2.6.35.6-45.fc14

14 files changed, 8 insertions, 1146 deletions

diff --git a/freed-ora/current/f14/deblob-check b/freed-ora/current/f14/deblob-check
index 65e97cbbf..28ec9d853 100755
--- a/freed-ora/current/f14/deblob-check
+++ b/freed-ora/current/f14/deblob-check
@@ -1,6 +1,6 @@
 #! /bin/sh
 
-# deblob-check version 2010-10-22
+# deblob-check version 2010-09-27
 # Inspired in gNewSense's find-firmware script.
 # Written by Alexandre Oliva <lxoliva@fsfla.org>
 
@@ -1208,7 +1208,7 @@ set_except () {
     blob '\(#ifdef[ ]__\(LITTLE\|BIG\)_ENDIAN[\n]\)\?#define[ ]FW_EXT[ ]["]\(_ecd\)\?\.bin2\?["]\([\n]#else[\n]#define[ ]FW_EXT[ ]["]\(_ecd\)\?\.bin2\?["]\)*\([\n]#endif\)\?' drivers/atm/fore200e.c
     blobna 'sprintf[(][^;]*fore200[^;]*FW_EXT[^;]*[)][;]' drivers/atm/fore200e.c
     blobname '\(pc\|sb\)a200e\(_ecd\)\?\.bin[12]\?' drivers/atm/fore200e.c
-    blobna 'The[ ]supplied[ ]firmware[ ]images.*http:[/][/][^\n]*\(fore\|FORE_Systems\).*Rebuild[ ]and[ ]re-install[^.]*\.' Documentation/networking/fore200e.txt
+    blobna 'The[ ]supplied[ ]firmware[ ]images.*fore.*Rebuild[ ]and[ ]re-install[^.]*\.' Documentation/networking/fore200e.txt
 
     blobname 'intelliport2\.bin' drivers/char/ip2/ip2main.c
 
@@ -2572,7 +2572,6 @@ set_except () {
     defsnc '[	][	]degrade_factor\[CPU_LOAD_IDX_MAX\]\[DEGRADE_SHIFT[ ][+][ ]1\][ ]=' kernel/sched.c
     defsnc 'static[ ]const[ ]unsigned[ ]char[ ]expected_result\[FIFO_SIZE\][ ]=' samples/kfifo/bytestream-example.c
     defsnc 'static[ ]const[ ]int[ ]expected_result\[FIFO_SIZE\][ ]=' samples/kfifo/inttype-example.c
-    blobname 'haup-ir-blaster\.bin' drivers/input/lirc/lirc_zilog.c
     ;;
 
   */*freedo*.patch | */*logo*.patch)
@@ -2639,6 +2638,7 @@ set_except () {
     blobname 'iwlwifi-6000g2[ab]-' drivers/net/iwlwifi/iwl-6000.c
     blobname '#api[ ]["]\.ucode["]' 'drivers/net/iwlwifi/iwl-\(3945.h\|\(4965\|[156]000\)\.c\)'
     blobname 'c[tb]fw\(_\(fc\|cna\)\)\?\.bin' drivers/scsi/bfa/bfad_fwimg.c
+    blobname 'haup-ir-blaster\.bin' drivers/input/lirc/lirc_zilog.c
     blobna 'seq_printf[(]seq[,][ ]["][^"]*%s[ ]%s[^"]*["][,][ 	\n]*\(GB_RCV\|MOJAVE_\)UCODE_VERS_STRING[,][ ]\(GB_RCV\|MOJAVE_\)UCODE_VERS_DATE[)][;]\([ 	\n]*seq_printf[(]seq[,][ ]["][^"]*%s[ ]%s[^"]*["][,][ 	\n]*\(GB_RCV\|MOJAVE_\)UCODE_VERS_STRING[,][ ]\(GB_RCV\|MOJAVE_\)UCODE_VERS_DATE[)][;]\)*' drivers/staging/slicoss/slicoss.c
     blobname 'slicoss[/]\(oasis\|gb\)\(rcvucode\|download\)\.sys' drivers/staging/slicoss/slicoss.c
     blobname 'CMV[x9ae][yip]\.bin\(\.v2\)\?' drivers/usb/atm/ueagle-atm.c
@@ -2671,7 +2671,6 @@ set_except () {
     defsnc '[	][	]degrade_factor\[CPU_LOAD_IDX_MAX\]\[DEGRADE_SHIFT[ ][+][ ]1\][ ]=' kernel/sched.c
     defsnc 'static[ ]const[ ]unsigned[ ]char[ ]expected_result\[FIFO_SIZE\][ ]=' samples/kfifo/bytestream-example.c
     defsnc 'static[ ]const[ ]int[ ]expected_result\[FIFO_SIZE\][ ]=' samples/kfifo/inttype-example.c
-    blobname 'haup-ir-blaster\.bin' drivers/input/lirc/lirc_zilog.c
     ;;
 
   */hid-support*.patch)
@@ -3168,9 +3167,6 @@ set_except () {
   */linux-2.6*-at76.patch)
     blobname 'atmel_at76c50\(3-\(i386[13]\|rfmd\(-acc\)\?\)\|5\(a\(mx\)\?\)\?-rfmd\(2958\)\?\)\.bin' drivers/net/wireless/at76_usb/at76_usb.c
     ;;
-  */v4l1*.patch)
-    accept '[(]at[ ]which[ ]point[ ]it[ ]should[ ]use[ ]request_firmware'
-    ;;
   */linux-2.6-v4l-dvb*.patch)
     # post 2.6.33 fixes start here
     defsnc 'static[ ]struct[ ]i2c_reg_u8[ ]ov9655_init\[\][ ]=' drivers/media/video/gspca/sn9c20x.c
diff --git a/freed-ora/current/f14/depessimize-rds_copy_page_user.patch b/freed-ora/current/f14/depessimize-rds_copy_page_user.patch
deleted file mode 100644
index aec8bff4d..000000000
--- a/freed-ora/current/f14/depessimize-rds_copy_page_user.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 799c10559d60f159ab2232203f222f18fa3c4a5f Mon Sep 17 00:00:00 2001
-From: Linus Torvalds <torvalds@linux-foundation.org>
-Date: Fri, 15 Oct 2010 11:09:28 -0700
-Subject: [PATCH] De-pessimize rds_page_copy_user
-
-Don't try to "optimize" rds_page_copy_user() by using kmap_atomic() and
-the unsafe atomic user mode accessor functions.  It's actually slower
-than the straightforward code on any reasonable modern CPU.
-
-Back when the code was written (although probably not by the time it was
-actually merged, though), 32-bit x86 may have been the dominant
-architecture.  And there kmap_atomic() can be a lot faster than kmap()
-(unless you have very good locality, in which case the virtual address
-caching by kmap() can overcome all the downsides).
-
-But these days, x86-64 may not be more populous, but it's getting there
-(and if you care about performance, it's definitely already there -
-you'd have upgraded your CPU's already in the last few years).  And on
-x86-64, the non-kmap_atomic() version is faster, simply because the code
-is simpler and doesn't have the "re-try page fault" case.
-
-People with old hardware are not likely to care about RDS anyway, and
-the optimization for the 32-bit case is simply buggy, since it doesn't
-verify the user addresses properly.
-
-Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
-Acked-by: Andrew Morton <akpm@linux-foundation.org>
-Cc: stable@kernel.org
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- net/rds/page.c |   27 +++++++--------------------
- 1 files changed, 7 insertions(+), 20 deletions(-)
-
-diff --git a/net/rds/page.c b/net/rds/page.c
-index 595a952..1dfbfea 100644
---- a/net/rds/page.c
-+++ b/net/rds/page.c
-@@ -57,30 +57,17 @@ int rds_page_copy_user(struct page *page, unsigned long offset,
- 	unsigned long ret;
- 	void *addr;
- 
--	if (to_user)
-+	addr = kmap(page);
-+	if (to_user) {
- 		rds_stats_add(s_copy_to_user, bytes);
--	else
-+		ret = copy_to_user(ptr, addr + offset, bytes);
-+	} else {
- 		rds_stats_add(s_copy_from_user, bytes);
--
--	addr = kmap_atomic(page, KM_USER0);
--	if (to_user)
--		ret = __copy_to_user_inatomic(ptr, addr + offset, bytes);
--	else
--		ret = __copy_from_user_inatomic(addr + offset, ptr, bytes);
--	kunmap_atomic(addr, KM_USER0);
--
--	if (ret) {
--		addr = kmap(page);
--		if (to_user)
--			ret = copy_to_user(ptr, addr + offset, bytes);
--		else
--			ret = copy_from_user(addr + offset, ptr, bytes);
--		kunmap(page);
--		if (ret)
--			return -EFAULT;
-+		ret = copy_from_user(addr + offset, ptr, bytes);
- 	}
-+	kunmap(page);
- 
--	return 0;
-+	return ret ? -EFAULT : 0;
- }
- EXPORT_SYMBOL_GPL(rds_page_copy_user);
- 
--- 
-1.7.3.2
-
diff --git a/freed-ora/current/f14/dmar-disable-when-ricoh-multifunction.patch b/freed-ora/current/f14/dmar-disable-when-ricoh-multifunction.patch
index e0bbf3020..13b1700d0 100644
--- a/freed-ora/current/f14/dmar-disable-when-ricoh-multifunction.patch
+++ b/freed-ora/current/f14/dmar-disable-when-ricoh-multifunction.patch
@@ -11,15 +11,14 @@ diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
 index 8e499e8..076c5de 100644
 --- a/drivers/pci/intel-iommu.c
 +++ b/drivers/pci/intel-iommu.c
-@@ -3755,6 +3755,18 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
+@@ -3755,6 +3755,17 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
  
