--- /dev/null
+From af9a75dd1a1f8a9aa406466cc8bb16208120488a Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Sat, 9 Jan 2010 01:22:29 -0500
+Subject: ALSA: ac97: Add Dell Dimension 2400 to Headphone/Line Jack Sense blacklist
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit af9a75dd1a1f8a9aa406466cc8bb16208120488a upstream.
+
+This model needs both 'Headphone Jack Sense' and 'Line Jack Sense' muted
+for audible playback, so just add it to the ad1981 jack sense blacklist.
+
+Tested-by: Pete <x41215201@gmail.com>
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ac97/ac97_patch.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/ac97/ac97_patch.c
++++ b/sound/pci/ac97/ac97_patch.c
+@@ -1870,6 +1870,7 @@ static unsigned int ad1981_jacks_blackli
+ 0x10140554, /* Thinkpad T42p/R50p */
+ 0x10140567, /* Thinkpad T43p 2668-G7U */
+ 0x10140581, /* Thinkpad X41-2527 */
++ 0x10280160, /* Dell Dimension 2400 */
+ 0x104380b0, /* Asus A7V8X-MX */
+ 0x11790241, /* Toshiba Satellite A-15 S127 */
+ 0x144dc01a, /* Samsung NP-X20C004/SEG */
--- /dev/null
+From dfb12eeb0f04b37e5eb3858864d074af4ecd2ac7 Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Sun, 27 Dec 2009 15:48:40 -0500
+Subject: ALSA: atiixp: Specify codec for Foxconn RC4107MA-RS2
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit dfb12eeb0f04b37e5eb3858864d074af4ecd2ac7 upstream.
+
+BugLink: https://bugs.launchpad.net/ubuntu/+bug/498863
+
+This mainboard needs ac97_codec=0.
+
+Tested-by: Apoorv Parle <apparle@yahoo.co.in>
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/atiixp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/atiixp.c
++++ b/sound/pci/atiixp.c
+@@ -297,6 +297,7 @@ static struct pci_device_id snd_atiixp_i
+ MODULE_DEVICE_TABLE(pci, snd_atiixp_ids);
+
+ static struct snd_pci_quirk atiixp_quirks[] __devinitdata = {
++ SND_PCI_QUIRK(0x105b, 0x0c81, "Foxconn RC4107MA-RS2", 0),
+ SND_PCI_QUIRK(0x15bd, 0x3100, "DFI RS482", 0),
+ { } /* terminator */
+ };
--- /dev/null
+From 9c0afc861a7228f718cb6a79fa7f9d46bf9ff300 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 12 Jan 2010 14:00:11 +0100
+Subject: ALSA: hda - Fix ALC861-VD capture source mixer
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 9c0afc861a7228f718cb6a79fa7f9d46bf9ff300 upstream.
+
+The capture source or input source mixer element wasn't created properly
+for ALC861-VD codec due to the wrong NID passed to
+alc_auto_create_input_ctls().
+
+References: Novell bnc#568305
+ http://bugzilla.novell.com/show_bug.cgi?id=568305
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -15323,7 +15323,7 @@ static struct alc_config_preset alc861vd
+ static int alc861vd_auto_create_input_ctls(struct hda_codec *codec,
+ const struct auto_pin_cfg *cfg)
+ {
+- return alc_auto_create_input_ctls(codec, cfg, 0x15, 0x09, 0);
++ return alc_auto_create_input_ctls(codec, cfg, 0x15, 0x22, 0);
+ }
+
+
--- /dev/null
+From b3172f222ab5afdc91ea058bd11c42cf169728f3 Mon Sep 17 00:00:00 2001
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Thu, 24 Dec 2009 01:13:51 +0100
+Subject: ASoC: fix params_rate() macro use in several codecs
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit b3172f222ab5afdc91ea058bd11c42cf169728f3 upstream.
+
+Sevelar ASoC codec drivers wrongly assume, that the params_rate() macro
+returns one of SNDRV_PCM_RATE_* defines instead of the actual numerical
+sampling rate. Fix them.
+
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8510.c | 14 +++++++-------
+ sound/soc/codecs/wm8940.c | 14 +++++++-------
+ sound/soc/codecs/wm8974.c | 14 +++++++-------
+ 3 files changed, 21 insertions(+), 21 deletions(-)
+
+--- a/sound/soc/codecs/wm8510.c
++++ b/sound/soc/codecs/wm8510.c
+@@ -425,23 +425,23 @@ static int wm8510_pcm_hw_params(struct s
+
+ /* filter coefficient */
+ switch (params_rate(params)) {
+- case SNDRV_PCM_RATE_8000:
++ case 8000:
+ adn |= 0x5 << 1;
+ break;
+- case SNDRV_PCM_RATE_11025:
++ case 11025:
+ adn |= 0x4 << 1;
+ break;
+- case SNDRV_PCM_RATE_16000:
++ case 16000:
+ adn |= 0x3 << 1;
+ break;
+- case SNDRV_PCM_RATE_22050:
++ case 22050:
+ adn |= 0x2 << 1;
+ break;
+- case SNDRV_PCM_RATE_32000:
++ case 32000:
+ adn |= 0x1 << 1;
+ break;
+- case SNDRV_PCM_RATE_44100:
+- case SNDRV_PCM_RATE_48000:
++ case 44100:
++ case 48000:
+ break;
+ }
+
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -379,23 +379,23 @@ static int wm8940_i2s_hw_params(struct s
+ iface |= (1 << 9);
+
+ switch (params_rate(params)) {
+- case SNDRV_PCM_RATE_8000:
++ case 8000:
+ addcntrl |= (0x5 << 1);
+ break;
+- case SNDRV_PCM_RATE_11025:
++ case 11025:
+ addcntrl |= (0x4 << 1);
+ break;
+- case SNDRV_PCM_RATE_16000:
++ case 16000:
+ addcntrl |= (0x3 << 1);
+ break;
+- case SNDRV_PCM_RATE_22050:
++ case 22050:
+ addcntrl |= (0x2 << 1);
+ break;
+- case SNDRV_PCM_RATE_32000:
++ case 32000:
+ addcntrl |= (0x1 << 1);
+ break;
+- case SNDRV_PCM_RATE_44100:
+- case SNDRV_PCM_RATE_48000:
++ case 44100:
++ case 48000:
+ break;
+ }
+ ret = snd_soc_write(codec, WM8940_ADDCNTRL, addcntrl);
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -480,23 +480,23 @@ static int wm8974_pcm_hw_params(struct s
+
+ /* filter coefficient */
+ switch (params_rate(params)) {
+- case SNDRV_PCM_RATE_8000:
++ case 8000:
+ adn |= 0x5 << 1;
+ break;
+- case SNDRV_PCM_RATE_11025:
++ case 11025:
+ adn |= 0x4 << 1;
+ break;
+- case SNDRV_PCM_RATE_16000:
++ case 16000:
+ adn |= 0x3 << 1;
+ break;
+- case SNDRV_PCM_RATE_22050:
++ case 22050:
+ adn |= 0x2 << 1;
+ break;
+- case SNDRV_PCM_RATE_32000:
++ case 32000:
+ adn |= 0x1 << 1;
+ break;
+- case SNDRV_PCM_RATE_44100:
+- case SNDRV_PCM_RATE_48000:
++ case 44100:
++ case 48000:
+ break;
+ }
+
--- /dev/null
+From 5ee518ecbcb5934e284ea51a19a939c891f5f7ea Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 7 Jan 2010 16:29:20 +0000
+Subject: ASoC: Fix WM8350 DSP mode B configuration
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 5ee518ecbcb5934e284ea51a19a939c891f5f7ea upstream.
+
+We need to set the LRCLK inversion bit to select DSP mode.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8350.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8350.c
++++ b/sound/soc/codecs/wm8350.c
+@@ -925,7 +925,7 @@ static int wm8350_set_dai_fmt(struct snd
+ iface |= 0x3 << 8;
+ break;
+ case SND_SOC_DAIFMT_DSP_B:
+- iface |= 0x3 << 8; /* lg not sure which mode */
++ iface |= 0x3 << 8 | WM8350_AIF_LRCLK_INV;
+ break;
+ default:
+ return -EINVAL;
--- /dev/null
+From bd4f490a079730aadfaf9a728303ea0135c01945 Mon Sep 17 00:00:00 2001
+From: Dave Anderson <anderson@redhat.com>
+Date: Fri, 8 Jan 2010 14:42:50 -0800
+Subject: cgroups: fix 2.6.32 regression causing BUG_ON() in cgroup_diput()
+
+From: Dave Anderson <anderson@redhat.com>
+
+commit bd4f490a079730aadfaf9a728303ea0135c01945 upstream.
+
+The LTP cgroup test suite generates a "kernel BUG at kernel/cgroup.c:790!"
+here in cgroup_diput():
+
+ /*
+ * if we're getting rid of the cgroup, refcount should ensure
+ * that there are no pidlists left.
+ */
+ BUG_ON(!list_empty(&cgrp->pidlists));
+
+The cgroup pidlist rework in 2.6.32 generates the BUG_ON, which is caused
+when pidlist_array_load() calls cgroup_pidlist_find():
+
+(1) if a matching cgroup_pidlist is found, it down_write's the mutex of the
+ pre-existing cgroup_pidlist, and increments its use_count.
+(2) if no matching cgroup_pidlist is found, then a new one is allocated, it
+ down_write's its mutex, and the use_count is set to 0.
+(3) the matching, or new, cgroup_pidlist gets returned back to pidlist_array_load(),
+ which increments its use_count -- regardless whether new or pre-existing --
+ and up_write's the mutex.
