--- /dev/null
+From 0613a59456980161d0cd468bae6c63d772743102 Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Mon, 1 Nov 2010 01:14:51 -0400
+Subject: ALSA: ac97: Apply quirk for Dell Latitude D610 binding Master and Headphone controls
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit 0613a59456980161d0cd468bae6c63d772743102 upstream.
+
+BugLink: https://launchpad.net/bugs/669279
+
+The original reporter states: "The Master mixer does not change the
+volume from the headphone output (which is affected by the headphone
+mixer). Instead it only seems to control the on-board speaker volume.
+This confuses PulseAudio greatly as the Master channel is merged into
+the volume mix."
+
+Fix this symptom by applying the hp_only quirk for the reporter's SSID.
+The fix is applicable to all stable kernels.
+
+Reported-and-tested-by: Ben Gamari <bgamari@gmail.com>
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/intel8x0.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/intel8x0.c
++++ b/sound/pci/intel8x0.c
+@@ -1866,6 +1866,12 @@ static struct ac97_quirk ac97_quirks[] _
+ },
+ {
+ .subvendor = 0x1028,
++ .subdevice = 0x0182,
++ .name = "Dell Latitude D610", /* STAC9750/51 */
++ .type = AC97_TUNE_HP_ONLY
++ },
++ {
++ .subvendor = 0x1028,
+ .subdevice = 0x0186,
+ .name = "Dell Latitude D810", /* cf. Malone #41015 */
+ .type = AC97_TUNE_HP_MUTE_LED
--- /dev/null
+From 60686aa0086a14f8b15c83a09f3df1eebe3aab3c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 30 Nov 2010 08:14:21 +0100
+Subject: ALSA: Fix SNDCTL_DSP_RESET ioctl for OSS emulation
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 60686aa0086a14f8b15c83a09f3df1eebe3aab3c upstream.
+
+In OSS emulation, SNDCTL_DSP_RESET ioctl needs the reset of the internal
+buffer state in addition to drop of the running streams. Otherwise the
+succeeding access becomes inconsistent.
+
+Tested-by: Amit Nagal <helloin.amit@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/oss/pcm_oss.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -1510,16 +1510,19 @@ static ssize_t snd_pcm_oss_read1(struct
+ static int snd_pcm_oss_reset(struct snd_pcm_oss_file *pcm_oss_file)
+ {
+ struct snd_pcm_substream *substream;
++ struct snd_pcm_runtime *runtime;
++ int i;
+
+- substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
+- if (substream != NULL) {
++ for (i = 0; i < 2; i++) {
++ substream = pcm_oss_file->streams[i];
++ if (!substream)
++ continue;
++ runtime = substream->runtime;
+ snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+- substream->runtime->oss.prepare = 1;
+- }
+- substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
+- if (substream != NULL) {
+- snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+- substream->runtime->oss.prepare = 1;
++ runtime->oss.prepare = 1;
++ runtime->oss.buffer_used = 0;
++ runtime->oss.prev_hw_ptr_period = 0;
++ runtime->oss.period_ptr = 0;
+ }
+ return 0;
+ }
--- /dev/null
+From cc1c452e509aefc28f7ad2deed75bc69d4f915f7 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Wed, 24 Nov 2010 14:17:47 +0100
+Subject: ALSA: HDA: Add an extra DAC for Realtek ALC887-VD
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit cc1c452e509aefc28f7ad2deed75bc69d4f915f7 upstream.
+
+The patch enables ALC887-VD to use the DAC at nid 0x26,
+which makes it possible to use this DAC for e g Headphone
+volume.
+
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -18612,6 +18612,8 @@ static inline hda_nid_t alc662_mix_to_da
+ return 0x02;
+ else if (nid >= 0x0c && nid <= 0x0e)
+ return nid - 0x0c + 0x02;
++ else if (nid == 0x26) /* ALC887-VD has this DAC too */
++ return 0x25;
+ else
+ return 0;
+ }
+@@ -18620,7 +18622,7 @@ static inline hda_nid_t alc662_mix_to_da
+ static hda_nid_t alc662_dac_to_mix(struct hda_codec *codec, hda_nid_t pin,
+ hda_nid_t dac)
+ {
+- hda_nid_t mix[4];
++ hda_nid_t mix[5];
+ int i, num;
+
+ num = snd_hda_get_connections(codec, pin, mix, ARRAY_SIZE(mix));
--- /dev/null
+From 6cb3b707f95954ac18f19b4b3919af235738371a Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Thu, 9 Sep 2010 08:51:44 +0200
+Subject: ALSA: HDA: Add fixup pins for Ideapad Y550
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 6cb3b707f95954ac18f19b4b3919af235738371a upstream.
+
+By adding the subwoofer as a speaker pin, it is treated correctly when auto-muting.
+
+BugLink: https://launchpad.net/bugs/611803
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -18934,6 +18934,26 @@ static void alc662_auto_init(struct hda_
+ alc_inithook(codec);
+ }
+
++enum {
++ ALC662_FIXUP_IDEAPAD,
++};
++
++static const struct alc_fixup alc662_fixups[] = {
++ [ALC662_FIXUP_IDEAPAD] = {
++ .pins = (const struct alc_pincfg[]) {
++ { 0x17, 0x99130112 }, /* subwoofer */
++ { }
++ }
++ },
++};
++
++static struct snd_pci_quirk alc662_fixup_tbl[] = {
++ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
++ {}
++};
++
++
++
+ static int patch_alc662(struct hda_codec *codec)
+ {
+ struct alc_spec *spec;
+@@ -18966,6 +18986,7 @@ static int patch_alc662(struct hda_codec
+ }
+
+ if (board_config == ALC662_AUTO) {
++ alc_pick_fixup(codec, alc662_fixup_tbl, alc662_fixups, 1);
+ /* automatic parse from the BIOS config */
+ err = alc662_parse_auto_config(codec);
+ if (err < 0) {
+@@ -19024,8 +19045,11 @@ static int patch_alc662(struct hda_codec
+ spec->vmaster_nid = 0x02;
+
+ codec->patch_ops = alc_patch_ops;
+- if (board_config == ALC662_AUTO)
++ if (board_config == ALC662_AUTO) {
+ spec->init_hook = alc662_auto_init;
++ alc_pick_fixup(codec, alc662_fixup_tbl, alc662_fixups, 0);
++ }
++
+ #ifdef CONFIG_SND_HDA_POWER_SAVE
+ if (!spec->loopback.amplist)
+ spec->loopback.amplist = alc662_loopbacks;
--- /dev/null
+From a0e90acc657990511c83bc69965bfd3c63386d45 Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Sat, 20 Nov 2010 10:20:35 -0500
+Subject: ALSA: hda: Add Samsung R720 SSID for subwoofer pin fixup
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit a0e90acc657990511c83bc69965bfd3c63386d45 upstream.
+
+BugLink: https://launchpad.net/bugs/677830
+
+The original reporter states that the subwoofer does not mute when
+inserting headphones. We need an entry for his machine's SSID in the
+subwoofer pin fixup list, so add it there (verified using hda_analyzer).
+
+Reported-and-tested-by: i-NoD
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -18956,6 +18956,7 @@ static const struct alc_fixup alc662_fix
+
+ static struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
++ SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+ {}
--- /dev/null
+From 2df03514de41f3bbb5623f2e7f2bf594e49cb2ec Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Sun, 10 Oct 2010 22:39:28 -0400
+Subject: ALSA: hda: Add speaker pin to automute Acer Aspire 8943G
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit 2df03514de41f3bbb5623f2e7f2bf594e49cb2ec upstream.
+
+BugLink: https://bugs.launchpad.net/bugs/656625
+
+Add clause for handling Acer Aspire 8943G's subwoofer as additional
+speaker pin for automuting.
+
+Reported-by: RussianNeuroMancer
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -18935,10 +18935,17 @@ static void alc662_auto_init(struct hda_
+ }
+
+ enum {
++ ALC662_FIXUP_ASPIRE,
+ ALC662_FIXUP_IDEAPAD,
+ };
+
+ static const struct alc_fixup alc662_fixups[] = {
++ [ALC662_FIXUP_ASPIRE] = {
++ .pins = (const struct alc_pincfg[]) {
++ { 0x15, 0x99130112 }, /* subwoofer */
++ { }
++ }
++ },
+ [ALC662_FIXUP_IDEAPAD] = {
+ .pins = (const struct alc_pincfg[]) {
+ { 0x17, 0x99130112 }, /* subwoofer */
+@@ -18948,6 +18955,7 @@ static const struct alc_fixup alc662_fix
+ };
+
+ static struct snd_pci_quirk alc662_fixup_tbl[] = {
++ SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+ {}
--- /dev/null
+From d41185882b828896ccecac319c9f65f708baaf0d Mon Sep 17 00:00:00 2001
+From: Valentine Sinitsyn <valentine.sinitsyn@gmail.com>
+Date: Fri, 1 Oct 2010 22:24:08 +0600
+Subject: ALSA: hda - Added fixup for Lenovo Y550P
+
+From: Valentine Sinitsyn <valentine.sinitsyn@gmail.com>
+
+commit d41185882b828896ccecac319c9f65f708baaf0d upstream.
+
+Signed-off-by: Valentine Sinitsyn <valentine.sinitsyn@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -18948,6 +18948,7 @@ static const struct alc_fixup alc662_fix
+ };
+
+ static struct snd_pci_quirk alc662_fixup_tbl[] = {
++ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+ {}
+ };
--- /dev/null
+From 7167594a3da7dcc33203b85d62e519594baee390 Mon Sep 17 00:00:00 2001
+From: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
+Date: Thu, 25 Nov 2010 00:08:01 -0200
+Subject: ALSA: hda - Fix ALC660-VD/ALC861-VD capture/playback mixers
+
+From: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
+
+commit 7167594a3da7dcc33203b85d62e519594baee390 upstream.
+
+The mixer nids passed to alc_auto_create_input_ctls are wrong: 0x15 is
+a pin, and 0x09 is the ADC on both ALC660-VD/ALC861-VD. Thus with
+current code, input playback volume/switches and input source mixer
+controls are not created, and recording doesn't work. Select correct
+mixers, 0x0b (input playback mixer) and 0x22 (capture source mixer).
+
+Reference: https://qa.mandriva.com/show_bug.cgi?id=61159
+
+Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -16557,7 +16557,7 @@ static struct alc_config_preset alc861vd
+ static int alc861vd_auto_create_input_ctls(struct hda_codec *codec,
+ const struct auto_pin_cfg *cfg)
+ {
+- return alc_auto_create_input_ctls(codec, cfg, 0x15, 0x09, 0);
++ return alc_auto_create_input_ctls(codec, cfg, 0x0b, 0x22, 0);
+ }
+
+
--- /dev/null
+From 01e0f1378c47947b825eac05c98697ab1be1c86f Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Mon, 22 Nov 2010 10:59:36 +0100
+Subject: ALSA: hda - Fixed ALC887-VD initial error
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit 01e0f1378c47947b825eac05c98697ab1be1c86f upstream.
