--- /dev/null
+From c14c95f62ecb8710af14ae0d48e01991b70bb6f4 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 16 Feb 2012 16:38:07 +0100
+Subject: ALSA: hda/realtek - Fix overflow of vol/sw check bitmap
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c14c95f62ecb8710af14ae0d48e01991b70bb6f4 upstream.
+
+The bitmap introduced in the commit [527e4d73: ALSA: hda/realtek - Fix
+missing volume controls with ALC260] is too narrow for some codecs,
+which may have more NIDs than 0x20, thus it may overflow the bitmap
+array on them.
+
+Just double the number to cover all and also add a sanity-check code
+to be safer.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -79,6 +79,8 @@ enum {
+ ALC_AUTOMUTE_MIXER, /* mute/unmute mixer widget AMP */
+ };
+
++#define MAX_VOL_NIDS 0x40
++
+ struct alc_spec {
+ /* codec parameterization */
+ const struct snd_kcontrol_new *mixers[5]; /* mixer arrays */
+@@ -117,8 +119,8 @@ struct alc_spec {
+ const hda_nid_t *capsrc_nids;
+ hda_nid_t dig_in_nid; /* digital-in NID; optional */
+ hda_nid_t mixer_nid; /* analog-mixer NID */
+- DECLARE_BITMAP(vol_ctls, 0x20 << 1);
+- DECLARE_BITMAP(sw_ctls, 0x20 << 1);
++ DECLARE_BITMAP(vol_ctls, MAX_VOL_NIDS << 1);
++ DECLARE_BITMAP(sw_ctls, MAX_VOL_NIDS << 1);
+
+ /* capture setup for dynamic dual-adc switch */
+ hda_nid_t cur_adc;
+@@ -3068,7 +3070,10 @@ static int alc_auto_fill_dac_nids(struct
+ static inline unsigned int get_ctl_pos(unsigned int data)
+ {
+ hda_nid_t nid = get_amp_nid_(data);
+- unsigned int dir = get_amp_direction_(data);
++ unsigned int dir;
++ if (snd_BUG_ON(nid >= MAX_VOL_NIDS))
++ return 0;
++ dir = get_amp_direction_(data);
+ return (nid << 1) | dir;
+ }
+
--- /dev/null
+From ef8d60fb79614a86a82720dc2402631dbcafb315 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 17 Feb 2012 10:12:38 +0100
+Subject: ALSA: hda/realtek - Fix surround output regression on Acer Aspire 5935
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ef8d60fb79614a86a82720dc2402631dbcafb315 upstream.
+
+The previous fix for the speaker on Acer Aspire 59135 introduced
+another problem for surround outputs. It changed the connections on
+the line-in/mic pins for limiting the routes, but it left the modified
+connections. Thus wrong connection indices were written when set to
+4ch or 6ch mode.
+
+This patch fixes it by restoring the right connections just after
+parsing the tree but before the initialization.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42740
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4229,12 +4229,20 @@ static void alc889_fixup_dac_route(struc
+ const struct alc_fixup *fix, int action)
+ {
+ if (action == ALC_FIXUP_ACT_PRE_PROBE) {
++ /* fake the connections during parsing the tree */
+ hda_nid_t conn1[2] = { 0x0c, 0x0d };
+ hda_nid_t conn2[2] = { 0x0e, 0x0f };
+ snd_hda_override_conn_list(codec, 0x14, 2, conn1);
+ snd_hda_override_conn_list(codec, 0x15, 2, conn1);
+ snd_hda_override_conn_list(codec, 0x18, 2, conn2);
+ snd_hda_override_conn_list(codec, 0x1a, 2, conn2);
++ } else if (action == ALC_FIXUP_ACT_PROBE) {
++ /* restore the connections */
++ hda_nid_t conn[5] = { 0x0c, 0x0d, 0x0e, 0x0f, 0x26 };
++ snd_hda_override_conn_list(codec, 0x14, 5, conn);
++ snd_hda_override_conn_list(codec, 0x15, 5, conn);
++ snd_hda_override_conn_list(codec, 0x18, 5, conn);
++ snd_hda_override_conn_list(codec, 0x1a, 5, conn);
+ }
+ }
+
--- /dev/null
+From d980e0f8d858c6963d676013e976ff00ab7acb2b Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Tue, 7 Feb 2012 09:42:11 +0000
+Subject: ARM: omap: fix oops in arch/arm/mach-omap2/vp.c when pmic is not found
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit d980e0f8d858c6963d676013e976ff00ab7acb2b upstream.
