--- /dev/null
+From e9d010c2e8f03952e67a6fd8aed0f0dc92084ccc Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 1 Feb 2012 10:33:23 +0100
+Subject: ALSA: hda - Allow analog low-current mode when dynamic power-control is on
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit e9d010c2e8f03952e67a6fd8aed0f0dc92084ccc upstream.
+
+VIA codecs have several different power-saving features, and one of
+them is the analog low-current mode. But it turned out that the ALC
+mode causes pop-noises at each on/off time on some machines. As a
+quick workaround, disable the ALC when another power-saving feature,
+the dynamic pin power-control, is turned off, too, since the dynamic
+power-control is already exposed as a mixer enum element so that user
+can turn it on/off freely.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=741128
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_via.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -198,6 +198,9 @@ struct via_spec {
+ unsigned int no_pin_power_ctl;
+ enum VIA_HDA_CODEC codec_type;
+
++ /* analog low-power control */
++ bool alc_mode;
++
+ /* smart51 setup */
+ unsigned int smart51_nums;
+ hda_nid_t smart51_pins[2];
+@@ -748,6 +751,7 @@ static int via_pin_power_ctl_put(struct
+ return 0;
+ spec->no_pin_power_ctl = val;
+ set_widgets_power_state(codec);
++ analog_low_current_mode(codec);
+ return 1;
+ }
+
+@@ -1035,13 +1039,19 @@ static bool is_aa_path_mute(struct hda_c
+ }
+
+ /* enter/exit analog low-current mode */
+-static void analog_low_current_mode(struct hda_codec *codec)
++static void __analog_low_current_mode(struct hda_codec *codec, bool force)
+ {
+ struct via_spec *spec = codec->spec;
+ bool enable;
+ unsigned int verb, parm;
+
+- enable = is_aa_path_mute(codec) && !spec->opened_streams;
++ if (spec->no_pin_power_ctl)
++ enable = false;
++ else
++ enable = is_aa_path_mute(codec) && !spec->opened_streams;
++ if (enable == spec->alc_mode && !force)
++ return;
++ spec->alc_mode = enable;
+
+ /* decide low current mode's verb & parameter */
+ switch (spec->codec_type) {
+@@ -1073,6 +1083,11 @@ static void analog_low_current_mode(stru
+ snd_hda_codec_write(codec, codec->afg, 0, verb, parm);
+ }
+
++static void analog_low_current_mode(struct hda_codec *codec)
++{
++ return __analog_low_current_mode(codec, false);
++}
++
+ /*
+ * generic initialization of ADC, input mixers and output mixers
+ */
+@@ -1498,10 +1513,6 @@ static int via_build_controls(struct hda
+ return err;
+ }
+
+- /* init power states */
+- set_widgets_power_state(codec);
+- analog_low_current_mode(codec);
+-
+ via_free_kctls(codec); /* no longer needed */
+ return 0;
+ }
+@@ -2771,6 +2782,10 @@ static int via_init(struct hda_codec *co
+ for (i = 0; i < spec->num_iverbs; i++)
+ snd_hda_sequence_write(codec, spec->init_verbs[i]);
+
++ /* init power states */
++ set_widgets_power_state(codec);
++ __analog_low_current_mode(codec, true);
++
+ via_auto_init_multi_out(codec);
+ via_auto_init_hp_out(codec);
+ via_auto_init_speaker_out(codec);
--- /dev/null
+From 31150f2327cbb66363f38e13ca1be973d2f9203a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 30 Jan 2012 10:54:08 +0100
+Subject: ALSA: hda - Apply 0x0f-VREF fix to all ASUS laptops with ALC861/660
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 31150f2327cbb66363f38e13ca1be973d2f9203a upstream.
+
+It turned out that other ASUS laptops require the similar fix to
+enable the VREF on the pin 0x0f for the secret output amp, not only
+ASUS A6Rp. Moreover, it's required even when the pin is being used
+as the output. Thus, writing a fixed value doesn't work always.
+
+This patch applies the VREF-fix for all ASUS laptops with ALC861/660
+in a fixup function that checks the current value and turns on only
+the VREF value no matter whether input or output direction is set.
+
+The automute function is modified as well to keep the pin VREF upon
+muting/unmuting via pin-control; otherwise the pin VREF is reset at
+plugging/unplugging a jack.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42588
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 43 ++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 35 insertions(+), 8 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -176,6 +176,7 @@ struct alc_spec {
+ unsigned int detect_lo:1; /* Line-out detection enabled */
+ unsigned int automute_speaker_possible:1; /* there are speakers and either LO or HP */
+ unsigned int automute_lo_possible:1; /* there are line outs and HP */
++ unsigned int keep_vref_in_automute:1; /* Don't clear VREF in automute */
+
+ /* other flags */
+ unsigned int no_analog :1; /* digital I/O only */
+@@ -519,13 +520,24 @@ static void do_automute(struct hda_codec
+
+ for (i = 0; i < num_pins; i++) {
+ hda_nid_t nid = pins[i];
++ unsigned int val;
+ if (!nid)
+ break;
+ switch (spec->automute_mode) {
+ case ALC_AUTOMUTE_PIN:
++ /* don't reset VREF value in case it's controlling
++ * the amp (see alc861_fixup_asus_amp_vref_0f())
++ */
++ if (spec->keep_vref_in_automute) {
++ val = snd_hda_codec_read(codec, nid, 0,
++ AC_VERB_GET_PIN_WIDGET_CONTROL, 0);
++ val &= ~PIN_HP;
++ } else
++ val = 0;
++ val |= pin_bits;
+ snd_hda_codec_write(codec, nid, 0,
+ AC_VERB_SET_PIN_WIDGET_CONTROL,
+- pin_bits);
++ val);
+ break;
+ case ALC_AUTOMUTE_AMP:
+ snd_hda_codec_amp_stereo(codec, nid, HDA_OUTPUT, 0,
+@@ -5225,6 +5237,25 @@ enum {
+ PINFIX_ASUS_A6RP,
+ };
+
++/* On some laptops, VREF of pin 0x0f is abused for controlling the main amp */
++static void alc861_fixup_asus_amp_vref_0f(struct hda_codec *codec,
++ const struct alc_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++ unsigned int val;
++
++ if (action != ALC_FIXUP_ACT_INIT)
++ return;
++ val = snd_hda_codec_read(codec, 0x0f, 0,
++ AC_VERB_GET_PIN_WIDGET_CONTROL, 0);