+
+ALC887-VD is like ALC888-VD. It can not be initialized as ALC882.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -19038,7 +19038,10 @@ static int patch_alc888(struct hda_codec
+ {
+ if ((alc_read_coef_idx(codec, 0) & 0x00f0)==0x0030){
+ kfree(codec->chip_name);
+- codec->chip_name = kstrdup("ALC888-VD", GFP_KERNEL);
++ if (codec->vendor_id == 0x10ec0887)
++ codec->chip_name = kstrdup("ALC887-VD", GFP_KERNEL);
++ else
++ codec->chip_name = kstrdup("ALC888-VD", GFP_KERNEL);
+ if (!codec->chip_name) {
+ alc_free(codec);
+ return -ENOMEM;
+@@ -19520,7 +19523,7 @@ static struct hda_codec_preset snd_hda_p
+ { .id = 0x10ec0885, .rev = 0x100103, .name = "ALC889A",
+ .patch = patch_alc882 },
+ { .id = 0x10ec0885, .name = "ALC885", .patch = patch_alc882 },
+- { .id = 0x10ec0887, .name = "ALC887", .patch = patch_alc882 },
++ { .id = 0x10ec0887, .name = "ALC887", .patch = patch_alc888 },
+ { .id = 0x10ec0888, .rev = 0x100101, .name = "ALC1200",
+ .patch = patch_alc882 },
+ { .id = 0x10ec0888, .name = "ALC888", .patch = patch_alc888 },
--- /dev/null
+From 5a8cfb4e8ae317d283f84122ed20faa069c5e0c4 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 26 Nov 2010 17:11:18 +0100
+Subject: ALSA: hda - Use ALC_INIT_DEFAULT for really default initialization
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 5a8cfb4e8ae317d283f84122ed20faa069c5e0c4 upstream.
+
+When SKU assid gives no valid bits for 0x38, the driver didn't take
+any action, so far. This resulted in the missing initialization for
+external amps, etc, thus the silent output in the end.
+
+Especially users hit this problem on ALC888 newly since 2.6.35,
+where the driver doesn't force to use ALC_INIT_DEFAULT any more.
+
+This patch sets the default initialization scheme to use
+ALC_INIT_DEFAULT when no valid bits are set for SKU assid.
+
+Reference:
+ https://bugzilla.redhat.com/show_bug.cgi?id=657388
+
+Reported-and-tested-by: Kyle McMartin <kyle@redhat.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1438,6 +1438,7 @@ do_sku:
+ spec->init_amp = ALC_INIT_GPIO3;
+ break;
+ case 5:
++ default:
+ spec->init_amp = ALC_INIT_DEFAULT;
+ break;
+ }
--- /dev/null
+From 0defe09ca70daccdc83abd9c3c24cd89ae6a1141 Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Wed, 1 Dec 2010 19:16:07 -0500
+Subject: ALSA: hda: Use "alienware" model quirk for another SSID
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit 0defe09ca70daccdc83abd9c3c24cd89ae6a1141 upstream.
+
+BugLink: https://launchpad.net/bugs/683695
+
+The original reporter states that headphone jacks do not appear to
+work. Upon inspecting his codec dump, and upon further testing, it is
+confirmed that the "alienware" model quirk is correct.
+
+Reported-and-tested-by: Cody Thierauf
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1619,6 +1619,8 @@ static struct snd_pci_quirk stac92hd73xx
+ static struct snd_pci_quirk stac92hd73xx_codec_id_cfg_tbl[] = {
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02a1,
+ "Alienware M17x", STAC_ALIENWARE_M17X),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x043a,
++ "Alienware M17x", STAC_ALIENWARE_M17X),
+ {} /* terminator */
+ };
+
--- /dev/null
+From 6d212d8e86fb4221bd91b9266b7567ee2b83bd01 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Fri, 29 Oct 2010 15:41:17 -0700
+Subject: ASoC: Remove volatility from WM8900 POWER1 register
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 6d212d8e86fb4221bd91b9266b7567ee2b83bd01 upstream.
+
+Not all bits can be read back from POWER1 so avoid corruption when using
+a read/modify/write cycle by marking it non-volatile - the only thing we
+read back from it is the chip revision which has diagnostic value only.
+We can re-add later but that's a more invasive change than is suitable
+for a bugfix.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8900.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/sound/soc/codecs/wm8900.c
++++ b/sound/soc/codecs/wm8900.c
+@@ -188,7 +188,6 @@ static int wm8900_volatile_register(unsi
+ {
+ switch (reg) {
+ case WM8900_REG_ID:
+- case WM8900_REG_POWER1:
+ return 1;
+ default:
+ return 0;
+@@ -1236,11 +1235,6 @@ static __devinit int wm8900_i2c_probe(st
+ goto err;
+ }
+
+- /* Read back from the chip */
+- reg = snd_soc_read(codec, WM8900_REG_POWER1);
+- reg = (reg >> 12) & 0xf;
+- dev_info(&i2c->dev, "WM8900 revision %d\n", reg);
+-
+ wm8900_reset(codec);
+
+ /* Turn the chip on */
--- /dev/null
+From 08b1a38465cab8c2224a5202c7a3b5e5f5630894 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@gmail.com>
+Date: Wed, 24 Nov 2010 10:20:33 +0800
+Subject: ASoC: wm8961 - clear WM8961_DACSLOPE bit for normal mode
+
+From: Axel Lin <axel.lin@gmail.com>
+
+commit 08b1a38465cab8c2224a5202c7a3b5e5f5630894 upstream.
+
+DACSLOPE bit of Register 06h ADC and DAC Control 2:
+ 0: Normal mode
+ 1: Sloping stop-band mode
+
+Thus in the case of normal mode, we should clear DACSLOPE bit.
+
+Signed-off-by: Axel Lin <axel.lin@gmail.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8961.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8961.c
++++ b/sound/soc/codecs/wm8961.c
+@@ -711,7 +711,7 @@ static int wm8961_hw_params(struct snd_p
+ if (fs <= 24000)
+ reg |= WM8961_DACSLOPE;
+ else
+- reg &= WM8961_DACSLOPE;
++ reg &= ~WM8961_DACSLOPE;
+ snd_soc_write(codec, WM8961_ADC_DAC_CONTROL_2, reg);
+
+ return 0;
--- /dev/null
+From 2f7dceeda4708f470fd927adb3861bd8ebbe2310 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@gmail.com>
+Date: Wed, 24 Nov 2010 10:21:54 +0800
+Subject: ASoC: wm8961 - clear WM8961_MCLKDIV bit for freq <= 16500000
+
+From: Axel Lin <axel.lin@gmail.com>
+
+commit 2f7dceeda4708f470fd927adb3861bd8ebbe2310 upstream.
+
+MCLKDIV bit of Register 04h Clocking1:
+ 0 : Divide by 1
+ 1 : Divide by 2
+
+Thus in the case of freq <= 16500000, we should clear MCLKDIV bit.
+
+Signed-off-by: Axel Lin <axel.lin@gmail.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8961.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8961.c
++++ b/sound/soc/codecs/wm8961.c
+@@ -736,7 +736,7 @@ static int wm8961_set_sysclk(struct snd_
+ freq /= 2;
+ } else {
+ dev_dbg(codec->dev, "Using MCLK/1 for %dHz MCLK\n", freq);
+- reg &= WM8961_MCLKDIV;
++ reg &= ~WM8961_MCLKDIV;
+ }
+
+ snd_soc_write(codec, WM8961_CLOCKING1, reg);
--- /dev/null
+From cb4644cac4a2797afc847e6c92736664d4b0ea34 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <jaxboe@fusionio.com>
+Date: Wed, 10 Nov 2010 14:36:25 +0100
+Subject: bio: take care not overflow page count when mapping/copying user data
+
+From: Jens Axboe <jaxboe@fusionio.com>
+
+commit cb4644cac4a2797afc847e6c92736664d4b0ea34 upstream.
+
+If the iovec is being set up in a way that causes uaddr + PAGE_SIZE
+to overflow, we could end up attempting to map a huge number of
+pages. Check for this invalid input type.
+
+Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/bio.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -834,6 +834,12 @@ struct bio *bio_copy_user_iov(struct req
+ end = (uaddr + iov[i].iov_len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ start = uaddr >> PAGE_SHIFT;
+
++ /*
++ * Overflow, abort
++ */
++ if (end < start)
++ return ERR_PTR(-EINVAL);
++
+ nr_pages += end - start;
+ len += iov[i].iov_len;
+ }
+@@ -962,6 +968,12 @@ static struct bio *__bio_map_user_iov(st
+ unsigned long end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ unsigned long start = uaddr >> PAGE_SHIFT;
+
++ /*
++ * Overflow, abort
++ */
++ if (end < start)
++ return ERR_PTR(-EINVAL);
++
+ nr_pages += end - start;
+ /*
+ * buffer must be aligned to at least hardsector size for now
+@@ -989,7 +1001,7 @@ static struct bio *__bio_map_user_iov(st
+ unsigned long start = uaddr >> PAGE_SHIFT;
+ const int local_nr_pages = end - start;
+ const int page_limit = cur_page + local_nr_pages;
+-
++
+ ret = get_user_pages_fast(uaddr, local_nr_pages,
+ write_to_vm, &pages[cur_page]);
+ if (ret < local_nr_pages) {
--- /dev/null
+From abe1def46d84aa27d3f84d729204b162e8c64d76 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Fri, 1 Oct 2010 18:13:41 -0300
+Subject: [media] drivers/media/video/cx23885/cx23885-core.c: fix cx23885_dev_checkrevision()
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit abe1def46d84aa27d3f84d729204b162e8c64d76 upstream.
+
+It was missing the `break'.
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=18672
+
+Reported-by: Igor <i2g2r2@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx23885/cx23885-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/video/cx23885/cx23885-core.c
++++ b/drivers/media/video/cx23885/cx23885-core.c
+@@ -815,6 +815,7 @@ static void cx23885_dev_checkrevision(st
+ case 0x0e:
+ /* CX23887-15Z */
+ dev->hwrevision = 0xc0;
++ break;
+ case 0x0f:
+ /* CX23887-14Z */
+ dev->hwrevision = 0xb1;
--- /dev/null
+From 3074adc8b6d9bf28b574a58241b958057a69a7a0 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Tue, 30 Nov 2010 00:15:10 -0500
+Subject: drm/radeon/kms: add workaround for dce3 ddc line vbios bug
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 3074adc8b6d9bf28b574a58241b958057a69a7a0 upstream.
+
+fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=23752
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_atombios.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -98,6 +98,14 @@ static inline struct radeon_i2c_bus_rec
+ }
+ }
+
++ /* some DCE3 boards have bad data for this entry */
++ if (ASIC_IS_DCE3(rdev)) {
++ if ((i == 4) &&
++ (gpio->usClkMaskRegisterIndex == 0x1fda) &&
++ (gpio->sucI2cId.ucAccess == 0x94))
++ gpio->sucI2cId.ucAccess = 0x14;
++ }
++
+ if (gpio->sucI2cId.ucAccess == id) {
+ i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4;
+ i2c.mask_data_reg = le16_to_cpu(gpio->usDataMaskRegisterIndex) * 4;
+@@ -174,6 +182,14 @@ void radeon_atombios_i2c_init(struct rad
+ }
+ }
+
++ /* some DCE3 boards have bad data for this entry */
++ if (ASIC_IS_DCE3(rdev)) {
++ if ((i == 4) &&
++ (gpio->usClkMaskRegisterIndex == 0x1fda) &&
++ (gpio->sucI2cId.ucAccess == 0x94))
++ gpio->sucI2cId.ucAccess = 0x14;
++ }
++
+ i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4;
+ i2c.mask_data_reg = le16_to_cpu(gpio->usDataMaskRegisterIndex) * 4;
+ i2c.en_clk_reg = le16_to_cpu(gpio->usClkEnRegisterIndex) * 4;
--- /dev/null
+From c7a71fc761551dc8be8543f14a90d08cda4e77f9 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Wed, 17 Nov 2010 02:49:40 -0500
+Subject: drm/radeon/kms/atom: set sane defaults in atombios_get_encoder_mode()
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit c7a71fc761551dc8be8543f14a90d08cda4e77f9 upstream.