+
+So if a matching list is ever encountered by cgroup_pidlist_find() during
+the life of a cgroup directory, it results in an inflated use_count value,
+preventing it from ever getting released by cgroup_release_pid_array().
+Then if the directory is subsequently removed, cgroup_diput() hits the
+BUG_ON() when it finds that the directory's cgroup is still populated with
+a pidlist.
+
+The patch simply removes the use_count increment when a matching pidlist
+is found by cgroup_pidlist_find(), because it gets bumped by the calling
+pidlist_array_load() function while still protected by the list's mutex.
+
+Signed-off-by: Dave Anderson <anderson@redhat.com>
+Reviewed-by: Li Zefan <lizf@cn.fujitsu.com>
+Acked-by: Ben Blum <bblum@andrew.cmu.edu>
+Cc: Paul Menage <menage@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/cgroup.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2468,7 +2468,6 @@ static struct cgroup_pidlist *cgroup_pid
+ /* make sure l doesn't vanish out from under us */
+ down_write(&l->mutex);
+ mutex_unlock(&cgrp->pidlist_mutex);
+- l->use_count++;
+ return l;
+ }
+ }
--- /dev/null
+From 42d53b4ff7d61487d18274ebdf1f70c1aef6f122 Mon Sep 17 00:00:00 2001
+From: Krzysztof Halasa <khc@pm.waw.pl>
+Date: Fri, 8 Jan 2010 14:42:36 -0800
+Subject: dma-debug: allow DMA_BIDIRECTIONAL mappings to be synced with DMA_FROM_DEVICE and
+
+From: Krzysztof Halasa <khc@pm.waw.pl>
+
+commit 42d53b4ff7d61487d18274ebdf1f70c1aef6f122 upstream.
+
+There is no need to perform full BIDIR sync (copying the buffers in case
+of swiotlb and similar schemes) if we know that the owner (CPU or device)
+hasn't altered the data.
+
+Addresses the false-positive reported at
+http://bugzilla.kernel.org/show_bug.cgi?id=14169
+
+Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
+Cc: David Miller <davem@davemloft.net>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/dma-debug.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -913,6 +913,9 @@ static void check_sync(struct device *de
+ ref->size);
+ }
+
++ if (entry->direction == DMA_BIDIRECTIONAL)
++ goto out;
++
+ if (ref->direction != entry->direction) {
+ err_printk(dev, entry, "DMA-API: device driver syncs "
+ "DMA memory with different direction "
+@@ -923,9 +926,6 @@ static void check_sync(struct device *de
+ dir2name[ref->direction]);
+ }
+
+- if (entry->direction == DMA_BIDIRECTIONAL)
+- goto out;
+-
+ if (to_cpu && !(entry->direction == DMA_FROM_DEVICE) &&
+ !(ref->direction == DMA_TO_DEVICE))
+ err_printk(dev, entry, "DMA-API: device driver syncs "
+@@ -948,7 +948,6 @@ static void check_sync(struct device *de
+
+ out:
+ put_hash_bucket(bucket, &flags);
+-
+ }
+
+ void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,
--- /dev/null
+From 5787536edf18e33d06e2bf038bfd0910f4def213 Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+Date: Fri, 8 Jan 2010 14:43:08 -0800
+Subject: drivers/cpuidle/governors/menu.c: fix undefined reference to `__udivdi3'
+
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+commit 5787536edf18e33d06e2bf038bfd0910f4def213 upstream.
+
+menu: use proper 64 bit math
+
+The new menu governor is incorrectly doing a 64 bit divide. Compile
+tested only
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/cpuidle/governors/menu.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -18,6 +18,7 @@
+ #include <linux/hrtimer.h>
+ #include <linux/tick.h>
+ #include <linux/sched.h>
++#include <linux/math64.h>
+
+ #define BUCKETS 12
+ #define RESOLUTION 1024
+@@ -169,6 +170,12 @@ static DEFINE_PER_CPU(struct menu_device
+
+ static void menu_update(struct cpuidle_device *dev);
+
++/* This implements DIV_ROUND_CLOSEST but avoids 64 bit division */
++static u64 div_round64(u64 dividend, u32 divisor)
++{
++ return div_u64(dividend + (divisor / 2), divisor);
++}
++
+ /**
+ * menu_select - selects the next idle state to enter
+ * @dev: the CPU
+@@ -209,9 +216,8 @@ static int menu_select(struct cpuidle_de
+ data->correction_factor[data->bucket] = RESOLUTION * DECAY;
+
+ /* Make sure to round up for half microseconds */
+- data->predicted_us = DIV_ROUND_CLOSEST(
+- data->expected_us * data->correction_factor[data->bucket],
+- RESOLUTION * DECAY);
++ data->predicted_us = div_round64(data->expected_us * data->correction_factor[data->bucket],
++ RESOLUTION * DECAY);
+
+ /*
+ * We want to default to C1 (hlt), not to busy polling
--- /dev/null
+From 898822ce9561ab9b58a7eb60580a162a83dadecd Mon Sep 17 00:00:00 2001
+From: Zhao Yakui <yakui.zhao@intel.com>
+Date: Mon, 4 Jan 2010 16:29:30 +0800
+Subject: drm/i915: Enable/disable the dithering for LVDS based on VBT setting
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit 898822ce9561ab9b58a7eb60580a162a83dadecd upstream.
+
+Enable/disable the dithering for LVDS based on VBT setting. On the 965/g4x
+platform the dithering flag is defined in LVDS register. And on the ironlake
+the dithering flag is defined in pipeconf register.
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 4 ++++
+ drivers/gpu/drm/i915/intel_display.c | 15 ++++++++++++++-
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -968,6 +968,8 @@
+ #define LVDS_PORT_EN (1 << 31)
+ /* Selects pipe B for LVDS data. Must be set on pre-965. */
+ #define LVDS_PIPEB_SELECT (1 << 30)
++/* LVDS dithering flag on 965/g4x platform */
++#define LVDS_ENABLE_DITHER (1 << 25)
+ /* Enable border for unscaled (or aspect-scaled) display */
+ #define LVDS_BORDER_ENABLE (1 << 15)
+ /*
+@@ -1737,6 +1739,8 @@
+
+ /* Display & cursor control */
+
++/* dithering flag on Ironlake */
++#define PIPE_ENABLE_DITHER (1 << 4)
+ /* Pipe A */
+ #define PIPEADSL 0x70000
+ #define PIPEACONF 0x70008
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -3104,7 +3104,20 @@ static int intel_crtc_mode_set(struct dr
+ * appropriately here, but we need to look more thoroughly into how
+ * panels behave in the two modes.
+ */
+-
++ /* set the dithering flag */
++ if (IS_I965G(dev)) {
++ if (dev_priv->lvds_dither) {
++ if (IS_IGDNG(dev))
++ pipeconf |= PIPE_ENABLE_DITHER;
++ else
++ lvds |= LVDS_ENABLE_DITHER;
++ } else {
++ if (IS_IGDNG(dev))
++ pipeconf &= ~PIPE_ENABLE_DITHER;
++ else
++ lvds &= ~LVDS_ENABLE_DITHER;
++ }
++ }
+ I915_WRITE(lvds_reg, lvds);
+ I915_READ(lvds_reg);
+ }
--- /dev/null
+From 96b47b65594fe2365f73aede060cb5203561fed3 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Tue, 15 Dec 2009 17:50:00 +0100
+Subject: drm/i915: fix order of fence release wrt flushing
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 96b47b65594fe2365f73aede060cb5203561fed3 upstream.
+
+i915_gem_object_unbind had the ordering wrong. The other user,
+i915_gem_object_put_fence_reg already has the correct ordering.
+
+Results was usually corrupted pixmaps, especially garbled font glyphs
+after a suspend/resume (because this evicts everything).
+
+I'm still waiting for the feedback from the bug-reporters, but
+because this obviously fixes a bug (at least for me) I'm already
+submitting it.
+
+Bugzilla: http://bugs.freedesktop.org/show_bug.cgi?id=25406
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2010,9 +2010,6 @@ i915_gem_object_unbind(struct drm_gem_ob
+ /* blow away mappings if mapped through GTT */
+ i915_gem_release_mmap(obj);
+
+- if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
+- i915_gem_clear_fence_reg(obj);
+-
+ /* Move the object to the CPU domain to ensure that
+ * any possible CPU writes while it's not in the GTT
+ * are flushed when we go to remap it. This will
+@@ -2028,6 +2025,10 @@ i915_gem_object_unbind(struct drm_gem_ob
+
+ BUG_ON(obj_priv->active);
+
++ /* release the fence reg _after_ flushing */
++ if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
++ i915_gem_clear_fence_reg(obj);
++
+ if (obj_priv->agp_mem != NULL) {
+ drm_unbind_agp(obj_priv->agp_mem);
+ drm_free_agp(obj_priv->agp_mem, obj->size / PAGE_SIZE);
--- /dev/null
+From 29bd0ae25f8cb96b63560c2cbccec77b425e1603 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Tue, 17 Nov 2009 14:08:52 -0800
+Subject: drm/i915: fix unused var
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 29bd0ae25f8cb96b63560c2cbccec77b425e1603 upstream.
+
+drivers/gpu/drm/i915/i915_dma.c: In function 'i915_driver_load':
+drivers/gpu/drm/i915/i915_dma.c:1114: warning: 'll_base' may be used uninitialized in this function
+
+Partly this is because gcc isn't smart enough. But `ll_base' does get used
+uninitialised in the DRM_DEBUG() call.