+
+When the PMIC is not found, voltdm->pmic will be NULL. vp.c's
+initialization function tries to dereferences this, which causes an
+oops:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000000
+pgd = c0004000
+[00000000] *pgd=00000000
+Internal error: Oops: 5 [#1] PREEMPT
+Modules linked in:
+CPU: 0 Not tainted (3.3.0-rc2+ #204)
+PC is at omap_vp_init+0x5c/0x15c
+LR is at omap_vp_init+0x58/0x15c
+pc : [<c03db880>] lr : [<c03db87c>] psr: 60000013
+sp : c181ff30 ip : c181ff68 fp : c181ff64
+r10: c0407808 r9 : c040786c r8 : c0407814
+r7 : c0026868 r6 : c00264fc r5 : c040ad6c r4 : 00000000
+r3 : 00000040 r2 : 000032c8 r1 : 0000fa00 r0 : 000032c8
+Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: 10c5387d Table: 80004019 DAC: 00000015
+Process swapper (pid: 1, stack limit = 0xc181e2e8)
+Stack: (0xc181ff30 to 0xc1820000)
+ff20: c0381d00 c02e9c6d c0383582 c040786c
+ff40: c040ad6c c00264fc c0026868 c0407814 00000000 c03d9de4 c181ff8c c181ff68
+ff60: c03db448 c03db830 c02e982c c03fdfb8 c03fe004 c0039988 00000013 00000000
+ff80: c181ff9c c181ff90 c03d9df8 c03db390 c181ffdc c181ffa0 c0008798 c03d9df0
+ffa0: c181ffc4 c181ffb0 c0055a44 c0187050 c0039988 c03fdfb8 c03fe004 c0039988
+ffc0: 00000013 00000000 00000000 00000000 c181fff4 c181ffe0 c03d1284 c0008708
+ffe0: 00000000 c03d1208 00000000 c181fff8 c0039988 c03d1214 1077ce40 01f7ee08
+Backtrace:
+[<c03db824>] (omap_vp_init+0x0/0x15c) from [<c03db448>] (omap_voltage_late_init+0xc4/0xfc)
+[<c03db384>] (omap_voltage_late_init+0x0/0xfc) from [<c03d9df8>] (omap2_common_pm_late_init+0x14/0x54)
+ r8:00000000 r7:00000013 r6:c0039988 r5:c03fe004 r4:c03fdfb8
+[<c03d9de4>] (omap2_common_pm_late_init+0x0/0x54) from [<c0008798>] (do_one_initcall+0x9c/0x164)
+[<c00086fc>] (do_one_initcall+0x0/0x164) from [<c03d1284>] (kernel_init+0x7c/0x120)
+[<c03d1208>] (kernel_init+0x0/0x120) from [<c0039988>] (do_exit+0x0/0x2cc)
+ r5:c03d1208 r4:00000000
+Code: e5ca300b e5900034 ebf69027 e5994024 (e5941000)
+---[ end trace aed617dddaf32c3d ]---
+Kernel panic - not syncing: Attempted to kill init!
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Igor Grinberg <grinberg@compulab.co.il>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/vp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm/mach-omap2/vp.c
++++ b/arch/arm/mach-omap2/vp.c
+@@ -41,6 +41,11 @@ void __init omap_vp_init(struct voltaged
+ u32 val, sys_clk_rate, timeout, waittime;
+ u32 vddmin, vddmax, vstepmin, vstepmax;
+
++ if (!voltdm->pmic || !voltdm->pmic->uv_to_vsel) {
++ pr_err("%s: No PMIC info for vdd_%s\n", __func__, voltdm->name);
++ return;
++ }
++
+ if (!voltdm->read || !voltdm->write) {
+ pr_err("%s: No read/write API for accessing vdd_%s regs\n",
+ __func__, voltdm->name);
--- /dev/null
+From 40410715715178ec196314dd0c19150c06901f80 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Tue, 7 Feb 2012 09:44:55 +0000
+Subject: ARM: omap: fix oops in drivers/video/omap2/dss/dpi.c
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 40410715715178ec196314dd0c19150c06901f80 upstream.