+
+If there was no connector mapped to the encoder, atombios_get_encoder_mode()
+returned 0 which is the id for DP. Return something sane instead based on
+the encoder id. This avoids hitting the DP paths on non-DP encoders.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_encoders.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_encoders.c
+@@ -595,6 +595,7 @@ atombios_digital_setup(struct drm_encode
+ int
+ atombios_get_encoder_mode(struct drm_encoder *encoder)
+ {
++ struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+ struct drm_device *dev = encoder->dev;
+ struct radeon_device *rdev = dev->dev_private;
+ struct drm_connector *connector;
+@@ -602,9 +603,20 @@ atombios_get_encoder_mode(struct drm_enc
+ struct radeon_connector_atom_dig *dig_connector;
+
+ connector = radeon_get_connector_for_encoder(encoder);
+- if (!connector)
+- return 0;
+-
++ if (!connector) {
++ switch (radeon_encoder->encoder_id) {
++ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
++ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
++ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
++ case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
++ case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1:
++ return ATOM_ENCODER_MODE_DVI;
++ case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC1:
++ case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC2:
++ default:
++ return ATOM_ENCODER_MODE_CRT;
++ }
++ }
+ radeon_connector = to_radeon_connector(connector);
+
+ switch (connector->connector_type) {
--- /dev/null
+From be66305718bee9927e6acc6b75618ce3cd745718 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 18 Nov 2010 17:18:08 -0500
+Subject: drm/radeon/kms: fix i2c pad masks on rs4xx
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit be66305718bee9927e6acc6b75618ce3cd745718 upstream.
+
+These got lost in the last i2c cleanup. Fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=23222
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_combios.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -571,6 +571,7 @@ static struct radeon_i2c_bus_rec combios
+ }
+
+ if (clk_mask && data_mask) {
++ /* system specific masks */
+ i2c.mask_clk_mask = clk_mask;
+ i2c.mask_data_mask = data_mask;
+ i2c.a_clk_mask = clk_mask;
+@@ -579,7 +580,19 @@ static struct radeon_i2c_bus_rec combios
+ i2c.en_data_mask = data_mask;
+ i2c.y_clk_mask = clk_mask;
+ i2c.y_data_mask = data_mask;
++ } else if ((ddc_line == RADEON_GPIOPAD_MASK) ||
++ (ddc_line == RADEON_MDGPIO_MASK)) {
++ /* default gpiopad masks */
++ i2c.mask_clk_mask = (0x20 << 8);
++ i2c.mask_data_mask = 0x80;
++ i2c.a_clk_mask = (0x20 << 8);
++ i2c.a_data_mask = 0x80;
++ i2c.en_clk_mask = (0x20 << 8);
++ i2c.en_data_mask = 0x80;
++ i2c.y_clk_mask = (0x20 << 8);
++ i2c.y_data_mask = 0x80;
+ } else {
++ /* default masks for ddc pads */
+ i2c.mask_clk_mask = RADEON_GPIO_EN_1;
+ i2c.mask_data_mask = RADEON_GPIO_EN_0;
+ i2c.a_clk_mask = RADEON_GPIO_A_1;
--- /dev/null
+From c49948f4bd39e27dd06a1cdb0c3743ca2a734f5e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Tue, 30 Nov 2010 15:46:47 -0500
+Subject: drm/radeon/kms: fix interlaced and doublescan handling
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit c49948f4bd39e27dd06a1cdb0c3743ca2a734f5e upstream.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 34 +++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -1119,6 +1119,8 @@ radeon_add_atom_connector(struct drm_dev
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+ connector->polled = DRM_CONNECTOR_POLL_CONNECT;
++ connector->interlace_allowed = true;
++ connector->doublescan_allowed = true;
+ break;
+ case DRM_MODE_CONNECTOR_DVIA:
+ drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
+@@ -1134,6 +1136,8 @@ radeon_add_atom_connector(struct drm_dev
+ 1);
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
++ connector->interlace_allowed = true;
++ connector->doublescan_allowed = true;
+ break;
+ case DRM_MODE_CONNECTOR_DVII:
+ case DRM_MODE_CONNECTOR_DVID:
+@@ -1163,6 +1167,11 @@ radeon_add_atom_connector(struct drm_dev
+ rdev->mode_info.load_detect_property,
+ 1);
+ }
++ connector->interlace_allowed = true;
++ if (connector_type == DRM_MODE_CONNECTOR_DVII)
++ connector->doublescan_allowed = true;
++ else
++ connector->doublescan_allowed = false;
+ break;
+ case DRM_MODE_CONNECTOR_HDMIA:
+ case DRM_MODE_CONNECTOR_HDMIB:
+@@ -1186,6 +1195,11 @@ radeon_add_atom_connector(struct drm_dev
+ rdev->mode_info.underscan_property,
+ UNDERSCAN_AUTO);
+ subpixel_order = SubPixelHorizontalRGB;
++ connector->interlace_allowed = true;
++ if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
++ connector->doublescan_allowed = true;
++ else
++ connector->doublescan_allowed = false;
+ break;
+ case DRM_MODE_CONNECTOR_DisplayPort:
+ case DRM_MODE_CONNECTOR_eDP:
+@@ -1216,6 +1230,9 @@ radeon_add_atom_connector(struct drm_dev
+ drm_connector_attach_property(&radeon_connector->base,
+ rdev->mode_info.underscan_property,
+ UNDERSCAN_AUTO);
++ connector->interlace_allowed = true;
++ /* in theory with a DP to VGA converter... */
++ connector->doublescan_allowed = false;
+ break;
+ case DRM_MODE_CONNECTOR_SVIDEO:
+ case DRM_MODE_CONNECTOR_Composite:
+@@ -1231,6 +1248,8 @@ radeon_add_atom_connector(struct drm_dev
+ radeon_atombios_get_tv_info(rdev));
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
++ connector->interlace_allowed = false;
++ connector->doublescan_allowed = false;
+ break;
+ case DRM_MODE_CONNECTOR_LVDS:
+ radeon_dig_connector = kzalloc(sizeof(struct radeon_connector_atom_dig), GFP_KERNEL);
+@@ -1249,6 +1268,8 @@ radeon_add_atom_connector(struct drm_dev
+ dev->mode_config.scaling_mode_property,
+ DRM_MODE_SCALE_FULLSCREEN);
+ subpixel_order = SubPixelHorizontalRGB;
++ connector->interlace_allowed = false;
++ connector->doublescan_allowed = false;
+ break;
+ }
+
+@@ -1326,6 +1347,8 @@ radeon_add_legacy_connector(struct drm_d
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+ connector->polled = DRM_CONNECTOR_POLL_CONNECT;
++ connector->interlace_allowed = true;
++ connector->doublescan_allowed = true;
+ break;
+ case DRM_MODE_CONNECTOR_DVIA:
+ drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
+@@ -1341,6 +1364,8 @@ radeon_add_legacy_connector(struct drm_d
+ 1);
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
++ connector->interlace_allowed = true;
++ connector->doublescan_allowed = true;
+ break;
+ case DRM_MODE_CONNECTOR_DVII:
+ case DRM_MODE_CONNECTOR_DVID:
+@@ -1358,6 +1383,11 @@ radeon_add_legacy_connector(struct drm_d
+ 1);
+ }
+ subpixel_order = SubPixelHorizontalRGB;
++ connector->interlace_allowed = true;
++ if (connector_type == DRM_MODE_CONNECTOR_DVII)
++ connector->doublescan_allowed = true;
++ else
++ connector->doublescan_allowed = false;
+ break;
+ case DRM_MODE_CONNECTOR_SVIDEO:
+ case DRM_MODE_CONNECTOR_Composite:
+@@ -1380,6 +1410,8 @@ radeon_add_legacy_connector(struct drm_d
+ radeon_combios_get_tv_info(rdev));
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
++ connector->interlace_allowed = false;
++ connector->doublescan_allowed = false;
+ break;
+ case DRM_MODE_CONNECTOR_LVDS:
+ drm_connector_init(dev, &radeon_connector->base, &radeon_lvds_connector_funcs, connector_type);
+@@ -1393,6 +1425,8 @@ radeon_add_legacy_connector(struct drm_d
+ dev->mode_config.scaling_mode_property,
+ DRM_MODE_SCALE_FULLSCREEN);
+ subpixel_order = SubPixelHorizontalRGB;
++ connector->interlace_allowed = false;
++ connector->doublescan_allowed = false;
+ break;
+ }
+
--- /dev/null
+From 791cfe2684a74ed7155254816ff9e89e6064277c Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Sun, 21 Nov 2010 10:58:05 -0500
+Subject: drm/radeon/kms: fix regression in rs4xx i2c setup
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 791cfe2684a74ed7155254816ff9e89e6064277c upstream.
+
+typo in my last i2c rework.
+
+Fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=23222
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_combios.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -729,7 +729,7 @@ void radeon_combios_i2c_init(struct rade
+ clk = RBIOS8(offset + 3 + (i * 5) + 3);
+ data = RBIOS8(offset + 3 + (i * 5) + 4);
+ i2c = combios_setup_i2c_bus(rdev, DDC_MONID,
+- clk, data);
++ (1 << clk), (1 << data));
+ rdev->i2c_bus[4] = radeon_i2c_create(dev, &i2c, "GPIOPAD_MASK");
+ break;
+ }
--- /dev/null
+From f24d86f1a49505cdea56728b853a5d0a3f8e3d11 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Fri, 19 Nov 2010 23:27:04 +0000
+Subject: drm/radeon/kms: fix resume regression for some r5xx laptops
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit f24d86f1a49505cdea56728b853a5d0a3f8e3d11 upstream.
+
+I had removed this when I switched the atom indirect io methods
+to use the io bar rather than the mmio bar, but it appears it's
+still needed.
+
+Reported-by: Mark Lord <kernel@teksavvy.com>
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atom.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -112,6 +112,7 @@ static uint32_t atom_iio_execute(struct
+ base += 3;
+ break;
+ case ATOM_IIO_WRITE:
++ (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
+ ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp);
+ base += 3;
+ break;
--- /dev/null
+From 2b66b50b12cabc05f05543e792d4c9c2465d5702 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <daenzer@vmware.com>
+Date: Tue, 9 Nov 2010 11:50:05 +0100
+Subject: drm/radeon/kms: Fix retrying ttm_bo_init() after it failed once.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <daenzer@vmware.com>
+
+commit 2b66b50b12cabc05f05543e792d4c9c2465d5702 upstream.
+
+If ttm_bo_init() returns failure, it already destroyed the BO, so we need to
+retry from scratch.
+
+Signed-off-by: Michel Dänzer <daenzer@vmware.com>
+Tested-by: Markus Trippelsdorf <markus@trippelsdorf.de>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_object.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -102,6 +102,8 @@ int radeon_bo_create(struct radeon_devic
+ type = ttm_bo_type_device;
+ }
+ *bo_ptr = NULL;
++
++retry:
+ bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
+ if (bo == NULL)
+ return -ENOMEM;
+@@ -109,8 +111,6 @@ int radeon_bo_create(struct radeon_devic
+ bo->gobj = gobj;
+ bo->surface_reg = -1;
+ INIT_LIST_HEAD(&bo->list);
+-
+-retry:
+ radeon_ttm_placement_from_domain(bo, domain);
+ /* Kernel allocation are uninterruptible */
+ mutex_lock(&rdev->vram_mutex);
--- /dev/null
+From b2298fd27127f872881048fd37cb9217a648ae06 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Mon, 8 Nov 2010 18:39:18 +0000
+Subject: drm/radeon/kms: fix thermal sensor reporting on rv6xx
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit b2298fd27127f872881048fd37cb9217a648ae06 upstream.
+
+Temperature is not shifted as on newer asics.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/r600.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -97,14 +97,8 @@ u32 rv6xx_get_temp(struct radeon_device
+ {
+ u32 temp = (RREG32(CG_THERMAL_STATUS) & ASIC_T_MASK) >>
+ ASIC_T_SHIFT;
+- u32 actual_temp = 0;
+
+- if ((temp >> 7) & 1)
+- actual_temp = 0;
+- else
+- actual_temp = (temp >> 1) & 0xff;
+-
+- return actual_temp * 1000;
++ return temp * 1000;
+ }
+
+ void r600_pm_get_dynpm_state(struct radeon_device *rdev)
--- /dev/null
+From 0ec80d645661dda50acd417bdfcb33df2e5dd31e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Tue, 30 Nov 2010 19:11:45 -0500
+Subject: drm/radeon/kms: fix typos in disabled vbios code
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 0ec80d645661dda50acd417bdfcb33df2e5dd31e upstream.
+
+6xx/7xx was hitting the wrong BUS_CNTL reg and bits.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/r600_reg.h | 1 +
+ drivers/gpu/drm/radeon/radeon_bios.c | 13 +++++++------
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/r600_reg.h
++++ b/drivers/gpu/drm/radeon/r600_reg.h
+@@ -86,6 +86,7 @@
+ #define R600_HDP_NONSURFACE_BASE 0x2c04
+
+ #define R600_BUS_CNTL 0x5420
++# define R600_BIOS_ROM_DIS (1 << 1)
+ #define R600_CONFIG_CNTL 0x5424
+ #define R600_CONFIG_MEMSIZE 0x5428
+ #define R600_CONFIG_F0_BASE 0x542C
+--- a/drivers/gpu/drm/radeon/radeon_bios.c
++++ b/drivers/gpu/drm/radeon/radeon_bios.c
+@@ -130,6 +130,7 @@ static bool radeon_atrm_get_bios(struct
+ }
+ return true;
+ }
++
+ static bool r700_read_disabled_bios(struct radeon_device *rdev)
+ {
+ uint32_t viph_control;
+@@ -143,7 +144,7 @@ static bool r700_read_disabled_bios(stru
+ bool r;
+
+ viph_control = RREG32(RADEON_VIPH_CONTROL);
+- bus_cntl = RREG32(RADEON_BUS_CNTL);
++ bus_cntl = RREG32(R600_BUS_CNTL);
+ d1vga_control = RREG32(AVIVO_D1VGA_CONTROL);
+ d2vga_control = RREG32(AVIVO_D2VGA_CONTROL);
+ vga_render_control = RREG32(AVIVO_VGA_RENDER_CONTROL);
+@@ -152,7 +153,7 @@ static bool r700_read_disabled_bios(stru
+ /* disable VIP */
+ WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
+ /* enable the rom */
+- WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
++ WREG32(R600_BUS_CNTL, (bus_cntl & ~R600_BIOS_ROM_DIS));
+ /* Disable VGA mode */
+ WREG32(AVIVO_D1VGA_CONTROL,
+ (d1vga_control & ~(AVIVO_DVGA_CONTROL_MODE_ENABLE |
+@@ -191,7 +192,7 @@ static bool r700_read_disabled_bios(stru
+ cg_spll_status = RREG32(R600_CG_SPLL_STATUS);
+ }
+ WREG32(RADEON_VIPH_CONTROL, viph_control);
+- WREG32(RADEON_BUS_CNTL, bus_cntl);
++ WREG32(R600_BUS_CNTL, bus_cntl);
+ WREG32(AVIVO_D1VGA_CONTROL, d1vga_control);
+ WREG32(AVIVO_D2VGA_CONTROL, d2vga_control);
+ WREG32(AVIVO_VGA_RENDER_CONTROL, vga_render_control);
+@@ -216,7 +217,7 @@ static bool r600_read_disabled_bios(stru
+ bool r;
+
+ viph_control = RREG32(RADEON_VIPH_CONTROL);
+- bus_cntl = RREG32(RADEON_BUS_CNTL);
++ bus_cntl = RREG32(R600_BUS_CNTL);
+ d1vga_control = RREG32(AVIVO_D1VGA_CONTROL);
+ d2vga_control = RREG32(AVIVO_D2VGA_CONTROL);
+ vga_render_control = RREG32(AVIVO_VGA_RENDER_CONTROL);
+@@ -231,7 +232,7 @@ static bool r600_read_disabled_bios(stru
+ /* disable VIP */
+ WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
+ /* enable the rom */
+- WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
++ WREG32(R600_BUS_CNTL, (bus_cntl & ~R600_BIOS_ROM_DIS));
+ /* Disable VGA mode */
+ WREG32(AVIVO_D1VGA_CONTROL,
+ (d1vga_control & ~(AVIVO_DVGA_CONTROL_MODE_ENABLE |
+@@ -262,7 +263,7 @@ static bool r600_read_disabled_bios(stru
+
+ /* restore regs */
+ WREG32(RADEON_VIPH_CONTROL, viph_control);
+- WREG32(RADEON_BUS_CNTL, bus_cntl);
++ WREG32(R600_BUS_CNTL, bus_cntl);
+ WREG32(AVIVO_D1VGA_CONTROL, d1vga_control);
+ WREG32(AVIVO_D2VGA_CONTROL, d2vga_control);
+ WREG32(AVIVO_VGA_RENDER_CONTROL, vga_render_control);
--- /dev/null
+From 85f7ffd5d2b320f73912b15fe8cef34bae297daf Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Mon, 25 Oct 2010 11:41:53 +0200
+Subject: firewire: ohci: fix buffer overflow in AR split packet handling
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 85f7ffd5d2b320f73912b15fe8cef34bae297daf upstream.
+
+When the controller had to split a received asynchronous packet into two
+buffers, the driver tries to reassemble it by copying both parts into
+the first page. However, if size + rest > PAGE_SIZE, i.e., if the yet
+unhandled packets before the split packet, the split packet itself, and
+any received packets after the split packet are together larger than one
+page, then the memory after the first page would get overwritten.
+
+To fix this, do not try to copy the data of all unhandled packets at
+once, but copy the possibly needed data every time when handling
+a packet.
+
+This gets rid of most of the infamous crashes and data corruptions when
+using firewire-net.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Maxim Levitsky <maximlevitsky@gmail.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (cast PAGE_SIZE to size_t)
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/ohci.c | 35 ++++++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -739,7 +739,7 @@ static void ar_context_tasklet(unsigned
+ d = &ab->descriptor;
+
+ if (d->res_count == 0) {
+- size_t size, rest, offset;
++ size_t size, size2, rest, pktsize, size3, offset;
+ dma_addr_t start_bus;
+ void *start;
+
+@@ -756,12 +756,41 @@ static void ar_context_tasklet(unsigned
+ ab = ab->next;
+ d = &ab->descriptor;
+ size = buffer + PAGE_SIZE - ctx->pointer;
++ /* valid buffer data in the next page */
+ rest = le16_to_cpu(d->req_count) - le16_to_cpu(d->res_count);
++ /* what actually fits in this page */
++ size2 = min(rest, (size_t)PAGE_SIZE - size);
+ memmove(buffer, ctx->pointer, size);
+- memcpy(buffer + size, ab->data, rest);
++ memcpy(buffer + size, ab->data, size2);
+ ctx->current_buffer = ab;
+ ctx->pointer = (void *) ab->data + rest;
+- end = buffer + size + rest;
++
++ while (size > 0) {
++ void *next = handle_ar_packet(ctx, buffer);
++ pktsize = next - buffer;
++ if (pktsize >= size) {
++ /*
++ * We have handled all the data that was
++ * originally in this page, so we can now
++ * continue in the next page.
++ */
++ buffer = next;
++ break;
++ }
++ /* move the next packet to the start of the buffer */
++ memmove(buffer, next, size + size2 - pktsize);
++ size -= pktsize;
++ /* fill up this page again */
++ size3 = min(rest - size2,
++ (size_t)PAGE_SIZE - size - size2);
++ memcpy(buffer + size + size2,
++ (void *) ab->data + size2, size3);
++ size2 += size3;
++ }
++
++ /* handle the packets that are fully in the next page */
++ buffer = (void *) ab->data + (buffer - (start + size));
++ end = (void *) ab->data + rest;
+
+ while (buffer < end)
+ buffer = handle_ar_packet(ctx, buffer);
--- /dev/null
+From a1f805e5e73a8fe166b71c6592d3837df0cd5e2e Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Mon, 25 Oct 2010 11:42:20 +0200
+Subject: firewire: ohci: fix race in AR split packet handling
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit a1f805e5e73a8fe166b71c6592d3837df0cd5e2e upstream.
+
+When handling an AR buffer that has been completely filled, we assumed
+that its descriptor will not be read by the controller and can be
+overwritten. However, when the last received packet happens to end at
+the end of the buffer, the controller might not yet have moved on to the
+next buffer and might read the branch address later. If we overwrite
+and free the page before that, the DMA context will either go dead
+because of an invalid Z value, or go off into some random memory.
+
+To fix this, ensure that the descriptor does not get overwritten by
+using only the actual buffer instead of the entire page for reassembling
+the split packet. Furthermore, to avoid freeing the page too early,
+move on to the next buffer only when some data in it guarantees that the
+controller has moved on.
+
+This should eliminate the remaining firewire-net problems.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Maxim Levitsky <maximlevitsky@gmail.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/ohci.c | 39 +++++++++++++++++++++++----------------
+ 1 file changed, 23 insertions(+), 16 deletions(-)
+
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -750,20 +750,19 @@ static void ar_context_tasklet(unsigned
+ */
+
+ offset = offsetof(struct ar_buffer, data);
+- start = buffer = ab;
++ start = ab;
+ start_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
++ buffer = ab->data;
+
+ ab = ab->next;
+ d = &ab->descriptor;
+- size = buffer + PAGE_SIZE - ctx->pointer;
++ size = start + PAGE_SIZE - ctx->pointer;
+ /* valid buffer data in the next page */
+ rest = le16_to_cpu(d->req_count) - le16_to_cpu(d->res_count);
+ /* what actually fits in this page */
+- size2 = min(rest, (size_t)PAGE_SIZE - size);
++ size2 = min(rest, (size_t)PAGE_SIZE - offset - size);
+ memmove(buffer, ctx->pointer, size);
+ memcpy(buffer + size, ab->data, size2);
+- ctx->current_buffer = ab;
+- ctx->pointer = (void *) ab->data + rest;
+
+ while (size > 0) {
+ void *next = handle_ar_packet(ctx, buffer);
+@@ -782,22 +781,30 @@ static void ar_context_tasklet(unsigned
+ size -= pktsize;
+ /* fill up this page again */
+ size3 = min(rest - size2,
+- (size_t)PAGE_SIZE - size - size2);
++ (size_t)PAGE_SIZE - offset - size - size2);
+ memcpy(buffer + size + size2,
+ (void *) ab->data + size2, size3);
+ size2 += size3;
+ }
+
+- /* handle the packets that are fully in the next page */
+- buffer = (void *) ab->data + (buffer - (start + size));
+- end = (void *) ab->data + rest;
+-
+- while (buffer < end)
+- buffer = handle_ar_packet(ctx, buffer);
+-
+- dma_free_coherent(ohci->card.device, PAGE_SIZE,
+- start, start_bus);
+- ar_context_add_page(ctx);
++ if (rest > 0) {
++ /* handle the packets that are fully in the next page */
++ buffer = (void *) ab->data +
++ (buffer - (start + offset + size));
++ end = (void *) ab->data + rest;
++
++ while (buffer < end)
++ buffer = handle_ar_packet(ctx, buffer);
++
++ ctx->current_buffer = ab;
++ ctx->pointer = end;
++
++ dma_free_coherent(ohci->card.device, PAGE_SIZE,
++ start, start_bus);
++ ar_context_add_page(ctx);
++ } else {
++ ctx->pointer = start + PAGE_SIZE;
++ }
+ } else {
+ buffer = ctx->pointer;
+ ctx->pointer = end =
--- /dev/null
+From f43402fa55bf5e7e190c176343015122f694857c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Moine?= <moinejf@free.fr>
+Date: Sat, 16 Oct 2010 13:54:05 -0300
+Subject: [media] gspca - main: Fix a regression with the PS3 Eye webcam
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Moine?= <moinejf@free.fr>
+
+commit f43402fa55bf5e7e190c176343015122f694857c upstream.
+
+When audio is present, some alternate settings were skipped.
+This prevented some webcams to work, especially when bulk transfer was used.
+This patch permits to use the last or only alternate setting.
+
+Reported-by: Antonio Ospite <ospite@studenti.unina.it>
+Tested-by: Antonio Ospite <ospite@studenti.unina.it>
+Signed-off-by: Jean-François Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/gspca.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/video/gspca/gspca.c
++++ b/drivers/media/video/gspca/gspca.c
+@@ -652,7 +652,7 @@ static struct usb_host_endpoint *get_ep(
+ : USB_ENDPOINT_XFER_ISOC;
+ i = gspca_dev->alt; /* previous alt setting */
+ if (gspca_dev->cam.reverse_alts) {
+- if (gspca_dev->audio)
++ if (gspca_dev->audio && i < gspca_dev->nbalt - 2)
+ i++;
+ while (++i < gspca_dev->nbalt) {
+ ep = alt_xfer(&intf->altsetting[i], xfer);
+@@ -660,7 +660,7 @@ static struct usb_host_endpoint *get_ep(
+ break;
+ }
+ } else {
+- if (gspca_dev->audio)
++ if (gspca_dev->audio && i > 1)
+ i--;
+ while (--i >= 0) {
+ ep = alt_xfer(&intf->altsetting[i], xfer);
--- /dev/null
+From 0303a90a744662e934877a5d637a43197229274b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Moine?= <moinejf@free.fr>
+Date: Thu, 21 Oct 2010 04:05:15 -0300
+Subject: [media] gspca - sonixj: Fix a regression of sensors hv7131r and mi0360
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Moine?= <moinejf@free.fr>
+
+commit 0303a90a744662e934877a5d637a43197229274b upstream.
+
+The bug was introduced by commit 23a98274cc348880ecb6803307c254448084953a
+applying values of sensor sp80708 to sensors hv7131r and mi0360.
+
+Signed-off-by: Jean-François Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/sonixj.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/video/gspca/sonixj.c
++++ b/drivers/media/video/gspca/sonixj.c
+@@ -2474,8 +2474,7 @@ static int sd_start(struct gspca_dev *gs
+ reg1 = 0x44;
+ reg17 = 0xa2;
+ break;
+- default:
+-/* case SENSOR_SP80708: */
++ case SENSOR_SP80708:
+ init = sp80708_sensor_param1;
+ if (mode) {
+ /*?? reg1 = 0x04; * 320 clk 48Mhz */
--- /dev/null
+From 4f5c933abb34532dc962185c999509b97a97fa1b Mon Sep 17 00:00:00 2001
+From: James M McLaren <mclaren@tulane.edu>
+Date: Sun, 3 Oct 2010 19:09:18 -0300
+Subject: [media] hdpvr: Add missing URB_NO_TRANSFER_DMA_MAP flag
+
+From: James M McLaren <mclaren@tulane.edu>
+
+commit 4f5c933abb34532dc962185c999509b97a97fa1b upstream.
+
+Necessary on arm.
+
+Signed-off-by: Janne Grunau <j@jannau.net>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/hdpvr/hdpvr-video.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/video/hdpvr/hdpvr-video.c
++++ b/drivers/media/video/hdpvr/hdpvr-video.c
+@@ -157,6 +157,7 @@ int hdpvr_alloc_buffers(struct hdpvr_dev
+ mem, dev->bulk_in_size,
+ hdpvr_read_bulk_callback, buf);
+
++ buf->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ buf->status = BUFSTAT_AVAILABLE;
+ list_add_tail(&buf->buff_list, &dev->free_buff_list);
+ }
--- /dev/null
+From 0a77fe4c188e25917799f2356d4aa5e6d80c39a2 Mon Sep 17 00:00:00 2001
+From: Avi Kivity <avi@redhat.com>
+Date: Tue, 19 Oct 2010 18:48:35 +0200
+Subject: KVM: Correct ordering of ldt reload wrt fs/gs reload
+
+From: Avi Kivity <avi@redhat.com>
+
+commit 0a77fe4c188e25917799f2356d4aa5e6d80c39a2 upstream.
+
+If fs or gs refer to the ldt, they must be reloaded after the ldt. Reorder
+the code to that effect.
+
+Userspace code that uses the ldt with kvm is nonexistent, so this doesn't fix
+a user-visible bug.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/svm.c | 2 +-
+ arch/x86/kvm/vmx.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3281,6 +3281,7 @@ static void svm_vcpu_run(struct kvm_vcpu
+ vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;
+
+ load_host_msrs(vcpu);
++ kvm_load_ldt(ldt_selector);
+ loadsegment(fs, fs_selector);
+ #ifdef CONFIG_X86_64
+ load_gs_index(gs_selector);
+@@ -3288,7 +3289,6 @@ static void svm_vcpu_run(struct kvm_vcpu
+ #else
+ loadsegment(gs, gs_selector);
+ #endif
+- kvm_load_ldt(ldt_selector);
+
+ reload_tss(vcpu);
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -846,8 +846,6 @@ static void __vmx_load_host_state(struct
+
+ ++vmx->vcpu.stat.host_state_reload;
+ vmx->host_state.loaded = 0;
+- if (vmx->host_state.fs_reload_needed)
+- loadsegment(fs, vmx->host_state.fs_sel);
+ if (vmx->host_state.gs_ldt_reload_needed) {
+ kvm_load_ldt(vmx->host_state.ldt_sel);
+ #ifdef CONFIG_X86_64
+@@ -857,6 +855,8 @@ static void __vmx_load_host_state(struct
+ loadsegment(gs, vmx->host_state.gs_sel);
+ #endif
+ }
++ if (vmx->host_state.fs_reload_needed)
++ loadsegment(fs, vmx->host_state.fs_sel);
+ reload_tss();
+ #ifdef CONFIG_X86_64
+ if (is_long_mode(&vmx->vcpu)) {
--- /dev/null
+From c8770e7ba63bb5dd8fe5f9d251275a8fa717fb78 Mon Sep 17 00:00:00 2001
+From: Avi Kivity <avi@redhat.com>
+Date: Thu, 11 Nov 2010 12:37:26 +0200
+Subject: KVM: VMX: Fix host userspace gsbase corruption
+
+From: Avi Kivity <avi@redhat.com>
+
+commit c8770e7ba63bb5dd8fe5f9d251275a8fa717fb78 upstream.
+
+We now use load_gs_index() to load gs safely; unfortunately this also
+changes MSR_KERNEL_GS_BASE, which we managed separately. This resulted
+in confusion and breakage running 32-bit host userspace on a 64-bit kernel.
+
+Fix by
+- saving guest MSR_KERNEL_GS_BASE before we we reload the host's gs
+- doing the host save/load unconditionally, instead of only when in guest
+ long mode
+
+Things can be cleaned up further, but this is the minmal fix for now.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/vmx.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -828,10 +828,9 @@ static void vmx_save_host_state(struct k
+ #endif
+
+ #ifdef CONFIG_X86_64
+- if (is_long_mode(&vmx->vcpu)) {
+- rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
++ rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
++ if (is_long_mode(&vmx->vcpu))
+ wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+- }
+ #endif
+ for (i = 0; i < vmx->save_nmsrs; ++i)
+ kvm_set_shared_msr(vmx->guest_msrs[i].index,
+@@ -846,11 +845,14 @@ static void __vmx_load_host_state(struct
+
+ ++vmx->vcpu.stat.host_state_reload;
+ vmx->host_state.loaded = 0;
++#ifdef CONFIG_X86_64
++ if (is_long_mode(&vmx->vcpu))
++ rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
++#endif
+ if (vmx->host_state.gs_ldt_reload_needed) {
+ kvm_load_ldt(vmx->host_state.ldt_sel);
+ #ifdef CONFIG_X86_64
+ load_gs_index(vmx->host_state.gs_sel);
+- wrmsrl(MSR_KERNEL_GS_BASE, current->thread.gs);
+ #else
+ loadsegment(gs, vmx->host_state.gs_sel);
+ #endif
+@@ -859,10 +861,7 @@ static void __vmx_load_host_state(struct
+ loadsegment(fs, vmx->host_state.fs_sel);
+ reload_tss();
+ #ifdef CONFIG_X86_64
+- if (is_long_mode(&vmx->vcpu)) {
+- rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+- wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
+- }
++ wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
+ #endif
+ if (current_thread_info()->status & TS_USEDFPU)
+ clts();
--- /dev/null
+From edde99ce05290e50ce0b3495d209e54e6349ab47 Mon Sep 17 00:00:00 2001
+From: Michael S. Tsirkin <mst@redhat.com>
+Date: Mon, 25 Oct 2010 03:21:24 +0200
+Subject: KVM: Write protect memory after slot swap
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit edde99ce05290e50ce0b3495d209e54e6349ab47 upstream.
+
+I have observed the following bug trigger:
+
+1. userspace calls GET_DIRTY_LOG
+2. kvm_mmu_slot_remove_write_access is called and makes a page ro
+3. page fault happens and makes the page writeable
+ fault is logged in the bitmap appropriately
+4. kvm_vm_ioctl_get_dirty_log swaps slot pointers
+
+a lot of time passes
+
+5. guest writes into the page
+6. userspace calls GET_DIRTY_LOG
+
+At point (5), bitmap is clean and page is writeable,
+thus, guest modification of memory is not logged
+and GET_DIRTY_LOG returns an empty bitmap.
+
+The rule is that all pages are either dirty in the current bitmap,
+or write-protected, which is violated here.
+
+It seems that just moving kvm_mmu_slot_remove_write_access down
+to after the slot pointer swap should fix this bug.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2912,10 +2912,6 @@ int kvm_vm_ioctl_get_dirty_log(struct kv
+ struct kvm_memslots *slots, *old_slots;
+ unsigned long *dirty_bitmap;
+
+- spin_lock(&kvm->mmu_lock);
+- kvm_mmu_slot_remove_write_access(kvm, log->slot);
+- spin_unlock(&kvm->mmu_lock);
+-
+ r = -ENOMEM;
+ dirty_bitmap = vmalloc(n);
+ if (!dirty_bitmap)
+@@ -2937,6 +2933,10 @@ int kvm_vm_ioctl_get_dirty_log(struct kv
+ dirty_bitmap = old_slots->memslots[log->slot].dirty_bitmap;
+ kfree(old_slots);
+
++ spin_lock(&kvm->mmu_lock);
++ kvm_mmu_slot_remove_write_access(kvm, log->slot);
++ spin_unlock(&kvm->mmu_lock);
++
+ r = -EFAULT;
+ if (copy_to_user(log->dirty_bitmap, dirty_bitmap, n)) {
+ vfree(dirty_bitmap);
--- /dev/null
+From 97e69aa62f8b5d338d6cff49be09e37cc1262838 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segooon@gmail.com>
+Date: Sat, 30 Oct 2010 22:54:47 +0400
+Subject: KVM: x86: fix information leak to userland
+
+From: Vasiliy Kulikov <segooon@gmail.com>
+
+commit 97e69aa62f8b5d338d6cff49be09e37cc1262838 upstream.
+
+Structures kvm_vcpu_events, kvm_debugregs, kvm_pit_state2 and
+kvm_clock_data are copied to userland with some padding and reserved
+fields unitialized. It leads to leaking of contents of kernel stack
+memory. We have to initialize them to zero.
+
+In patch v1 Jan Kiszka suggested to fill reserved fields with zeros
+instead of memset'ting the whole struct. It makes sense as these
+fields are explicitly marked as padding. No more fields need zeroing.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2305,6 +2305,7 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_
+ !kvm_exception_is_soft(vcpu->arch.exception.nr);
+ events->exception.nr = vcpu->arch.exception.nr;
+ events->exception.has_error_code = vcpu->arch.exception.has_error_code;
++ events->exception.pad = 0;
+ events->exception.error_code = vcpu->arch.exception.error_code;
+
+ events->interrupt.injected =
+@@ -2318,12 +2319,14 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_
+ events->nmi.injected = vcpu->arch.nmi_injected;
+ events->nmi.pending = vcpu->arch.nmi_pending;
+ events->nmi.masked = kvm_x86_ops->get_nmi_mask(vcpu);
++ events->nmi.pad = 0;
+
+ events->sipi_vector = vcpu->arch.sipi_vector;
+
+ events->flags = (KVM_VCPUEVENT_VALID_NMI_PENDING
+ | KVM_VCPUEVENT_VALID_SIPI_VECTOR
+ | KVM_VCPUEVENT_VALID_SHADOW);
++ memset(&events->reserved, 0, sizeof(events->reserved));
+ }
+
+ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
+@@ -2366,6 +2369,7 @@ static void kvm_vcpu_ioctl_x86_get_debug
+ dbgregs->dr6 = vcpu->arch.dr6;
+ dbgregs->dr7 = vcpu->arch.dr7;
+ dbgregs->flags = 0;
++ memset(&dbgregs->reserved, 0, sizeof(dbgregs->reserved));
+ }
+
+ static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
+@@ -2849,6 +2853,7 @@ static int kvm_vm_ioctl_get_pit2(struct
+ sizeof(ps->channels));
+ ps->flags = kvm->arch.vpit->pit_state.flags;
+ mutex_unlock(&kvm->arch.vpit->pit_state.lock);
++ memset(&ps->reserved, 0, sizeof(ps->reserved));
+ return r;
+ }
+
+@@ -3229,6 +3234,7 @@ long kvm_arch_vm_ioctl(struct file *filp
+ now_ns = timespec_to_ns(&now);
+ user_ns.clock = kvm->arch.kvmclock_offset + now_ns;
+ user_ns.flags = 0;
++ memset(&user_ns.pad, 0, sizeof(user_ns.pad));
+
+ r = -EFAULT;
+ if (copy_to_user(argp, &user_ns, sizeof(user_ns)))
--- /dev/null
+From 38715258aa2e8cd94bd4aafadc544e5104efd551 Mon Sep 17 00:00:00 2001
+From: Ken Chen <kenchen@google.com>
+Date: Thu, 11 Nov 2010 14:05:16 -0800
+Subject: latencytop: fix per task accumulator
+
+From: Ken Chen <kenchen@google.com>
+
+commit 38715258aa2e8cd94bd4aafadc544e5104efd551 upstream.
+
+Per task latencytop accumulator prematurely terminates due to erroneous
+placement of latency_record_count. It should be incremented whenever a
+new record is allocated instead of increment on every latencytop event.
+
+Also fix search iterator to only search known record events instead of
+blindly searching all pre-allocated space.
+
+Signed-off-by: Ken Chen <kenchen@google.com>
+Reviewed-by: Arjan van de Ven <arjan@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/latencytop.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/kernel/latencytop.c
++++ b/kernel/latencytop.c
+@@ -194,14 +194,7 @@ __account_scheduler_latency(struct task_
+
+ account_global_scheduler_latency(tsk, &lat);
+
+- /*
+- * short term hack; if we're > 32 we stop; future we recycle:
+- */
+- tsk->latency_record_count++;
+- if (tsk->latency_record_count >= LT_SAVECOUNT)
+- goto out_unlock;
+-
+- for (i = 0; i < LT_SAVECOUNT; i++) {
++ for (i = 0; i < tsk->latency_record_count; i++) {
+ struct latency_record *mylat;
+ int same = 1;
+
+@@ -227,8 +220,14 @@ __account_scheduler_latency(struct task_
+ }
+ }
+
++ /*
++ * short term hack; if we're > 32 we stop; future we recycle:
++ */
++ if (tsk->latency_record_count >= LT_SAVECOUNT)
++ goto out_unlock;
++
+ /* Allocated a new one: */
+- i = tsk->latency_record_count;
++ i = tsk->latency_record_count++;
+ memcpy(&tsk->latency_record[i], &lat, sizeof(struct latency_record));
+
+ out_unlock:
--- /dev/null
+From 8d056cb965b8fb7c53c564abf28b1962d1061cd3 Mon Sep 17 00:00:00 2001
+From: Dave Hansen <dave@linux.vnet.ibm.com>
+Date: Thu, 11 Nov 2010 14:05:15 -0800
+Subject: mm/vfs: revalidate page->mapping in do_generic_file_read()
+
+From: Dave Hansen <dave@linux.vnet.ibm.com>
+
+commit 8d056cb965b8fb7c53c564abf28b1962d1061cd3 upstream.
+
+70 hours into some stress tests of a 2.6.32-based enterprise kernel, we
+ran into a NULL dereference in here:
+
+ int block_is_partially_uptodate(struct page *page, read_descriptor_t *desc,
+ unsigned long from)
+ {
+----> struct inode *inode = page->mapping->host;
+
+It looks like page->mapping was the culprit. (xmon trace is below).
+After closer examination, I realized that do_generic_file_read() does a
+find_get_page(), and eventually locks the page before calling
+block_is_partially_uptodate(). However, it doesn't revalidate the
+page->mapping after the page is locked. So, there's a small window
+between the find_get_page() and ->is_partially_uptodate() where the page
+could get truncated and page->mapping cleared.
+
+We _have_ a reference, so it can't get reclaimed, but it certainly
+can be truncated.
+
+I think the correct thing is to check page->mapping after the
+trylock_page(), and jump out if it got truncated. This patch has been
+running in the test environment for a month or so now, and we have not
+seen this bug pop up again.
+
+xmon info:
+
+ 1f:mon> e
+ cpu 0x1f: Vector: 300 (Data Access) at [c0000002ae36f770]
+ pc: c0000000001e7a6c: .block_is_partially_uptodate+0xc/0x100
+ lr: c000000000142944: .generic_file_aio_read+0x1e4/0x770
+ sp: c0000002ae36f9f0
+ msr: 8000000000009032
+ dar: 0
+ dsisr: 40000000
+ current = 0xc000000378f99e30
+ paca = 0xc000000000f66300
+ pid = 21946, comm = bash
+ 1f:mon> r
+ R00 = 0025c0500000006d R16 = 0000000000000000
+ R01 = c0000002ae36f9f0 R17 = c000000362cd3af0
+ R02 = c000000000e8cd80 R18 = ffffffffffffffff
+ R03 = c0000000031d0f88 R19 = 0000000000000001
+ R04 = c0000002ae36fa68 R20 = c0000003bb97b8a0
+ R05 = 0000000000000000 R21 = c0000002ae36fa68
+ R06 = 0000000000000000 R22 = 0000000000000000
+ R07 = 0000000000000001 R23 = c0000002ae36fbb0
+ R08 = 0000000000000002 R24 = 0000000000000000
+ R09 = 0000000000000000 R25 = c000000362cd3a80
+ R10 = 0000000000000000 R26 = 0000000000000002
+ R11 = c0000000001e7b60 R27 = 0000000000000000
+ R12 = 0000000042000484 R28 = 0000000000000001
+ R13 = c000000000f66300 R29 = c0000003bb97b9b8
+ R14 = 0000000000000001 R30 = c000000000e28a08
+ R15 = 000000000000ffff R31 = c0000000031d0f88
+ pc = c0000000001e7a6c .block_is_partially_uptodate+0xc/0x100
+ lr = c000000000142944 .generic_file_aio_read+0x1e4/0x770
+ msr = 8000000000009032 cr = 22000488
+ ctr = c0000000001e7a60 xer = 0000000020000000 trap = 300
+ dar = 0000000000000000 dsisr = 40000000
+ 1f:mon> t
+ [link register ] c000000000142944 .generic_file_aio_read+0x1e4/0x770
+ [c0000002ae36f9f0] c000000000142a14 .generic_file_aio_read+0x2b4/0x770 (unreliable)
+ [c0000002ae36fb40] c0000000001b03e4 .do_sync_read+0xd4/0x160
+ [c0000002ae36fce0] c0000000001b153c .vfs_read+0xec/0x1f0
+ [c0000002ae36fd80] c0000000001b1768 .SyS_read+0x58/0xb0
+ [c0000002ae36fe30] c00000000000852c syscall_exit+0x0/0x40
+ --- Exception: c00 (System Call) at 00000080a840bc54
+ SP (fffca15df30) is in userspace
+ 1f:mon> di c0000000001e7a6c
+ c0000000001e7a6c e9290000 ld r9,0(r9)
+ c0000000001e7a70 418200c0 beq c0000000001e7b30 # .block_is_partially_uptodate+0xd0/0x100
+ c0000000001e7a74 e9440008 ld r10,8(r4)
+ c0000000001e7a78 78a80020 clrldi r8,r5,32
+ c0000000001e7a7c 3c000001 lis r0,1
+ c0000000001e7a80 812900a8 lwz r9,168(r9)
+ c0000000001e7a84 39600001 li r11,1
+ c0000000001e7a88 7c080050 subf r0,r8,r0
+ c0000000001e7a8c 7f805040 cmplw cr7,r0,r10
+ c0000000001e7a90 7d6b4830 slw r11,r11,r9
+ c0000000001e7a94 796b0020 clrldi r11,r11,32
+ c0000000001e7a98 419d00a8 bgt cr7,c0000000001e7b40 # .block_is_partially_uptodate+0xe0/0x100
+ c0000000001e7a9c 7fa55840 cmpld cr7,r5,r11
+ c0000000001e7aa0 7d004214 add r8,r0,r8
+ c0000000001e7aa4 79080020 clrldi r8,r8,32
+ c0000000001e7aa8 419c0078 blt cr7,c0000000001e7b20 # .block_is_partially_uptodate+0xc0/0x100
+
+Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com>
+Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
+Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Rik van Riel <riel@redhat.com>
+Cc: <arunabal@in.ibm.com>
+Cc: <sbest@us.ibm.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Minchan Kim <minchan.kim@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/filemap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1010,6 +1010,9 @@ find_page:
+ goto page_not_up_to_date;
+ if (!trylock_page(page))
+ goto page_not_up_to_date;
++ /* Did it get truncated before we got the lock? */
++ if (!page->mapping)
++ goto page_not_up_to_date_locked;
+ if (!mapping->a_ops->is_partially_uptodate(page,
+ desc, offset))
+ goto page_not_up_to_date_locked;
--- /dev/null
+From 6b1686a71e3158d3c5f125260effce171cc7852b Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Thu, 28 Oct 2010 12:34:21 +0200
+Subject: netfilter: nf_conntrack: allow nf_ct_alloc_hashtable() to get highmem pages
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit 6b1686a71e3158d3c5f125260effce171cc7852b upstream.
+
+commit ea781f197d6a8 (use SLAB_DESTROY_BY_RCU and get rid of call_rcu())
+did a mistake in __vmalloc() call in nf_ct_alloc_hashtable().
+
+I forgot to add __GFP_HIGHMEM, so pages were taken from LOWMEM only.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/nf_conntrack_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1260,7 +1260,8 @@ void *nf_ct_alloc_hashtable(unsigned int
+ if (!hash) {
+ *vmalloced = 1;
+ printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
+- hash = __vmalloc(sz, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
++ hash = __vmalloc(sz, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
++ PAGE_KERNEL);
+ }
+
+ if (hash && nulls)
--- /dev/null
+From ac5aa2e3332ec04889074afdbd1479424d0227a5 Mon Sep 17 00:00:00 2001
+From: Eric Paris <eparis@redhat.com>
+Date: Fri, 12 Nov 2010 08:26:06 +0100
+Subject: netfilter: NF_HOOK_COND has wrong conditional
+
+From: Eric Paris <eparis@redhat.com>
+
+commit ac5aa2e3332ec04889074afdbd1479424d0227a5 upstream.
+
+The NF_HOOK_COND returns 0 when it shouldn't due to what I believe to be an
+error in the code as the order of operations is not what was intended. C will
+evalutate == before =. Which means ret is getting set to the bool result,
+rather than the return value of the function call. The code says
+
+if (ret = function() == 1)
+when it meant to say:
+if ((ret = function()) == 1)
+
+Normally the compiler would warn, but it doesn't notice it because its
+a actually complex conditional and so the wrong code is wrapped in an explict
+set of () [exactly what the compiler wants you to do if this was intentional].
+Fixing this means that errors when netfilter denies a packet get propagated
+back up the stack rather than lost.
+
+Problem introduced by commit 2249065f (netfilter: get rid of the grossness
+in netfilter.h).
+
+Signed-off-by: Eric Paris <eparis@redhat.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/netfilter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -215,7 +215,7 @@ NF_HOOK_COND(uint8_t pf, unsigned int ho
+ int ret;
+
+ if (!cond ||
+- (ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN) == 1))
++ ((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1))
+ ret = okfn(skb);
+ return ret;
+ }
--- /dev/null
+From 015f0212d51d85bd281a831639a769b4a1a3307a Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Thu, 28 Oct 2010 10:10:37 -0400
+Subject: nfs: handle lock context allocation failures in nfs_create_request
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 015f0212d51d85bd281a831639a769b4a1a3307a upstream.
+
+nfs_get_lock_context can return NULL on an allocation failure.
+Regression introduced by commit f11ac8db.
+
+Reported-by: Steve Dickson <steved@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/pagelist.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -65,6 +65,13 @@ nfs_create_request(struct nfs_open_conte
+ if (req == NULL)
+ return ERR_PTR(-ENOMEM);
+
++ /* get lock context early so we can deal with alloc failures */
++ req->wb_lock_context = nfs_get_lock_context(ctx);
++ if (req->wb_lock_context == NULL) {
++ nfs_page_free(req);
++ return ERR_PTR(-ENOMEM);
++ }
++
+ /* Initialize the request struct. Initially, we assume a
+ * long write-back delay. This will be adjusted in
+ * update_nfs_request below if the region is not locked. */
+@@ -79,7 +86,6 @@ nfs_create_request(struct nfs_open_conte
+ req->wb_pgbase = offset;
+ req->wb_bytes = count;
+ req->wb_context = get_nfs_open_context(ctx);
+- req->wb_lock_context = nfs_get_lock_context(ctx);
+ kref_init(&req->wb_kref);
+ return req;
+ }
--- /dev/null
+From 27d20fddc8af539464fc3ba499d6a830054c3bd6 Mon Sep 17 00:00:00 2001
+From: Nick Piggin <npiggin@kernel.dk>
+Date: Thu, 11 Nov 2010 14:05:19 -0800
+Subject: radix-tree: fix RCU bug
+
+From: Nick Piggin <npiggin@kernel.dk>
+
+commit 27d20fddc8af539464fc3ba499d6a830054c3bd6 upstream.
+
+Salman Qazi describes the following radix-tree bug:
+
+In the following case, we get can get a deadlock:
+
+0. The radix tree contains two items, one has the index 0.
+1. The reader (in this case find_get_pages) takes the rcu_read_lock.
+2. The reader acquires slot(s) for item(s) including the index 0 item.
+3. The non-zero index item is deleted, and as a consequence the other item is
+ moved to the root of the tree. The place where it used to be is queued for
+ deletion after the readers finish.
+3b. The zero item is deleted, removing it from the direct slot, it remains in
+ the rcu-delayed indirect node.
+4. The reader looks at the index 0 slot, and finds that the page has 0 ref
+ count
+5. The reader looks at it again, hoping that the item will either be freed or
+ the ref count will increase. This never happens, as the slot it is looking
+ at will never be updated. Also, this slot can never be reclaimed because
+ the reader is holding rcu_read_lock and is in an infinite loop.
+
+The fix is to re-use the same "indirect" pointer case that requires a slot
+lookup retry into a general "retry the lookup" bit.
+
+Signed-off-by: Nick Piggin <npiggin@kernel.dk>
+Reported-by: Salman Qazi <sqazi@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/radix-tree.h | 36 ++++++++++---------
+ lib/radix-tree.c | 83 +++++++++++++++++++++++++++++++--------------
+ mm/filemap.c | 26 +++++---------
+ 3 files changed, 87 insertions(+), 58 deletions(-)
+
+--- a/include/linux/radix-tree.h
++++ b/include/linux/radix-tree.h
+@@ -36,17 +36,6 @@
+ * RCU.
+ */
+ #define RADIX_TREE_INDIRECT_PTR 1
+-#define RADIX_TREE_RETRY ((void *)-1UL)
+-
+-static inline void *radix_tree_ptr_to_indirect(void *ptr)
+-{
+- return (void *)((unsigned long)ptr | RADIX_TREE_INDIRECT_PTR);
+-}
+-
+-static inline void *radix_tree_indirect_to_ptr(void *ptr)
+-{
+- return (void *)((unsigned long)ptr & ~RADIX_TREE_INDIRECT_PTR);
+-}
+
+ static inline int radix_tree_is_indirect_ptr(void *ptr)
+ {
+@@ -138,16 +127,29 @@ do { \
+ * removed.
+ *
+ * For use with radix_tree_lookup_slot(). Caller must hold tree at least read
+- * locked across slot lookup and dereference. More likely, will be used with
+- * radix_tree_replace_slot(), as well, so caller will hold tree write locked.
++ * locked across slot lookup and dereference. Not required if write lock is
++ * held (ie. items cannot be concurrently inserted).
++ *
++ * radix_tree_deref_retry must be used to confirm validity of the pointer if
++ * only the read lock is held.
+ */
+ static inline void *radix_tree_deref_slot(void **pslot)
+ {
+- void *ret = rcu_dereference(*pslot);
+- if (unlikely(radix_tree_is_indirect_ptr(ret)))
+- ret = RADIX_TREE_RETRY;
+- return ret;
++ return rcu_dereference(*pslot);
+ }
++
++/**
++ * radix_tree_deref_retry - check radix_tree_deref_slot
++ * @arg: pointer returned by radix_tree_deref_slot
++ * Returns: 0 if retry is not required, otherwise retry is required
++ *
++ * radix_tree_deref_retry must be used with radix_tree_deref_slot.
++ */
++static inline int radix_tree_deref_retry(void *arg)
++{
++ return unlikely((unsigned long)arg & RADIX_TREE_INDIRECT_PTR);
++}
++
+ /**
+ * radix_tree_replace_slot - replace item in a slot
+ * @pslot: pointer to slot, returned by radix_tree_lookup_slot
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -82,6 +82,16 @@ struct radix_tree_preload {
+ };
+ static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
+
++static inline void *ptr_to_indirect(void *ptr)
++{
++ return (void *)((unsigned long)ptr | RADIX_TREE_INDIRECT_PTR);
++}
++
++static inline void *indirect_to_ptr(void *ptr)
++{
++ return (void *)((unsigned long)ptr & ~RADIX_TREE_INDIRECT_PTR);
++}
++
+ static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
+ {
+ return root->gfp_mask & __GFP_BITS_MASK;
+@@ -265,7 +275,7 @@ static int radix_tree_extend(struct radi
+ return -ENOMEM;
+
+ /* Increase the height. */
+- node->slots[0] = radix_tree_indirect_to_ptr(root->rnode);
++ node->slots[0] = indirect_to_ptr(root->rnode);
+
+ /* Propagate the aggregated tag info into the new root */
+ for (tag = 0; tag < RADIX_TREE_MAX_TAGS; tag++) {
+@@ -276,7 +286,7 @@ static int radix_tree_extend(struct radi
+ newheight = root->height+1;
+ node->height = newheight;
+ node->count = 1;
+- node = radix_tree_ptr_to_indirect(node);
++ node = ptr_to_indirect(node);
+ rcu_assign_pointer(root->rnode, node);
+ root->height = newheight;
+ } while (height > root->height);
+@@ -309,7 +319,7 @@ int radix_tree_insert(struct radix_tree_
+ return error;
+ }
+
+- slot = radix_tree_indirect_to_ptr(root->rnode);
++ slot = indirect_to_ptr(root->rnode);
+
+ height = root->height;
+ shift = (height-1) * RADIX_TREE_MAP_SHIFT;
+@@ -325,8 +335,7 @@ int radix_tree_insert(struct radix_tree_
+ rcu_assign_pointer(node->slots[offset], slot);
+ node->count++;
+ } else
+- rcu_assign_pointer(root->rnode,
+- radix_tree_ptr_to_indirect(slot));
++ rcu_assign_pointer(root->rnode, ptr_to_indirect(slot));
+ }
+
+ /* Go a level down */
+@@ -374,7 +383,7 @@ static void *radix_tree_lookup_element(s
+ return NULL;
+ return is_slot ? (void *)&root->rnode : node;
+ }
+- node = radix_tree_indirect_to_ptr(node);
++ node = indirect_to_ptr(node);
+
+ height = node->height;
+ if (index > radix_tree_maxindex(height))
+@@ -393,7 +402,7 @@ static void *radix_tree_lookup_element(s
+ height--;
+ } while (height > 0);
+
+- return is_slot ? (void *)slot:node;
++ return is_slot ? (void *)slot : indirect_to_ptr(node);
+ }
+
+ /**
+@@ -455,7 +464,7 @@ void *radix_tree_tag_set(struct radix_tr
+ height = root->height;
+ BUG_ON(index > radix_tree_maxindex(height));
+
+- slot = radix_tree_indirect_to_ptr(root->rnode);
++ slot = indirect_to_ptr(root->rnode);
+ shift = (height - 1) * RADIX_TREE_MAP_SHIFT;
+
+ while (height > 0) {
+@@ -509,7 +518,7 @@ void *radix_tree_tag_clear(struct radix_
+
+ shift = (height - 1) * RADIX_TREE_MAP_SHIFT;
+ pathp->node = NULL;
+- slot = radix_tree_indirect_to_ptr(root->rnode);
++ slot = indirect_to_ptr(root->rnode);
+
+ while (height > 0) {
+ int offset;
+@@ -579,7 +588,7 @@ int radix_tree_tag_get(struct radix_tree
+
+ if (!radix_tree_is_indirect_ptr(node))
+ return (index == 0);
+- node = radix_tree_indirect_to_ptr(node);
++ node = indirect_to_ptr(node);
+
+ height = node->height;
+ if (index > radix_tree_maxindex(height))
+@@ -666,7 +675,7 @@ unsigned long radix_tree_range_tag_if_ta
+ }
+
+ shift = (height - 1) * RADIX_TREE_MAP_SHIFT;
+- slot = radix_tree_indirect_to_ptr(root->rnode);
++ slot = indirect_to_ptr(root->rnode);
+
+ /*
+ * we fill the path from (root->height - 2) to 0, leaving the index at
+@@ -897,7 +906,7 @@ radix_tree_gang_lookup(struct radix_tree
+ results[0] = node;
+ return 1;
+ }
+- node = radix_tree_indirect_to_ptr(node);
++ node = indirect_to_ptr(node);
+
+ max_index = radix_tree_maxindex(node->height);
+
+@@ -916,7 +925,8 @@ radix_tree_gang_lookup(struct radix_tree
+ slot = *(((void ***)results)[ret + i]);
+ if (!slot)
+ continue;
+- results[ret + nr_found] = rcu_dereference_raw(slot);
++ results[ret + nr_found] =
++ indirect_to_ptr(rcu_dereference_raw(slot));
+ nr_found++;
+ }
+ ret += nr_found;
+@@ -965,7 +975,7 @@ radix_tree_gang_lookup_slot(struct radix
+ results[0] = (void **)&root->rnode;
+ return 1;
+ }
+- node = radix_tree_indirect_to_ptr(node);
++ node = indirect_to_ptr(node);
+
+ max_index = radix_tree_maxindex(node->height);
+
+@@ -1090,7 +1100,7 @@ radix_tree_gang_lookup_tag(struct radix_
+ results[0] = node;
+ return 1;
+ }
+- node = radix_tree_indirect_to_ptr(node);
++ node = indirect_to_ptr(node);
+
+ max_index = radix_tree_maxindex(node->height);
+
+@@ -1109,7 +1119,8 @@ radix_tree_gang_lookup_tag(struct radix_
+ slot = *(((void ***)results)[ret + i]);
+ if (!slot)
+ continue;
+- results[ret + nr_found] = rcu_dereference_raw(slot);
++ results[ret + nr_found] =
++ indirect_to_ptr(rcu_dereference_raw(slot));
+ nr_found++;
+ }
+ ret += nr_found;
+@@ -1159,7 +1170,7 @@ radix_tree_gang_lookup_tag_slot(struct r
+ results[0] = (void **)&root->rnode;
+ return 1;
+ }
+- node = radix_tree_indirect_to_ptr(node);
++ node = indirect_to_ptr(node);
+
+ max_index = radix_tree_maxindex(node->height);
+
+@@ -1195,7 +1206,7 @@ static inline void radix_tree_shrink(str
+ void *newptr;
+
+ BUG_ON(!radix_tree_is_indirect_ptr(to_free));
+- to_free = radix_tree_indirect_to_ptr(to_free);
++ to_free = indirect_to_ptr(to_free);
+
+ /*
+ * The candidate node has more than one child, or its child
+@@ -1208,16 +1219,39 @@ static inline void radix_tree_shrink(str
+
+ /*
+ * We don't need rcu_assign_pointer(), since we are simply
+- * moving the node from one part of the tree to another. If
+- * it was safe to dereference the old pointer to it
++ * moving the node from one part of the tree to another: if it
++ * was safe to dereference the old pointer to it
+ * (to_free->slots[0]), it will be safe to dereference the new
+- * one (root->rnode).
++ * one (root->rnode) as far as dependent read barriers go.
+ */
+ newptr = to_free->slots[0];
+ if (root->height > 1)
+- newptr = radix_tree_ptr_to_indirect(newptr);
++ newptr = ptr_to_indirect(newptr);
+ root->rnode = newptr;
+ root->height--;
++
++ /*
++ * We have a dilemma here. The node's slot[0] must not be
++ * NULLed in case there are concurrent lookups expecting to
++ * find the item. However if this was a bottom-level node,
++ * then it may be subject to the slot pointer being visible
++ * to callers dereferencing it. If item corresponding to
++ * slot[0] is subsequently deleted, these callers would expect
++ * their slot to become empty sooner or later.
++ *
++ * For example, lockless pagecache will look up a slot, deref
++ * the page pointer, and if the page is 0 refcount it means it
++ * was concurrently deleted from pagecache so try the deref
++ * again. Fortunately there is already a requirement for logic
++ * to retry the entire slot lookup -- the indirect pointer
++ * problem (replacing direct root node with an indirect pointer
++ * also results in a stale slot). So tag the slot as indirect
++ * to force callers to retry.
++ */
++ if (root->height == 0)
++ *((unsigned long *)&to_free->slots[0]) |=
++ RADIX_TREE_INDIRECT_PTR;
++
+ radix_tree_node_free(to_free);
+ }
+ }
+@@ -1254,7 +1288,7 @@ void *radix_tree_delete(struct radix_tre
+ root->rnode = NULL;
+ goto out;
+ }
+- slot = radix_tree_indirect_to_ptr(slot);
++ slot = indirect_to_ptr(slot);
+
+ shift = (height - 1) * RADIX_TREE_MAP_SHIFT;
+ pathp->node = NULL;
+@@ -1296,8 +1330,7 @@ void *radix_tree_delete(struct radix_tre
+ radix_tree_node_free(to_free);
+
+ if (pathp->node->count) {
+- if (pathp->node ==
+- radix_tree_indirect_to_ptr(root->rnode))
++ if (pathp->node == indirect_to_ptr(root->rnode))
+ radix_tree_shrink(root);
+ goto out;
+ }
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -631,7 +631,9 @@ repeat:
+ pagep = radix_tree_lookup_slot(&mapping->page_tree, offset);
+ if (pagep) {
+ page = radix_tree_deref_slot(pagep);
+- if (unlikely(!page || page == RADIX_TREE_RETRY))
++ if (unlikely(!page))
++ goto out;
++ if (radix_tree_deref_retry(page))
+ goto repeat;
+
+ if (!page_cache_get_speculative(page))
+@@ -647,6 +649,7 @@ repeat:
+ goto repeat;
+ }
+ }
++out:
+ rcu_read_unlock();
+
+ return page;
+@@ -764,12 +767,11 @@ repeat:
+ page = radix_tree_deref_slot((void **)pages[i]);
+ if (unlikely(!page))
+ continue;
+- /*
+- * this can only trigger if nr_found == 1, making livelock
+- * a non issue.
+- */
+- if (unlikely(page == RADIX_TREE_RETRY))
++ if (radix_tree_deref_retry(page)) {
++ if (ret)
++ start = pages[ret-1]->index;
+ goto restart;
++ }
+
+ if (!page_cache_get_speculative(page))
+ goto repeat;
+@@ -817,11 +819,7 @@ repeat:
+ page = radix_tree_deref_slot((void **)pages[i]);
+ if (unlikely(!page))
+ continue;
+- /*
+- * this can only trigger if nr_found == 1, making livelock
+- * a non issue.
+- */
+- if (unlikely(page == RADIX_TREE_RETRY))
++ if (radix_tree_deref_retry(page))
+ goto restart;
+
+ if (page->mapping == NULL || page->index != index)
+@@ -874,11 +872,7 @@ repeat:
+ page = radix_tree_deref_slot((void **)pages[i]);
+ if (unlikely(!page))
+ continue;
+- /*
+- * this can only trigger if nr_found == 1, making livelock
+- * a non issue.
+- */
+- if (unlikely(page == RADIX_TREE_RETRY))
++ if (radix_tree_deref_retry(page))
+ goto restart;
+
+ if (!page_cache_get_speculative(page))
tty-open-hangup-race-fixup.patch
usbnet-fix-usb_autopm_get_interface-failure-v1.patch
hid-fix-for-problems-with-egalax-dwav-multi-touch-screen.patch
+gspca-main-fix-a-regression-with-the-ps3-eye-webcam.patch
+gspca-sonixj-fix-a-regression-of-sensors-hv7131r-and-mi0360.patch
+hdpvr-add-missing-urb_no_transfer_dma_map-flag.patch
+drivers-media-video-cx23885-cx23885-core.c-fix-cx23885_dev_checkrevision.patch
+nfs-handle-lock-context-allocation-failures-in-nfs_create_request.patch
+kvm-write-protect-memory-after-slot-swap.patch
+kvm-x86-fix-information-leak-to-userland.patch
+kvm-correct-ordering-of-ldt-reload-wrt-fs-gs-reload.patch
+kvm-vmx-fix-host-userspace-gsbase-corruption.patch
+asoc-remove-volatility-from-wm8900-power1-register.patch
+asoc-wm8961-clear-wm8961_dacslope-bit-for-normal-mode.patch
+asoc-wm8961-clear-wm8961_mclkdiv-bit-for-freq-16500000.patch
+firewire-ohci-fix-buffer-overflow-in-ar-split-packet-handling.patch
+firewire-ohci-fix-race-in-ar-split-packet-handling.patch
+alsa-hda-fixed-alc887-vd-initial-error.patch
+alsa-ac97-apply-quirk-for-dell-latitude-d610-binding-master-and-headphone-controls.patch
+alsa-hda-add-fixup-pins-for-ideapad-y550.patch
+alsa-hda-added-fixup-for-lenovo-y550p.patch
+alsa-hda-add-speaker-pin-to-automute-acer-aspire-8943g.patch
+alsa-hda-add-samsung-r720-ssid-for-subwoofer-pin-fixup.patch
+alsa-hda-use-alc_init_default-for-really-default-initialization.patch
+alsa-hda-fix-alc660-vd-alc861-vd-capture-playback-mixers.patch
+alsa-hda-add-an-extra-dac-for-realtek-alc887-vd.patch
+alsa-fix-sndctl_dsp_reset-ioctl-for-oss-emulation.patch
+alsa-hda-use-alienware-model-quirk-for-another-ssid.patch
+netfilter-nf_conntrack-allow-nf_ct_alloc_hashtable-to-get-highmem-pages.patch
+netfilter-nf_hook_cond-has-wrong-conditional.patch
+radix-tree-fix-rcu-bug.patch
+latencytop-fix-per-task-accumulator.patch
+mm-vfs-revalidate-page-mapping-in-do_generic_file_read.patch
+bio-take-care-not-overflow-page-count-when-mapping-copying-user-data.patch
+drm-radeon-kms-atom-set-sane-defaults-in-atombios_get_encoder_mode.patch
+drm-radeon-kms-fix-typos-in-disabled-vbios-code.patch
+drm-radeon-kms-add-workaround-for-dce3-ddc-line-vbios-bug.patch
+drm-radeon-kms-fix-retrying-ttm_bo_init-after-it-failed-once.patch
+drm-radeon-kms-fix-thermal-sensor-reporting-on-rv6xx.patch
+drm-radeon-kms-fix-i2c-pad-masks-on-rs4xx.patch
+drm-radeon-kms-fix-resume-regression-for-some-r5xx-laptops.patch
+drm-radeon-kms-fix-regression-in-rs4xx-i2c-setup.patch
+drm-radeon-kms-fix-interlaced-and-doublescan-handling.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