++ if (!(val & (AC_PINCTL_IN_EN | AC_PINCTL_OUT_EN)))
++ val |= AC_PINCTL_IN_EN;
++ val |= AC_PINCTL_VREF_50;
++ snd_hda_codec_write(codec, 0x0f, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, val);
++ spec->keep_vref_in_automute = 1;
++}
++
+ static const struct alc_fixup alc861_fixups[] = {
+ [PINFIX_FSC_AMILO_PI1505] = {
+ .type = ALC_FIXUP_PINS,
+@@ -5235,17 +5266,13 @@ static const struct alc_fixup alc861_fix
+ }
+ },
+ [PINFIX_ASUS_A6RP] = {
+- .type = ALC_FIXUP_VERBS,
+- .v.verbs = (const struct hda_verb[]) {
+- /* node 0x0f VREF seems controlling the master output */
+- { 0x0f, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF50 },
+- { }
+- },
++ .type = ALC_FIXUP_FUNC,
++ .v.func = alc861_fixup_asus_amp_vref_0f,
+ },
+ };
+
+ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
+- SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", PINFIX_ASUS_A6RP),
++ SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", PINFIX_ASUS_A6RP),
+ SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", PINFIX_ASUS_A6RP),
+ SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
+ {}
--- /dev/null
+From b5bcc189401c815988b7dd37611fc56f40c9139d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 2 Feb 2012 10:30:17 +0100
+Subject: ALSA: hda - Disable dynamic-power control for VIA as default
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b5bcc189401c815988b7dd37611fc56f40c9139d upstream.
+
+Since the dynamic pin power-control and the analog low-current mode
+may lead to pop-noise, it's safer to set it off as default.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=741128
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_via.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -1460,6 +1460,7 @@ static int via_build_controls(struct hda
+ struct snd_kcontrol *kctl;
+ int err, i;
+
++ spec->no_pin_power_ctl = 1;
+ if (spec->set_widgets_power_state)
+ if (!via_clone_control(spec, &via_pin_power_ctl_enum))
+ return -ENOMEM;
--- /dev/null
+From f70eecde3bca92630d3886496e73316ff353f185 Mon Sep 17 00:00:00 2001
+From: Dylan Reid <dgreid@chromium.org>
+Date: Tue, 31 Jan 2012 13:04:41 -0800
+Subject: ALSA: hda - Fix calling cs_automic twice for Cirrus codecs.
+
+From: Dylan Reid <dgreid@chromium.org>
+
+commit f70eecde3bca92630d3886496e73316ff353f185 upstream.
+
+If cs_automic is called twice (like it is during init) while the mic
+is present, it will over-write the last_input with the new one,
+causing it to switch back to the automic input when the mic is
+unplugged. This leaves the driver in a state (cur_input, last_input,
+and automix_idx the same) where the internal mic can not be selected
+until it is rebooted without the mic attached.
+
+Check that the mic hasn't already been switched to before setting
+last_input.
+
+Signed-off-by: Dylan Reid <dgreid@chromium.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_cirrus.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -976,8 +976,10 @@ static void cs_automic(struct hda_codec
+ /* specific to CS421x, single ADC */
+ if (spec->vendor_nid == CS421X_VENDOR_NID) {
+ if (present) {
+- spec->last_input = spec->cur_input;
+- spec->cur_input = spec->automic_idx;
++ if (spec->cur_input != spec->automic_idx) {
++ spec->last_input = spec->cur_input;
++ spec->cur_input = spec->automic_idx;
++ }
+ } else {
+ spec->cur_input = spec->last_input;
+ }
--- /dev/null
+From 54c2a89f60fd71b924d0f848ac892442951401a6 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Wed, 1 Feb 2012 12:05:41 +0100
+Subject: ALSA: HDA: Fix duplicated output to more than one codec
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 54c2a89f60fd71b924d0f848ac892442951401a6 upstream.
+
+This typo caused the wrong codec's nid to be checked for wcaps type.
+As a result, sometimes speakers would duplicate the output sent to
+HDMI output.
+
+BugLink: https://bugs.launchpad.net/bugs/924320
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_codec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -1446,7 +1446,7 @@ void snd_hda_codec_setup_stream(struct h
+ for (i = 0; i < c->cvt_setups.used; i++) {
+ p = snd_array_elem(&c->cvt_setups, i);
+ if (!p->active && p->stream_tag == stream_tag &&
+- get_wcaps_type(get_wcaps(codec, p->nid)) == type)
++ get_wcaps_type(get_wcaps(c, p->nid)) == type)
+ p->dirty = 1;
+ }
+ }
--- /dev/null
+From 924339239fd5ba3e505f9420d41f0939196f3530 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 24 Jan 2012 13:58:36 +0100
+Subject: ALSA: hda - Fix the logic to detect VIA analog low-current mode
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 924339239fd5ba3e505f9420d41f0939196f3530 upstream.
+
+The analog low-current mode must be enabled when the no stream is
+running but the current detection checks it in a wrong way.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=741128
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_via.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -1041,7 +1041,7 @@ static void analog_low_current_mode(stru
+ bool enable;
+ unsigned int verb, parm;
+
+- enable = is_aa_path_mute(codec) && (spec->opened_streams != 0);
++ enable = is_aa_path_mute(codec) && !spec->opened_streams;
+
+ /* decide low current mode's verb & parameter */
+ switch (spec->codec_type) {
--- /dev/null
+From a389d67cf9849aff1722ed73186a584e2196a873 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Fri, 27 Jan 2012 14:31:19 +0100
+Subject: ALSA: HDA: Remove quirk for Asus N53Jq
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit a389d67cf9849aff1722ed73186a584e2196a873 upstream.
+
+The user reports that he needs to add model=auto for audio to
+work properly. In fact, since node 0x15 is not even a pin node,
+the existing fixup is definitely wrong. Relevant information can
+be found in the buglink below.
