--- /dev/null
+From 78e2a928e377d5124932d4399c6c581908b027a0 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 2 Jan 2012 12:40:16 +0100
+Subject: ALSA: HDA: Fix automute for Cirrus Logic 421x
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 78e2a928e377d5124932d4399c6c581908b027a0 upstream.
+
+There was a bug in the automute logic causing speakers not to
+mute when headphones were plugged in.
+
+Tested-by: Hsin-Yi Chen <hychen@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_cirrus.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -916,16 +916,14 @@ static void cs_automute(struct hda_codec
+
+ /* mute speakers if spdif or hp jack is plugged in */
+ for (i = 0; i < cfg->speaker_outs; i++) {
++ int pin_ctl = hp_present ? 0 : PIN_OUT;
++ /* detect on spdif is specific to CS421x */
++ if (spdif_present && (spec->vendor_nid == CS421X_VENDOR_NID))
++ pin_ctl = 0;
++
+ nid = cfg->speaker_pins[i];
+ snd_hda_codec_write(codec, nid, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL,
+- hp_present ? 0 : PIN_OUT);
+- /* detect on spdif is specific to CS421x */
+- if (spec->vendor_nid == CS421X_VENDOR_NID) {
+- snd_hda_codec_write(codec, nid, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL,
+- spdif_present ? 0 : PIN_OUT);
+- }
++ AC_VERB_SET_PIN_WIDGET_CONTROL, pin_ctl);
+ }
+ if (spec->board_config == CS420X_MBP53 ||
+ spec->board_config == CS420X_MBP55 ||
--- /dev/null
+From 40d03e63e91af8ddccdfd5a536cc2a6e51433e1d Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 2 Jan 2012 12:40:15 +0100
+Subject: ALSA: HDA: Fix master control for Cirrus Logic 421X
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 40d03e63e91af8ddccdfd5a536cc2a6e51433e1d upstream.
+
+The control name "HP/Speakers" is non-standard, and since there is
+only one DAC on this chip there is no need for a virtual master
+anyway.
+
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_cirrus.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -1756,30 +1756,19 @@ static int build_cs421x_output(struct hd
+ struct auto_pin_cfg *cfg = &spec->autocfg;
+ struct snd_kcontrol *kctl;
+ int err;
+- char *name = "HP/Speakers";
++ char *name = "Master";
+
+ fix_volume_caps(codec, dac);
+- if (!spec->vmaster_sw) {
+- err = add_vmaster(codec, dac);
+- if (err < 0)
+- return err;
+- }
+
+ err = add_mute(codec, name, 0,
+ HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl);
+ if (err < 0)
+ return err;
+- err = snd_ctl_add_slave(spec->vmaster_sw, kctl);
+- if (err < 0)
+- return err;
+
+ err = add_volume(codec, name, 0,
+ HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl);
+ if (err < 0)
+ return err;
+- err = snd_ctl_add_slave(spec->vmaster_vol, kctl);
+- if (err < 0)
+- return err;
+
+ if (cfg->speaker_outs) {
+ err = snd_hda_ctl_add(codec, 0,
--- /dev/null
+From 4808d12d1dddb046ec86425e5f6766f02e950292 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 15:16:02 +0100
+Subject: ALSA: hda - Fix the detection of "Loopback Mixing" control for VIA codecs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4808d12d1dddb046ec86425e5f6766f02e950292 upstream.
+
+Currently the driver checks only the out_mix_path[] for the primary
+output route for judging whether to create the loopback-mixing control
+or not. But, there are cases where aamix-routing is available only on
+headphone or speaker paths but not on the primary output path. So, the
+driver ignores such cases inappropriately.
+
+This patch fixes the check of the loopback-mixing control by testing
+all mix-routing paths.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_via.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -2187,7 +2187,10 @@ static int via_auto_create_loopback_swit
+ {
+ struct via_spec *spec = codec->spec;
+
+- if (!spec->aa_mix_nid || !spec->out_mix_path.depth)
++ if (!spec->aa_mix_nid)
++ return 0; /* no loopback switching available */
++ if (!(spec->out_mix_path.depth || spec->hp_mix_path.depth ||
++ spec->speaker_path.depth))
+ return 0; /* no loopback switching available */
+ if (!via_clone_control(spec, &via_aamix_ctl_enum))
+ return -ENOMEM;
--- /dev/null
+From f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 11 Jan 2012 12:34:11 +0100
+Subject: ALSA: hda - Fix the lost power-setup of seconary pins after PM resume
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33 upstream.
+
+When multiple headphone or other detectable output pins are present,
+the power-map has to be updated after resume appropriately, but the
+current driver doesn't check all pins but only the first pin (since
+it's enough to check it for the mute-behavior). This resulted in the
+silent output from the secondary outputs after PM resume.
