]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.13-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 4 Mar 2014 00:54:48 +0000 (16:54 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 4 Mar 2014 00:54:48 +0000 (16:54 -0800)
added patches:
asoc-da732x-mark-dc-offset-control-registers-volatile.patch
asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch
asoc-fsl-fix-pm-support-of-machine-drivers.patch
asoc-max98090-sync-regcache-on-entering-standby.patch
asoc-rt5640-add-acpi-id-for-intel-baytrail.patch
asoc-sta32x-fix-array-access-overflow.patch
asoc-sta32x-fix-cache-sync.patch
asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch
asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch
asoc-wm8770-fix-wrong-number-of-enum-items.patch
asoc-wm8958-dsp-fix-firmware-block-loading.patch
kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch
kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch

14 files changed:
queue-3.13/asoc-da732x-mark-dc-offset-control-registers-volatile.patch [new file with mode: 0644]
queue-3.13/asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch [new file with mode: 0644]
queue-3.13/asoc-fsl-fix-pm-support-of-machine-drivers.patch [new file with mode: 0644]
queue-3.13/asoc-max98090-sync-regcache-on-entering-standby.patch [new file with mode: 0644]
queue-3.13/asoc-rt5640-add-acpi-id-for-intel-baytrail.patch [new file with mode: 0644]
queue-3.13/asoc-sta32x-fix-array-access-overflow.patch [new file with mode: 0644]
queue-3.13/asoc-sta32x-fix-cache-sync.patch [new file with mode: 0644]
queue-3.13/asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch [new file with mode: 0644]
queue-3.13/asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch [new file with mode: 0644]
queue-3.13/asoc-wm8770-fix-wrong-number-of-enum-items.patch [new file with mode: 0644]
queue-3.13/asoc-wm8958-dsp-fix-firmware-block-loading.patch [new file with mode: 0644]
queue-3.13/kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch [new file with mode: 0644]
queue-3.13/kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch [new file with mode: 0644]
queue-3.13/series

diff --git a/queue-3.13/asoc-da732x-mark-dc-offset-control-registers-volatile.patch b/queue-3.13/asoc-da732x-mark-dc-offset-control-registers-volatile.patch
new file mode 100644 (file)
index 0000000..c6f554c
--- /dev/null
@@ -0,0 +1,53 @@
+From 75306820248e26d15d84acf4e297b9fb27dd3bb2 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@linaro.org>
+Date: Mon, 24 Feb 2014 11:59:14 +0900
+Subject: ASoC: da732x: Mark DC offset control registers volatile
+
+From: Mark Brown <broonie@linaro.org>
+
+commit 75306820248e26d15d84acf4e297b9fb27dd3bb2 upstream.
+
+The driver reads from the DC offset control registers during callibration
+but since the registers are marked as volatile and there is a register
+cache the values will not be read from the hardware after the first reading
+rendering the callibration ineffective.
+
+It appears that the driver was originally written for the ASoC level
+register I/O code but converted to regmap prior to merge and this issue
+was missed during the conversion as the framework level volatile register
+functionality was not being used.
+
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Acked-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/da732x.c |   12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/sound/soc/codecs/da732x.c
++++ b/sound/soc/codecs/da732x.c
+@@ -1268,11 +1268,23 @@ static struct snd_soc_dai_driver da732x_
+       },
+ };
++static bool da732x_volatile(struct device *dev, unsigned int reg)
++{
++      switch (reg) {
++      case DA732X_REG_HPL_DAC_OFF_CNTL:
++      case DA732X_REG_HPR_DAC_OFF_CNTL:
++              return true;
++      default:
++              return false;
++      }
++}
++
+ static const struct regmap_config da732x_regmap = {
+       .reg_bits               = 8,
+       .val_bits               = 8,
+       .max_register           = DA732X_MAX_REG,
++      .volatile_reg           = da732x_volatile,
+       .reg_defaults           = da732x_reg_cache,
+       .num_reg_defaults       = ARRAY_SIZE(da732x_reg_cache),
+       .cache_type             = REGCACHE_RBTREE,
diff --git a/queue-3.13/asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch b/queue-3.13/asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch
new file mode 100644 (file)
index 0000000..4bd75b3
--- /dev/null
@@ -0,0 +1,85 @@
+From 07b0e5b10258b48e5edfb6c8ac156f05510eb775 Mon Sep 17 00:00:00 2001
+From: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Date: Thu, 6 Feb 2014 18:03:07 +0000
+Subject: ASoC: da9055: Fix device registration of PMIC and CODEC devices
+
+From: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+
+commit 07b0e5b10258b48e5edfb6c8ac156f05510eb775 upstream.
+
+Currently the I2C device Ids conflict for the MFD and CODEC so
+cannot be both instantiated on one platform. This patch updates
+the Ids and names to make them unique from each other.
+
+It should be noted that the I2C addresses for both PMIC and CODEC
+are modifiable so instantiation of the two are kept as separate
+devices, rather than instantiating the CODEC from the MFD code.