+
+When a PMIC is not found, this driver is unable to obtain its
+'vdds_dsi_reg' regulator. Even through its initialization function
+fails, other code still calls its enable function, which fails to
+check whether it has this regulator before asking for it to be enabled.
+
+This fixes the oops, however a better fix would be to sort out the
+upper layers to prevent them calling into a module which failed to
+initialize.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000038
+pgd = c0004000
+[00000038] *pgd=00000000
+Internal error: Oops: 5 [#1] PREEMPT
+Modules linked in:
+CPU: 0 Not tainted (3.3.0-rc2+ #228)
+PC is at regulator_enable+0x10/0x70
+LR is at omapdss_dpi_display_enable+0x54/0x15c
+pc : [<c01b9a08>] lr : [<c01af994>] psr: 60000013
+sp : c181fd90 ip : c181fdb0 fp : c181fdac
+r10: c042eff0 r9 : 00000060 r8 : c044a164
+r7 : c042c0e4 r6 : c042bd60 r5 : 00000000 r4 : c042bd60
+r3 : c084de48 r2 : c181e000 r1 : c042bd60 r0 : 00000000
+Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: 10c5387d Table: 80004019 DAC: 00000015
+Process swapper (pid: 1, stack limit = 0xc181e2e8)
+Stack: (0xc181fd90 to 0xc1820000)
+fd80: c001754c c042bd60 00000000 c042bd60
+fda0: c181fdcc c181fdb0 c01af994 c01b9a04 c0016104 c042bd60 c042bd60 c044a338
+fdc0: c181fdec c181fdd0 c01b5ed0 c01af94c c042bd60 c042bd60 c1aa8000 c1aa8a0c
+fde0: c181fe04 c181fdf0 c01b5f54 c01b5ea8 c02fc18c c042bd60 c181fe3c c181fe08
+fe00: c01b2a18 c01b5f48 c01aed14 c02fc160 c01df8ec 00000002 c042bd60 00000003
+fe20: c042bd60 c1aa8000 c1aa8a0c c042eff8 c181fe84 c181fe40 c01b3874 c01b29fc
+fe40: c042eff8 00000000 c042f000 c0449db8 c044ed78 00000000 c181fe74 c042eff8
+fe60: c042eff8 c0449db8 c0449db8 c044ed78 00000000 00000000 c181fe94 c181fe88
+fe80: c01e452c c01b35e8 c181feb4 c181fe98 c01e2fdc c01e4518 c042eff8 c0449db8
+fea0: c0449db8 c181fef0 c181fecc c181feb8 c01e3104 c01e2f48 c042eff8 c042f02c
+fec0: c181feec c181fed0 c01e3190 c01e30c0 c01e311c 00000000 c01e311c c0449db8
+fee0: c181ff14 c181fef0 c01e1998 c01e3128 c18330a8 c1892290 c04165e8 c0449db8
+ff00: c0449db8 c1ab60c0 c181ff24 c181ff18 c01e2e28 c01e194c c181ff54 c181ff28
+ff20: c01e2218 c01e2e14 c039afed c181ff38 c04165e8 c041660c c0449db8 00000013
+ff40: 00000000 c03ffdb8 c181ff7c c181ff58 c01e384c c01e217c c181ff7c c04165e8
+ff60: c041660c c003a37c 00000013 00000000 c181ff8c c181ff80 c01e488c c01e3790
+ff80: c181ff9c c181ff90 c03ffdcc c01e484c c181ffdc c181ffa0 c0008798 c03ffdc4
+ffa0: c181ffc4 c181ffb0 c0056440 c0187810 c003a37c c04165e8 c041660c c003a37c
+ffc0: 00000013 00000000 00000000 00000000 c181fff4 c181ffe0 c03ea284 c0008708
+ffe0: 00000000 c03ea208 00000000 c181fff8 c003a37c c03ea214 1073cec0 01f7ee08
+Backtrace:
+[<c01b99f8>] (regulator_enable+0x0/0x70) from [<c01af994>] (omapdss_dpi_display_enable+0x54/0x15c)
+ r6:c042bd60 r5:00000000 r4:c042bd60