+
+This patch fixes the problem by checking all pins at (re-)init time.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740347
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 36 +++++++++++++++++++++++-------------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4306,6 +4306,27 @@ static void stac_store_hints(struct hda_
+ }
+ }
+
++static void stac_issue_unsol_events(struct hda_codec *codec, int num_pins,
++ const hda_nid_t *pins)
++{
++ while (num_pins--)
++ stac_issue_unsol_event(codec, *pins++);
++}
++
++/* fake event to set up pins */
++static void stac_fake_hp_events(struct hda_codec *codec)
++{
++ struct sigmatel_spec *spec = codec->spec;
++
++ if (spec->autocfg.hp_outs)
++ stac_issue_unsol_events(codec, spec->autocfg.hp_outs,
++ spec->autocfg.hp_pins);
++ if (spec->autocfg.line_outs &&
++ spec->autocfg.line_out_pins[0] != spec->autocfg.hp_pins[0])
++ stac_issue_unsol_events(codec, spec->autocfg.line_outs,
++ spec->autocfg.line_out_pins);
++}
++
+ static int stac92xx_init(struct hda_codec *codec)
+ {
+ struct sigmatel_spec *spec = codec->spec;
+@@ -4356,10 +4377,7 @@ static int stac92xx_init(struct hda_code
+ stac92xx_auto_set_pinctl(codec, spec->autocfg.line_out_pins[0],
+ AC_PINCTL_OUT_EN);
+ /* fake event to set up pins */
+- if (cfg->hp_pins[0])
+- stac_issue_unsol_event(codec, cfg->hp_pins[0]);
+- else if (cfg->line_out_pins[0])
+- stac_issue_unsol_event(codec, cfg->line_out_pins[0]);
++ stac_fake_hp_events(codec);
+ } else {
+ stac92xx_auto_init_multi_out(codec);
+ stac92xx_auto_init_hp_out(codec);
+@@ -5000,19 +5018,11 @@ static void stac927x_proc_hook(struct sn
+ #ifdef CONFIG_PM
+ static int stac92xx_resume(struct hda_codec *codec)
+ {
+- struct sigmatel_spec *spec = codec->spec;
+-
+ stac92xx_init(codec);
+ snd_hda_codec_resume_amp(codec);
+ snd_hda_codec_resume_cache(codec);
+ /* fake event to set up pins again to override cached values */
+- if (spec->hp_detect) {
+- if (spec->autocfg.hp_pins[0])
+- stac_issue_unsol_event(codec, spec->autocfg.hp_pins[0]);
+- else if (spec->autocfg.line_out_pins[0])
+- stac_issue_unsol_event(codec,
+- spec->autocfg.line_out_pins[0]);
+- }
++ stac_fake_hp_events(codec);
+ return 0;
+ }
+
--- /dev/null
+From 3a90274de3548ebb2aabfbf488cea8e275a73dc6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 12:41:22 +0100
+Subject: ALSA: hda - Return the error from get_wcaps_type() for invalid NIDs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 3a90274de3548ebb2aabfbf488cea8e275a73dc6 upstream.
+
+When an invalid NID is given, get_wcaps() returns zero as the error,
+but get_wcaps_type() takes it as the normal value and returns a bogus
+AC_WID_AUD_OUT value. This confuses the parser.
+
+With this patch, get_wcaps_type() returns -1 when value 0 is given,
+i.e. an invalid NID is passed to get_wcaps().
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740118
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_local.h | 7 ++++++-
+ sound/pci/hda/hda_proc.c | 2 ++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -476,7 +476,12 @@ static inline u32 get_wcaps(struct hda_c
+ }
+
+ /* get the widget type from widget capability bits */
+-#define get_wcaps_type(wcaps) (((wcaps) & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT)
++static inline int get_wcaps_type(unsigned int wcaps)
++{
++ if (!wcaps)
++ return -1; /* invalid type */
++ return (wcaps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT;
++}
+
+ static inline unsigned int get_wcaps_channels(u32 wcaps)
+ {
+--- a/sound/pci/hda/hda_proc.c
++++ b/sound/pci/hda/hda_proc.c
+@@ -54,6 +54,8 @@ static const char *get_wid_type_name(uns
+ [AC_WID_BEEP] = "Beep Generator Widget",
+ [AC_WID_VENDOR] = "Vendor Defined Widget",
+ };
++ if (wid_value == -1)
++ return "UNKNOWN Widget";
+ wid_value &= 0xf;
+ if (names[wid_value])
+ return names[wid_value];
--- /dev/null
+From de4da59e480cdf1075b33dbaf8078fc87bc52241 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 08:59:56 +0100
+Subject: ALSA: hda - Use auto-parser for HP laptops with cx20459 codec
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit de4da59e480cdf1075b33dbaf8078fc87bc52241 upstream.
+
+These laptops can work well with the auto-parser and their BIOS setups,
+and in addition, the auto-parser fixes the problem with S3/S4 where
+the unsol event handling is killed after resume due to fallback to the
+single-cmd mode.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740115
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1119,8 +1119,6 @@ static const char * const cxt5045_models
+
+ static const struct snd_pci_quirk cxt5045_cfg_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x30d5, "HP 530", CXT5045_LAPTOP_HP530),
+- SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x3000, "HP DV Series",
+- CXT5045_LAPTOP_HPSENSE),
+ SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba P105", CXT5045_LAPTOP_MICSENSE),
+ SND_PCI_QUIRK(0x152d, 0x0753, "Benq R55E", CXT5045_BENQ),
+ SND_PCI_QUIRK(0x1734, 0x10ad, "Fujitsu Si1520", CXT5045_LAPTOP_MICSENSE),
--- /dev/null
+From e7848163aa2a649d9065f230fadff80dc3519775 Mon Sep 17 00:00:00 2001
+From: Pavel Hofman <pavel.hofman@ivitera.com>
+Date: Thu, 5 Jan 2012 23:05:18 +0100
+Subject: ALSA: ice1724 - Check for ac97 to avoid kernel oops
+
+From: Pavel Hofman <pavel.hofman@ivitera.com>
+
+commit e7848163aa2a649d9065f230fadff80dc3519775 upstream.