  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
  
 +/* https://bugzilla.redhat.com/show_bug.cgi?id=605888 */
 +static void __devinit quirk_ricoh_multifunction(struct pci_dev *dev)
 +{
-+	printk(KERN_INFO "intel_iommu: broken Ricoh device %04X detected, disabling...\n",
-+		dev->device);
++	printk(KERN_INFO "intel_iommu: broken Ricoh device %04X detected, disabling...\n");
 +	dmar_disabled = 1;
 +}
 +DECLARE_PCI_FIXUP_HEADER(0x1180, 0xe822, quirk_ricoh_multifunction);
diff --git a/freed-ora/current/f14/drm-i915-sanity-check-pread-pwrite.patch b/freed-ora/current/f14/drm-i915-sanity-check-pread-pwrite.patch
deleted file mode 100644
index b5eb2dda8..000000000
--- a/freed-ora/current/f14/drm-i915-sanity-check-pread-pwrite.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4 Mon Sep 17 00:00:00 2001
-From: Chris Wilson <chris@chris-wilson.co.uk>
-Date: Sun, 26 Sep 2010 20:50:05 +0100
-Subject: drm/i915: Sanity check pread/pwrite
-
-From: Chris Wilson <chris@chris-wilson.co.uk>
-
-commit ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4 upstream.
-
-Move the access control up from the fast paths, which are no longer
-universally taken first, up into the caller. This then duplicates some
-sanity checking along the slow paths, but is much simpler.
-Tracked as CVE-2010-2962.
-
-Reported-by: Kees Cook <kees@ubuntu.com>
-Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/gpu/drm/i915/i915_gem.c |   28 ++++++++++++++++++++--------
- 1 file changed, 20 insertions(+), 8 deletions(-)
-
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -465,8 +465,15 @@ i915_gem_pread_ioctl(struct drm_device *
- 	 */
- 	if (args->offset > obj->size || args->size > obj->size ||
- 	    args->offset + args->size > obj->size) {
--		drm_gem_object_unreference_unlocked(obj);
--		return -EINVAL;
-+		ret = -EINVAL;
-+		goto err;
-+	}
-+
-+	if (!access_ok(VERIFY_WRITE,
-+		       (char __user *)(uintptr_t)args->data_ptr,
-+		       args->size)) {
-+		ret = -EFAULT;
-+		goto err;
- 	}
- 
- 	if (i915_gem_object_needs_bit17_swizzle(obj)) {
-@@ -478,8 +485,8 @@ i915_gem_pread_ioctl(struct drm_device *
- 							file_priv);
- 	}
- 
-+err:
- 	drm_gem_object_unreference_unlocked(obj);
--
- 	return ret;
- }
- 
-@@ -568,8 +575,6 @@ i915_gem_gtt_pwrite_fast(struct drm_devi
- 
- 	user_data = (char __user *) (uintptr_t) args->data_ptr;
- 	remain = args->size;
--	if (!access_ok(VERIFY_READ, user_data, remain))
--		return -EFAULT;
- 
- 
- 	mutex_lock(&dev->struct_mutex);
-@@ -928,8 +933,15 @@ i915_gem_pwrite_ioctl(struct drm_device
- 	 */
- 	if (args->offset > obj->size || args->size > obj->size ||
- 	    args->offset + args->size > obj->size) {
--		drm_gem_object_unreference_unlocked(obj);
--		return -EINVAL;
-+		ret = -EINVAL;
-+		goto err;
-+	}
-+
-+	if (!access_ok(VERIFY_READ,
-+		       (char __user *)(uintptr_t)args->data_ptr,
-+		       args->size)) {
-+		ret = -EFAULT;
-+		goto err;
- 	}
- 
- 	/* We can only do the GTT pwrite on untiled buffers, as otherwise
-@@ -963,8 +975,8 @@ i915_gem_pwrite_ioctl(struct drm_device
- 		DRM_INFO("pwrite failed %d\n", ret);
- #endif
- 
-+err:
- 	drm_gem_object_unreference_unlocked(obj);
--
- 	return ret;
- }
- 
diff --git a/freed-ora/current/f14/drm-nouveau-nv50-crtc-update-delay.patch b/freed-ora/current/f14/drm-nouveau-nv50-crtc-update-delay.patch
deleted file mode 100644
index 319770cba..000000000
--- a/freed-ora/current/f14/drm-nouveau-nv50-crtc-update-delay.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 8f51b07995c55369bfd27921ef10b76c2b203fe8 Mon Sep 17 00:00:00 2001
-From: Ben Skeggs <bskeggs@redhat.com>
-Date: Tue, 17 Aug 2010 14:20:29 +1000
-Subject: [PATCH] drm-nouveau-nv50-crtc-update-delay
-
-rhbz#614552
-
-Adds a short delay before doing framebuffer-only CRTC updates.  Fixes
-an issue that effects some cards (Quadro NVS295/FX580) where two of
-these updates in quick succession hangs the display engine.
-
-Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
----
- drivers/gpu/drm/nouveau/nv50_crtc.c |    3 +++
- 1 files changed, 3 insertions(+), 0 deletions(-)
-
-diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
-index 2423c92..5c2aa1e 100644
---- a/drivers/gpu/drm/nouveau/nv50_crtc.c
-+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
-@@ -540,6 +540,9 @@ nv50_crtc_do_mode_set_base(struct drm_crtc *crtc, int x, int y,
- 		nouveau_bo_unpin(ofb->nvbo);
- 	}
- 
-+	if (update)
-+		mdelay(1);
-+
- 	nv_crtc->fb.offset = fb->nvbo->bo.offset - dev_priv->vm_vram_base;
- 	nv_crtc->fb.tile_flags = fb->nvbo->tile_flags;
- 	nv_crtc->fb.cpp = drm_fb->bits_per_pixel / 8;
--- 
-1.7.3.1
-
diff --git a/freed-ora/current/f14/drm-nouveau-nv86-bug.patch b/freed-ora/current/f14/drm-nouveau-nv86-bug.patch
deleted file mode 100644
index aee3bedaf..000000000
--- a/freed-ora/current/f14/drm-nouveau-nv86-bug.patch
+++ /dev/null
@@ -1,231 +0,0 @@
-From e7e3837f6395e44b5b5fb7cdbcccaba5baf76803 Mon Sep 17 00:00:00 2001
-From: Ben Skeggs <bskeggs@redhat.com>
-Date: Fri, 22 Oct 2010 10:26:24 +1000
-Subject: [PATCH] drm-nouveau-nv86-bug
-
-drm/nv50: implement possible workaround for NV86 PGRAPH TLB flush hang
-
-Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
----
- drivers/gpu/drm/nouveau/nouveau_drv.h   |    5 +++
- drivers/gpu/drm/nouveau/nouveau_mem.c   |   14 +++-----
- drivers/gpu/drm/nouveau/nouveau_sgdma.c |    8 ++--
- drivers/gpu/drm/nouveau/nouveau_state.c |   10 ++++++
- drivers/gpu/drm/nouveau/nv50_fifo.c     |    5 +++
- drivers/gpu/drm/nouveau/nv50_graph.c    |   52 +++++++++++++++++++++++++++++++
- drivers/gpu/drm/nouveau/nv50_instmem.c  |    1 -
- 7 files changed, 82 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
-index be53e92..4273390 100644
---- a/drivers/gpu/drm/nouveau/nouveau_drv.h
-+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
-@@ -304,6 +304,7 @@ struct nouveau_fifo_engine {
- 	void (*destroy_context)(struct nouveau_channel *);
- 	int  (*load_context)(struct nouveau_channel *);
- 	int  (*unload_context)(struct drm_device *);
-+	void (*tlb_flush)(struct drm_device *dev);
- };
- 
- struct nouveau_pgraph_object_method {
-@@ -336,6 +337,7 @@ struct nouveau_pgraph_engine {
- 	void (*destroy_context)(struct nouveau_channel *);
- 	int  (*load_context)(struct nouveau_channel *);
- 	int  (*unload_context)(struct drm_device *);
-+	void (*tlb_flush)(struct drm_device *dev);
- 
- 	void (*set_region_tiling)(struct drm_device *dev, int i, uint32_t addr,
- 				  uint32_t size, uint32_t pitch);
-@@ -944,6 +946,7 @@ extern int  nv50_fifo_create_context(struct nouveau_channel *);
- extern void nv50_fifo_destroy_context(struct nouveau_channel *);
- extern int  nv50_fifo_load_context(struct nouveau_channel *);
- extern int  nv50_fifo_unload_context(struct drm_device *);
-+extern void nv50_fifo_tlb_flush(struct drm_device *dev);
- 
- /* nvc0_fifo.c */
- extern int  nvc0_fifo_init(struct drm_device *);
-@@ -1021,6 +1024,8 @@ extern int  nv50_graph_load_context(struct nouveau_channel *);
- extern int  nv50_graph_unload_context(struct drm_device *);
- extern void nv50_graph_context_switch(struct drm_device *);