+[<c01af940>] (omapdss_dpi_display_enable+0x0/0x15c) from [<c01b5ed0>] (generic_dpi_panel_power_on+0x34/0x78)
+ r6:c044a338 r5:c042bd60 r4:c042bd60
+[<c01b5e9c>] (generic_dpi_panel_power_on+0x0/0x78) from [<c01b5f54>] (generic_dpi_panel_enable+0x18/0x28)
+ r7:c1aa8a0c r6:c1aa8000 r5:c042bd60 r4:c042bd60
+[<c01b5f3c>] (generic_dpi_panel_enable+0x0/0x28) from [<c01b2a18>] (omapfb_init_display+0x28/0x150)
+ r4:c042bd60
+[<c01b29f0>] (omapfb_init_display+0x0/0x150) from [<c01b3874>] (omapfb_probe+0x298/0x318)
+ r8:c042eff8 r7:c1aa8a0c r6:c1aa8000 r5:c042bd60 r4:00000003
+[<c01b35dc>] (omapfb_probe+0x0/0x318) from [<c01e452c>] (platform_drv_probe+0x20/0x24)
+[<c01e450c>] (platform_drv_probe+0x0/0x24) from [<c01e2fdc>] (really_probe+0xa0/0x178)
+[<c01e2f3c>] (really_probe+0x0/0x178) from [<c01e3104>] (driver_probe_device+0x50/0x68)
+ r7:c181fef0 r6:c0449db8 r5:c0449db8 r4:c042eff8
+[<c01e30b4>] (driver_probe_device+0x0/0x68) from [<c01e3190>] (__driver_attach+0x74/0x98)
+ r5:c042f02c r4:c042eff8
+[<c01e311c>] (__driver_attach+0x0/0x98) from [<c01e1998>] (bus_for_each_dev+0x58/0x98)
+ r6:c0449db8 r5:c01e311c r4:00000000
+[<c01e1940>] (bus_for_each_dev+0x0/0x98) from [<c01e2e28>] (driver_attach+0x20/0x28)
+ r7:c1ab60c0 r6:c0449db8 r5:c0449db8 r4:c04165e8
+[<c01e2e08>] (driver_attach+0x0/0x28) from [<c01e2218>] (bus_add_driver+0xa8/0x22c)
+[<c01e2170>] (bus_add_driver+0x0/0x22c) from [<c01e384c>] (driver_register+0xc8/0x154)
+[<c01e3784>] (driver_register+0x0/0x154) from [<c01e488c>] (platform_driver_register+0x4c/0x60)
+ r8:00000000 r7:00000013 r6:c003a37c r5:c041660c r4:c04165e8
+[<c01e4840>] (platform_driver_register+0x0/0x60) from [<c03ffdcc>] (omapfb_init+0x14/0x34)
+[<c03ffdb8>] (omapfb_init+0x0/0x34) from [<c0008798>] (do_one_initcall+0x9c/0x164)
+[<c00086fc>] (do_one_initcall+0x0/0x164) from [<c03ea284>] (kernel_init+0x7c/0x120)
+[<c03ea208>] (kernel_init+0x0/0x120) from [<c003a37c>] (do_exit+0x0/0x2d8)
+ r5:c03ea208 r4:00000000
+Code: e1a0c00d e92dd870 e24cb004 e24dd004 (e5906038)
+---[ end trace 9e2474c2e193b223 ]---
+
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Igor Grinberg <grinberg@compulab.co.il>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/omap2/dss/dpi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/video/omap2/dss/dpi.c
++++ b/drivers/video/omap2/dss/dpi.c
+@@ -180,6 +180,11 @@ int omapdss_dpi_display_enable(struct om
+ {
+ int r;
+
++ if (cpu_is_omap34xx() && !dpi.vdds_dsi_reg) {
++ DSSERR("no VDSS_DSI regulator\n");
++ return -ENODEV;
++ }
++
+ if (dssdev->manager == NULL) {
+ DSSERR("failed to enable display: no manager\n");
+ return -ENODEV;
--- /dev/null
+From 31794bc37bf2db84f085da52b72bfba65739b2d2 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Mon, 13 Feb 2012 22:00:47 -0800
+Subject: ASoC: wm8962: Fix sidetone enumeration texts
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 31794bc37bf2db84f085da52b72bfba65739b2d2 upstream.