+
+Cards with identical PCI ids but no AC97 config in EEPROM do not have
+the ac97 field initialized. We must check for this case to avoid kernel oops.
+
+Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ice1712/amp.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/ice1712/amp.c
++++ b/sound/pci/ice1712/amp.c
+@@ -68,8 +68,11 @@ static int __devinit snd_vt1724_amp_init
+
+ static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice)
+ {
+- /* we use pins 39 and 41 of the VT1616 for left and right read outputs */
+- snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
++ if (ice->ac97)
++ /* we use pins 39 and 41 of the VT1616 for left and right
++ read outputs */
++ snd_ac97_write_cache(ice->ac97, 0x5a,
++ snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
+ return 0;
+ }
+
--- /dev/null
+From d0f3a2eb9062560bebca8b923424f3ca02a331ba Mon Sep 17 00:00:00 2001
+From: Karsten Wiese <fzu@wemgehoertderstaat.de>
+Date: Fri, 30 Dec 2011 01:42:01 +0100
+Subject: ALSA: snd-usb-us122l: Delete calls to preempt_disable
+
+From: Karsten Wiese <fzu@wemgehoertderstaat.de>
+
+commit d0f3a2eb9062560bebca8b923424f3ca02a331ba upstream.
+
+They are not needed here.
+
+Signed-off-by: Karsten Wiese <fzu@wemgehoertderstaat.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usx2y/usb_stream.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/sound/usb/usx2y/usb_stream.c
++++ b/sound/usb/usx2y/usb_stream.c
+@@ -674,7 +674,7 @@ dotry:
+ inurb->transfer_buffer_length =
+ inurb->number_of_packets *
+ inurb->iso_frame_desc[0].length;
+- preempt_disable();
++
+ if (u == 0) {
+ int now;
+ struct usb_device *dev = inurb->dev;
+@@ -686,19 +686,17 @@ dotry:
+ }
+ err = usb_submit_urb(inurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->inurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+ err = usb_submit_urb(outurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->outurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+- preempt_enable();
++
+ if (inurb->start_frame != outurb->start_frame) {
+ snd_printd(KERN_DEBUG
+ "u[%i] start_frames differ in:%u out:%u\n",
--- /dev/null
+From e74a8f2edb92cb690b467cea0ab652c509e9f624 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Tue, 10 Jan 2012 15:11:02 -0800
+Subject: drivers/rtc/interface.c: fix alarm rollover when day or month is out-of-range
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit e74a8f2edb92cb690b467cea0ab652c509e9f624 upstream.
+
+Commit f44f7f96a20a ("RTC: Initialize kernel state from RTC") introduced a
+potential infinite loop. If an alarm time contains a wildcard month and
+an invalid day (> 31), or a wildcard year and an invalid month (>= 12),
+the loop searching for the next matching date will never terminate. Treat
+the invalid values as wildcards.
+
+Fixes <http://bugs.debian.org/646429>, <http://bugs.debian.org/653331>
+
+Reported-by: leo weppelman <leoweppelman@googlemail.com>
+Reported-by: "P. van Gaans" <mailme667@yahoo.co.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Cc: Marcelo Roberto Jimenez <mroberto@cpti.cetuc.puc-rio.br>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <john.stultz@linaro.org>
+Acked-by: Alessandro Zummo <a.zummo@towertech.it>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/interface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -227,11 +227,11 @@ int __rtc_read_alarm(struct rtc_device *
+ alarm->time.tm_hour = now.tm_hour;
+
+ /* For simplicity, only support date rollover for now */
+- if (alarm->time.tm_mday == -1) {
++ if (alarm->time.tm_mday < 1 || alarm->time.tm_mday > 31) {
+ alarm->time.tm_mday = now.tm_mday;
+ missing = day;
+ }
+- if (alarm->time.tm_mon == -1) {
++ if ((unsigned)alarm->time.tm_mon >= 12) {
+ alarm->time.tm_mon = now.tm_mon;
+ if (missing == none)
+ missing = month;
--- /dev/null
+From 28eebb703e28bc455ba704adb1026f76649b768c Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 3 Jan 2012 09:48:38 -0500
+Subject: drm/radeon/kms: disable writeback on pre-R300 asics
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 28eebb703e28bc455ba704adb1026f76649b768c upstream.
+
+We often end up missing fences on older asics with
+writeback enabled which leads to delays in the userspace
+accel code, so just disable it by default on those asics.
+
+Reported-by: Helge Deller <deller@gmx.de>
+Reported-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -224,8 +224,11 @@ int radeon_wb_init(struct radeon_device
+ if (radeon_no_wb == 1)
+ rdev->wb.enabled = false;
+ else {
+- /* often unreliable on AGP */
+ if (rdev->flags & RADEON_IS_AGP) {
++ /* often unreliable on AGP */
++ rdev->wb.enabled = false;
++ } else if (rdev->family < CHIP_R300) {
++ /* often unreliable on pre-r300 */
+ rdev->wb.enabled = false;
+ } else {
+ rdev->wb.enabled = true;
--- /dev/null
+From 92db7f6c860b8190571a9dc1fcbc16d003422fe8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Fri, 23 Dec 2011 20:32:18 +0100
+Subject: drm/radeon/kms: workaround invalid AVI infoframe checksum issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <zajec5@gmail.com>
+
+commit 92db7f6c860b8190571a9dc1fcbc16d003422fe8 upstream.
+
+This change was verified to fix both issues with no video I've
+investigated. I've also checked checksum calculation with fglrx on:
+RV620, HD54xx, HD5450, HD6310, HD6320.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/r600_hdmi.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -196,6 +196,13 @@ static void r600_hdmi_videoinfoframe(
+ frame[0xD] = (right_bar >> 8);
+
+ r600_hdmi_infoframe_checksum(0x82, 0x02, 0x0D, frame);
++ /* Our header values (type, version, length) should be alright, Intel
++ * is using the same. Checksum function also seems to be OK, it works
++ * fine for audio infoframe. However calculated value is always lower
++ * by 2 in comparison to fglrx. It breaks displaying anything in case
++ * of TVs that strictly check the checksum. Hack it manually here to
++ * workaround this issue. */
++ frame[0x0] += 2;
+
+ WREG32(offset+R600_HDMI_VIDEOINFOFRAME_0,
+ frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
--- /dev/null
+From d50f2ab6f050311dbf7b8f5501b25f0bf64a439b Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang@gmail.com>
+Date: Tue, 10 Jan 2012 11:51:10 -0500
+Subject: ext4: fix undefined behavior in ext4_fill_flex_info()
+
+From: Xi Wang <xi.wang@gmail.com>
+
+commit d50f2ab6f050311dbf7b8f5501b25f0bf64a439b upstream.
+
+Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by
+zero when trying to mount a corrupted file system") fixes CVE-2009-4307
+by performing a sanity check on s_log_groups_per_flex, since it can be
+set to a bogus value by an attacker.
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ if (groups_per_flex < 2) { ... }
+
+This patch fixes two potential issues in the previous commit.
+
+1) The sanity check might only work on architectures like PowerPC.
+On x86, 5 bits are used for the shifting amount. That means, given a
+large s_log_groups_per_flex value like 36, groups_per_flex = 1 << 36
+is essentially 1 << 4 = 16, rather than 0. This will bypass the check,
+leaving s_log_groups_per_flex and groups_per_flex inconsistent.
+
+2) The sanity check relies on undefined behavior, i.e., oversized shift.
+A standard-confirming C compiler could rewrite the check in unexpected
+ways. Consider the following equivalent form, assuming groups_per_flex
+is unsigned for simplicity.
+
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+ if (groups_per_flex == 0 || groups_per_flex == 1) {
+
+We compile the code snippet using Clang 3.0 and GCC 4.6. Clang will
+completely optimize away the check groups_per_flex == 0, leaving the
+patched code as vulnerable as the original. GCC keeps the check, but
+there is no guarantee that future versions will do the same.
+
+Signed-off-by: Xi Wang <xi.wang@gmail.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext4/super.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1984,17 +1984,16 @@ static int ext4_fill_flex_info(struct su
+ struct ext4_group_desc *gdp = NULL;
+ ext4_group_t flex_group_count;
+ ext4_group_t flex_group;
+- int groups_per_flex = 0;
++ unsigned int groups_per_flex = 0;
+ size_t size;
+ int i;
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+- groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+-
+- if (groups_per_flex < 2) {
++ if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) {
+ sbi->s_log_groups_per_flex = 0;
+ return 1;
+ }
++ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ /* We allocate both existing and potentially added groups */
+ flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
--- /dev/null
+From d4afc7754a60b885b63ef23fd194984e2d53a4e6 Mon Sep 17 00:00:00 2001
+From: Rene Bollford <xsecute@googlemail.com>
+Date: Sun, 23 Oct 2011 09:56:42 +0200
+Subject: [PATCH] ideapad: Check if acpi already handle backlight power to avoid a page fault
+
+From: Rene Bollford <xsecute@googlemail.com>
+
+commit d4afc7754a60b885b63ef23fd194984e2d53a4e6 upstream.
+
+This patch avoid a page fault in the ideapad-laptop extras when
+turning the backlight power on or off.
+
+Signed-off-by: Rene Bolldorf <xsecute@googlemail.com>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Tested-by: Artem X <artem.brz@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/ideapad-laptop.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -493,6 +493,8 @@ static void ideapad_backlight_notify_pow
+ unsigned long power;
+ struct backlight_device *blightdev = priv->blightdev;
+
++ if (!blightdev)
++ return;
+ if (read_ec_data(ideapad_handle, 0x18, &power))
+ return;
+ blightdev->props.power = power ? FB_BLANK_UNBLANK : FB_BLANK_POWERDOWN;
--- /dev/null
+From avi@redhat.com Thu Jan 12 14:57:51 2012
+From: Avi Kivity <avi@redhat.com>
+Date: Thu, 12 Jan 2012 12:39:54 +0200
+Subject: KVM: Device assignment permission checks
+To: stable@vger.kernel.org
+Cc: kvm@vger.kernel.org, Marcelo Tosatti <mtosatti@redhat.com>
+Message-ID: <1326364794-18150-5-git-send-email-avi@redhat.com>
+
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+(cherry picked from commit 3d27e23b17010c668db311140b17bbbb70c78fb9)
+
+Only allow KVM device assignment to attach to devices which:
+
+ - Are not bridges
+ - Have BAR resources (assume others are special devices)
+ - The user has permissions to use
+
+Assigning a bridge is a configuration error, it's not supported, and
+typically doesn't result in the behavior the user is expecting anyway.
+Devices without BAR resources are typically chipset components that
+also don't have host drivers. We don't want users to hold such devices
+captive or cause system problems by fencing them off into an iommu
+domain. We determine "permission to use" by testing whether the user
+has access to the PCI sysfs resource files. By default a normal user
+will not have access to these files, so it provides a good indication
+that an administration agent has granted the user access to the device.
+
+[Yang Bai: add missing #include]
+[avi: fix comment style]
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Yang Bai <hamo.by@gmail.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ Documentation/virtual/kvm/api.txt | 4 ++
+ virt/kvm/assigned-dev.c | 75 ++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 79 insertions(+)
+
+--- a/Documentation/virtual/kvm/api.txt
++++ b/Documentation/virtual/kvm/api.txt
+@@ -1134,6 +1134,10 @@ following flags are specified:
+ The KVM_DEV_ASSIGN_ENABLE_IOMMU flag is a mandatory option to ensure
+ isolation of the device. Usages not specifying this flag are deprecated.
+
++Only PCI header type 0 devices with PCI BAR resources are supported by
++device assignment. The user requesting this ioctl must have read/write
++access to the PCI sysfs resource files associated with the device.
++
+ 4.49 KVM_DEASSIGN_PCI_DEVICE
+
+ Capability: KVM_CAP_DEVICE_DEASSIGNMENT
+--- a/virt/kvm/assigned-dev.c
++++ b/virt/kvm/assigned-dev.c
+@@ -17,6 +17,8 @@
+ #include <linux/pci.h>
+ #include <linux/interrupt.h>
+ #include <linux/slab.h>
++#include <linux/namei.h>
++#include <linux/fs.h>
+ #include "irq.h"
+
+ static struct kvm_assigned_dev_kernel *kvm_find_assigned_dev(struct list_head *head,
+@@ -474,12 +476,73 @@ out:
+ return r;
+ }
+
++/*
++ * We want to test whether the caller has been granted permissions to
++ * use this device. To be able to configure and control the device,
++ * the user needs access to PCI configuration space and BAR resources.
++ * These are accessed through PCI sysfs. PCI config space is often
++ * passed to the process calling this ioctl via file descriptor, so we
++ * can't rely on access to that file. We can check for permissions
++ * on each of the BAR resource files, which is a pretty clear
++ * indicator that the user has been granted access to the device.
++ */
++static int probe_sysfs_permissions(struct pci_dev *dev)
++{
++#ifdef CONFIG_SYSFS
++ int i;
++ bool bar_found = false;
++
++ for (i = PCI_STD_RESOURCES; i <= PCI_STD_RESOURCE_END; i++) {
++ char *kpath, *syspath;
++ struct path path;
++ struct inode *inode;
++ int r;
++
++ if (!pci_resource_len(dev, i))
++ continue;
++
++ kpath = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
++ if (!kpath)
++ return -ENOMEM;
++
++ /* Per sysfs-rules, sysfs is always at /sys */
++ syspath = kasprintf(GFP_KERNEL, "/sys%s/resource%d", kpath, i);
++ kfree(kpath);
++ if (!syspath)
++ return -ENOMEM;
++
++ r = kern_path(syspath, LOOKUP_FOLLOW, &path);
++ kfree(syspath);
++ if (r)
++ return r;
++
++ inode = path.dentry->d_inode;
++
++ r = inode_permission(inode, MAY_READ | MAY_WRITE | MAY_ACCESS);
++ path_put(&path);
++ if (r)
++ return r;
++
++ bar_found = true;
++ }
++
++ /* If no resources, probably something special */
++ if (!bar_found)
++ return -EPERM;
++
++ return 0;
++#else
++ return -EINVAL; /* No way to control the device without sysfs */
++#endif
++}
++
+ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
+ struct kvm_assigned_pci_dev *assigned_dev)
+ {
+ int r = 0, idx;
+ struct kvm_assigned_dev_kernel *match;
+ struct pci_dev *dev;
++ u8 header_type;
+
+ if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU))
+ return -EINVAL;
+@@ -510,6 +573,18 @@ static int kvm_vm_ioctl_assign_device(st
+ r = -EINVAL;
+ goto out_free;
+ }
++
++ /* Don't allow bridges to be assigned */
++ pci_read_config_byte(dev, PCI_HEADER_TYPE, &header_type);
++ if ((header_type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) {
++ r = -EPERM;
++ goto out_put;
++ }
++
++ r = probe_sysfs_permissions(dev);
++ if (r)
++ goto out_put;
++
+ if (pci_enable_device(dev)) {
+ printk(KERN_INFO "%s: Could not enable PCI device\n", __func__);
+ r = -EBUSY;
--- /dev/null
+From avi@redhat.com Thu Jan 12 14:56:45 2012
+From: Avi Kivity <avi@redhat.com>
+Date: Thu, 12 Jan 2012 12:39:51 +0200
+Subject: KVM guest: prevent tracing recursion with kvmclock
+To: stable@vger.kernel.org
+Cc: kvm@vger.kernel.org, Marcelo Tosatti <mtosatti@redhat.com>
+Message-ID: <1326364794-18150-2-git-send-email-avi@redhat.com>
+
+From: Avi Kivity <avi@redhat.com>
+
+(cherry picked from commit 95ef1e52922cf75b1ea2eae54ef886f2cc47eecb)
+
+Prevent tracing of preempt_disable() in get_cpu_var() in
+kvm_clock_read(). When CONFIG_DEBUG_PREEMPT is enabled,
+preempt_disable/enable() are traced and this causes the function_graph
+tracer to go into an infinite recursion. By open coding the
+preempt_disable() around the get_cpu_var(), we can use the notrace
+version which prevents preempt_disable/enable() from being traced and
+prevents the recursion.
+
+Based on a similar patch for Xen from Jeremy Fitzhardinge.
+
+Tested-by: Gleb Natapov <gleb@redhat.com>
+Acked-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/kernel/kvmclock.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -74,9 +74,10 @@ static cycle_t kvm_clock_read(void)
+ struct pvclock_vcpu_time_info *src;
+ cycle_t ret;
+
+- src = &get_cpu_var(hv_clock);
++ preempt_disable_notrace();
++ src = &__get_cpu_var(hv_clock);
+ ret = pvclock_clocksource_read(src);
+- put_cpu_var(hv_clock);
++ preempt_enable_notrace();
+ return ret;
+ }
+
--- /dev/null
+From avi@redhat.com Thu Jan 12 14:57:35 2012
+From: Avi Kivity <avi@redhat.com>
+Date: Thu, 12 Jan 2012 12:39:53 +0200
+Subject: KVM: Remove ability to assign a device without iommu support
+To: stable@vger.kernel.org
+Cc: kvm@vger.kernel.org, Marcelo Tosatti <mtosatti@redhat.com>
+Message-ID: <1326364794-18150-4-git-send-email-avi@redhat.com>
+
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+(cherry picked from commit 423873736b78f549fbfa2f715f2e4de7e6c5e1e9)
+
+This option has no users and it exposes a security hole that we
+can allow devices to be assigned without iommu protection. Make
+KVM_DEV_ASSIGN_ENABLE_IOMMU a mandatory option.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ Documentation/virtual/kvm/api.txt | 3 +++
+ virt/kvm/assigned-dev.c | 18 +++++++++---------
+ 2 files changed, 12 insertions(+), 9 deletions(-)
+
+--- a/Documentation/virtual/kvm/api.txt
++++ b/Documentation/virtual/kvm/api.txt
+@@ -1131,6 +1131,9 @@ following flags are specified:
+ /* Depends on KVM_CAP_IOMMU */
+ #define KVM_DEV_ASSIGN_ENABLE_IOMMU (1 << 0)
+
++The KVM_DEV_ASSIGN_ENABLE_IOMMU flag is a mandatory option to ensure
++isolation of the device. Usages not specifying this flag are deprecated.
++
+ 4.49 KVM_DEASSIGN_PCI_DEVICE
+
+ Capability: KVM_CAP_DEVICE_DEASSIGNMENT
+--- a/virt/kvm/assigned-dev.c
++++ b/virt/kvm/assigned-dev.c
+@@ -481,6 +481,9 @@ static int kvm_vm_ioctl_assign_device(st
+ struct kvm_assigned_dev_kernel *match;
+ struct pci_dev *dev;
+
++ if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU))
++ return -EINVAL;
++
+ mutex_lock(&kvm->lock);
+ idx = srcu_read_lock(&kvm->srcu);
+
+@@ -538,16 +541,14 @@ static int kvm_vm_ioctl_assign_device(st
+
+ list_add(&match->list, &kvm->arch.assigned_dev_head);
+
+- if (assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU) {
+- if (!kvm->arch.iommu_domain) {
+- r = kvm_iommu_map_guest(kvm);
+- if (r)
+- goto out_list_del;
+- }
+- r = kvm_assign_device(kvm, match);
++ if (!kvm->arch.iommu_domain) {
++ r = kvm_iommu_map_guest(kvm);
+ if (r)
+ goto out_list_del;
+ }
++ r = kvm_assign_device(kvm, match);
++ if (r)
++ goto out_list_del;
+
+ out:
+ srcu_read_unlock(&kvm->srcu, idx);
+@@ -587,8 +588,7 @@ static int kvm_vm_ioctl_deassign_device(
+ goto out;
+ }
+
+- if (match->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)
+- kvm_deassign_device(kvm, match);
++ kvm_deassign_device(kvm, match);
+
+ kvm_free_assigned_device(kvm, match);
+
--- /dev/null
+From avi@redhat.com Thu Jan 12 14:57:09 2012
+From: Avi Kivity <avi@redhat.com>
+Date: Thu, 12 Jan 2012 12:39:52 +0200
+Subject: KVM: x86: Prevent starting PIT timers in the absence of irqchip support
+To: stable@vger.kernel.org
+Cc: kvm@vger.kernel.org, Marcelo Tosatti <mtosatti@redhat.com>
+Message-ID: <1326364794-18150-3-git-send-email-avi@redhat.com>
+
+
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+(cherry picked from commit 0924ab2cfa98b1ece26c033d696651fd62896c69)
+
+User space may create the PIT and forgets about setting up the irqchips.
+In that case, firing PIT IRQs will crash the host:
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000128
+IP: [<ffffffffa10f6280>] kvm_set_irq+0x30/0x170 [kvm]
+...
+Call Trace:
+ [<ffffffffa11228c1>] pit_do_work+0x51/0xd0 [kvm]
+ [<ffffffff81071431>] process_one_work+0x111/0x4d0
+ [<ffffffff81071bb2>] worker_thread+0x152/0x340
+ [<ffffffff81075c8e>] kthread+0x7e/0x90
+ [<ffffffff815a4474>] kernel_thread_helper+0x4/0x10
+
+Prevent this by checking the irqchip mode before starting a timer. We
+can't deny creating the PIT if the irqchips aren't set up yet as
+current user land expects this order to work.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/kvm/i8254.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -338,11 +338,15 @@ static enum hrtimer_restart pit_timer_fn
+ return HRTIMER_NORESTART;
+ }
+
+-static void create_pit_timer(struct kvm_kpit_state *ps, u32 val, int is_period)
++static void create_pit_timer(struct kvm *kvm, u32 val, int is_period)
+ {
++ struct kvm_kpit_state *ps = &kvm->arch.vpit->pit_state;
+ struct kvm_timer *pt = &ps->pit_timer;
+ s64 interval;
+
++ if (!irqchip_in_kernel(kvm))
++ return;
++
+ interval = muldiv64(val, NSEC_PER_SEC, KVM_PIT_FREQ);
+
+ pr_debug("create pit timer, interval is %llu nsec\n", interval);
+@@ -394,13 +398,13 @@ static void pit_load_count(struct kvm *k
+ /* FIXME: enhance mode 4 precision */
+ case 4:
+ if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)) {
+- create_pit_timer(ps, val, 0);
++ create_pit_timer(kvm, val, 0);
+ }
+ break;
+ case 2:
+ case 3:
+ if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)){
+- create_pit_timer(ps, val, 1);
++ create_pit_timer(kvm, val, 1);
+ }
+ break;
+ default:
--- /dev/null
+From 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Mon, 7 Nov 2011 15:51:05 -0800
+Subject: mtd: mtd_blkdevs: don't increase 'open' count on error path
+
+From: Brian Norris <computersforpeace@gmail.com>
+
+commit 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 upstream.
+
+Some error paths in mtd_blkdevs were fixed in the following commit:
+
+ commit 94735ec4044a6d318b83ad3c5794e931ed168d10
+ mtd: mtd_blkdevs: fix error path in blktrans_open
+
+But on these error paths, the block device's `dev->open' count is
+already incremented before we check for errors. This meant that, while
+the error path was handled correctly on the first time through
+blktrans_open(), the device is erroneously considered already open on
+the second time through.
+
+This problem can be seen, for instance, when a UBI volume is
+simultaneously mounted as a UBIFS partition and read through its
+corresponding gluebi mtdblockX device. This results in blktrans_open()
+passing its error checks (with `dev->open > 0') without actually having
+a handle on the device. Here's a summarized log of the actions and
+results with nandsim:
+
+ # modprobe nandsim
+ # modprobe mtdblock
+ # modprobe gluebi
+ # modprobe ubifs
+ # ubiattach /dev/ubi_ctrl -m 0
+ ...
+ # ubimkvol /dev/ubi0 -N test -s 16MiB
+ ...
+ # mount -t ubifs ubi0:test /mnt
+ # ls /dev/mtdblock*
+ /dev/mtdblock0 /dev/mtdblock1
+ # cat /dev/mtdblock1 > /dev/null
+ cat: can't open '/dev/mtdblock4': Device or resource busy
+ # cat /dev/mtdblock1 > /dev/null
+
+ CPU 0 Unable to handle kernel paging request at virtual address
+ fffffff0, epc == 8031536c, ra == 8031f280
+ Oops[#1]:
+ ...
+ Call Trace:
+ [<8031536c>] ubi_leb_read+0x14/0x164
+ [<8031f280>] gluebi_read+0xf0/0x148
+ [<802edba8>] mtdblock_readsect+0x64/0x198
+ [<802ecfe4>] mtd_blktrans_thread+0x330/0x3f4
+ [<8005be98>] kthread+0x88/0x90
+ [<8000bc04>] kernel_thread_helper+0x10/0x18
+
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtd_blkdevs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -215,7 +215,7 @@ static int blktrans_open(struct block_de
+
+ mutex_lock(&dev->lock);
+
+- if (dev->open++)
++ if (dev->open)
+ goto unlock;
+
+ kref_get(&dev->ref);
+@@ -235,6 +235,7 @@ static int blktrans_open(struct block_de
+ goto error_release;
+
+ unlock:
++ dev->open++;
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
--- /dev/null
+From 3538c56329936c78f7d356889908790006d0124c Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Date: Fri, 2 Dec 2011 15:07:17 +0200
+Subject: mtd: mtdoops: skip reading initially bad blocks
+
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+
+commit 3538c56329936c78f7d356889908790006d0124c upstream.
+
+Use block_isbad to check and skip the bad blocks reading.
+This will allow to get rid of the read errors if bad blocks
+are present initially.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtdoops.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -253,6 +253,9 @@ static void find_next_position(struct mt
+ size_t retlen;
+
+ for (page = 0; page < cxt->oops_pages; page++) {
++ if (mtd->block_isbad &&
++ mtd->block_isbad(mtd, page * record_size))
++ continue;
+ /* Assume the page is used */
+ mark_page_used(cxt, page);
+ ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE,
--- /dev/null
+From 2f4478ccff7df845dc9c0f8996a96373122c4417 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Tue, 29 Nov 2011 15:34:08 +0100
+Subject: mtd: tests: stresstest: bail out if device has not enough eraseblocks
+
+From: Wolfram Sang <w.sang@pengutronix.de>
+
+commit 2f4478ccff7df845dc9c0f8996a96373122c4417 upstream.
+
+stresstest needs at least two eraseblocks. Bail out gracefully if that
+condition is not met. Fixes the following 'division by zero' OOPS:
+
+[ 619.100000] mtd_stresstest: MTD device size 131072, eraseblock size 131072, page size 2048, count of eraseblocks 1, pages per eraseblock 64, OOB size 64
+[ 619.120000] mtd_stresstest: scanning for bad eraseblocks
+[ 619.120000] mtd_stresstest: scanned 1 eraseblocks, 0 are bad
+[ 619.130000] mtd_stresstest: doing operations
+[ 619.130000] mtd_stresstest: 0 operations done
+[ 619.140000] Division by zero in kernel.
+...
+
+caused by
+
+ /* Read or write up 2 eraseblocks at a time - hence 'ebcnt - 1' */
+ eb %= (ebcnt - 1);
+
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/tests/mtd_stresstest.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mtd/tests/mtd_stresstest.c
++++ b/drivers/mtd/tests/mtd_stresstest.c
+@@ -277,6 +277,12 @@ static int __init mtd_stresstest_init(vo
+ (unsigned long long)mtd->size, mtd->erasesize,
+ pgsize, ebcnt, pgcnt, mtd->oobsize);
+
++ if (ebcnt < 2) {
++ printk(PRINT_PREF "error: need at least 2 eraseblocks\n");
++ err = -ENOSPC;
++ goto out_put_mtd;
++ }
++
+ /* Read or write up 2 eraseblocks at a time */
+ bufsize = mtd->erasesize * 2;
+
+@@ -315,6 +321,7 @@ out:
+ kfree(bbt);
+ vfree(writebuf);
+ vfree(readbuf);
++out_put_mtd:
+ put_mtd_device(mtd);
+ if (err)
+ printk(PRINT_PREF "error %d occurred\n", err);
--- /dev/null
+From 556f063580db2953a7e53cd46b47724246320f60 Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Date: Tue, 29 Nov 2011 12:49:18 +0200
+Subject: mtdoops: fix the oops_page_used array size
+
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+
+commit 556f063580db2953a7e53cd46b47724246320f60 upstream.
+
+The array of unsigned long pointed by oops_page_used is allocated
+by vmalloc which requires the size to be in bytes.
+
+BITS_PER_LONG is equal to 32.
+If we want to allocate memory for 32 pages with one bit per page then
+32 / BITS_PER_LONG is equal to 1 byte that is 8 bits.
+To fix it we need to multiply the result by sizeof(unsigned long) equal to 4.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtdoops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -369,7 +369,7 @@ static void mtdoops_notify_add(struct mt
+
+ /* oops_page_used is a bit field */
+ cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
+- BITS_PER_LONG));
++ BITS_PER_LONG) * sizeof(unsigned long));
+ if (!cxt->oops_page_used) {
+ printk(KERN_ERR "mtdoops: could not allocate page array\n");
+ return;
--- /dev/null
+From 3df96909b75835d487a9178761622b0cbd7310d4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Thu, 5 Jan 2012 18:42:17 +0100
+Subject: radeon: Fix disabling PCI bus mastering on big endian hosts.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <michel.daenzer@amd.com>
+
+commit 3df96909b75835d487a9178761622b0cbd7310d4 upstream.
+
+It would previously write basically random bits to PCI configuration space...
+Not very surprising that the GPU tended to stop responding completely. The
+resulting MCE even froze the whole machine sometimes.
+
+Now resetting the GPU after a lockup has at least a fighting chance of
+succeeding.
+
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/r100.c | 5 +++--
+ drivers/gpu/drm/radeon/rs600.c | 4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -2069,6 +2069,7 @@ bool r100_gpu_is_lockup(struct radeon_de
+ void r100_bm_disable(struct radeon_device *rdev)
+ {
+ u32 tmp;
++ u16 tmp16;
+
+ /* disable bus mastering */
+ tmp = RREG32(R_000030_BUS_CNTL);
+@@ -2079,8 +2080,8 @@ void r100_bm_disable(struct radeon_devic
+ WREG32(R_000030_BUS_CNTL, (tmp & 0xFFFFFFFF) | 0x00000040);
+ tmp = RREG32(RADEON_BUS_CNTL);
+ mdelay(1);
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
+- pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp16);
++ pci_write_config_word(rdev->pdev, 0x4, tmp16 & 0xFFFB);
+ mdelay(1);
+ }
+
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -324,10 +324,10 @@ void rs600_hpd_fini(struct radeon_device
+
+ void rs600_bm_disable(struct radeon_device *rdev)
+ {
+- u32 tmp;
++ u16 tmp;
+
+ /* disable bus mastering */
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp);
+ pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
+ mdelay(1);
+ }
--- /dev/null
+mtdoops-fix-the-oops_page_used-array-size.patch
+mtd-mtdoops-skip-reading-initially-bad-blocks.patch
+mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch
+mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch
+drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch
+ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch
+alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch
+alsa-hda-fix-master-control-for-cirrus-logic-421x.patch
+alsa-hda-fix-automute-for-cirrus-logic-421x.patch
+alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch
+alsa-hda-use-auto-parser-for-hp-laptops-with-cx20459-codec.patch
+alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch
+alsa-hda-fix-the-detection-of-loopback-mixing-control-for-via-codecs.patch
+alsa-hda-fix-the-lost-power-setup-of-seconary-pins-after-pm-resume.patch
+kvm-guest-prevent-tracing-recursion-with-kvmclock.patch
+kvm-x86-prevent-starting-pit-timers-in-the-absence-of-irqchip-support.patch
+kvm-remove-ability-to-assign-a-device-without-iommu-support.patch
+kvm-device-assignment-permission-checks.patch
+ideapad-check-if-acpi-already-handle-backlight-power-to-avoid-a-page-fault.patch
+drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch
+drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch
+radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
