3.9.9-300.fc19.gnu

14 files changed, 1518 insertions, 244 deletions

diff --git a/freed-ora/current/f19/config-armv7-generic b/freed-ora/current/f19/config-armv7-generic
index 58c581629..d1e984fce 100644
--- a/freed-ora/current/f19/config-armv7-generic
+++ b/freed-ora/current/f19/config-armv7-generic
@@ -70,7 +70,7 @@ CONFIG_ARM_ERRATA_775420=y
 CONFIG_PL310_ERRATA_753970=y
 CONFIG_PL310_ERRATA_769419=y
 # Cortex-A15
-CONFIG_ARM_ERRATA_798181=y
+# CONFIG_ARM_ERRATA_798181 is not set
 
 # generic that deviates from or should be merged into config-generic
 CONFIG_SMP=y
diff --git a/freed-ora/current/f19/config-armv7-lpae b/freed-ora/current/f19/config-armv7-lpae
index 7e34dedb9..57d7d860e 100644
--- a/freed-ora/current/f19/config-armv7-lpae
+++ b/freed-ora/current/f19/config-armv7-lpae
@@ -11,6 +11,9 @@ CONFIG_VIRTIO_CONSOLE=m
 CONFIG_ARM_VIRT_EXT=y
 CONFIG_VIRTUALIZATION=y
 
+# Cortex-A15
+CONFIG_ARM_ERRATA_798181=y
+
 CONFIG_KVM=y
 CONFIG_KVM_ARM_HOST=y
 CONFIG_KVM_ARM_MAX_VCPUS=8
diff --git a/freed-ora/current/f19/drm-hotspot-cursor-backport.patch b/freed-ora/current/f19/drm-hotspot-cursor-backport.patch
new file mode 100644
index 000000000..f3dc82042
--- /dev/null
+++ b/freed-ora/current/f19/drm-hotspot-cursor-backport.patch
@@ -0,0 +1,164 @@
+From f2a2b3496b6024a5df546f0aedd60705b896a464 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 20 Jun 2013 11:48:52 +1000
+Subject: [PATCH 2/5] drm: add hotspot support for cursors.
+
+So it looks like for virtual hw cursors on QXL we need to inform
+the "hw" device what the cursor hotspot parameters are. This
+makes sense if you think the host has to draw the cursor and interpret
+clicks from it. However the current modesetting interface doesn't support
+passing the hotspot information from userspace.
+
+This implements a new cursor ioctl, that takes the hotspot info as well,
+userspace can try calling the new interface and if it gets -ENOSYS it means
+its on an older kernel and can just fallback.
+
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+---
+ drivers/gpu/drm/drm_crtc.c  | 35 +++++++++++++++++++++++++++++------
+ drivers/gpu/drm/drm_drv.c   |  1 +
+ include/drm/drm_crtc.h      |  5 +++++
+ include/uapi/drm/drm.h      |  1 +
+ include/uapi/drm/drm_mode.h | 13 +++++++++++++
+ 5 files changed, 49 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index dd64a06..21e71a8 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -2202,10 +2202,10 @@ out:
+ 	return ret;
+ }
+ 
+-int drm_mode_cursor_ioctl(struct drm_device *dev,
+-			void *data, struct drm_file *file_priv)
++static int drm_mode_cursor_common(struct drm_device *dev,
++				  struct drm_mode_cursor2 *req,
++				  struct drm_file *file_priv)
+ {
+-	struct drm_mode_cursor *req = data;
+ 	struct drm_mode_object *obj;
+ 	struct drm_crtc *crtc;
+ 	int ret = 0;
+@@ -2225,13 +2225,17 @@ int drm_mode_cursor_ioctl(struct drm_device *dev,
+ 
+ 	mutex_lock(&crtc->mutex);
+ 	if (req->flags & DRM_MODE_CURSOR_BO) {
+-		if (!crtc->funcs->cursor_set) {
++		if (!crtc->funcs->cursor_set && !crtc->funcs->cursor_set2) {
+ 			ret = -ENXIO;
+ 			goto out;
+ 		}
+ 		/* Turns off the cursor if handle is 0 */
+-		ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
+-					      req->width, req->height);
++		if (crtc->funcs->cursor_set2)
++			ret = crtc->funcs->cursor_set2(crtc, file_priv, req->handle,
++						      req->width, req->height, req->hot_x, req->hot_y);
++		else
++			ret = crtc->funcs->cursor_set(crtc, file_priv, req->handle,
++						      req->width, req->height);
+ 	}
+ 
+ 	if (req->flags & DRM_MODE_CURSOR_MOVE) {
+@@ -2246,6 +2250,25 @@ out:
+ 	mutex_unlock(&crtc->mutex);
+ 
+ 	return ret;
++
++}
++int drm_mode_cursor_ioctl(struct drm_device *dev,
++			void *data, struct drm_file *file_priv)
++{
++	struct drm_mode_cursor *req = data;
++	struct drm_mode_cursor2 new_req;
++
++	memcpy(&new_req, req, sizeof(struct drm_mode_cursor));
++	new_req.hot_x = new_req.hot_y = 0;
++
++	return drm_mode_cursor_common(dev, &new_req, file_priv);
++}
++
++int drm_mode_cursor2_ioctl(struct drm_device *dev,
++			   void *data, struct drm_file *file_priv)
++{
++	struct drm_mode_cursor2 *req = data;
++	return drm_mode_cursor_common(dev, req, file_priv);
+ }
+ 
+ /* Original addfb only supported RGB formats, so figure out which one */
+diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
+index 25f91cd..cb4470b 100644
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -166,6 +166,7 @@ static struct drm_ioctl_desc drm_ioctls[] = {
+ 	DRM_IOCTL_DEF(DRM_IOCTL_MODE_DESTROY_DUMB, drm_mode_destroy_dumb_ioctl, DRM_CONTROL_ALLOW|DRM_UNLOCKED),
+ 	DRM_IOCTL_DEF(DRM_IOCTL_MODE_OBJ_GETPROPERTIES, drm_mode_obj_get_properties_ioctl, DRM_CONTROL_ALLOW|DRM_UNLOCKED),
+ 	DRM_IOCTL_DEF(DRM_IOCTL_MODE_OBJ_SETPROPERTY, drm_mode_obj_set_property_ioctl, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
++	DRM_IOCTL_DEF(DRM_IOCTL_MODE_CURSOR2, drm_mode_cursor2_ioctl, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
+ };
+ 
+ #define DRM_CORE_IOCTL_COUNT	ARRAY_SIZE( drm_ioctls )
+diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
+index e3e0d65..eba931b 100644
+--- a/include/drm/drm_crtc.h
++++ b/include/drm/drm_crtc.h
+@@ -339,6 +339,9 @@ struct drm_crtc_funcs {
+ 	/* cursor controls */
+ 	int (*cursor_set)(struct drm_crtc *crtc, struct drm_file *file_priv,
+ 			  uint32_t handle, uint32_t width, uint32_t height);
++	int (*cursor_set2)(struct drm_crtc *crtc, struct drm_file *file_priv,
++			   uint32_t handle, uint32_t width, uint32_t height,
++			   int32_t hot_x, int32_t hot_y);
+ 	int (*cursor_move)(struct drm_crtc *crtc, int x, int y);
+ 
+ 	/* Set gamma on the CRTC */
+@@ -1025,6 +1028,8 @@ extern int drm_mode_setplane(struct drm_device *dev,
+ 			       void *data, struct drm_file *file_priv);
+ extern int drm_mode_cursor_ioctl(struct drm_device *dev,
+ 				void *data, struct drm_file *file_priv);
++extern int drm_mode_cursor2_ioctl(struct drm_device *dev,
++				void *data, struct drm_file *file_priv);
+ extern int drm_mode_addfb(struct drm_device *dev,
+ 			  void *data, struct drm_file *file_priv);
+ extern int drm_mode_addfb2(struct drm_device *dev,
+diff --git a/include/uapi/drm/drm.h b/include/uapi/drm/drm.h
+index 8d1e2bb..5182a2d 100644
+--- a/include/uapi/drm/drm.h
++++ b/include/uapi/drm/drm.h
+@@ -732,6 +732,7 @@ struct drm_prime_handle {
+ #define DRM_IOCTL_MODE_ADDFB2		DRM_IOWR(0xB8, struct drm_mode_fb_cmd2)
+ #define DRM_IOCTL_MODE_OBJ_GETPROPERTIES	DRM_IOWR(0xB9, struct drm_mode_obj_get_properties)
+ #define DRM_IOCTL_MODE_OBJ_SETPROPERTY	DRM_IOWR(0xBA, struct drm_mode_obj_set_property)
++#define DRM_IOCTL_MODE_CURSOR2		DRM_IOWR(0xBB, struct drm_mode_cursor2)
+ 
+ /**
+  * Device specific ioctls should only be in their respective headers
+diff --git a/include/uapi/drm/drm_mode.h b/include/uapi/drm/drm_mode.h
+index 3d6301b..ecde539 100644
+--- a/include/uapi/drm/drm_mode.h
++++ b/include/uapi/drm/drm_mode.h
+@@ -388,6 +388,19 @@ struct drm_mode_cursor {
+ 	__u32 handle;
+ };
+ 
++struct drm_mode_cursor2 {
++	__u32 flags;
++	__u32 crtc_id;
++	__s32 x;
++	__s32 y;
++	__u32 width;
++	__u32 height;
++	/* driver specific handle */
++	__u32 handle;
++	__s32 hot_x;
++	__s32 hot_y;
++};
++
+ struct drm_mode_crtc_lut {
+ 	__u32 crtc_id;
+ 	__u32 gamma_size;
+-- 
+1.8.3.1
+
diff --git a/freed-ora/current/f19/drm-qxl-3.10-rc7-diff.patch b/freed-ora/current/f19/drm-qxl-3.10-rc7-diff.patch
new file mode 100644
index 000000000..3aa53f60d
--- /dev/null
+++ b/freed-ora/current/f19/drm-qxl-3.10-rc7-diff.patch
@@ -0,0 +1,593 @@
+From be71369a5b4297776fb9988e6274595136294588 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Tue, 16 Apr 2013 13:24:25 +1000
+Subject: [PATCH 4/5] drm/qxl 3.10-rc7 diff
+
+drm/qxl: make lots of things static.
+drm/qxl: fix smatch warnings
+drm/qxl: fix build with debugfs turned off.
+drivers, drm: fix qxl build error when debugfs is disabled
+drm/qxl: fix ioport interactions for kernel submitted commands.
+qxl: drop unused variable.