+
+Signed-off-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Acked-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/da9055-i2c.c  |   12 ++++++++++--
+ sound/soc/codecs/da9055.c |   11 +++++++++--
+ 2 files changed, 19 insertions(+), 4 deletions(-)
+
+--- a/drivers/mfd/da9055-i2c.c
++++ b/drivers/mfd/da9055-i2c.c
+@@ -53,17 +53,25 @@ static int da9055_i2c_remove(struct i2c_
+       return 0;
+ }
++/*
++ * DO NOT change the device Ids. The naming is intentionally specific as both
++ * the PMIC and CODEC parts of this chip are instantiated separately as I2C
++ * devices (both have configurable I2C addresses, and are to all intents and
++ * purposes separate). As a result there are specific DA9055 ids for PMIC
++ * and CODEC, which must be different to operate together.
++ */
+ static struct i2c_device_id da9055_i2c_id[] = {
+-      {"da9055", 0},
++      {"da9055-pmic", 0},
+       { }
+ };
++MODULE_DEVICE_TABLE(i2c, da9055_i2c_id);
+ static struct i2c_driver da9055_i2c_driver = {
+       .probe = da9055_i2c_probe,
+       .remove = da9055_i2c_remove,
+       .id_table = da9055_i2c_id,
+       .driver = {
+-              .name = "da9055",
++              .name = "da9055-pmic",
+               .owner = THIS_MODULE,
+       },
+ };
+--- a/sound/soc/codecs/da9055.c
++++ b/sound/soc/codecs/da9055.c
+@@ -1523,8 +1523,15 @@ static int da9055_remove(struct i2c_clie
+       return 0;
+ }
++/*
++ * DO NOT change the device Ids. The naming is intentionally specific as both
++ * the CODEC and PMIC parts of this chip are instantiated separately as I2C
++ * devices (both have configurable I2C addresses, and are to all intents and
++ * purposes separate). As a result there are specific DA9055 Ids for CODEC
++ * and PMIC, which must be different to operate together.
++ */
+ static const struct i2c_device_id da9055_i2c_id[] = {
+-      { "da9055", 0 },
++      { "da9055-codec", 0 },
+       { }
+ };
+ MODULE_DEVICE_TABLE(i2c, da9055_i2c_id);
+@@ -1532,7 +1539,7 @@ MODULE_DEVICE_TABLE(i2c, da9055_i2c_id);
+ /* I2C codec control layer */
+ static struct i2c_driver da9055_i2c_driver = {
+       .driver = {
+-              .name = "da9055",
++              .name = "da9055-codec",
+               .owner = THIS_MODULE,
+       },
+       .probe          = da9055_i2c_probe,
diff --git a/queue-3.13/asoc-fsl-fix-pm-support-of-machine-drivers.patch b/queue-3.13/asoc-fsl-fix-pm-support-of-machine-drivers.patch
new file mode 100644 (file)
index 0000000..ea77c35
--- /dev/null
@@ -0,0 +1,186 @@
+From 47cf84e17ebb79a20e6244b954c4ea4e18a82d43 Mon Sep 17 00:00:00 2001
+From: Shawn Guo <shawn.guo@linaro.org>
+Date: Sat, 8 Feb 2014 13:20:35 +0800
+Subject: ASoC: fsl: fix pm support of machine drivers
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+commit 47cf84e17ebb79a20e6244b954c4ea4e18a82d43 upstream.
+
+The commit 1abe729 (ASoC: fsl: Add missing pm to current machine
+drivers) enables pm support for a few IMX machine drivers.  But it does
+not update dev drvdata to be the pointer to 'card'.  This causes the
+kernel dump below in system suspend, because snd_soc_suspend() expects
+that the dev drvdata points to 'card', while it still points to the
+private data of machine driver.
+
+This patch fixes imx-sgtl5000 and imx-wm8962 by attaching 'card' to dev
+drvdata and private data to card drvdata.  For imx-mc13783, I simply
+revert the pm change because it must be broken for the same reason and
+I don't have hardware to test pm enabling code.
+
+$ echo mem > /sys/power/state
+PM: Syncing filesystems ... done.
+PM: Preparing system for mem sleep
+mmc1: card e624 removed
+Freezing user space processes ... (elapsed 0.002 seconds) done.
+Freezing remaining freezable tasks ... (elapsed 0.002 seconds) done.
+PM: Entering mem sleep
+INFO: trying to register non-static key.
+the code is fine but needs lockdep annotation.
+turning off the locking correctness validator.