+
+Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
+Cc: Eric Anholt <eric@anholt.net>
+Cc: Dave Airlie <airlied@linux.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_dma.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1111,7 +1111,8 @@ static void i915_setup_compression(struc
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ struct drm_mm_node *compressed_fb, *compressed_llb;
+- unsigned long cfb_base, ll_base;
++ unsigned long cfb_base;
++ unsigned long ll_base = 0;
+
+ /* Leave 1M for line length buffer & misc. */
+ compressed_fb = drm_mm_search_free(&dev_priv->vram, size, 4096, 0);
--- /dev/null
+From 8faf3b317471179c02db339aa80955a2e88c036d Mon Sep 17 00:00:00 2001
+From: Zhao Yakui <yakui.zhao@intel.com>
+Date: Mon, 4 Jan 2010 16:29:31 +0800
+Subject: drm/i915: Make the BPC in FDI rx/transcoder be consistent with that in pipeconf on Ironlake
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit 8faf3b317471179c02db339aa80955a2e88c036d upstream.
+
+Make the BPC in FDI rx/transcoder be consistent with that in pipeconf on Ironlake.
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1473,6 +1473,10 @@ static void igdng_crtc_dpms(struct drm_c
+ int trans_vsync_reg = (pipe == 0) ? TRANS_VSYNC_A : TRANS_VSYNC_B;
+ u32 temp;
+ int tries = 5, j, n;
++ u32 pipe_bpc;
++
++ temp = I915_READ(pipeconf_reg);
++ pipe_bpc = temp & PIPE_BPC_MASK;
+
+ /* XXX: When our outputs are all unaware of DPMS modes other than off
+ * and on, we should map those modes to DRM_MODE_DPMS_OFF in the CRTC.
+@@ -1504,6 +1508,12 @@ static void igdng_crtc_dpms(struct drm_c
+
+ /* enable PCH FDI RX PLL, wait warmup plus DMI latency */
+ temp = I915_READ(fdi_rx_reg);
++ /*
++ * make the BPC in FDI Rx be consistent with that in
++ * pipeconf reg.
++ */
++ temp &= ~(0x7 << 16);
++ temp |= (pipe_bpc << 11);
+ I915_WRITE(fdi_rx_reg, temp | FDI_RX_PLL_ENABLE |
+ FDI_SEL_PCDCLK |
+ FDI_DP_PORT_WIDTH_X4); /* default 4 lanes */
+@@ -1644,6 +1654,12 @@ static void igdng_crtc_dpms(struct drm_c
+
+ /* enable PCH transcoder */
+ temp = I915_READ(transconf_reg);
++ /*
++ * make the BPC in transcoder be consistent with
++ * that in pipeconf reg.
++ */
++ temp &= ~PIPE_BPC_MASK;
++ temp |= pipe_bpc;
+ I915_WRITE(transconf_reg, temp | TRANS_ENABLE);
+ I915_READ(transconf_reg);
+
+@@ -1722,6 +1738,9 @@ static void igdng_crtc_dpms(struct drm_c
+ I915_READ(fdi_tx_reg);
+
+ temp = I915_READ(fdi_rx_reg);
++ /* BPC in FDI rx is consistent with that in pipeconf */
++ temp &= ~(0x07 << 16);
++ temp |= (pipe_bpc << 11);
+ I915_WRITE(fdi_rx_reg, temp & ~FDI_RX_ENABLE);
+ I915_READ(fdi_rx_reg);
+
+@@ -1765,7 +1784,12 @@ static void igdng_crtc_dpms(struct drm_c
+ }
+ }
+ }
+-
++ temp = I915_READ(transconf_reg);
++ /* BPC in transcoder is consistent with that in pipeconf */
++ temp &= ~PIPE_BPC_MASK;
++ temp |= pipe_bpc;
++ I915_WRITE(transconf_reg, temp);
++ I915_READ(transconf_reg);
+ udelay(100);
+
+ /* disable PCH DPLL */
--- /dev/null
+From e3d8affb0d2d95f2da61e30ce86b33177feb91e8 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 4 Jan 2010 18:57:57 +0000
+Subject: drm/i915: Permit pinning whilst the device is 'suspended'
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit e3d8affb0d2d95f2da61e30ce86b33177feb91e8 upstream.
+
+As pinning (allocating and binding GTT memory) does not actually invoke
+GPU commands, it is safe, and indeed is attempted, during resumption
+from suspension:
+
+ [drm:intel_init_clock_gating] *ERROR* failed to pin power context: -16
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reported-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2571,9 +2571,6 @@ i915_gem_object_bind_to_gtt(struct drm_g
+ bool retry_alloc = false;
+ int ret;
+
+- if (dev_priv->mm.suspended)
+- return -EBUSY;
+-
+ if (obj_priv->madv != I915_MADV_WILLNEED) {
+ DRM_ERROR("Attempting to bind a purgeable object\n");
+ return -EINVAL;
--- /dev/null
+From e5a95eb778690bc864eb330202d2c1b974caaeb4 Mon Sep 17 00:00:00 2001
+From: Zhao Yakui <yakui.zhao@intel.com>
+Date: Mon, 4 Jan 2010 16:29:32 +0800
+Subject: drm/i915: Select the correct BPC for LVDS on Ironlake
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit e5a95eb778690bc864eb330202d2c1b974caaeb4 upstream.
+
+Select the correct BPC for LVDS on Ironlake. If it is 18-bit LVDS panel,
+the BPC will be 6. When it is 24-bit LVDS panel, the BPC will 8.
+At the same time the BPC will be 8 when the output device is CRT/HDMI/DP.
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2901,6 +2901,18 @@ static int intel_crtc_mode_set(struct dr
+
+ /* determine panel color depth */
+ temp = I915_READ(pipeconf_reg);
++ temp &= ~PIPE_BPC_MASK;
++ if (is_lvds) {
++ int lvds_reg = I915_READ(PCH_LVDS);
++ /* the BPC will be 6 if it is 18-bit LVDS panel */
++ if ((lvds_reg & LVDS_A3_POWER_MASK) == LVDS_A3_POWER_UP)
++ temp |= PIPE_8BPC;
++ else
++ temp |= PIPE_6BPC;
++ } else
++ temp |= PIPE_8BPC;
++ I915_WRITE(pipeconf_reg, temp);
++ I915_READ(pipeconf_reg);
+
+ switch (temp & PIPE_BPC_MASK) {
+ case PIPE_8BPC:
--- /dev/null
+From a2565377a5c31e25c77c7cabaf6752abe9a2d83a Mon Sep 17 00:00:00 2001
+From: Zhao Yakui <yakui.zhao@intel.com>
+Date: Fri, 11 Dec 2009 09:26:11 +0800
+Subject: drm/i915: Update LVDS connector status when receiving ACPI LID event
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit a2565377a5c31e25c77c7cabaf6752abe9a2d83a upstream.
+
+Dirk reports that nothing is displayed on LVDS when using ubuntu 9.1 after
+close/reopen the LID. And I also reproduce this issue on another laptop.
+After some tests and debug, it seems that it is related with that the
+LVDS status is not updated in time in course of suspend/resume.
+
+Now the LID state is used to check whether the LVDS is connected or
+disconnected. And when the LID is closed, it means that the LVDS is
+disconnected. When it is reopened, it means that the LVDS is connected.
+At the same time on some distributions the LID event is also used to put
+the system into suspend state. When the LID is closed, the system will enter
+the suspend state. When the LID is reopened, the system will be resumed.
+
+In such case when the LID is closed, user-space script will receive the LID
+notification event and detect the LVDS as disconnected. Then the system will
+enter the suspended state. When the LID is reopened, the system will be
+resumed. As the LVDS status is not updated in course of resume, it will cause
+that the LVDS connector is marked as unused and disabled. After the resume is
+finished,user-space script will try to configure the display mode for LVDS.
+But unfortunately as the LVDS status is not updated in time and it is still
+marked as disconnected, the LVDS and its corresponding CRTC will be disabled
+again in the function of drm_helper_disable_unused_functions after changing
+mode for LVDS.
+
+So we had better check and update the status of LVDS connector after receiving
+the LID notication event. Then after the system is resumed from suspended
+state, we can set the display mode for LVDS correctly.
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Reported-by: Dirk Hohndel <hohndel@infradead.org>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 1 +
+ drivers/gpu/drm/i915/intel_lvds.c | 9 +++++++++
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -546,6 +546,7 @@ typedef struct drm_i915_private {
+ struct timer_list idle_timer;
+ bool busy;
+ u16 orig_clock;
++ struct drm_connector *int_lvds_connector;
+ } drm_i915_private_t;
+
+ /** driver private structure attached to each drm_gem_object */
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -679,7 +679,14 @@ static int intel_lid_notify(struct notif
+ struct drm_i915_private *dev_priv =
+ container_of(nb, struct drm_i915_private, lid_notifier);
+ struct drm_device *dev = dev_priv->dev;
++ struct drm_connector *connector = dev_priv->int_lvds_connector;
+
++ /*
++ * check and update the status of LVDS connector after receiving
++ * the LID nofication event.
