--- /dev/null
+From b189e810619a676e6b931a942a3e8387f3d39c21 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?fran=C3=A7ois=20romieu?= <romieu@fr.zoreil.com>
+Date: Sun, 8 Jan 2012 13:41:33 +0000
+Subject: 8139cp: fix missing napi_gro_flush.
+
+From: Francois Romieu <romieu@fr.zoreil.com>
+
+commit b189e810619a676e6b931a942a3e8387f3d39c21 upstream.
+
+The driver uses __napi_complete and napi_gro_receive. Without it, the
+driver hits the BUG_ON(n->gro_list) assertion hard in __napi_complete.
+
+Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Tested-by: Marin Glibic <zhilla2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/realtek/8139cp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -563,6 +563,7 @@ rx_next:
+ if (cpr16(IntrStatus) & cp_rx_intr_mask)
+ goto rx_status_loop;
+
++ napi_gro_flush(napi);
+ spin_lock_irqsave(&cp->lock, flags);
+ __napi_complete(napi);
+ cpw16_f(IntrMask, cp_intr_mask);
--- /dev/null
+From 097354eb14fa94d31a09c64d640643f58e4a5a9a Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Sun, 27 Nov 2011 18:58:17 +0100
+Subject: drm/i915: check ACTHD of all rings
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 097354eb14fa94d31a09c64d640643f58e4a5a9a upstream.
+
+Otherwise hangcheck spuriously fires when running blitter/bsd-only
+workloads.
+
+Contrary to a similar patch by Ben Widawsky this does not check
+INSTDONE of the other rings. Chris Wilson implied that in a failure to
+detect a hang, most likely because INSTDONE was fluctuating. Thus only
+check ACTHD, which as far as I know is rather reliable. Also, blitter
+and bsd rings can't launch complex tasks from a single instruction
+(like 3D_PRIM on the render with complex or even infinite shaders).
+
+This fixes spurious gpu hang detection when running
+tests/gem_hangcheck_forcewake on snb/ivb.
+
+Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 2 ++
+ drivers/gpu/drm/i915/i915_irq.c | 13 ++++++++++---
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -337,6 +337,8 @@ typedef struct drm_i915_private {
+ struct timer_list hangcheck_timer;
+ int hangcheck_count;
+ uint32_t last_acthd;
++ uint32_t last_acthd_bsd;
++ uint32_t last_acthd_blt;
+ uint32_t last_instdone;
+ uint32_t last_instdone1;
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1669,7 +1669,7 @@ void i915_hangcheck_elapsed(unsigned lon
+ {
+ struct drm_device *dev = (struct drm_device *)data;
+ drm_i915_private_t *dev_priv = dev->dev_private;
+- uint32_t acthd, instdone, instdone1;
++ uint32_t acthd, instdone, instdone1, acthd_bsd, acthd_blt;
+ bool err = false;
+
+ if (!i915_enable_hangcheck)
+@@ -1686,16 +1686,21 @@ void i915_hangcheck_elapsed(unsigned lon
+ }
+
+ if (INTEL_INFO(dev)->gen < 4) {
+- acthd = I915_READ(ACTHD);
+ instdone = I915_READ(INSTDONE);
+ instdone1 = 0;
+ } else {
+- acthd = I915_READ(ACTHD_I965);
+ instdone = I915_READ(INSTDONE_I965);
+ instdone1 = I915_READ(INSTDONE1);
+ }
++ acthd = intel_ring_get_active_head(&dev_priv->ring[RCS]);
++ acthd_bsd = HAS_BSD(dev) ?
++ intel_ring_get_active_head(&dev_priv->ring[VCS]) : 0;
++ acthd_blt = HAS_BLT(dev) ?
