From 14c36a09524bd517e5e76c10783cd756c2a5513b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 27 Feb 2012 13:46:03 -0800 Subject: [PATCH] 3.2-stable patches added patches: alsa-hda-realtek-fix-overflow-of-vol-sw-check-bitmap.patch alsa-hda-realtek-fix-surround-output-regression-on-acer-aspire-5935.patch arm-omap-fix-oops-in-arch-arm-mach-omap2-vp.c-when-pmic-is-not-found.patch arm-omap-fix-oops-in-drivers-video-omap2-dss-dpi.c.patch asoc-wm8962-fix-sidetone-enumeration-texts.patch ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch hwmon-ads1015-fix-file-leak-in-probe-function.patch hwmon-max6639-fix-fan_from_reg-calculation.patch hwmon-max6639-fix-ppr-register-initialization-to-set-both-channels.patch nommu-lock-i_mmap_mutex-for-access-to-the-vma-prio-list.patch x86-amd-fix-l1i-and-l2-cache-sharing-information-for-amd-family-15h-processors.patch x86-nmi-test-saved-cs-in-nmi-to-determine-nested-nmi-case.patch --- ...-fix-overflow-of-vol-sw-check-bitmap.patch | 58 +++++++++ ...utput-regression-on-acer-aspire-5935.patch | 50 ++++++++ ...ch-omap2-vp.c-when-pmic-is-not-found.patch | 71 +++++++++++ ...ops-in-drivers-video-omap2-dss-dpi.c.patch | 111 ++++++++++++++++++ ...m8962-fix-sidetone-enumeration-texts.patch | 29 +++++ ...1-in-ath9k-rate-control-s-.tx_status.patch | 38 ++++++ ...1015-fix-file-leak-in-probe-function.patch | 41 +++++++ ...max6639-fix-fan_from_reg-calculation.patch | 44 +++++++ ...-initialization-to-set-both-channels.patch | 62 ++++++++++ ...utex-for-access-to-the-vma-prio-list.patch | 73 ++++++++++++ queue-3.2/series | 12 ++ ...mation-for-amd-family-15h-processors.patch | 97 +++++++++++++++ ...-in-nmi-to-determine-nested-nmi-case.patch | 49 ++++++++ 13 files changed, 735 insertions(+) create mode 100644 queue-3.2/alsa-hda-realtek-fix-overflow-of-vol-sw-check-bitmap.patch create mode 100644 queue-3.2/alsa-hda-realtek-fix-surround-output-regression-on-acer-aspire-5935.patch create mode 100644 queue-3.2/arm-omap-fix-oops-in-arch-arm-mach-omap2-vp.c-when-pmic-is-not-found.patch create mode 100644 queue-3.2/arm-omap-fix-oops-in-drivers-video-omap2-dss-dpi.c.patch create mode 100644 queue-3.2/asoc-wm8962-fix-sidetone-enumeration-texts.patch create mode 100644 queue-3.2/ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch create mode 100644 queue-3.2/hwmon-ads1015-fix-file-leak-in-probe-function.patch create mode 100644 queue-3.2/hwmon-max6639-fix-fan_from_reg-calculation.patch create mode 100644 queue-3.2/hwmon-max6639-fix-ppr-register-initialization-to-set-both-channels.patch create mode 100644 queue-3.2/nommu-lock-i_mmap_mutex-for-access-to-the-vma-prio-list.patch create mode 100644 queue-3.2/x86-amd-fix-l1i-and-l2-cache-sharing-information-for-amd-family-15h-processors.patch create mode 100644 queue-3.2/x86-nmi-test-saved-cs-in-nmi-to-determine-nested-nmi-case.patch diff --git a/queue-3.2/alsa-hda-realtek-fix-overflow-of-vol-sw-check-bitmap.patch b/queue-3.2/alsa-hda-realtek-fix-overflow-of-vol-sw-check-bitmap.patch new file mode 100644 index 00000000000..3499d0dbafc --- /dev/null +++ b/queue-3.2/alsa-hda-realtek-fix-overflow-of-vol-sw-check-bitmap.patch @@ -0,0 +1,58 @@ +From c14c95f62ecb8710af14ae0d48e01991b70bb6f4 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 16 Feb 2012 16:38:07 +0100 +Subject: ALSA: hda/realtek - Fix overflow of vol/sw check bitmap + +From: Takashi Iwai + +commit c14c95f62ecb8710af14ae0d48e01991b70bb6f4 upstream. + +The bitmap introduced in the commit [527e4d73: ALSA: hda/realtek - Fix +missing volume controls with ALC260] is too narrow for some codecs, +which may have more NIDs than 0x20, thus it may overflow the bitmap +array on them. + +Just double the number to cover all and also add a sanity-check code +to be safer. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -79,6 +79,8 @@ enum { + ALC_AUTOMUTE_MIXER, /* mute/unmute mixer widget AMP */ + }; + ++#define MAX_VOL_NIDS 0x40 ++ + struct alc_spec { + /* codec parameterization */ + const struct snd_kcontrol_new *mixers[5]; /* mixer arrays */ +@@ -117,8 +119,8 @@ struct alc_spec { + const hda_nid_t *capsrc_nids; + hda_nid_t dig_in_nid; /* digital-in NID; optional */ + hda_nid_t mixer_nid; /* analog-mixer NID */ +- DECLARE_BITMAP(vol_ctls, 0x20 << 1); +- DECLARE_BITMAP(sw_ctls, 0x20 << 1); ++ DECLARE_BITMAP(vol_ctls, MAX_VOL_NIDS << 1); ++ DECLARE_BITMAP(sw_ctls, MAX_VOL_NIDS << 1); + + /* capture setup for dynamic dual-adc switch */ + hda_nid_t cur_adc; +@@ -3068,7 +3070,10 @@ static int alc_auto_fill_dac_nids(struct + static inline unsigned int get_ctl_pos(unsigned int data) + { + hda_nid_t nid = get_amp_nid_(data); +- unsigned int dir = get_amp_direction_(data); ++ unsigned int dir; ++ if (snd_BUG_ON(nid >= MAX_VOL_NIDS)) ++ return 0; ++ dir = get_amp_direction_(data); + return (nid << 1) | dir; + } + diff --git a/queue-3.2/alsa-hda-realtek-fix-surround-output-regression-on-acer-aspire-5935.patch b/queue-3.2/alsa-hda-realtek-fix-surround-output-regression-on-acer-aspire-5935.patch new file mode 100644 index 00000000000..13483ebb6ba --- /dev/null +++ b/queue-3.2/alsa-hda-realtek-fix-surround-output-regression-on-acer-aspire-5935.patch @@ -0,0 +1,50 @@ +From ef8d60fb79614a86a82720dc2402631dbcafb315 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 17 Feb 2012 10:12:38 +0100 +Subject: ALSA: hda/realtek - Fix surround output regression on Acer Aspire 5935 + +From: Takashi Iwai + +commit ef8d60fb79614a86a82720dc2402631dbcafb315 upstream. + +The previous fix for the speaker on Acer Aspire 59135 introduced +another problem for surround outputs. It changed the connections on +the line-in/mic pins for limiting the routes, but it left the modified +connections. Thus wrong connection indices were written when set to +4ch or 6ch mode. + +This patch fixes it by restoring the right connections just after +parsing the tree but before the initialization. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42740 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4229,12 +4229,20 @@ static void alc889_fixup_dac_route(struc + const struct alc_fixup *fix, int action) + { + if (action == ALC_FIXUP_ACT_PRE_PROBE) { ++ /* fake the connections during parsing the tree */ + hda_nid_t conn1[2] = { 0x0c, 0x0d }; + hda_nid_t conn2[2] = { 0x0e, 0x0f }; + snd_hda_override_conn_list(codec, 0x14, 2, conn1); + snd_hda_override_conn_list(codec, 0x15, 2, conn1); + snd_hda_override_conn_list(codec, 0x18, 2, conn2); + snd_hda_override_conn_list(codec, 0x1a, 2, conn2); ++ } else if (action == ALC_FIXUP_ACT_PROBE) { ++ /* restore the connections */ ++ hda_nid_t conn[5] = { 0x0c, 0x0d, 0x0e, 0x0f, 0x26 }; ++ snd_hda_override_conn_list(codec, 0x14, 5, conn); ++ snd_hda_override_conn_list(codec, 0x15, 5, conn); ++ snd_hda_override_conn_list(codec, 0x18, 5, conn); ++ snd_hda_override_conn_list(codec, 0x1a, 5, conn); + } + } + diff --git a/queue-3.2/arm-omap-fix-oops-in-arch-arm-mach-omap2-vp.c-when-pmic-is-not-found.patch b/queue-3.2/arm-omap-fix-oops-in-arch-arm-mach-omap2-vp.c-when-pmic-is-not-found.patch new file mode 100644 index 00000000000..8bde5bbfb9a --- /dev/null +++ b/queue-3.2/arm-omap-fix-oops-in-arch-arm-mach-omap2-vp.c-when-pmic-is-not-found.patch @@ -0,0 +1,71 @@ +From d980e0f8d858c6963d676013e976ff00ab7acb2b Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Tue, 7 Feb 2012 09:42:11 +0000 +Subject: ARM: omap: fix oops in arch/arm/mach-omap2/vp.c when pmic is not found + +From: Russell King + +commit d980e0f8d858c6963d676013e976ff00ab7acb2b upstream. + +When the PMIC is not found, voltdm->pmic will be NULL. vp.c's +initialization function tries to dereferences this, which causes an +oops: + +Unable to handle kernel NULL pointer dereference at virtual address 00000000 +pgd = c0004000 +[00000000] *pgd=00000000 +Internal error: Oops: 5 [#1] PREEMPT +Modules linked in: +CPU: 0 Not tainted (3.3.0-rc2+ #204) +PC is at omap_vp_init+0x5c/0x15c +LR is at omap_vp_init+0x58/0x15c +pc : [] lr : [] psr: 60000013 +sp : c181ff30 ip : c181ff68 fp : c181ff64 +r10: c0407808 r9 : c040786c r8 : c0407814 +r7 : c0026868 r6 : c00264fc r5 : c040ad6c r4 : 00000000 +r3 : 00000040 