++ */
++ if (connector)
++ connector->status = connector->funcs->detect(connector);
+ if (!acpi_lid_open()) {
+ dev_priv->modeset_on_lid = 1;
+ return NOTIFY_OK;
+@@ -1085,6 +1092,8 @@ out:
+ DRM_DEBUG("lid notifier registration failed\n");
+ dev_priv->lid_notifier.notifier_call = NULL;
+ }
++ /* keep the LVDS connector */
++ dev_priv->int_lvds_connector = connector;
+ drm_sysfs_connector_add(connector);
+ return;
+
--- /dev/null
+From e6be8d9d17bd44061116f601fe2609b3ace7aa69 Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyu.z.wang@intel.com>
+Date: Tue, 5 Jan 2010 11:25:05 +0800
+Subject: drm: remove address mask param for drm_pci_alloc()
+
+From: Zhenyu Wang <zhenyu.z.wang@intel.com>
+
+commit e6be8d9d17bd44061116f601fe2609b3ace7aa69 upstream.
+
+drm_pci_alloc() has input of address mask for setting pci dma
+mask on the device, which should be properly setup by drm driver.
+And leave it as a param for drm_pci_alloc() would cause confusion
+or mistake would corrupt the correct dma mask setting, as seen on
+intel hw which set wrong dma mask for hw status page. So remove
+it from drm_pci_alloc() function.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/ati_pcigart.c | 10 ++++++++--
+ drivers/gpu/drm/drm_bufs.c | 4 ++--
+ drivers/gpu/drm/drm_pci.c | 8 +-------
+ drivers/gpu/drm/i915/i915_dma.c | 2 +-
+ drivers/gpu/drm/i915/i915_gem.c | 2 +-
+ include/drm/drmP.h | 2 +-
+ 6 files changed, 14 insertions(+), 14 deletions(-)
+
+--- a/drivers/gpu/drm/ati_pcigart.c
++++ b/drivers/gpu/drm/ati_pcigart.c
+@@ -39,8 +39,7 @@ static int drm_ati_alloc_pcigart_table(s
+ struct drm_ati_pcigart_info *gart_info)
+ {
+ gart_info->table_handle = drm_pci_alloc(dev, gart_info->table_size,
+- PAGE_SIZE,
+- gart_info->table_mask);
++ PAGE_SIZE);
+ if (gart_info->table_handle == NULL)
+ return -ENOMEM;
+
+@@ -112,6 +111,13 @@ int drm_ati_pcigart_init(struct drm_devi
+ if (gart_info->gart_table_location == DRM_ATI_GART_MAIN) {
+ DRM_DEBUG("PCI: no table in VRAM: using normal RAM\n");
+
++ if (pci_set_dma_mask(dev->pdev, gart_info->table_mask)) {
++ DRM_ERROR("fail to set dma mask to 0x%Lx\n",
++ gart_info->table_mask);
++ ret = 1;
++ goto done;
++ }
++
+ ret = drm_ati_alloc_pcigart_table(dev, gart_info);
+ if (ret) {
+ DRM_ERROR("cannot allocate PCI GART page!\n");
+--- a/drivers/gpu/drm/drm_bufs.c
++++ b/drivers/gpu/drm/drm_bufs.c
+@@ -326,7 +326,7 @@ static int drm_addmap_core(struct drm_de
+ * As we're limiting the address to 2^32-1 (or less),
+ * casting it down to 32 bits is no problem, but we
+ * need to point to a 64bit variable first. */
+- dmah = drm_pci_alloc(dev, map->size, map->size, 0xffffffffUL);
++ dmah = drm_pci_alloc(dev, map->size, map->size);
+ if (!dmah) {
+ kfree(map);
+ return -ENOMEM;
+@@ -885,7 +885,7 @@ int drm_addbufs_pci(struct drm_device *
+
+ while (entry->buf_count < count) {
+
+- dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000, 0xfffffffful);
++ dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000);
+
+ if (!dmah) {
+ /* Set count correctly so we free the proper amount. */
+--- a/drivers/gpu/drm/drm_pci.c
++++ b/drivers/gpu/drm/drm_pci.c
+@@ -47,8 +47,7 @@
+ /**
+ * \brief Allocate a PCI consistent memory block, for DMA.
+ */
+-drm_dma_handle_t *drm_pci_alloc(struct drm_device * dev, size_t size, size_t align,
+- dma_addr_t maxaddr)
++drm_dma_handle_t *drm_pci_alloc(struct drm_device * dev, size_t size, size_t align)
+ {
+ drm_dma_handle_t *dmah;
+ #if 1
+@@ -63,11 +62,6 @@ drm_dma_handle_t *drm_pci_alloc(struct d
+ if (align > size)
+ return NULL;
+
+- if (pci_set_dma_mask(dev->pdev, maxaddr) != 0) {
+- DRM_ERROR("Setting pci dma mask failed\n");
+- return NULL;
+- }
+-
+ dmah = kmalloc(sizeof(drm_dma_handle_t), GFP_KERNEL);
+ if (!dmah)
+ return NULL;
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -123,7 +123,7 @@ static int i915_init_phys_hws(struct drm
+ drm_i915_private_t *dev_priv = dev->dev_private;
+ /* Program Hardware Status Page */
+ dev_priv->status_page_dmah =
+- drm_pci_alloc(dev, PAGE_SIZE, PAGE_SIZE, 0xffffffff);
++ drm_pci_alloc(dev, PAGE_SIZE, PAGE_SIZE);
+
+ if (!dev_priv->status_page_dmah) {
+ DRM_ERROR("Can not allocate hardware status page\n");
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -4637,7 +4637,7 @@ int i915_gem_init_phys_object(struct drm
+
+ phys_obj->id = id;
+
+- phys_obj->handle = drm_pci_alloc(dev, size, 0, 0xffffffff);
++ phys_obj->handle = drm_pci_alloc(dev, size, 0);
+ if (!phys_obj->handle) {
+ ret = -ENOMEM;
+ goto kfree_obj;
+--- a/include/drm/drmP.h
++++ b/include/drm/drmP.h
+@@ -1402,7 +1402,7 @@ extern int drm_ati_pcigart_cleanup(struc
+ struct drm_ati_pcigart_info * gart_info);
+
+ extern drm_dma_handle_t *drm_pci_alloc(struct drm_device *dev, size_t size,
+- size_t align, dma_addr_t maxaddr);
++ size_t align);
+ extern void __drm_pci_free(struct drm_device *dev, drm_dma_handle_t * dmah);
+ extern void drm_pci_free(struct drm_device *dev, drm_dma_handle_t * dmah);
+
--- /dev/null
+From efd124b999fb4d426b30675f1684521af0872789 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Sun, 27 Dec 2009 17:01:42 +0200
+Subject: exofs: simple_write_end does not mark_inode_dirty
+
+From: Boaz Harrosh <bharrosh@panasas.com>
+
+commit efd124b999fb4d426b30675f1684521af0872789 upstream.
+
+exofs uses simple_write_end() for it's .write_end handler. But
+it is not enough because simple_write_end() does not call
+mark_inode_dirty() when it extends i_size. So even if we do
+call mark_inode_dirty at beginning of write out, with a very
+long IO and a saturated system we might get the .write_inode()
+called while still extend-writing to file and miss out on the last
+i_size updates.
+
+So override .write_end, call simple_write_end(), and afterwords if
+i_size was changed call mark_inode_dirty().
+
+It stands to logic that since simple_write_end() was the one extending
+i_size it should also call mark_inode_dirty(). But it looks like all
+users of simple_write_end() are memory-bound pseudo filesystems, who
+could careless about mark_inode_dirty(). I might submit a
+warning-comment patch to simple_write_end() in future.
+
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/exofs/inode.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/fs/exofs/inode.c
++++ b/fs/exofs/inode.c
+@@ -731,13 +731,28 @@ static int exofs_write_begin_export(stru
+ fsdata);
+ }
+
++static int exofs_write_end(struct file *file, struct address_space *mapping,
++ loff_t pos, unsigned len, unsigned copied,
++ struct page *page, void *fsdata)
++{
++ struct inode *inode = mapping->host;
++ /* According to comment in simple_write_end i_mutex is held */
++ loff_t i_size = inode->i_size;
++ int ret;
++
++ ret = simple_write_end(file, mapping,pos, len, copied, page, fsdata);
++ if (i_size != inode->i_size)
++ mark_inode_dirty(inode);
++ return ret;
++}
++
+ const struct address_space_operations exofs_aops = {
+ .readpage = exofs_readpage,
+ .readpages = exofs_readpages,
+ .writepage = exofs_writepage,
+ .writepages = exofs_writepages,
+ .write_begin = exofs_write_begin_export,
+- .write_end = simple_write_end,
++ .write_end = exofs_write_end,
+ };
+
+ /******************************************************************************
--- /dev/null
+From 53281b6d34d44308372d16acb7fb5327609f68b6 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 16 Dec 2009 08:23:37 -0800
+Subject: fasync: split 'fasync_helper()' into separate add/remove functions
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 53281b6d34d44308372d16acb7fb5327609f68b6 upstream.
+
+Yes, the add and remove cases do share the same basic loop and the
+locking, but the compiler can inline and then CSE some of the end result
+anyway. And splitting it up makes the code way easier to follow,
+and makes it clearer exactly what the semantics are.
+
+In particular, we must make sure that the FASYNC flag in file->f_flags
+exactly matches the state of "is this file on any fasync list", since
+not only is that flag visible to user space (F_GETFL), but we also use
+that flag to check whether we need to remove any fasync entries on file
+close.
+
+We got that wrong for the case of a mixed use of file locking (which
+tries to remove any fasync entries for file leases) and fasync.
+
+Splitting the function up also makes it possible to do some future
+optimizations without making the function even messier. In particular,
+since the FASYNC flag has to match the state of "is this on a list", we
+can do the following future optimizations:
+
+ - on remove, we don't even need to get the locks and traverse the list
+ if FASYNC isn't set, since we can know a priori that there is no
+ point (this is effectively the same optimization that we already do
+ in __fput() wrt removing fasync on file close)
+
+ - on add, we can use the FASYNC flag to decide whether we are changing
+ an existing entry or need to allocate a new one.
+
+but this is just the cleanup + fix for the FASYNC flag.
+
+Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
+Tested-by: Tavis Ormandy <taviso@google.com>
+Cc: Jeff Dike <jdike@addtoit.com>
+Cc: Matt Mackall <mpm@selenic.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fcntl.c | 102 +++++++++++++++++++++++++++++++++++++++----------------------
+ 1 file changed, 66 insertions(+), 36 deletions(-)
+
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -618,60 +618,90 @@ static DEFINE_RWLOCK(fasync_lock);
+ static struct kmem_cache *fasync_cache __read_mostly;
+
+ /*
+- * fasync_helper() is used by almost all character device drivers
+- * to set up the fasync queue. It returns negative on error, 0 if it did
+- * no changes and positive if it added/deleted the entry.
++ * Remove a fasync entry. If successfully removed, return
++ * positive and clear the FASYNC flag. If no entry exists,
++ * do nothing and return 0.
++ *
++ * NOTE! It is very important that the FASYNC flag always
++ * match the state "is the filp on a fasync list".
++ *
++ * We always take the 'filp->f_lock', in since fasync_lock
++ * needs to be irq-safe.
+ */
+-int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
++static int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
+ {
+ struct fasync_struct *fa, **fp;
+- struct fasync_struct *new = NULL;
+ int result = 0;
+
+- if (on) {
+- new = kmem_cache_alloc(fasync_cache, GFP_KERNEL);
+- if (!new)
+- return -ENOMEM;
++ spin_lock(&filp->f_lock);
++ write_lock_irq(&fasync_lock);
++ for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
++ if (fa->fa_file != filp)
++ continue;
++ *fp = fa->fa_next;
++ kmem_cache_free(fasync_cache, fa);
++ filp->f_flags &= ~FASYNC;
++ result = 1;
++ break;
+ }
++ write_unlock_irq(&fasync_lock);
++ spin_unlock(&filp->f_lock);
++ return result;
++}
++
++/*
++ * Add a fasync entry. Return negative on error, positive if
++ * added, and zero if did nothing but change an existing one.
++ *
++ * NOTE! It is very important that the FASYNC flag always
++ * match the state "is the filp on a fasync list".
++ */
++static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
++{
++ struct fasync_struct *new, *fa, **fp;
++ int result = 0;
++
++ new = kmem_cache_alloc(fasync_cache, GFP_KERNEL);
++ if (!new)
++ return -ENOMEM;
+
+- /*
+- * We need to take f_lock first since it's not an IRQ-safe
+- * lock.
+- */
+ spin_lock(&filp->f_lock);
+ write_lock_irq(&fasync_lock);
+ for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
+- if (fa->fa_file == filp) {
+- if(on) {
+- fa->fa_fd = fd;
+- kmem_cache_free(fasync_cache, new);
+- } else {
+- *fp = fa->fa_next;
+- kmem_cache_free(fasync_cache, fa);
+- result = 1;
+- }
+- goto out;
+- }
++ if (fa->fa_file != filp)
++ continue;
++ fa->fa_fd = fd;
++ kmem_cache_free(fasync_cache, new);
++ goto out;
+ }
+
+- if (on) {
+- new->magic = FASYNC_MAGIC;
+- new->fa_file = filp;
+- new->fa_fd = fd;
+- new->fa_next = *fapp;
+- *fapp = new;
+- result = 1;
+- }
++ new->magic = FASYNC_MAGIC;
++ new->fa_file = filp;
++ new->fa_fd = fd;
++ new->fa_next = *fapp;
++ *fapp = new;
++ result = 1;
++ filp->f_flags |= FASYNC;
++
+ out:
+- if (on)
+- filp->f_flags |= FASYNC;
+- else
+- filp->f_flags &= ~FASYNC;
+ write_unlock_irq(&fasync_lock);
+ spin_unlock(&filp->f_lock);
+ return result;
+ }
+
++/*
++ * fasync_helper() is used by almost all character device drivers
++ * to set up the fasync queue, and for regular files by the file
++ * lease code. It returns negative on error, 0 if it did no changes
++ * and positive if it added/deleted the entry.
++ */
++int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
++{
++ if (!on)
++ return fasync_remove_entry(filp, fapp);
++ return fasync_add_entry(fd, filp, fapp);
++}
++
+ EXPORT_SYMBOL(fasync_helper);
+
+ void __kill_fasync(struct fasync_struct *fa, int sig, int band)
--- /dev/null
+From bb595c923bc51dff9cdd112de18deb57ac7945d2 Mon Sep 17 00:00:00 2001
+From: Roger Blofeld <blofeldus@yahoo.com>
+Date: Sun, 10 Jan 2010 20:52:32 +0100
+Subject: hwmon: (adt7462) Fix pin 28 monitoring
+
+From: Roger Blofeld <blofeldus@yahoo.com>
+
+commit bb595c923bc51dff9cdd112de18deb57ac7945d2 upstream.
+
+The ADT7462_PIN28_VOLT value is a 4-bit field, so the corresponding
+shift must be 4.
+
+Signed-off-by: Roger Blofeld <blofeldus@yahoo.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/adt7462.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/adt7462.c
++++ b/drivers/hwmon/adt7462.c
+@@ -97,7 +97,7 @@ I2C_CLIENT_INSMOD_1(adt7462);
+ #define ADT7462_PIN24_SHIFT 6
+ #define ADT7462_PIN26_VOLT_INPUT 0x08
+ #define ADT7462_PIN25_VOLT_INPUT 0x20
+-#define ADT7462_PIN28_SHIFT 6 /* cfg3 */
++#define ADT7462_PIN28_SHIFT 4 /* cfg3 */
+ #define ADT7462_PIN28_VOLT 0x5
+
+ #define ADT7462_REG_ALARM1 0xB8
--- /dev/null
+From 1fe63ab47a617ee95f562eaa7ddbbc59981ff8c6 Mon Sep 17 00:00:00 2001
+From: Yong Wang <yong.y.wang@linux.intel.com>
+Date: Sun, 10 Jan 2010 20:52:34 +0100
+Subject: hwmon: (coretemp) Fix TjMax for Atom N450/D410/D510 CPUs
+
+From: Yong Wang <yong.y.wang@linux.intel.com>
+
+commit 1fe63ab47a617ee95f562eaa7ddbbc59981ff8c6 upstream.
+
+The max junction temperature of Atom N450/D410/D510 CPUs is 100 degrees
+Celsius. Since these CPUs are always coupled with Intel NM10 chipset in
+one package, the best way to verify whether an Atom CPU is N450/D410/D510
+is to check the host bridge device.
+
+Signed-off-by: Yong Wang <yong.y.wang@intel.com>
+Acked-by: Huaxu Wan <huaxu.wan@intel.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/Kconfig | 2 +-
+ drivers/hwmon/coretemp.c | 16 ++++++++++++++--
+ 2 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -33,6 +33,7 @@
+ #include <linux/list.h>
+ #include <linux/platform_device.h>
+ #include <linux/cpu.h>
++#include <linux/pci.h>
+ #include <asm/msr.h>
+ #include <asm/processor.h>
+
+@@ -161,6 +162,7 @@ static int __devinit adjust_tjmax(struct
+ int usemsr_ee = 1;
+ int err;
+ u32 eax, edx;
++ struct pci_dev *host_bridge;
+
+ /* Early chips have no MSR for TjMax */
+
+@@ -168,11 +170,21 @@ static int __devinit adjust_tjmax(struct
+ usemsr_ee = 0;
+ }
+
+- /* Atoms seems to have TjMax at 90C */
++ /* Atom CPUs */
+
+ if (c->x86_model == 0x1c) {
+ usemsr_ee = 0;
+- tjmax = 90000;
++
++ host_bridge = pci_get_bus_and_slot(0, PCI_DEVFN(0, 0));
++
++ if (host_bridge && host_bridge->vendor == PCI_VENDOR_ID_INTEL
++ && (host_bridge->device == 0xa000 /* NM10 based nettop */
++ || host_bridge->device == 0xa010)) /* NM10 based netbook */
++ tjmax = 100000;
++ else
++ tjmax = 90000;
++
++ pci_dev_put(host_bridge);
+ }
+
+ if ((c->x86_model > 0xe) && (usemsr_ee)) {
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -374,7 +374,7 @@ config SENSORS_GL520SM
+
+ config SENSORS_CORETEMP
+ tristate "Intel Core/Core2/Atom temperature sensor"
+- depends on X86 && EXPERIMENTAL
++ depends on X86 && PCI && EXPERIMENTAL
+ help
+ If you say yes here you get support for the temperature
+ sensor inside your CPU. Most of the family 6 CPUs
--- /dev/null
+From b45c6e76bc2c72f6426c14bed64fdcbc9bf37cb0 Mon Sep 17 00:00:00 2001
+From: Andi Kleen <andi@firstfloor.org>
+Date: Fri, 8 Jan 2010 14:42:52 -0800
+Subject: kernel/signal.c: fix kernel information leak with print-fatal-signals=1
+
+From: Andi Kleen <andi@firstfloor.org>
+
+commit b45c6e76bc2c72f6426c14bed64fdcbc9bf37cb0 upstream.
+
+When print-fatal-signals is enabled it's possible to dump any memory
+reachable by the kernel to the log by simply jumping to that address from
+user space.
+
+Or crash the system if there's some hardware with read side effects.