++ intel_ring_get_active_head(&dev_priv->ring[BCS]) : 0;
+
+ if (dev_priv->last_acthd == acthd &&
++ dev_priv->last_acthd_bsd == acthd_bsd &&
++ dev_priv->last_acthd_blt == acthd_blt &&
+ dev_priv->last_instdone == instdone &&
+ dev_priv->last_instdone1 == instdone1) {
+ if (dev_priv->hangcheck_count++ > 1) {
+@@ -1727,6 +1732,8 @@ void i915_hangcheck_elapsed(unsigned lon
+ dev_priv->hangcheck_count = 0;
+
+ dev_priv->last_acthd = acthd;
++ dev_priv->last_acthd_bsd = acthd_bsd;
++ dev_priv->last_acthd_blt = acthd_blt;
+ dev_priv->last_instdone = instdone;
+ dev_priv->last_instdone1 = instdone1;
+ }
--- /dev/null
+From 8109021313c7a3d8947677391ce6ab9cd0bb1d28 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel@ffwll.ch>
+Date: Fri, 13 Jan 2012 16:20:06 -0800
+Subject: drm/i915: convert force_wake_get to func pointer in the gpu reset code
+
+From: Daniel Vetter <daniel@ffwll.ch>
+
+commit 8109021313c7a3d8947677391ce6ab9cd0bb1d28 upstream.
+
+This was forgotten in the original multi-threaded forcewake
+conversion:
+
+commit 8d715f0024f64ad1b1be85d8c081cf577944c847
+Author: Keith Packard <keithp at keithp.com>
+Date: Fri Nov 18 20:39:01 2011 -0800
+
+ drm/i915: add multi-threaded forcewake support
+
+Signed-Off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -645,7 +645,7 @@ int i915_reset(struct drm_device *dev, u
+ ret = gen6_do_reset(dev, flags);
+ /* If reset with a user forcewake, try to restore */
+ if (atomic_read(&dev_priv->forcewake_count))
+- __gen6_gt_force_wake_get(dev_priv);
++ dev_priv->display.force_wake_get(dev_priv);
+ break;
+ case 5:
+ ret = ironlake_do_reset(dev, flags);
--- /dev/null
+From 832afda6a7d7235ef0e09f4ec46736861540da6d Mon Sep 17 00:00:00 2001
+From: Wu Fengguang <fengguang.wu@intel.com>
+Date: Fri, 9 Dec 2011 20:42:21 +0800
+Subject: drm/i915: DisplayPort hot remove notification to audio driver
+
+From: Wu Fengguang <fengguang.wu@intel.com>
+
+commit 832afda6a7d7235ef0e09f4ec46736861540da6d upstream.
+
+On DP monitor hot remove, clear DP_AUDIO_OUTPUT_ENABLE accordingly,
+so that the audio driver will receive hot plug events and take action
+to refresh its device state and ELD contents.
+
+Note that the DP_AUDIO_OUTPUT_ENABLE bit may be enabled or disabled
+only when the link training is complete and set to "Normal".
+
+Tested OK for both hot plug/remove and DPMS on/off.
+
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1926,6 +1926,7 @@ intel_dp_link_down(struct intel_dp *inte
+ intel_wait_for_vblank(dev, to_intel_crtc(crtc)->pipe);
+ }
+
++ DP &= ~DP_AUDIO_OUTPUT_ENABLE;
+ I915_WRITE(intel_dp->output_reg, DP & ~DP_PORT_EN);
+ POSTING_READ(intel_dp->output_reg);
+ msleep(intel_dp->panel_power_down_delay);
--- /dev/null
+From 23bd15ec662344dc10e9918fdd0dbc58bc71526d Mon Sep 17 00:00:00 2001
+From: Rodrigo Vivi <rodrigo.vivi@gmail.com>
+Date: Wed, 14 Dec 2011 21:10:06 -0200
+Subject: drm/i915: Fix TV Out refresh rate.
+
+From: Rodrigo Vivi <rodrigo.vivi@gmail.com>
+
+commit 23bd15ec662344dc10e9918fdd0dbc58bc71526d upstream.
+
+TV Out refresh rate was half of the specification for almost all modes.
+Due to this reason pixel clock was so low for some modes causing flickering screen.