- extern int  nv50_grctx_init(struct nouveau_grctx *);
-+extern void nv50_graph_tlb_flush(struct drm_device *dev);
-+extern void nv86_graph_tlb_flush(struct drm_device *dev);
- 
- /* nvc0_graph.c */
- extern int  nvc0_graph_init(struct drm_device *);
-diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
-index 4f0ae39..514ad9f 100644
---- a/drivers/gpu/drm/nouveau/nouveau_mem.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
-@@ -173,11 +173,10 @@ nv50_mem_vm_bind_linear(struct drm_device *dev, uint64_t virt, uint32_t size,
- 			}
- 		}
- 	}
--	dev_priv->engine.instmem.flush(dev);
- 
--	nv50_vm_flush(dev, 5);
--	nv50_vm_flush(dev, 0);
--	nv50_vm_flush(dev, 4);
-+	dev_priv->engine.instmem.flush(dev);
-+	dev_priv->engine.fifo.tlb_flush(dev);
-+	dev_priv->engine.graph.tlb_flush(dev);
- 	nv50_vm_flush(dev, 6);
- 	return 0;
- }
-@@ -207,11 +206,10 @@ nv50_mem_vm_unbind(struct drm_device *dev, uint64_t virt, uint32_t size)
- 			pte++;
- 		}
- 	}
--	dev_priv->engine.instmem.flush(dev);
- 
--	nv50_vm_flush(dev, 5);
--	nv50_vm_flush(dev, 0);
--	nv50_vm_flush(dev, 4);
-+	dev_priv->engine.instmem.flush(dev);
-+	dev_priv->engine.fifo.tlb_flush(dev);
-+	dev_priv->engine.graph.tlb_flush(dev);
- 	nv50_vm_flush(dev, 6);
- }
- 
-diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
-index 7f028fe..d55a583 100644
---- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
-@@ -120,8 +120,8 @@ nouveau_sgdma_bind(struct ttm_backend *be, struct ttm_mem_reg *mem)
- 	dev_priv->engine.instmem.flush(nvbe->dev);
- 
- 	if (dev_priv->card_type == NV_50) {
--		nv50_vm_flush(dev, 5); /* PGRAPH */
--		nv50_vm_flush(dev, 0); /* PFIFO */
-+		dev_priv->engine.fifo.tlb_flush(dev);
-+		dev_priv->engine.graph.tlb_flush(dev);
- 	}
- 
- 	nvbe->bound = true;
-@@ -162,8 +162,8 @@ nouveau_sgdma_unbind(struct ttm_backend *be)
- 	dev_priv->engine.instmem.flush(nvbe->dev);
- 
- 	if (dev_priv->card_type == NV_50) {
--		nv50_vm_flush(dev, 5);
--		nv50_vm_flush(dev, 0);
-+		dev_priv->engine.fifo.tlb_flush(dev);
-+		dev_priv->engine.graph.tlb_flush(dev);
- 	}
- 
- 	nvbe->bound = false;
-diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
-index be85960..47c353c 100644
---- a/drivers/gpu/drm/nouveau/nouveau_state.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
-@@ -333,6 +333,15 @@ static int nouveau_init_engine_ptrs(struct drm_device *dev)
- 		engine->graph.destroy_context	= nv50_graph_destroy_context;
- 		engine->graph.load_context	= nv50_graph_load_context;
- 		engine->graph.unload_context	= nv50_graph_unload_context;
-+		if (dev_priv->chipset != 0x86)
-+			engine->graph.tlb_flush	= nv50_graph_tlb_flush;
-+		else {
-+			/* from what i can see nvidia do this on every
-+			 * pre-NVA3 board except NVAC, but, we've only
-+			 * ever seen problems on NV86
-+			 */
-+			engine->graph.tlb_flush	= nv86_graph_tlb_flush;
-+		}
- 		engine->fifo.channels		= 128;
- 		engine->fifo.init		= nv50_fifo_init;
- 		engine->fifo.takedown		= nv50_fifo_takedown;
-@@ -344,6 +353,7 @@ static int nouveau_init_engine_ptrs(struct drm_device *dev)
- 		engine->fifo.destroy_context	= nv50_fifo_destroy_context;
- 		engine->fifo.load_context	= nv50_fifo_load_context;
- 		engine->fifo.unload_context	= nv50_fifo_unload_context;
-+		engine->fifo.tlb_flush		= nv50_fifo_tlb_flush;
- 		engine->display.early_init	= nv50_display_early_init;
- 		engine->display.late_takedown	= nv50_display_late_takedown;
- 		engine->display.create		= nv50_display_create;
-diff --git a/drivers/gpu/drm/nouveau/nv50_fifo.c b/drivers/gpu/drm/nouveau/nv50_fifo.c
-index a46a961..1da65bd 100644
---- a/drivers/gpu/drm/nouveau/nv50_fifo.c
-+++ b/drivers/gpu/drm/nouveau/nv50_fifo.c
-@@ -464,3 +464,8 @@ nv50_fifo_unload_context(struct drm_device *dev)
- 	return 0;
- }
- 
-+void
-+nv50_fifo_tlb_flush(struct drm_device *dev)
-+{
-+	nv50_vm_flush(dev, 5);
-+}
-diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
-index cbf5ae2..8b669d0 100644
---- a/drivers/gpu/drm/nouveau/nv50_graph.c
-+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
-@@ -402,3 +402,55 @@ struct nouveau_pgraph_object_class nv50_graph_grclass[] = {
- 	{ 0x8597, false, NULL }, /* tesla (nva3, nva5, nva8) */
- 	{}
- };
-+
-+void
-+nv50_graph_tlb_flush(struct drm_device *dev)
-+{
-+	nv50_vm_flush(dev, 0);
-+}
-+
-+void
-+nv86_graph_tlb_flush(struct drm_device *dev)
-+{
-+	struct drm_nouveau_private *dev_priv = dev->dev_private;
-+	struct nouveau_timer_engine *ptimer = &dev_priv->engine.timer;
-+	bool idle, timeout = false;
-+	unsigned long flags;
-+	u64 start;
-+	u32 tmp;
-+
-+	spin_lock_irqsave(&dev_priv->context_switch_lock, flags);
-+	nv_mask(dev, 0x400500, 0x00000001, 0x00000000);
-+
-+	start = ptimer->read(dev);
-+	do {
-+		idle = true;
-+
-+		for (tmp = nv_rd32(dev, 0x400380); tmp && idle; tmp >>= 3) {
-+			if ((tmp & 7) == 1)
-+				idle = false;
-+		}
-+
-+		for (tmp = nv_rd32(dev, 0x400384); tmp && idle; tmp >>= 3) {
-+			if ((tmp & 7) == 1)
-+				idle = false;
-+		}
-+
-+		for (tmp = nv_rd32(dev, 0x400388); tmp && idle; tmp >>= 3) {
-+			if ((tmp & 7) == 1)
-+				idle = false;
-+		}
-+	} while (!idle && !(timeout = ptimer->read(dev) - start > 2000000000));
-+
-+	if (timeout) {
-+		NV_ERROR(dev, "PGRAPH TLB flush idle timeout fail: "
-+			      "0x%08x 0x%08x 0x%08x 0x%08x\n",
-+			 nv_rd32(dev, 0x400700), nv_rd32(dev, 0x400380),
-+			 nv_rd32(dev, 0x400384), nv_rd32(dev, 0x400388));
-+	}
-+
-+	nv50_vm_flush(dev, 0);
-+
-+	nv_mask(dev, 0x400500, 0x00000001, 0x00000001);
-+	spin_unlock_irqrestore(&dev_priv->context_switch_lock, flags);
-+}
-diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
-index ac3de05..c836ddc 100644
---- a/drivers/gpu/drm/nouveau/nv50_instmem.c
-+++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
-@@ -402,7 +402,6 @@ nv50_instmem_bind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
- 	}
- 	dev_priv->engine.instmem.flush(dev);
- 
--	nv50_vm_flush(dev, 4);
- 	nv50_vm_flush(dev, 6);
- 
- 	gpuobj->im_bound = 1;
--- 
-1.7.3.1
-
diff --git a/freed-ora/current/f14/kernel.spec b/freed-ora/current/f14/kernel.spec
index 65bbe0a75..73b02b1e6 100644
--- a/freed-ora/current/f14/kernel.spec
+++ b/freed-ora/current/f14/kernel.spec
@@ -48,7 +48,7 @@ Summary: The Linux kernel
 # reset this by hand to 1 (or to 0 and then use rpmdev-bumpspec).
 # scripts/rebase.sh should be made to do that for you, actually.
 #
-%global baserelease 50
+%global baserelease 45
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -692,14 +692,13 @@ Patch1808: drm-ttm-fix.patch
 Patch1810: drm-nouveau-updates.patch
 Patch1811: drm-nouveau-race-fix.patch
 Patch1812: drm-nouveau-nva3-noaccel.patch
-Patch1813: drm-nouveau-nv86-bug.patch
-Patch1814: drm-nouveau-nv50-crtc-update-delay.patch
 Patch1819: drm-intel-big-hammer.patch
 # intel drm is all merged upstream
 Patch1824: drm-intel-next.patch
 # make sure the lvds comes back on lid open
 Patch1825: drm-intel-make-lvds-work.patch
 Patch1900: linux-2.6-intel-iommu-igfx.patch
+
 Patch2000: efifb-add-more-models.patch
 Patch2001: efifb-check-that-the-base-addr-is-plausible-on-pci-systems.patch
 
