--- /dev/null
+From 78e2a928e377d5124932d4399c6c581908b027a0 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 2 Jan 2012 12:40:16 +0100
+Subject: ALSA: HDA: Fix automute for Cirrus Logic 421x
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 78e2a928e377d5124932d4399c6c581908b027a0 upstream.
+
+There was a bug in the automute logic causing speakers not to
+mute when headphones were plugged in.
+
+Tested-by: Hsin-Yi Chen <hychen@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_cirrus.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -920,16 +920,14 @@ static void cs_automute(struct hda_codec
+
+ /* mute speakers if spdif or hp jack is plugged in */
+ for (i = 0; i < cfg->speaker_outs; i++) {
++ int pin_ctl = hp_present ? 0 : PIN_OUT;
++ /* detect on spdif is specific to CS421x */
++ if (spdif_present && (spec->vendor_nid == CS421X_VENDOR_NID))
++ pin_ctl = 0;
++
+ nid = cfg->speaker_pins[i];
+ snd_hda_codec_write(codec, nid, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL,
+- hp_present ? 0 : PIN_OUT);
+- /* detect on spdif is specific to CS421x */
+- if (spec->vendor_nid == CS421X_VENDOR_NID) {
+- snd_hda_codec_write(codec, nid, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL,
+- spdif_present ? 0 : PIN_OUT);
+- }
++ AC_VERB_SET_PIN_WIDGET_CONTROL, pin_ctl);
+ }
+ if (spec->gpio_eapd_hp) {
+ unsigned int gpio = hp_present ?
--- /dev/null
+From 40d03e63e91af8ddccdfd5a536cc2a6e51433e1d Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 2 Jan 2012 12:40:15 +0100
+Subject: ALSA: HDA: Fix master control for Cirrus Logic 421X
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 40d03e63e91af8ddccdfd5a536cc2a6e51433e1d upstream.
+
+The control name "HP/Speakers" is non-standard, and since there is
+only one DAC on this chip there is no need for a virtual master
+anyway.
+
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_cirrus.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -1771,30 +1771,19 @@ static int build_cs421x_output(struct hd
+ struct auto_pin_cfg *cfg = &spec->autocfg;
+ struct snd_kcontrol *kctl;
+ int err;
+- char *name = "HP/Speakers";
++ char *name = "Master";
+
+ fix_volume_caps(codec, dac);
+- if (!spec->vmaster_sw) {
+- err = add_vmaster(codec, dac);
+- if (err < 0)
+- return err;
+- }
+
+ err = add_mute(codec, name, 0,
+ HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl);
+ if (err < 0)
+ return err;
+- err = snd_ctl_add_slave(spec->vmaster_sw, kctl);
+- if (err < 0)
+- return err;
+
+ err = add_volume(codec, name, 0,
+ HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl);
+ if (err < 0)
+ return err;
+- err = snd_ctl_add_slave(spec->vmaster_vol, kctl);
+- if (err < 0)
+- return err;
+
+ if (cfg->speaker_outs) {
+ err = snd_hda_ctl_add(codec, 0,
--- /dev/null
+From 4808d12d1dddb046ec86425e5f6766f02e950292 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 15:16:02 +0100
+Subject: ALSA: hda - Fix the detection of "Loopback Mixing" control for VIA codecs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4808d12d1dddb046ec86425e5f6766f02e950292 upstream.
+
+Currently the driver checks only the out_mix_path[] for the primary
+output route for judging whether to create the loopback-mixing control
+or not. But, there are cases where aamix-routing is available only on
+headphone or speaker paths but not on the primary output path. So, the
+driver ignores such cases inappropriately.
+
+This patch fixes the check of the loopback-mixing control by testing
+all mix-routing paths.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_via.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -2200,7 +2200,10 @@ static int via_auto_create_loopback_swit
+ {
+ struct via_spec *spec = codec->spec;
+
+- if (!spec->aa_mix_nid || !spec->out_mix_path.depth)
++ if (!spec->aa_mix_nid)
++ return 0; /* no loopback switching available */
++ if (!(spec->out_mix_path.depth || spec->hp_mix_path.depth ||
++ spec->speaker_path.depth))
+ return 0; /* no loopback switching available */
+ if (!via_clone_control(spec, &via_aamix_ctl_enum))
+ return -ENOMEM;
--- /dev/null
+From f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 11 Jan 2012 12:34:11 +0100
+Subject: ALSA: hda - Fix the lost power-setup of seconary pins after PM resume
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33 upstream.