+
+The sidetone enumeration texts have left and right swapped.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8962.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -2559,7 +2559,7 @@ static int dsp2_event(struct snd_soc_dap
+ return 0;
+ }
+
+-static const char *st_text[] = { "None", "Right", "Left" };
++static const char *st_text[] = { "None", "Left", "Right" };
+
+ static const struct soc_enum str_enum =
+ SOC_ENUM_SINGLE(WM8962_DAC_DSP_MIXING_1, 2, 3, st_text);
--- /dev/null
+From 2504a6423b9ab4c36df78227055995644de19edb Mon Sep 17 00:00:00 2001
+From: Pavel Roskin <proski@gnu.org>
+Date: Sat, 11 Feb 2012 10:01:53 -0500
+Subject: ath9k: stop on rates with idx -1 in ath9k rate control's .tx_status
+
+From: Pavel Roskin <proski@gnu.org>
+
+commit 2504a6423b9ab4c36df78227055995644de19edb upstream.
+
+Rate control algorithms are supposed to stop processing when they
+encounter a rate with the index -1. Checking for rate->count not being
+zero is not enough.
+
+Allowing a rate with negative index leads to memory corruption in
+ath_debug_stat_rc().
+
+One consequence of the bug is discussed at
+https://bugzilla.redhat.com/show_bug.cgi?id=768639
+
+Signed-off-by: Pavel Roskin <proski@gnu.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/rc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/rc.c
++++ b/drivers/net/wireless/ath/ath9k/rc.c
+@@ -1347,7 +1347,7 @@ static void ath_tx_status(void *priv, st
+ fc = hdr->frame_control;
+ for (i = 0; i < sc->hw->max_rates; i++) {
+ struct ieee80211_tx_rate *rate = &tx_info->status.rates[i];
+- if (!rate->count)
++ if (rate->idx < 0 || !rate->count)
+ break;
+
+ final_ts_idx = i;
--- /dev/null
+From 363434b5dc352464ac7601547891e5fc9105f124 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Wed, 22 Feb 2012 08:13:52 -0800
+Subject: hwmon: (ads1015) Fix file leak in probe function
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit 363434b5dc352464ac7601547891e5fc9105f124 upstream.
+
+An error while creating sysfs attribute files in the driver's probe function
+results in an error abort, but already created files are not removed. This patch
+fixes the problem.
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Cc: Dirk Eibach <eibach@gdsys.de>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/ads1015.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/hwmon/ads1015.c
++++ b/drivers/hwmon/ads1015.c
+@@ -271,7 +271,7 @@ static int ads1015_probe(struct i2c_clie
+ continue;
+ err = device_create_file(&client->dev, &ads1015_in[k].dev_attr);
+ if (err)
+- goto exit_free;
++ goto exit_remove;
+ }
+
+ data->hwmon_dev = hwmon_device_register(&client->dev);
+@@ -285,7 +285,6 @@ static int ads1015_probe(struct i2c_clie
+ exit_remove:
+ for (k = 0; k < ADS1015_CHANNELS; ++k)
+ device_remove_file(&client->dev, &ads1015_in[k].dev_attr);
+-exit_free:
+ kfree(data);
+ exit:
+ return err;
--- /dev/null
+From b63d97a36edb1aecf8c13e5f5783feff4d64c24b Mon Sep 17 00:00:00 2001
+From: Chris D Schimp <silverchris@gmail.com>
+Date: Mon, 20 Feb 2012 16:59:24 -0500
+Subject: hwmon: (max6639) Fix FAN_FROM_REG calculation
+
+From: Chris D Schimp <silverchris@gmail.com>
+
+commit b63d97a36edb1aecf8c13e5f5783feff4d64c24b upstream.
+
+RPM calculation from tachometer value does not depend on PPR.
+Also, do not report negative RPM values.
