From faa88b270e419ee0ded6a010be75d311b082a573 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 12 Jan 2012 15:10:58 -0800 Subject: [PATCH] 3.1-stable patches added patches: alsa-hda-fix-automute-for-cirrus-logic-421x.patch alsa-hda-fix-master-control-for-cirrus-logic-421x.patch alsa-hda-fix-the-detection-of-loopback-mixing-control-for-via-codecs.patch alsa-hda-fix-the-lost-power-setup-of-seconary-pins-after-pm-resume.patch alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch alsa-hda-use-auto-parser-for-hp-laptops-with-cx20459-codec.patch alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch ideapad-check-if-acpi-already-handle-backlight-power-to-avoid-a-page-fault.patch kvm-device-assignment-permission-checks.patch kvm-guest-prevent-tracing-recursion-with-kvmclock.patch kvm-remove-ability-to-assign-a-device-without-iommu-support.patch kvm-x86-prevent-starting-pit-timers-in-the-absence-of-irqchip-support.patch mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch mtd-mtdoops-skip-reading-initially-bad-blocks.patch mtdoops-fix-the-oops_page_used-array-size.patch mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch --- ...a-fix-automute-for-cirrus-logic-421x.patch | 46 +++++ ...master-control-for-cirrus-logic-421x.patch | 55 ++++++ ...opback-mixing-control-for-via-codecs.patch | 39 +++++ ...tup-of-seconary-pins-after-pm-resume.patch | 89 ++++++++++ ...from-get_wcaps_type-for-invalid-nids.patch | 53 ++++++ ...er-for-hp-laptops-with-cx20459-codec.patch | 34 ++++ ...-check-for-ac97-to-avoid-kernel-oops.patch | 36 ++++ ...122l-delete-calls-to-preempt_disable.patch | 51 ++++++ ...er-when-day-or-month-is-out-of-range.patch | 50 ++++++ ...-disable-writeback-on-pre-r300-asics.patch | 38 +++++ ...invalid-avi-infoframe-checksum-issue.patch | 40 +++++ ...ined-behavior-in-ext4_fill_flex_info.patch | 71 ++++++++ ...acklight-power-to-avoid-a-page-fault.patch | 33 ++++ ...-device-assignment-permission-checks.patch | 158 ++++++++++++++++++ ...vent-tracing-recursion-with-kvmclock.patch | 45 +++++ ...ssign-a-device-without-iommu-support.patch | 81 +++++++++ ...rs-in-the-absence-of-irqchip-support.patch | 72 ++++++++ ...-t-increase-open-count-on-error-path.patch | 82 +++++++++ ...ps-skip-reading-initially-bad-blocks.patch | 34 ++++ ...if-device-has-not-enough-eraseblocks.patch | 57 +++++++ ...ps-fix-the-oops_page_used-array-size.patch | 37 ++++ ...ci-bus-mastering-on-big-endian-hosts.patch | 65 +++++++ queue-3.1/series | 22 +++ 23 files changed, 1288 insertions(+) create mode 100644 queue-3.1/alsa-hda-fix-automute-for-cirrus-logic-421x.patch create mode 100644 queue-3.1/alsa-hda-fix-master-control-for-cirrus-logic-421x.patch create mode 100644 queue-3.1/alsa-hda-fix-the-detection-of-loopback-mixing-control-for-via-codecs.patch create mode 100644 queue-3.1/alsa-hda-fix-the-lost-power-setup-of-seconary-pins-after-pm-resume.patch create mode 100644 queue-3.1/alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch create mode 100644 queue-3.1/alsa-hda-use-auto-parser-for-hp-laptops-with-cx20459-codec.patch create mode 100644 queue-3.1/alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch create mode 100644 queue-3.1/alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch create mode 100644 queue-3.1/drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch create mode 100644 queue-3.1/drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch create mode 100644 queue-3.1/drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch create mode 100644 queue-3.1/ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch create mode 100644 queue-3.1/ideapad-check-if-acpi-already-handle-backlight-power-to-avoid-a-page-fault.patch create mode 100644 queue-3.1/kvm-device-assignment-permission-checks.patch create mode 100644 queue-3.1/kvm-guest-prevent-tracing-recursion-with-kvmclock.patch create mode 100644 queue-3.1/kvm-remove-ability-to-assign-a-device-without-iommu-support.patch create mode 100644 queue-3.1/kvm-x86-prevent-starting-pit-timers-in-the-absence-of-irqchip-support.patch create mode 100644 queue-3.1/mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch create mode 100644 queue-3.1/mtd-mtdoops-skip-reading-initially-bad-blocks.patch create mode 100644 queue-3.1/mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch create mode 100644 queue-3.1/mtdoops-fix-the-oops_page_used-array-size.patch create mode 100644 queue-3.1/radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch create mode 100644 queue-3.1/series diff --git a/queue-3.1/alsa-hda-fix-automute-for-cirrus-logic-421x.patch b/queue-3.1/alsa-hda-fix-automute-for-cirrus-logic-421x.patch new file mode 100644 index 00000000000..3e78d02de81 --- /dev/null +++ b/queue-3.1/alsa-hda-fix-automute-for-cirrus-logic-421x.patch @@ -0,0 +1,46 @@ +From 78e2a928e377d5124932d4399c6c581908b027a0 Mon Sep 17 00:00:00 2001 +From: David Henningsson +Date: Mon, 2 Jan 2012 12:40:16 +0100 +Subject: ALSA: HDA: Fix automute for Cirrus Logic 421x + +From: David Henningsson + +commit 78e2a928e377d5124932d4399c6c581908b027a0 upstream. + +There was a bug in the automute logic causing speakers not to +mute when headphones were plugged in. + +Tested-by: Hsin-Yi Chen +Signed-off-by: David Henningsson +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_cirrus.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -916,16 +916,14 @@ static void cs_automute(struct hda_codec + + /* mute speakers if spdif or hp jack is plugged in */ + for (i = 0; i < cfg->speaker_outs; i++) { ++ int pin_ctl = hp_present ? 0 : PIN_OUT; ++ /* detect on spdif is specific to CS421x */ ++ if (spdif_present && (spec->vendor_nid == CS421X_VENDOR_NID)) ++ pin_ctl = 0; ++ + nid = cfg->speaker_pins[i]; + snd_hda_codec_write(codec, nid, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, +- hp_present ? 0 : PIN_OUT); +- /* detect on spdif is specific to CS421x */ +- if (spec->vendor_nid == CS421X_VENDOR_NID) { +- snd_hda_codec_write(codec, nid, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, +- spdif_present ? 0 : PIN_OUT); +- } ++ AC_VERB_SET_PIN_WIDGET_CONTROL, pin_ctl); + } + if (spec->board_config == CS420X_MBP53 || + spec->board_config == CS420X_MBP55 || diff --git a/queue-3.1/alsa-hda-fix-master-control-for-cirrus-logic-421x.patch b/queue-3.1/alsa-hda-fix-master-control-for-cirrus-logic-421x.patch new file mode 100644 index 00000000000..4c3a4fa2bf4 --- /dev/null +++ b/queue-3.1/alsa-hda-fix-master-control-for-cirrus-logic-421x.patch @@ -0,0 +1,55 @@ +From 40d03e63e91af8ddccdfd5a536cc2a6e51433e1d Mon Sep 17 00:00:00 2001 +From: David Henningsson +Date: Mon, 2 Jan 2012 12:40:15 +0100 +Subject: ALSA: HDA: Fix master control for Cirrus Logic 421X + +From: David Henningsson + +commit 40d03e63e91af8ddccdfd5a536cc2a6e51433e1d upstream. + +The control name "HP/Speakers" is non-standard, and since there is +only one DAC on this chip there is no need for a virtual master +anyway. + +Signed-off-by: David Henningsson +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_cirrus.c | 13 +------------ + 1 file changed, 1 insertion(+), 12 deletions(-) + +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -1756,30 +1756,19 @@ static int build_cs421x_output(struct hd + struct auto_pin_cfg *cfg = &spec->autocfg; + struct snd_kcontrol *kctl; + int err; +- char *name = "HP/Speakers"; ++ char *name = "Master"; + + fix_volume_caps(codec, dac); +- if (!spec->vmaster_sw) { +- err = add_vmaster(codec, dac); +- if (err < 0) +- return err; +- } + + err = add_mute(codec, name, 0, + HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl); + if (err < 0) + return err; +- err = snd_ctl_add_slave(spec->vmaster_sw, kctl); +- if (err < 0) +- return err; + + err = add_volume(codec, name, 0, + HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl); + if (err < 0) + return err; +- err = snd_ctl_add_slave(spec->vmaster_vol, kctl); +- if (err < 0) +- return err; + + if (cfg->speaker_outs) { + err = snd_hda_ctl_add(codec, 0, diff --git a/queue-3.1/alsa-hda-fix-the-detection-of-loopback-mixing-control-for-via-codecs.patch b/queue-3.1/alsa-hda-fix-the-detection-of-loopback-mixing-control-for-via-codecs.patch new file mode 100644 index 00000000000..6b4a9b00f5e --- /dev/null +++ b/queue-3.1/alsa-hda-fix-the-detection-of-loopback-mixing-control-for-via-codecs.patch @@ -0,0 +1,39 @@ +From 4808d12d1dddb046ec86425e5f6766f02e950292 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 10 Jan 2012 15:16:02 +0100 +Subject: ALSA: hda - Fix the detection of "Loopback Mixing" control for VIA codecs + +From: Takashi Iwai + +commit 4808d12d1dddb046ec86425e5f6766f02e950292 upstream. + +Currently the driver checks only the out_mix_path[] for the primary +output route for judging whether to create the loopback-mixing control +or not. But, there are cases where aamix-routing is available only on +headphone or speaker paths but not on the primary output path. So, the +driver ignores such cases inappropriately. + +This patch fixes the check of the loopback-mixing control by testing +all mix-routing paths. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_via.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_via.c ++++ b/sound/pci/hda/patch_via.c +@@ -2187,7 +2187,10 @@ static int via_auto_create_loopback_swit + { + struct via_spec *spec = codec->spec; + +- if (!spec->aa_mix_nid || !spec->out_mix_path.depth) ++ if (!spec->aa_mix_nid) ++ return 0; /* no loopback switching available */ ++ if (!(spec->out_mix_path.depth || spec->hp_mix_path.depth || ++ spec->speaker_path.depth)) + return 0; /* no loopback switching available */ + if (!via_clone_control(spec, &via_aamix_ctl_enum)) + return -ENOMEM; diff --git a/queue-3.1/alsa-hda-fix-the-lost-power-setup-of-seconary-pins-after-pm-resume.patch b/queue-3.1/alsa-hda-fix-the-lost-power-setup-of-seconary-pins-after-pm-resume.patch new file mode 100644 index 00000000000..2da3e155aa5 --- /dev/null +++ b/queue-3.1/alsa-hda-fix-the-lost-power-setup-of-seconary-pins-after-pm-resume.patch @@ -0,0 +1,89 @@ +From f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 11 Jan 2012 12:34:11 +0100 +Subject: ALSA: hda - Fix the lost power-setup of seconary pins after PM resume + +From: Takashi Iwai + +commit f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33 upstream. + +When multiple headphone or other detectable output pins are present, +the power-map has to be updated after resume appropriately, but the +current driver doesn't check all pins but only the first pin (since +it's enough to check it for the mute-behavior). This resulted in the +silent output from the secondary outputs after PM resume. + +This patch fixes the problem by checking all pins at (re-)init time. + +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740347 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 36 +++++++++++++++++++++++------------- + 1 file changed, 23 insertions(+), 13 deletions(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -4306,6 +4306,27 @@ static void stac_store_hints(struct hda_ + } + } + ++static void stac_issue_unsol_events(struct hda_codec *codec, int num_pins, ++ const hda_nid_t *pins) ++{ ++ while (num_pins--) ++ stac_issue_unsol_event(codec, *pins++); ++} ++ ++/* fake event to set up pins */ ++static void stac_fake_hp_events(struct hda_codec *codec) ++{ ++ struct sigmatel_spec *spec = codec->spec; ++ ++ if (spec->autocfg.hp_outs) ++ stac_issue_unsol_events(codec, spec->autocfg.hp_outs, ++ spec->autocfg.hp_pins); ++ if (spec->autocfg.line_outs && ++ spec->autocfg.line_out_pins[0] != spec->autocfg.hp_pins[0]) ++ stac_issue_unsol_events(codec, spec->autocfg.line_outs, ++ spec->autocfg.line_out_pins); ++} ++ + static int stac92xx_init(struct hda_codec *codec) + { + struct sigmatel_spec *spec = codec->spec; +@@ -4356,10 +4377,7 @@ static int stac92xx_init(struct hda_code + stac92xx_auto_set_pinctl(codec, spec->autocfg.line_out_pins[0], + AC_PINCTL_OUT_EN); + /* fake event to set up pins */ +- if (cfg->hp_pins[0]) +- stac_issue_unsol_event(codec, cfg->hp_pins[0]); +- else if (cfg->line_out_pins[0]) +- stac_issue_unsol_event(codec, cfg->line_out_pins[0]); ++ stac_fake_hp_events(codec); + } else { + stac92xx_auto_init_multi_out(codec); + stac92xx_auto_init_hp_out(codec); +@@ -5000,19 +5018,11 @@ static void stac927x_proc_hook(struct sn + #ifdef CONFIG_PM + static int stac92xx_resume(struct hda_codec *codec) + { +- struct sigmatel_spec *spec = codec->spec; +- + stac92xx_init(codec); + snd_hda_codec_resume_amp(codec); + snd_hda_codec_resume_cache(codec); + /* fake event to set up pins again to override cached values */ +- if (spec->hp_detect) { +- if (spec->autocfg.hp_pins[0]) +- stac_issue_unsol_event(codec, spec->autocfg.hp_pins[0]); +- else if (spec->autocfg.line_out_pins[0]) +- stac_issue_unsol_event(codec, +- spec->autocfg.line_out_pins[0]); +- } ++ stac_fake_hp_events(codec); + return 0; + } + diff --git a/queue-3.1/alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch b/queue-3.1/alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch new file mode 100644 index 00000000000..40d35bbc525 --- /dev/null +++ b/queue-3.1/alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch @@ -0,0 +1,53 @@ +From 3a90274de3548ebb2aabfbf488cea8e275a73dc6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 10 Jan 2012 12:41:22 +0100 +Subject: ALSA: hda - Return the error from get_wcaps_type() for invalid NIDs + +From: Takashi Iwai + +commit 3a90274de3548ebb2aabfbf488cea8e275a73dc6 upstream. + +When an invalid NID is given, get_wcaps() returns zero as the error, +but get_wcaps_type() takes it as the normal value and returns a bogus +AC_WID_AUD_OUT value. This confuses the parser. + +With this patch, get_wcaps_type() returns -1 when value 0 is given, +i.e. an invalid NID is passed to get_wcaps(). + +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740118 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_local.h | 7 ++++++- + sound/pci/hda/hda_proc.c | 2 ++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_local.h ++++ b/sound/pci/hda/hda_local.h +@@ -476,7 +476,12 @@ static inline u32 get_wcaps(struct hda_c + } + + /* get the widget type from widget capability bits */ +-#define get_wcaps_type(wcaps) (((wcaps) & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT) ++static inline int get_wcaps_type(unsigned int wcaps) ++{ ++ if (!wcaps) ++ return -1; /* invalid type */ ++ return (wcaps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT; ++} + + static inline unsigned int get_wcaps_channels(u32 wcaps) + { +--- a/sound/pci/hda/hda_proc.c ++++ b/sound/pci/hda/hda_proc.c +@@ -54,6 +54,8 @@ static const char *get_wid_type_name(uns + [AC_WID_BEEP] = "Beep Generator Widget", + [AC_WID_VENDOR] = "Vendor Defined Widget", + }; ++ if (wid_value == -1) ++ return "UNKNOWN Widget"; + wid_value &= 0xf; + if (names[wid_value]) + return names[wid_value]; diff --git a/queue-3.1/alsa-hda-use-auto-parser-for-hp-laptops-with-cx20459-codec.patch b/queue-3.1/alsa-hda-use-auto-parser-for-hp-laptops-with-cx20459-codec.patch new file mode 100644 index 00000000000..0d0cb1713f0 --- /dev/null +++ b/queue-3.1/alsa-hda-use-auto-parser-for-hp-laptops-with-cx20459-codec.patch @@ -0,0 +1,34 @@ +From de4da59e480cdf1075b33dbaf8078fc87bc52241 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 10 Jan 2012 08:59:56 +0100 +Subject: ALSA: hda - Use auto-parser for HP laptops with cx20459 codec + +From: Takashi Iwai + +commit de4da59e480cdf1075b33dbaf8078fc87bc52241 upstream. + +These laptops can work well with the auto-parser and their BIOS setups, +and in addition, the auto-parser fixes the problem with S3/S4 where +the unsol event handling is killed after resume due to fallback to the +single-cmd mode. + +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740115 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_conexant.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -1119,8 +1119,6 @@ static const char * const cxt5045_models + + static const struct snd_pci_quirk cxt5045_cfg_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x30d5, "HP 530", CXT5045_LAPTOP_HP530), +- SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x3000, "HP DV Series", +- CXT5045_LAPTOP_HPSENSE), + SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba P105", CXT5045_LAPTOP_MICSENSE), + SND_PCI_QUIRK(0x152d, 0x0753, "Benq R55E", CXT5045_BENQ), + SND_PCI_QUIRK(0x1734, 0x10ad, "Fujitsu Si1520", CXT5045_LAPTOP_MICSENSE), diff --git a/queue-3.1/alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch b/queue-3.1/alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch new file mode 100644 index 00000000000..a0bad11f6a1 --- /dev/null +++ b/queue-3.1/alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch @@ -0,0 +1,36 @@ +From e7848163aa2a649d9065f230fadff80dc3519775 Mon Sep 17 00:00:00 2001 +From: Pavel Hofman +Date: Thu, 5 Jan 2012 23:05:18 +0100 +Subject: ALSA: ice1724 - Check for ac97 to avoid kernel oops + +From: Pavel Hofman + +commit e7848163aa2a649d9065f230fadff80dc3519775 upstream. + +Cards with identical PCI ids but no AC97 config in EEPROM do not have +the ac97 field initialized. We must check for this case to avoid kernel oops. + +Signed-off-by: Pavel Hofman +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ice1712/amp.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/sound/pci/ice1712/amp.c ++++ b/sound/pci/ice1712/amp.c +@@ -68,8 +68,11 @@ static int __devinit snd_vt1724_amp_init + + static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice) + { +- /* we use pins 39 and 41 of the VT1616 for left and right read outputs */ +- snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000); ++ if (ice->ac97) ++ /* we use pins 39 and 41 of the VT1616 for left and right ++ read outputs */ ++ snd_ac97_write_cache(ice->ac97, 0x5a, ++ snd_ac97_read(ice->ac97, 0x5a) & ~0x8000); + return 0; + } + diff --git a/queue-3.1/alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch b/queue-3.1/alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch new file mode 100644 index 00000000000..2b4914d1b67 --- /dev/null +++ b/queue-3.1/alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch @@ -0,0 +1,51 @@ +From d0f3a2eb9062560bebca8b923424f3ca02a331ba Mon Sep 17 00:00:00 2001 +From: Karsten Wiese +Date: Fri, 30 Dec 2011 01:42:01 +0100 +Subject: ALSA: snd-usb-us122l: Delete calls to preempt_disable + +From: Karsten Wiese + +commit d0f3a2eb9062560bebca8b923424f3ca02a331ba upstream. + +They are not needed here. + +Signed-off-by: Karsten Wiese +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usx2y/usb_stream.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/sound/usb/usx2y/usb_stream.c ++++ b/sound/usb/usx2y/usb_stream.c +@@ -674,7 +674,7 @@ dotry: + inurb->transfer_buffer_length = + inurb->number_of_packets * + inurb->iso_frame_desc[0].length; +- preempt_disable(); ++ + if (u == 0) { + int now; + struct usb_device *dev = inurb->dev; +@@ -686,19 +686,17 @@ dotry: + } + err = usb_submit_urb(inurb, GFP_ATOMIC); + if (err < 0) { +- preempt_enable(); + snd_printk(KERN_ERR"usb_submit_urb(sk->inurb[%i])" + " returned %i\n", u, err); + return err; + } + err = usb_submit_urb(outurb, GFP_ATOMIC); + if (err < 0) { +- preempt_enable(); + snd_printk(KERN_ERR"usb_submit_urb(sk->outurb[%i])" + " returned %i\n", u, err); + return err; + } +- preempt_enable(); ++ + if (inurb->start_frame != outurb->start_frame) { + snd_printd(KERN_DEBUG + "u[%i] start_frames differ in:%u out:%u\n", diff --git a/queue-3.1/drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch b/queue-3.1/drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch new file mode 100644 index 00000000000..7e3847cabf3 --- /dev/null +++ b/queue-3.1/drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch @@ -0,0 +1,50 @@ +From e74a8f2edb92cb690b467cea0ab652c509e9f624 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 10 Jan 2012 15:11:02 -0800 +Subject: drivers/rtc/interface.c: fix alarm rollover when day or month is out-of-range + +From: Ben Hutchings + +commit e74a8f2edb92cb690b467cea0ab652c509e9f624 upstream. + +Commit f44f7f96a20a ("RTC: Initialize kernel state from RTC") introduced a +potential infinite loop. If an alarm time contains a wildcard month and +an invalid day (> 31), or a wildcard year and an invalid month (>= 12), +the loop searching for the next matching date will never terminate. Treat +the invalid values as wildcards. + +Fixes , + +Reported-by: leo weppelman +Reported-by: "P. van Gaans" +Signed-off-by: Ben Hutchings +Signed-off-by: Jonathan Nieder +Cc: Mark Brown +Cc: Marcelo Roberto Jimenez +Cc: Thomas Gleixner +Cc: John Stultz +Acked-by: Alessandro Zummo +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/interface.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -227,11 +227,11 @@ int __rtc_read_alarm(struct rtc_device * + alarm->time.tm_hour = now.tm_hour; + + /* For simplicity, only support date rollover for now */ +- if (alarm->time.tm_mday == -1) { ++ if (alarm->time.tm_mday < 1 || alarm->time.tm_mday > 31) { + alarm->time.tm_mday = now.tm_mday; + missing = day; + } +- if (alarm->time.tm_mon == -1) { ++ if ((unsigned)alarm->time.tm_mon >= 12) { + alarm->time.tm_mon = now.tm_mon; + if (missing == none) + missing = month; diff --git a/queue-3.1/drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch b/queue-3.1/drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch new file mode 100644 index 00000000000..ef8b857139a --- /dev/null +++ b/queue-3.1/drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch @@ -0,0 +1,38 @@ +From 28eebb703e28bc455ba704adb1026f76649b768c Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 3 Jan 2012 09:48:38 -0500 +Subject: drm/radeon/kms: disable writeback on pre-R300 asics + +From: Alex Deucher + +commit 28eebb703e28bc455ba704adb1026f76649b768c upstream. + +We often end up missing fences on older asics with +writeback enabled which leads to delays in the userspace +accel code, so just disable it by default on those asics. + +Reported-by: Helge Deller +Reported-by: Dave Airlie +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_device.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -224,8 +224,11 @@ int radeon_wb_init(struct radeon_device + if (radeon_no_wb == 1) + rdev->wb.enabled = false; + else { +- /* often unreliable on AGP */ + if (rdev->flags & RADEON_IS_AGP) { ++ /* often unreliable on AGP */ ++ rdev->wb.enabled = false; ++ } else if (rdev->family < CHIP_R300) { ++ /* often unreliable on pre-r300 */ + rdev->wb.enabled = false; + } else { + rdev->wb.enabled = true; diff --git a/queue-3.1/drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch b/queue-3.1/drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch new file mode 100644 index 00000000000..6eb86d46a08 --- /dev/null +++ b/queue-3.1/drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch @@ -0,0 +1,40 @@ +From 92db7f6c860b8190571a9dc1fcbc16d003422fe8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Fri, 23 Dec 2011 20:32:18 +0100 +Subject: drm/radeon/kms: workaround invalid AVI infoframe checksum issue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +commit 92db7f6c860b8190571a9dc1fcbc16d003422fe8 upstream. + +This change was verified to fix both issues with no video I've +investigated. I've also checked checksum calculation with fglrx on: +RV620, HD54xx, HD5450, HD6310, HD6320. + +Signed-off-by: Rafał Miłecki +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r600_hdmi.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/radeon/r600_hdmi.c ++++ b/drivers/gpu/drm/radeon/r600_hdmi.c +@@ -196,6 +196,13 @@ static void r600_hdmi_videoinfoframe( + frame[0xD] = (right_bar >> 8); + + r600_hdmi_infoframe_checksum(0x82, 0x02, 0x0D, frame); ++ /* Our header values (type, version, length) should be alright, Intel ++ * is using the same. Checksum function also seems to be OK, it works ++ * fine for audio infoframe. However calculated value is always lower ++ * by 2 in comparison to fglrx. It breaks displaying anything in case ++ * of TVs that strictly check the checksum. Hack it manually here to ++ * workaround this issue. */ ++ frame[0x0] += 2; + + WREG32(offset+R600_HDMI_VIDEOINFOFRAME_0, + frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24)); diff --git a/queue-3.1/ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch b/queue-3.1/ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch new file mode 100644 index 00000000000..ae620dc35a0 --- /dev/null +++ b/queue-3.1/ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch @@ -0,0 +1,71 @@ +From d50f2ab6f050311dbf7b8f5501b25f0bf64a439b Mon Sep 17 00:00:00 2001 +From: Xi Wang +Date: Tue, 10 Jan 2012 11:51:10 -0500 +Subject: ext4: fix undefined behavior in ext4_fill_flex_info() + +From: Xi Wang + +commit d50f2ab6f050311dbf7b8f5501b25f0bf64a439b upstream. + +Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by +zero when trying to mount a corrupted file system") fixes CVE-2009-4307 +by performing a sanity check on s_log_groups_per_flex, since it can be +set to a bogus value by an attacker. + + sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex; + groups_per_flex = 1 << sbi->s_log_groups_per_flex; + + if (groups_per_flex < 2) { ... } + +This patch fixes two potential issues in the previous commit. + +1) The sanity check might only work on architectures like PowerPC. +On x86, 5 bits are used for the shifting amount. That means, given a +large s_log_groups_per_flex value like 36, groups_per_flex = 1 << 36 +is essentially 1 << 4 = 16, rather than 0. This will bypass the check, +leaving s_log_groups_per_flex and groups_per_flex inconsistent. + +2) The sanity check relies on undefined behavior, i.e., oversized shift. +A standard-confirming C compiler could rewrite the check in unexpected +ways. Consider the following equivalent form, assuming groups_per_flex +is unsigned for simplicity. + + groups_per_flex = 1 << sbi->s_log_groups_per_flex; + if (groups_per_flex == 0 || groups_per_flex == 1) { + +We compile the code snippet using Clang 3.0 and GCC 4.6. Clang will +completely optimize away the check groups_per_flex == 0, leaving the +patched code as vulnerable as the original. GCC keeps the check, but +there is no guarantee that future versions will do the same. + +Signed-off-by: Xi Wang +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/super.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1984,17 +1984,16 @@ static int ext4_fill_flex_info(struct su + struct ext4_group_desc *gdp = NULL; + ext4_group_t flex_group_count; + ext4_group_t flex_group; +- int groups_per_flex = 0; ++ unsigned int groups_per_flex = 0; + size_t size; + int i; + + sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex; +- groups_per_flex = 1 << sbi->s_log_groups_per_flex; +- +- if (groups_per_flex < 2) { ++ if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) { + sbi->s_log_groups_per_flex = 0; + return 1; + } ++ groups_per_flex = 1 << sbi->s_log_groups_per_flex; + + /* We allocate both existing and potentially added groups */ + flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) + diff --git a/queue-3.1/ideapad-check-if-acpi-already-handle-backlight-power-to-avoid-a-page-fault.patch b/queue-3.1/ideapad-check-if-acpi-already-handle-backlight-power-to-avoid-a-page-fault.patch new file mode 100644 index 00000000000..0b43a7d7561 --- /dev/null +++ b/queue-3.1/ideapad-check-if-acpi-already-handle-backlight-power-to-avoid-a-page-fault.patch @@ -0,0 +1,33 @@ +From d4afc7754a60b885b63ef23fd194984e2d53a4e6 Mon Sep 17 00:00:00 2001 +From: Rene Bollford +Date: Sun, 23 Oct 2011 09:56:42 +0200 +Subject: [PATCH] ideapad: Check if acpi already handle backlight power to avoid a page fault + +From: Rene Bollford + +commit d4afc7754a60b885b63ef23fd194984e2d53a4e6 upstream. + +This patch avoid a page fault in the ideapad-laptop extras when +turning the backlight power on or off. + +Signed-off-by: Rene Bolldorf +Signed-off-by: Matthew Garrett +Signed-off-by: Jonathan Nieder +Tested-by: Artem X +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/ideapad-laptop.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -493,6 +493,8 @@ static void ideapad_backlight_notify_pow + unsigned long power; + struct backlight_device *blightdev = priv->blightdev; + ++ if (!blightdev) ++ return; + if (read_ec_data(ideapad_handle, 0x18, &power)) + return; + blightdev->props.power = power ? FB_BLANK_UNBLANK : FB_BLANK_POWERDOWN; diff --git a/queue-3.1/kvm-device-assignment-permission-checks.patch b/queue-3.1/kvm-device-assignment-permission-checks.patch new file mode 100644 index 00000000000..3a967d62689 --- /dev/null +++ b/queue-3.1/kvm-device-assignment-permission-checks.patch @@ -0,0 +1,158 @@ +From avi@redhat.com Thu Jan 12 14:57:51 2012 +From: Avi Kivity +Date: Thu, 12 Jan 2012 12:39:54 +0200 +Subject: KVM: Device assignment permission checks +To: stable@vger.kernel.org +Cc: kvm@vger.kernel.org, Marcelo Tosatti +Message-ID: <1326364794-18150-5-git-send-email-avi@redhat.com> + + +From: Alex Williamson + +(cherry picked from commit 3d27e23b17010c668db311140b17bbbb70c78fb9) + +Only allow KVM device assignment to attach to devices which: + + - Are not bridges + - Have BAR resources (assume others are special devices) + - The user has permissions to use + +Assigning a bridge is a configuration error, it's not supported, and +typically doesn't result in the behavior the user is expecting anyway. +Devices without BAR resources are typically chipset components that +also don't have host drivers. We don't want users to hold such devices +captive or cause system problems by fencing them off into an iommu +domain. We determine "permission to use" by testing whether the user +has access to the PCI sysfs resource files. By default a normal user +will not have access to these files, so it provides a good indication +that an administration agent has granted the user access to the device. + +[Yang Bai: add missing #include] +[avi: fix comment style] + +Signed-off-by: Alex Williamson +Signed-off-by: Yang Bai +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/virtual/kvm/api.txt | 4 ++ + virt/kvm/assigned-dev.c | 75 ++++++++++++++++++++++++++++++++++++++ + 2 files changed, 79 insertions(+) + +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -1134,6 +1134,10 @@ following flags are specified: + The KVM_DEV_ASSIGN_ENABLE_IOMMU flag is a mandatory option to ensure + isolation of the device. Usages not specifying this flag are deprecated. + ++Only PCI header type 0 devices with PCI BAR resources are supported by ++device assignment. The user requesting this ioctl must have read/write ++access to the PCI sysfs resource files associated with the device. ++ + 4.49 KVM_DEASSIGN_PCI_DEVICE + + Capability: KVM_CAP_DEVICE_DEASSIGNMENT +--- a/virt/kvm/assigned-dev.c ++++ b/virt/kvm/assigned-dev.c +@@ -17,6 +17,8 @@ + #include + #include + #include ++#include ++#include + #include "irq.h" + + static struct kvm_assigned_dev_kernel *kvm_find_assigned_dev(struct list_head *head, +@@ -474,12 +476,73 @@ out: + return r; + } + ++/* ++ * We want to test whether the caller has been granted permissions to ++ * use this device. To be able to configure and control the device, ++ * the user needs access to PCI configuration space and BAR resources. ++ * These are accessed through PCI sysfs. PCI config space is often ++ * passed to the process calling this ioctl via file descriptor, so we ++ * can't rely on access to that file. We can check for permissions ++ * on each of the BAR resource files, which is a pretty clear ++ * indicator that the user has been granted access to the device. ++ */ ++static int probe_sysfs_permissions(struct pci_dev *dev) ++{ ++#ifdef CONFIG_SYSFS ++ int i; ++ bool bar_found = false; ++ ++ for (i = PCI_STD_RESOURCES; i <= PCI_STD_RESOURCE_END; i++) { ++ char *kpath, *syspath; ++ struct path path; ++ struct inode *inode; ++ int r; ++ ++ if (!pci_resource_len(dev, i)) ++ continue; ++ ++ kpath = kobject_get_path(&dev->dev.kobj, GFP_KERNEL); ++ if (!kpath) ++ return -ENOMEM; ++ ++ /* Per sysfs-rules, sysfs is always at /sys */ ++ syspath = kasprintf(GFP_KERNEL, "/sys%s/resource%d", kpath, i); ++ kfree(kpath); ++ if (!syspath) ++ return -ENOMEM; ++ ++ r = kern_path(syspath, LOOKUP_FOLLOW, &path); ++ kfree(syspath); ++ if (r) ++ return r; ++ ++ inode = path.dentry->d_inode; ++ ++ r = inode_permission(inode, MAY_READ | MAY_WRITE | MAY_ACCESS); ++ path_put(&path); ++ if (r) ++ return r; ++ ++ bar_found = true; ++ } ++ ++ /* If no resources, probably something special */ ++ if (!bar_found) ++ return -EPERM; ++ ++ return 0; ++#else ++ return -EINVAL; /* No way to control the device without sysfs */ ++#endif ++} ++ + static int kvm_vm_ioctl_assign_device(struct kvm *kvm, + struct kvm_assigned_pci_dev *assigned_dev) + { + int r = 0, idx; + struct kvm_assigned_dev_kernel *match; + struct pci_dev *dev; ++ u8 header_type; + + if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)) + return -EINVAL; +@@ -510,6 +573,18 @@ static int kvm_vm_ioctl_assign_device(st + r = -EINVAL; + goto out_free; + } ++ ++ /* Don't allow bridges to be assigned */ ++ pci_read_config_byte(dev, PCI_HEADER_TYPE, &header_type); ++ if ((header_type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) { ++ r = -EPERM; ++ goto out_put; ++ } ++ ++ r = probe_sysfs_permissions(dev); ++ if (r) ++ goto out_put; ++ + if (pci_enable_device(dev)) { + printk(KERN_INFO "%s: Could not enable PCI device\n", __func__); + r = -EBUSY; diff --git a/queue-3.1/kvm-guest-prevent-tracing-recursion-with-kvmclock.patch b/queue-3.1/kvm-guest-prevent-tracing-recursion-with-kvmclock.patch new file mode 100644 index 00000000000..f606c8e432e --- /dev/null +++ b/queue-3.1/kvm-guest-prevent-tracing-recursion-with-kvmclock.patch @@ -0,0 +1,45 @@ +From avi@redhat.com Thu Jan 12 14:56:45 2012 +From: Avi Kivity +Date: Thu, 12 Jan 2012 12:39:51 +0200 +Subject: KVM guest: prevent tracing recursion with kvmclock +To: stable@vger.kernel.org +Cc: kvm@vger.kernel.org, Marcelo Tosatti +Message-ID: <1326364794-18150-2-git-send-email-avi@redhat.com> + +From: Avi Kivity + +(cherry picked from commit 95ef1e52922cf75b1ea2eae54ef886f2cc47eecb) + +Prevent tracing of preempt_disable() in get_cpu_var() in +kvm_clock_read(). When CONFIG_DEBUG_PREEMPT is enabled, +preempt_disable/enable() are traced and this causes the function_graph +tracer to go into an infinite recursion. By open coding the +preempt_disable() around the get_cpu_var(), we can use the notrace +version which prevents preempt_disable/enable() from being traced and +prevents the recursion. + +Based on a similar patch for Xen from Jeremy Fitzhardinge. + +Tested-by: Gleb Natapov +Acked-by: Steven Rostedt +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/kvmclock.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/kvmclock.c ++++ b/arch/x86/kernel/kvmclock.c +@@ -74,9 +74,10 @@ static cycle_t kvm_clock_read(void) + struct pvclock_vcpu_time_info *src; + cycle_t ret; + +- src = &get_cpu_var(hv_clock); ++ preempt_disable_notrace(); ++ src = &__get_cpu_var(hv_clock); + ret = pvclock_clocksource_read(src); +- put_cpu_var(hv_clock); ++ preempt_enable_notrace(); + return ret; + } + diff --git a/queue-3.1/kvm-remove-ability-to-assign-a-device-without-iommu-support.patch b/queue-3.1/kvm-remove-ability-to-assign-a-device-without-iommu-support.patch new file mode 100644 index 00000000000..98ef0ec8768 --- /dev/null +++ b/queue-3.1/kvm-remove-ability-to-assign-a-device-without-iommu-support.patch @@ -0,0 +1,81 @@ +From avi@redhat.com Thu Jan 12 14:57:35 2012 +From: Avi Kivity +Date: Thu, 12 Jan 2012 12:39:53 +0200 +Subject: KVM: Remove ability to assign a device without iommu support +To: stable@vger.kernel.org +Cc: kvm@vger.kernel.org, Marcelo Tosatti +Message-ID: <1326364794-18150-4-git-send-email-avi@redhat.com> + + +From: Alex Williamson + +(cherry picked from commit 423873736b78f549fbfa2f715f2e4de7e6c5e1e9) + +This option has no users and it exposes a security hole that we +can allow devices to be assigned without iommu protection. Make +KVM_DEV_ASSIGN_ENABLE_IOMMU a mandatory option. + +Signed-off-by: Alex Williamson +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/virtual/kvm/api.txt | 3 +++ + virt/kvm/assigned-dev.c | 18 +++++++++--------- + 2 files changed, 12 insertions(+), 9 deletions(-) + +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -1131,6 +1131,9 @@ following flags are specified: + /* Depends on KVM_CAP_IOMMU */ + #define KVM_DEV_ASSIGN_ENABLE_IOMMU (1 << 0) + ++The KVM_DEV_ASSIGN_ENABLE_IOMMU flag is a mandatory option to ensure ++isolation of the device. Usages not specifying this flag are deprecated. ++ + 4.49 KVM_DEASSIGN_PCI_DEVICE + + Capability: KVM_CAP_DEVICE_DEASSIGNMENT +--- a/virt/kvm/assigned-dev.c ++++ b/virt/kvm/assigned-dev.c +@@ -481,6 +481,9 @@ static int kvm_vm_ioctl_assign_device(st + struct kvm_assigned_dev_kernel *match; + struct pci_dev *dev; + ++ if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)) ++ return -EINVAL; ++ + mutex_lock(&kvm->lock); + idx = srcu_read_lock(&kvm->srcu); + +@@ -538,16 +541,14 @@ static int kvm_vm_ioctl_assign_device(st + + list_add(&match->list, &kvm->arch.assigned_dev_head); + +- if (assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU) { +- if (!kvm->arch.iommu_domain) { +- r = kvm_iommu_map_guest(kvm); +- if (r) +- goto out_list_del; +- } +- r = kvm_assign_device(kvm, match); ++ if (!kvm->arch.iommu_domain) { ++ r = kvm_iommu_map_guest(kvm); + if (r) + goto out_list_del; + } ++ r = kvm_assign_device(kvm, match); ++ if (r) ++ goto out_list_del; + + out: + srcu_read_unlock(&kvm->srcu, idx); +@@ -587,8 +588,7 @@ static int kvm_vm_ioctl_deassign_device( + goto out; + } + +- if (match->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU) +- kvm_deassign_device(kvm, match); ++ kvm_deassign_device(kvm, match); + + kvm_free_assigned_device(kvm, match); + diff --git a/queue-3.1/kvm-x86-prevent-starting-pit-timers-in-the-absence-of-irqchip-support.patch b/queue-3.1/kvm-x86-prevent-starting-pit-timers-in-the-absence-of-irqchip-support.patch new file mode 100644 index 00000000000..e92a5159044 --- /dev/null +++ b/queue-3.1/kvm-x86-prevent-starting-pit-timers-in-the-absence-of-irqchip-support.patch @@ -0,0 +1,72 @@ +From avi@redhat.com Thu Jan 12 14:57:09 2012 +From: Avi Kivity +Date: Thu, 12 Jan 2012 12:39:52 +0200 +Subject: KVM: x86: Prevent starting PIT timers in the absence of irqchip support +To: stable@vger.kernel.org +Cc: kvm@vger.kernel.org, Marcelo Tosatti +Message-ID: <1326364794-18150-3-git-send-email-avi@redhat.com> + + +From: Jan Kiszka + +(cherry picked from commit 0924ab2cfa98b1ece26c033d696651fd62896c69) + +User space may create the PIT and forgets about setting up the irqchips. +In that case, firing PIT IRQs will crash the host: + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000128 +IP: [] kvm_set_irq+0x30/0x170 [kvm] +... +Call Trace: + [] pit_do_work+0x51/0xd0 [kvm] + [] process_one_work+0x111/0x4d0 + [] worker_thread+0x152/0x340 + [] kthread+0x7e/0x90 + [] kernel_thread_helper+0x4/0x10 + +Prevent this by checking the irqchip mode before starting a timer. We +can't deny creating the PIT if the irqchips aren't set up yet as +current user land expects this order to work. + +Signed-off-by: Jan Kiszka +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/i8254.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -338,11 +338,15 @@ static enum hrtimer_restart pit_timer_fn + return HRTIMER_NORESTART; + } + +-static void create_pit_timer(struct kvm_kpit_state *ps, u32 val, int is_period) ++static void create_pit_timer(struct kvm *kvm, u32 val, int is_period) + { ++ struct kvm_kpit_state *ps = &kvm->arch.vpit->pit_state; + struct kvm_timer *pt = &ps->pit_timer; + s64 interval; + ++ if (!irqchip_in_kernel(kvm)) ++ return; ++ + interval = muldiv64(val, NSEC_PER_SEC, KVM_PIT_FREQ); + + pr_debug("create pit timer, interval is %llu nsec\n", interval); +@@ -394,13 +398,13 @@ static void pit_load_count(struct kvm *k + /* FIXME: enhance mode 4 precision */ + case 4: + if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)) { +- create_pit_timer(ps, val, 0); ++ create_pit_timer(kvm, val, 0); + } + break; + case 2: + case 3: + if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)){ +- create_pit_timer(ps, val, 1); ++ create_pit_timer(kvm, val, 1); + } + break; + default: diff --git a/queue-3.1/mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch b/queue-3.1/mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch new file mode 100644 index 00000000000..cb9309e6de7 --- /dev/null +++ b/queue-3.1/mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch @@ -0,0 +1,82 @@ +From 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Mon, 7 Nov 2011 15:51:05 -0800 +Subject: mtd: mtd_blkdevs: don't increase 'open' count on error path + +From: Brian Norris + +commit 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 upstream. + +Some error paths in mtd_blkdevs were fixed in the following commit: + + commit 94735ec4044a6d318b83ad3c5794e931ed168d10 + mtd: mtd_blkdevs: fix error path in blktrans_open + +But on these error paths, the block device's `dev->open' count is +already incremented before we check for errors. This meant that, while +the error path was handled correctly on the first time through +blktrans_open(), the device is erroneously considered already open on +the second time through. + +This problem can be seen, for instance, when a UBI volume is +simultaneously mounted as a UBIFS partition and read through its +corresponding gluebi mtdblockX device. This results in blktrans_open() +passing its error checks (with `dev->open > 0') without actually having +a handle on the device. Here's a summarized log of the actions and +results with nandsim: + + # modprobe nandsim + # modprobe mtdblock + # modprobe gluebi + # modprobe ubifs + # ubiattach /dev/ubi_ctrl -m 0 + ... + # ubimkvol /dev/ubi0 -N test -s 16MiB + ... + # mount -t ubifs ubi0:test /mnt + # ls /dev/mtdblock* + /dev/mtdblock0 /dev/mtdblock1 + # cat /dev/mtdblock1 > /dev/null + cat: can't open '/dev/mtdblock4': Device or resource busy + # cat /dev/mtdblock1 > /dev/null + + CPU 0 Unable to handle kernel paging request at virtual address + fffffff0, epc == 8031536c, ra == 8031f280 + Oops[#1]: + ... + Call Trace: + [<8031536c>] ubi_leb_read+0x14/0x164 + [<8031f280>] gluebi_read+0xf0/0x148 + [<802edba8>] mtdblock_readsect+0x64/0x198 + [<802ecfe4>] mtd_blktrans_thread+0x330/0x3f4 + [<8005be98>] kthread+0x88/0x90 + [<8000bc04>] kernel_thread_helper+0x10/0x18 + +Signed-off-by: Brian Norris +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/mtd_blkdevs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/mtd_blkdevs.c ++++ b/drivers/mtd/mtd_blkdevs.c +@@ -215,7 +215,7 @@ static int blktrans_open(struct block_de + + mutex_lock(&dev->lock); + +- if (dev->open++) ++ if (dev->open) + goto unlock; + + kref_get(&dev->ref); +@@ -235,6 +235,7 @@ static int blktrans_open(struct block_de + goto error_release; + + unlock: ++ dev->open++; + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; diff --git a/queue-3.1/mtd-mtdoops-skip-reading-initially-bad-blocks.patch b/queue-3.1/mtd-mtdoops-skip-reading-initially-bad-blocks.patch new file mode 100644 index 00000000000..c42dabd646b --- /dev/null +++ b/queue-3.1/mtd-mtdoops-skip-reading-initially-bad-blocks.patch @@ -0,0 +1,34 @@ +From 3538c56329936c78f7d356889908790006d0124c Mon Sep 17 00:00:00 2001 +From: Roman Tereshonkov +Date: Fri, 2 Dec 2011 15:07:17 +0200 +Subject: mtd: mtdoops: skip reading initially bad blocks + +From: Roman Tereshonkov + +commit 3538c56329936c78f7d356889908790006d0124c upstream. + +Use block_isbad to check and skip the bad blocks reading. +This will allow to get rid of the read errors if bad blocks +are present initially. + +Signed-off-by: Roman Tereshonkov +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/mtdoops.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/mtd/mtdoops.c ++++ b/drivers/mtd/mtdoops.c +@@ -253,6 +253,9 @@ static void find_next_position(struct mt + size_t retlen; + + for (page = 0; page < cxt->oops_pages; page++) { ++ if (mtd->block_isbad && ++ mtd->block_isbad(mtd, page * record_size)) ++ continue; + /* Assume the page is used */ + mark_page_used(cxt, page); + ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE, diff --git a/queue-3.1/mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch b/queue-3.1/mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch new file mode 100644 index 00000000000..2f56c5a24a5 --- /dev/null +++ b/queue-3.1/mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch @@ -0,0 +1,57 @@ +From 2f4478ccff7df845dc9c0f8996a96373122c4417 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Tue, 29 Nov 2011 15:34:08 +0100 +Subject: mtd: tests: stresstest: bail out if device has not enough eraseblocks + +From: Wolfram Sang + +commit 2f4478ccff7df845dc9c0f8996a96373122c4417 upstream. + +stresstest needs at least two eraseblocks. Bail out gracefully if that +condition is not met. Fixes the following 'division by zero' OOPS: + +[ 619.100000] mtd_stresstest: MTD device size 131072, eraseblock size 131072, page size 2048, count of eraseblocks 1, pages per eraseblock 64, OOB size 64 +[ 619.120000] mtd_stresstest: scanning for bad eraseblocks +[ 619.120000] mtd_stresstest: scanned 1 eraseblocks, 0 are bad +[ 619.130000] mtd_stresstest: doing operations +[ 619.130000] mtd_stresstest: 0 operations done +[ 619.140000] Division by zero in kernel. +... + +caused by + + /* Read or write up 2 eraseblocks at a time - hence 'ebcnt - 1' */ + eb %= (ebcnt - 1); + +Signed-off-by: Wolfram Sang +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/tests/mtd_stresstest.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mtd/tests/mtd_stresstest.c ++++ b/drivers/mtd/tests/mtd_stresstest.c +@@ -277,6 +277,12 @@ static int __init mtd_stresstest_init(vo + (unsigned long long)mtd->size, mtd->erasesize, + pgsize, ebcnt, pgcnt, mtd->oobsize); + ++ if (ebcnt < 2) { ++ printk(PRINT_PREF "error: need at least 2 eraseblocks\n"); ++ err = -ENOSPC; ++ goto out_put_mtd; ++ } ++ + /* Read or write up 2 eraseblocks at a time */ + bufsize = mtd->erasesize * 2; + +@@ -315,6 +321,7 @@ out: + kfree(bbt); + vfree(writebuf); + vfree(readbuf); ++out_put_mtd: + put_mtd_device(mtd); + if (err) + printk(PRINT_PREF "error %d occurred\n", err); diff --git a/queue-3.1/mtdoops-fix-the-oops_page_used-array-size.patch b/queue-3.1/mtdoops-fix-the-oops_page_used-array-size.patch new file mode 100644 index 00000000000..f6837b6a9a9 --- /dev/null +++ b/queue-3.1/mtdoops-fix-the-oops_page_used-array-size.patch @@ -0,0 +1,37 @@ +From 556f063580db2953a7e53cd46b47724246320f60 Mon Sep 17 00:00:00 2001 +From: Roman Tereshonkov +Date: Tue, 29 Nov 2011 12:49:18 +0200 +Subject: mtdoops: fix the oops_page_used array size + +From: Roman Tereshonkov + +commit 556f063580db2953a7e53cd46b47724246320f60 upstream. + +The array of unsigned long pointed by oops_page_used is allocated +by vmalloc which requires the size to be in bytes. + +BITS_PER_LONG is equal to 32. +If we want to allocate memory for 32 pages with one bit per page then +32 / BITS_PER_LONG is equal to 1 byte that is 8 bits. +To fix it we need to multiply the result by sizeof(unsigned long) equal to 4. + +Signed-off-by: Roman Tereshonkov +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/mtdoops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/mtdoops.c ++++ b/drivers/mtd/mtdoops.c +@@ -369,7 +369,7 @@ static void mtdoops_notify_add(struct mt + + /* oops_page_used is a bit field */ + cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages, +- BITS_PER_LONG)); ++ BITS_PER_LONG) * sizeof(unsigned long)); + if (!cxt->oops_page_used) { + printk(KERN_ERR "mtdoops: could not allocate page array\n"); + return; diff --git a/queue-3.1/radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch b/queue-3.1/radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch new file mode 100644 index 00000000000..1bd4fc55cee --- /dev/null +++ b/queue-3.1/radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch @@ -0,0 +1,65 @@ +From 3df96909b75835d487a9178761622b0cbd7310d4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Thu, 5 Jan 2012 18:42:17 +0100 +Subject: radeon: Fix disabling PCI bus mastering on big endian hosts. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michel Dänzer + +commit 3df96909b75835d487a9178761622b0cbd7310d4 upstream. + +It would previously write basically random bits to PCI configuration space... +Not very surprising that the GPU tended to stop responding completely. The +resulting MCE even froze the whole machine sometimes. + +Now resetting the GPU after a lockup has at least a fighting chance of +succeeding. + +Signed-off-by: Michel Dänzer +Reviewed-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r100.c | 5 +++-- + drivers/gpu/drm/radeon/rs600.c | 4 ++-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -2069,6 +2069,7 @@ bool r100_gpu_is_lockup(struct radeon_de + void r100_bm_disable(struct radeon_device *rdev) + { + u32 tmp; ++ u16 tmp16; + + /* disable bus mastering */ + tmp = RREG32(R_000030_BUS_CNTL); +@@ -2079,8 +2080,8 @@ void r100_bm_disable(struct radeon_devic + WREG32(R_000030_BUS_CNTL, (tmp & 0xFFFFFFFF) | 0x00000040); + tmp = RREG32(RADEON_BUS_CNTL); + mdelay(1); +- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp); +- pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB); ++ pci_read_config_word(rdev->pdev, 0x4, &tmp16); ++ pci_write_config_word(rdev->pdev, 0x4, tmp16 & 0xFFFB); + mdelay(1); + } + +--- a/drivers/gpu/drm/radeon/rs600.c ++++ b/drivers/gpu/drm/radeon/rs600.c +@@ -324,10 +324,10 @@ void rs600_hpd_fini(struct radeon_device + + void rs600_bm_disable(struct radeon_device *rdev) + { +- u32 tmp; ++ u16 tmp; + + /* disable bus mastering */ +- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp); ++ pci_read_config_word(rdev->pdev, 0x4, &tmp); + pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB); + mdelay(1); + } diff --git a/queue-3.1/series b/queue-3.1/series new file mode 100644 index 00000000000..2b8450103a5 --- /dev/null +++ b/queue-3.1/series @@ -0,0 +1,22 @@ +mtdoops-fix-the-oops_page_used-array-size.patch +mtd-mtdoops-skip-reading-initially-bad-blocks.patch +mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch +mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch +drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch +ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch +alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch +alsa-hda-fix-master-control-for-cirrus-logic-421x.patch +alsa-hda-fix-automute-for-cirrus-logic-421x.patch +alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch +alsa-hda-use-auto-parser-for-hp-laptops-with-cx20459-codec.patch +alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch +alsa-hda-fix-the-detection-of-loopback-mixing-control-for-via-codecs.patch +alsa-hda-fix-the-lost-power-setup-of-seconary-pins-after-pm-resume.patch +kvm-guest-prevent-tracing-recursion-with-kvmclock.patch +kvm-x86-prevent-starting-pit-timers-in-the-absence-of-irqchip-support.patch +kvm-remove-ability-to-assign-a-device-without-iommu-support.patch +kvm-device-assignment-permission-checks.patch +ideapad-check-if-acpi-already-handle-backlight-power-to-avoid-a-page-fault.patch +drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch +drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch +radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch -- 2.47.3