+
+When multiple headphone or other detectable output pins are present,
+the power-map has to be updated after resume appropriately, but the
+current driver doesn't check all pins but only the first pin (since
+it's enough to check it for the mute-behavior). This resulted in the
+silent output from the secondary outputs after PM resume.
+
+This patch fixes the problem by checking all pins at (re-)init time.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740347
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 36 +++++++++++++++++++++++-------------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4326,6 +4326,27 @@ static void stac_store_hints(struct hda_
+ }
+ }
+
++static void stac_issue_unsol_events(struct hda_codec *codec, int num_pins,
++ const hda_nid_t *pins)
++{
++ while (num_pins--)
++ stac_issue_unsol_event(codec, *pins++);
++}
++
++/* fake event to set up pins */
++static void stac_fake_hp_events(struct hda_codec *codec)
++{
++ struct sigmatel_spec *spec = codec->spec;
++
++ if (spec->autocfg.hp_outs)
++ stac_issue_unsol_events(codec, spec->autocfg.hp_outs,
++ spec->autocfg.hp_pins);
++ if (spec->autocfg.line_outs &&
++ spec->autocfg.line_out_pins[0] != spec->autocfg.hp_pins[0])
++ stac_issue_unsol_events(codec, spec->autocfg.line_outs,
++ spec->autocfg.line_out_pins);
++}
++
+ static int stac92xx_init(struct hda_codec *codec)
+ {
+ struct sigmatel_spec *spec = codec->spec;
+@@ -4376,10 +4397,7 @@ static int stac92xx_init(struct hda_code
+ stac92xx_auto_set_pinctl(codec, spec->autocfg.line_out_pins[0],
+ AC_PINCTL_OUT_EN);
+ /* fake event to set up pins */
+- if (cfg->hp_pins[0])
+- stac_issue_unsol_event(codec, cfg->hp_pins[0]);
+- else if (cfg->line_out_pins[0])
+- stac_issue_unsol_event(codec, cfg->line_out_pins[0]);
++ stac_fake_hp_events(codec);
+ } else {
+ stac92xx_auto_init_multi_out(codec);
+ stac92xx_auto_init_hp_out(codec);
+@@ -5028,19 +5046,11 @@ static void stac927x_proc_hook(struct sn
+ #ifdef CONFIG_PM
+ static int stac92xx_resume(struct hda_codec *codec)
+ {
+- struct sigmatel_spec *spec = codec->spec;
+-
+ stac92xx_init(codec);
+ snd_hda_codec_resume_amp(codec);
+ snd_hda_codec_resume_cache(codec);
+ /* fake event to set up pins again to override cached values */
+- if (spec->hp_detect) {
+- if (spec->autocfg.hp_pins[0])
+- stac_issue_unsol_event(codec, spec->autocfg.hp_pins[0]);
+- else if (spec->autocfg.line_out_pins[0])
+- stac_issue_unsol_event(codec,
+- spec->autocfg.line_out_pins[0]);
+- }
++ stac_fake_hp_events(codec);
+ return 0;
+ }
+
--- /dev/null
+From 3a90274de3548ebb2aabfbf488cea8e275a73dc6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 12:41:22 +0100
+Subject: ALSA: hda - Return the error from get_wcaps_type() for invalid NIDs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 3a90274de3548ebb2aabfbf488cea8e275a73dc6 upstream.
+
+When an invalid NID is given, get_wcaps() returns zero as the error,
+but get_wcaps_type() takes it as the normal value and returns a bogus
+AC_WID_AUD_OUT value. This confuses the parser.
+
+With this patch, get_wcaps_type() returns -1 when value 0 is given,
+i.e. an invalid NID is passed to get_wcaps().