@@ -729,7 +728,6 @@ Patch2917: hdpvr-ir-enable.patch
 Patch2918: linux-2.6-v4l-dvb-ir-core-update-2.patch
 Patch2919: linux-2.6-v4l-dvb-ir-core-update-3.patch
 Patch2920: linux-2.6-lirc-ioctl-compat-fixups.patch
-Patch2923: linux-2.6-v4l-dvb-ir-core-fix-imon.patch
 
 Patch2950: linux-2.6-via-velocity-dma-fix.patch
 
@@ -790,17 +788,6 @@ Patch13637: dmar-disable-when-ricoh-multifunction.patch
 
 Patch13638: ima-allow-it-to-be-completely-disabled-and-default-off.patch
 
-Patch13640: sdhci-8-bit-data-transfer-width-support.patch
-Patch13641: mmc-make-sdhci-work-with-ricoh-mmc-controller.patch
-Patch13642: mmc-add-ricoh-e822-pci-id.patch
-
-Patch13645: tpm-autodetect-itpm-devices.patch
-Patch13646: depessimize-rds_copy_page_user.patch
-
-Patch13650: drm-i915-sanity-check-pread-pwrite.patch
-Patch13651: kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch
-Patch13652: v4l1-fix-32-bit-compat-microcode-loading-translation.patch
-
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1384,8 +1371,6 @@ ApplyPatch drm-ttm-fix.patch
 ApplyPatch drm-nouveau-updates.patch
 ApplyPatch drm-nouveau-race-fix.patch
 ApplyPatch drm-nouveau-nva3-noaccel.patch
-ApplyPatch drm-nouveau-nv86-bug.patch
-ApplyPatch drm-nouveau-nv50-crtc-update-delay.patch
 
 ApplyPatch drm-intel-big-hammer.patch
 ApplyOptionalPatch drm-intel-next.patch
@@ -1423,7 +1408,6 @@ ApplyPatch hdpvr-ir-enable.patch
 ApplyPatch linux-2.6-v4l-dvb-ir-core-update-2.patch
 ApplyPatch linux-2.6-v4l-dvb-ir-core-update-3.patch
 ApplyPatch linux-2.6-lirc-ioctl-compat-fixups.patch
-ApplyPatch linux-2.6-v4l-dvb-ir-core-fix-imon.patch
 
 # Fix DMA bug on via-velocity
 ApplyPatch linux-2.6-via-velocity-dma-fix.patch
@@ -1492,21 +1476,6 @@ ApplyPatch dmar-disable-when-ricoh-multifunction.patch
 
 ApplyPatch ima-allow-it-to-be-completely-disabled-and-default-off.patch
 
-# rhbz#596475
-ApplyPatch sdhci-8-bit-data-transfer-width-support.patch
-ApplyPatch mmc-make-sdhci-work-with-ricoh-mmc-controller.patch
-ApplyPatch mmc-add-ricoh-e822-pci-id.patch
-
-ApplyPatch depessimize-rds_copy_page_user.patch
-ApplyPatch tpm-autodetect-itpm-devices.patch
-
-# CVE-2010-2962
-ApplyPatch drm-i915-sanity-check-pread-pwrite.patch
-# CVE-2010-3698
-ApplyPatch kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch
-# CVE-2010-2963
-ApplyPatch v4l1-fix-32-bit-compat-microcode-loading-translation.patch
-
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2093,31 +2062,6 @@ fi
 # and build.
 