+
+The fatal signals handler will dump 16 bytes at the execution address,
+which is fully controlled by ring 3.
+
+In addition when something jumps to a unmapped address there will be up to
+16 additional useless page faults, which might be potentially slow (and at
+least is not very efficient)
+
+Fortunately this option is off by default and only there on i386.
+
+But fix it by checking for kernel addresses and also stopping when there's
+a page fault.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/signal.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -939,7 +939,8 @@ static void print_fatal_signal(struct pt
+ for (i = 0; i < 16; i++) {
+ unsigned char insn;
+
+- __get_user(insn, (unsigned char *)(regs->ip + i));
++ if (get_user(insn, (unsigned char *)(regs->ip + i)))
++ break;
+ printk("%02x ", insn);
+ }
+ }
--- /dev/null
+From 7ee3aebe31d2cb22c84e1c8f48182947b13a3607 Mon Sep 17 00:00:00 2001
+From: Sascha Hauer <s.hauer@pengutronix.de>
+Date: Fri, 8 Jan 2010 14:42:47 -0800
+Subject: lib/rational.c needs module.h
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+commit 7ee3aebe31d2cb22c84e1c8f48182947b13a3607 upstream.
+
+lib/rational.c:62: warning: data definition has no type or storage class
+lib/rational.c:62: warning: type defaults to 'int' in declaration of 'EXPORT_SYMBOL'
+lib/rational.c:62: warning: parameter names (without types) in function declaration
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: WANG Cong <xiyou.wangcong@gmail.com>
+Cc: Oskar Schirmer <os@emlix.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/rational.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/lib/rational.c
++++ b/lib/rational.c
+@@ -7,6 +7,7 @@
+ */
+
+ #include <linux/rational.h>
++#include <linux/module.h>
+
+ /*
+ * calculate best rational approximation for a given fraction
--- /dev/null
+From 7d92df692994472cab6045bbd9d0e2c4afa4365f Mon Sep 17 00:00:00 2001
+From: Anna Lemehova <EXT-Anna.Lemehova@nokia.com>
+Date: Fri, 8 Jan 2010 14:42:58 -0800
+Subject: mmc_block: add dev_t initialization check
+
+From: Anna Lemehova <EXT-Anna.Lemehova@nokia.com>
+
+commit 7d92df692994472cab6045bbd9d0e2c4afa4365f upstream.
+
+When a card is removed before mmc_blk_probe() has called add_disk(), then
+the minor field is uninitialized and has value 0. This caused
+mmc_blk_put() to always release devidx 0 even if 0 was still in use. Then
+the next mmc_blk_probe() used the first free idx of 0, which oopses in
+sysfs, since it is used by another card.
+
+Signed-off-by: Anna Lemehova <EXT-Anna.Lemehova@nokia.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
+Cc: <linux-mmc@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/card/block.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -85,7 +85,12 @@ static void mmc_blk_put(struct mmc_blk_d
+ mutex_lock(&open_lock);
+ md->usage--;
+ if (md->usage == 0) {
++ int devmaj = MAJOR(disk_devt(md->disk));
+ int devidx = MINOR(disk_devt(md->disk)) >> MMC_SHIFT;
++
++ if (!devmaj)
++ devidx = md->disk->first_minor >> MMC_SHIFT;
++
+ __clear_bit(devidx, dev_use);
+
+ put_disk(md->disk);
--- /dev/null
+From 0a74ff29b8dd8b748f8856352f9a9b5c6cc362cc Mon Sep 17 00:00:00 2001
+From: Jarkko Lavinen <jarkko.lavinen@nokia.com>
+Date: Fri, 8 Jan 2010 14:42:59 -0800
+Subject: mmc_block: fix probe error cleanup bug
+
+From: Jarkko Lavinen <jarkko.lavinen@nokia.com>
+
+commit 0a74ff29b8dd8b748f8856352f9a9b5c6cc362cc upstream.
+
+If mmc_blk_set_blksize() fails mmc_blk_probe() the request queue and its
+thread have been set up and they need to be shut down properly before
+putting the disk.
+
+Signed-off-by: Jarkko Lavinen <jarkko.lavinen@nokia.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
+Cc: <linux-mmc@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/card/block.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -618,6 +618,7 @@ static int mmc_blk_probe(struct mmc_card
+ return 0;
+
+ out:
++ mmc_cleanup_queue(&md->queue);
+ mmc_blk_put(md);
+
+ return err;
--- /dev/null
+From 5fa83ce284a4b7cd9dcfadd01500b0ed4ab9b740 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@nokia.com>
+Date: Fri, 8 Jan 2010 14:43:00 -0800
+Subject: mmc_block: fix queue cleanup
+
+From: Adrian Hunter <adrian.hunter@nokia.com>
+
+commit 5fa83ce284a4b7cd9dcfadd01500b0ed4ab9b740 upstream.
+
+The main bug was that 'blk_cleanup_queue()' was called while the block
+device could still be in use, for example, because the card was removed
+while files were still open.
+
+In addition, to be sure that 'mmc_request()' will get called for all new
+requests (so it can error them out), the queue is emptied during cleanup.
+This is done after the worker thread is stopped to avoid racing with it.
+
+Finally, it is not a device error for this to be happening, so quiet the
+(sometimes very many) error messages.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
+Cc: <linux-mmc@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/card/block.c | 2 ++
+ drivers/mmc/card/queue.c | 18 +++++++++---------
+ 2 files changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -91,6 +91,8 @@ static void mmc_blk_put(struct mmc_blk_d
+ if (!devmaj)
+ devidx = md->disk->first_minor >> MMC_SHIFT;
+
++ blk_cleanup_queue(md->queue.queue);
++
+ __clear_bit(devidx, dev_use);
+
+ put_disk(md->disk);
+--- a/drivers/mmc/card/queue.c
++++ b/drivers/mmc/card/queue.c
+@@ -90,9 +90,10 @@ static void mmc_request(struct request_q
+ struct request *req;
+
+ if (!mq) {
+- printk(KERN_ERR "MMC: killing requests for dead queue\n");
+- while ((req = blk_fetch_request(q)) != NULL)
++ while ((req = blk_fetch_request(q)) != NULL) {
++ req->cmd_flags |= REQ_QUIET;
+ __blk_end_request_all(req, -EIO);
++ }
+ return;
+ }
+
+@@ -223,17 +224,18 @@ void mmc_cleanup_queue(struct mmc_queue
+ struct request_queue *q = mq->queue;
+ unsigned long flags;
+
+- /* Mark that we should start throwing out stragglers */
+- spin_lock_irqsave(q->queue_lock, flags);
+- q->queuedata = NULL;
+- spin_unlock_irqrestore(q->queue_lock, flags);
+-
+ /* Make sure the queue isn't suspended, as that will deadlock */
+ mmc_queue_resume(mq);
+
+ /* Then terminate our worker thread */
+ kthread_stop(mq->thread);
+
++ /* Empty the queue */
++ spin_lock_irqsave(q->queue_lock, flags);
++ q->queuedata = NULL;
++ blk_start_queue(q);
++ spin_unlock_irqrestore(q->queue_lock, flags);
++
+ if (mq->bounce_sg)
+ kfree(mq->bounce_sg);
+ mq->bounce_sg = NULL;
+@@ -245,8 +247,6 @@ void mmc_cleanup_queue(struct mmc_queue
+ kfree(mq->bounce_buf);
+ mq->bounce_buf = NULL;
+
+- blk_cleanup_queue(mq->queue);
+-
+ mq->card = NULL;
+ }
+ EXPORT_SYMBOL(mmc_cleanup_queue);
--- /dev/null
+From 10b465aaf9536ee5a16652fa0700740183d48ec9 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sat, 19 Dec 2009 14:43:01 +0000
+Subject: modules: Skip empty sections when exporting section notes
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 10b465aaf9536ee5a16652fa0700740183d48ec9 upstream.
+
+Commit 35dead4 "modules: don't export section names of empty sections
+via sysfs" changed the set of sections that have attributes, but did
+not change the iteration over these attributes in add_notes_attrs().
+This can lead to add_notes_attrs() creating attributes with the wrong
+names or with null name pointers.
+
+Introduce a sect_empty() function and use it in both add_sect_attrs()
+and add_notes_attrs().
+
+Reported-by: Martin Michlmayr <tbm@cyrius.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Tested-by: Martin Michlmayr <tbm@cyrius.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/module.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1146,6 +1146,12 @@ static const struct kernel_symbol *resol
+ * J. Corbet <corbet@lwn.net>
+ */
+ #if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
++
++static inline bool sect_empty(const Elf_Shdr *sect)
++{
++ return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
++}
++
+ struct module_sect_attr
+ {
+ struct module_attribute mattr;
+@@ -1187,8 +1193,7 @@ static void add_sect_attrs(struct module
+
+ /* Count loaded sections and allocate structures */
+ for (i = 0; i < nsect; i++)
+- if (sechdrs[i].sh_flags & SHF_ALLOC
+- && sechdrs[i].sh_size)
++ if (!sect_empty(&sechdrs[i]))
+ nloaded++;
+ size[0] = ALIGN(sizeof(*sect_attrs)
+ + nloaded * sizeof(sect_attrs->attrs[0]),
+@@ -1206,9 +1211,7 @@ static void add_sect_attrs(struct module
+ sattr = §_attrs->attrs[0];
+ gattr = §_attrs->grp.attrs[0];
+ for (i = 0; i < nsect; i++) {
+- if (! (sechdrs[i].sh_flags & SHF_ALLOC))
+- continue;
+- if (!sechdrs[i].sh_size)
++ if (sect_empty(&sechdrs[i]))
+ continue;
+ sattr->address = sechdrs[i].sh_addr;
+ sattr->name = kstrdup(secstrings + sechdrs[i].sh_name,
+@@ -1292,7 +1295,7 @@ static void add_notes_attrs(struct modul
+ /* Count notes sections and allocate structures. */
+ notes = 0;
+ for (i = 0; i < nsect; i++)
+- if ((sechdrs[i].sh_flags & SHF_ALLOC) &&
++ if (!sect_empty(&sechdrs[i]) &&
+ (sechdrs[i].sh_type == SHT_NOTE))
+ ++notes;
+
+@@ -1308,7 +1311,7 @@ static void add_notes_attrs(struct modul
+ notes_attrs->notes = notes;
+ nattr = ¬es_attrs->attrs[0];
+ for (loaded = i = 0; i < nsect; ++i) {
+- if (!(sechdrs[i].sh_flags & SHF_ALLOC))
++ if (sect_empty(&sechdrs[i]))
+ continue;
+ if (sechdrs[i].sh_type == SHT_NOTE) {
+ nattr->attr.name = mod->sect_attrs->attrs[loaded].name;
--- /dev/null
+From dce766af541f6605fa9889892c0280bab31c66ab Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fwestphal@astaro.com>
+Date: Fri, 8 Jan 2010 17:31:24 +0100
+Subject: netfilter: ebtables: enforce CAP_NET_ADMIN
+
+From: Florian Westphal <fwestphal@astaro.com>
+
+commit dce766af541f6605fa9889892c0280bab31c66ab upstream.
+
+normal users are currently allowed to set/modify ebtables rules.
+Restrict it to processes with CAP_NET_ADMIN.
+
+Note that this cannot be reproduced with unmodified ebtables binary
+because it uses SOCK_RAW.
+
+Signed-off-by: Florian Westphal <fwestphal@astaro.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bridge/netfilter/ebtables.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1406,6 +1406,9 @@ static int do_ebt_set_ctl(struct sock *s
+ {
+ int ret;
+
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++
+ switch(cmd) {
+ case EBT_SO_SET_ENTRIES:
+ ret = do_replace(sock_net(sk), user, len);
+@@ -1425,6 +1428,9 @@ static int do_ebt_get_ctl(struct sock *s
+ struct ebt_replace tmp;
+ struct ebt_table *t;
+
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++
+ if (copy_from_user(&tmp, user, sizeof(tmp)))
+ return -EFAULT;
+
--- /dev/null
+From aaff23a95aea5f000895f50d90e91f1e2f727002 Mon Sep 17 00:00:00 2001
+From: Patrick McHardy <kaber@trash.net>
+Date: Thu, 7 Jan 2010 18:33:18 +0100
+Subject: netfilter: nf_ct_ftp: fix out of bounds read in update_nl_seq()
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit aaff23a95aea5f000895f50d90e91f1e2f727002 upstream.
+
+As noticed by Dan Carpenter <error27@gmail.com>, update_nl_seq()
+currently contains an out of bounds read of the seq_aft_nl array
+when looking for the oldest sequence number position.
+
+Fix it to only compare valid positions.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/nf_conntrack_ftp.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_ftp.c
++++ b/net/netfilter/nf_conntrack_ftp.c
+@@ -323,24 +323,24 @@ static void update_nl_seq(struct nf_conn
+ struct nf_ct_ftp_master *info, int dir,
+ struct sk_buff *skb)
+ {
+- unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;
++ unsigned int i, oldest;
+
+ /* Look for oldest: if we find exact match, we're done. */
+ for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
+ if (info->seq_aft_nl[dir][i] == nl_seq)
+ return;
+-
+- if (oldest == info->seq_aft_nl_num[dir] ||
+- before(info->seq_aft_nl[dir][i],
+- info->seq_aft_nl[dir][oldest]))
+- oldest = i;
+ }
+
+ if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
+ info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
+- } else if (oldest != NUM_SEQ_TO_REMEMBER &&
+- after(nl_seq, info->seq_aft_nl[dir][oldest])) {
+- info->seq_aft_nl[dir][oldest] = nl_seq;
++ } else {
++ if (before(info->seq_aft_nl[dir][0], info->seq_aft_nl[dir][1]))
++ oldest = 0;
++ else
++ oldest = 1;
++
++ if (after(nl_seq, info->seq_aft_nl[dir][oldest]))
++ info->seq_aft_nl[dir][oldest] = nl_seq;
+ }
+ }
+
--- /dev/null
+From 7211a4e859ad070b28545c06e0a6cb60b3b8aa31 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Fri, 25 Dec 2009 17:44:45 +0100
+Subject: nfsd: make sure data is on disk before calling ->fsync
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 7211a4e859ad070b28545c06e0a6cb60b3b8aa31 upstream.
+
+nfsd is not using vfs_fsync, so I missed it when changing the calling
+convention during the 2.6.32 window. This patch fixes it to not only
+start the data writeout, but also wait for it to complete before calling
+into ->fsync.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -774,12 +774,9 @@ static inline int nfsd_dosync(struct fil
+ int (*fsync) (struct file *, struct dentry *, int);
+ int err;
+
+- err = filemap_fdatawrite(inode->i_mapping);
++ err = filemap_write_and_wait(inode->i_mapping);
+ if (err == 0 && fop && (fsync = fop->fsync))
+ err = fsync(filp, dp, 0);
+- if (err == 0)
+- err = filemap_fdatawait(inode->i_mapping);
+-
+ return err;
+ }
+
--- /dev/null
+From 05b5d898235401c489c68e1f3bc5706a29ad5713 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 6 Jan 2010 18:03:36 +0100
+Subject: quota: Fix dquot_transfer for filesystems different from ext4
+
+From: Jan Kara <jack@suse.cz>
+
+commit 05b5d898235401c489c68e1f3bc5706a29ad5713 upstream.
+
+Commit fd8fbfc1 modified the way we find amount of reserved space
+belonging to an inode. The amount of reserved space is checked
+from dquot_transfer and thus inode_reserved_space gets called
+even for filesystems that don't provide get_reserved_space callback
+which results in a BUG.
+
+Fix the problem by checking get_reserved_space callback and return 0 if
+the filesystem does not provide it.
+
+CC: Dmitry Monakhov <dmonakhov@openvz.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/quota/dquot.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -1425,6 +1425,9 @@ static void inode_sub_rsv_space(struct i
+ static qsize_t inode_get_rsv_space(struct inode *inode)
+ {
+ qsize_t ret;
++
++ if (!inode->i_sb->dq_op->get_reserved_space)
++ return 0;
+ spin_lock(&inode->i_lock);
+ ret = *inode_reserved_space(inode);
+ spin_unlock(&inode->i_lock);
--- /dev/null
+From db677ffa5f5a4f15b9dad4d132b3477b80766d82 Mon Sep 17 00:00:00 2001
+From: Rusty Russell <rusty@rustcorp.com.au>
+Date: Tue, 5 Jan 2010 12:48:49 +1030
+Subject: Revert "x86: Side-step lguest problem by only building cmpxchg8b_emu for pre-Pentium"
+
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit db677ffa5f5a4f15b9dad4d132b3477b80766d82 upstream.
+
+This reverts commit ae1b22f6e46c03cede7cea234d0bf2253b4261cf.
+
+As Linus said in 982d007a6ee: "There was something really messy about
+cmpxchg8b and clone CPU's, so if you enable it on other CPUs later, do it
+carefully."
+
+This breaks lguest for those configs, but we can fix that by emulating
+if we have to.
+
+Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=14884
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/Kconfig.cpu | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/Kconfig.cpu
++++ b/arch/x86/Kconfig.cpu
+@@ -400,7 +400,7 @@ config X86_TSC
+
+ config X86_CMPXCHG64
+ def_bool y
+- depends on !M386 && !M486
++ depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
+
+ # this should be set for all -march=.. options where the compiler
+ # generates cmov.
--- /dev/null
+From 004731b2c7c658d36bee167cb1e1a399c2cbccc9 Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Fri, 8 Jan 2010 14:43:11 -0800
+Subject: rtc_cmos: convert shutdown to new pnp_driver->shutdown
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit 004731b2c7c658d36bee167cb1e1a399c2cbccc9 upstream.
+
+commit abd6633c67925f90775bb74755f9c547e30f1f20 ("pnp: add a shutdown
+method to pnp drivers") adds shutdown method to bus driver blindly. With
+it, driver->shutdown is no longer valid.
+
+Use pnp_driver->shutdown instead.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14889
+
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Reported-by: Malte Schröder <maltesch@gmx.de>
+Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
+Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
+Cc: David Hardeman <david@hardeman.nu>
+Cc: Dmitry Torokhov <dtor@mail.ru>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Paul Gortmaker <p_gortmaker@yahoo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/rtc-cmos.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -1099,9 +1099,9 @@ static int cmos_pnp_resume(struct pnp_de
+ #define cmos_pnp_resume NULL
+ #endif
+
+-static void cmos_pnp_shutdown(struct device *pdev)
++static void cmos_pnp_shutdown(struct pnp_dev *pnp)
+ {
+- if (system_state == SYSTEM_POWER_OFF && !cmos_poweroff(pdev))
++ if (system_state == SYSTEM_POWER_OFF && !cmos_poweroff(&pnp->dev))
+ return;
+
+ cmos_do_shutdown();
+@@ -1120,15 +1120,12 @@ static struct pnp_driver cmos_pnp_driver
+ .id_table = rtc_ids,
+ .probe = cmos_pnp_probe,
+ .remove = __exit_p(cmos_pnp_remove),
++ .shutdown = cmos_pnp_shutdown,
+
+ /* flag ensures resume() gets called, and stops syslog spam */
+ .flags = PNP_DRIVER_RES_DO_NOT_CHANGE,
+ .suspend = cmos_pnp_suspend,
+ .resume = cmos_pnp_resume,
+- .driver = {
+- .name = (char *)driver_name,
+- .shutdown = cmos_pnp_shutdown,
+- }
+ };
+
+ #endif /* CONFIG_PNP */
--- /dev/null
+fasync-split-fasync_helper-into-separate-add-remove-functions.patch
+asoc-fix-params_rate-macro-use-in-several-codecs.patch
+modules-skip-empty-sections-when-exporting-section-notes.patch
+exofs-simple_write_end-does-not-mark_inode_dirty.patch
+revert-x86-side-step-lguest-problem-by-only-building-cmpxchg8b_emu-for-pre-pentium.patch
+nfsd-make-sure-data-is-on-disk-before-calling-fsync.patch
+sunrpc-fix-peername-failed-on-closed-listener.patch
+sunrpc-fix-up-an-error-return-value-in-gss_import_sec_context_kerberos.patch
+sunrpc-fix-the-return-value-in-gss_import_sec_context.patch
+sunrpc-on-successful-gss-error-pipe-write-don-t-return-error.patch
+drm-i915-update-lvds-connector-status-when-receiving-acpi-lid-event.patch
+drm-i915-fix-order-of-fence-release-wrt-flushing.patch
+drm-i915-permit-pinning-whilst-the-device-is-suspended.patch
+drm-remove-address-mask-param-for-drm_pci_alloc.patch
+drm-i915-enable-disable-the-dithering-for-lvds-based-on-vbt-setting.patch
+drm-i915-make-the-bpc-in-fdi-rx-transcoder-be-consistent-with-that-in-pipeconf-on-ironlake.patch
+drm-i915-select-the-correct-bpc-for-lvds-on-ironlake.patch
+drm-i915-fix-unused-var.patch
+rtc_cmos-convert-shutdown-to-new-pnp_driver-shutdown.patch
+drivers-cpuidle-governors-menu.c-fix-undefined-reference-to-__udivdi3.patch
+cgroups-fix-2.6.32-regression-causing-bug_on-in-cgroup_diput.patch
+lib-rational.c-needs-module.h.patch
+dma-debug-allow-dma_bidirectional-mappings-to-be-synced-with-dma_from_device-and.patch
+kernel-signal.c-fix-kernel-information-leak-with-print-fatal-signals-1.patch
+mmc_block-add-dev_t-initialization-check.patch
+mmc_block-fix-probe-error-cleanup-bug.patch
+mmc_block-fix-queue-cleanup.patch
+alsa-hda-fix-alc861-vd-capture-source-mixer.patch
+alsa-ac97-add-dell-dimension-2400-to-headphone-line-jack-sense-blacklist.patch
+alsa-atiixp-specify-codec-for-foxconn-rc4107ma-rs2.patch
+asoc-fix-wm8350-dsp-mode-b-configuration.patch
+netfilter-ebtables-enforce-cap_net_admin.patch
+netfilter-nf_ct_ftp-fix-out-of-bounds-read-in-update_nl_seq.patch
+hwmon-coretemp-fix-tjmax-for-atom-n450-d410-d510-cpus.patch
+hwmon-adt7462-fix-pin-28-monitoring.patch
+quota-fix-dquot_transfer-for-filesystems-different-from-ext4.patch
--- /dev/null
+From b292cf9ce70d221c3f04ff62db5ab13d9a249ca8 Mon Sep 17 00:00:00 2001
+From: Xiaotian Feng <dfeng@redhat.com>
+Date: Thu, 31 Dec 2009 10:52:36 +0800
+Subject: sunrpc: fix peername failed on closed listener
+
+From: Xiaotian Feng <dfeng@redhat.com>
+
+commit b292cf9ce70d221c3f04ff62db5ab13d9a249ca8 upstream.
+
+There're some warnings of "nfsd: peername failed (err 107)!"
+socket error -107 means Transport endpoint is not connected.
+This warning message was outputed by svc_tcp_accept() [net/sunrpc/svcsock.c],
+when kernel_getpeername returns -107. This means socket might be CLOSED.
+
+And svc_tcp_accept was called by svc_recv() [net/sunrpc/svc_xprt.c]
+
+ if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
+ <snip>
+ newxpt = xprt->xpt_ops->xpo_accept(xprt);
+ <snip>
+
+So this might happen when xprt->xpt_flags has both XPT_LISTENER and XPT_CLOSE.
+
+Let's take a look at commit b0401d72, this commit has moved the close
+processing after do recvfrom method, but this commit also introduces this
+warnings, if the xpt_flags has both XPT_LISTENER and XPT_CLOSED, we should
+close it, not accpet then close.
+
+Signed-off-by: Xiaotian Feng <dfeng@redhat.com>
+Cc: J. Bruce Fields <bfields@fieldses.org>
+Cc: Neil Brown <neilb@suse.de>
+Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Nikola Ciprich <extmaillist@linuxbox.cz>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/svc_xprt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -711,7 +711,8 @@ int svc_recv(struct svc_rqst *rqstp, lon
+ spin_unlock_bh(&pool->sp_lock);
+
+ len = 0;
+- if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
++ if (test_bit(XPT_LISTENER, &xprt->xpt_flags) &&
++ !test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
+ struct svc_xprt *newxpt;
+ newxpt = xprt->xpt_ops->xpo_accept(xprt);
+ if (newxpt) {
--- /dev/null
+From b891e4a05ef6beac85465295a032431577c66b16 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 18 Dec 2009 16:28:12 -0500
+Subject: SUNRPC: Fix the return value in gss_import_sec_context()
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit b891e4a05ef6beac85465295a032431577c66b16 upstream.
+
+If the context allocation fails, it will return GSS_S_FAILURE, which is
+neither a valid error code, nor is it even negative.
+
+Return ENOMEM instead...
+
+Reported-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/gss_mech_switch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sunrpc/auth_gss/gss_mech_switch.c
++++ b/net/sunrpc/auth_gss/gss_mech_switch.c
+@@ -252,7 +252,7 @@ gss_import_sec_context(const void *input
+ struct gss_ctx **ctx_id)
+ {
+ if (!(*ctx_id = kzalloc(sizeof(**ctx_id), GFP_KERNEL)))
+- return GSS_S_FAILURE;
++ return -ENOMEM;
+ (*ctx_id)->mech_type = gss_mech_get(mech);
+
+ return mech->gm_ops
--- /dev/null
+From 14ace024b1e16d2bb9445c8387494fbbd820a738 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 18 Dec 2009 16:28:05 -0500
+Subject: SUNRPC: Fix up an error return value in gss_import_sec_context_kerberos()
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 14ace024b1e16d2bb9445c8387494fbbd820a738 upstream.
+
+If the context allocation fails, the function currently returns a random
+error code, since the variable 'p' still points to a valid memory location.
+
+Ensure that it returns ENOMEM...
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/gss_krb5_mech.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
++++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
+@@ -131,8 +131,10 @@ gss_import_sec_context_kerberos(const vo
+ struct krb5_ctx *ctx;
+ int tmp;
+
+- if (!(ctx = kzalloc(sizeof(*ctx), GFP_NOFS)))
++ if (!(ctx = kzalloc(sizeof(*ctx), GFP_NOFS))) {
++ p = ERR_PTR(-ENOMEM);
+ goto out_err;
++ }
+
+ p = simple_get_bytes(p, end, &ctx->initiate, sizeof(ctx->initiate));
+ if (IS_ERR(p))
--- /dev/null
+From 486bad2e40e938cd68fd853b7a9fa3115a9d3a4a Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Fri, 18 Dec 2009 16:28:20 -0500
+Subject: sunrpc: on successful gss error pipe write, don't return error
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 486bad2e40e938cd68fd853b7a9fa3115a9d3a4a upstream.
+
+When handling the gssd downcall, the kernel should distinguish between a
+successful downcall that contains an error code and a failed downcall
+(i.e. where the parsing failed or some other sort of problem occurred).
+
+In the former case, gss_pipe_downcall should be returning the number of
+bytes written to the pipe instead of an error. In the event of other
+errors, we generally want the initiating task to retry the upcall so
+we set msg.errno to -EAGAIN. An unexpected error code here is a bug
+however, so BUG() in that case.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/auth_gss.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -644,7 +644,22 @@ gss_pipe_downcall(struct file *filp, con
+ p = gss_fill_context(p, end, ctx, gss_msg->auth->mech);
+ if (IS_ERR(p)) {
+ err = PTR_ERR(p);
+- gss_msg->msg.errno = (err == -EAGAIN) ? -EAGAIN : -EACCES;
++ switch (err) {
++ case -EACCES:
++ gss_msg->msg.errno = err;
++ err = mlen;
++ break;
++ case -EFAULT:
++ case -ENOMEM:
++ case -EINVAL:
++ case -ENOSYS:
++ gss_msg->msg.errno = -EAGAIN;
++ break;
++ default:
++ printk(KERN_CRIT "%s: bad return from "
++ "gss_fill_context: %ld\n", __func__, err);
++ BUG();
++ }
+ goto err_release_msg;
+ }
+ gss_msg->ctx = gss_get_ctx(ctx);
projects / thirdparty / kernel / stable-queue.git / commitdiff