+
+Signed-off-by: Chris D Schimp <silverchris@gmail.com>
+[guenter.roeck@ericsson.com: do not report negative RPM values]
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Roland Stigge <stigge@antcom.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/max6639.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/max6639.c
++++ b/drivers/hwmon/max6639.c
+@@ -72,8 +72,8 @@ static unsigned short normal_i2c[] = { 0
+
+ static const int rpm_ranges[] = { 2000, 4000, 8000, 16000 };
+
+-#define FAN_FROM_REG(val, div, rpm_range) ((val) == 0 ? -1 : \
+- (val) == 255 ? 0 : (rpm_ranges[rpm_range] * 30) / ((div + 1) * (val)))
++#define FAN_FROM_REG(val, rpm_range) ((val) == 0 || (val) == 255 ? \
++ 0 : (rpm_ranges[rpm_range] * 30) / (val))
+ #define TEMP_LIMIT_TO_REG(val) SENSORS_LIMIT((val) / 1000, 0, 255)
+
+ /*
+@@ -333,7 +333,7 @@ static ssize_t show_fan_input(struct dev
+ return PTR_ERR(data);
+
+ return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan[attr->index],
+- data->ppr, data->rpm_range));
++ data->rpm_range));
+ }
+
+ static ssize_t show_alarm(struct device *dev,
--- /dev/null
+From 2f2da1ac0ba5b6cc6e1957c4da5ff20e67d8442b Mon Sep 17 00:00:00 2001
+From: Chris D Schimp <silverchris@gmail.com>
+Date: Mon, 20 Feb 2012 17:44:59 -0500
+Subject: hwmon: (max6639) Fix PPR register initialization to set both channels
+
+From: Chris D Schimp <silverchris@gmail.com>
+
+commit 2f2da1ac0ba5b6cc6e1957c4da5ff20e67d8442b upstream.
+
+Initialize PPR register for both channels, and set correct PPR register bits.
+Also remove unnecessary variable initializations.
+
+Signed-off-by: Chris D Schimp <silverchris@gmail.com>
+[guenter.roeck@ericsson.com: Merged two patches into one]
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Roland Stigge <stigge@antcom.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/max6639.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/hwmon/max6639.c
++++ b/drivers/hwmon/max6639.c
+@@ -429,9 +429,9 @@ static int max6639_init_client(struct i2
+ struct max6639_data *data = i2c_get_clientdata(client);
+ struct max6639_platform_data *max6639_info =
+ client->dev.platform_data;
+- int i = 0;
++ int i;
+ int rpm_range = 1; /* default: 4000 RPM */
+- int err = 0;
++ int err;
+
+ /* Reset chip to default values, see below for GCONFIG setup */
+ err = i2c_smbus_write_byte_data(client, MAX6639_REG_GCONFIG,
+@@ -446,11 +446,6 @@ static int max6639_init_client(struct i2
+ else
+ data->ppr = 2;
+ data->ppr -= 1;
+- err = i2c_smbus_write_byte_data(client,
+- MAX6639_REG_FAN_PPR(i),
+- data->ppr << 5);
+- if (err)
+- goto exit;
+
+ if (max6639_info)
+ rpm_range = rpm_range_to_reg(max6639_info->rpm_range);
+@@ -458,6 +453,13 @@ static int max6639_init_client(struct i2
+
+ for (i = 0; i < 2; i++) {
+
++ /* Set Fan pulse per revolution */
++ err = i2c_smbus_write_byte_data(client,
++ MAX6639_REG_FAN_PPR(i),
++ data->ppr << 6);
++ if (err)
++ goto exit;
++
+ /* Fans config PWM, RPM */
+ err = i2c_smbus_write_byte_data(client,
+ MAX6639_REG_FAN_CONFIG1(i),
--- /dev/null
+From 918e556ec214ed2f584e4cac56d7b29e4bb6bf27 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 23 Feb 2012 13:50:35 +0000
+Subject: NOMMU: Lock i_mmap_mutex for access to the VMA prio list
+
+From: David Howells <dhowells@redhat.com>
+
+commit 918e556ec214ed2f584e4cac56d7b29e4bb6bf27 upstream.