 %changelog
-* Tue Nov 02 2010 Ben Skeggs <bskeggs@redhat.com> 2.6.35.6-50
-- nouveau: add potential workaround for NV86 hardware quirk
-- fix issue that occurs in certain dual-head configurations (rhbz#641524)
-
-* Sat Oct 23 2010 Jarod Wilson <jarod@redhat.com> 2.6.35.6-49
-- Fix brown paper bag bug in imon driver
-
-* Fri Oct 22 2010 Chuck Ebbert <cebbert@redhat.com> 2.6.35.6-48
-- drm-i915-sanity-check-pread-pwrite.patch;
-   fix CVE-2010-2962, arbitrary kernel memory write via i915 GEM ioctl
-- kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch;
-   fix CVE-2010-3698, kvm: invalid selector in fs/gs causes kernel panic
-- v4l1-fix-32-bit-compat-microcode-loading-translation.patch;
-   fixes CVE-2010-2963, v4l: VIDIOCSMICROCODE arbitrary write
-
-* Fri Oct 22 2010 Kyle McMartin <kyle@redhat.com> 2.6.35.6-47
-- tpm-autodetect-itpm-devices.patch: Auto-fix TPM issues on various
-  laptops which prevented suspend/resume.
-- depessimize-rds_copy_page_user.patch: Fix CVE-2010-3904, local
-  privilege escalation via RDS protocol.
-
-* Mon Oct 18 2010 Kyle McMartin <kyle@redhat.com> 2.6.35.6-46
-- Add Ricoh e822 support. (rhbz#596475) Thanks to sgruszka@ for
-  sending the patches in.
-
 * Mon Oct 18 2010 Kyle McMartin <kyle@redhat.com> 2.6.35.6-45
 - Print a useful message when disabling IOMMU when a Ricoh cardreader
   is probed.
@@ -2133,7 +2077,7 @@ fi
 - Quirk to disable DMAR with Ricoh card reader/firewire. (rhbz#605888)
 
 * Mon Oct 18 2010 Kyle McMartin <kyle@redhat.com>
-- Two networking fixes (skge, r8169) from sgruszka@. (rhbz#447489,629158)
+- Two networking fixes (skge, r8169) from sgruska. (rhbz#447489,629158)
 