+CPU: 0 PID: 1861 Comm: bash Not tainted 3.14.0-rc1+ #1648
+Backtrace:
+[<80012144>] (dump_backtrace) from [<800122e4>] (show_stack+0x18/0x1c)
+ r6:8079c77c r5:00000c5a r4:00000000 r3:00000000
+[<800122cc>] (show_stack) from [<80637ac0>] (dump_stack+0x78/0x94)
+[<80637a48>] (dump_stack) from [<80028918>] (warn_slowpath_common+0x6c/0x8c)
+ r4:bdb21c38 r3:be62df00
+[<800288ac>] (warn_slowpath_common) from [<800289dc>] (warn_slowpath_fmt+0x38/0x40)
+ r8:be62e3a8 r7:bf122960 r6:00000005 r5:00000000 r4:00000000
+[<800289a8>] (warn_slowpath_fmt) from [<8006518c>] (__lock_acquire+0x1ae0/0x1ce0)
+ r3:8079d598 r2:80799e70
+[<800636ac>] (__lock_acquire) from [<80065894>] (lock_acquire+0x68/0x7c)
+ r10:bdb20000 r9:be62df00 r8:00000000 r7:00000000 r6:60000013 r5:bdb20000
+ r4:00000000
+[<8006582c>] (lock_acquire) from [<8063c938>] (mutex_lock_nested+0x5c/0x3b8)
+ r7:00000000 r6:80dfc78c r5:804be444 r4:bf122928
+[<8063c8dc>] (mutex_lock_nested) from [<804be444>] (snd_soc_suspend+0x34/0x42c)
+ r10:00000000 r9:00000000 r8:00000000 r7:bf1c4444 r6:bf1c4410 r5:be978150
+ r4:be978010
+[<804be410>] (snd_soc_suspend) from [<8034392c>] (platform_pm_suspend+0x34/0x64)
+ r10:00000000 r8:00000000 r7:bf1c4444 r6:bf1c4410 r5:803438f8 r4:bf1c4410
+[<803438f8>] (platform_pm_suspend) from [<80348e18>] (dpm_run_callback.isra.7+0x34/0x6c)
+[<80348de4>] (dpm_run_callback.isra.7) from [<80349354>] (__device_suspend+0x10c/0x220)
+ r9:808dd974 r8:808c4a5c r6:00000002 r5:80e5001c r4:bf1c4410
+[<80349248>] (__device_suspend) from [<8034a338>] (dpm_suspend+0x60/0x220)
+ r7:bf1c4410 r6:808dd90c r5:80e5001c r4:bf1c44c0
+[<8034a2d8>] (dpm_suspend) from [<8034a790>] (dpm_suspend_start+0x60/0x68)
+ r10:8079a818 r9:00000000 r8:00000004 r7:80dfbe90 r6:80641eec r5:00000000
+ r4:00000002
+[<8034a730>] (dpm_suspend_start) from [<8006a788>] (suspend_devices_and_enter+0x74/0x318)
+ r4:00000003 r3:80dfbe98
+[<8006a714>] (suspend_devices_and_enter) from [<8006abd8>] (pm_suspend+0x1ac/0x244)
+ r10:8079a818 r8:00000004 r7:00000003 r6:80641eec r5:00000000 r4:00000003
+[<8006aa2c>] (pm_suspend) from [<80069a4c>] (state_store+0x70/0xc0)
+ r5:00000003 r4:bd85ea40
+[<800699dc>] (state_store) from [<80294034>] (kobj_attr_store+0x1c/0x28)
+ r10:beb9fe08 r8:00000000 r7:bdb21f78 r6:bd85ea40 r5:00000004 r4:beb9fe00
+[<80294018>] (kobj_attr_store) from [<80140f90>] (sysfs_kf_write+0x54/0x58)
+[<80140f3c>] (sysfs_kf_write) from [<8014474c>] (kernfs_fop_write+0xc4/0x160)
+ r6:bd85ea40 r5:beb9fe00 r4:00000004 r3:80140f3c
+[<80144688>] (kernfs_fop_write) from [<800dfa14>] (vfs_write+0xbc/0x184)
+ r10:00000000 r9:00000000 r8:00000000 r7:bdb21f78 r6:00500c08 r5:00000004
+ r4:be782600
+[<800df958>] (vfs_write) from [<800dfe00>] (SyS_write+0x48/0x70)
+ r10:00000000 r8:00000000 r7:00000004 r6:00500c08 r5:00000000 r4:be782600
+[<800dfdb8>] (SyS_write) from [<8000e800>] (ret_fast_syscall+0x0/0x48)
+ r9:bdb20000 r8:8000e9c4 r7:00000004 r6:00500c08 r5:00000004 r4:76eb65e0
+
+Fixes: 1abe729 (ASoC: fsl: Add missing pm to current machine drivers)
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/fsl/imx-mc13783.c  |    1 -
+ sound/soc/fsl/imx-sgtl5000.c |   10 ++++++----
+ sound/soc/fsl/imx-wm8962.c   |   11 +++++++----
+ 3 files changed, 13 insertions(+), 9 deletions(-)
+
+--- a/sound/soc/fsl/imx-mc13783.c
++++ b/sound/soc/fsl/imx-mc13783.c
+@@ -160,7 +160,6 @@ static struct platform_driver imx_mc1378
+       .driver = {
+               .name = "imx_mc13783",
+               .owner = THIS_MODULE,
+-              .pm = &snd_soc_pm_ops,
+       },
+       .probe = imx_mc13783_probe,
+       .remove = imx_mc13783_remove
+--- a/sound/soc/fsl/imx-sgtl5000.c
++++ b/sound/soc/fsl/imx-sgtl5000.c
+@@ -33,8 +33,7 @@ struct imx_sgtl5000_data {
+ static int imx_sgtl5000_dai_init(struct snd_soc_pcm_runtime *rtd)
+ {
+-      struct imx_sgtl5000_data *data = container_of(rtd->card,
+-                                      struct imx_sgtl5000_data, card);
++      struct imx_sgtl5000_data *data = snd_soc_card_get_drvdata(rtd->card);
+       struct device *dev = rtd->card->dev;
+       int ret;
+@@ -159,13 +158,15 @@ static int imx_sgtl5000_probe(struct pla
+       data->card.dapm_widgets = imx_sgtl5000_dapm_widgets;
+       data->card.num_dapm_widgets = ARRAY_SIZE(imx_sgtl5000_dapm_widgets);
++      platform_set_drvdata(pdev, &data->card);
++      snd_soc_card_set_drvdata(&data->card, data);
++
+       ret = devm_snd_soc_register_card(&pdev->dev, &data->card);
+       if (ret) {
+               dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
+               goto fail;
+       }
+-      platform_set_drvdata(pdev, data);
+       of_node_put(ssi_np);
+       of_node_put(codec_np);
+@@ -184,7 +185,8 @@ fail:
+ static int imx_sgtl5000_remove(struct platform_device *pdev)
+ {
+-      struct imx_sgtl5000_data *data = platform_get_drvdata(pdev);
++      struct snd_soc_card *card = platform_get_drvdata(pdev);
++      struct imx_sgtl5000_data *data = snd_soc_card_get_drvdata(card);
+       clk_put(data->codec_clk);
+--- a/sound/soc/fsl/imx-wm8962.c
++++ b/sound/soc/fsl/imx-wm8962.c
+@@ -71,7 +71,7 @@ static int imx_wm8962_set_bias_level(str
+ {
+       struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
+       struct imx_priv *priv = &card_priv;
+-      struct imx_wm8962_data *data = platform_get_drvdata(priv->pdev);
++      struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
+       struct device *dev = &priv->pdev->dev;
+       unsigned int pll_out;
+       int ret;
+@@ -137,7 +137,7 @@ static int imx_wm8962_late_probe(struct
+ {
+       struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
+       struct imx_priv *priv = &card_priv;
+-      struct imx_wm8962_data *data = platform_get_drvdata(priv->pdev);
++      struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
+       struct device *dev = &priv->pdev->dev;
+       int ret;
+@@ -264,13 +264,15 @@ static int imx_wm8962_probe(struct platf
+       data->card.late_probe = imx_wm8962_late_probe;
+       data->card.set_bias_level = imx_wm8962_set_bias_level;
++      platform_set_drvdata(pdev, &data->card);
++      snd_soc_card_set_drvdata(&data->card, data);
++
+       ret = devm_snd_soc_register_card(&pdev->dev, &data->card);
+       if (ret) {
+               dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
+               goto clk_fail;
+       }
+-      platform_set_drvdata(pdev, data);
+       of_node_put(ssi_np);
+       of_node_put(codec_np);
+@@ -289,7 +291,8 @@ fail:
+ static int imx_wm8962_remove(struct platform_device *pdev)
+ {
+-      struct imx_wm8962_data *data = platform_get_drvdata(pdev);
++      struct snd_soc_card *card = platform_get_drvdata(pdev);
++      struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
+       if (!IS_ERR(data->codec_clk))
+               clk_disable_unprepare(data->codec_clk);
diff --git a/queue-3.13/asoc-max98090-sync-regcache-on-entering-standby.patch b/queue-3.13/asoc-max98090-sync-regcache-on-entering-standby.patch
new file mode 100644 (file)
index 0000000..8015399
--- /dev/null
@@ -0,0 +1,59 @@
+From c42c8922c46d33ed769e99618bdfba06866a0c72 Mon Sep 17 00:00:00 2001
+From: Dylan Reid <dgreid@chromium.org>
+Date: Wed, 12 Feb 2014 10:24:54 -0800
+Subject: ASoC: max98090: sync regcache on entering STANDBY
+
+From: Dylan Reid <dgreid@chromium.org>
+
+commit c42c8922c46d33ed769e99618bdfba06866a0c72 upstream.
+
+Sync regcache when entering STANDBY from OFF.  ON isn't entered with
+OFF as the current state, so the registers were not being re-synced
+after suspend/resume.
+
+The 98088 and 98095 already call regcache_sync from STANDBY.
+
+Signed-off-by: Dylan Reid <dgreid@chromium.org>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/max98090.c |   20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1769,16 +1769,6 @@ static int max98090_set_bias_level(struc
+       switch (level) {
+       case SND_SOC_BIAS_ON:
+-              if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) {
+-                      ret = regcache_sync(max98090->regmap);
+-
+-                      if (ret != 0) {
+-                              dev_err(codec->dev,
+-                                      "Failed to sync cache: %d\n", ret);
+-                              return ret;
+-                      }
+-              }
+-
+               if (max98090->jack_state == M98090_JACK_STATE_HEADSET) {
+                       /*
+                        * Set to normal bias level.
+@@ -1792,6 +1782,16 @@ static int max98090_set_bias_level(struc
+               break;
+       case SND_SOC_BIAS_STANDBY:
++              if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) {
++                      ret = regcache_sync(max98090->regmap);
++                      if (ret != 0) {
++                              dev_err(codec->dev,
++                                      "Failed to sync cache: %d\n", ret);
++                              return ret;
++                      }
++              }
++              break;
++
+       case SND_SOC_BIAS_OFF:
+               /* Set internal pull-up to lowest power mode */
+               snd_soc_update_bits(codec, M98090_REG_JACK_DETECT,
diff --git a/queue-3.13/asoc-rt5640-add-acpi-id-for-intel-baytrail.patch b/queue-3.13/asoc-rt5640-add-acpi-id-for-intel-baytrail.patch
new file mode 100644 (file)
index 0000000..d8bd07e
--- /dev/null
@@ -0,0 +1,29 @@
+From b31b2b6d5de71c569413d8dc4f7b050cbe25a09e Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Fri, 7 Feb 2014 09:35:16 +0200
+Subject: ASoC: rt5640: Add ACPI ID for Intel Baytrail
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+commit b31b2b6d5de71c569413d8dc4f7b050cbe25a09e upstream.
+
+Realtek RT5640 uses ACPI ID "10EC5640" for Intel Baytrail platforms.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5640.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -2093,6 +2093,7 @@ MODULE_DEVICE_TABLE(i2c, rt5640_i2c_id);
+ #ifdef CONFIG_ACPI
+ static struct acpi_device_id rt5640_acpi_match[] = {
+       { "INT33CA", 0 },
++      { "10EC5640", 0 },
+       { },
+ };
+ MODULE_DEVICE_TABLE(acpi, rt5640_acpi_match);
diff --git a/queue-3.13/asoc-sta32x-fix-array-access-overflow.patch b/queue-3.13/asoc-sta32x-fix-array-access-overflow.patch
new file mode 100644 (file)
index 0000000..04b864a
--- /dev/null
@@ -0,0 +1,105 @@
+From 025c3fa9256d4c54506b7a29dc3befac54f5c68d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 18 Feb 2014 09:24:12 +0100
+Subject: ASoC: sta32x: Fix array access overflow
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 025c3fa9256d4c54506b7a29dc3befac54f5c68d upstream.
+
+Preset EQ enum of sta32x codec driver declares too many number of
+items and it may lead to the access over the actual array size.
+
+Use SOC_ENUM_SINGLE_DECL() helper and it's automatically fixed.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/sta32x.c |   72 +++++++++++++++++++++++-----------------------
+ 1 file changed, 36 insertions(+), 36 deletions(-)
+
+--- a/sound/soc/codecs/sta32x.c
++++ b/sound/soc/codecs/sta32x.c
+@@ -187,42 +187,42 @@ static const unsigned int sta32x_limiter
+       13, 16, TLV_DB_SCALE_ITEM(-1500, 300, 0),
+ };
+-static const struct soc_enum sta32x_drc_ac_enum =
+-      SOC_ENUM_SINGLE(STA32X_CONFD, STA32X_CONFD_DRC_SHIFT,
+-                      2, sta32x_drc_ac);
+-static const struct soc_enum sta32x_auto_eq_enum =
+-      SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT,
+-                      3, sta32x_auto_eq_mode);
+-static const struct soc_enum sta32x_auto_gc_enum =
+-      SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT,
+-                      4, sta32x_auto_gc_mode);
+-static const struct soc_enum sta32x_auto_xo_enum =
+-      SOC_ENUM_SINGLE(STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT,
+-                      16, sta32x_auto_xo_mode);
+-static const struct soc_enum sta32x_preset_eq_enum =
+-      SOC_ENUM_SINGLE(STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT,
+-                      32, sta32x_preset_eq_mode);
+-static const struct soc_enum sta32x_limiter_ch1_enum =
+-      SOC_ENUM_SINGLE(STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT,
+-                      3, sta32x_limiter_select);
+-static const struct soc_enum sta32x_limiter_ch2_enum =
+-      SOC_ENUM_SINGLE(STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT,
+-                      3, sta32x_limiter_select);
+-static const struct soc_enum sta32x_limiter_ch3_enum =
+-      SOC_ENUM_SINGLE(STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT,
+-                      3, sta32x_limiter_select);
+-static const struct soc_enum sta32x_limiter1_attack_rate_enum =
+-      SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxA_SHIFT,
+-                      16, sta32x_limiter_attack_rate);
+-static const struct soc_enum sta32x_limiter2_attack_rate_enum =
+-      SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxA_SHIFT,
+-                      16, sta32x_limiter_attack_rate);
+-static const struct soc_enum sta32x_limiter1_release_rate_enum =
+-      SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxR_SHIFT,
+-                      16, sta32x_limiter_release_rate);
+-static const struct soc_enum sta32x_limiter2_release_rate_enum =
+-      SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxR_SHIFT,
+-                      16, sta32x_limiter_release_rate);
++static SOC_ENUM_SINGLE_DECL(sta32x_drc_ac_enum,
++                          STA32X_CONFD, STA32X_CONFD_DRC_SHIFT,
++                          sta32x_drc_ac);
++static SOC_ENUM_SINGLE_DECL(sta32x_auto_eq_enum,
++                          STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT,
++                          sta32x_auto_eq_mode);
++static SOC_ENUM_SINGLE_DECL(sta32x_auto_gc_enum,
++                          STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT,
++                          sta32x_auto_gc_mode);
++static SOC_ENUM_SINGLE_DECL(sta32x_auto_xo_enum,
++                          STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT,
++                          sta32x_auto_xo_mode);
++static SOC_ENUM_SINGLE_DECL(sta32x_preset_eq_enum,
++                          STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT,
++                          sta32x_preset_eq_mode);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch1_enum,
++                          STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT,
++                          sta32x_limiter_select);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch2_enum,
++                          STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT,
++                          sta32x_limiter_select);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch3_enum,
++                          STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT,
++                          sta32x_limiter_select);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_attack_rate_enum,
++                          STA32X_L1AR, STA32X_LxA_SHIFT,
++                          sta32x_limiter_attack_rate);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_attack_rate_enum,
++                          STA32X_L2AR, STA32X_LxA_SHIFT,
++                          sta32x_limiter_attack_rate);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_release_rate_enum,
++                          STA32X_L1AR, STA32X_LxR_SHIFT,
++                          sta32x_limiter_release_rate);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
++                          STA32X_L2AR, STA32X_LxR_SHIFT,
++                          sta32x_limiter_release_rate);
+ /* byte array controls for setting biquad, mixer, scaling coefficients;
+  * for biquads all five coefficients need to be set in one go,
diff --git a/queue-3.13/asoc-sta32x-fix-cache-sync.patch b/queue-3.13/asoc-sta32x-fix-cache-sync.patch
new file mode 100644 (file)
index 0000000..6b4ede4
--- /dev/null
@@ -0,0 +1,35 @@
+From 70ff00f82a6af0ff68f8f7b411738634ce2f20d0 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Sat, 22 Feb 2014 18:27:17 +0100
+Subject: ASoC: sta32x: Fix cache sync
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit 70ff00f82a6af0ff68f8f7b411738634ce2f20d0 upstream.
+
+codec->control_data contains a pointer to the regmap struct of the device, not
+to the device private data. Use snd_soc_codec_get_drvdata() instead.
+
+The issue was introduced in commit 29fdf4fbbe ("ASoC: sta32x: Convert to
+regmap").
+
+Fixes: 29fdf4fbbe (ASoC: sta32x: Convert to regmap)
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/sta32x.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/sta32x.c
++++ b/sound/soc/codecs/sta32x.c
+@@ -331,7 +331,7 @@ static int sta32x_sync_coef_shadow(struc
+ static int sta32x_cache_sync(struct snd_soc_codec *codec)
+ {
+-      struct sta32x_priv *sta32x = codec->control_data;
++      struct sta32x_priv *sta32x = snd_soc_codec_get_drvdata(codec);
+       unsigned int mute;
+       int rc;
diff --git a/queue-3.13/asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch b/queue-3.13/asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch
new file mode 100644 (file)
index 0000000..a7dda90
--- /dev/null
@@ -0,0 +1,46 @@
+From b3619b288b621e63f66908045f48495869a996a6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 27 Feb 2014 07:41:32 +0100
+Subject: ASoC: sta32x: Fix wrong enum for limiter2 release rate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b3619b288b621e63f66908045f48495869a996a6 upstream.
+
+There is a typo in the Limiter2 Release Rate control, a wrong enum for
+Limiter1 is assigned.  It must point to Limiter2.
+Spotted by a compile warning:
+
+In file included from sound/soc/codecs/sta32x.c:34:0:
+sound/soc/codecs/sta32x.c:223:29: warning: ‘sta32x_limiter2_release_rate_enum’ defined but not used [-Wunused-variable]
+ static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
+                             ^
+include/sound/soc.h:275:18: note: in definition of macro ‘SOC_ENUM_DOUBLE_DECL’
+  struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
+                  ^
+sound/soc/codecs/sta32x.c:223:8: note: in expansion of macro ‘SOC_ENUM_SINGLE_DECL’
+ static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
+        ^
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/sta32x.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/sta32x.c
++++ b/sound/soc/codecs/sta32x.c
+@@ -434,7 +434,7 @@ SOC_SINGLE_TLV("Treble Tone Control", ST
+ SOC_ENUM("Limiter1 Attack Rate (dB/ms)", sta32x_limiter1_attack_rate_enum),
+ SOC_ENUM("Limiter2 Attack Rate (dB/ms)", sta32x_limiter2_attack_rate_enum),
+ SOC_ENUM("Limiter1 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum),
+-SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum),
++SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter2_release_rate_enum),
+ /* depending on mode, the attack/release thresholds have
+  * two different enum definitions; provide both
diff --git a/queue-3.13/asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch b/queue-3.13/asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch
new file mode 100644 (file)
index 0000000..e28997f
--- /dev/null
@@ -0,0 +1,45 @@
+From 9febd494d15c4a351e9c9cae7184643144eea892 Mon Sep 17 00:00:00 2001
+From: Alexander Shiyan <shc_work@mail.ru>
+Date: Sat, 15 Feb 2014 23:28:29 +0400
+Subject: ASoC: txx9aclc_ac97: Fix kernel crash on probe
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+commit 9febd494d15c4a351e9c9cae7184643144eea892 upstream.
+
+This patch fixes a crash caused by commit 3bed3344c826
+(ASoC: txx9aclc_ac97: Convert to devm_ioremap_resource()).
+This is an attempt to assign "drvdata->base" while memory
+for "drvdata" is not already allocated.
+
+Fixes: 3bed3344c826 (ASoC: txx9aclc_ac97: Convert to devm_ioremap_resource())
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/txx9/txx9aclc-ac97.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/txx9/txx9aclc-ac97.c
++++ b/sound/soc/txx9/txx9aclc-ac97.c
+@@ -183,14 +183,16 @@ static int txx9aclc_ac97_dev_probe(struc
+       irq = platform_get_irq(pdev, 0);
+       if (irq < 0)
+               return irq;
++
++      drvdata = devm_kzalloc(&pdev->dev, sizeof(*drvdata), GFP_KERNEL);
++      if (!drvdata)
++              return -ENOMEM;
++
+       r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+       drvdata->base = devm_ioremap_resource(&pdev->dev, r);
+       if (IS_ERR(drvdata->base))
+               return PTR_ERR(drvdata->base);
+-      drvdata = devm_kzalloc(&pdev->dev, sizeof(*drvdata), GFP_KERNEL);
+-      if (!drvdata)
+-              return -ENOMEM;
+       platform_set_drvdata(pdev, drvdata);
+       drvdata->physbase = r->start;
+       if (sizeof(drvdata->physbase) > sizeof(r->start) &&
diff --git a/queue-3.13/asoc-wm8770-fix-wrong-number-of-enum-items.patch b/queue-3.13/asoc-wm8770-fix-wrong-number-of-enum-items.patch
new file mode 100644 (file)
index 0000000..1bd34ef
--- /dev/null
@@ -0,0 +1,37 @@
+From 7a6c0a58dc824523966f212c76322d47c5b0e6fe Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 18 Feb 2014 09:37:30 +0100
+Subject: ASoC: wm8770: Fix wrong number of enum items
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 7a6c0a58dc824523966f212c76322d47c5b0e6fe upstream.
+
+wm8770 codec driver defines ain_enum with a wrong number of items.
+
+Use SOC_ENUM_DOUBLE_DECL() macro and it's automatically fixed.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8770.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/wm8770.c
++++ b/sound/soc/codecs/wm8770.c
+@@ -196,8 +196,8 @@ static const char *ain_text[] = {
+       "AIN5", "AIN6", "AIN7", "AIN8"
+ };
+-static const struct soc_enum ain_enum =
+-      SOC_ENUM_DOUBLE(WM8770_ADCMUX, 0, 4, 8, ain_text);
++static SOC_ENUM_DOUBLE_DECL(ain_enum,
++                          WM8770_ADCMUX, 0, 4, ain_text);
+ static const struct snd_kcontrol_new ain_mux =
+       SOC_DAPM_ENUM("Capture Mux", ain_enum);
diff --git a/queue-3.13/asoc-wm8958-dsp-fix-firmware-block-loading.patch b/queue-3.13/asoc-wm8958-dsp-fix-firmware-block-loading.patch
new file mode 100644 (file)
index 0000000..cebcee9
--- /dev/null
@@ -0,0 +1,35 @@
+From 548da08fc1e245faf9b0d7c41ecd8e07984fc332 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Sat, 22 Feb 2014 18:30:13 +0100
+Subject: ASoC: wm8958-dsp: Fix firmware block loading
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit 548da08fc1e245faf9b0d7c41ecd8e07984fc332 upstream.
+
+The codec->control_data contains a pointer to the device's regmap struct. But
+wm8994_bulk_write() expects a pointer to the parent wm8998 device.
+
+The issue was introduced in commit d9a7666f ("ASoC: Remove ASoC-specific
+WM8994 I/O code").
+
+Fixes: d9a7666f ("ASoC: Remove ASoC-specific WM8994 I/O code")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8958-dsp2.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8958-dsp2.c
++++ b/sound/soc/codecs/wm8958-dsp2.c
+@@ -153,7 +153,7 @@ static int wm8958_dsp2_fw(struct snd_soc
+                       data32 &= 0xffffff;
+-                      wm8994_bulk_write(codec->control_data,
++                      wm8994_bulk_write(wm8994->wm8994,
+                                         data32 & 0xffffff,
+                                         block_len / 2,
+                                         (void *)(data + 8));
diff --git a/queue-3.13/kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch b/queue-3.13/kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch
new file mode 100644 (file)
index 0000000..b90427e
--- /dev/null
@@ -0,0 +1,43 @@
+From 1b385cbdd74aa803e966e01e5fe49490d6044e30 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 27 Feb 2014 22:54:11 +0100
+Subject: kvm, vmx: Really fix lazy FPU on nested guest
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 1b385cbdd74aa803e966e01e5fe49490d6044e30 upstream.
+
+Commit e504c9098ed6 (kvm, vmx: Fix lazy FPU on nested guest, 2013-11-13)
+highlighted a real problem, but the fix was subtly wrong.
+
+nested_read_cr0 is the CR0 as read by L2, but here we want to look at
+the CR0 value reflecting L1's setup.  In other words, L2 might think
+that TS=0 (so nested_read_cr0 has the bit clear); but if L1 is actually
+running it with TS=1, we should inject the fault into L1.
+
+The effective value of CR0 in L2 is contained in vmcs12->guest_cr0, use
+it.
+
+Fixes: e504c9098ed6acd9e1079c5e10e4910724ad429f
+Reported-by: Kashyap Chamarty <kchamart@redhat.com>
+Reported-by: Stefan Bader <stefan.bader@canonical.com>
+Tested-by: Kashyap Chamarty <kchamart@redhat.com>
+Tested-by: Anthoine Bourgeois <bourgeois@bertin.fr>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6644,7 +6644,7 @@ static bool nested_vmx_exit_handled(stru
+               else if (is_page_fault(intr_info))
+                       return enable_ept;
+               else if (is_no_device(intr_info) &&
+-                       !(nested_read_cr0(vmcs12) & X86_CR0_TS))
++                       !(vmcs12->guest_cr0 & X86_CR0_TS))
+                       return 0;
+               return vmcs12->exception_bitmap &
+                               (1u << (intr_info & INTR_INFO_VECTOR_MASK));
diff --git a/queue-3.13/kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch b/queue-3.13/kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch
new file mode 100644 (file)
index 0000000..f57518f
--- /dev/null
@@ -0,0 +1,50 @@
+From a08d3b3b99efd509133946056531cdf8f3a0c09b Mon Sep 17 00:00:00 2001
+From: Andrew Honig <ahonig@google.com>
+Date: Thu, 27 Feb 2014 19:35:14 +0100
+Subject: kvm: x86: fix emulator buffer overflow (CVE-2014-0049)
+
+From: Andrew Honig <ahonig@google.com>
+
+commit a08d3b3b99efd509133946056531cdf8f3a0c09b upstream.
+
+The problem occurs when the guest performs a pusha with the stack
+address pointing to an mmio address (or an invalid guest physical
+address) to start with, but then extending into an ordinary guest
+physical address.  When doing repeated emulated pushes
+emulator_read_write sets mmio_needed to 1 on the first one.  On a
+later push when the stack points to regular memory,
+mmio_nr_fragments is set to 0, but mmio_is_needed is not set to 0.
+
+As a result, KVM exits to userspace, and then returns to
+complete_emulated_mmio.  In complete_emulated_mmio
+vcpu->mmio_cur_fragment is incremented.  The termination condition of
+vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments is never achieved.
+The code bounces back and fourth to userspace incrementing
+mmio_cur_fragment past it's buffer.  If the guest does nothing else it
+eventually leads to a a crash on a memcpy from invalid memory address.
+
+However if a guest code can cause the vm to be destroyed in another
+vcpu with excellent timing, then kvm_clear_async_pf_completion_queue
+can be used by the guest to control the data that's pointed to by the
+call to cancel_work_item, which can be used to gain execution.
+
+Fixes: f78146b0f9230765c6315b2e14f56112513389ad
+Signed-off-by: Andrew Honig <ahonig@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/x86.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6163,7 +6163,7 @@ static int complete_emulated_mmio(struct
+               frag->len -= len;
+       }
+-      if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) {
++      if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) {
+               vcpu->mmio_needed = 0;
+               /* FIXME: return into emulator if single-stepping.  */
index 09496d0b0540235a4ba561bc46c666d37cbca803..223f93333b571f16ac4ee3c16fce0241853d2d7e 100644 (file)
@@ -81,3 +81,16 @@ cgroup-fix-locking-in-cgroup_cfts_commit.patch
 cgroup-update-cgroup_enable_task_cg_lists-to-grab-siglock.patch
 fs-fix-iversion-handling.patch
 export-declare-ksymtab-symbols.patch
+kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch
+kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch
+asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch
+asoc-rt5640-add-acpi-id-for-intel-baytrail.patch
+asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch
+asoc-fsl-fix-pm-support-of-machine-drivers.patch
+asoc-max98090-sync-regcache-on-entering-standby.patch
+asoc-wm8770-fix-wrong-number-of-enum-items.patch
+asoc-da732x-mark-dc-offset-control-registers-volatile.patch
+asoc-sta32x-fix-cache-sync.patch
+asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch
+asoc-sta32x-fix-array-access-overflow.patch
+asoc-wm8958-dsp-fix-firmware-block-loading.patch