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740118
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_local.h | 7 ++++++-
+ sound/pci/hda/hda_proc.c | 2 ++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -487,7 +487,12 @@ static inline u32 get_wcaps(struct hda_c
+ }
+
+ /* get the widget type from widget capability bits */
+-#define get_wcaps_type(wcaps) (((wcaps) & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT)
++static inline int get_wcaps_type(unsigned int wcaps)
++{
++ if (!wcaps)
++ return -1; /* invalid type */
++ return (wcaps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT;
++}
+
+ static inline unsigned int get_wcaps_channels(u32 wcaps)
+ {
+--- a/sound/pci/hda/hda_proc.c
++++ b/sound/pci/hda/hda_proc.c
+@@ -54,6 +54,8 @@ static const char *get_wid_type_name(uns
+ [AC_WID_BEEP] = "Beep Generator Widget",
+ [AC_WID_VENDOR] = "Vendor Defined Widget",
+ };
++ if (wid_value == -1)
++ return "UNKNOWN Widget";
+ wid_value &= 0xf;
+ if (names[wid_value])
+ return names[wid_value];
--- /dev/null
+From de4da59e480cdf1075b33dbaf8078fc87bc52241 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 08:59:56 +0100
+Subject: ALSA: hda - Use auto-parser for HP laptops with cx20459 codec
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit de4da59e480cdf1075b33dbaf8078fc87bc52241 upstream.
+
+These laptops can work well with the auto-parser and their BIOS setups,
+and in addition, the auto-parser fixes the problem with S3/S4 where
+the unsol event handling is killed after resume due to fallback to the
+single-cmd mode.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740115
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1120,8 +1120,6 @@ static const char * const cxt5045_models
+
+ static const struct snd_pci_quirk cxt5045_cfg_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x30d5, "HP 530", CXT5045_LAPTOP_HP530),
+- SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x3000, "HP DV Series",
+- CXT5045_LAPTOP_HPSENSE),
+ SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba P105", CXT5045_LAPTOP_MICSENSE),
+ SND_PCI_QUIRK(0x152d, 0x0753, "Benq R55E", CXT5045_BENQ),
+ SND_PCI_QUIRK(0x1734, 0x10ad, "Fujitsu Si1520", CXT5045_LAPTOP_MICSENSE),
--- /dev/null
+From e7848163aa2a649d9065f230fadff80dc3519775 Mon Sep 17 00:00:00 2001
+From: Pavel Hofman <pavel.hofman@ivitera.com>
+Date: Thu, 5 Jan 2012 23:05:18 +0100
+Subject: ALSA: ice1724 - Check for ac97 to avoid kernel oops
+
+From: Pavel Hofman <pavel.hofman@ivitera.com>
+
+commit e7848163aa2a649d9065f230fadff80dc3519775 upstream.
+
+Cards with identical PCI ids but no AC97 config in EEPROM do not have
+the ac97 field initialized. We must check for this case to avoid kernel oops.
+
+Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ice1712/amp.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/ice1712/amp.c
++++ b/sound/pci/ice1712/amp.c
+@@ -68,8 +68,11 @@ static int __devinit snd_vt1724_amp_init
+
+ static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice)
+ {
+- /* we use pins 39 and 41 of the VT1616 for left and right read outputs */
+- snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
++ if (ice->ac97)
++ /* we use pins 39 and 41 of the VT1616 for left and right
++ read outputs */
++ snd_ac97_write_cache(ice->ac97, 0x5a,
++ snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
+ return 0;
+ }
+
--- /dev/null
+From d0f3a2eb9062560bebca8b923424f3ca02a331ba Mon Sep 17 00:00:00 2001
+From: Karsten Wiese <fzu@wemgehoertderstaat.de>
+Date: Fri, 30 Dec 2011 01:42:01 +0100
+Subject: ALSA: snd-usb-us122l: Delete calls to preempt_disable
+
+From: Karsten Wiese <fzu@wemgehoertderstaat.de>
+
+commit d0f3a2eb9062560bebca8b923424f3ca02a331ba upstream.
+
+They are not needed here.
+
+Signed-off-by: Karsten Wiese <fzu@wemgehoertderstaat.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usx2y/usb_stream.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/sound/usb/usx2y/usb_stream.c
++++ b/sound/usb/usx2y/usb_stream.c
+@@ -674,7 +674,7 @@ dotry:
+ inurb->transfer_buffer_length =
+ inurb->number_of_packets *
+ inurb->iso_frame_desc[0].length;
+- preempt_disable();
++
+ if (u == 0) {
+ int now;
+ struct usb_device *dev = inurb->dev;
+@@ -686,19 +686,17 @@ dotry:
+ }
+ err = usb_submit_urb(inurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->inurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+ err = usb_submit_urb(outurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->outurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+- preempt_enable();
++
+ if (inurb->start_frame != outurb->start_frame) {
+ snd_printd(KERN_DEBUG
+ "u[%i] start_frames differ in:%u out:%u\n",
--- /dev/null
+From 80c8a2a372599e604b04a9c568952fe39cd1851d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 9 Jan 2012 11:37:20 +0100
+Subject: ALSA: usb-audio - Avoid flood of frame-active debug messages
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 80c8a2a372599e604b04a9c568952fe39cd1851d upstream.
+
+With some buggy devices, the usb-audio driver may give "frame xxx active"
+kernel messages too often. Better to keep it as debug-only using
+snd_printdd(), and also add the rate-limit for avoiding floods.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=738681
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/endpoint.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -17,6 +17,7 @@
+
+ #include <linux/gfp.h>
+ #include <linux/init.h>
++#include <linux/ratelimit.h>
+ #include <linux/usb.h>
+ #include <linux/usb/audio.h>
+
+@@ -458,8 +459,8 @@ static int retire_capture_urb(struct snd
+
+ for (i = 0; i < urb->number_of_packets; i++) {
+ cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset;
+- if (urb->iso_frame_desc[i].status) {
+- snd_printd(KERN_ERR "frame %d active: %d\n", i, urb->iso_frame_desc[i].status);
++ if (urb->iso_frame_desc[i].status && printk_ratelimit()) {
++ snd_printdd("frame %d active: %d\n", i, urb->iso_frame_desc[i].status);
+ // continue;
+ }
+ bytes = urb->iso_frame_desc[i].actual_length;
--- /dev/null
+From e74a8f2edb92cb690b467cea0ab652c509e9f624 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Tue, 10 Jan 2012 15:11:02 -0800
+Subject: drivers/rtc/interface.c: fix alarm rollover when day or month is out-of-range
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit e74a8f2edb92cb690b467cea0ab652c509e9f624 upstream.
+
+Commit f44f7f96a20a ("RTC: Initialize kernel state from RTC") introduced a
+potential infinite loop. If an alarm time contains a wildcard month and
+an invalid day (> 31), or a wildcard year and an invalid month (>= 12),
+the loop searching for the next matching date will never terminate. Treat
+the invalid values as wildcards.
+
+Fixes <http://bugs.debian.org/646429>, <http://bugs.debian.org/653331>
+
+Reported-by: leo weppelman <leoweppelman@googlemail.com>
+Reported-by: "P. van Gaans" <mailme667@yahoo.co.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Cc: Marcelo Roberto Jimenez <mroberto@cpti.cetuc.puc-rio.br>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <john.stultz@linaro.org>
+Acked-by: Alessandro Zummo <a.zummo@towertech.it>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/interface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -228,11 +228,11 @@ int __rtc_read_alarm(struct rtc_device *
+ alarm->time.tm_hour = now.tm_hour;
+
+ /* For simplicity, only support date rollover for now */
+- if (alarm->time.tm_mday == -1) {
++ if (alarm->time.tm_mday < 1 || alarm->time.tm_mday > 31) {
+ alarm->time.tm_mday = now.tm_mday;
+ missing = day;
+ }
+- if (alarm->time.tm_mon == -1) {
++ if ((unsigned)alarm->time.tm_mon >= 12) {
+ alarm->time.tm_mon = now.tm_mon;
+ if (missing == none)
+ missing = month;
--- /dev/null
+From 28eebb703e28bc455ba704adb1026f76649b768c Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 3 Jan 2012 09:48:38 -0500
+Subject: drm/radeon/kms: disable writeback on pre-R300 asics
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 28eebb703e28bc455ba704adb1026f76649b768c upstream.
+
+We often end up missing fences on older asics with
+writeback enabled which leads to delays in the userspace
+accel code, so just disable it by default on those asics.
+
+Reported-by: Helge Deller <deller@gmx.de>
+Reported-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -224,8 +224,11 @@ int radeon_wb_init(struct radeon_device
+ if (radeon_no_wb == 1)
+ rdev->wb.enabled = false;
+ else {
+- /* often unreliable on AGP */
+ if (rdev->flags & RADEON_IS_AGP) {
++ /* often unreliable on AGP */
++ rdev->wb.enabled = false;
++ } else if (rdev->family < CHIP_R300) {
++ /* often unreliable on pre-r300 */
+ rdev->wb.enabled = false;
+ } else {
+ rdev->wb.enabled = true;
--- /dev/null
+From 92db7f6c860b8190571a9dc1fcbc16d003422fe8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Fri, 23 Dec 2011 20:32:18 +0100
+Subject: drm/radeon/kms: workaround invalid AVI infoframe checksum issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <zajec5@gmail.com>
+
+commit 92db7f6c860b8190571a9dc1fcbc16d003422fe8 upstream.
+
+This change was verified to fix both issues with no video I've
+investigated. I've also checked checksum calculation with fglrx on:
+RV620, HD54xx, HD5450, HD6310, HD6320.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/r600_hdmi.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -196,6 +196,13 @@ static void r600_hdmi_videoinfoframe(
+ frame[0xD] = (right_bar >> 8);
+
+ r600_hdmi_infoframe_checksum(0x82, 0x02, 0x0D, frame);
++ /* Our header values (type, version, length) should be alright, Intel
++ * is using the same. Checksum function also seems to be OK, it works
++ * fine for audio infoframe. However calculated value is always lower
++ * by 2 in comparison to fglrx. It breaks displaying anything in case
++ * of TVs that strictly check the checksum. Hack it manually here to
++ * workaround this issue. */
++ frame[0x0] += 2;
+
+ WREG32(offset+R600_HDMI_VIDEOINFOFRAME_0,
+ frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
--- /dev/null
+From 014a1770371a028d22f364718c805f4216911ecd Mon Sep 17 00:00:00 2001
+From: Djalal Harouni <tixxdz@opendz.org>
+Date: Wed, 4 Jan 2012 17:09:52 -0500
+Subject: ext4: add missing ext4_resize_end on error paths
+
+From: Djalal Harouni <tixxdz@opendz.org>
+
+commit 014a1770371a028d22f364718c805f4216911ecd upstream.
+
+Online resize ioctls 'EXT4_IOC_GROUP_EXTEND' and 'EXT4_IOC_GROUP_ADD'
+call ext4_resize_begin() to check permissions and to set the
+EXT4_RESIZING bit lock, they do their work and they must finish with
+ext4_resize_end() which calls clear_bit_unlock() to unlock and to
+avoid -EBUSY errors for the next resize operations.
+
+This patch adds the missing ext4_resize_end() calls on error paths.
+
+Patch tested.
+
+Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext4/ioctl.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -182,19 +182,22 @@ setversion_out:
+ if (err)
+ return err;
+
+- if (get_user(n_blocks_count, (__u32 __user *)arg))
+- return -EFAULT;
++ if (get_user(n_blocks_count, (__u32 __user *)arg)) {
++ err = -EFAULT;
++ goto group_extend_out;
++ }
+
+ if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
+ ext4_msg(sb, KERN_ERR,
+ "Online resizing not supported with bigalloc");
+- return -EOPNOTSUPP;
++ err = -EOPNOTSUPP;
++ goto group_extend_out;
+ }
+
+ err = mnt_want_write(filp->f_path.mnt);
+ if (err)
+- return err;
++ goto group_extend_out;
+
+ err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+ if (EXT4_SB(sb)->s_journal) {
+@@ -204,9 +207,10 @@ setversion_out:
+ }
+ if (err == 0)
+ err = err2;
++
+ mnt_drop_write(filp->f_path.mnt);
++group_extend_out:
+ ext4_resize_end(sb);
+-
+ return err;
+ }
+
+@@ -267,19 +271,22 @@ mext_out:
+ return err;
+
+ if (copy_from_user(&input, (struct ext4_new_group_input __user *)arg,
+- sizeof(input)))
+- return -EFAULT;
++ sizeof(input))) {
++ err = -EFAULT;
++ goto group_add_out;
++ }
+
+ if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
+ ext4_msg(sb, KERN_ERR,
+ "Online resizing not supported with bigalloc");
+- return -EOPNOTSUPP;
++ err = -EOPNOTSUPP;
++ goto group_add_out;
+ }
+
+ err = mnt_want_write(filp->f_path.mnt);
+ if (err)
+- return err;
++ goto group_add_out;
+
+ err = ext4_group_add(sb, &input);
+ if (EXT4_SB(sb)->s_journal) {
+@@ -289,9 +296,10 @@ mext_out:
+ }
+ if (err == 0)
+ err = err2;
++
+ mnt_drop_write(filp->f_path.mnt);
++group_add_out:
+ ext4_resize_end(sb);
+-
+ return err;
+ }
+
--- /dev/null
+From d50f2ab6f050311dbf7b8f5501b25f0bf64a439b Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang@gmail.com>
+Date: Tue, 10 Jan 2012 11:51:10 -0500
+Subject: ext4: fix undefined behavior in ext4_fill_flex_info()
+
+From: Xi Wang <xi.wang@gmail.com>
+
+commit d50f2ab6f050311dbf7b8f5501b25f0bf64a439b upstream.
+
+Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by
+zero when trying to mount a corrupted file system") fixes CVE-2009-4307
+by performing a sanity check on s_log_groups_per_flex, since it can be
+set to a bogus value by an attacker.
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ if (groups_per_flex < 2) { ... }
+
+This patch fixes two potential issues in the previous commit.
+
+1) The sanity check might only work on architectures like PowerPC.
+On x86, 5 bits are used for the shifting amount. That means, given a
+large s_log_groups_per_flex value like 36, groups_per_flex = 1 << 36
+is essentially 1 << 4 = 16, rather than 0. This will bypass the check,
+leaving s_log_groups_per_flex and groups_per_flex inconsistent.
+
+2) The sanity check relies on undefined behavior, i.e., oversized shift.
+A standard-confirming C compiler could rewrite the check in unexpected
+ways. Consider the following equivalent form, assuming groups_per_flex
+is unsigned for simplicity.
+
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+ if (groups_per_flex == 0 || groups_per_flex == 1) {
+
+We compile the code snippet using Clang 3.0 and GCC 4.6. Clang will
+completely optimize away the check groups_per_flex == 0, leaving the
+patched code as vulnerable as the original. GCC keeps the check, but
+there is no guarantee that future versions will do the same.
+
+Signed-off-by: Xi Wang <xi.wang@gmail.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext4/super.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2006,17 +2006,16 @@ static int ext4_fill_flex_info(struct su
+ struct ext4_group_desc *gdp = NULL;
+ ext4_group_t flex_group_count;
+ ext4_group_t flex_group;
+- int groups_per_flex = 0;
++ unsigned int groups_per_flex = 0;
+ size_t size;
+ int i;
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+- groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+-
+- if (groups_per_flex < 2) {
++ if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) {
+ sbi->s_log_groups_per_flex = 0;
+ return 1;
+ }
++ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ /* We allocate both existing and potentially added groups */
+ flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
--- /dev/null
+From 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Mon, 7 Nov 2011 15:51:05 -0800
+Subject: mtd: mtd_blkdevs: don't increase 'open' count on error path
+
+From: Brian Norris <computersforpeace@gmail.com>
+
+commit 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 upstream.
+
+Some error paths in mtd_blkdevs were fixed in the following commit:
+
+ commit 94735ec4044a6d318b83ad3c5794e931ed168d10
+ mtd: mtd_blkdevs: fix error path in blktrans_open
+
+But on these error paths, the block device's `dev->open' count is
+already incremented before we check for errors. This meant that, while
+the error path was handled correctly on the first time through
+blktrans_open(), the device is erroneously considered already open on
+the second time through.
+
+This problem can be seen, for instance, when a UBI volume is
+simultaneously mounted as a UBIFS partition and read through its
+corresponding gluebi mtdblockX device. This results in blktrans_open()
+passing its error checks (with `dev->open > 0') without actually having
+a handle on the device. Here's a summarized log of the actions and
+results with nandsim:
+
+ # modprobe nandsim
+ # modprobe mtdblock
+ # modprobe gluebi
+ # modprobe ubifs
+ # ubiattach /dev/ubi_ctrl -m 0
+ ...
+ # ubimkvol /dev/ubi0 -N test -s 16MiB
+ ...
+ # mount -t ubifs ubi0:test /mnt
+ # ls /dev/mtdblock*
+ /dev/mtdblock0 /dev/mtdblock1
+ # cat /dev/mtdblock1 > /dev/null
+ cat: can't open '/dev/mtdblock4': Device or resource busy
+ # cat /dev/mtdblock1 > /dev/null
+
+ CPU 0 Unable to handle kernel paging request at virtual address
+ fffffff0, epc == 8031536c, ra == 8031f280
+ Oops[#1]:
+ ...
+ Call Trace:
+ [<8031536c>] ubi_leb_read+0x14/0x164
+ [<8031f280>] gluebi_read+0xf0/0x148
+ [<802edba8>] mtdblock_readsect+0x64/0x198
+ [<802ecfe4>] mtd_blktrans_thread+0x330/0x3f4
+ [<8005be98>] kthread+0x88/0x90
+ [<8000bc04>] kernel_thread_helper+0x10/0x18
+
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtd_blkdevs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -215,7 +215,7 @@ static int blktrans_open(struct block_de
+
+ mutex_lock(&dev->lock);
+
+- if (dev->open++)
++ if (dev->open)
+ goto unlock;
+
+ kref_get(&dev->ref);
+@@ -235,6 +235,7 @@ static int blktrans_open(struct block_de
+ goto error_release;
+
+ unlock:
++ dev->open++;
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
--- /dev/null
+From 3538c56329936c78f7d356889908790006d0124c Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Date: Fri, 2 Dec 2011 15:07:17 +0200
+Subject: mtd: mtdoops: skip reading initially bad blocks
+
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+
+commit 3538c56329936c78f7d356889908790006d0124c upstream.
+
+Use block_isbad to check and skip the bad blocks reading.
+This will allow to get rid of the read errors if bad blocks
+are present initially.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtdoops.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -253,6 +253,9 @@ static void find_next_position(struct mt
+ size_t retlen;
+
+ for (page = 0; page < cxt->oops_pages; page++) {
++ if (mtd->block_isbad &&
++ mtd->block_isbad(mtd, page * record_size))
++ continue;
+ /* Assume the page is used */
+ mark_page_used(cxt, page);
+ ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE,
--- /dev/null
+From 2f4478ccff7df845dc9c0f8996a96373122c4417 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Tue, 29 Nov 2011 15:34:08 +0100
+Subject: mtd: tests: stresstest: bail out if device has not enough eraseblocks
+
+From: Wolfram Sang <w.sang@pengutronix.de>
+
+commit 2f4478ccff7df845dc9c0f8996a96373122c4417 upstream.
+
+stresstest needs at least two eraseblocks. Bail out gracefully if that
+condition is not met. Fixes the following 'division by zero' OOPS:
+
+[ 619.100000] mtd_stresstest: MTD device size 131072, eraseblock size 131072, page size 2048, count of eraseblocks 1, pages per eraseblock 64, OOB size 64
+[ 619.120000] mtd_stresstest: scanning for bad eraseblocks
+[ 619.120000] mtd_stresstest: scanned 1 eraseblocks, 0 are bad
+[ 619.130000] mtd_stresstest: doing operations
+[ 619.130000] mtd_stresstest: 0 operations done
+[ 619.140000] Division by zero in kernel.
+...
+
+caused by
+
+ /* Read or write up 2 eraseblocks at a time - hence 'ebcnt - 1' */
+ eb %= (ebcnt - 1);
+
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/tests/mtd_stresstest.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mtd/tests/mtd_stresstest.c
++++ b/drivers/mtd/tests/mtd_stresstest.c
+@@ -284,6 +284,12 @@ static int __init mtd_stresstest_init(vo
+ (unsigned long long)mtd->size, mtd->erasesize,
+ pgsize, ebcnt, pgcnt, mtd->oobsize);
+
++ if (ebcnt < 2) {
++ printk(PRINT_PREF "error: need at least 2 eraseblocks\n");
++ err = -ENOSPC;
++ goto out_put_mtd;
++ }
++
+ /* Read or write up 2 eraseblocks at a time */
+ bufsize = mtd->erasesize * 2;
+
+@@ -322,6 +328,7 @@ out:
+ kfree(bbt);
+ vfree(writebuf);
+ vfree(readbuf);
++out_put_mtd:
+ put_mtd_device(mtd);
+ if (err)
+ printk(PRINT_PREF "error %d occurred\n", err);
--- /dev/null
+From 556f063580db2953a7e53cd46b47724246320f60 Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Date: Tue, 29 Nov 2011 12:49:18 +0200
+Subject: mtdoops: fix the oops_page_used array size
+
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+
+commit 556f063580db2953a7e53cd46b47724246320f60 upstream.
+
+The array of unsigned long pointed by oops_page_used is allocated
+by vmalloc which requires the size to be in bytes.
+
+BITS_PER_LONG is equal to 32.
+If we want to allocate memory for 32 pages with one bit per page then
+32 / BITS_PER_LONG is equal to 1 byte that is 8 bits.
+To fix it we need to multiply the result by sizeof(unsigned long) equal to 4.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtdoops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -369,7 +369,7 @@ static void mtdoops_notify_add(struct mt
+
+ /* oops_page_used is a bit field */
+ cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
+- BITS_PER_LONG));
++ BITS_PER_LONG) * sizeof(unsigned long));
+ if (!cxt->oops_page_used) {
+ printk(KERN_ERR "mtdoops: could not allocate page array\n");
+ return;
--- /dev/null
+From 3df96909b75835d487a9178761622b0cbd7310d4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Thu, 5 Jan 2012 18:42:17 +0100
+Subject: radeon: Fix disabling PCI bus mastering on big endian hosts.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <michel.daenzer@amd.com>
+
+commit 3df96909b75835d487a9178761622b0cbd7310d4 upstream.
+
+It would previously write basically random bits to PCI configuration space...
+Not very surprising that the GPU tended to stop responding completely. The
+resulting MCE even froze the whole machine sometimes.
+
+Now resetting the GPU after a lockup has at least a fighting chance of
+succeeding.
+
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/r100.c | 5 +++--
+ drivers/gpu/drm/radeon/rs600.c | 4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -2177,6 +2177,7 @@ bool r100_gpu_is_lockup(struct radeon_de
+ void r100_bm_disable(struct radeon_device *rdev)
+ {
+ u32 tmp;
++ u16 tmp16;
+
+ /* disable bus mastering */
+ tmp = RREG32(R_000030_BUS_CNTL);
+@@ -2187,8 +2188,8 @@ void r100_bm_disable(struct radeon_devic
+ WREG32(R_000030_BUS_CNTL, (tmp & 0xFFFFFFFF) | 0x00000040);
+ tmp = RREG32(RADEON_BUS_CNTL);
+ mdelay(1);
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
+- pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp16);
++ pci_write_config_word(rdev->pdev, 0x4, tmp16 & 0xFFFB);
+ mdelay(1);
+ }
+
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -324,10 +324,10 @@ void rs600_hpd_fini(struct radeon_device
+
+ void rs600_bm_disable(struct radeon_device *rdev)
+ {
+- u32 tmp;
++ u16 tmp;
+
+ /* disable bus mastering */
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp);
+ pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
+ mdelay(1);
+ }
--- /dev/null
+mtdoops-fix-the-oops_page_used-array-size.patch
+mtd-mtdoops-skip-reading-initially-bad-blocks.patch
+mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch
+mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch
+drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch
+ext4-add-missing-ext4_resize_end-on-error-paths.patch
+ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch
+alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch
+alsa-hda-fix-master-control-for-cirrus-logic-421x.patch
+alsa-hda-fix-automute-for-cirrus-logic-421x.patch
+alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch
+alsa-usb-audio-avoid-flood-of-frame-active-debug-messages.patch
+alsa-hda-use-auto-parser-for-hp-laptops-with-cx20459-codec.patch
+alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch
+alsa-hda-fix-the-detection-of-loopback-mixing-control-for-via-codecs.patch
+alsa-hda-fix-the-lost-power-setup-of-seconary-pins-after-pm-resume.patch
+drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch
+drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch
+radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch