorrect comments and fixed compile warnings]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/Makefile | 2 -
+ arch/x86/xen/enlighten.c | 8 +++++
+ arch/x86/xen/vga.c | 67 ++++++++++++++++++++++++++++++++++++++++++++
+ arch/x86/xen/xen-ops.h | 11 +++++++
+ include/xen/interface/xen.h | 39 +++++++++++++++++++++++++
+ 5 files changed, 126 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/xen/Makefile
++++ b/arch/x86/xen/Makefile
+@@ -18,5 +18,5 @@ obj-y := enlighten.o setup.o multicalls
+ obj-$(CONFIG_SMP) += smp.o
+ obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o
+ obj-$(CONFIG_XEN_DEBUG_FS) += debugfs.o
+-
++obj-$(CONFIG_XEN_DOM0) += vga.o
+ obj-$(CONFIG_SWIOTLB_XEN) += pci-swiotlb-xen.o
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1248,6 +1248,14 @@ asmlinkage void __init xen_start_kernel(
+ if (pci_xen)
+ x86_init.pci.arch_init = pci_xen_init;
+ } else {
++ const struct dom0_vga_console_info *info =
++ (void *)((char *)xen_start_info +
++ xen_start_info->console.dom0.info_off);
++
++ xen_init_vga(info, xen_start_info->console.dom0.info_size);
++ xen_start_info->console.domU.mfn = 0;
++ xen_start_info->console.domU.evtchn = 0;
++
+ /* Make sure ACS will be enabled */
+ pci_request_acs();
+ }
+--- /dev/null
++++ b/arch/x86/xen/vga.c
+@@ -0,0 +1,67 @@
++#include <linux/screen_info.h>
++#include <linux/init.h>
++
++#include <asm/bootparam.h>
++#include <asm/setup.h>
++
++#include <xen/interface/xen.h>
++
++#include "xen-ops.h"
++
++void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size)
++{
++ struct screen_info *screen_info = &boot_params.screen_info;
++
++ /* This is drawn from a dump from vgacon:startup in
++ * standard Linux. */
++ screen_info->orig_video_mode = 3;
++ screen_info->orig_video_isVGA = 1;
++ screen_info->orig_video_lines = 25;
++ screen_info->orig_video_cols = 80;
++ screen_info->orig_video_ega_bx = 3;
++ screen_info->orig_video_points = 16;
++ screen_info->orig_y = screen_info->orig_video_lines - 1;
++
++ switch (info->video_type) {
++ case XEN_VGATYPE_TEXT_MODE_3:
++ if (size < offsetof(struct dom0_vga_console_info, u.text_mode_3)
++ + sizeof(info->u.text_mode_3))
++ break;
++ screen_info->orig_video_lines = info->u.text_mode_3.rows;
++ screen_info->orig_video_cols = info->u.text_mode_3.columns;
++ screen_info->orig_x = info->u.text_mode_3.cursor_x;
++ screen_info->orig_y = info->u.text_mode_3.cursor_y;
++ screen_info->orig_video_points =
++ info->u.text_mode_3.font_height;
++ break;
++
++ case XEN_VGATYPE_VESA_LFB:
++ if (size < offsetof(struct dom0_vga_console_info,
++ u.vesa_lfb.gbl_caps))
++ break;
++ screen_info->orig_video_isVGA = VIDEO_TYPE_VLFB;
++ screen_info->lfb_width = info->u.vesa_lfb.width;
++ screen_info->lfb_height = info->u.vesa_lfb.height;
++ screen_info->lfb_depth = info->u.vesa_lfb.bits_per_pixel;
++ screen_info->lfb_base = info->u.vesa_lfb.lfb_base;
++ screen_info->lfb_size = info->u.vesa_lfb.lfb_size;
++ screen_info->lfb_linelength = info->u.vesa_lfb.bytes_per_line;
++ screen_info->red_size = info->u.vesa_lfb.red_size;
++ screen_info->red_pos = info->u.vesa_lfb.red_pos;
++ screen_info->green_size = info->u.vesa_lfb.green_size;
++ screen_info->green_pos = info->u.vesa_lfb.green_pos;
++ screen_info->blue_size = info->u.vesa_lfb.blue_size;
++ screen_info->blue_pos = info->u.vesa_lfb.blue_pos;
++ screen_info->rsvd_size = info->u.vesa_lfb.rsvd_size;
++ screen_info->rsvd_pos = info->u.vesa_lfb.rsvd_pos;
++ if (size >= offsetof(struct dom0_vga_console_info,
++ u.vesa_lfb.gbl_caps)
++ + sizeof(info->u.vesa_lfb.gbl_caps))
++ screen_info->capabilities = info->u.vesa_lfb.gbl_caps;
++ if (size >= offsetof(struct dom0_vga_console_info,
++ u.vesa_lfb.mode_attrs)
++ + sizeof(info->u.vesa_lfb.mode_attrs))
++ screen_info->vesa_attributes = info->u.vesa_lfb.mode_attrs;
++ break;
++ }
++}
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -88,6 +88,17 @@ static inline void xen_uninit_lock_cpu(i
+ }
+ #endif
+
++struct dom0_vga_console_info;
++
++#ifdef CONFIG_XEN_DOM0
++void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size);
++#else
++static inline void __init xen_init_vga(const struct dom0_vga_console_info *info,
++ size_t size)
++{
++}
++#endif
++
+ /* Declare an asm function, along with symbols needed to make it
+ inlineable */
+ #define DECL_ASM(ret, name, ...) \
+--- a/include/xen/interface/xen.h
++++ b/include/xen/interface/xen.h
+@@ -450,6 +450,45 @@ struct start_info {
+ int8_t cmd_line[MAX_GUEST_CMDLINE];
+ };
+
++struct dom0_vga_console_info {
++ uint8_t video_type;
++#define XEN_VGATYPE_TEXT_MODE_3 0x03
++#define XEN_VGATYPE_VESA_LFB 0x23
++
++ union {
++ struct {
++ /* Font height, in pixels. */
++ uint16_t font_height;
++ /* Cursor location (column, row). */
++ uint16_t cursor_x, cursor_y;
++ /* Number of rows and columns (dimensions in characters). */
++ uint16_t rows, columns;
++ } text_mode_3;
++
++ struct {
++ /* Width and height, in pixels. */
++ uint16_t width, height;
++ /* Bytes per scan line. */
++ uint16_t bytes_per_line;
++ /* Bits per pixel. */
++ uint16_t bits_per_pixel;
++ /* LFB physical address, and size (in units of 64kB). */
++ uint32_t lfb_base;
++ uint32_t lfb_size;
++ /* RGB mask offsets and sizes, as defined by VBE 1.2+ */
++ uint8_t red_pos, red_size;
++ uint8_t green_pos, green_size;
++ uint8_t blue_pos, blue_size;
++ uint8_t rsvd_pos, rsvd_size;
++
++ /* VESA capabilities (offset 0xa, VESA command 0x4f00). */
++ uint32_t gbl_caps;
++ /* Mode attributes (offset 0x0, VESA command 0x4f01). */
++ uint16_t mode_attrs;
++ } vesa_lfb;
++ } u;
++};
++
+ /* These flags are passed in the 'flags' field of start_info_t. */
+ #define SIF_PRIVILEGED (1<<0) /* Is the domain privileged? */
+ #define SIF_INITDOMAIN (1<<1) /* Is this the initial control domain? */
projects / thirdparty / kernel / stable-queue.git / commitdiff