 * Fri Oct 15 2010 Kyle McMartin <kyle@redhat.com>
 - pnpacpi: cope with invalid device IDs. (rhbz#641468)
diff --git a/freed-ora/current/f14/kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch b/freed-ora/current/f14/kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch
deleted file mode 100644
index d65904e04..000000000
--- a/freed-ora/current/f14/kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch
+++ /dev/null
@@ -1,164 +0,0 @@
-From: Avi Kivity <avi@redhat.com>
-Date: Tue, 19 Oct 2010 14:46:55 +0000 (+0200)
-Subject: KVM: Fix fs/gs reload oops with invalid ldt
-X-Git-Tag: v2.6.36~4^2
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=9581d442b9058d3699b4be568b6e5eae38a41493
-
-KVM: Fix fs/gs reload oops with invalid ldt
-
-kvm reloads the host's fs and gs blindly, however the underlying segment
-descriptors may be invalid due to the user modifying the ldt after loading
-them.
-
-Fix by using the safe accessors (loadsegment() and load_gs_index()) instead
-of home grown unsafe versions.
-
-This is CVE-2010-3698.
-
-KVM-Stable-Tag.
-Signed-off-by: Avi Kivity <avi@redhat.com>
-Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
----
-
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index 502e53f..c52e2eb 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -652,20 +652,6 @@ static inline struct kvm_mmu_page *page_header(hpa_t shadow_page)
- 	return (struct kvm_mmu_page *)page_private(page);
- }
- 
--static inline u16 kvm_read_fs(void)
--{
--	u16 seg;
--	asm("mov %%fs, %0" : "=g"(seg));
--	return seg;
--}
--
--static inline u16 kvm_read_gs(void)
--{
--	u16 seg;
--	asm("mov %%gs, %0" : "=g"(seg));
--	return seg;
--}
--
- static inline u16 kvm_read_ldt(void)
- {
- 	u16 ldt;
-@@ -673,16 +659,6 @@ static inline u16 kvm_read_ldt(void)
- 	return ldt;
- }
- 
--static inline void kvm_load_fs(u16 sel)
--{
--	asm("mov %0, %%fs" : : "rm"(sel));
--}
--
--static inline void kvm_load_gs(u16 sel)
--{
--	asm("mov %0, %%gs" : : "rm"(sel));
--}
--
- static inline void kvm_load_ldt(u16 sel)
- {
- 	asm("lldt %0" : : "rm"(sel));
-diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 81ed28c..8a3f9f6 100644
---- a/arch/x86/kvm/svm.c
-+++ b/arch/x86/kvm/svm.c
-@@ -3163,8 +3163,8 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
- 	sync_lapic_to_cr8(vcpu);
- 
- 	save_host_msrs(vcpu);
--	fs_selector = kvm_read_fs();
--	gs_selector = kvm_read_gs();
-+	savesegment(fs, fs_selector);
-+	savesegment(gs, gs_selector);
- 	ldt_selector = kvm_read_ldt();
- 	svm->vmcb->save.cr2 = vcpu->arch.cr2;
- 	/* required for live migration with NPT */
-@@ -3251,10 +3251,15 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
- 	vcpu->arch.regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
- 	vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;
- 
--	kvm_load_fs(fs_selector);
--	kvm_load_gs(gs_selector);
--	kvm_load_ldt(ldt_selector);
- 	load_host_msrs(vcpu);
-+	loadsegment(fs, fs_selector);
-+#ifdef CONFIG_X86_64
-+	load_gs_index(gs_selector);
-+	wrmsrl(MSR_KERNEL_GS_BASE, current->thread.gs);
-+#else
-+	loadsegment(gs, gs_selector);
-+#endif
-+	kvm_load_ldt(ldt_selector);
- 
- 	reload_tss(vcpu);
- 
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 49b25ee..7bddfab 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -803,7 +803,7 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
- 	 */
- 	vmx->host_state.ldt_sel = kvm_read_ldt();
- 	vmx->host_state.gs_ldt_reload_needed = vmx->host_state.ldt_sel;
--	vmx->host_state.fs_sel = kvm_read_fs();
-+	savesegment(fs, vmx->host_state.fs_sel);
- 	if (!(vmx->host_state.fs_sel & 7)) {
- 		vmcs_write16(HOST_FS_SELECTOR, vmx->host_state.fs_sel);
- 		vmx->host_state.fs_reload_needed = 0;
-@@ -811,7 +811,7 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
- 		vmcs_write16(HOST_FS_SELECTOR, 0);
- 		vmx->host_state.fs_reload_needed = 1;
- 	}
--	vmx->host_state.gs_sel = kvm_read_gs();
-+	savesegment(gs, vmx->host_state.gs_sel);
- 	if (!(vmx->host_state.gs_sel & 7))
- 		vmcs_write16(HOST_GS_SELECTOR, vmx->host_state.gs_sel);
- 	else {
-@@ -841,27 +841,21 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
- 
- static void __vmx_load_host_state(struct vcpu_vmx *vmx)
- {
--	unsigned long flags;
--
- 	if (!vmx->host_state.loaded)
- 		return;
- 
- 	++vmx->vcpu.stat.host_state_reload;
- 	vmx->host_state.loaded = 0;
- 	if (vmx->host_state.fs_reload_needed)
--		kvm_load_fs(vmx->host_state.fs_sel);
-+		loadsegment(fs, vmx->host_state.fs_sel);
- 	if (vmx->host_state.gs_ldt_reload_needed) {
- 		kvm_load_ldt(vmx->host_state.ldt_sel);
--		/*
--		 * If we have to reload gs, we must take care to
--		 * preserve our gs base.
--		 */
--		local_irq_save(flags);
--		kvm_load_gs(vmx->host_state.gs_sel);
- #ifdef CONFIG_X86_64
--		wrmsrl(MSR_GS_BASE, vmcs_readl(HOST_GS_BASE));
-+		load_gs_index(vmx->host_state.gs_sel);
-+		wrmsrl(MSR_KERNEL_GS_BASE, current->thread.gs);
-+#else
-+		loadsegment(gs, vmx->host_state.gs_sel);
- #endif
--		local_irq_restore(flags);
- 	}
- 	reload_tss();
- #ifdef CONFIG_X86_64
-@@ -2589,8 +2583,8 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
- 	vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS);  /* 22.2.4 */
- 	vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS);  /* 22.2.4 */
- 	vmcs_write16(HOST_ES_SELECTOR, __KERNEL_DS);  /* 22.2.4 */
--	vmcs_write16(HOST_FS_SELECTOR, kvm_read_fs());    /* 22.2.4 */
--	vmcs_write16(HOST_GS_SELECTOR, kvm_read_gs());    /* 22.2.4 */
-+	vmcs_write16(HOST_FS_SELECTOR, 0);            /* 22.2.4 */
-+	vmcs_write16(HOST_GS_SELECTOR, 0);            /* 22.2.4 */
- 	vmcs_write16(HOST_SS_SELECTOR, __KERNEL_DS);  /* 22.2.4 */
- #ifdef CONFIG_X86_64
- 	rdmsrl(MSR_FS_BASE, a);
diff --git a/freed-ora/current/f14/linux-2.6-v4l-dvb-ir-core-fix-imon.patch b/freed-ora/current/f14/linux-2.6-v4l-dvb-ir-core-fix-imon.patch
deleted file mode 100644
index 48be94701..000000000
--- a/freed-ora/current/f14/linux-2.6-v4l-dvb-ir-core-fix-imon.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From: Jarod Wilson <jarod@redhat.com>
-Date: Sat, 23 Oct 2010 19:42:20 +0000 (-0300)
-Subject: [media] imon: fix my egregious brown paper bag w/rdev/idev split
-X-Git-Url: http://git.linuxtv.org/media_tree.git?a=commitdiff_plain;h=428cc7633dedbab05aab80b805d8585572dc6dbf
-
-[media] imon: fix my egregious brown paper bag w/rdev/idev split
-
-Somehow, I managed to screw things up when reworking the rdev/idev split
-patch from David, and started trying to get ir_input_dev from idev
-instead of rdev, thus resulting in button presses hanging the system.
-This fixes it.
-
-Signed-off-by: Jarod Wilson <jarod@redhat.com>
-Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
----
-
-diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c
-index 0391c3b..bcb2826 100644
---- a/drivers/media/IR/imon.c
-+++ b/drivers/media/IR/imon.c
-@@ -1477,7 +1477,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
- 	bool norelease = false;
- 	int i;
- 	u64 scancode;
--	struct input_dev *idev = NULL;
-+	struct input_dev *rdev = NULL;
- 	struct ir_input_dev *irdev = NULL;
- 	int press_type = 0;
- 	int msec;
-@@ -1485,8 +1485,8 @@ static void imon_incoming_packet(struct imon_context *ictx,
- 	static struct timeval prev_time = { 0, 0 };
- 	u8 ktype;
- 
--	idev = ictx->idev;
--	irdev = input_get_drvdata(idev);
-+	rdev = ictx->rdev;
-+	irdev = input_get_drvdata(rdev);
- 
- 	/* filter out junk data on the older 0xffdc imon devices */
- 	if ((buf[0] == 0xff) && (buf[1] == 0xff) && (buf[2] == 0xff))
-@@ -1570,8 +1570,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
- 		if (press_type == 0)
- 			ir_keyup(irdev);
- 		else {
--			ir_keydown(ictx->rdev, ictx->rc_scancode,
--				   ictx->rc_toggle);
-+			ir_keydown(rdev, ictx->rc_scancode, ictx->rc_toggle);
- 			spin_lock_irqsave(&ictx->kc_lock, flags);
- 			ictx->last_keycode = ictx->kc;
- 			spin_unlock_irqrestore(&ictx->kc_lock, flags);
-@@ -1587,7 +1586,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
- 		do_gettimeofday(&t);
- 		msec = tv2int(&t, &prev_time);
- 		prev_time = t;
--		if (msec < idev->rep[REP_DELAY]) {
-+		if (msec < ictx->idev->rep[REP_DELAY]) {
- 			spin_unlock_irqrestore(&ictx->kc_lock, flags);
- 			return;
- 		}
-@@ -1596,12 +1595,12 @@ static void imon_incoming_packet(struct imon_context *ictx,
- 
- 	spin_unlock_irqrestore(&ictx->kc_lock, flags);
- 
--	input_report_key(idev, kc, press_type);
--	input_sync(idev);
-+	input_report_key(ictx->idev, kc, press_type);
-+	input_sync(ictx->idev);
- 
- 	/* panel keys don't generate a release */
--	input_report_key(idev, kc, 0);
--	input_sync(idev);
-+	input_report_key(ictx->idev, kc, 0);
-+	input_sync(ictx->idev);
- 
- 	ictx->last_keycode = kc;
- 
diff --git a/freed-ora/current/f14/mmc-add-ricoh-e822-pci-id.patch b/freed-ora/current/f14/mmc-add-ricoh-e822-pci-id.patch
deleted file mode 100644
index 0503db749..000000000
--- a/freed-ora/current/f14/mmc-add-ricoh-e822-pci-id.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From kernel-bounces@lists.fedoraproject.org Thu Sep  9 09:24:46 2010
-From: Stanislaw Gruszka <sgruszka@redhat.com>
-Subject: [PATCH 3/3] mmc: add ricoh e822 pci id
-Date: Thu,  9 Sep 2010 15:24:12 +0200
-
-From: Pablo Castillo <CyberCastle@gmail.com>
-
-Upstream 568133ebda39f7507759a744fa9cf4d5097bad2f commit.
-
-Signed-off-by: Pablo Castillo <CyberCastle@gmail.com>
-Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
-Tested-by: Gregg Lebovitz <gregg@lebovitz.net>
-Cc: Maxim Levitsky <maximlevitsky@gmail.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- drivers/mmc/host/sdhci-pci.c |    8 ++++++++
- 1 files changed, 8 insertions(+), 0 deletions(-)
-
-diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
-index e021431..e8aa99d 100644
---- a/drivers/mmc/host/sdhci-pci.c
-+++ b/drivers/mmc/host/sdhci-pci.c
-@@ -415,6 +415,14 @@ static const struct pci_device_id pci_ids[] __devinitdata = {
- 	},
- 
- 	{
-+		.vendor         = PCI_VENDOR_ID_RICOH,
-+		.device         = 0xe822,
-+		.subvendor      = PCI_ANY_ID,
-+		.subdevice      = PCI_ANY_ID,
-+		.driver_data    = (kernel_ulong_t)&sdhci_ricoh_mmc,
-+	},
-+
-+	{
- 		.vendor		= PCI_VENDOR_ID_ENE,
- 		.device		= PCI_DEVICE_ID_ENE_CB712_SD,
- 		.subvendor	= PCI_ANY_ID,
--- 
-1.7.1
-
-_______________________________________________
-kernel mailing list
-kernel@lists.fedoraproject.org
-https://admin.fedoraproject.org/mailman/listinfo/kernel
-
diff --git a/freed-ora/current/f14/mmc-make-sdhci-work-with-ricoh-mmc-controller.patch b/freed-ora/current/f14/mmc-make-sdhci-work-with-ricoh-mmc-controller.patch
deleted file mode 100644
index aba08d35a..000000000
--- a/freed-ora/current/f14/mmc-make-sdhci-work-with-ricoh-mmc-controller.patch
+++ /dev/null
@@ -1,150 +0,0 @@
-From kernel-bounces@lists.fedoraproject.org Thu Sep  9 09:24:33 2010
-From: Stanislaw Gruszka <sgruszka@redhat.com>
-Subject: [PATCH 2/3] mmc: make sdhci work with ricoh mmc controller
-Date: Thu,  9 Sep 2010 15:24:11 +0200
-
-From: Maxim Levitsky <maximlevitsky@gmail.com>
-
-Upstream ccc92c23240cdf952ef7cc39ba563910dcbc9cbe commit.
-
-The current way of disabling it is not well tested by vendor and has all
-kinds of bugs that show up on resume from ram/disk.  A very good example
-is a dead SDHCI controller.
-
-Old way of disabling is still supported by continuing to use
-CONFIG_MMC_RICOH_MMC.
-
-Based on 'http://list.drzeus.cx/pipermail/sdhci-devel/2007-December/002085.html'
-Therefore most of the credit for this goes to Andrew de Quincey
-
-Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
-Cc: Andrew de Quincey <adq_dvb@lidskialf.net>
-Acked-by: Philip Langdale <philipl@overt.org>
-Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
-Cc: <linux-mmc@vger.kernel.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- drivers/mmc/host/sdhci-pci.c |   41 +++++++++++++++++++++++++++++++++++++++++
- drivers/mmc/host/sdhci.c     |    3 ++-
- drivers/mmc/host/sdhci.h     |    4 ++++
- 3 files changed, 47 insertions(+), 1 deletions(-)
-
-diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
-index 65483fd..e021431 100644
---- a/drivers/mmc/host/sdhci-pci.c
-+++ b/drivers/mmc/host/sdhci-pci.c
-@@ -17,6 +17,7 @@
- #include <linux/pci.h>
- #include <linux/dma-mapping.h>
- #include <linux/slab.h>
-+#include <linux/device.h>
- 
- #include <linux/mmc/host.h>
- 
-@@ -84,7 +85,30 @@ static int ricoh_probe(struct sdhci_pci_chip *chip)
- 	if (chip->pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG ||
- 	    chip->pdev->subsystem_vendor == PCI_VENDOR_ID_SONY)
- 		chip->quirks |= SDHCI_QUIRK_NO_CARD_NO_RESET;
-+	return 0;
-+}
-+
-+static int ricoh_mmc_probe_slot(struct sdhci_pci_slot *slot)
-+{
-+	slot->host->caps =
-+		((0x21 << SDHCI_TIMEOUT_CLK_SHIFT)
-+			& SDHCI_TIMEOUT_CLK_MASK) |
-+
-+		((0x21 << SDHCI_CLOCK_BASE_SHIFT)
-+			& SDHCI_CLOCK_BASE_MASK) |
- 
-+		SDHCI_TIMEOUT_CLK_UNIT |
-+		SDHCI_CAN_VDD_330 |
-+		SDHCI_CAN_DO_SDMA;
-+	return 0;
-+}
-+
-+static int ricoh_mmc_resume(struct sdhci_pci_chip *chip)
-+{
-+	/* Apply a delay to allow controller to settle */
-+	/* Otherwise it becomes confused if card state changed
-+		during suspend */
-+	msleep(500);
- 	return 0;
- }
- 
-@@ -95,6 +119,15 @@ static const struct sdhci_pci_fixes sdhci_ricoh = {
- 			  SDHCI_QUIRK_CLOCK_BEFORE_RESET,
- };
- 
-+static const struct sdhci_pci_fixes sdhci_ricoh_mmc = {
-+	.probe_slot	= ricoh_mmc_probe_slot,
-+	.resume		= ricoh_mmc_resume,
-+	.quirks		= SDHCI_QUIRK_32BIT_DMA_ADDR |
-+			  SDHCI_QUIRK_CLOCK_BEFORE_RESET |
-+			  SDHCI_QUIRK_NO_CARD_NO_RESET |
-+			  SDHCI_QUIRK_MISSING_CAPS
-+};
-+
- static const struct sdhci_pci_fixes sdhci_ene_712 = {
- 	.quirks		= SDHCI_QUIRK_SINGLE_POWER_WRITE |
- 			  SDHCI_QUIRK_BROKEN_DMA,
-@@ -374,6 +407,14 @@ static const struct pci_device_id pci_ids[] __devinitdata = {
- 	},
- 
- 	{
-+		.vendor         = PCI_VENDOR_ID_RICOH,
-+		.device         = 0x843,
-+		.subvendor      = PCI_ANY_ID,
-+		.subdevice      = PCI_ANY_ID,
-+		.driver_data    = (kernel_ulong_t)&sdhci_ricoh_mmc,
-+	},
-+
-+	{
- 		.vendor		= PCI_VENDOR_ID_ENE,
- 		.device		= PCI_DEVICE_ID_ENE_CB712_SD,
- 		.subvendor	= PCI_ANY_ID,
-diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
-index 955cad9..8e1dda3 100644
---- a/drivers/mmc/host/sdhci.c
-+++ b/drivers/mmc/host/sdhci.c
-@@ -1692,7 +1692,8 @@ int sdhci_add_host(struct sdhci_host *host)
- 			host->version);
- 	}
- 
--	caps = sdhci_readl(host, SDHCI_CAPABILITIES);
-+	caps = (host->quirks & SDHCI_QUIRK_MISSING_CAPS) ? host->caps :
-+		sdhci_readl(host, SDHCI_CAPABILITIES);
- 
- 	if (host->quirks & SDHCI_QUIRK_FORCE_DMA)
- 		host->flags |= SDHCI_USE_SDMA;
-diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
-index eb5efe0..030de49 100644
---- a/drivers/mmc/host/sdhci.h
-+++ b/drivers/mmc/host/sdhci.h
-@@ -241,6 +241,8 @@ struct sdhci_host {
- #define SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN		(1<<25)
- /* Controller cannot support End Attribute in NOP ADMA descriptor */
- #define SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC		(1<<26)
-+/* Controller is missing device caps. Use caps provided by host */
-+#define SDHCI_QUIRK_MISSING_CAPS			(1<<27)
- 
- 	int			irq;		/* Device IRQ */
- 	void __iomem *		ioaddr;		/* Mapped address */
-@@ -293,6 +295,8 @@ struct sdhci_host {
- 
- 	struct timer_list	timer;		/* Timer for timeouts */
- 
-+	unsigned int		caps;		/* Alternative capabilities */
-+
- 	unsigned long		private[0] ____cacheline_aligned;
- };
- 
--- 
-1.7.1
-
-_______________________________________________
-kernel mailing list
-kernel@lists.fedoraproject.org
-https://admin.fedoraproject.org/mailman/listinfo/kernel
-
diff --git a/freed-ora/current/f14/sdhci-8-bit-data-transfer-width-support.patch b/freed-ora/current/f14/sdhci-8-bit-data-transfer-width-support.patch
deleted file mode 100644
index 94210a8ff..000000000
--- a/freed-ora/current/f14/sdhci-8-bit-data-transfer-width-support.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From kernel-bounces@lists.fedoraproject.org Thu Sep  9 09:23:49 2010
-From: Stanislaw Gruszka <sgruszka@redhat.com>
-Subject: [PATCH 1/3] sdhci: 8-bit data transfer width support
-Date: Thu,  9 Sep 2010 15:24:10 +0200
-
-From: Kyungmin Park <kyungmin.park@samsung.com>
-
-Upstream ae6d6c92212e94b12ab9365c23fb73acc2c3c2e7 commit.
-
-Some host controllers such as s5pc110 support the WIDE8 feature.
-
-Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
-Cc: Grant Likely <grant.likely@secretlab.ca>
-Cc: <linux-mmc@vger.kernel.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- drivers/mmc/host/sdhci.c |    5 +++++
- drivers/mmc/host/sdhci.h |    1 +
- 2 files changed, 6 insertions(+), 0 deletions(-)
-
-diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
-index c6d1bd8..955cad9 100644
---- a/drivers/mmc/host/sdhci.c
-+++ b/drivers/mmc/host/sdhci.c
-@@ -1159,6 +1159,11 @@ static void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
- 
- 	ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
- 
-+	if (ios->bus_width == MMC_BUS_WIDTH_8)
-+		ctrl |= SDHCI_CTRL_8BITBUS;
-+	else
-+		ctrl &= ~SDHCI_CTRL_8BITBUS;
-+
- 	if (ios->bus_width == MMC_BUS_WIDTH_4)
- 		ctrl |= SDHCI_CTRL_4BITBUS;
- 	else
-diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
-index c846813..eb5efe0 100644
---- a/drivers/mmc/host/sdhci.h
-+++ b/drivers/mmc/host/sdhci.h
-@@ -72,6 +72,7 @@
- #define   SDHCI_CTRL_ADMA1	0x08
- #define   SDHCI_CTRL_ADMA32	0x10
- #define   SDHCI_CTRL_ADMA64	0x18
-+#define  SDHCI_CTRL_8BITBUS	0x20
- 
- #define SDHCI_POWER_CONTROL	0x29
- #define  SDHCI_POWER_ON		0x01
--- 
-1.7.1
-
-_______________________________________________
-kernel mailing list
-kernel@lists.fedoraproject.org
-https://admin.fedoraproject.org/mailman/listinfo/kernel
-
diff --git a/freed-ora/current/f14/tpm-autodetect-itpm-devices.patch b/freed-ora/current/f14/tpm-autodetect-itpm-devices.patch
deleted file mode 100644
index 57b5d07ed..000000000
--- a/freed-ora/current/f14/tpm-autodetect-itpm-devices.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-commit 8cf5102c84dba60b2ea29b7e89f1a65100e20bb9
-Author: Matthew Garrett <mjg@redhat.com>
-Date:   Thu Oct 21 17:31:56 2010 -0400
-
-    tpm: Autodetect itpm devices
-    
-    Some Lenovos have TPMs that require a quirk to function correctly. This can
-    be autodetected by checking whether the device has a _HID of INTC0102. This
-    is an invalid PNPid, and as such is discarded by the pnp layer - however
-    it's still present in the ACPI code, so we can pull it out that way. This
-    means that the quirk won't be automatically applied on non-ACPI systems,
-    but without ACPI we don't have any way to identify the chip anyway so I
-    don't think that's a great concern.
-    
-    Signed-off-by: Matthew Garrett <mjg@redhat.com>
-
-diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
-index 1030f84..c17a305 100644
---- a/drivers/char/tpm/tpm_tis.c
-+++ b/drivers/char/tpm/tpm_tis.c
-@@ -25,6 +25,7 @@
- #include <linux/slab.h>
- #include <linux/interrupt.h>
- #include <linux/wait.h>
-+#include <linux/acpi.h>
- #include "tpm.h"
- 
- #define TPM_HEADER_SIZE 10
-@@ -78,6 +79,26 @@ enum tis_defaults {
- static LIST_HEAD(tis_chips);
- static DEFINE_SPINLOCK(tis_lock);
- 
-+#ifdef CONFIG_ACPI
-+static int is_itpm(struct pnp_dev *dev)
-+{
-+	struct acpi_device *acpi = pnp_acpi_device(dev);
-+	struct acpi_hardware_id *id;
-+
-+	list_for_each_entry(id, &acpi->pnp.ids, list) {
-+		if (!strcmp("INTC0102", id->id))
-+			return 1;
-+	}
-+
-+	return 0;
-+}
-+#else
-+static int is_itpm(struct pnp_dev *dev)
-+{
-+	return 0;
-+}
-+#endif
-+
- static int check_locality(struct tpm_chip *chip, int l)
- {
- 	if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
-@@ -472,6 +493,9 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
- 		 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
- 		 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
- 
-+	if (is_itpm(to_pnp_dev(dev)))
-+		itpm = 1;
-+
- 	if (itpm)
- 		dev_info(dev, "Intel iTPM workaround enabled\n");
- 
diff --git a/freed-ora/current/f14/v4l1-fix-32-bit-compat-microcode-loading-translation.patch b/freed-ora/current/f14/v4l1-fix-32-bit-compat-microcode-loading-translation.patch
deleted file mode 100644
index bfb7db817..000000000
--- a/freed-ora/current/f14/v4l1-fix-32-bit-compat-microcode-loading-translation.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From 3e645d6b485446c54c6745c5e2cf5c528fe4deec Mon Sep 17 00:00:00 2001
-From: Linus Torvalds <torvalds@linux-foundation.org>
-Date: Fri, 15 Oct 2010 11:12:38 -0700
-Subject: v4l1: fix 32-bit compat microcode loading translation
-
-From: Linus Torvalds <torvalds@linux-foundation.org>
-
-commit 3e645d6b485446c54c6745c5e2cf5c528fe4deec upstream.
-
-The compat code for the VIDIOCSMICROCODE ioctl is totally buggered.
-It's only used by the VIDEO_STRADIS driver, and that one is scheduled to
-staging and eventually removed unless somebody steps up to maintain it
-(at which point it should use request_firmware() rather than some magic
-ioctl).  So we'll get rid of it eventually.
-
-But in the meantime, the compatibility ioctl code is broken, and this
-tries to get it to at least limp along (even if Mauro suggested just
-deleting it entirely, which may be the right thing to do - I don't think
-the compatibility translation code has ever worked unless you were very
-lucky).
-
-Reported-by: Kees Cook <kees.cook@canonical.com>
-Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/media/video/v4l2-compat-ioctl32.c |   32 +++++++++++++++++++-----------
- 1 file changed, 21 insertions(+), 11 deletions(-)
-
---- a/drivers/media/video/v4l2-compat-ioctl32.c
-+++ b/drivers/media/video/v4l2-compat-ioctl32.c
-@@ -193,17 +193,24 @@ static int put_video_window32(struct vid
- struct video_code32 {
- 	char		loadwhat[16];	/* name or tag of file being passed */
- 	compat_int_t	datasize;
--	unsigned char	*data;
-+	compat_uptr_t	data;
- };
- 
--static int get_microcode32(struct video_code *kp, struct video_code32 __user *up)
-+static struct video_code __user *get_microcode32(struct video_code32 *kp)
- {
--	if (!access_ok(VERIFY_READ, up, sizeof(struct video_code32)) ||
--		copy_from_user(kp->loadwhat, up->loadwhat, sizeof(up->loadwhat)) ||
--		get_user(kp->datasize, &up->datasize) ||
--		copy_from_user(kp->data, up->data, up->datasize))
--			return -EFAULT;
--	return 0;
-+	struct video_code __user *up;
-+
-+	up = compat_alloc_user_space(sizeof(*up));
-+
-+	/*
-+	 * NOTE! We don't actually care if these fail. If the
-+	 * user address is invalid, the native ioctl will do
-+	 * the error handling for us
-+	 */
-+	(void) copy_to_user(up->loadwhat, kp->loadwhat, sizeof(up->loadwhat));
-+	(void) put_user(kp->datasize, &up->datasize);
-+	(void) put_user(compat_ptr(kp->data), &up->data);
-+	return up;
- }
- 
- #define VIDIOCGTUNER32		_IOWR('v', 4, struct video_tuner32)
-@@ -744,7 +751,7 @@ static long do_video_ioctl(struct file *
- 		struct video_tuner vt;
- 		struct video_buffer vb;
- 		struct video_window vw;
--		struct video_code vc;
-+		struct video_code32 vc;
- 		struct video_audio va;
- #endif
- 		struct v4l2_format v2f;
-@@ -823,8 +830,11 @@ static long do_video_ioctl(struct file *
- 		break;
- 
- 	case VIDIOCSMICROCODE:
--		err = get_microcode32(&karg.vc, up);
--		compatible_arg = 0;
-+		/* Copy the 32-bit "video_code32" to kernel space */
-+		if (copy_from_user(&karg.vc, up, sizeof(karg.vc)))
-+			return -EFAULT;
-+		/* Convert the 32-bit version to a 64-bit version in user space */
-+		up = get_microcode32(&karg.vc);
- 		break;
- 
- 	case VIDIOCSFREQ: