From f5a5b3930c3f7963a26901450c0356586c29c928 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 3 Mar 2014 16:54:48 -0800 Subject: [PATCH] 3.13-stable patches added patches: asoc-da732x-mark-dc-offset-control-registers-volatile.patch asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch asoc-fsl-fix-pm-support-of-machine-drivers.patch asoc-max98090-sync-regcache-on-entering-standby.patch asoc-rt5640-add-acpi-id-for-intel-baytrail.patch asoc-sta32x-fix-array-access-overflow.patch asoc-sta32x-fix-cache-sync.patch asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch asoc-wm8770-fix-wrong-number-of-enum-items.patch asoc-wm8958-dsp-fix-firmware-block-loading.patch kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch --- ...dc-offset-control-registers-volatile.patch | 53 +++++ ...gistration-of-pmic-and-codec-devices.patch | 85 ++++++++ ...sl-fix-pm-support-of-machine-drivers.patch | 186 ++++++++++++++++++ ...90-sync-regcache-on-entering-standby.patch | 59 ++++++ ...t5640-add-acpi-id-for-intel-baytrail.patch | 29 +++ ...soc-sta32x-fix-array-access-overflow.patch | 105 ++++++++++ queue-3.13/asoc-sta32x-fix-cache-sync.patch | 35 ++++ ...wrong-enum-for-limiter2-release-rate.patch | 46 +++++ ...9aclc_ac97-fix-kernel-crash-on-probe.patch | 45 +++++ ...m8770-fix-wrong-number-of-enum-items.patch | 37 ++++ ...m8958-dsp-fix-firmware-block-loading.patch | 35 ++++ ...-really-fix-lazy-fpu-on-nested-guest.patch | 43 ++++ ...ulator-buffer-overflow-cve-2014-0049.patch | 50 +++++ queue-3.13/series | 13 ++ 14 files changed, 821 insertions(+) create mode 100644 queue-3.13/asoc-da732x-mark-dc-offset-control-registers-volatile.patch create mode 100644 queue-3.13/asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch create mode 100644 queue-3.13/asoc-fsl-fix-pm-support-of-machine-drivers.patch create mode 100644 queue-3.13/asoc-max98090-sync-regcache-on-entering-standby.patch create mode 100644 queue-3.13/asoc-rt5640-add-acpi-id-for-intel-baytrail.patch create mode 100644 queue-3.13/asoc-sta32x-fix-array-access-overflow.patch create mode 100644 queue-3.13/asoc-sta32x-fix-cache-sync.patch create mode 100644 queue-3.13/asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch create mode 100644 queue-3.13/asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch create mode 100644 queue-3.13/asoc-wm8770-fix-wrong-number-of-enum-items.patch create mode 100644 queue-3.13/asoc-wm8958-dsp-fix-firmware-block-loading.patch create mode 100644 queue-3.13/kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch create mode 100644 queue-3.13/kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch diff --git a/queue-3.13/asoc-da732x-mark-dc-offset-control-registers-volatile.patch b/queue-3.13/asoc-da732x-mark-dc-offset-control-registers-volatile.patch new file mode 100644 index 00000000000..c6f554ccbed --- /dev/null +++ b/queue-3.13/asoc-da732x-mark-dc-offset-control-registers-volatile.patch @@ -0,0 +1,53 @@ +From 75306820248e26d15d84acf4e297b9fb27dd3bb2 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Mon, 24 Feb 2014 11:59:14 +0900 +Subject: ASoC: da732x: Mark DC offset control registers volatile + +From: Mark Brown + +commit 75306820248e26d15d84acf4e297b9fb27dd3bb2 upstream. + +The driver reads from the DC offset control registers during callibration +but since the registers are marked as volatile and there is a register +cache the values will not be read from the hardware after the first reading +rendering the callibration ineffective. + +It appears that the driver was originally written for the ASoC level +register I/O code but converted to regmap prior to merge and this issue +was missed during the conversion as the framework level volatile register +functionality was not being used. + +Signed-off-by: Mark Brown +Acked-by: Adam Thomson +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/da732x.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/sound/soc/codecs/da732x.c ++++ b/sound/soc/codecs/da732x.c +@@ -1268,11 +1268,23 @@ static struct snd_soc_dai_driver da732x_ + }, + }; + ++static bool da732x_volatile(struct device *dev, unsigned int reg) ++{ ++ switch (reg) { ++ case DA732X_REG_HPL_DAC_OFF_CNTL: ++ case DA732X_REG_HPR_DAC_OFF_CNTL: ++ return true; ++ default: ++ return false; ++ } ++} ++ + static const struct regmap_config da732x_regmap = { + .reg_bits = 8, + .val_bits = 8, + + .max_register = DA732X_MAX_REG, ++ .volatile_reg = da732x_volatile, + .reg_defaults = da732x_reg_cache, + .num_reg_defaults = ARRAY_SIZE(da732x_reg_cache), + .cache_type = REGCACHE_RBTREE, diff --git a/queue-3.13/asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch b/queue-3.13/asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch new file mode 100644 index 00000000000..4bd75b34964 --- /dev/null +++ b/queue-3.13/asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch @@ -0,0 +1,85 @@ +From 07b0e5b10258b48e5edfb6c8ac156f05510eb775 Mon Sep 17 00:00:00 2001 +From: Adam Thomson +Date: Thu, 6 Feb 2014 18:03:07 +0000 +Subject: ASoC: da9055: Fix device registration of PMIC and CODEC devices + +From: Adam Thomson + +commit 07b0e5b10258b48e5edfb6c8ac156f05510eb775 upstream. + +Currently the I2C device Ids conflict for the MFD and CODEC so +cannot be both instantiated on one platform. This patch updates +the Ids and names to make them unique from each other. + +It should be noted that the I2C addresses for both PMIC and CODEC +are modifiable so instantiation of the two are kept as separate +devices, rather than instantiating the CODEC from the MFD code. + +Signed-off-by: Adam Thomson +Acked-by: Mark Brown +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/da9055-i2c.c | 12 ++++++++++-- + sound/soc/codecs/da9055.c | 11 +++++++++-- + 2 files changed, 19 insertions(+), 4 deletions(-) + +--- a/drivers/mfd/da9055-i2c.c ++++ b/drivers/mfd/da9055-i2c.c +@@ -53,17 +53,25 @@ static int da9055_i2c_remove(struct i2c_ + return 0; + } + ++/* ++ * DO NOT change the device Ids. The naming is intentionally specific as both ++ * the PMIC and CODEC parts of this chip are instantiated separately as I2C ++ * devices (both have configurable I2C addresses, and are to all intents and ++ * purposes separate). As a result there are specific DA9055 ids for PMIC ++ * and CODEC, which must be different to operate together. ++ */ + static struct i2c_device_id da9055_i2c_id[] = { +- {"da9055", 0}, ++ {"da9055-pmic", 0}, + { } + }; ++MODULE_DEVICE_TABLE(i2c, da9055_i2c_id); + + static struct i2c_driver da9055_i2c_driver = { + .probe = da9055_i2c_probe, + .remove = da9055_i2c_remove, + .id_table = da9055_i2c_id, + .driver = { +- .name = "da9055", ++ .name = "da9055-pmic", + .owner = THIS_MODULE, + }, + }; +--- a/sound/soc/codecs/da9055.c ++++ b/sound/soc/codecs/da9055.c +@@ -1523,8 +1523,15 @@ static int da9055_remove(struct i2c_clie + return 0; + } + ++/* ++ * DO NOT change the device Ids. The naming is intentionally specific as both ++ * the CODEC and PMIC parts of this chip are instantiated separately as I2C ++ * devices (both have configurable I2C addresses, and are to all intents and ++ * purposes separate). As a result there are specific DA9055 Ids for CODEC ++ * and PMIC, which must be different to operate together. ++ */ + static const struct i2c_device_id da9055_i2c_id[] = { +- { "da9055", 0 }, ++ { "da9055-codec", 0 }, + { } + }; + MODULE_DEVICE_TABLE(i2c, da9055_i2c_id); +@@ -1532,7 +1539,7 @@ MODULE_DEVICE_TABLE(i2c, da9055_i2c_id); + /* I2C codec control layer */ + static struct i2c_driver da9055_i2c_driver = { + .driver = { +- .name = "da9055", ++ .name = "da9055-codec", + .owner = THIS_MODULE, + }, + .probe = da9055_i2c_probe, diff --git a/queue-3.13/asoc-fsl-fix-pm-support-of-machine-drivers.patch b/queue-3.13/asoc-fsl-fix-pm-support-of-machine-drivers.patch new file mode 100644 index 00000000000..ea77c359231 --- /dev/null +++ b/queue-3.13/asoc-fsl-fix-pm-support-of-machine-drivers.patch @@ -0,0 +1,186 @@ +From 47cf84e17ebb79a20e6244b954c4ea4e18a82d43 Mon Sep 17 00:00:00 2001 +From: Shawn Guo +Date: Sat, 8 Feb 2014 13:20:35 +0800 +Subject: ASoC: fsl: fix pm support of machine drivers + +From: Shawn Guo + +commit 47cf84e17ebb79a20e6244b954c4ea4e18a82d43 upstream. + +The commit 1abe729 (ASoC: fsl: Add missing pm to current machine +drivers) enables pm support for a few IMX machine drivers. But it does +not update dev drvdata to be the pointer to 'card'. This causes the +kernel dump below in system suspend, because snd_soc_suspend() expects +that the dev drvdata points to 'card', while it still points to the +private data of machine driver. + +This patch fixes imx-sgtl5000 and imx-wm8962 by attaching 'card' to dev +drvdata and private data to card drvdata. For imx-mc13783, I simply +revert the pm change because it must be broken for the same reason and +I don't have hardware to test pm enabling code. + +$ echo mem > /sys/power/state +PM: Syncing filesystems ... done. +PM: Preparing system for mem sleep +mmc1: card e624 removed +Freezing user space processes ... (elapsed 0.002 seconds) done. +Freezing remaining freezable tasks ... (elapsed 0.002 seconds) done. +PM: Entering mem sleep +INFO: trying to register non-static key. +the code is fine but needs lockdep annotation. +turning off the locking correctness validator. +CPU: 0 PID: 1861 Comm: bash Not tainted 3.14.0-rc1+ #1648 +Backtrace: +[<80012144>] (dump_backtrace) from [<800122e4>] (show_stack+0x18/0x1c) + r6:8079c77c r5:00000c5a r4:00000000 r3:00000000 +[<800122cc>] (show_stack) from [<80637ac0>] (dump_stack+0x78/0x94) +[<80637a48>] (dump_stack) from [<80028918>] (warn_slowpath_common+0x6c/0x8c) + r4:bdb21c38 r3:be62df00 +[<800288ac>] (warn_slowpath_common) from [<800289dc>] (warn_slowpath_fmt+0x38/0x40) + r8:be62e3a8 r7:bf122960 r6:00000005 r5:00000000 r4:00000000 +[<800289a8>] (warn_slowpath_fmt) from [<8006518c>] (__lock_acquire+0x1ae0/0x1ce0) + r3:8079d598 r2:80799e70 +[<800636ac>] (__lock_acquire) from [<80065894>] (lock_acquire+0x68/0x7c) + r10:bdb20000 r9:be62df00 r8:00000000 r7:00000000 r6:60000013 r5:bdb20000 + r4:00000000 +[<8006582c>] (lock_acquire) from [<8063c938>] (mutex_lock_nested+0x5c/0x3b8) + r7:00000000 r6:80dfc78c r5:804be444 r4:bf122928 +[<8063c8dc>] (mutex_lock_nested) from [<804be444>] (snd_soc_suspend+0x34/0x42c) + r10:00000000 r9:00000000 r8:00000000 r7:bf1c4444 r6:bf1c4410 r5:be978150 + r4:be978010 +[<804be410>] (snd_soc_suspend) from [<8034392c>] (platform_pm_suspend+0x34/0x64) + r10:00000000 r8:00000000 r7:bf1c4444 r6:bf1c4410 r5:803438f8 r4:bf1c4410 +[<803438f8>] (platform_pm_suspend) from [<80348e18>] (dpm_run_callback.isra.7+0x34/0x6c) +[<80348de4>] (dpm_run_callback.isra.7) from [<80349354>] (__device_suspend+0x10c/0x220) + r9:808dd974 r8:808c4a5c r6:00000002 r5:80e5001c r4:bf1c4410 +[<80349248>] (__device_suspend) from [<8034a338>] (dpm_suspend+0x60/0x220) + r7:bf1c4410 r6:808dd90c r5:80e5001c r4:bf1c44c0 +[<8034a2d8>] (dpm_suspend) from [<8034a790>] (dpm_suspend_start+0x60/0x68) + r10:8079a818 r9:00000000 r8:00000004 r7:80dfbe90 r6:80641eec r5:00000000 + r4:00000002 +[<8034a730>] (dpm_suspend_start) from [<8006a788>] (suspend_devices_and_enter+0x74/0x318) + r4:00000003 r3:80dfbe98 +[<8006a714>] (suspend_devices_and_enter) from [<8006abd8>] (pm_suspend+0x1ac/0x244) + r10:8079a818 r8:00000004 r7:00000003 r6:80641eec r5:00000000 r4:00000003 +[<8006aa2c>] (pm_suspend) from [<80069a4c>] (state_store+0x70/0xc0) + r5:00000003 r4:bd85ea40 +[<800699dc>] (state_store) from [<80294034>] (kobj_attr_store+0x1c/0x28) + r10:beb9fe08 r8:00000000 r7:bdb21f78 r6:bd85ea40 r5:00000004 r4:beb9fe00 +[<80294018>] (kobj_attr_store) from [<80140f90>] (sysfs_kf_write+0x54/0x58) +[<80140f3c>] (sysfs_kf_write) from [<8014474c>] (kernfs_fop_write+0xc4/0x160) + r6:bd85ea40 r5:beb9fe00 r4:00000004 r3:80140f3c +[<80144688>] (kernfs_fop_write) from [<800dfa14>] (vfs_write+0xbc/0x184) + r10:00000000 r9:00000000 r8:00000000 r7:bdb21f78 r6:00500c08 r5:00000004 + r4:be782600 +[<800df958>] (vfs_write) from [<800dfe00>] (SyS_write+0x48/0x70) + r10:00000000 r8:00000000 r7:00000004 r6:00500c08 r5:00000000 r4:be782600 +[<800dfdb8>] (SyS_write) from [<8000e800>] (ret_fast_syscall+0x0/0x48) + r9:bdb20000 r8:8000e9c4 r7:00000004 r6:00500c08 r5:00000004 r4:76eb65e0 + +Fixes: 1abe729 (ASoC: fsl: Add missing pm to current machine drivers) +Signed-off-by: Shawn Guo +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/fsl/imx-mc13783.c | 1 - + sound/soc/fsl/imx-sgtl5000.c | 10 ++++++---- + sound/soc/fsl/imx-wm8962.c | 11 +++++++---- + 3 files changed, 13 insertions(+), 9 deletions(-) + +--- a/sound/soc/fsl/imx-mc13783.c ++++ b/sound/soc/fsl/imx-mc13783.c +@@ -160,7 +160,6 @@ static struct platform_driver imx_mc1378 + .driver = { + .name = "imx_mc13783", + .owner = THIS_MODULE, +- .pm = &snd_soc_pm_ops, + }, + .probe = imx_mc13783_probe, + .remove = imx_mc13783_remove +--- a/sound/soc/fsl/imx-sgtl5000.c ++++ b/sound/soc/fsl/imx-sgtl5000.c +@@ -33,8 +33,7 @@ struct imx_sgtl5000_data { + + static int imx_sgtl5000_dai_init(struct snd_soc_pcm_runtime *rtd) + { +- struct imx_sgtl5000_data *data = container_of(rtd->card, +- struct imx_sgtl5000_data, card); ++ struct imx_sgtl5000_data *data = snd_soc_card_get_drvdata(rtd->card); + struct device *dev = rtd->card->dev; + int ret; + +@@ -159,13 +158,15 @@ static int imx_sgtl5000_probe(struct pla + data->card.dapm_widgets = imx_sgtl5000_dapm_widgets; + data->card.num_dapm_widgets = ARRAY_SIZE(imx_sgtl5000_dapm_widgets); + ++ platform_set_drvdata(pdev, &data->card); ++ snd_soc_card_set_drvdata(&data->card, data); ++ + ret = devm_snd_soc_register_card(&pdev->dev, &data->card); + if (ret) { + dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret); + goto fail; + } + +- platform_set_drvdata(pdev, data); + of_node_put(ssi_np); + of_node_put(codec_np); + +@@ -184,7 +185,8 @@ fail: + + static int imx_sgtl5000_remove(struct platform_device *pdev) + { +- struct imx_sgtl5000_data *data = platform_get_drvdata(pdev); ++ struct snd_soc_card *card = platform_get_drvdata(pdev); ++ struct imx_sgtl5000_data *data = snd_soc_card_get_drvdata(card); + + clk_put(data->codec_clk); + +--- a/sound/soc/fsl/imx-wm8962.c ++++ b/sound/soc/fsl/imx-wm8962.c +@@ -71,7 +71,7 @@ static int imx_wm8962_set_bias_level(str + { + struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai; + struct imx_priv *priv = &card_priv; +- struct imx_wm8962_data *data = platform_get_drvdata(priv->pdev); ++ struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card); + struct device *dev = &priv->pdev->dev; + unsigned int pll_out; + int ret; +@@ -137,7 +137,7 @@ static int imx_wm8962_late_probe(struct + { + struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai; + struct imx_priv *priv = &card_priv; +- struct imx_wm8962_data *data = platform_get_drvdata(priv->pdev); ++ struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card); + struct device *dev = &priv->pdev->dev; + int ret; + +@@ -264,13 +264,15 @@ static int imx_wm8962_probe(struct platf + data->card.late_probe = imx_wm8962_late_probe; + data->card.set_bias_level = imx_wm8962_set_bias_level; + ++ platform_set_drvdata(pdev, &data->card); ++ snd_soc_card_set_drvdata(&data->card, data); ++ + ret = devm_snd_soc_register_card(&pdev->dev, &data->card); + if (ret) { + dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret); + goto clk_fail; + } + +- platform_set_drvdata(pdev, data); + of_node_put(ssi_np); + of_node_put(codec_np); + +@@ -289,7 +291,8 @@ fail: + + static int imx_wm8962_remove(struct platform_device *pdev) + { +- struct imx_wm8962_data *data = platform_get_drvdata(pdev); ++ struct snd_soc_card *card = platform_get_drvdata(pdev); ++ struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card); + + if (!IS_ERR(data->codec_clk)) + clk_disable_unprepare(data->codec_clk); diff --git a/queue-3.13/asoc-max98090-sync-regcache-on-entering-standby.patch b/queue-3.13/asoc-max98090-sync-regcache-on-entering-standby.patch new file mode 100644 index 00000000000..8015399e467 --- /dev/null +++ b/queue-3.13/asoc-max98090-sync-regcache-on-entering-standby.patch @@ -0,0 +1,59 @@ +From c42c8922c46d33ed769e99618bdfba06866a0c72 Mon Sep 17 00:00:00 2001 +From: Dylan Reid +Date: Wed, 12 Feb 2014 10:24:54 -0800 +Subject: ASoC: max98090: sync regcache on entering STANDBY + +From: Dylan Reid + +commit c42c8922c46d33ed769e99618bdfba06866a0c72 upstream. + +Sync regcache when entering STANDBY from OFF. ON isn't entered with +OFF as the current state, so the registers were not being re-synced +after suspend/resume. + +The 98088 and 98095 already call regcache_sync from STANDBY. + +Signed-off-by: Dylan Reid +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/max98090.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1769,16 +1769,6 @@ static int max98090_set_bias_level(struc + + switch (level) { + case SND_SOC_BIAS_ON: +- if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) { +- ret = regcache_sync(max98090->regmap); +- +- if (ret != 0) { +- dev_err(codec->dev, +- "Failed to sync cache: %d\n", ret); +- return ret; +- } +- } +- + if (max98090->jack_state == M98090_JACK_STATE_HEADSET) { + /* + * Set to normal bias level. +@@ -1792,6 +1782,16 @@ static int max98090_set_bias_level(struc + break; + + case SND_SOC_BIAS_STANDBY: ++ if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) { ++ ret = regcache_sync(max98090->regmap); ++ if (ret != 0) { ++ dev_err(codec->dev, ++ "Failed to sync cache: %d\n", ret); ++ return ret; ++ } ++ } ++ break; ++ + case SND_SOC_BIAS_OFF: + /* Set internal pull-up to lowest power mode */ + snd_soc_update_bits(codec, M98090_REG_JACK_DETECT, diff --git a/queue-3.13/asoc-rt5640-add-acpi-id-for-intel-baytrail.patch b/queue-3.13/asoc-rt5640-add-acpi-id-for-intel-baytrail.patch new file mode 100644 index 00000000000..d8bd07ec454 --- /dev/null +++ b/queue-3.13/asoc-rt5640-add-acpi-id-for-intel-baytrail.patch @@ -0,0 +1,29 @@ +From b31b2b6d5de71c569413d8dc4f7b050cbe25a09e Mon Sep 17 00:00:00 2001 +From: Jarkko Nikula +Date: Fri, 7 Feb 2014 09:35:16 +0200 +Subject: ASoC: rt5640: Add ACPI ID for Intel Baytrail + +From: Jarkko Nikula + +commit b31b2b6d5de71c569413d8dc4f7b050cbe25a09e upstream. + +Realtek RT5640 uses ACPI ID "10EC5640" for Intel Baytrail platforms. + +Signed-off-by: Jarkko Nikula +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/rt5640.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/codecs/rt5640.c ++++ b/sound/soc/codecs/rt5640.c +@@ -2093,6 +2093,7 @@ MODULE_DEVICE_TABLE(i2c, rt5640_i2c_id); + #ifdef CONFIG_ACPI + static struct acpi_device_id rt5640_acpi_match[] = { + { "INT33CA", 0 }, ++ { "10EC5640", 0 }, + { }, + }; + MODULE_DEVICE_TABLE(acpi, rt5640_acpi_match); diff --git a/queue-3.13/asoc-sta32x-fix-array-access-overflow.patch b/queue-3.13/asoc-sta32x-fix-array-access-overflow.patch new file mode 100644 index 00000000000..04b864adb41 --- /dev/null +++ b/queue-3.13/asoc-sta32x-fix-array-access-overflow.patch @@ -0,0 +1,105 @@ +From 025c3fa9256d4c54506b7a29dc3befac54f5c68d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 18 Feb 2014 09:24:12 +0100 +Subject: ASoC: sta32x: Fix array access overflow + +From: Takashi Iwai + +commit 025c3fa9256d4c54506b7a29dc3befac54f5c68d upstream. + +Preset EQ enum of sta32x codec driver declares too many number of +items and it may lead to the access over the actual array size. + +Use SOC_ENUM_SINGLE_DECL() helper and it's automatically fixed. + +Signed-off-by: Takashi Iwai +Acked-by: Liam Girdwood +Acked-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/sta32x.c | 72 +++++++++++++++++++++++----------------------- + 1 file changed, 36 insertions(+), 36 deletions(-) + +--- a/sound/soc/codecs/sta32x.c ++++ b/sound/soc/codecs/sta32x.c +@@ -187,42 +187,42 @@ static const unsigned int sta32x_limiter + 13, 16, TLV_DB_SCALE_ITEM(-1500, 300, 0), + }; + +-static const struct soc_enum sta32x_drc_ac_enum = +- SOC_ENUM_SINGLE(STA32X_CONFD, STA32X_CONFD_DRC_SHIFT, +- 2, sta32x_drc_ac); +-static const struct soc_enum sta32x_auto_eq_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT, +- 3, sta32x_auto_eq_mode); +-static const struct soc_enum sta32x_auto_gc_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT, +- 4, sta32x_auto_gc_mode); +-static const struct soc_enum sta32x_auto_xo_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT, +- 16, sta32x_auto_xo_mode); +-static const struct soc_enum sta32x_preset_eq_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT, +- 32, sta32x_preset_eq_mode); +-static const struct soc_enum sta32x_limiter_ch1_enum = +- SOC_ENUM_SINGLE(STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT, +- 3, sta32x_limiter_select); +-static const struct soc_enum sta32x_limiter_ch2_enum = +- SOC_ENUM_SINGLE(STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT, +- 3, sta32x_limiter_select); +-static const struct soc_enum sta32x_limiter_ch3_enum = +- SOC_ENUM_SINGLE(STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT, +- 3, sta32x_limiter_select); +-static const struct soc_enum sta32x_limiter1_attack_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxA_SHIFT, +- 16, sta32x_limiter_attack_rate); +-static const struct soc_enum sta32x_limiter2_attack_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxA_SHIFT, +- 16, sta32x_limiter_attack_rate); +-static const struct soc_enum sta32x_limiter1_release_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxR_SHIFT, +- 16, sta32x_limiter_release_rate); +-static const struct soc_enum sta32x_limiter2_release_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxR_SHIFT, +- 16, sta32x_limiter_release_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_drc_ac_enum, ++ STA32X_CONFD, STA32X_CONFD_DRC_SHIFT, ++ sta32x_drc_ac); ++static SOC_ENUM_SINGLE_DECL(sta32x_auto_eq_enum, ++ STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT, ++ sta32x_auto_eq_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_auto_gc_enum, ++ STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT, ++ sta32x_auto_gc_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_auto_xo_enum, ++ STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT, ++ sta32x_auto_xo_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_preset_eq_enum, ++ STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT, ++ sta32x_preset_eq_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch1_enum, ++ STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT, ++ sta32x_limiter_select); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch2_enum, ++ STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT, ++ sta32x_limiter_select); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch3_enum, ++ STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT, ++ sta32x_limiter_select); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_attack_rate_enum, ++ STA32X_L1AR, STA32X_LxA_SHIFT, ++ sta32x_limiter_attack_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_attack_rate_enum, ++ STA32X_L2AR, STA32X_LxA_SHIFT, ++ sta32x_limiter_attack_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_release_rate_enum, ++ STA32X_L1AR, STA32X_LxR_SHIFT, ++ sta32x_limiter_release_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum, ++ STA32X_L2AR, STA32X_LxR_SHIFT, ++ sta32x_limiter_release_rate); + + /* byte array controls for setting biquad, mixer, scaling coefficients; + * for biquads all five coefficients need to be set in one go, diff --git a/queue-3.13/asoc-sta32x-fix-cache-sync.patch b/queue-3.13/asoc-sta32x-fix-cache-sync.patch new file mode 100644 index 00000000000..6b4ede4ae82 --- /dev/null +++ b/queue-3.13/asoc-sta32x-fix-cache-sync.patch @@ -0,0 +1,35 @@ +From 70ff00f82a6af0ff68f8f7b411738634ce2f20d0 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Sat, 22 Feb 2014 18:27:17 +0100 +Subject: ASoC: sta32x: Fix cache sync + +From: Lars-Peter Clausen + +commit 70ff00f82a6af0ff68f8f7b411738634ce2f20d0 upstream. + +codec->control_data contains a pointer to the regmap struct of the device, not +to the device private data. Use snd_soc_codec_get_drvdata() instead. + +The issue was introduced in commit 29fdf4fbbe ("ASoC: sta32x: Convert to +regmap"). + +Fixes: 29fdf4fbbe (ASoC: sta32x: Convert to regmap) +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/sta32x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/sta32x.c ++++ b/sound/soc/codecs/sta32x.c +@@ -331,7 +331,7 @@ static int sta32x_sync_coef_shadow(struc + + static int sta32x_cache_sync(struct snd_soc_codec *codec) + { +- struct sta32x_priv *sta32x = codec->control_data; ++ struct sta32x_priv *sta32x = snd_soc_codec_get_drvdata(codec); + unsigned int mute; + int rc; + diff --git a/queue-3.13/asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch b/queue-3.13/asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch new file mode 100644 index 00000000000..a7dda904e66 --- /dev/null +++ b/queue-3.13/asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch @@ -0,0 +1,46 @@ +From b3619b288b621e63f66908045f48495869a996a6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 27 Feb 2014 07:41:32 +0100 +Subject: ASoC: sta32x: Fix wrong enum for limiter2 release rate +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +commit b3619b288b621e63f66908045f48495869a996a6 upstream. + +There is a typo in the Limiter2 Release Rate control, a wrong enum for +Limiter1 is assigned. It must point to Limiter2. +Spotted by a compile warning: + +In file included from sound/soc/codecs/sta32x.c:34:0: +sound/soc/codecs/sta32x.c:223:29: warning: ‘sta32x_limiter2_release_rate_enum’ defined but not used [-Wunused-variable] + static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum, + ^ +include/sound/soc.h:275:18: note: in definition of macro ‘SOC_ENUM_DOUBLE_DECL’ + struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \ + ^ +sound/soc/codecs/sta32x.c:223:8: note: in expansion of macro ‘SOC_ENUM_SINGLE_DECL’ + static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum, + ^ + +Signed-off-by: Takashi Iwai +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/sta32x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/sta32x.c ++++ b/sound/soc/codecs/sta32x.c +@@ -434,7 +434,7 @@ SOC_SINGLE_TLV("Treble Tone Control", ST + SOC_ENUM("Limiter1 Attack Rate (dB/ms)", sta32x_limiter1_attack_rate_enum), + SOC_ENUM("Limiter2 Attack Rate (dB/ms)", sta32x_limiter2_attack_rate_enum), + SOC_ENUM("Limiter1 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum), +-SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum), ++SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter2_release_rate_enum), + + /* depending on mode, the attack/release thresholds have + * two different enum definitions; provide both diff --git a/queue-3.13/asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch b/queue-3.13/asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch new file mode 100644 index 00000000000..e28997f2d8b --- /dev/null +++ b/queue-3.13/asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch @@ -0,0 +1,45 @@ +From 9febd494d15c4a351e9c9cae7184643144eea892 Mon Sep 17 00:00:00 2001 +From: Alexander Shiyan +Date: Sat, 15 Feb 2014 23:28:29 +0400 +Subject: ASoC: txx9aclc_ac97: Fix kernel crash on probe + +From: Alexander Shiyan + +commit 9febd494d15c4a351e9c9cae7184643144eea892 upstream. + +This patch fixes a crash caused by commit 3bed3344c826 +(ASoC: txx9aclc_ac97: Convert to devm_ioremap_resource()). +This is an attempt to assign "drvdata->base" while memory +for "drvdata" is not already allocated. + +Fixes: 3bed3344c826 (ASoC: txx9aclc_ac97: Convert to devm_ioremap_resource()) +Signed-off-by: Alexander Shiyan +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/txx9/txx9aclc-ac97.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/sound/soc/txx9/txx9aclc-ac97.c ++++ b/sound/soc/txx9/txx9aclc-ac97.c +@@ -183,14 +183,16 @@ static int txx9aclc_ac97_dev_probe(struc + irq = platform_get_irq(pdev, 0); + if (irq < 0) + return irq; ++ ++ drvdata = devm_kzalloc(&pdev->dev, sizeof(*drvdata), GFP_KERNEL); ++ if (!drvdata) ++ return -ENOMEM; ++ + r = platform_get_resource(pdev, IORESOURCE_MEM, 0); + drvdata->base = devm_ioremap_resource(&pdev->dev, r); + if (IS_ERR(drvdata->base)) + return PTR_ERR(drvdata->base); + +- drvdata = devm_kzalloc(&pdev->dev, sizeof(*drvdata), GFP_KERNEL); +- if (!drvdata) +- return -ENOMEM; + platform_set_drvdata(pdev, drvdata); + drvdata->physbase = r->start; + if (sizeof(drvdata->physbase) > sizeof(r->start) && diff --git a/queue-3.13/asoc-wm8770-fix-wrong-number-of-enum-items.patch b/queue-3.13/asoc-wm8770-fix-wrong-number-of-enum-items.patch new file mode 100644 index 00000000000..1bd34efb7c8 --- /dev/null +++ b/queue-3.13/asoc-wm8770-fix-wrong-number-of-enum-items.patch @@ -0,0 +1,37 @@ +From 7a6c0a58dc824523966f212c76322d47c5b0e6fe Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 18 Feb 2014 09:37:30 +0100 +Subject: ASoC: wm8770: Fix wrong number of enum items + +From: Takashi Iwai + +commit 7a6c0a58dc824523966f212c76322d47c5b0e6fe upstream. + +wm8770 codec driver defines ain_enum with a wrong number of items. + +Use SOC_ENUM_DOUBLE_DECL() macro and it's automatically fixed. + +Signed-off-by: Takashi Iwai +Acked-by: Liam Girdwood +Acked-by: Charles Keepax +Acked-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8770.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/wm8770.c ++++ b/sound/soc/codecs/wm8770.c +@@ -196,8 +196,8 @@ static const char *ain_text[] = { + "AIN5", "AIN6", "AIN7", "AIN8" + }; + +-static const struct soc_enum ain_enum = +- SOC_ENUM_DOUBLE(WM8770_ADCMUX, 0, 4, 8, ain_text); ++static SOC_ENUM_DOUBLE_DECL(ain_enum, ++ WM8770_ADCMUX, 0, 4, ain_text); + + static const struct snd_kcontrol_new ain_mux = + SOC_DAPM_ENUM("Capture Mux", ain_enum); diff --git a/queue-3.13/asoc-wm8958-dsp-fix-firmware-block-loading.patch b/queue-3.13/asoc-wm8958-dsp-fix-firmware-block-loading.patch new file mode 100644 index 00000000000..cebcee90ad7 --- /dev/null +++ b/queue-3.13/asoc-wm8958-dsp-fix-firmware-block-loading.patch @@ -0,0 +1,35 @@ +From 548da08fc1e245faf9b0d7c41ecd8e07984fc332 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Sat, 22 Feb 2014 18:30:13 +0100 +Subject: ASoC: wm8958-dsp: Fix firmware block loading + +From: Lars-Peter Clausen + +commit 548da08fc1e245faf9b0d7c41ecd8e07984fc332 upstream. + +The codec->control_data contains a pointer to the device's regmap struct. But +wm8994_bulk_write() expects a pointer to the parent wm8998 device. + +The issue was introduced in commit d9a7666f ("ASoC: Remove ASoC-specific +WM8994 I/O code"). + +Fixes: d9a7666f ("ASoC: Remove ASoC-specific WM8994 I/O code") +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8958-dsp2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8958-dsp2.c ++++ b/sound/soc/codecs/wm8958-dsp2.c +@@ -153,7 +153,7 @@ static int wm8958_dsp2_fw(struct snd_soc + + data32 &= 0xffffff; + +- wm8994_bulk_write(codec->control_data, ++ wm8994_bulk_write(wm8994->wm8994, + data32 & 0xffffff, + block_len / 2, + (void *)(data + 8)); diff --git a/queue-3.13/kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch b/queue-3.13/kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch new file mode 100644 index 00000000000..b90427e830f --- /dev/null +++ b/queue-3.13/kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch @@ -0,0 +1,43 @@ +From 1b385cbdd74aa803e966e01e5fe49490d6044e30 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Thu, 27 Feb 2014 22:54:11 +0100 +Subject: kvm, vmx: Really fix lazy FPU on nested guest + +From: Paolo Bonzini + +commit 1b385cbdd74aa803e966e01e5fe49490d6044e30 upstream. + +Commit e504c9098ed6 (kvm, vmx: Fix lazy FPU on nested guest, 2013-11-13) +highlighted a real problem, but the fix was subtly wrong. + +nested_read_cr0 is the CR0 as read by L2, but here we want to look at +the CR0 value reflecting L1's setup. In other words, L2 might think +that TS=0 (so nested_read_cr0 has the bit clear); but if L1 is actually +running it with TS=1, we should inject the fault into L1. + +The effective value of CR0 in L2 is contained in vmcs12->guest_cr0, use +it. + +Fixes: e504c9098ed6acd9e1079c5e10e4910724ad429f +Reported-by: Kashyap Chamarty +Reported-by: Stefan Bader +Tested-by: Kashyap Chamarty +Tested-by: Anthoine Bourgeois +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/vmx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -6644,7 +6644,7 @@ static bool nested_vmx_exit_handled(stru + else if (is_page_fault(intr_info)) + return enable_ept; + else if (is_no_device(intr_info) && +- !(nested_read_cr0(vmcs12) & X86_CR0_TS)) ++ !(vmcs12->guest_cr0 & X86_CR0_TS)) + return 0; + return vmcs12->exception_bitmap & + (1u << (intr_info & INTR_INFO_VECTOR_MASK)); diff --git a/queue-3.13/kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch b/queue-3.13/kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch new file mode 100644 index 00000000000..f57518f361b --- /dev/null +++ b/queue-3.13/kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch @@ -0,0 +1,50 @@ +From a08d3b3b99efd509133946056531cdf8f3a0c09b Mon Sep 17 00:00:00 2001 +From: Andrew Honig +Date: Thu, 27 Feb 2014 19:35:14 +0100 +Subject: kvm: x86: fix emulator buffer overflow (CVE-2014-0049) + +From: Andrew Honig + +commit a08d3b3b99efd509133946056531cdf8f3a0c09b upstream. + +The problem occurs when the guest performs a pusha with the stack +address pointing to an mmio address (or an invalid guest physical +address) to start with, but then extending into an ordinary guest +physical address. When doing repeated emulated pushes +emulator_read_write sets mmio_needed to 1 on the first one. On a +later push when the stack points to regular memory, +mmio_nr_fragments is set to 0, but mmio_is_needed is not set to 0. + +As a result, KVM exits to userspace, and then returns to +complete_emulated_mmio. In complete_emulated_mmio +vcpu->mmio_cur_fragment is incremented. The termination condition of +vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments is never achieved. +The code bounces back and fourth to userspace incrementing +mmio_cur_fragment past it's buffer. If the guest does nothing else it +eventually leads to a a crash on a memcpy from invalid memory address. + +However if a guest code can cause the vm to be destroyed in another +vcpu with excellent timing, then kvm_clear_async_pf_completion_queue +can be used by the guest to control the data that's pointed to by the +call to cancel_work_item, which can be used to gain execution. + +Fixes: f78146b0f9230765c6315b2e14f56112513389ad +Signed-off-by: Andrew Honig +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6163,7 +6163,7 @@ static int complete_emulated_mmio(struct + frag->len -= len; + } + +- if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) { ++ if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) { + vcpu->mmio_needed = 0; + + /* FIXME: return into emulator if single-stepping. */ diff --git a/queue-3.13/series b/queue-3.13/series index 09496d0b054..223f93333b5 100644 --- a/queue-3.13/series +++ b/queue-3.13/series @@ -81,3 +81,16 @@ cgroup-fix-locking-in-cgroup_cfts_commit.patch cgroup-update-cgroup_enable_task_cg_lists-to-grab-siglock.patch fs-fix-iversion-handling.patch export-declare-ksymtab-symbols.patch +kvm-x86-fix-emulator-buffer-overflow-cve-2014-0049.patch +kvm-vmx-really-fix-lazy-fpu-on-nested-guest.patch +asoc-da9055-fix-device-registration-of-pmic-and-codec-devices.patch +asoc-rt5640-add-acpi-id-for-intel-baytrail.patch +asoc-txx9aclc_ac97-fix-kernel-crash-on-probe.patch +asoc-fsl-fix-pm-support-of-machine-drivers.patch +asoc-max98090-sync-regcache-on-entering-standby.patch +asoc-wm8770-fix-wrong-number-of-enum-items.patch +asoc-da732x-mark-dc-offset-control-registers-volatile.patch +asoc-sta32x-fix-cache-sync.patch +asoc-sta32x-fix-wrong-enum-for-limiter2-release-rate.patch +asoc-sta32x-fix-array-access-overflow.patch +asoc-wm8958-dsp-fix-firmware-block-loading.patch -- 2.47.3