+
+Lock i_mmap_mutex for access to the VMA prio list to prevent concurrent
+access. Currently, certain parts of the mmap handling are protected by
+the region mutex, but not all.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/nommu.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -696,9 +696,11 @@ static void add_vma_to_mm(struct mm_stru
+ if (vma->vm_file) {
+ mapping = vma->vm_file->f_mapping;
+
++ mutex_lock(&mapping->i_mmap_mutex);
+ flush_dcache_mmap_lock(mapping);
+ vma_prio_tree_insert(vma, &mapping->i_mmap);
+ flush_dcache_mmap_unlock(mapping);
++ mutex_unlock(&mapping->i_mmap_mutex);
+ }
+
+ /* add the VMA to the tree */
+@@ -760,9 +762,11 @@ static void delete_vma_from_mm(struct vm
+ if (vma->vm_file) {
+ mapping = vma->vm_file->f_mapping;
+
++ mutex_lock(&mapping->i_mmap_mutex);
+ flush_dcache_mmap_lock(mapping);
+ vma_prio_tree_remove(vma, &mapping->i_mmap);
+ flush_dcache_mmap_unlock(mapping);
++ mutex_unlock(&mapping->i_mmap_mutex);
+ }
+
+ /* remove from the MM's tree and list */
+@@ -2052,6 +2056,7 @@ int nommu_shrink_inode_mappings(struct i
+ high = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+ down_write(&nommu_region_sem);
++ mutex_lock(&inode->i_mapping->i_mmap_mutex);
+
+ /* search for VMAs that fall within the dead zone */
+ vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap,
+@@ -2059,6 +2064,7 @@ int nommu_shrink_inode_mappings(struct i
+ /* found one - only interested if it's shared out of the page
+ * cache */
+ if (vma->vm_flags & VM_SHARED) {
++ mutex_unlock(&inode->i_mapping->i_mmap_mutex);
+ up_write(&nommu_region_sem);
+ return -ETXTBSY; /* not quite true, but near enough */
+ }
+@@ -2086,6 +2092,7 @@ int nommu_shrink_inode_mappings(struct i
+ }
+ }
+
++ mutex_unlock(&inode->i_mapping->i_mmap_mutex);
+ up_write(&nommu_region_sem);
+ return 0;
+ }
usb-set-hub-depth-after-usb3-hub-reset.patch
usb-storage-fix-freezing-of-the-scanning-thread.patch
target-allow-control-cdbs-with-data-1-page.patch
+asoc-wm8962-fix-sidetone-enumeration-texts.patch
+alsa-hda-realtek-fix-overflow-of-vol-sw-check-bitmap.patch
+alsa-hda-realtek-fix-surround-output-regression-on-acer-aspire-5935.patch
+nommu-lock-i_mmap_mutex-for-access-to-the-vma-prio-list.patch
+hwmon-max6639-fix-fan_from_reg-calculation.patch
+hwmon-max6639-fix-ppr-register-initialization-to-set-both-channels.patch
+hwmon-ads1015-fix-file-leak-in-probe-function.patch
+arm-omap-fix-oops-in-drivers-video-omap2-dss-dpi.c.patch
+arm-omap-fix-oops-in-arch-arm-mach-omap2-vp.c-when-pmic-is-not-found.patch
+x86-amd-fix-l1i-and-l2-cache-sharing-information-for-amd-family-15h-processors.patch
+ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch
+x86-nmi-test-saved-cs-in-nmi-to-determine-nested-nmi-case.patch
--- /dev/null
+From 32c3233885eb10ac9cb9410f2f8cd64b8df2b2a1 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Wed, 8 Feb 2012 20:52:29 +0100
+Subject: x86/amd: Fix L1i and L2 cache sharing information for AMD family 15h processors
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit 32c3233885eb10ac9cb9410f2f8cd64b8df2b2a1 upstream.