+drm/qxl: drop active_user_framebuffer as its unneeded
+qxl: fix bug with object eviction and update area
+qxl: fix Kconfig deps - select FB_DEFERRED_IO
+drm/qxl: fix build warnings on 32-bit
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+---
+ drivers/gpu/drm/qxl/Kconfig       |  1 +
+ drivers/gpu/drm/qxl/qxl_cmd.c     | 52 +++++++++++++++++----------------------
+ drivers/gpu/drm/qxl/qxl_debugfs.c |  6 +++++
+ drivers/gpu/drm/qxl/qxl_display.c | 36 +++++++++++----------------
+ drivers/gpu/drm/qxl/qxl_drv.c     |  2 +-
+ drivers/gpu/drm/qxl/qxl_drv.h     |  7 ------
+ drivers/gpu/drm/qxl/qxl_fb.c      |  2 +-
+ drivers/gpu/drm/qxl/qxl_gem.c     | 29 ----------------------
+ drivers/gpu/drm/qxl/qxl_ioctl.c   | 29 +++++++++++-----------
+ drivers/gpu/drm/qxl/qxl_kms.c     | 11 +++++----
+ drivers/gpu/drm/qxl/qxl_object.c  |  6 ++---
+ drivers/gpu/drm/qxl/qxl_release.c |  4 +--
+ drivers/gpu/drm/qxl/qxl_ttm.c     | 10 +++++---
+ 13 files changed, 78 insertions(+), 117 deletions(-)
+
+diff --git a/drivers/gpu/drm/qxl/Kconfig b/drivers/gpu/drm/qxl/Kconfig
+index 2f1a57e..d6c1279 100644
+--- a/drivers/gpu/drm/qxl/Kconfig
++++ b/drivers/gpu/drm/qxl/Kconfig
+@@ -4,6 +4,7 @@ config DRM_QXL
+ 	select FB_SYS_FILLRECT
+ 	select FB_SYS_COPYAREA
+ 	select FB_SYS_IMAGEBLIT
++	select FB_DEFERRED_IO
+         select DRM_KMS_HELPER
+         select DRM_TTM
+ 	help
+diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
+index 804b411..02befd9 100644
+--- a/drivers/gpu/drm/qxl/qxl_cmd.c
++++ b/drivers/gpu/drm/qxl/qxl_cmd.c
+@@ -144,8 +144,8 @@ int qxl_ring_push(struct qxl_ring *ring,
+ 	return 0;
+ }
+ 
+-bool qxl_ring_pop(struct qxl_ring *ring,
+-		  void *element)
++static bool qxl_ring_pop(struct qxl_ring *ring,
++			 void *element)
+ {
+ 	volatile struct qxl_ring_header *header = &(ring->ring->header);
+ 	volatile uint8_t *ring_elt;
+@@ -169,23 +169,6 @@ bool qxl_ring_pop(struct qxl_ring *ring,
+ 	return true;
+ }
+ 
+-void qxl_ring_wait_idle(struct qxl_ring *ring)
+-{
+-	struct qxl_ring_header *header = &(ring->ring->header);
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&ring->lock, flags);
+-	if (ring->ring->header.cons < ring->ring->header.prod) {
+-		header->notify_on_cons = header->prod;
+-		mb();
+-		spin_unlock_irqrestore(&ring->lock, flags);
+-		wait_event_interruptible(*ring->push_event,
+-					 qxl_check_idle(ring));
+-		spin_lock_irqsave(&ring->lock, flags);
+-	}
+-	spin_unlock_irqrestore(&ring->lock, flags);
+-}
+-
+ int
+ qxl_push_command_ring_release(struct qxl_device *qdev, struct qxl_release *release,
+ 			      uint32_t type, bool interruptible)
+@@ -294,7 +277,7 @@ out_unref:
+ 	return 0;
+ }
+ 
+-static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port)
++static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port, bool intr)
+ {
+ 	int irq_num;
+ 	long addr = qdev->io_base + port;
+@@ -302,20 +285,29 @@ static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port)
+ 
+ 	mutex_lock(&qdev->async_io_mutex);
+ 	irq_num = atomic_read(&qdev->irq_received_io_cmd);
+-
+-
+ 	if (qdev->last_sent_io_cmd > irq_num) {
+-		ret = wait_event_interruptible(qdev->io_cmd_event,
+-					       atomic_read(&qdev->irq_received_io_cmd) > irq_num);
+-		if (ret)
++		if (intr)
++			ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
++							       atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
++		else
++			ret = wait_event_timeout(qdev->io_cmd_event,
++						 atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
++		/* 0 is timeout, just bail the "hw" has gone away */
++		if (ret <= 0)
+ 			goto out;
+ 		irq_num = atomic_read(&qdev->irq_received_io_cmd);
+ 	}
+ 	outb(val, addr);
+ 	qdev->last_sent_io_cmd = irq_num + 1;
+-	ret = wait_event_interruptible(qdev->io_cmd_event,
+-				       atomic_read(&qdev->irq_received_io_cmd) > irq_num);
++	if (intr)
++		ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
++						       atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
++	else
++		ret = wait_event_timeout(qdev->io_cmd_event,
++					 atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
+ out:
++	if (ret > 0)
++		ret = 0;
+ 	mutex_unlock(&qdev->async_io_mutex);
+ 	return ret;
+ }
+@@ -325,7 +317,7 @@ static void wait_for_io_cmd(struct qxl_device *qdev, uint8_t val, long port)
+ 	int ret;
+ 
+ restart:
+-	ret = wait_for_io_cmd_user(qdev, val, port);
++	ret = wait_for_io_cmd_user(qdev, val, port, false);
+ 	if (ret == -ERESTARTSYS)
+ 		goto restart;
+ }
+@@ -357,7 +349,7 @@ int qxl_io_update_area(struct qxl_device *qdev, struct qxl_bo *surf,
+ 	mutex_lock(&qdev->update_area_mutex);
+ 	qdev->ram_header->update_area = *area;
+ 	qdev->ram_header->update_surface = surface_id;
+-	ret = wait_for_io_cmd_user(qdev, 0, QXL_IO_UPDATE_AREA_ASYNC);
++	ret = wait_for_io_cmd_user(qdev, 0, QXL_IO_UPDATE_AREA_ASYNC, true);
+ 	mutex_unlock(&qdev->update_area_mutex);
+ 	return ret;
+ }
+@@ -609,7 +601,7 @@ retry:
+ 	return ret;
+ }
+ 
+-void qxl_surface_evict_locked(struct qxl_device *qdev, struct qxl_bo *surf, bool do_update_area)
++static void qxl_surface_evict_locked(struct qxl_device *qdev, struct qxl_bo *surf, bool do_update_area)
+ {
+ 	/* no need to update area if we are just freeing the surface normally */
+ 	if (do_update_area)
+diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c
+index c630152..c3c2bbd 100644
+--- a/drivers/gpu/drm/qxl/qxl_debugfs.c
++++ b/drivers/gpu/drm/qxl/qxl_debugfs.c
+@@ -35,6 +35,7 @@
+ #include "qxl_object.h"
+ 
+ 
++#if defined(CONFIG_DEBUG_FS)
+ static int
+ qxl_debugfs_irq_received(struct seq_file *m, void *data)
+ {
+@@ -69,20 +70,25 @@ static struct drm_info_list qxl_debugfs_list[] = {
+ 	{ "qxl_buffers", qxl_debugfs_buffers_info, 0, NULL },
+ };
+ #define QXL_DEBUGFS_ENTRIES ARRAY_SIZE(qxl_debugfs_list)
++#endif
+ 
+ int
+ qxl_debugfs_init(struct drm_minor *minor)
+ {
++#if defined(CONFIG_DEBUG_FS)
+ 	drm_debugfs_create_files(qxl_debugfs_list, QXL_DEBUGFS_ENTRIES,
+ 				 minor->debugfs_root, minor);
++#endif
+ 	return 0;
+ }
+ 
+ void
+ qxl_debugfs_takedown(struct drm_minor *minor)
+ {
++#if defined(CONFIG_DEBUG_FS)
+ 	drm_debugfs_remove_files(qxl_debugfs_list, QXL_DEBUGFS_ENTRIES,
+ 				 minor);
++#endif
+ }
+ 
+ int qxl_debugfs_add_files(struct qxl_device *qdev,
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
+index c80ddfe..823d29e 100644
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -84,6 +84,7 @@ void qxl_alloc_client_monitors_config(struct qxl_device *qdev, unsigned count)
+ 	if (qdev->client_monitors_config &&
+ 	    count > qdev->client_monitors_config->count) {
+ 		kfree(qdev->client_monitors_config);
++		qdev->client_monitors_config = NULL;
+ 	}
+ 	if (!qdev->client_monitors_config) {
+ 		qdev->client_monitors_config = kzalloc(
+@@ -413,11 +414,11 @@ static void qxl_user_framebuffer_destroy(struct drm_framebuffer *fb)
+ 	kfree(qxl_fb);
+ }
+ 
+-int qxl_framebuffer_surface_dirty(struct drm_framebuffer *fb,
+-				  struct drm_file *file_priv,
+-				  unsigned flags, unsigned color,
+-				  struct drm_clip_rect *clips,
+-				  unsigned num_clips)
++static int qxl_framebuffer_surface_dirty(struct drm_framebuffer *fb,
++					 struct drm_file *file_priv,
++					 unsigned flags, unsigned color,
++					 struct drm_clip_rect *clips,
++					 unsigned num_clips)
+ {
+ 	/* TODO: vmwgfx where this was cribbed from had locking. Why? */
+ 	struct qxl_framebuffer *qxl_fb = to_qxl_framebuffer(fb);
+@@ -427,10 +428,10 @@ int qxl_framebuffer_surface_dirty(struct drm_framebuffer *fb,
+ 	int inc = 1;
+ 
+ 	qobj = gem_to_qxl_bo(qxl_fb->obj);
+-	if (qxl_fb != qdev->active_user_framebuffer) {
+-		DRM_INFO("%s: qxl_fb 0x%p != qdev->active_user_framebuffer 0x%p\n",
+-			__func__, qxl_fb, qdev->active_user_framebuffer);
+-	}
++	/* if we aren't primary surface ignore this */
++	if (!qobj->is_primary)
++		return 0;
++
+ 	if (!num_clips) {
+ 		num_clips = 1;
+ 		clips = &norect;
+@@ -603,7 +604,6 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
+ 					       mode->hdisplay,
+ 					       mode->vdisplay);
+ 	}
+-	qdev->mode_set = true;
+ 	return 0;
+ }
+ 
+@@ -619,7 +619,7 @@ static void qxl_crtc_commit(struct drm_crtc *crtc)
+ 	DRM_DEBUG("\n");
+ }
+ 
+-void qxl_crtc_load_lut(struct drm_crtc *crtc)
++static void qxl_crtc_load_lut(struct drm_crtc *crtc)
+ {
+ 	DRM_DEBUG("\n");
+ }
+@@ -633,7 +633,7 @@ static const struct drm_crtc_helper_funcs qxl_crtc_helper_funcs = {
+ 	.load_lut = qxl_crtc_load_lut,
+ };
+ 
+-int qdev_crtc_init(struct drm_device *dev, int num_crtc)
++static int qdev_crtc_init(struct drm_device *dev, int num_crtc)
+ {
+ 	struct qxl_crtc *qxl_crtc;
+ 
+@@ -764,7 +764,7 @@ static int qxl_conn_mode_valid(struct drm_connector *connector,
+ 	return MODE_OK;
+ }
+ 
+-struct drm_encoder *qxl_best_encoder(struct drm_connector *connector)
++static struct drm_encoder *qxl_best_encoder(struct drm_connector *connector)
+ {
+ 	struct qxl_output *qxl_output =
+ 		drm_connector_to_qxl_output(connector);
+@@ -855,7 +855,7 @@ static const struct drm_encoder_funcs qxl_enc_funcs = {