+
+BugLink: https://bugs.launchpad.net/bugs/918254
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5011,7 +5011,6 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x8330, "ASUS Eeepc P703 P900A",
+ ALC269_FIXUP_AMIC),
+ SND_PCI_QUIRK(0x1043, 0x1013, "ASUS N61Da", ALC269_FIXUP_AMIC),
+- SND_PCI_QUIRK(0x1043, 0x1113, "ASUS N63Jn", ALC269_FIXUP_AMIC),
+ SND_PCI_QUIRK(0x1043, 0x1143, "ASUS B53f", ALC269_FIXUP_AMIC),
+ SND_PCI_QUIRK(0x1043, 0x1133, "ASUS UJ20ft", ALC269_FIXUP_AMIC),
+ SND_PCI_QUIRK(0x1043, 0x1183, "ASUS K72DR", ALC269_FIXUP_AMIC),
--- /dev/null
+From 2af276dfb1722e97b190bd2e646b079a2aa674db Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Mon, 30 Jan 2012 20:21:42 +0100
+Subject: ARM: 7306/1: vfp: flush thread hwstate before restoring context from sigframe
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 2af276dfb1722e97b190bd2e646b079a2aa674db upstream.
+
+Following execution of a signal handler, we currently restore the VFP
+context from the ucontext in the signal frame. This involves copying
+from the user stack into the current thread's vfp_hard_struct and then
+flushing the new data out to the hardware registers.
+
+This is problematic when using a preemptible kernel because we could be
+context switched whilst updating the vfp_hard_struct. If the current
+thread has made use of VFP since the last context switch, the VFP
+notifier will copy from the hardware registers into the vfp_hard_struct,
+overwriting any data that had been partially copied by the signal code.
+
+Disabling preemption across copy_from_user calls is a terrible idea, so
+instead we move the VFP thread flush *before* we update the
+vfp_hard_struct. Since the flushing is performed lazily, this has the
+effect of disabling VFP and clearing the CPU's VFP state pointer,
+therefore preventing the thread from being updated with stale data on
+the next context switch.
+
+Tested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/signal.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -227,6 +227,8 @@ static int restore_vfp_context(struct vf
+ if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
+ return -EINVAL;
+
++ vfp_flush_hwstate(thread);
++
+ /*
+ * Copy the floating point registers. There can be unused
+ * registers see asm/hwcap.h for details.
+@@ -251,9 +253,6 @@ static int restore_vfp_context(struct vf
+ __get_user_error(h->fpinst, &frame->ufp_exc.fpinst, err);
+ __get_user_error(h->fpinst2, &frame->ufp_exc.fpinst2, err);
+
+- if (!err)
+- vfp_flush_hwstate(thread);
+-
+ return err ? -EFAULT : 0;
+ }
+
--- /dev/null
+From 247f4993a5974e6759606c4d380748eecfd273ff Mon Sep 17 00:00:00 2001
+From: Dave Martin <dave.martin@linaro.org>
+Date: Mon, 30 Jan 2012 20:22:28 +0100
+Subject: ARM: 7307/1: vfp: fix ptrace regset modification race
+
+From: Dave Martin <dave.martin@linaro.org>
+
+commit 247f4993a5974e6759606c4d380748eecfd273ff upstream.
+
+In a preemptible kernel, vfp_set() can be preempted, causing the
+hardware VFP context to be switched while the thread vfp state is
+being read and modified. This leads to a race condition which can
+cause the thread vfp state to become corrupted if lazy VFP context
+save occurs due to preemption in between the time thread->vfpstate
+is read and the time the modified state is written back.
+
+This may occur if preemption occurs during the execution of a
+ptrace() call which modifies the VFP register state of a thread.
+Such instances should be very rare in most realistic scenarios --
+none has been reported, so far as I am aware. Only uniprocessor
+systems should be affected, since VFP context save is not currently
+lazy in SMP kernels.
+
+The problem was introduced by my earlier patch migrating to use
+regsets to implement ptrace.
+
+This patch does a vfp_sync_hwstate() before reading
+thread->vfpstate, to make sure that the thread's VFP state is not
+live in the hardware registers while the registers are modified.
+
+Thanks to Will Deacon for spotting this.
+
+Signed-off-by: Dave Martin <dave.martin@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/ptrace.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/kernel/ptrace.c
++++ b/arch/arm/kernel/ptrace.c
+@@ -699,10 +699,13 @@ static int vfp_set(struct task_struct *t
+ {
+ int ret;
+ struct thread_info *thread = task_thread_info(target);
+- struct vfp_hard_struct new_vfp = thread->vfpstate.hard;
++ struct vfp_hard_struct new_vfp;
+ const size_t user_fpregs_offset = offsetof(struct user_vfp, fpregs);
+ const size_t user_fpscr_offset = offsetof(struct user_vfp, fpscr);
+
++ vfp_sync_hwstate(thread);
++ new_vfp = thread->vfpstate.hard;
++
+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+ &new_vfp.fpregs,
+ user_fpregs_offset,
+@@ -723,7 +726,6 @@ static int vfp_set(struct task_struct *t
+ if (ret)
+ return ret;
+
+- vfp_sync_hwstate(thread);
+ thread->vfpstate.hard = new_vfp;
+ vfp_flush_hwstate(thread);
+
--- /dev/null
+From 8130b9d7b9d858aa04ce67805e8951e3cb6e9b2f Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Mon, 30 Jan 2012 20:23:29 +0100
+Subject: ARM: 7308/1: vfp: flush thread hwstate before copying ptrace registers
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 8130b9d7b9d858aa04ce67805e8951e3cb6e9b2f upstream.
+
+If we are context switched whilst copying into a thread's
+vfp_hard_struct then the partial copy may be corrupted by the VFP
+context switching code (see "ARM: vfp: flush thread hwstate before
+restoring context from sigframe").
+
+This patch updates the ptrace VFP set code so that the thread state is
+flushed before the copy, therefore disabling VFP and preventing
+corruption from occurring.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/ptrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/kernel/ptrace.c
++++ b/arch/arm/kernel/ptrace.c
+@@ -726,8 +726,8 @@ static int vfp_set(struct task_struct *t
+ if (ret)
+ return ret;
+
+- thread->vfpstate.hard = new_vfp;
+ vfp_flush_hwstate(thread);
++ thread->vfpstate.hard = new_vfp;
+
+ return 0;
+ }
--- /dev/null
+From 8ef5d844cc3a644ea6f7665932a4307e9fad01fa Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegor_sub1@visionsystems.de>
+Date: Mon, 23 Jan 2012 08:32:23 +0100
+Subject: ARM: OMAP2+: GPMC: fix device size setup
+
+From: Yegor Yefremov <yegor_sub1@visionsystems.de>
+
+commit 8ef5d844cc3a644ea6f7665932a4307e9fad01fa upstream.
+
+following statement can only change device size from 8-bit(0) to 16-bit(1),
+but not vice versa:
+
+regval |= GPMC_CONFIG1_DEVICESIZE(wval);
+
+so as this field has 1 reserved bit, that could be used in future,
+just clear both bits and then OR with the desired value
+
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/gpmc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/arm/mach-omap2/gpmc.c
++++ b/arch/arm/mach-omap2/gpmc.c
+@@ -528,7 +528,13 @@ int gpmc_cs_configure(int cs, int cmd, i
+
+ case GPMC_CONFIG_DEV_SIZE:
+ regval = gpmc_cs_read_reg(cs, GPMC_CS_CONFIG1);
++
++ /* clear 2 target bits */
++ regval &= ~GPMC_CONFIG1_DEVICESIZE(3);
++
++ /* set the proper value */
+ regval |= GPMC_CONFIG1_DEVICESIZE(wval);
++
+ gpmc_cs_write_reg(cs, GPMC_CS_CONFIG1, regval);
+ break;
+
--- /dev/null
+From 77231abe55433aa17eca712718745275853fa66d Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Fri, 20 Jan 2012 12:19:43 +0000
+Subject: ASoC: wm_hubs: Enable line out VMID buffer for single ended line outputs
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 77231abe55433aa17eca712718745275853fa66d upstream.
+
+For optimal performance the single ended line outputs require that the
+line output VMID buffer be enabled.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm_hubs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -614,6 +614,8 @@ SND_SOC_DAPM_INPUT("IN2RP:VXRP"),
+ SND_SOC_DAPM_MICBIAS("MICBIAS2", WM8993_POWER_MANAGEMENT_1, 5, 0),
+ SND_SOC_DAPM_MICBIAS("MICBIAS1", WM8993_POWER_MANAGEMENT_1, 4, 0),
+
++SND_SOC_DAPM_SUPPLY("LINEOUT_VMID_BUF", WM8993_ANTIPOP1, 7, 0, NULL, 0),
++
+ SND_SOC_DAPM_MIXER("IN1L PGA", WM8993_POWER_MANAGEMENT_2, 6, 0,
+ in1l_pga, ARRAY_SIZE(in1l_pga)),
+ SND_SOC_DAPM_MIXER("IN1R PGA", WM8993_POWER_MANAGEMENT_2, 4, 0,
+@@ -832,9 +834,11 @@ static const struct snd_soc_dapm_route l
+ };
+
+ static const struct snd_soc_dapm_route lineout1_se_routes[] = {
++ { "LINEOUT1N Mixer", NULL, "LINEOUT_VMID_BUF" },
+ { "LINEOUT1N Mixer", "Left Output Switch", "Left Output PGA" },
+ { "LINEOUT1N Mixer", "Right Output Switch", "Right Output PGA" },
+
++ { "LINEOUT1P Mixer", NULL, "LINEOUT_VMID_BUF" },
+ { "LINEOUT1P Mixer", "Left Output Switch", "Left Output PGA" },
+
+ { "LINEOUT1N Driver", NULL, "LINEOUT1N Mixer" },
+@@ -851,9 +855,11 @@ static const struct snd_soc_dapm_route l
+ };
+
+ static const struct snd_soc_dapm_route lineout2_se_routes[] = {
++ { "LINEOUT2N Mixer", NULL, "LINEOUT_VMID_BUF" },
+ { "LINEOUT2N Mixer", "Left Output Switch", "Left Output PGA" },
+ { "LINEOUT2N Mixer", "Right Output Switch", "Right Output PGA" },
+
++ { "LINEOUT2P Mixer", NULL, "LINEOUT_VMID_BUF" },
+ { "LINEOUT2P Mixer", "Right Output Switch", "Right Output PGA" },
+
+ { "LINEOUT2N Driver", NULL, "LINEOUT2N Mixer" },
--- /dev/null
+From 114395c61ad2eb5a7a5cd163fcadb2414e48245a Mon Sep 17 00:00:00 2001
+From: UK KIM <w0806.kim@samsung.com>
+Date: Sat, 28 Jan 2012 01:52:22 +0900
+Subject: ASoC: wm_hubs: fix wrong bits for LINEOUT2 N/P mixer
+
+From: UK KIM <w0806.kim@samsung.com>
+
+commit 114395c61ad2eb5a7a5cd163fcadb2414e48245a upstream.
+
+Signed-off-by: UK KIM <w0806.kim@samsung.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm_hubs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -593,8 +593,8 @@ SOC_DAPM_SINGLE("Output Switch", WM8993_
+ };
+
+ static const struct snd_kcontrol_new line2n_mix[] = {
+-SOC_DAPM_SINGLE("Left Output Switch", WM8993_LINE_MIXER2, 6, 1, 0),
+-SOC_DAPM_SINGLE("Right Output Switch", WM8993_LINE_MIXER2, 5, 1, 0),
++SOC_DAPM_SINGLE("Left Output Switch", WM8993_LINE_MIXER2, 5, 1, 0),
++SOC_DAPM_SINGLE("Right Output Switch", WM8993_LINE_MIXER2, 6, 1, 0),
+ };
+
+ static const struct snd_kcontrol_new line2p_mix[] = {
--- /dev/null
+From cbcb8346054073d000ecac324763372d6abd44ac Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Fri, 3 Feb 2012 15:37:15 -0800
+Subject: drivers/tty/vt/vt_ioctl.c: fix KDFONTOP 32bit compatibility layer
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit cbcb8346054073d000ecac324763372d6abd44ac upstream.
+
+KDFONTOP(GET) currently fails with EIO when being run in a 32bit userland
+with a 64bit kernel if the font width is not 8.
+
+This is because of the setting of the KD_FONT_FLAG_OLD flag, which makes
+con_font_get return EIO in such case.
+
+This flag should *not* be set for KDFONTOP, since it's actually the whole
+point of this flag (see comment in con_font_set for instance).
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arthur Taylor <art@ified.ca>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/vt/vt_ioctl.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -1463,7 +1463,6 @@ compat_kdfontop_ioctl(struct compat_cons
+ if (!perm && op->op != KD_FONT_OP_GET)
+ return -EPERM;
+ op->data = compat_ptr(((struct compat_console_font_op *)op)->data);
+- op->flags |= KD_FONT_FLAG_OLD;
+ i = con_font_op(vc, op);
+ if (i)
+ return i;
--- /dev/null
+From d1bb399ad03c11e792f6dea198d3b1e23061f094 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Thu, 26 Jan 2012 22:05:58 +0100
+Subject: firewire: ohci: add reset packet quirk for SB Audigy
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit d1bb399ad03c11e792f6dea198d3b1e23061f094 upstream.
+
+The Audigy's SB1394 controller is actually from Texas Instruments
+and has the same bus reset packet generation bug, so it needs the
+same quirk entry.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firewire/ohci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -263,6 +263,7 @@ static inline struct fw_ohci *fw_ohci(st
+ static char ohci_driver_name[] = KBUILD_MODNAME;
+
+ #define PCI_DEVICE_ID_AGERE_FW643 0x5901
++#define PCI_DEVICE_ID_CREATIVE_SB1394 0x4001
+ #define PCI_DEVICE_ID_JMICRON_JMB38X_FW 0x2380
+ #define PCI_DEVICE_ID_TI_TSB12LV22 0x8009
+ #define PCI_DEVICE_ID_TI_TSB12LV26 0x8020
+@@ -289,6 +290,9 @@ static const struct {
+ {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
+ QUIRK_NO_MSI},
+
++ {PCI_VENDOR_ID_CREATIVE, PCI_DEVICE_ID_CREATIVE_SB1394, PCI_ANY_ID,
++ QUIRK_RESET_PACKET},
++
+ {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, PCI_ANY_ID,
+ QUIRK_NO_MSI},
+
--- /dev/null
+From 320cfa6ce0b3dc794fedfa4bae54c0f65077234d Mon Sep 17 00:00:00 2001
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Date: Sun, 29 Jan 2012 12:41:15 +0100
+Subject: firewire: ohci: disable MSI on Ricoh controllers
+
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+commit 320cfa6ce0b3dc794fedfa4bae54c0f65077234d upstream.
+
+The PCIe device
+
+ FireWire (IEEE 1394) [0c00]: Ricoh Co Ltd FireWire Host Controller
+ [1180:e832] (prog-if 10 [OHCI])
+
+is unable to access attached FireWire devices when MSI is enabled but
+works if MSI is disabled.
+http://www.mail-archive.com/alsa-user@lists.sourceforge.net/msg28251.html
+
+Hence add the "disable MSI" quirks flag for this device, or in fact for
+safety and simplicity for all current (R5U230, R5U231, R5U240) and
+future Ricoh PCIe 1394 controllers.
+
+Reported-by: Stefan Thomas <kontrapunktstefan@googlemail.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firewire/ohci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -303,7 +303,7 @@ static const struct {
+ QUIRK_NO_MSI},
+
+ {PCI_VENDOR_ID_RICOH, PCI_ANY_ID, PCI_ANY_ID,
+- QUIRK_CYCLE_TIMER},
++ QUIRK_CYCLE_TIMER | QUIRK_NO_MSI},
+
+ {PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_TSB12LV22, PCI_ANY_ID,
+ QUIRK_CYCLE_TIMER | QUIRK_RESET_PACKET | QUIRK_NO_1394A},
--- /dev/null
+From a6f7feae6d19e84253918d88b04153af09d3a243 Mon Sep 17 00:00:00 2001
+From: Jack Morgenstein <jackm@mellanox.com>
+Date: Thu, 26 Jan 2012 16:41:33 +0200
+Subject: IB/mlx4: pass SMP vendor-specific attribute MADs to firmware
+
+From: Jack Morgenstein <jackm@mellanox.com>
+
+commit a6f7feae6d19e84253918d88b04153af09d3a243 upstream.
+
+In the current code, vendor-specific MADs (e.g with the FDR-10
+attribute) are silently dropped by the driver, resulting in timeouts
+at the sending side and inability to query/configure the relevant
+feature. However, the ConnectX firmware is able to handle such MADs.
+For unsupported attributes, the firmware returns a GET_RESPONSE MAD
+containing an error status.
+
+For example, for a FDR-10 node with LID 11:
+
+ # ibstat mlx4_0 1
+
+ CA: 'mlx4_0'
+ Port 1:
+ State: Active
+ Physical state: LinkUp
+ Rate: 40 (FDR10)
+ Base lid: 11
+ LMC: 0
+ SM lid: 24
+ Capability mask: 0x02514868
+ Port GUID: 0x0002c903002e65d1
+ Link layer: InfiniBand
+
+Extended Port Query (EPI) vendor mad timeouts before the patch:
+
+ # smpquery MEPI 11 -d
+
+ ibwarn: [4196] smp_query_via: attr 0xff90 mod 0x0 route Lid 11
+ ibwarn: [4196] _do_madrpc: retry 1 (timeout 1000 ms)
+ ibwarn: [4196] _do_madrpc: retry 2 (timeout 1000 ms)
+ ibwarn: [4196] _do_madrpc: timeout after 3 retries, 3000 ms
+ ibwarn: [4196] mad_rpc: _do_madrpc failed; dport (Lid 11)
+ smpquery: iberror: [pid 4196] main: failed: operation EPI: ext port info query failed
+
+EPI query works OK with the patch:
+
+ # smpquery MEPI 11 -d
+
+ ibwarn: [6548] smp_query_via: attr 0xff90 mod 0x0 route Lid 11
+ ibwarn: [6548] mad_rpc: data offs 64 sz 64
+ mad data
+ 0000 0000 0000 0001 0000 0001 0000 0001
+ 0000 0000 0000 0000 0000 0000 0000 0000
+ 0000 0000 0000 0000 0000 0000 0000 0000
+ 0000 0000 0000 0000 0000 0000 0000 0000
+ # Ext Port info: Lid 11 port 0
+ StateChangeEnable:...............0x00
+ LinkSpeedSupported:..............0x01
+ LinkSpeedEnabled:................0x01
+ LinkSpeedActive:.................0x01
+
+Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Acked-by: Ira Weiny <weiny2@llnl.gov>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/mad.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/mad.c
++++ b/drivers/infiniband/hw/mlx4/mad.c
+@@ -256,12 +256,9 @@ static int ib_process_mad(struct ib_devi
+ return IB_MAD_RESULT_SUCCESS;
+
+ /*
+- * Don't process SMInfo queries or vendor-specific
+- * MADs -- the SMA can't handle them.
++ * Don't process SMInfo queries -- the SMA can't handle them.
+ */
+- if (in_mad->mad_hdr.attr_id == IB_SMP_ATTR_SM_INFO ||
+- ((in_mad->mad_hdr.attr_id & IB_SMP_ATTR_VENDOR_MASK) ==
+- IB_SMP_ATTR_VENDOR_MASK))
++ if (in_mad->mad_hdr.attr_id == IB_SMP_ATTR_SM_INFO)
+ return IB_MAD_RESULT_SUCCESS;
+ } else if (in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT ||
+ in_mad->mad_hdr.mgmt_class == MLX4_IB_VENDOR_CLASS1 ||
--- /dev/null
+From 55ca6140e9bb307efc97a9301a4f501de02a6fd6 Mon Sep 17 00:00:00 2001
+From: Jiang Liu <liuj97@gmail.com>
+Date: Fri, 3 Feb 2012 15:37:16 -0800
+Subject: kprobes: fix a memory leak in function pre_handler_kretprobe()
+
+From: Jiang Liu <liuj97@gmail.com>
+
+commit 55ca6140e9bb307efc97a9301a4f501de02a6fd6 upstream.
+
+In function pre_handler_kretprobe(), the allocated kretprobe_instance
+object will get leaked if the entry_handler callback returns non-zero.
+This may cause all the preallocated kretprobe_instance objects exhausted.
+
+This issue can be reproduced by changing
+samples/kprobes/kretprobe_example.c to probe "mutex_unlock". And the fix
+is straightforward: just put the allocated kretprobe_instance object back
+onto the free_instances list.
+
+[akpm@linux-foundation.org: use raw_spin_lock/unlock]
+Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
+Acked-by: Jim Keniston <jkenisto@us.ibm.com>
+Acked-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
+Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/kprobes.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1673,8 +1673,12 @@ static int __kprobes pre_handler_kretpro
+ ri->rp = rp;
+ ri->task = current;
+
+- if (rp->entry_handler && rp->entry_handler(ri, regs))
++ if (rp->entry_handler && rp->entry_handler(ri, regs)) {
++ raw_spin_lock_irqsave(&rp->lock, flags);
++ hlist_add_head(&ri->hlist, &rp->free_instances);
++ raw_spin_unlock_irqrestore(&rp->lock, flags);
+ return 0;
++ }
+
+ arch_prepare_kretprobe(ri, regs);
+
--- /dev/null
+From 6d08f2c7139790c268820a2e590795cb8333181a Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Tue, 31 Jan 2012 17:15:11 +0100
+Subject: proc: make sure mem_open() doesn't pin the target's memory
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 6d08f2c7139790c268820a2e590795cb8333181a upstream.
+
+Once /proc/pid/mem is opened, the memory can't be released until
+mem_release() even if its owner exits.
+
+Change mem_open() to do atomic_inc(mm_count) + mmput(), this only
+pins mm_struct. Change mem_rw() to do atomic_inc_not_zero(mm_count)
+before access_remote_vm(), this verifies that this mm is still alive.
+
+I am not sure what should mem_rw() return if atomic_inc_not_zero()
+fails. With this patch it returns zero to match the "mm == NULL" case,
+may be it should return -EINVAL like it did before e268337d.
+
+Perhaps it makes sense to add the additional fatal_signal_pending()
+check into the main loop, to ensure we do not hold this memory if
+the target task was oom-killed.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/base.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -775,6 +775,13 @@ static int mem_open(struct inode* inode,
+ if (IS_ERR(mm))
+ return PTR_ERR(mm);
+
++ if (mm) {
++ /* ensure this mm_struct can't be freed */
++ atomic_inc(&mm->mm_count);
++ /* but do not pin its memory */
++ mmput(mm);
++ }
++
+ /* OK to pass negative loff_t, we can catch out-of-range */
+ file->f_mode |= FMODE_UNSIGNED_OFFSET;
+ file->private_data = mm;
+@@ -798,6 +805,9 @@ static ssize_t mem_rw(struct file *file,
+ return -ENOMEM;
+
+ copied = 0;
++ if (!atomic_inc_not_zero(&mm->mm_users))
++ goto free;
++
+ while (count > 0) {
+ int this_len = min_t(int, count, PAGE_SIZE);
+
+@@ -825,6 +835,8 @@ static ssize_t mem_rw(struct file *file,
+ }
+ *ppos = addr;
+
++ mmput(mm);
++free:
+ free_page((unsigned long) page);
+ return copied;
+ }
+@@ -861,7 +873,7 @@ static int mem_release(struct inode *ino
+ {
+ struct mm_struct *mm = file->private_data;
+ if (mm)
+- mmput(mm);
++ mmdrop(mm);
+ return 0;
+ }
+
--- /dev/null
+From 71879d3cb3dd8f2dfdefb252775c1b3ea04a3dd4 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Tue, 31 Jan 2012 17:14:38 +0100
+Subject: proc: mem_release() should check mm != NULL
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 71879d3cb3dd8f2dfdefb252775c1b3ea04a3dd4 upstream.
+
+mem_release() can hit mm == NULL, add the necessary check.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -886,8 +886,8 @@ loff_t mem_lseek(struct file *file, loff
+ static int mem_release(struct inode *inode, struct file *file)
+ {
+ struct mm_struct *mm = file->private_data;
+-
+- mmput(mm);
++ if (mm)
++ mmput(mm);
+ return 0;
+ }
+
--- /dev/null
+From 572d34b946bae070debd42db1143034d9687e13f Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Tue, 31 Jan 2012 17:14:54 +0100
+Subject: proc: unify mem_read() and mem_write()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 572d34b946bae070debd42db1143034d9687e13f upstream.
+
+No functional changes, cleanup and preparation.
+
+mem_read() and mem_write() are very similar. Move this code into the
+new common helper, mem_rw(), which takes the additional "int write"
+argument.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/base.c | 90 ++++++++++++++++++++-------------------------------------
+ 1 file changed, 32 insertions(+), 58 deletions(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -782,57 +782,13 @@ static int mem_open(struct inode* inode,
+ return 0;
+ }
+
+-static ssize_t mem_read(struct file * file, char __user * buf,
+- size_t count, loff_t *ppos)
++static ssize_t mem_rw(struct file *file, char __user *buf,
++ size_t count, loff_t *ppos, int write)
+ {
+- int ret;
+- char *page;
+- unsigned long src = *ppos;
+ struct mm_struct *mm = file->private_data;
+-
+- if (!mm)
+- return 0;
+-
+- page = (char *)__get_free_page(GFP_TEMPORARY);
+- if (!page)
+- return -ENOMEM;
+-
+- ret = 0;
+-
+- while (count > 0) {
+- int this_len, retval;
+-
+- this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
+- retval = access_remote_vm(mm, src, page, this_len, 0);
+- if (!retval) {
+- if (!ret)
+- ret = -EIO;
+- break;
+- }
+-
+- if (copy_to_user(buf, page, retval)) {
+- ret = -EFAULT;
+- break;
+- }
+-
+- ret += retval;
+- src += retval;
+- buf += retval;
+- count -= retval;
+- }
+- *ppos = src;
+-
+- free_page((unsigned long) page);
+- return ret;
+-}
+-
+-static ssize_t mem_write(struct file * file, const char __user *buf,
+- size_t count, loff_t *ppos)
+-{
+- int copied;
++ unsigned long addr = *ppos;
++ ssize_t copied;
+ char *page;
+- unsigned long dst = *ppos;
+- struct mm_struct *mm = file->private_data;
+
+ if (!mm)
+ return 0;
+@@ -843,30 +799,48 @@ static ssize_t mem_write(struct file * f
+
+ copied = 0;
+ while (count > 0) {
+- int this_len, retval;
++ int this_len = min_t(int, count, PAGE_SIZE);
+
+- this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
+- if (copy_from_user(page, buf, this_len)) {
++ if (write && copy_from_user(page, buf, this_len)) {
+ copied = -EFAULT;
+ break;
+ }
+- retval = access_remote_vm(mm, dst, page, this_len, 1);
+- if (!retval) {
++
++ this_len = access_remote_vm(mm, addr, page, this_len, write);
++ if (!this_len) {
+ if (!copied)
+ copied = -EIO;
+ break;
+ }
+- copied += retval;
+- buf += retval;
+- dst += retval;
+- count -= retval;
++
++ if (!write && copy_to_user(buf, page, this_len)) {
++ copied = -EFAULT;
++ break;
++ }
++
++ buf += this_len;
++ addr += this_len;
++ copied += this_len;
++ count -= this_len;
+ }
+- *ppos = dst;
++ *ppos = addr;
+
+ free_page((unsigned long) page);
+ return copied;
+ }
+
++static ssize_t mem_read(struct file *file, char __user *buf,
++ size_t count, loff_t *ppos)
++{
++ return mem_rw(file, buf, count, ppos, 0);
++}
++
++static ssize_t mem_write(struct file *file, const char __user *buf,
++ size_t count, loff_t *ppos)
++{
++ return mem_rw(file, (char __user*)buf, count, ppos, 1);
++}
++
+ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
+ {
+ switch (orig) {
--- /dev/null
+From e47e321a35c741ee41b67976f8c6a3a7a42bc5c0 Mon Sep 17 00:00:00 2001
+From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Date: Fri, 20 Jan 2012 18:43:54 +0000
+Subject: RDMA/core: Fix kernel panic by always initializing qp->usecnt
+
+From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+
+commit e47e321a35c741ee41b67976f8c6a3a7a42bc5c0 upstream.
+
+We have just been investigating kernel panics related to
+cq->ibcq.event_handler() completion calls. The problem is that
+ib_destroy_qp() fails with -EBUSY.
+
+Further investigation revealed qp->usecnt is not initialized. This
+counter was introduced in linux-3.2 by commit 0e0ec7e0638e
+("RDMA/core: Export ib_open_qp() to share XRC TGT QPs") but it only
+gets initialized for IB_QPT_XRC_TGT, but it is checked in
+ib_destroy_qp() for any QP type.
+
+Fix this by initializing qp->usecnt for every QP we create.
+
+Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Signed-off-by: Sven Breuner <sven.breuner@itwm.fraunhofer.de>
+
+[ Initialize qp->usecnt in uverbs too. - Sean ]
+
+Signed-off-by: Sean Hefty <sean.hefty@intel.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/uverbs_cmd.c | 1 +
+ drivers/infiniband/core/verbs.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -1485,6 +1485,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uv
+ qp->event_handler = attr.event_handler;
+ qp->qp_context = attr.qp_context;
+ qp->qp_type = attr.qp_type;
++ atomic_set(&qp->usecnt, 0);
+ atomic_inc(&pd->usecnt);
+ atomic_inc(&attr.send_cq->usecnt);
+ if (attr.recv_cq)
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -421,6 +421,7 @@ struct ib_qp *ib_create_qp(struct ib_pd
+ qp->uobject = NULL;
+ qp->qp_type = qp_init_attr->qp_type;
+
++ atomic_set(&qp->usecnt, 0);
+ if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) {
+ qp->event_handler = __ib_shared_qp_event_handler;
+ qp->qp_context = qp;
+@@ -430,7 +431,6 @@ struct ib_qp *ib_create_qp(struct ib_pd
+ qp->xrcd = qp_init_attr->xrcd;
+ atomic_inc(&qp_init_attr->xrcd->usecnt);
+ INIT_LIST_HEAD(&qp->open_list);
+- atomic_set(&qp->usecnt, 0);
+
+ real_qp = qp;
+ qp = __ib_open_qp(real_qp, qp_init_attr->event_handler,
--- /dev/null
+From 3deaa7190a8da38453c4fabd9dec7f66d17fff67 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Fri, 3 Feb 2012 15:37:17 -0800
+Subject: readahead: fix pipeline break caused by block plug
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 3deaa7190a8da38453c4fabd9dec7f66d17fff67 upstream.
+
+Herbert Poetzl reported a performance regression since 2.6.39. The test
+is a simple dd read, but with big block size. The reason is:
+
+T1: ra (A, A+128k), (A+128k, A+256k)
+T2: lock_page for page A, submit the 256k
+T3: hit page A+128K, ra (A+256k, A+384). the range isn't submitted
+because of plug and there isn't any lock_page till we hit page A+256k
+because all pages from A to A+256k is in memory
+T4: hit page A+256k, ra (A+384, A+ 512). Because of plug, the range isn't
+submitted again.
+T5: lock_page A+256k, so (A+256k, A+512k) will be submitted. The task is
+waitting for (A+256k, A+512k) finish.
+
+There is no request to disk in T3 and T4, so readahead pipeline breaks.
+
+We really don't need block plug for generic_file_aio_read() for buffered
+I/O. The readahead already has plug and has fine grained control when I/O
+should be submitted. Deleting plug for buffered I/O fixes the regression.
+
+One side effect is plug makes the request size 256k, the size is 128k
+without it. This is because default ra size is 128k and not a reason we
+need plug here.
+
+Vivek said:
+
+: We submit some readahead IO to device request queue but because of nested
+: plug, queue never gets unplugged. When read logic reaches a page which is
+: not in page cache, it waits for page to be read from the disk
+: (lock_page_killable()) and that time we flush the plug list.
+:
+: So effectively read ahead logic is kind of broken in parts because of
+: nested plugging. Removing top level plug (generic_file_aio_read()) for
+: buffered reads, will allow unplugging queue earlier for readahead.
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Reported-by: Herbert Poetzl <herbert@13thfloor.at>
+Tested-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/filemap.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1400,15 +1400,12 @@ generic_file_aio_read(struct kiocb *iocb
+ unsigned long seg = 0;
+ size_t count;
+ loff_t *ppos = &iocb->ki_pos;
+- struct blk_plug plug;
+
+ count = 0;
+ retval = generic_segment_checks(iov, &nr_segs, &count, VERIFY_WRITE);
+ if (retval)
+ return retval;
+
+- blk_start_plug(&plug);
+-
+ /* coalesce the iovecs and go direct-to-BIO for O_DIRECT */
+ if (filp->f_flags & O_DIRECT) {
+ loff_t size;
+@@ -1424,8 +1421,12 @@ generic_file_aio_read(struct kiocb *iocb
+ retval = filemap_write_and_wait_range(mapping, pos,
+ pos + iov_length(iov, nr_segs) - 1);
+ if (!retval) {
++ struct blk_plug plug;
++
++ blk_start_plug(&plug);
+ retval = mapping->a_ops->direct_IO(READ, iocb,
+ iov, pos, nr_segs);
++ blk_finish_plug(&plug);
+ }
+ if (retval > 0) {
+ *ppos = pos + retval;
+@@ -1481,7 +1482,6 @@ generic_file_aio_read(struct kiocb *iocb
+ break;
+ }
+ out:
+- blk_finish_plug(&plug);
+ return retval;
+ }
+ EXPORT_SYMBOL(generic_file_aio_read);
--- /dev/null
+readahead-fix-pipeline-break-caused-by-block-plug.patch
+alsa-hda-fix-the-logic-to-detect-via-analog-low-current-mode.patch
+alsa-hda-remove-quirk-for-asus-n53jq.patch
+alsa-hda-apply-0x0f-vref-fix-to-all-asus-laptops-with-alc861-660.patch
+alsa-hda-fix-calling-cs_automic-twice-for-cirrus-codecs.patch
+alsa-hda-allow-analog-low-current-mode-when-dynamic-power-control-is-on.patch
+alsa-hda-fix-duplicated-output-to-more-than-one-codec.patch
+alsa-hda-disable-dynamic-power-control-for-via-as-default.patch
+asoc-wm_hubs-enable-line-out-vmid-buffer-for-single-ended-line-outputs.patch
+asoc-wm_hubs-fix-wrong-bits-for-lineout2-n-p-mixer.patch
+arm-7306-1-vfp-flush-thread-hwstate-before-restoring-context-from-sigframe.patch
+arm-7307-1-vfp-fix-ptrace-regset-modification-race.patch
+arm-7308-1-vfp-flush-thread-hwstate-before-copying-ptrace-registers.patch
+arm-omap2-gpmc-fix-device-size-setup.patch
+drivers-tty-vt-vt_ioctl.c-fix-kdfontop-32bit-compatibility-layer.patch
+proc-mem_release-should-check-mm-null.patch
+proc-unify-mem_read-and-mem_write.patch
+proc-make-sure-mem_open-doesn-t-pin-the-target-s-memory.patch
+firewire-ohci-add-reset-packet-quirk-for-sb-audigy.patch
+firewire-ohci-disable-msi-on-ricoh-controllers.patch
+ib-mlx4-pass-smp-vendor-specific-attribute-mads-to-firmware.patch
+rdma-core-fix-kernel-panic-by-always-initializing-qp-usecnt.patch
+kprobes-fix-a-memory-leak-in-function-pre_handler_kretprobe.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