+
+For L1 instruction cache and L2 cache the shared CPU information
+is wrong. On current AMD family 15h CPUs those caches are shared
+between both cores of a compute unit.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=42607
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Cc: Petkov Borislav <Borislav.Petkov@amd.com>
+Cc: Dave Jones <davej@redhat.com>
+Link: http://lkml.kernel.org/r/20120208195229.GA17523@alberich.amd.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 44 +++++++++++++++++++++++++++-------
+ 1 file changed, 36 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -326,8 +326,7 @@ static void __cpuinit amd_calc_l3_indice
+ l3->indices = (max(max3(sc0, sc1, sc2), sc3) << 10) - 1;
+ }
+
+-static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf,
+- int index)
++static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf, int index)
+ {
+ int node;
+
+@@ -725,14 +724,16 @@ static DEFINE_PER_CPU(struct _cpuid4_inf
+ #define CPUID4_INFO_IDX(x, y) (&((per_cpu(ici_cpuid4_info, x))[y]))
+
+ #ifdef CONFIG_SMP
+-static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
++
++static int __cpuinit cache_shared_amd_cpu_map_setup(unsigned int cpu, int index)
+ {
+- struct _cpuid4_info *this_leaf, *sibling_leaf;
+- unsigned long num_threads_sharing;
+- int index_msb, i, sibling;
++ struct _cpuid4_info *this_leaf;
++ int ret, i, sibling;
+ struct cpuinfo_x86 *c = &cpu_data(cpu);
+
+- if ((index == 3) && (c->x86_vendor == X86_VENDOR_AMD)) {
++ ret = 0;
++ if (index == 3) {
++ ret = 1;
+ for_each_cpu(i, cpu_llc_shared_mask(cpu)) {
+ if (!per_cpu(ici_cpuid4_info, i))
+ continue;
+@@ -743,8 +744,35 @@ static void __cpuinit cache_shared_cpu_m
+ set_bit(sibling, this_leaf->shared_cpu_map);
+ }
+ }
+- return;
++ } else if ((c->x86 == 0x15) && ((index == 1) || (index == 2))) {
++ ret = 1;
++ for_each_cpu(i, cpu_sibling_mask(cpu)) {
++ if (!per_cpu(ici_cpuid4_info, i))
++ continue;
++ this_leaf = CPUID4_INFO_IDX(i, index);
++ for_each_cpu(sibling, cpu_sibling_mask(cpu)) {
++ if (!cpu_online(sibling))
++ continue;
++ set_bit(sibling, this_leaf->shared_cpu_map);
++ }
++ }
+ }
++
++ return ret;
++}
++
++static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
++{
++ struct _cpuid4_info *this_leaf, *sibling_leaf;
++ unsigned long num_threads_sharing;
++ int index_msb, i;
++ struct cpuinfo_x86 *c = &cpu_data(cpu);
++
++ if (c->x86_vendor == X86_VENDOR_AMD) {
++ if (cache_shared_amd_cpu_map_setup(cpu, index))
++ return;
++ }
++
+ this_leaf = CPUID4_INFO_IDX(cpu, index);
+ num_threads_sharing = 1 + this_leaf->base.eax.split.num_threads_sharing;
+
--- /dev/null
+From 45d5a1683c04be28abdf5c04c27b1417e0374486 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <rostedt@goodmis.org>
+Date: Sun, 19 Feb 2012 16:43:37 -0500
+Subject: x86/nmi: Test saved %cs in NMI to determine nested NMI case
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+commit 45d5a1683c04be28abdf5c04c27b1417e0374486 upstream.
+
+Currently, the NMI handler tests if it is nested by checking the
+special variable saved on the stack (set during NMI handling)
+and whether the saved stack is the NMI stack as well (to prevent
+the race when the variable is set to zero).
+
+But userspace may set their %rsp to any value as long as they do
+not derefence it, and it may make it point to the NMI stack,
+which will prevent NMIs from triggering while the userspace app
+is running. (I tested this, and it is indeed the case)
+
+Add another check to determine nested NMIs by looking at the
+saved %cs (code segment register) and making sure that it is the
+kernel code segment.
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: http://lkml.kernel.org/r/1329687817.1561.27.camel@acer.local.home
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index 3fe8239..debd851 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -1532,6 +1532,13 @@ ENTRY(nmi)
+ pushq_cfi %rdx
+
+ /*
++ * If %cs was not the kernel segment, then the NMI triggered in user
++ * space, which means it is definitely not nested.
++ */
++ cmp $__KERNEL_CS, 16(%rsp)
++ jne first_nmi
++
++ /*
+ * Check the special variable on the stack to see if NMIs are
+ * executing.
+ */
projects / thirdparty / kernel / stable-queue.git / commitdiff