+ 	.destroy = qxl_enc_destroy,
+ };
+ 
+-int qdev_output_init(struct drm_device *dev, int num_output)
++static int qdev_output_init(struct drm_device *dev, int num_output)
+ {
+ 	struct qxl_output *qxl_output;
+ 	struct drm_connector *connector;
+@@ -892,7 +892,6 @@ qxl_user_framebuffer_create(struct drm_device *dev,
+ {
+ 	struct drm_gem_object *obj;
+ 	struct qxl_framebuffer *qxl_fb;
+-	struct qxl_device *qdev = dev->dev_private;
+ 	int ret;
+ 
+ 	obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handles[0]);
+@@ -908,13 +907,6 @@ qxl_user_framebuffer_create(struct drm_device *dev,
+ 		return NULL;
+ 	}
+ 
+-	if (qdev->active_user_framebuffer) {
+-		DRM_INFO("%s: active_user_framebuffer %p -> %p\n",
+-			 __func__,
+-			 qdev->active_user_framebuffer, qxl_fb);
+-	}
+-	qdev->active_user_framebuffer = qxl_fb;
+-
+ 	return &qxl_fb->base;
+ }
+ 
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
+index d337da0..aa291d8 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.c
++++ b/drivers/gpu/drm/qxl/qxl_drv.c
+@@ -46,7 +46,7 @@ static DEFINE_PCI_DEVICE_TABLE(pciidlist) = {
+ };
+ MODULE_DEVICE_TABLE(pci, pciidlist);
+ 
+-int qxl_modeset = -1;
++static int qxl_modeset = -1;
+ 
+ MODULE_PARM_DESC(modeset, "Disable/Enable modesetting");
+ module_param_named(modeset, qxl_modeset, int, 0400);
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
+index 52b582c..43d06ab 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -255,12 +255,6 @@ struct qxl_device {
+ 	struct qxl_gem		gem;
+ 	struct qxl_mode_info mode_info;
+ 
+-	/*
+-	 * last created framebuffer with fb_create
+-	 * only used by debugfs dumbppm
+-	 */
+-	struct qxl_framebuffer *active_user_framebuffer;
+-
+ 	struct fb_info			*fbdev_info;
+ 	struct qxl_framebuffer	*fbdev_qfb;
+ 	void *ram_physical;
+@@ -270,7 +264,6 @@ struct qxl_device {
+ 	struct qxl_ring *cursor_ring;
+ 
+ 	struct qxl_ram_header *ram_header;
+-	bool mode_set;
+ 
+ 	bool primary_created;
+ 
+diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
+index 232b52b..b3c5127 100644
+--- a/drivers/gpu/drm/qxl/qxl_fb.c
++++ b/drivers/gpu/drm/qxl/qxl_fb.c
+@@ -159,7 +159,7 @@ static void qxl_deferred_io(struct fb_info *info,
+ };
+ 
+ 
+-struct fb_deferred_io qxl_defio = {
++static struct fb_deferred_io qxl_defio = {
+ 	.delay		= QXL_DIRTY_DELAY,
+ 	.deferred_io	= qxl_deferred_io,
+ };
+diff --git a/drivers/gpu/drm/qxl/qxl_gem.c b/drivers/gpu/drm/qxl/qxl_gem.c
+index adc1ee2..a235693 100644
+--- a/drivers/gpu/drm/qxl/qxl_gem.c
++++ b/drivers/gpu/drm/qxl/qxl_gem.c
+@@ -127,35 +127,6 @@ void qxl_gem_object_unpin(struct drm_gem_object *obj)
+ 	}
+ }
+ 
+-int qxl_gem_set_domain(struct drm_gem_object *gobj,
+-			  uint32_t rdomain, uint32_t wdomain)
+-{
+-	struct qxl_bo *qobj;
+-	uint32_t domain;
+-	int r;
+-
+-	/* FIXME: reeimplement */
+-	qobj = gobj->driver_private;
+-	/* work out where to validate the buffer to */
+-	domain = wdomain;
+-	if (!domain)
+-		domain = rdomain;
+-	if (!domain) {
+-		/* Do nothings */
+-		pr_warn("Set domain withou domain !\n");
+-		return 0;
+-	}
+-	if (domain == QXL_GEM_DOMAIN_CPU) {
+-		/* Asking for cpu access wait for object idle */
+-		r = qxl_bo_wait(qobj, NULL, false);
+-		if (r) {
+-			pr_err("Failed to wait for object !\n");
+-			return r;
+-		}
+-	}
+-	return 0;
+-}
+-
+ int qxl_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_priv)
+ {
+ 	return 0;
+diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
+index 83ca4f7..a4b71b2 100644
+--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
+@@ -30,8 +30,8 @@
+  * TODO: allocating a new gem(in qxl_bo) for each request.
+  * This is wasteful since bo's are page aligned.
+  */
+-int qxl_alloc_ioctl(struct drm_device *dev, void *data,
+-		    struct drm_file *file_priv)
++static int qxl_alloc_ioctl(struct drm_device *dev, void *data,
++			   struct drm_file *file_priv)
+ {
+ 	struct qxl_device *qdev = dev->dev_private;
+ 	struct drm_qxl_alloc *qxl_alloc = data;
+@@ -58,8 +58,8 @@ int qxl_alloc_ioctl(struct drm_device *dev, void *data,
+ 	return 0;
+ }
+ 
+-int qxl_map_ioctl(struct drm_device *dev, void *data,
+-		  struct drm_file *file_priv)
++static int qxl_map_ioctl(struct drm_device *dev, void *data,
++			 struct drm_file *file_priv)
+ {
+ 	struct qxl_device *qdev = dev->dev_private;
+ 	struct drm_qxl_map *qxl_map = data;
+@@ -101,9 +101,9 @@ apply_surf_reloc(struct qxl_device *qdev, struct qxl_bo *dst, uint64_t dst_off,
+ }
+ 
+ /* return holding the reference to this object */
+-struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
+-				  struct drm_file *file_priv, uint64_t handle,
+-				  struct qxl_reloc_list *reloc_list)
++static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
++					 struct drm_file *file_priv, uint64_t handle,
++					 struct qxl_reloc_list *reloc_list)
+ {
+ 	struct drm_gem_object *gobj;
+ 	struct qxl_bo *qobj;
+@@ -129,8 +129,8 @@ struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
+  * However, the command as passed from user space must *not* contain the initial
+  * QXLReleaseInfo struct (first XXX bytes)
+  */
+-int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
+-			 struct drm_file *file_priv)
++static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
++				struct drm_file *file_priv)
+ {
+ 	struct qxl_device *qdev = dev->dev_private;
+ 	struct drm_qxl_execbuffer *execbuffer = data;
+@@ -151,7 +151,7 @@ int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
+ 		struct qxl_bo *cmd_bo;
+ 		int release_type;
+ 		struct drm_qxl_command *commands =
+-			(struct drm_qxl_command *)execbuffer->commands;
++			(struct drm_qxl_command *)(uintptr_t)execbuffer->commands;
+ 
+ 		if (DRM_COPY_FROM_USER(&user_cmd, &commands[cmd_num],
+ 				       sizeof(user_cmd)))
+@@ -193,7 +193,7 @@ int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
+ 
+ 		for (i = 0 ; i < user_cmd.relocs_num; ++i) {
+ 			if (DRM_COPY_FROM_USER(&reloc,
+-					       &((struct drm_qxl_reloc *)user_cmd.relocs)[i],
++					       &((struct drm_qxl_reloc *)(uintptr_t)user_cmd.relocs)[i],
+ 					       sizeof(reloc))) {
+ 				qxl_bo_list_unreserve(&reloc_list, true);
+ 				qxl_release_unreserve(qdev, release);
+@@ -266,8 +266,8 @@ int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
+ 	return 0;
+ }
+ 
+-int qxl_update_area_ioctl(struct drm_device *dev, void *data,
+-			  struct drm_file *file)
++static int qxl_update_area_ioctl(struct drm_device *dev, void *data,
++				 struct drm_file *file)
+ {
+ 	struct qxl_device *qdev = dev->dev_private;
+ 	struct drm_qxl_update_area *update_area = data;
+@@ -294,6 +294,7 @@ int qxl_update_area_ioctl(struct drm_device *dev, void *data,
+ 		goto out;
+ 
+ 	if (!qobj->pin_count) {
++		qxl_ttm_placement_from_domain(qobj, qobj->type);
+ 		ret = ttm_bo_validate(&qobj->tbo, &qobj->placement,
+ 				      true, false);
+ 		if (unlikely(ret))
+@@ -347,7 +348,7 @@ static int qxl_clientcap_ioctl(struct drm_device *dev, void *data,
+ 	if (qdev->pdev->revision < 4)
+ 		return -ENOSYS;
+ 
+-	if (byte > 58)
++	if (byte >= 58)
+ 		return -ENOSYS;
+ 
+ 	if (qdev->rom->client_capabilities[byte] & (1 << idx))
+diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
+index 036e0de..e27ce2a 100644
+--- a/drivers/gpu/drm/qxl/qxl_kms.c
++++ b/drivers/gpu/drm/qxl/qxl_kms.c
+@@ -128,12 +128,13 @@ int qxl_device_init(struct qxl_device *qdev,
+ 
+ 	qdev->vram_mapping = io_mapping_create_wc(qdev->vram_base, pci_resource_len(pdev, 0));
+ 	qdev->surface_mapping = io_mapping_create_wc(qdev->surfaceram_base, qdev->surfaceram_size);
+-	DRM_DEBUG_KMS("qxl: vram %p-%p(%dM %dk), surface %p-%p(%dM %dk)\n",
+-		 (void *)qdev->vram_base, (void *)pci_resource_end(pdev, 0),
++	DRM_DEBUG_KMS("qxl: vram %llx-%llx(%dM %dk), surface %llx-%llx(%dM %dk)\n",
++		 (unsigned long long)qdev->vram_base,
++		 (unsigned long long)pci_resource_end(pdev, 0),
+ 		 (int)pci_resource_len(pdev, 0) / 1024 / 1024,
+ 		 (int)pci_resource_len(pdev, 0) / 1024,
+-		 (void *)qdev->surfaceram_base,
+-		 (void *)pci_resource_end(pdev, 1),
++		 (unsigned long long)qdev->surfaceram_base,
++		 (unsigned long long)pci_resource_end(pdev, 1),
+ 		 (int)qdev->surfaceram_size / 1024 / 1024,
+ 		 (int)qdev->surfaceram_size / 1024);
+ 
+@@ -230,7 +231,7 @@ int qxl_device_init(struct qxl_device *qdev,
+ 	return 0;
+ }
+ 
+-void qxl_device_fini(struct qxl_device *qdev)
++static void qxl_device_fini(struct qxl_device *qdev)
+ {
+ 	if (qdev->current_release_bo[0])
+ 		qxl_bo_unref(&qdev->current_release_bo[0]);
+diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c
+index 51efb94..d9b12e7 100644
+--- a/drivers/gpu/drm/qxl/qxl_object.c
++++ b/drivers/gpu/drm/qxl/qxl_object.c
+@@ -59,11 +59,11 @@ void qxl_ttm_placement_from_domain(struct qxl_bo *qbo, u32 domain)
+ 	qbo->placement.lpfn = 0;
+ 	qbo->placement.placement = qbo->placements;
+ 	qbo->placement.busy_placement = qbo->placements;
+-	if (domain & QXL_GEM_DOMAIN_VRAM)
++	if (domain == QXL_GEM_DOMAIN_VRAM)
+ 		qbo->placements[c++] = TTM_PL_FLAG_CACHED | TTM_PL_FLAG_VRAM;
+-	if (domain & QXL_GEM_DOMAIN_SURFACE)
++	if (domain == QXL_GEM_DOMAIN_SURFACE)
+ 		qbo->placements[c++] = TTM_PL_FLAG_CACHED | TTM_PL_FLAG_PRIV0;
+-	if (domain & QXL_GEM_DOMAIN_CPU)
++	if (domain == QXL_GEM_DOMAIN_CPU)
+ 		qbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
+ 	if (!c)
+ 		qbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
+diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
+index 1600781..c4267c7 100644
+--- a/drivers/gpu/drm/qxl/qxl_release.c
++++ b/drivers/gpu/drm/qxl/qxl_release.c
+@@ -117,8 +117,8 @@ qxl_release_add_res(struct qxl_device *qdev, struct qxl_release *release,
+ 	release->bos[release->bo_count++] = qxl_bo_ref(bo);
+ }
+ 
+-int qxl_release_bo_alloc(struct qxl_device *qdev,
+-			 struct qxl_bo **bo)
++static int qxl_release_bo_alloc(struct qxl_device *qdev,
++				struct qxl_bo **bo)
+ {
+ 	int ret;
+ 	ret = qxl_bo_create(qdev, PAGE_SIZE, false, QXL_GEM_DOMAIN_VRAM, NULL,
+diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
+index aa9fb9a..489cb8c 100644
+--- a/drivers/gpu/drm/qxl/qxl_ttm.c
++++ b/drivers/gpu/drm/qxl/qxl_ttm.c
+@@ -315,9 +315,9 @@ static void qxl_ttm_tt_unpopulate(struct ttm_tt *ttm)
+ 	ttm_pool_unpopulate(ttm);
+ }
+ 
+-struct ttm_tt *qxl_ttm_tt_create(struct ttm_bo_device *bdev,
+-				 unsigned long size, uint32_t page_flags,
+-				 struct page *dummy_read_page)
++static struct ttm_tt *qxl_ttm_tt_create(struct ttm_bo_device *bdev,
++					unsigned long size, uint32_t page_flags,
++					struct page *dummy_read_page)
+ {
+ 	struct qxl_device *qdev;
+ 	struct qxl_ttm_tt *gtt;
+@@ -555,6 +555,7 @@ static int qxl_mm_dump_table(struct seq_file *m, void *data)
+ 
+ static int qxl_ttm_debugfs_init(struct qxl_device *qdev)
+ {
++#if defined(CONFIG_DEBUG_FS)
+ 	static struct drm_info_list qxl_mem_types_list[QXL_DEBUGFS_MEM_TYPES];
+ 	static char qxl_mem_types_names[QXL_DEBUGFS_MEM_TYPES][32];
+ 	unsigned i;
+@@ -574,4 +575,7 @@ static int qxl_ttm_debugfs_init(struct qxl_device *qdev)
+ 
+ 	}
+ 	return qxl_debugfs_add_files(qdev, qxl_mem_types_list, i);
++#else
++	return 0;
++#endif
+ }
+-- 
+1.8.3.1
+
diff --git a/freed-ora/current/f19/drm-qxl-access-fix.patch b/freed-ora/current/f19/drm-qxl-access-fix.patch
new file mode 100644
index 000000000..e40a14d1b
--- /dev/null
+++ b/freed-ora/current/f19/drm-qxl-access-fix.patch
@@ -0,0 +1,30 @@
+From 18097b91aaff215e843f04b84ec2c686270bb55f Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Fri, 28 Jun 2013 13:27:40 +1000
+Subject: [PATCH] drm/qxl: add missing access check for execbuffer ioctl
+
+Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+---
+ drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
+index a4b71b2..a30f294 100644
+--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
+@@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
+ 		if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
+ 			return -EINVAL;
+ 
++		if (!access_ok(VERIFY_READ,
++			       (void *)(unsigned long)user_cmd.command,
++			       user_cmd.command_size))
++			return -EFAULT;
++
+ 		ret = qxl_alloc_release_reserved(qdev,
+ 						 sizeof(union qxl_release_info) +
+ 						 user_cmd.command_size,
+-- 
+1.8.1.2
+
diff --git a/freed-ora/current/f19/drm-qxl-backport-fixes.patch b/freed-ora/current/f19/drm-qxl-backport-fixes.patch
deleted file mode 100644
index 0979f2509..000000000
--- a/freed-ora/current/f19/drm-qxl-backport-fixes.patch
+++ /dev/null
@@ -1,154 +0,0 @@
-diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
-index 08b0823..f867714 100644
---- a/drivers/gpu/drm/qxl/qxl_cmd.c
-+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
-@@ -277,7 +277,7 @@ out_unref:
- 	return 0;
- }
- 
--static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port)
-+static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port, bool intr)
- {
- 	int irq_num;
- 	long addr = qdev->io_base + port;
-@@ -285,20 +285,29 @@ static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port)
- 
- 	mutex_lock(&qdev->async_io_mutex);
- 	irq_num = atomic_read(&qdev->irq_received_io_cmd);
--
--
- 	if (qdev->last_sent_io_cmd > irq_num) {
--		ret = wait_event_interruptible(qdev->io_cmd_event,
--					       atomic_read(&qdev->irq_received_io_cmd) > irq_num);
--		if (ret)
-+		if (intr)
-+			ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
-+							       atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
-+		else
-+			ret = wait_event_timeout(qdev->io_cmd_event,
-+						 atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
-+		/* 0 is timeout, just bail the "hw" has gone away */
-+		if (ret <= 0)
- 			goto out;
- 		irq_num = atomic_read(&qdev->irq_received_io_cmd);
- 	}
- 	outb(val, addr);
- 	qdev->last_sent_io_cmd = irq_num + 1;
--	ret = wait_event_interruptible(qdev->io_cmd_event,
--				       atomic_read(&qdev->irq_received_io_cmd) > irq_num);
-+	if (intr)
-+		ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
-+						       atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
-+	else
-+		ret = wait_event_timeout(qdev->io_cmd_event,
-+					 atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
- out:
-+	if (ret > 0)
-+		ret = 0;
- 	mutex_unlock(&qdev->async_io_mutex);
- 	return ret;
- }
-@@ -308,7 +317,7 @@ static void wait_for_io_cmd(struct qxl_device *qdev, uint8_t val, long port)
- 	int ret;
- 
- restart:
--	ret = wait_for_io_cmd_user(qdev, val, port);
-+	ret = wait_for_io_cmd_user(qdev, val, port, false);
- 	if (ret == -ERESTARTSYS)
- 		goto restart;
- }
-@@ -340,7 +349,7 @@ int qxl_io_update_area(struct qxl_device *qdev, struct qxl_bo *surf,
- 	mutex_lock(&qdev->update_area_mutex);
- 	qdev->ram_header->update_area = *area;
- 	qdev->ram_header->update_surface = surface_id;
--	ret = wait_for_io_cmd_user(qdev, 0, QXL_IO_UPDATE_AREA_ASYNC);
-+	ret = wait_for_io_cmd_user(qdev, 0, QXL_IO_UPDATE_AREA_ASYNC, true);
- 	mutex_unlock(&qdev->update_area_mutex);
- 	return ret;
- }
-diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
-index fcfd443..823d29e 100644
---- a/drivers/gpu/drm/qxl/qxl_display.c
-+++ b/drivers/gpu/drm/qxl/qxl_display.c
-@@ -428,10 +428,10 @@ static int qxl_framebuffer_surface_dirty(struct drm_framebuffer *fb,
- 	int inc = 1;
- 
- 	qobj = gem_to_qxl_bo(qxl_fb->obj);
--	if (qxl_fb != qdev->active_user_framebuffer) {
--		DRM_INFO("%s: qxl_fb 0x%p != qdev->active_user_framebuffer 0x%p\n",
--			__func__, qxl_fb, qdev->active_user_framebuffer);
--	}
-+	/* if we aren't primary surface ignore this */
-+	if (!qobj->is_primary)
-+		return 0;
-+
- 	if (!num_clips) {
- 		num_clips = 1;
- 		clips = &norect;
-@@ -604,7 +604,6 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
- 					       mode->hdisplay,
- 					       mode->vdisplay);
- 	}
--	qdev->mode_set = true;
- 	return 0;
- }
- 
-@@ -893,7 +892,6 @@ qxl_user_framebuffer_create(struct drm_device *dev,
- {
- 	struct drm_gem_object *obj;
- 	struct qxl_framebuffer *qxl_fb;
--	struct qxl_device *qdev = dev->dev_private;
- 	int ret;
- 
- 	obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handles[0]);
-@@ -909,13 +907,6 @@ qxl_user_framebuffer_create(struct drm_device *dev,
- 		return NULL;
- 	}
- 
--	if (qdev->active_user_framebuffer) {
--		DRM_INFO("%s: active_user_framebuffer %p -> %p\n",
--			 __func__,
--			 qdev->active_user_framebuffer, qxl_fb);
--	}
--	qdev->active_user_framebuffer = qxl_fb;
--
- 	return &qxl_fb->base;
- }
- 
-diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
-index 52b582c..43d06ab 100644
---- a/drivers/gpu/drm/qxl/qxl_drv.h
-+++ b/drivers/gpu/drm/qxl/qxl_drv.h
-@@ -255,12 +255,6 @@ struct qxl_device {
- 	struct qxl_gem		gem;
- 	struct qxl_mode_info mode_info;
- 
--	/*
--	 * last created framebuffer with fb_create
--	 * only used by debugfs dumbppm
--	 */
--	struct qxl_framebuffer *active_user_framebuffer;
--
- 	struct fb_info			*fbdev_info;
- 	struct qxl_framebuffer	*fbdev_qfb;
- 	void *ram_physical;
-@@ -270,7 +264,6 @@ struct qxl_device {
- 	struct qxl_ring *cursor_ring;
- 
- 	struct qxl_ram_header *ram_header;
--	bool mode_set;
- 
- 	bool primary_created;
- 
-diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
-index 04b64f9..6db7370 100644
---- a/drivers/gpu/drm/qxl/qxl_ioctl.c
-+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
-@@ -294,6 +294,7 @@ static int qxl_update_area_ioctl(struct drm_device *dev, void *data,
- 		goto out;
- 
- 	if (!qobj->pin_count) {
-+		qxl_ttm_placement_from_domain(qobj, qobj->type);
- 		ret = ttm_bo_validate(&qobj->tbo, &qobj->placement,
- 				      true, false);
- 		if (unlikely(ret))
diff --git a/freed-ora/current/f19/drm-qxl-post-3.10-feature-fixes.patch b/freed-ora/current/f19/drm-qxl-post-3.10-feature-fixes.patch
new file mode 100644
index 000000000..cf747c4b2
--- /dev/null
+++ b/freed-ora/current/f19/drm-qxl-post-3.10-feature-fixes.patch
@@ -0,0 +1,517 @@
+From cd402bae4566410f38780e1ce94248b92c3403c0 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Mon, 1 Jul 2013 14:14:38 +1000
+Subject: [PATCH 5/5] drm/qxl: post 3.10 feature fixes
+
+drm/qxl: make dynamic resizing work properly.
+drm/qxl: add support for cursor hotspot.
+drm/qxl: add support for > 1 output
+drm/qxl: set time on drawables from userspace
+---
+ drivers/gpu/drm/qxl/qxl_cmd.c     |   8 +-
+ drivers/gpu/drm/qxl/qxl_display.c | 187 ++++++++++++++++----------------------
+ drivers/gpu/drm/qxl/qxl_drv.c     |   4 +
+ drivers/gpu/drm/qxl/qxl_drv.h     |   8 +-
+ drivers/gpu/drm/qxl/qxl_fb.c      |   2 +-
+ drivers/gpu/drm/qxl/qxl_ioctl.c   |   6 ++
+ 6 files changed, 98 insertions(+), 117 deletions(-)
+
+diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
+index 02befd9..0ec55e7 100644
+--- a/drivers/gpu/drm/qxl/qxl_cmd.c
++++ b/drivers/gpu/drm/qxl/qxl_cmd.c
+@@ -375,8 +375,8 @@ void qxl_io_destroy_primary(struct qxl_device *qdev)
+ 	wait_for_io_cmd(qdev, 0, QXL_IO_DESTROY_PRIMARY_ASYNC);
+ }
+ 
+-void qxl_io_create_primary(struct qxl_device *qdev, unsigned width,
+-			   unsigned height, unsigned offset, struct qxl_bo *bo)
++void qxl_io_create_primary(struct qxl_device *qdev,
++			   unsigned offset, struct qxl_bo *bo)
+ {
+ 	struct qxl_surface_create *create;
+ 
+@@ -384,8 +384,8 @@ void qxl_io_create_primary(struct qxl_device *qdev, unsigned width,
+ 		 qdev->ram_header);
+ 	create = &qdev->ram_header->create_surface;
+ 	create->format = bo->surf.format;
+-	create->width = width;
+-	create->height = height;
++	create->width = bo->surf.width;
++	create->height = bo->surf.height;
+ 	create->stride = bo->surf.stride;
+ 	create->mem = qxl_bo_physical_address(qdev, bo, offset);
+ 
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
+index 823d29e..a127a97 100644
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -30,53 +30,9 @@
+ #include "qxl_object.h"
+ #include "drm_crtc_helper.h"
+ 
+-static void qxl_crtc_set_to_mode(struct qxl_device *qdev,
+-				 struct drm_connector *connector,
+-				 struct qxl_head *head)
++static bool qxl_head_enabled(struct qxl_head *head)
+ {
+-	struct drm_device *dev = connector->dev;
+-	struct drm_display_mode *mode, *t;
+-	int width = head->width;
+-	int height = head->height;
+-
+-	if (width < 320 || height < 240) {
+-		qxl_io_log(qdev, "%s: bad head: %dx%d", width, height);
+-		width = 1024;
+-		height = 768;
+-	}
+-	if (width * height * 4 > 16*1024*1024) {
+-		width = 1024;
+-		height = 768;
+-	}
+-	/* TODO: go over regular modes and removed preferred? */
+-	list_for_each_entry_safe(mode, t, &connector->probed_modes, head)
+-		drm_mode_remove(connector, mode);
+-	mode = drm_cvt_mode(dev, width, height, 60, false, false, false);
+-	mode->type |= DRM_MODE_TYPE_PREFERRED;
+-	mode->status = MODE_OK;
+-	drm_mode_probed_add(connector, mode);
+-	qxl_io_log(qdev, "%s: %d x %d\n", __func__, width, height);
+-}
+-
+-void qxl_crtc_set_from_monitors_config(struct qxl_device *qdev)
+-{
+-	struct drm_connector *connector;
+-	int i;
+-	struct drm_device *dev = qdev->ddev;
+-
+-	i = 0;
+-	qxl_io_log(qdev, "%s: %d, %d\n", __func__,
+-		   dev->mode_config.num_connector,
+-		   qdev->monitors_config->count);
+-	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+-		if (i > qdev->monitors_config->count) {
+-			/* crtc will be reported as disabled */
+-			continue;
+-		}
+-		qxl_crtc_set_to_mode(qdev, connector,
+-				     &qdev->monitors_config->heads[i]);
+-		++i;
+-	}
++	return head->width && head->height;
+ }
+ 
+ void qxl_alloc_client_monitors_config(struct qxl_device *qdev, unsigned count)
+@@ -106,7 +62,6 @@ static int qxl_display_copy_rom_client_monitors_config(struct qxl_device *qdev)
+ 	int num_monitors;
+ 	uint32_t crc;
+ 
+-	BUG_ON(!qdev->monitors_config);
+ 	num_monitors = qdev->rom->client_monitors_config.count;
+ 	crc = crc32(0, (const uint8_t *)&qdev->rom->client_monitors_config,
+ 		  sizeof(qdev->rom->client_monitors_config));
+@@ -117,8 +72,8 @@ static int qxl_display_copy_rom_client_monitors_config(struct qxl_device *qdev)
+ 		return 1;
+ 	}
+ 	if (num_monitors > qdev->monitors_config->max_allowed) {
+-		DRM_INFO("client monitors list will be truncated: %d < %d\n",
+-			 qdev->monitors_config->max_allowed, num_monitors);
++		DRM_DEBUG_KMS("client monitors list will be truncated: %d < %d\n",
++			      qdev->monitors_config->max_allowed, num_monitors);
+ 		num_monitors = qdev->monitors_config->max_allowed;
+ 	} else {
+ 		num_monitors = qdev->rom->client_monitors_config.count;
+@@ -132,18 +87,15 @@ static int qxl_display_copy_rom_client_monitors_config(struct qxl_device *qdev)
+ 			&qdev->rom->client_monitors_config.heads[i];
+ 		struct qxl_head *client_head =
+ 			&qdev->client_monitors_config->heads[i];
+-		struct qxl_head *head = &qdev->monitors_config->heads[i];
+-		client_head->x = head->x = c_rect->left;
+-		client_head->y = head->y = c_rect->top;
+-		client_head->width = head->width =
+-						c_rect->right - c_rect->left;
+-		client_head->height = head->height =
+-						c_rect->bottom - c_rect->top;
+-		client_head->surface_id = head->surface_id = 0;
+-		client_head->id = head->id = i;
+-		client_head->flags = head->flags = 0;
+-		QXL_DEBUG(qdev, "read %dx%d+%d+%d\n", head->width, head->height,
+-			  head->x, head->y);
++		client_head->x = c_rect->left;
++		client_head->y = c_rect->top;
++		client_head->width = c_rect->right - c_rect->left;
++		client_head->height = c_rect->bottom - c_rect->top;
++		client_head->surface_id = 0;
++		client_head->id = i;
++		client_head->flags = 0;
++		DRM_DEBUG_KMS("read %dx%d+%d+%d\n", client_head->width, client_head->height,
++			  client_head->x, client_head->y);
+ 	}
+ 	return 0;
+ }
+@@ -155,9 +107,6 @@ void qxl_display_read_client_monitors_config(struct qxl_device *qdev)
+ 		qxl_io_log(qdev, "failed crc check for client_monitors_config,"
+ 				 " retrying\n");
+ 	}
+-	qxl_crtc_set_from_monitors_config(qdev);
+-	/* fire off a uevent and let userspace tell us what to do */
+-	qxl_io_log(qdev, "calling drm_sysfs_hotplug_event\n");
+ 	drm_sysfs_hotplug_event(qdev->ddev);
+ }
+ 
+@@ -170,9 +119,9 @@ static int qxl_add_monitors_config_modes(struct drm_connector *connector)
+ 	struct drm_display_mode *mode = NULL;
+ 	struct qxl_head *head;
+ 
+-	if (!qdev->monitors_config)
++	if (!qdev->client_monitors_config)
+ 		return 0;
+-	head = &qdev->monitors_config->heads[h];
++	head = &qdev->client_monitors_config->heads[h];
+ 
+ 	mode = drm_cvt_mode(dev, head->width, head->height, 60, false, false,
+ 			    false);
+@@ -255,11 +204,11 @@ qxl_hide_cursor(struct qxl_device *qdev)
+ 	qxl_release_unreserve(qdev, release);
+ }
+ 
+-static int qxl_crtc_cursor_set(struct drm_crtc *crtc,
+-			       struct drm_file *file_priv,
+-			       uint32_t handle,
+-			       uint32_t width,
+-			       uint32_t height)
++static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
++				struct drm_file *file_priv,
++				uint32_t handle,
++				uint32_t width,
++				uint32_t height, int32_t hot_x, int32_t hot_y)
+ {
+ 	struct drm_device *dev = crtc->dev;
+ 	struct qxl_device *qdev = dev->dev_private;
+@@ -315,8 +264,8 @@ static int qxl_crtc_cursor_set(struct drm_crtc *crtc,
+ 	cursor->header.type = SPICE_CURSOR_TYPE_ALPHA;
+ 	cursor->header.width = 64;
+ 	cursor->header.height = 64;
+-	cursor->header.hot_spot_x = 0;
+-	cursor->header.hot_spot_y = 0;
++	cursor->header.hot_spot_x = hot_x;
++	cursor->header.hot_spot_y = hot_y;
+ 	cursor->data_size = size;
+ 	cursor->chunk.next_chunk = 0;
+ 	cursor->chunk.prev_chunk = 0;
+@@ -397,7 +346,7 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc,
+ 
+ 
+ static const struct drm_crtc_funcs qxl_crtc_funcs = {
+-	.cursor_set = qxl_crtc_cursor_set,
++	.cursor_set2 = qxl_crtc_cursor_set2,
+ 	.cursor_move = qxl_crtc_cursor_move,
+ 	.gamma_set = qxl_crtc_gamma_set,
+ 	.set_config = drm_crtc_helper_set_config,
+@@ -506,7 +455,7 @@ qxl_send_monitors_config(struct qxl_device *qdev)
+ 	for (i = 0 ; i < qdev->monitors_config->count ; ++i) {
+ 		struct qxl_head *head = &qdev->monitors_config->heads[i];
+ 
+-		if (head->y > 8192 || head->y < head->x ||
++		if (head->y > 8192 || head->x > 8192 ||
+ 		    head->width > 8192 || head->height > 8192) {
+ 			DRM_ERROR("head %d wrong: %dx%d+%d+%d\n",
+ 				  i, head->width, head->height,
+@@ -517,16 +466,19 @@ qxl_send_monitors_config(struct qxl_device *qdev)
+ 	qxl_io_monitors_config(qdev);
+ }
+ 
+-static void qxl_monitors_config_set_single(struct qxl_device *qdev,
+-					   unsigned x, unsigned y,
+-					   unsigned width, unsigned height)
++static void qxl_monitors_config_set(struct qxl_device *qdev,
++				    int index,
++				    unsigned x, unsigned y,
++				    unsigned width, unsigned height,
++				    unsigned surf_id)
+ {
+-	DRM_DEBUG("%dx%d+%d+%d\n", width, height, x, y);
+-	qdev->monitors_config->count = 1;
+-	qdev->monitors_config->heads[0].x = x;
+-	qdev->monitors_config->heads[0].y = y;
+-	qdev->monitors_config->heads[0].width = width;
+-	qdev->monitors_config->heads[0].height = height;
++	DRM_DEBUG_KMS("%d:%dx%d+%d+%d\n", index, width, height, x, y);
++	qdev->monitors_config->heads[index].x = x;
++	qdev->monitors_config->heads[index].y = y;
++	qdev->monitors_config->heads[index].width = width;
++	qdev->monitors_config->heads[index].height = height;
++	qdev->monitors_config->heads[index].surface_id = surf_id;
++
+ }
+ 
+ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
+@@ -540,10 +492,11 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
+ 	struct qxl_mode *m = (void *)mode->private;
+ 	struct qxl_framebuffer *qfb;
+ 	struct qxl_bo *bo, *old_bo = NULL;
++	struct qxl_crtc *qcrtc = to_qxl_crtc(crtc);
+ 	uint32_t width, height, base_offset;
+ 	bool recreate_primary = false;
+ 	int ret;
+-
++	int surf_id;
+ 	if (!crtc->fb) {
+ 		DRM_DEBUG_KMS("No FB bound\n");
+ 		return 0;
+@@ -567,7 +520,8 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
+ 		  adjusted_mode->hdisplay,
+ 		  adjusted_mode->vdisplay);
+ 
+-	recreate_primary = true;
++	if (qcrtc->index == 0)
++		recreate_primary = true;
+ 
+ 	width = mode->hdisplay;
+ 	height = mode->vdisplay;
+@@ -588,8 +542,11 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
+ 			   "recreate primary: %dx%d (was %dx%d,%d,%d)\n",
+ 			   width, height, bo->surf.width,
+ 			   bo->surf.height, bo->surf.stride, bo->surf.format);
+-		qxl_io_create_primary(qdev, width, height, base_offset, bo);
++		qxl_io_create_primary(qdev, base_offset, bo);
+ 		bo->is_primary = true;
++		surf_id = 0;
++	} else {
++		surf_id = bo->surface_id;
+ 	}
+ 
+ 	if (old_bo && old_bo != bo) {
+@@ -599,11 +556,9 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
+ 		qxl_bo_unreserve(old_bo);
+ 	}
+ 
+-	if (qdev->monitors_config->count == 0) {
+-		qxl_monitors_config_set_single(qdev, x, y,
+-					       mode->hdisplay,
+-					       mode->vdisplay);
+-	}
++	qxl_monitors_config_set(qdev, qcrtc->index, x, y,
++				mode->hdisplay,
++				mode->vdisplay, surf_id);
+ 	return 0;
+ }
+ 
+@@ -619,6 +574,26 @@ static void qxl_crtc_commit(struct drm_crtc *crtc)
+ 	DRM_DEBUG("\n");
+ }
+ 
++static void qxl_crtc_disable(struct drm_crtc *crtc)
++{
++	struct qxl_crtc *qcrtc = to_qxl_crtc(crtc);
++	struct drm_device *dev = crtc->dev;
++	struct qxl_device *qdev = dev->dev_private;
++	if (crtc->fb) {
++		struct qxl_framebuffer *qfb = to_qxl_framebuffer(crtc->fb);
++		struct qxl_bo *bo = gem_to_qxl_bo(qfb->obj);
++		int ret;
++		ret = qxl_bo_reserve(bo, false);
++		qxl_bo_unpin(bo);
++		qxl_bo_unreserve(bo);
++		crtc->fb = NULL;
++	}
++
++	qxl_monitors_config_set(qdev, qcrtc->index, 0, 0, 0, 0, 0);
++
++	qxl_send_monitors_config(qdev);
++}
++
+ static void qxl_crtc_load_lut(struct drm_crtc *crtc)
+ {
+ 	DRM_DEBUG("\n");
+@@ -626,6 +601,7 @@ static void qxl_crtc_load_lut(struct drm_crtc *crtc)
+ 
+ static const struct drm_crtc_helper_funcs qxl_crtc_helper_funcs = {
+ 	.dpms = qxl_crtc_dpms,
++	.disable = qxl_crtc_disable,
+ 	.mode_fixup = qxl_crtc_mode_fixup,
+ 	.mode_set = qxl_crtc_mode_set,
+ 	.prepare = qxl_crtc_prepare,
+@@ -633,7 +609,7 @@ static const struct drm_crtc_helper_funcs qxl_crtc_helper_funcs = {
+ 	.load_lut = qxl_crtc_load_lut,
+ };
+ 
+-static int qdev_crtc_init(struct drm_device *dev, int num_crtc)
++static int qdev_crtc_init(struct drm_device *dev, int crtc_id)
+ {
+ 	struct qxl_crtc *qxl_crtc;
+ 
+@@ -642,7 +618,7 @@ static int qdev_crtc_init(struct drm_device *dev, int num_crtc)
+ 		return -ENOMEM;
+ 
+ 	drm_crtc_init(dev, &qxl_crtc->base, &qxl_crtc_funcs);
+-
++	qxl_crtc->index = crtc_id;
+ 	drm_mode_crtc_set_gamma_size(&qxl_crtc->base, 256);
+ 	drm_crtc_helper_add(&qxl_crtc->base, &qxl_crtc_helper_funcs);
+ 	return 0;
+@@ -670,18 +646,13 @@ static void qxl_write_monitors_config_for_encoder(struct qxl_device *qdev,
+ 		struct drm_encoder *encoder)
+ {
+ 	int i;
++	struct qxl_output *output = drm_encoder_to_qxl_output(encoder);
+ 	struct qxl_head *head;
+ 	struct drm_display_mode *mode;
+ 
+ 	BUG_ON(!encoder);
+ 	/* TODO: ugly, do better */
+-	for (i = 0 ; (encoder->possible_crtcs != (1 << i)) && i < 32; ++i)
+-		;
+-	if (encoder->possible_crtcs != (1 << i)) {
+-		DRM_ERROR("encoder has wrong possible_crtcs: %x\n",
+-			  encoder->possible_crtcs);
+-		return;
+-	}
++	i = output->index;
+ 	if (!qdev->monitors_config ||
+ 	    qdev->monitors_config->max_allowed <= i) {
+ 		DRM_ERROR(
+@@ -699,7 +670,6 @@ static void qxl_write_monitors_config_for_encoder(struct qxl_device *qdev,
+ 		DRM_DEBUG("missing for multiple monitors: no head holes\n");
+ 	head = &qdev->monitors_config->heads[i];
+ 	head->id = i;
+-	head->surface_id = 0;
+ 	if (encoder->crtc->enabled) {
+ 		mode = &encoder->crtc->mode;
+ 		head->width = mode->hdisplay;
+@@ -714,8 +684,8 @@ static void qxl_write_monitors_config_for_encoder(struct qxl_device *qdev,
+ 		head->x = 0;
+ 		head->y = 0;
+ 	}
+-	DRM_DEBUG("setting head %d to +%d+%d %dx%d\n",
+-		  i, head->x, head->y, head->width, head->height);
++	DRM_DEBUG_KMS("setting head %d to +%d+%d %dx%d out of %d\n",
++		      i, head->x, head->y, head->width, head->height, qdev->monitors_config->count);
+ 	head->flags = 0;
+ 	/* TODO - somewhere else to call this for multiple monitors
+ 	 * (config_commit?) */
+@@ -810,8 +780,9 @@ static enum drm_connector_status qxl_conn_detect(
+ 
+ 	/* The first monitor is always connected */
+ 	connected = (output->index == 0) ||
+-		    (qdev->monitors_config &&
+-		     qdev->monitors_config->count > output->index);
++		    (qdev->client_monitors_config &&
++		     qdev->client_monitors_config->count > output->index &&
++		     qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]));
+ 
+ 	DRM_DEBUG("\n");
+ 	return connected ? connector_status_connected
+@@ -919,7 +890,7 @@ int qxl_modeset_init(struct qxl_device *qdev)
+ 	int i;
+ 	int ret;
+ 	struct drm_gem_object *gobj;
+-	int max_allowed = QXL_NUM_OUTPUTS;
++	int max_allowed = qxl_num_crtc;
+ 	int monitors_config_size = sizeof(struct qxl_monitors_config) +
+ 				   max_allowed * sizeof(struct qxl_head);
+ 
+@@ -949,7 +920,7 @@ int qxl_modeset_init(struct qxl_device *qdev)
+ 	qdev->ddev->mode_config.max_height = 8192;
+ 
+ 	qdev->ddev->mode_config.fb_base = qdev->vram_base;
+-	for (i = 0 ; i < QXL_NUM_OUTPUTS; ++i) {
++	for (i = 0 ; i < qxl_num_crtc; ++i) {
+ 		qdev_crtc_init(qdev->ddev, i);
+ 		qdev_output_init(qdev->ddev, i);
+ 	}
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
+index aa291d8..00e57b76 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.c
++++ b/drivers/gpu/drm/qxl/qxl_drv.c
+@@ -47,10 +47,14 @@ static DEFINE_PCI_DEVICE_TABLE(pciidlist) = {
+ MODULE_DEVICE_TABLE(pci, pciidlist);
+ 
+ static int qxl_modeset = -1;
++int qxl_num_crtc = 4;
+ 
+ MODULE_PARM_DESC(modeset, "Disable/Enable modesetting");
+ module_param_named(modeset, qxl_modeset, int, 0400);
+ 
++MODULE_PARM_DESC(num_heads, "Number of virtual crtcs to expose (default 4)");
++module_param_named(num_heads, qxl_num_crtc, int, 0400);
++
+ static struct drm_driver qxl_driver;
+ static struct pci_driver qxl_pci_driver;
+ 
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
+index 43d06ab..42ef0e2 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -55,11 +55,10 @@
+ #define DRIVER_MINOR 1
+ #define DRIVER_PATCHLEVEL 0
+ 
+-#define QXL_NUM_OUTPUTS 1
+-
+ #define QXL_DEBUGFS_MAX_COMPONENTS		32
+ 
+ extern int qxl_log_level;
++extern int qxl_num_crtc;
+ 
+ enum {
+ 	QXL_INFO_LEVEL = 1,
+@@ -139,6 +138,7 @@ struct qxl_reloc_list {
+ 
+ struct qxl_crtc {
+ 	struct drm_crtc base;
++	int index;
+ 	int cur_x;
+ 	int cur_y;
+ };
+@@ -156,7 +156,7 @@ struct qxl_framebuffer {
+ 
+ #define to_qxl_crtc(x) container_of(x, struct qxl_crtc, base)
+ #define drm_connector_to_qxl_output(x) container_of(x, struct qxl_output, base)
+-#define drm_encoder_to_qxl_output(x) container_of(x, struct qxl_output, base)
++#define drm_encoder_to_qxl_output(x) container_of(x, struct qxl_output, enc)
+ #define to_qxl_framebuffer(x) container_of(x, struct qxl_framebuffer, base)
+ 
+ struct qxl_mman {
+@@ -435,7 +435,7 @@ void qxl_update_screen(struct qxl_device *qxl);
+ /* qxl io operations (qxl_cmd.c) */
+ 
+ void qxl_io_create_primary(struct qxl_device *qdev,
+-			   unsigned width, unsigned height, unsigned offset,
++			   unsigned offset,
+ 			   struct qxl_bo *bo);
+ void qxl_io_destroy_primary(struct qxl_device *qdev);
+ void qxl_io_memslot_add(struct qxl_device *qdev, uint8_t id);
+diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
+index b3c5127..11ef7cb 100644
+--- a/drivers/gpu/drm/qxl/qxl_fb.c
++++ b/drivers/gpu/drm/qxl/qxl_fb.c
+@@ -542,7 +542,7 @@ int qxl_fbdev_init(struct qxl_device *qdev)
+ 	qfbdev->helper.funcs = &qxl_fb_helper_funcs;
+ 
+ 	ret = drm_fb_helper_init(qdev->ddev, &qfbdev->helper,
+-				 1 /* num_crtc - QXL supports just 1 */,
++				 qxl_num_crtc /* num_crtc - QXL supports just 1 */,
+ 				 QXLFB_CONN_LIMIT);
+ 	if (ret) {
+ 		kfree(qfbdev);
+diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
+index a4b71b2..6ba49d9 100644
+--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
+@@ -183,6 +183,12 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
+ 		/* TODO copy slow path code from i915 */
+ 		fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
+ 		unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void *)(unsigned long)user_cmd.command, user_cmd.command_size);
++
++		{
++			struct qxl_drawable *draw = fb_cmd;
++
++			draw->mm_time = qdev->rom->mm_clock;
++		}
+ 		qxl_bo_kunmap_atomic_page(qdev, cmd_bo, fb_cmd);
+ 		if (unwritten) {
+ 			DRM_ERROR("got unwritten %d\n", unwritten);
+-- 
+1.8.3.1
+
diff --git a/freed-ora/current/f19/iwl3945-better-skb-management-in-rx-path.patch b/freed-ora/current/f19/iwl3945-better-skb-management-in-rx-path.patch
new file mode 100644
index 000000000..5d85af7d4
--- /dev/null
+++ b/freed-ora/current/f19/iwl3945-better-skb-management-in-rx-path.patch
@@ -0,0 +1,97 @@
+From: Eric Dumazet <edumazet@google.com>
+
+Steinar reported reallocations of skb->head with IPv6, leading to
+a warning in skb_try_coalesce()
+
+It turns out iwl3945 has several problems :
+
+1) skb->truesize is underestimated. 
+   We really consume PAGE_SIZE bytes for a fragment,
+   not the frame length.
+2) 128 bytes of initial headroom is a bit low and forces reallocations.
+3) We can avoid consuming a full page for small enough frames.
+
+Reported-by: Steinar H. Gunderson <sesse@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Paul Stewart <pstew@google.com>
+---
+v3: use regular memcpy(skb_put(...),...)
+v2: SMALL_PACKET_SIZE define
+
+ drivers/net/wireless/iwlegacy/3945.c |   31 +++++++++++++++----------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
+index c092033..f09e257 100644
+--- a/drivers/net/wireless/iwlegacy/3945.c
++++ b/drivers/net/wireless/iwlegacy/3945.c
+@@ -475,6 +475,8 @@ il3945_is_network_packet(struct il_priv *il, struct ieee80211_hdr *header)
+ 	}
+ }
+ 
++#define SMALL_PACKET_SIZE 256
++
+ static void
+ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb,
+ 			       struct ieee80211_rx_status *stats)
+@@ -483,14 +485,13 @@ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb,
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)IL_RX_DATA(pkt);
+ 	struct il3945_rx_frame_hdr *rx_hdr = IL_RX_HDR(pkt);
+ 	struct il3945_rx_frame_end *rx_end = IL_RX_END(pkt);
+-	u16 len = le16_to_cpu(rx_hdr->len);
++	u32 len = le16_to_cpu(rx_hdr->len);
+ 	struct sk_buff *skb;
+ 	__le16 fc = hdr->frame_control;
++	u32 fraglen = PAGE_SIZE << il->hw_params.rx_page_order;
+ 
+ 	/* We received data from the HW, so stop the watchdog */
+-	if (unlikely
+-	    (len + IL39_RX_FRAME_SIZE >
+-	     PAGE_SIZE << il->hw_params.rx_page_order)) {
++	if (unlikely(len + IL39_RX_FRAME_SIZE > fraglen)) {
+ 		D_DROP("Corruption detected!\n");
+ 		return;
+ 	}
+@@ -506,26 +507,32 @@ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb,
+ 		D_INFO("Woke queues - frame received on passive channel\n");
+ 	}
+ 
+-	skb = dev_alloc_skb(128);
++	skb = dev_alloc_skb(SMALL_PACKET_SIZE);
+ 	if (!skb) {
+ 		IL_ERR("dev_alloc_skb failed\n");
+ 		return;
+ 	}
+ 
+ 	if (!il3945_mod_params.sw_crypto)
+-		il_set_decrypted_flag(il, (struct ieee80211_hdr *)rxb_addr(rxb),
++		il_set_decrypted_flag(il, (struct ieee80211_hdr *)pkt,
+ 				      le32_to_cpu(rx_end->status), stats);
+ 
+-	skb_add_rx_frag(skb, 0, rxb->page,
+-			(void *)rx_hdr->payload - (void *)pkt, len,
+-			len);
+-
++	/* If frame is small enough to fit into skb->head, copy it
++	 * and do not consume a full page
++	 */
++	if (len <= SMALL_PACKET_SIZE) {
++		memcpy(skb_put(skb, len), rx_hdr->payload, len);
++	} else {
++		skb_add_rx_frag(skb, 0, rxb->page,
++				(void *)rx_hdr->payload - (void *)pkt, len,
++				fraglen);
++		il->alloc_rxb_page--;
++		rxb->page = NULL;
++	}
+ 	il_update_stats(il, false, fc, len);
+ 	memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
+ 
+ 	ieee80211_rx(il->hw, skb);
+-	il->alloc_rxb_page--;
+-	rxb->page = NULL;
+ }
+ 
+ #define IL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
+
+
diff --git a/freed-ora/current/f19/iwl4965-better-skb-management-in-rx-path.patch b/freed-ora/current/f19/iwl4965-better-skb-management-in-rx-path.patch
new file mode 100644
index 000000000..904ff04f6
--- /dev/null
+++ b/freed-ora/current/f19/iwl4965-better-skb-management-in-rx-path.patch
@@ -0,0 +1,65 @@
+4965 version of Eric patch "iwl3945: better skb management in rx path".
+It fixes several problems :
+
+1) skb->truesize is underestimated.
+   We really consume PAGE_SIZE bytes for a fragment,
+   not the frame length.
+2) 128 bytes of initial headroom is a bit low and forces reallocations.
+3) We can avoid consuming a full page for small enough frames.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/iwlegacy/4965-mac.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
+index d287fd2..4e5d408 100644
+--- a/drivers/net/wireless/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/iwlegacy/4965-mac.c
+@@ -574,9 +574,11 @@ il4965_translate_rx_status(struct il_priv *il, u32 decrypt_in)
+ 	return decrypt_out;
+ }
+ 
++#define SMALL_PACKET_SIZE 256
++
+ static void
+ il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr,
+-			       u16 len, u32 ampdu_status, struct il_rx_buf *rxb,
++			       u32 len, u32 ampdu_status, struct il_rx_buf *rxb,
+ 			       struct ieee80211_rx_status *stats)
+ {
+ 	struct sk_buff *skb;
+@@ -598,21 +600,25 @@ il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr,
+ 	    il_set_decrypted_flag(il, hdr, ampdu_status, stats))
+ 		return;
+ 
+-	skb = dev_alloc_skb(128);
++	skb = dev_alloc_skb(SMALL_PACKET_SIZE);
+ 	if (!skb) {
+ 		IL_ERR("dev_alloc_skb failed\n");
+ 		return;
+ 	}
+ 
+-	skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len,
+-			len);
++	if (len <= SMALL_PACKET_SIZE) {
++		memcpy(skb_put(skb, len), hdr, len);
++	} else {
++		skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb),
++				len, PAGE_SIZE << il->hw_params.rx_page_order);
++		il->alloc_rxb_page--;
++		rxb->page = NULL;
++	}
+ 
+ 	il_update_stats(il, false, fc, len);
+ 	memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
+ 
+ 	ieee80211_rx(il->hw, skb);
+-	il->alloc_rxb_page--;
+-	rxb->page = NULL;
+ }
+ 
+ /* Called for N_RX (legacy ABG frames), or
+-- 
+1.7.11.7
+
diff --git a/freed-ora/current/f19/kernel.spec b/freed-ora/current/f19/kernel.spec
index 3f848abc2..c1c8543d6 100644
--- a/freed-ora/current/f19/kernel.spec
+++ b/freed-ora/current/f19/kernel.spec
@@ -112,7 +112,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 8
+%define stable_update 9
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -731,8 +731,11 @@ Patch1000: devel-pekey-secure-boot-20130306.patch
 #atch1700: drm-edid-try-harder-to-fix-up-broken-headers.patch
 #Patch1800: drm-vgem.patch
 Patch1700: drm-ttm-exports-for-qxl.patch
-Patch1701: drm-qxl-driver.patch
-Patch1702: drm-qxl-backport-fixes.patch
+Patch1701: drm-hotspot-cursor-backport.patch
+Patch1702: drm-qxl-driver.patch
+Patch1703: drm-qxl-3.10-rc7-diff.patch
+Patch1704: drm-qxl-access-fix.patch
+Patch1705: drm-qxl-post-3.10-feature-fixes.patch
 # nouveau + drm fixes
 # intel drm is all merged upstream
 Patch1824: drm-intel-next.patch
@@ -838,9 +841,6 @@ Patch25038: cdrom-use-kzalloc-for-failing-hardware.patch
 Patch25043: vfio-Set-container-device-mode.patch
 Patch25044: vfio-fix-crash-on-rmmod.patch
 
-#rhbz 950735
-Patch25045: rt2800-fix-RT5390-RT3290-TX-power-settings-regression.patch
-
 #rhbz 969644
 Patch25046: KVM-x86-handle-idiv-overflow-at-kvm_write_tsc.patch
 
@@ -862,6 +862,10 @@ Patch25054: bridge-send-query-as-soon-as-leave-is-received.patch
 #rhbz 977558
 Patch25055: ath3k-dont-use-stack-memory-for-DMA.patch
 
+#rhbz 977040
+Patch25056: iwl3945-better-skb-management-in-rx-path.patch
+Patch25057: iwl4965-better-skb-management-in-rx-path.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1564,8 +1568,11 @@ ApplyPatch devel-pekey-secure-boot-20130306.patch
 
 # DRM core
 ApplyPatch drm-ttm-exports-for-qxl.patch
+ApplyPatch drm-hotspot-cursor-backport.patch
 ApplyPatch drm-qxl-driver.patch
-ApplyPatch drm-qxl-backport-fixes.patch
+ApplyPatch drm-qxl-3.10-rc7-diff.patch
+ApplyPatch drm-qxl-access-fix.patch
+ApplyPatch drm-qxl-post-3.10-feature-fixes.patch
 #ApplyPatch drm-edid-try-harder-to-fix-up-broken-headers.patch
 #ApplyPatch drm-vgem.patch
 
@@ -1656,9 +1663,6 @@ ApplyPatch cdrom-use-kzalloc-for-failing-hardware.patch
 ApplyPatch vfio-Set-container-device-mode.patch
 ApplyPatch vfio-fix-crash-on-rmmod.patch
 
-#rhbz 950735
-ApplyPatch rt2800-fix-RT5390-RT3290-TX-power-settings-regression.patch
-
 #rhbz 969644
 ApplyPatch KVM-x86-handle-idiv-overflow-at-kvm_write_tsc.patch
 
@@ -1680,6 +1684,10 @@ ApplyPatch bridge-send-query-as-soon-as-leave-is-received.patch
 #rhbz 977558
 ApplyPatch ath3k-dont-use-stack-memory-for-DMA.patch
 
+#rhbz 977040
+ApplyPatch iwl3945-better-skb-management-in-rx-path.patch
+ApplyPatch iwl4965-better-skb-management-in-rx-path.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2507,6 +2515,28 @@ fi
 # and build.
 
 %changelog
+* Sun Jul  7 2013 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 3.9.9-gnu.
+
+* Wed Jul 03 2013 Justin M. Forbes <jforbes@redhat.com> 3.9.9-300
+- Linux v3.9.9
+
+* Wed Jul 03 2013 Josh Boyer <jwboyer@redhat.com>
+- Add patches to fix iwl skb managment (rhbz 977040)
+
+* Wed Jul 03 2013 Dave Airlie <airlied@redhat.com>
+- fixup QXL driver patches to make it easier to rebase
+- add qxl driver dynamic resize + multiple heads support
+
+* Mon Jul 01 2013 Dave Airlie <airlied@redhat.com>
+- kernel portion of qxl cursor and dynamic resize fixes.
+
+* Fri Jun 28 2013 Peter Robinson <pbrobinson@fedoraproject.org>
+- Only enable ARM A15 errata on the LPAE kernel as it breaks A8
+
+* Fri Jun 28 2013 Dave Airlie <airlied@redhat.com> 
+- add qxl fix for missing access ok macro.
+
 * Fri Jun 28 2013 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 3.9.8-gnu.
 
diff --git a/freed-ora/current/f19/patch-3.9-gnu-3.9.8-gnu.xz.sign b/freed-ora/current/f19/patch-3.9-gnu-3.9.8-gnu.xz.sign
deleted file mode 100644
index b85172723..000000000
--- a/freed-ora/current/f19/patch-3.9-gnu-3.9.8-gnu.xz.sign
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.19 (GNU/Linux)
-
-iEYEABECAAYFAlHMsw8ACgkQvLfPh359R6d5DACeMzKKqKcj07T9pw+anQIE70bE
-n/oAn2iZLRxkWag5FtJlfxZqQ0sgV0qh
-=miKX
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f19/patch-3.9-gnu-3.9.9-gnu.xz.sign b/freed-ora/current/f19/patch-3.9-gnu-3.9.9-gnu.xz.sign
new file mode 100644
index 000000000..44bf22e97
--- /dev/null
+++ b/freed-ora/current/f19/patch-3.9-gnu-3.9.9-gnu.xz.sign
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.19 (GNU/Linux)
+
+iEYEABECAAYFAlHWNawACgkQvLfPh359R6ecywCgolrCHDKIP0XXRIdqbgJ9eSMW
+lbUAn1PTs9cmfcQBlStJn7qWVmpNX8u3
+=8pW9
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f19/rt2800-fix-RT5390-RT3290-TX-power-settings-regression.patch b/freed-ora/current/f19/rt2800-fix-RT5390-RT3290-TX-power-settings-regression.patch
deleted file mode 100644
index 354873950..000000000
--- a/freed-ora/current/f19/rt2800-fix-RT5390-RT3290-TX-power-settings-regression.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-My change:
-
-commit cee2c7315f60beeff6137ee59e99acc77d636eeb
-Author: Stanislaw Gruszka <sgruszka@redhat.com>
-Date:   Fri Oct 5 13:44:09 2012 +0200
-
-    rt2800: use BBP_R1 for setting tx power
-
-unfortunately does not work well with RT5390 and RT3290 chips as they
-require different temperature compensation TX power settings (TSSI
-tuning). Since that commit make wireless connection very unstable on
-those chips, restore previous behavior to fix regression. Once we
-implement proper TSSI tuning on 5390/3290 we can restore back setting
-TX power by BBP_R1 register for those chips.
-
-Reported-and-tested-by: Mike Romberg <mike-romberg@comcast.net>
-Cc: stable@vger.kernel.org
-Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
----
- drivers/net/wireless/rt2x00/rt2800lib.c | 29 ++++++++++++++++++-----------
- 1 file changed, 18 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
-index 92849e5..8b679df 100644
---- a/drivers/net/wireless/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-@@ -2634,19 +2634,26 @@ static void rt2800_config_txpower(struct rt2x00_dev *rt2x00dev,
- 	 * TODO: we do not use +6 dBm option to do not increase power beyond
- 	 * regulatory limit, however this could be utilized for devices with
- 	 * CAPABILITY_POWER_LIMIT.
-+	 *
-+	 * TODO: add different temperature compensation code for RT3290 & RT5390
-+	 * to allow to use BBP_R1 for those chips.
- 	 */
--	rt2800_bbp_read(rt2x00dev, 1, &r1);
--	if (delta <= -12) {
--		power_ctrl = 2;
--		delta += 12;
--	} else if (delta <= -6) {
--		power_ctrl = 1;
--		delta += 6;
--	} else {
--		power_ctrl = 0;
-+	if (!rt2x00_rt(rt2x00dev, RT3290) &&
-+	    !rt2x00_rt(rt2x00dev, RT5390)) {
-+		rt2800_bbp_read(rt2x00dev, 1, &r1);
-+		if (delta <= -12) {
-+			power_ctrl = 2;
-+			delta += 12;
-+		} else if (delta <= -6) {
-+			power_ctrl = 1;
-+			delta += 6;
-+		} else {
-+			power_ctrl = 0;
-+		}
-+		rt2x00_set_field8(&r1, BBP1_TX_POWER_CTRL, power_ctrl);
-+		rt2800_bbp_write(rt2x00dev, 1, r1);
- 	}
--	rt2x00_set_field8(&r1, BBP1_TX_POWER_CTRL, power_ctrl);
--	rt2800_bbp_write(rt2x00dev, 1, r1);
-+
- 	offset = TX_PWR_CFG_0;
- 
- 	for (i = 0; i < EEPROM_TXPOWER_BYRATE_SIZE; i += 2) {
--- 
-1.7.11.7
-
---
-To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html
\ No newline at end of file
diff --git a/freed-ora/current/f19/sources b/freed-ora/current/f19/sources
index ee88a4837..65152aeeb 100644
--- a/freed-ora/current/f19/sources
+++ b/freed-ora/current/f19/sources
@@ -1,2 +1,2 @@
 120df29f88622dabf7015a22c7cc8e25  linux-libre-3.9-gnu.tar.xz
-b628d7ff09667dc5546993bb83461d45  patch-3.9-gnu-3.9.8-gnu.xz
+e143fc381f4d2fdfc18686b867a5e6a5  patch-3.9-gnu-3.9.9-gnu.xz