+
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_tv.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -417,7 +417,7 @@ static const struct tv_mode tv_modes[] =
+ {
+ .name = "NTSC-M",
+ .clock = 108000,
+- .refresh = 29970,
++ .refresh = 59940,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+ /* 525 Lines, 60 Fields, 15.734KHz line, Sub-Carrier 3.580MHz */
+@@ -460,7 +460,7 @@ static const struct tv_mode tv_modes[] =
+ {
+ .name = "NTSC-443",
+ .clock = 108000,
+- .refresh = 29970,
++ .refresh = 59940,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+ /* 525 Lines, 60 Fields, 15.734KHz line, Sub-Carrier 4.43MHz */
+@@ -502,7 +502,7 @@ static const struct tv_mode tv_modes[] =
+ {
+ .name = "NTSC-J",
+ .clock = 108000,
+- .refresh = 29970,
++ .refresh = 59940,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+
+@@ -545,7 +545,7 @@ static const struct tv_mode tv_modes[] =
+ {
+ .name = "PAL-M",
+ .clock = 108000,
+- .refresh = 29970,
++ .refresh = 59940,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+
+@@ -589,7 +589,7 @@ static const struct tv_mode tv_modes[] =
+ /* 625 Lines, 50 Fields, 15.625KHz line, Sub-Carrier 4.434MHz */
+ .name = "PAL-N",
+ .clock = 108000,
+- .refresh = 25000,
++ .refresh = 50000,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+
+@@ -634,7 +634,7 @@ static const struct tv_mode tv_modes[] =
+ /* 625 Lines, 50 Fields, 15.625KHz line, Sub-Carrier 4.434MHz */
+ .name = "PAL",
+ .clock = 108000,
+- .refresh = 25000,
++ .refresh = 50000,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+
+@@ -821,7 +821,7 @@ static const struct tv_mode tv_modes[] =
+ {
+ .name = "1080i@50Hz",
+ .clock = 148800,
+- .refresh = 25000,
++ .refresh = 50000,
+ .oversample = TV_OVERSAMPLE_2X,
+ .component_only = 1,
+
+@@ -847,7 +847,7 @@ static const struct tv_mode tv_modes[] =
+ {
+ .name = "1080i@60Hz",
+ .clock = 148800,
+- .refresh = 30000,
++ .refresh = 60000,
+ .oversample = TV_OVERSAMPLE_2X,
+ .component_only = 1,
+
--- /dev/null
+From 07c1e8c1462fa7324de4c36ae9e55da2abd79cee Mon Sep 17 00:00:00 2001
+From: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Date: Sat, 7 Jan 2012 23:40:35 -0200
+Subject: drm/i915: handle 3rd pipe
+
+From: Eugeni Dodonov <eugeni.dodonov@intel.com>
+
+commit 07c1e8c1462fa7324de4c36ae9e55da2abd79cee upstream.
+
+We don't need to check 3rd pipe specifically, as it shares PLL with some
+other one.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41977
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_suspend.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_suspend.c
++++ b/drivers/gpu/drm/i915/i915_suspend.c
+@@ -34,6 +34,10 @@ static bool i915_pipe_enabled(struct drm
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ u32 dpll_reg;
+
++ /* On IVB, 3rd pipe shares PLL with another one */
++ if (pipe > 1)
++ return false;
++
+ if (HAS_PCH_SPLIT(dev))
+ dpll_reg = (pipe == PIPE_A) ? _PCH_DPLL_A : _PCH_DPLL_B;
+ else
--- /dev/null
+From 2deed761188d7480eb5f7efbfe7aa77f09322ed8 Mon Sep 17 00:00:00 2001
+From: Wu Fengguang <fengguang.wu@intel.com>
+Date: Fri, 9 Dec 2011 20:42:20 +0800
+Subject: drm/i915: HDMI hot remove notification to audio driver
+
+From: Wu Fengguang <fengguang.wu@intel.com>
+
+commit 2deed761188d7480eb5f7efbfe7aa77f09322ed8 upstream.
+
+On HDMI monitor hot remove, clear SDVO_AUDIO_ENABLE accordingly, so that
+the audio driver will receive hot plug events and take action to refresh
+its device state and ELD contents.
+
+The cleared SDVO_AUDIO_ENABLE bit needs to be restored to prevent losing
+HDMI audio after DPMS on.
+
+CC: Wang Zhenyu <zhenyu.z.wang@intel.com>
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_hdmi.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -269,6 +269,10 @@ static void intel_hdmi_dpms(struct drm_e
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
+ u32 temp;
++ u32 enable_bits = SDVO_ENABLE;
++
++ if (intel_hdmi->has_audio)
++ enable_bits |= SDVO_AUDIO_ENABLE;
+
+ temp = I915_READ(intel_hdmi->sdvox_reg);
+
+@@ -281,9 +285,9 @@ static void intel_hdmi_dpms(struct drm_e
+ }
+
+ if (mode != DRM_MODE_DPMS_ON) {
+- temp &= ~SDVO_ENABLE;
++ temp &= ~enable_bits;
+ } else {
+- temp |= SDVO_ENABLE;
++ temp |= enable_bits;
+ }
+
+ I915_WRITE(intel_hdmi->sdvox_reg, temp);
--- /dev/null
+From 9f1f46a45a681d357d1ceedecec3671a5ae957f4 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed, 14 Dec 2011 13:57:03 +0100
+Subject: drm/i915: protect force_wake_(get|put) with the gt_lock
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 9f1f46a45a681d357d1ceedecec3671a5ae957f4 upstream.
+
+The problem this patch solves is that the forcewake accounting
+necessary for register reads is protected by dev->struct_mutex. But the
+hangcheck and error_capture code need to access registers without
+grabbing this mutex because we hold it while waiting for the gpu.
+So a new lock is required. Because currently the error_state capture
+is called from the error irq handler and the hangcheck code runs from
+a timer, it needs to be an irqsafe spinlock (note that the registers
+used by the irq handler (neglecting the error handling part) only uses
+registers that don't need the forcewake dance).
+
+We could tune this down to a normal spinlock when we rework the
+error_state capture and hangcheck code to run from a workqueue. But
+we don't have any read in a fastpath that needs forcewake, so I've
+decided to not care much about overhead.
+
+This prevents tests/gem_hangcheck_forcewake from i-g-t from killing my
+snb on recent kernels - something must have slightly changed the
+timings. On previous kernels it only trigger a WARN about the broken
+locking.
+
+v2: Drop the previous patch for the register writes.
+
+v3: Improve the commit message per Chris Wilson's suggestions.
+
+Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_debugfs.c | 8 ++++++--
+ drivers/gpu/drm/i915/i915_dma.c | 1 +
+ drivers/gpu/drm/i915/i915_drv.c | 18 ++++++++++++------
+ drivers/gpu/drm/i915/i915_drv.h | 10 +++++++---
+ 4 files changed, 26 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -1314,9 +1314,13 @@ static int i915_gen6_forcewake_count_inf
+ struct drm_info_node *node = (struct drm_info_node *) m->private;
+ struct drm_device *dev = node->minor->dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
++ unsigned forcewake_count;
+
+- seq_printf(m, "forcewake count = %d\n",
+- atomic_read(&dev_priv->forcewake_count));
++ spin_lock_irq(&dev_priv->gt_lock);
++ forcewake_count = dev_priv->forcewake_count;
++ spin_unlock_irq(&dev_priv->gt_lock);
++
++ seq_printf(m, "forcewake count = %u\n", forcewake_count);
+
+ return 0;
+ }
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -2042,6 +2042,7 @@ int i915_driver_load(struct drm_device *
+ if (!IS_I945G(dev) && !IS_I945GM(dev))
+ pci_enable_msi(dev->pdev);
+
++ spin_lock_init(&dev_priv->gt_lock);
+ spin_lock_init(&dev_priv->irq_lock);
+ spin_lock_init(&dev_priv->error_lock);
+ spin_lock_init(&dev_priv->rps_lock);
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -368,11 +368,12 @@ void __gen6_gt_force_wake_mt_get(struct
+ */
+ void gen6_gt_force_wake_get(struct drm_i915_private *dev_priv)
+ {
+- WARN_ON(!mutex_is_locked(&dev_priv->dev->struct_mutex));
++ unsigned long irqflags;
+
+- /* Forcewake is atomic in case we get in here without the lock */
+- if (atomic_add_return(1, &dev_priv->forcewake_count) == 1)
++ spin_lock_irqsave(&dev_priv->gt_lock, irqflags);
++ if (dev_priv->forcewake_count++ == 0)
+ dev_priv->display.force_wake_get(dev_priv);
++ spin_unlock_irqrestore(&dev_priv->gt_lock, irqflags);
+ }
+
+ void __gen6_gt_force_wake_put(struct drm_i915_private *dev_priv)
+@@ -392,10 +393,12 @@ void __gen6_gt_force_wake_mt_put(struct
+ */
+ void gen6_gt_force_wake_put(struct drm_i915_private *dev_priv)
+ {
+- WARN_ON(!mutex_is_locked(&dev_priv->dev->struct_mutex));
++ unsigned long irqflags;
+
+- if (atomic_dec_and_test(&dev_priv->forcewake_count))
++ spin_lock_irqsave(&dev_priv->gt_lock, irqflags);
++ if (--dev_priv->forcewake_count == 0)
+ dev_priv->display.force_wake_put(dev_priv);
++ spin_unlock_irqrestore(&dev_priv->gt_lock, irqflags);
+ }
+
+ void __gen6_gt_wait_for_fifo(struct drm_i915_private *dev_priv)
+@@ -626,6 +629,7 @@ int i915_reset(struct drm_device *dev, u
+ * need to
+ */
+ bool need_display = true;
++ unsigned long irqflags;
+ int ret;
+
+ if (!i915_try_reset)
+@@ -644,8 +648,10 @@ int i915_reset(struct drm_device *dev, u
+ case 6:
+ ret = gen6_do_reset(dev, flags);
+ /* If reset with a user forcewake, try to restore */
+- if (atomic_read(&dev_priv->forcewake_count))
++ spin_lock_irqsave(&dev_priv->gt_lock, irqflags);
++ if (dev_priv->forcewake_count)
+ dev_priv->display.force_wake_get(dev_priv);
++ spin_unlock_irqrestore(&dev_priv->gt_lock, irqflags);
+ break;
+ case 5:
+ ret = ironlake_do_reset(dev, flags);
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -286,7 +286,13 @@ typedef struct drm_i915_private {
+ int relative_constants_mode;
+
+ void __iomem *regs;
+- u32 gt_fifo_count;
++ /** gt_fifo_count and the subsequent register write are synchronized
++ * with dev->struct_mutex. */
++ unsigned gt_fifo_count;
++ /** forcewake_count is protected by gt_lock */
++ unsigned forcewake_count;
++ /** gt_lock is also taken in irq contexts. */
++ struct spinlock gt_lock;
+
+ struct intel_gmbus {
+ struct i2c_adapter adapter;
+@@ -738,8 +744,6 @@ typedef struct drm_i915_private {
+
+ struct drm_property *broadcast_rgb_property;
+ struct drm_property *force_audio_property;
+-
+- atomic_t forcewake_count;
+ } drm_i915_private_t;
+
+ enum i915_cache_level {
--- /dev/null
+From 684a3ff7e69acc7c678d1a1394fe9e757993fd34 Mon Sep 17 00:00:00 2001
+From: Li Wang <liwang@nudt.edu.cn>
+Date: Thu, 19 Jan 2012 09:44:36 +0800
+Subject: eCryptfs: Infinite loop due to overflow in ecryptfs_write()
+
+From: Li Wang <liwang@nudt.edu.cn>
+
+commit 684a3ff7e69acc7c678d1a1394fe9e757993fd34 upstream.
+
+ecryptfs_write() can enter an infinite loop when truncating a file to a
+size larger than 4G. This only happens on architectures where size_t is
+represented by 32 bits.
+
+This was caused by a size_t overflow due to it incorrectly being used to
+store the result of a calculation which uses potentially large values of
+type loff_t.
+
+[tyhicks@canonical.com: rewrite subject and commit message]
+Signed-off-by: Li Wang <liwang@nudt.edu.cn>
+Signed-off-by: Yunchuan Wen <wenyunchuan@kylinos.com.cn>
+Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ecryptfs/read_write.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/ecryptfs/read_write.c
++++ b/fs/ecryptfs/read_write.c
+@@ -130,7 +130,7 @@ int ecryptfs_write(struct inode *ecryptf
+ pgoff_t ecryptfs_page_idx = (pos >> PAGE_CACHE_SHIFT);
+ size_t start_offset_in_page = (pos & ~PAGE_CACHE_MASK);
+ size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
+- size_t total_remaining_bytes = ((offset + size) - pos);
++ loff_t total_remaining_bytes = ((offset + size) - pos);
+
+ if (fatal_signal_pending(current)) {
+ rc = -EINTR;
+@@ -141,7 +141,7 @@ int ecryptfs_write(struct inode *ecryptf
+ num_bytes = total_remaining_bytes;
+ if (pos < offset) {
+ /* remaining zeros to write, up to destination offset */
+- size_t total_remaining_zeros = (offset - pos);
++ loff_t total_remaining_zeros = (offset - pos);
+
+ if (num_bytes > total_remaining_zeros)
+ num_bytes = total_remaining_zeros;
sched-rt-fix-task-stack-corruption-under-__arch_want_interrupts_on_ctxsw.patch
pm-hibernate-thaw-processes-in-snapshot_create_image-ioctl-test-path.patch
pm-hibernate-thaw-kernel-threads-in-snapshot_create_image-ioctl-path.patch
+8139cp-fix-missing-napi_gro_flush.patch
+udf-mark-lvid-buffer-as-uptodate-before-marking-it-dirty.patch
+drm-i915-hdmi-hot-remove-notification-to-audio-driver.patch
+drm-i915-displayport-hot-remove-notification-to-audio-driver.patch
+drm-i915-check-acthd-of-all-rings.patch
+drm-i915-fix-tv-out-refresh-rate.patch
+drm-i915-handle-3rd-pipe.patch
+drm-i915-convert-force_wake_get-to-func-pointer-in-the-gpu-reset-code.patch
+drm-i915-protect-force_wake_-get-put-with-the-gt_lock.patch
+ecryptfs-infinite-loop-due-to-overflow-in-ecryptfs_write.patch
--- /dev/null
+From 853a0c25baf96b028de1654bea1e0c8857eadf3d Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Fri, 23 Dec 2011 11:53:07 +0100
+Subject: udf: Mark LVID buffer as uptodate before marking it dirty
+
+From: Jan Kara <jack@suse.cz>
+
+commit 853a0c25baf96b028de1654bea1e0c8857eadf3d upstream.
+
+When we hit EIO while writing LVID, the buffer uptodate bit is cleared.
+This then results in an anoying warning from mark_buffer_dirty() when we
+write the buffer again. So just set uptodate flag unconditionally.
+
+Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/udf/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1799,6 +1799,12 @@ static void udf_close_lvid(struct super_
+ le16_to_cpu(lvid->descTag.descCRCLength)));
+
+ lvid->descTag.tagChecksum = udf_tag_checksum(&lvid->descTag);
++ /*
++ * We set buffer uptodate unconditionally here to avoid spurious
++ * warnings from mark_buffer_dirty() when previous EIO has marked
++ * the buffer as !uptodate
++ */
++ set_buffer_uptodate(bh);
+ mark_buffer_dirty(bh);
+ sbi->s_lvid_dirty = 0;
+ mutex_unlock(&sbi->s_alloc_mutex);
projects / thirdparty / kernel / stable-queue.git / commitdiff