r2 : 000032c8 r1 : 0000fa00 r0 : 000032c8 +Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel +Control: 10c5387d Table: 80004019 DAC: 00000015 +Process swapper (pid: 1, stack limit = 0xc181e2e8) +Stack: (0xc181ff30 to 0xc1820000) +ff20: c0381d00 c02e9c6d c0383582 c040786c +ff40: c040ad6c c00264fc c0026868 c0407814 00000000 c03d9de4 c181ff8c c181ff68 +ff60: c03db448 c03db830 c02e982c c03fdfb8 c03fe004 c0039988 00000013 00000000 +ff80: c181ff9c c181ff90 c03d9df8 c03db390 c181ffdc c181ffa0 c0008798 c03d9df0 +ffa0: c181ffc4 c181ffb0 c0055a44 c0187050 c0039988 c03fdfb8 c03fe004 c0039988 +ffc0: 00000013 00000000 00000000 00000000 c181fff4 c181ffe0 c03d1284 c0008708 +ffe0: 00000000 c03d1208 00000000 c181fff8 c0039988 c03d1214 1077ce40 01f7ee08 +Backtrace: +[] (omap_vp_init+0x0/0x15c) from [] (omap_voltage_late_init+0xc4/0xfc) +[] (omap_voltage_late_init+0x0/0xfc) from [] (omap2_common_pm_late_init+0x14/0x54) + r8:00000000 r7:00000013 r6:c0039988 r5:c03fe004 r4:c03fdfb8 +[] (omap2_common_pm_late_init+0x0/0x54) from [] (do_one_initcall+0x9c/0x164) +[] (do_one_initcall+0x0/0x164) from [] (kernel_init+0x7c/0x120) +[] (kernel_init+0x0/0x120) from [] (do_exit+0x0/0x2cc) + r5:c03d1208 r4:00000000 +Code: e5ca300b e5900034 ebf69027 e5994024 (e5941000) +---[ end trace aed617dddaf32c3d ]--- +Kernel panic - not syncing: Attempted to kill init! + +Signed-off-by: Russell King +Cc: Igor Grinberg +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/vp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/arm/mach-omap2/vp.c ++++ b/arch/arm/mach-omap2/vp.c +@@ -41,6 +41,11 @@ void __init omap_vp_init(struct voltaged + u32 val, sys_clk_rate, timeout, waittime; + u32 vddmin, vddmax, vstepmin, vstepmax; + ++ if (!voltdm->pmic || !voltdm->pmic->uv_to_vsel) { ++ pr_err("%s: No PMIC info for vdd_%s\n", __func__, voltdm->name); ++ return; ++ } ++ + if (!voltdm->read || !voltdm->write) { + pr_err("%s: No read/write API for accessing vdd_%s regs\n", + __func__, voltdm->name); diff --git a/queue-3.2/arm-omap-fix-oops-in-drivers-video-omap2-dss-dpi.c.patch b/queue-3.2/arm-omap-fix-oops-in-drivers-video-omap2-dss-dpi.c.patch new file mode 100644 index 00000000000..b24e2391ee5 --- /dev/null +++ b/queue-3.2/arm-omap-fix-oops-in-drivers-video-omap2-dss-dpi.c.patch @@ -0,0 +1,111 @@ +From 40410715715178ec196314dd0c19150c06901f80 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Tue, 7 Feb 2012 09:44:55 +0000 +Subject: ARM: omap: fix oops in drivers/video/omap2/dss/dpi.c + +From: Russell King + +commit 40410715715178ec196314dd0c19150c06901f80 upstream. + +When a PMIC is not found, this driver is unable to obtain its +'vdds_dsi_reg' regulator. Even through its initialization function +fails, other code still calls its enable function, which fails to +check whether it has this regulator before asking for it to be enabled. + +This fixes the oops, however a better fix would be to sort out the +upper layers to prevent them calling into a module which failed to +initialize. + +Unable to handle kernel NULL pointer dereference at virtual address 00000038 +pgd = c0004000 +[00000038] *pgd=00000000 +Internal error: Oops: 5 [#1] PREEMPT +Modules linked in: +CPU: 0 Not tainted (3.3.0-rc2+ #228) +PC is at regulator_enable+0x10/0x70 +LR is at omapdss_dpi_display_enable+0x54/0x15c +pc : [] lr : [] psr: 60000013 +sp : c181fd90 ip : c181fdb0 fp : c181fdac +r10: c042eff0 r9 : 00000060 r8 : c044a164 +r7 : c042c0e4 r6 : c042bd60 r5 : 00000000 r4 : c042bd60 +r3 : c084de48 r2 : c181e000 r1 : c042bd60 r0 : 00000000 +Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel +Control: 10c5387d Table: 80004019 DAC: 00000015 +Process swapper (pid: 1, stack limit = 0xc181e2e8) +Stack: (0xc181fd90 to 0xc1820000) +fd80: c001754c c042bd60 00000000 c042bd60 +fda0: c181fdcc c181fdb0 c01af994 c01b9a04 c0016104 c042bd60 c042bd60 c044a338 +fdc0: c181fdec c181fdd0 c01b5ed0 c01af94c c042bd60 c042bd60 c1aa8000 c1aa8a0c +fde0: c181fe04 c181fdf0 c01b5f54 c01b5ea8 c02fc18c c042bd60 c181fe3c c181fe08 +fe00: c01b2a18 c01b5f48 c01aed14 c02fc160 c01df8ec 00000002 c042bd60 00000003 +fe20: c042bd60 c1aa8000 c1aa8a0c c042eff8 c181fe84 c181fe40 c01b3874 c01b29fc +fe40: c042eff8 00000000 c042f000 c0449db8 c044ed78 00000000 c181fe74 c042eff8 +fe60: c042eff8 c0449db8 c0449db8 c044ed78 00000000 00000000 c181fe94 c181fe88 +fe80: c01e452c c01b35e8 c181feb4 c181fe98 c01e2fdc c01e4518 c042eff8 c0449db8 +fea0: c0449db8 c181fef0 c181fecc c181feb8 c01e3104 c01e2f48 c042eff8 c042f02c +fec0: c181feec c181fed0 c01e3190 c01e30c0 c01e311c 00000000 c01e311c c0449db8 +fee0: c181ff14 c181fef0 c01e1998 c01e3128 c18330a8 c1892290 c04165e8 c0449db8 +ff00: c0449db8 c1ab60c0 c181ff24 c181ff18 c01e2e28 c01e194c c181ff54 c181ff28 +ff20: c01e2218 c01e2e14 c039afed c181ff38 c04165e8 c041660c c0449db8 00000013 +ff40: 00000000 c03ffdb8 c181ff7c c181ff58 c01e384c c01e217c c181ff7c c04165e8 +ff60: c041660c c003a37c 00000013 00000000 c181ff8c c181ff80 c01e488c c01e3790 +ff80: c181ff9c c181ff90 c03ffdcc c01e484c c181ffdc c181ffa0 c0008798 c03ffdc4 +ffa0: c181ffc4 c181ffb0 c0056440 c0187810 c003a37c c04165e8 c041660c c003a37c +ffc0: 00000013 00000000 00000000 00000000 c181fff4 c181ffe0 c03ea284 c0008708 +ffe0: 00000000 c03ea208 00000000 c181fff8 c003a37c c03ea214 1073cec0 01f7ee08 +Backtrace: +[] (regulator_enable+0x0/0x70) from [] (omapdss_dpi_display_enable+0x54/0x15c) + r6:c042bd60 r5:00000000 r4:c042bd60 +[] (omapdss_dpi_display_enable+0x0/0x15c) from [] (generic_dpi_panel_power_on+0x34/0x78) + r6:c044a338 r5:c042bd60 r4:c042bd60 +[] (generic_dpi_panel_power_on+0x0/0x78) from [] (generic_dpi_panel_enable+0x18/0x28) + r7:c1aa8a0c r6:c1aa8000 r5:c042bd60 r4:c042bd60 +[] (generic_dpi_panel_enable+0x0/0x28) from [] (omapfb_init_display+0x28/0x150) + r4:c042bd60 +[] (omapfb_init_display+0x0/0x150) from [] (omapfb_probe+0x298/0x318) + r8:c042eff8 r7:c1aa8a0c r6:c1aa8000 r5:c042bd60 r4:00000003 +[] (omapfb_probe+0x0/0x318) from [] (platform_drv_probe+0x20/0x24) +[] (platform_drv_probe+0x0/0x24) from [] (really_probe+0xa0/0x178) +[] (really_probe+0x0/0x178) from [] (driver_probe_device+0x50/0x68) + r7:c181fef0 r6:c0449db8 r5:c0449db8 r4:c042eff8 +[] (driver_probe_device+0x0/0x68) from [] (__driver_attach+0x74/0x98) + r5:c042f02c r4:c042eff8 +[] (__driver_attach+0x0/0x98) from [] (bus_for_each_dev+0x58/0x98) + r6:c0449db8 r5:c01e311c r4:00000000 +[] (bus_for_each_dev+0x0/0x98) from [] (driver_attach+0x20/0x28) + r7:c1ab60c0 r6:c0449db8 r5:c0449db8 r4:c04165e8 +[] (driver_attach+0x0/0x28) from [] (bus_add_driver+0xa8/0x22c) +[] (bus_add_driver+0x0/0x22c) from [] (driver_register+0xc8/0x154) +[] (driver_register+0x0/0x154) from [] (platform_driver_register+0x4c/0x60) + r8:00000000 r7:00000013 r6:c003a37c r5:c041660c r4:c04165e8 +[] (platform_driver_register+0x0/0x60) from [] (omapfb_init+0x14/0x34) +[] (omapfb_init+0x0/0x34) from [] (do_one_initcall+0x9c/0x164) +[] (do_one_initcall+0x0/0x164) from [] (kernel_init+0x7c/0x120) +[] (kernel_init+0x0/0x120) from [] (do_exit+0x0/0x2d8) + r5:c03ea208 r4:00000000 +Code: e1a0c00d e92dd870 e24cb004 e24dd004 (e5906038) +---[ end trace 9e2474c2e193b223 ]--- + +Acked-by: Tony Lindgren +Signed-off-by: Russell King +Cc: Igor Grinberg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/omap2/dss/dpi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/video/omap2/dss/dpi.c ++++ b/drivers/video/omap2/dss/dpi.c +@@ -180,6 +180,11 @@ int omapdss_dpi_display_enable(struct om + { + int r; + ++ if (cpu_is_omap34xx() && !dpi.vdds_dsi_reg) { ++ DSSERR("no VDSS_DSI regulator\n"); ++ return -ENODEV; ++ } ++ + if (dssdev->manager == NULL) { + DSSERR("failed to enable display: no manager\n"); + return -ENODEV; diff --git a/queue-3.2/asoc-wm8962-fix-sidetone-enumeration-texts.patch b/queue-3.2/asoc-wm8962-fix-sidetone-enumeration-texts.patch new file mode 100644 index 00000000000..34c332d5ad2 --- /dev/null +++ b/queue-3.2/asoc-wm8962-fix-sidetone-enumeration-texts.patch @@ -0,0 +1,29 @@ +From 31794bc37bf2db84f085da52b72bfba65739b2d2 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Mon, 13 Feb 2012 22:00:47 -0800 +Subject: ASoC: wm8962: Fix sidetone enumeration texts + +From: Mark Brown + +commit 31794bc37bf2db84f085da52b72bfba65739b2d2 upstream. + +The sidetone enumeration texts have left and right swapped. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2559,7 +2559,7 @@ static int dsp2_event(struct snd_soc_dap + return 0; + } + +-static const char *st_text[] = { "None", "Right", "Left" }; ++static const char *st_text[] = { "None", "Left", "Right" }; + + static const struct soc_enum str_enum = + SOC_ENUM_SINGLE(WM8962_DAC_DSP_MIXING_1, 2, 3, st_text); diff --git a/queue-3.2/ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch b/queue-3.2/ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch new file mode 100644 index 00000000000..eed9a19c363 --- /dev/null +++ b/queue-3.2/ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch @@ -0,0 +1,38 @@ +From 2504a6423b9ab4c36df78227055995644de19edb Mon Sep 17 00:00:00 2001 +From: Pavel Roskin +Date: Sat, 11 Feb 2012 10:01:53 -0500 +Subject: ath9k: stop on rates with idx -1 in ath9k rate control's .tx_status + +From: Pavel Roskin + +commit 2504a6423b9ab4c36df78227055995644de19edb upstream. + +Rate control algorithms are supposed to stop processing when they +encounter a rate with the index -1. Checking for rate->count not being +zero is not enough. + +Allowing a rate with negative index leads to memory corruption in +ath_debug_stat_rc(). + +One consequence of the bug is discussed at +https://bugzilla.redhat.com/show_bug.cgi?id=768639 + +Signed-off-by: Pavel Roskin +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/rc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/rc.c ++++ b/drivers/net/wireless/ath/ath9k/rc.c +@@ -1347,7 +1347,7 @@ static void ath_tx_status(void *priv, st + fc = hdr->frame_control; + for (i = 0; i < sc->hw->max_rates; i++) { + struct ieee80211_tx_rate *rate = &tx_info->status.rates[i]; +- if (!rate->count) ++ if (rate->idx < 0 || !rate->count) + break; + + final_ts_idx = i; diff --git a/queue-3.2/hwmon-ads1015-fix-file-leak-in-probe-function.patch b/queue-3.2/hwmon-ads1015-fix-file-leak-in-probe-function.patch new file mode 100644 index 00000000000..1c190272136 --- /dev/null +++ b/queue-3.2/hwmon-ads1015-fix-file-leak-in-probe-function.patch @@ -0,0 +1,41 @@ +From 363434b5dc352464ac7601547891e5fc9105f124 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Wed, 22 Feb 2012 08:13:52 -0800 +Subject: hwmon: (ads1015) Fix file leak in probe function + +From: Guenter Roeck + +commit 363434b5dc352464ac7601547891e5fc9105f124 upstream. + +An error while creating sysfs attribute files in the driver's probe function +results in an error abort, but already created files are not removed. This patch +fixes the problem. + +Signed-off-by: Guenter Roeck +Cc: Dirk Eibach +Acked-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/ads1015.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/hwmon/ads1015.c ++++ b/drivers/hwmon/ads1015.c +@@ -271,7 +271,7 @@ static int ads1015_probe(struct i2c_clie + continue; + err = device_create_file(&client->dev, &ads1015_in[k].dev_attr); + if (err) +- goto exit_free; ++ goto exit_remove; + } + + data->hwmon_dev = hwmon_device_register(&client->dev); +@@ -285,7 +285,6 @@ static int ads1015_probe(struct i2c_clie + exit_remove: + for (k = 0; k < ADS1015_CHANNELS; ++k) + device_remove_file(&client->dev, &ads1015_in[k].dev_attr); +-exit_free: + kfree(data); + exit: + return err; diff --git a/queue-3.2/hwmon-max6639-fix-fan_from_reg-calculation.patch b/queue-3.2/hwmon-max6639-fix-fan_from_reg-calculation.patch new file mode 100644 index 00000000000..c73e5404e9f --- /dev/null +++ b/queue-3.2/hwmon-max6639-fix-fan_from_reg-calculation.patch @@ -0,0 +1,44 @@ +From b63d97a36edb1aecf8c13e5f5783feff4d64c24b Mon Sep 17 00:00:00 2001 +From: Chris D Schimp +Date: Mon, 20 Feb 2012 16:59:24 -0500 +Subject: hwmon: (max6639) Fix FAN_FROM_REG calculation + +From: Chris D Schimp + +commit b63d97a36edb1aecf8c13e5f5783feff4d64c24b upstream. + +RPM calculation from tachometer value does not depend on PPR. +Also, do not report negative RPM values. + +Signed-off-by: Chris D Schimp +[guenter.roeck@ericsson.com: do not report negative RPM values] +Signed-off-by: Guenter Roeck +Acked-by: Roland Stigge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/max6639.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/hwmon/max6639.c ++++ b/drivers/hwmon/max6639.c +@@ -72,8 +72,8 @@ static unsigned short normal_i2c[] = { 0 + + static const int rpm_ranges[] = { 2000, 4000, 8000, 16000 }; + +-#define FAN_FROM_REG(val, div, rpm_range) ((val) == 0 ? -1 : \ +- (val) == 255 ? 0 : (rpm_ranges[rpm_range] * 30) / ((div + 1) * (val))) ++#define FAN_FROM_REG(val, rpm_range) ((val) == 0 || (val) == 255 ? \ ++ 0 : (rpm_ranges[rpm_range] * 30) / (val)) + #define TEMP_LIMIT_TO_REG(val) SENSORS_LIMIT((val) / 1000, 0, 255) + + /* +@@ -333,7 +333,7 @@ static ssize_t show_fan_input(struct dev + return PTR_ERR(data); + + return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan[attr->index], +- data->ppr, data->rpm_range)); ++ data->rpm_range)); + } + + static ssize_t show_alarm(struct device *dev, diff --git a/queue-3.2/hwmon-max6639-fix-ppr-register-initialization-to-set-both-channels.patch b/queue-3.2/hwmon-max6639-fix-ppr-register-initialization-to-set-both-channels.patch new file mode 100644 index 00000000000..e3403b34c14 --- /dev/null +++ b/queue-3.2/hwmon-max6639-fix-ppr-register-initialization-to-set-both-channels.patch @@ -0,0 +1,62 @@ +From 2f2da1ac0ba5b6cc6e1957c4da5ff20e67d8442b Mon Sep 17 00:00:00 2001 +From: Chris D Schimp +Date: Mon, 20 Feb 2012 17:44:59 -0500 +Subject: hwmon: (max6639) Fix PPR register initialization to set both channels + +From: Chris D Schimp + +commit 2f2da1ac0ba5b6cc6e1957c4da5ff20e67d8442b upstream. + +Initialize PPR register for both channels, and set correct PPR register bits. +Also remove unnecessary variable initializations. + +Signed-off-by: Chris D Schimp +[guenter.roeck@ericsson.com: Merged two patches into one] +Signed-off-by: Guenter Roeck +Acked-by: Roland Stigge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/max6639.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/drivers/hwmon/max6639.c ++++ b/drivers/hwmon/max6639.c +@@ -429,9 +429,9 @@ static int max6639_init_client(struct i2 + struct max6639_data *data = i2c_get_clientdata(client); + struct max6639_platform_data *max6639_info = + client->dev.platform_data; +- int i = 0; ++ int i; + int rpm_range = 1; /* default: 4000 RPM */ +- int err = 0; ++ int err; + + /* Reset chip to default values, see below for GCONFIG setup */ + err = i2c_smbus_write_byte_data(client, MAX6639_REG_GCONFIG, +@@ -446,11 +446,6 @@ static int max6639_init_client(struct i2 + else + data->ppr = 2; + data->ppr -= 1; +- err = i2c_smbus_write_byte_data(client, +- MAX6639_REG_FAN_PPR(i), +- data->ppr << 5); +- if (err) +- goto exit; + + if (max6639_info) + rpm_range = rpm_range_to_reg(max6639_info->rpm_range); +@@ -458,6 +453,13 @@ static int max6639_init_client(struct i2 + + for (i = 0; i < 2; i++) { + ++ /* Set Fan pulse per revolution */ ++ err = i2c_smbus_write_byte_data(client, ++ MAX6639_REG_FAN_PPR(i), ++ data->ppr << 6); ++ if (err) ++ goto exit; ++ + /* Fans config PWM, RPM */ + err = i2c_smbus_write_byte_data(client, + MAX6639_REG_FAN_CONFIG1(i), diff --git a/queue-3.2/nommu-lock-i_mmap_mutex-for-access-to-the-vma-prio-list.patch b/queue-3.2/nommu-lock-i_mmap_mutex-for-access-to-the-vma-prio-list.patch new file mode 100644 index 00000000000..65e18662fa9 --- /dev/null +++ b/queue-3.2/nommu-lock-i_mmap_mutex-for-access-to-the-vma-prio-list.patch @@ -0,0 +1,73 @@ +From 918e556ec214ed2f584e4cac56d7b29e4bb6bf27 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 23 Feb 2012 13:50:35 +0000 +Subject: NOMMU: Lock i_mmap_mutex for access to the VMA prio list + +From: David Howells + +commit 918e556ec214ed2f584e4cac56d7b29e4bb6bf27 upstream. + +Lock i_mmap_mutex for access to the VMA prio list to prevent concurrent +access. Currently, certain parts of the mmap handling are protected by +the region mutex, but not all. + +Reported-by: Al Viro +Signed-off-by: David Howells +Acked-by: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/nommu.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -696,9 +696,11 @@ static void add_vma_to_mm(struct mm_stru + if (vma->vm_file) { + mapping = vma->vm_file->f_mapping; + ++ mutex_lock(&mapping->i_mmap_mutex); + flush_dcache_mmap_lock(mapping); + vma_prio_tree_insert(vma, &mapping->i_mmap); + flush_dcache_mmap_unlock(mapping); ++ mutex_unlock(&mapping->i_mmap_mutex); + } + + /* add the VMA to the tree */ +@@ -760,9 +762,11 @@ static void delete_vma_from_mm(struct vm + if (vma->vm_file) { + mapping = vma->vm_file->f_mapping; + ++ mutex_lock(&mapping->i_mmap_mutex); + flush_dcache_mmap_lock(mapping); + vma_prio_tree_remove(vma, &mapping->i_mmap); + flush_dcache_mmap_unlock(mapping); ++ mutex_unlock(&mapping->i_mmap_mutex); + } + + /* remove from the MM's tree and list */ +@@ -2052,6 +2056,7 @@ int nommu_shrink_inode_mappings(struct i + high = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; + + down_write(&nommu_region_sem); ++ mutex_lock(&inode->i_mapping->i_mmap_mutex); + + /* search for VMAs that fall within the dead zone */ + vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap, +@@ -2059,6 +2064,7 @@ int nommu_shrink_inode_mappings(struct i + /* found one - only interested if it's shared out of the page + * cache */ + if (vma->vm_flags & VM_SHARED) { ++ mutex_unlock(&inode->i_mapping->i_mmap_mutex); + up_write(&nommu_region_sem); + return -ETXTBSY; /* not quite true, but near enough */ + } +@@ -2086,6 +2092,7 @@ int nommu_shrink_inode_mappings(struct i + } + } + ++ mutex_unlock(&inode->i_mapping->i_mmap_mutex); + up_write(&nommu_region_sem); + return 0; + } diff --git a/queue-3.2/series b/queue-3.2/series index b822492a362..50d484a0833 100644 --- a/queue-3.2/series +++ b/queue-3.2/series @@ -43,3 +43,15 @@ usb-don-t-fail-usb3-probe-on-missing-legacy-pci-irq.patch usb-set-hub-depth-after-usb3-hub-reset.patch usb-storage-fix-freezing-of-the-scanning-thread.patch target-allow-control-cdbs-with-data-1-page.patch +asoc-wm8962-fix-sidetone-enumeration-texts.patch +alsa-hda-realtek-fix-overflow-of-vol-sw-check-bitmap.patch +alsa-hda-realtek-fix-surround-output-regression-on-acer-aspire-5935.patch +nommu-lock-i_mmap_mutex-for-access-to-the-vma-prio-list.patch +hwmon-max6639-fix-fan_from_reg-calculation.patch +hwmon-max6639-fix-ppr-register-initialization-to-set-both-channels.patch +hwmon-ads1015-fix-file-leak-in-probe-function.patch +arm-omap-fix-oops-in-drivers-video-omap2-dss-dpi.c.patch +arm-omap-fix-oops-in-arch-arm-mach-omap2-vp.c-when-pmic-is-not-found.patch +x86-amd-fix-l1i-and-l2-cache-sharing-information-for-amd-family-15h-processors.patch +ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch +x86-nmi-test-saved-cs-in-nmi-to-determine-nested-nmi-case.patch diff --git a/queue-3.2/x86-amd-fix-l1i-and-l2-cache-sharing-information-for-amd-family-15h-processors.patch b/queue-3.2/x86-amd-fix-l1i-and-l2-cache-sharing-information-for-amd-family-15h-processors.patch new file mode 100644 index 00000000000..cb1caee6fc4 --- /dev/null +++ b/queue-3.2/x86-amd-fix-l1i-and-l2-cache-sharing-information-for-amd-family-15h-processors.patch @@ -0,0 +1,97 @@ +From 32c3233885eb10ac9cb9410f2f8cd64b8df2b2a1 Mon Sep 17 00:00:00 2001 +From: Andreas Herrmann +Date: Wed, 8 Feb 2012 20:52:29 +0100 +Subject: x86/amd: Fix L1i and L2 cache sharing information for AMD family 15h processors + +From: Andreas Herrmann + +commit 32c3233885eb10ac9cb9410f2f8cd64b8df2b2a1 upstream. + +For L1 instruction cache and L2 cache the shared CPU information +is wrong. On current AMD family 15h CPUs those caches are shared +between both cores of a compute unit. + +This fixes https://bugzilla.kernel.org/show_bug.cgi?id=42607 + +Signed-off-by: Andreas Herrmann +Cc: Petkov Borislav +Cc: Dave Jones +Link: http://lkml.kernel.org/r/20120208195229.GA17523@alberich.amd.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/intel_cacheinfo.c | 44 +++++++++++++++++++++++++++------- + 1 file changed, 36 insertions(+), 8 deletions(-) + +--- a/arch/x86/kernel/cpu/intel_cacheinfo.c ++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c +@@ -326,8 +326,7 @@ static void __cpuinit amd_calc_l3_indice + l3->indices = (max(max3(sc0, sc1, sc2), sc3) << 10) - 1; + } + +-static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf, +- int index) ++static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf, int index) + { + int node; + +@@ -725,14 +724,16 @@ static DEFINE_PER_CPU(struct _cpuid4_inf + #define CPUID4_INFO_IDX(x, y) (&((per_cpu(ici_cpuid4_info, x))[y])) + + #ifdef CONFIG_SMP +-static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index) ++ ++static int __cpuinit cache_shared_amd_cpu_map_setup(unsigned int cpu, int index) + { +- struct _cpuid4_info *this_leaf, *sibling_leaf; +- unsigned long num_threads_sharing; +- int index_msb, i, sibling; ++ struct _cpuid4_info *this_leaf; ++ int ret, i, sibling; + struct cpuinfo_x86 *c = &cpu_data(cpu); + +- if ((index == 3) && (c->x86_vendor == X86_VENDOR_AMD)) { ++ ret = 0; ++ if (index == 3) { ++ ret = 1; + for_each_cpu(i, cpu_llc_shared_mask(cpu)) { + if (!per_cpu(ici_cpuid4_info, i)) + continue; +@@ -743,8 +744,35 @@ static void __cpuinit cache_shared_cpu_m + set_bit(sibling, this_leaf->shared_cpu_map); + } + } +- return; ++ } else if ((c->x86 == 0x15) && ((index == 1) || (index == 2))) { ++ ret = 1; ++ for_each_cpu(i, cpu_sibling_mask(cpu)) { ++ if (!per_cpu(ici_cpuid4_info, i)) ++ continue; ++ this_leaf = CPUID4_INFO_IDX(i, index); ++ for_each_cpu(sibling, cpu_sibling_mask(cpu)) { ++ if (!cpu_online(sibling)) ++ continue; ++ set_bit(sibling, this_leaf->shared_cpu_map); ++ } ++ } + } ++ ++ return ret; ++} ++ ++static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index) ++{ ++ struct _cpuid4_info *this_leaf, *sibling_leaf; ++ unsigned long num_threads_sharing; ++ int index_msb, i; ++ struct cpuinfo_x86 *c = &cpu_data(cpu); ++ ++ if (c->x86_vendor == X86_VENDOR_AMD) { ++ if (cache_shared_amd_cpu_map_setup(cpu, index)) ++ return; ++ } ++ + this_leaf = CPUID4_INFO_IDX(cpu, index); + num_threads_sharing = 1 + this_leaf->base.eax.split.num_threads_sharing; + diff --git a/queue-3.2/x86-nmi-test-saved-cs-in-nmi-to-determine-nested-nmi-case.patch b/queue-3.2/x86-nmi-test-saved-cs-in-nmi-to-determine-nested-nmi-case.patch new file mode 100644 index 00000000000..bf3cce68c04 --- /dev/null +++ b/queue-3.2/x86-nmi-test-saved-cs-in-nmi-to-determine-nested-nmi-case.patch @@ -0,0 +1,49 @@ +From 45d5a1683c04be28abdf5c04c27b1417e0374486 Mon Sep 17 00:00:00 2001 +From: Steven Rostedt +Date: Sun, 19 Feb 2012 16:43:37 -0500 +Subject: x86/nmi: Test saved %cs in NMI to determine nested NMI case + +From: Steven Rostedt + +commit 45d5a1683c04be28abdf5c04c27b1417e0374486 upstream. + +Currently, the NMI handler tests if it is nested by checking the +special variable saved on the stack (set during NMI handling) +and whether the saved stack is the NMI stack as well (to prevent +the race when the variable is set to zero). + +But userspace may set their %rsp to any value as long as they do +not derefence it, and it may make it point to the NMI stack, +which will prevent NMIs from triggering while the userspace app +is running. (I tested this, and it is indeed the case) + +Add another check to determine nested NMIs by looking at the +saved %cs (code segment register) and making sure that it is the +kernel code segment. + +Signed-off-by: Steven Rostedt +Cc: H. Peter Anvin +Cc: Peter Zijlstra +Cc: Linus Torvalds +Link: http://lkml.kernel.org/r/1329687817.1561.27.camel@acer.local.home +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S +index 3fe8239..debd851 100644 +--- a/arch/x86/kernel/entry_64.S ++++ b/arch/x86/kernel/entry_64.S +@@ -1532,6 +1532,13 @@ ENTRY(nmi) + pushq_cfi %rdx + + /* ++ * If %cs was not the kernel segment, then the NMI triggered in user ++ * space, which means it is definitely not nested. ++ */ ++ cmp $__KERNEL_CS, 16(%rsp) ++ jne first_nmi ++ ++ /* + * Check the special variable on the stack to see if NMIs are + * executing. + */ -- 2.47.3