[patch 00/83] 2.6.27.9-stable review

[patch 00/83] 2.6.27.9-stable review

[Greg KH]

This is the start of the stable review cycle for the 2.6.27.9 release.
There are 83 patches in this series, all will be posted as a response to
this one.  If anyone has any issues with these being applied, please let
us know.  If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Cc:
line.  If you wish to be a reviewer, please email stable@kernel.org to
add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by December 13, 2008, 20:00:00 UTC.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.9-rc1.gz
and the diffstat can be found below.


thanks,

greg k-h

-----------------

 Makefile                              |    2 +-
 arch/powerpc/kernel/cpu_setup_44x.S   |    1 +
 arch/powerpc/kernel/cputable.c        |    3 +
 arch/powerpc/sysdev/mpic.c            |    9 +-
 arch/sparc/include/asm/uaccess_64.h   |    4 +-
 arch/sparc64/kernel/pci.c             |   10 +-
 arch/sparc64/kernel/ptrace.c          |    2 +-
 arch/sparc64/kernel/visemul.c         |    6 +-
 arch/sparc64/lib/user_fixup.c         |    2 +-
 arch/um/drivers/mconsole_kern.c       |    4 +-
 arch/x86/kernel/hpet.c                |    2 +-
 arch/x86/mm/init_64.c                 |    4 +-
 block/bsg.c                           |    2 +
 block/scsi_ioctl.c                    |    2 +
 drivers/acpi/osl.c                    |   36 ----
 drivers/acpi/sleep/main.c             |   40 ++++-
 drivers/ata/libata-sff.c              |   13 +-
 drivers/edac/cell_edac.c              |    3 +
 drivers/hid/usbhid/hid-quirks.c       |    2 +
 drivers/input/serio/i8042-x86ia64io.h |   29 +++
 drivers/net/cxgb3/adapter.h           |    1 +
 drivers/net/cxgb3/cxgb3_main.c        |    5 +
 drivers/net/cxgb3/l2t.c               |    1 +
 drivers/net/cxgb3/sge.c               |   56 ++----
 drivers/net/niu.c                     |    3 +-
 drivers/net/pppol2tp.c                |    1 +
 drivers/pci/pcie/aspm.c               |   29 +++-
 drivers/pci/slot.c                    |    1 +
 drivers/pnp/base.h                    |    2 +-
 drivers/pnp/quirks.c                  |    2 +-
 drivers/pnp/resource.c                |    4 +-
 drivers/spi/spidev.c                  |    4 +-
 drivers/usb/serial/option.c           |  176 +++++++++++++++---
 drivers/usb/storage/unusual_devs.h    |  334 ++++++++++++++++++++++++++++++--
 fs/binfmt_em86.c                      |    2 +-
 fs/binfmt_misc.c                      |    4 +-
 fs/binfmt_script.c                    |    5 +-
 fs/cifs/connect.c                     |   36 ++--
 fs/exec.c                             |   10 +-
 fs/fcntl.c                            |    7 +
 fs/ioctl.c                            |   12 +-
 fs/jbd/checkpoint.c                   |   49 ++++--
 fs/jbd/journal.c                      |   28 +++-
 fs/jbd/recovery.c                     |    7 +-
 fs/proc/task_mmu.c                    |    4 +-
 include/linux/binfmts.h               |    2 +
 include/linux/blkdev.h                |    1 +
 include/linux/jbd.h                   |    2 +-
 include/linux/pnp.h                   |    6 +-
 kernel/fork.c                         |   15 +-
 kernel/sched.c                        |    8 +-
 net/atm/svc.c                         |    6 +-
 net/ipv4/udp.c                        |   12 +-
 net/ipv6/udp.c                        |    8 +-
 net/unix/af_unix.c                    |    2 +-
 sound/pci/emu10k1/emu10k1_main.c      |    3 +
 sound/pci/hda/hda_proc.c              |    2 +-
 sound/pci/hda/patch_analog.c          |   10 +-
 sound/pci/hda/patch_realtek.c         |  152 +++++++++++++++-
 sound/pci/hda/patch_sigmatel.c        |   45 ++++-
 60 files changed, 1012 insertions(+), 221 deletions(-)

[patch 01/83] libata: improve phantom device detection

[Greg KH]

[-- Attachment #1: libata-improve-phantom-device-detection.patch --]
[-- Type: text/plain, Size: 2001 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Tejun Heo <tj@kernel.org>

commit 6a6b97d360702b98c02c7fca4c4e088dcf3a2985 upstream.

Currently libata uses four methods to detect device presence.

1. PHY status if available.
2. TF register R/W test (only promotes presence, never demotes)
3. device signature after reset
4. IDENTIFY failure detection in SFF state machine

Combination of the above works well in most cases but recently there
have been a few reports where a phantom device causes unnecessary
delay during probe.  In both cases, PHY status wasn't available.  In
one case, it passed #2 and #3 and failed IDENTIFY with ATA_ERR which
didn't qualify as #4.  The other failed #2 but as it passed #3 and #4,
it still caused failure.

In both cases, phantom device reported diagnostic failure, so these
cases can be safely worked around by considering any !ATA_DRQ IDENTIFY
failure as NODEV_HINT if diagnostic failure is set.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/ata/libata-sff.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1227,10 +1227,19 @@ fsm_start:
 			/* ATA PIO protocol */
 			if (unlikely((status & ATA_DRQ) == 0)) {
 				/* handle BSY=0, DRQ=0 as error */
-				if (likely(status & (ATA_ERR | ATA_DF)))
+				if (likely(status & (ATA_ERR | ATA_DF))) {
 					/* device stops HSM for abort/error */
 					qc->err_mask |= AC_ERR_DEV;
-				else {
+
+					/* If diagnostic failed and this is
+					 * IDENTIFY, it's likely a phantom
+					 * device.  Mark hint.
+					 */
+					if (qc->dev->horkage &
+					    ATA_HORKAGE_DIAGNOSTIC)
+						qc->err_mask |=
+							AC_ERR_NODEV_HINT;
+				} else {
 					/* HSM violation. Let EH handle this.
 					 * Phantom devices also trigger this
 					 * condition.  Mark hint.

[patch 02/83] af_unix: netns: fix problem of return value

[Greg KH]

[-- Attachment #1: 0001-af_unix-netns-fix-problem-of-return-value.patch --]
[-- Type: text/plain, Size: 737 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Jianjun Kong <jianjun@zeuux.org>

[ Upstream commit 48dcc33e5e11de0f76b65b113988dbc930d17395 ]

fix problem of return value

net/unix/af_unix.c: unix_net_init()
when error appears, it should return 'error', not always return 0.

Signed-off-by: Jianjun Kong <jianjun@zeuux.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

---
 net/unix/af_unix.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2230,7 +2230,7 @@ static int unix_net_init(struct net *net
 #endif
 	error = 0;
 out:
-	return 0;
+	return error;
 }
 
 static void unix_net_exit(struct net *net)

[patch 03/83] cxgb3: Fix kernel crash caused by uninitialized l2t_entry.arpq

[Greg KH]

[-- Attachment #1: 0002-cxgb3-Fix-kernel-crash-caused-by-uninitialized-l2t_.patch --]
[-- Type: text/plain, Size: 1327 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Roland Dreier <rdreier@cisco.com>

[ Upstream commit 6d329af9967e7ab3f4a3d7f1e8ef87539c3a069f ]

Commit 147e70e6 ("cxgb3: Use SKB list interfaces instead of home-grown
implementation.") causes a crash in t3_l2t_send_slow() when an iWARP
connection request is received.  This is because the new l2t_entry.arpq
skb queue is never initialized, and therefore trying to add an skb to
it causes a NULL dereference.  With the old code there was no need to
initialize the queues because the l2t_entry structures were zeroed,
and the code used NULL to mean empty.

Fix this by adding __skb_queue_head_init() when all the l2t_entry
structures get allocated.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/cxgb3/l2t.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/cxgb3/l2t.c
+++ b/drivers/net/cxgb3/l2t.c
@@ -436,6 +436,7 @@ struct l2t_data *t3_init_l2t(unsigned in
 	for (i = 0; i < l2t_capacity; ++i) {
 		d->l2tab[i].idx = i;
 		d->l2tab[i].state = L2T_STATE_UNUSED;
+		__skb_queue_head_init(&d->l2tab[i].arpq);
 		spin_lock_init(&d->l2tab[i].lock);
 		atomic_set(&d->l2tab[i].refcnt, 0);
 	}

[patch 04/83] niu: Fix readq implementation when architecture does not provide one.

[Greg KH]

[-- Attachment #1: 0003-niu-Fix-readq-implementation-when-architecture-does.patch --]
[-- Type: text/plain, Size: 1734 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: David S. Miller <davem@davemloft.net>

[ Upstream commit e23a59e1ca6d177a57a7791b3629db93ff1d9813 ]

This fixes a TX hang reported by Jesper Dangaard Brouer.

When an architecutre cannot provide a fully functional
64-bit atomic readq/writeq, the driver must implement
it's own.  This is because only the driver can say whether
doing something like using two 32-bit reads to implement
the full 64-bit read will actually work properly.

In particular one of the issues is whether the top 32-bits
or the bottom 32-bits of the 64-bit register should be read
first.  There could be side effects, and in fact that is
exactly the problem here.

The TX_CS register has counters in the upper 32-bits and
state bits in the lower 32-bits.  A read clears the state
bits.

We would read the counter half before the state bit half.
That first read would clear the state bits, and then the
driver thinks that no interrupts are pending because the
interrupt indication state bits are seen clear every time.

Fix this by reading the bottom half before the upper half.

Tested-by: Jesper Dangaard Brouer <jdb@comx.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/niu.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -51,8 +51,7 @@ MODULE_VERSION(DRV_MODULE_VERSION);
 #ifndef readq
 static u64 readq(void __iomem *reg)
 {
-	return (((u64)readl(reg + 0x4UL) << 32) |
-		(u64)readl(reg));
+	return ((u64) readl(reg)) | (((u64) readl(reg + 4UL)) << 32);
 }
 
 static void writeq(u64 val, void __iomem *reg)

[patch 05/83] pppol2tp: Add missing sock_put() in pppol2tp_release()

[Greg KH]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: 0004-pppol2tp-Add-missing-sock_put-in-pppol2tp_release.patch --]
[-- Type: text/plain; charset=utf-8, Size: 694 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Frédéric Moulins <frederic.moulins@alsatis.com>

[ Upstream commit e6358135147807351db3b7782d3e198a1bba8b62 ]

pppol2tp_sock_to_session() do sock_hold() if the session to release is
not NULL.

Signed-off-by: Frederic Moulins <frederic.moulins@alsatis.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

---
 drivers/net/pppol2tp.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -1353,6 +1353,7 @@ static int pppol2tp_release(struct socke
 			kfree_skb(skb);
 			sock_put(sk);
 		}
+		sock_put(sk);
 	}
 
 	release_sock(sk);

[patch 06/83] udp: multicast packets need to check namespace

[Greg KH]

[-- Attachment #1: 0005-udp-multicast-packets-need-to-check-namespace.patch --]
[-- Type: text/plain, Size: 3290 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Eric Dumazet <dada1@cosmosbay.com>

[ Upstream commit 920a46115ca3fa88990276d98520abab85495b2d ]

Current UDP multicast delivery is not namespace aware.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Acked-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/ipv4/udp.c |   12 +++++++-----
 net/ipv6/udp.c |    8 ++++----
 2 files changed, 11 insertions(+), 9 deletions(-)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -302,7 +302,7 @@ static struct sock *__udp4_lib_lookup(st
 	return result;
 }
 
-static inline struct sock *udp_v4_mcast_next(struct sock *sk,
+static inline struct sock *udp_v4_mcast_next(struct net *net, struct sock *sk,
 					     __be16 loc_port, __be32 loc_addr,
 					     __be16 rmt_port, __be32 rmt_addr,
 					     int dif)
@@ -314,7 +314,8 @@ static inline struct sock *udp_v4_mcast_
 	sk_for_each_from(s, node) {
 		struct inet_sock *inet = inet_sk(s);
 
-		if (s->sk_hash != hnum					||
+		if (!net_eq(sock_net(s), net)				||
+		    s->sk_hash != hnum					||
 		    (inet->daddr && inet->daddr != rmt_addr)		||
 		    (inet->dport != rmt_port && inet->dport)		||
 		    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)	||
@@ -1097,15 +1098,16 @@ static int __udp4_lib_mcast_deliver(stru
 	read_lock(&udp_hash_lock);
 	sk = sk_head(&udptable[udp_hashfn(net, ntohs(uh->dest))]);
 	dif = skb->dev->ifindex;
-	sk = udp_v4_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
+	sk = udp_v4_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
 	if (sk) {
 		struct sock *sknext = NULL;
 
 		do {
 			struct sk_buff *skb1 = skb;
 
-			sknext = udp_v4_mcast_next(sk_next(sk), uh->dest, daddr,
-						   uh->source, saddr, dif);
+			sknext = udp_v4_mcast_next(net, sk_next(sk), uh->dest,
+						   daddr, uh->source, saddr,
+						   dif);
 			if (sknext)
 				skb1 = skb_clone(skb, GFP_ATOMIC);
 
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -313,7 +313,7 @@ drop:
 	return -1;
 }
 
-static struct sock *udp_v6_mcast_next(struct sock *sk,
+static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
 				      __be16 loc_port, struct in6_addr *loc_addr,
 				      __be16 rmt_port, struct in6_addr *rmt_addr,
 				      int dif)
@@ -325,7 +325,7 @@ static struct sock *udp_v6_mcast_next(st
 	sk_for_each_from(s, node) {
 		struct inet_sock *inet = inet_sk(s);
 
-		if (sock_net(s) != sock_net(sk))
+		if (!net_eq(sock_net(s), net))
 			continue;
 
 		if (s->sk_hash == num && s->sk_family == PF_INET6) {
@@ -368,14 +368,14 @@ static int __udp6_lib_mcast_deliver(stru
 	read_lock(&udp_hash_lock);
 	sk = sk_head(&udptable[udp_hashfn(net, ntohs(uh->dest))]);
 	dif = inet6_iif(skb);
-	sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
+	sk = udp_v6_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
 	if (!sk) {
 		kfree_skb(skb);
 		goto out;
 	}
 
 	sk2 = sk;
-	while ((sk2 = udp_v6_mcast_next(sk_next(sk2), uh->dest, daddr,
+	while ((sk2 = udp_v6_mcast_next(net, sk_next(sk2), uh->dest, daddr,
 					uh->source, saddr, dif))) {
 		struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
 		if (buff) {

[patch 07/83] sparc64: Fix offset calculation in compute_size()

[Greg KH]

[-- Attachment #1: 0001-sparc64-Fix-offset-calculation-in-compute_size.patch --]
[-- Type: text/plain, Size: 795 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: David S. Miller <davem@davemloft.net>

[ Upstream commit b270ee8a9fc9547eb781ce9ccd379450bcf9a204 ]

The fault address is somewhere inside of the buffer, not
before it.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc64/lib/user_fixup.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/sparc64/lib/user_fixup.c
+++ b/arch/sparc64/lib/user_fixup.c
@@ -24,7 +24,7 @@ static unsigned long compute_size(unsign
 	if (fault_addr < start || fault_addr >= end) {
 		*offset = 0;
 	} else {
-		*offset = start - fault_addr;
+		*offset = fault_addr - start;
 		size = end - fault_addr;
 	}
 	return size;

[patch 08/83] sparc64: Fix __copy_{to,from}_user_inatomic defines.

[Greg KH]

[-- Attachment #1: 0002-sparc64-Fix-__copy_-to-from-_user_inatomic-defines.patch --]
[-- Type: text/plain, Size: 1182 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Hugh Dickins <hugh@veritas.com>

[ Upstream commit b270ee8a9fc9547eb781ce9ccd379450bcf9a204 ]

Alexander Beregalov reports oops in __bzero() called from
copy_from_user_fixup() called from iov_iter_copy_from_user_atomic(),
when running dbench on tmpfs on sparc64: its __copy_from_user_inatomic
and __copy_to_user_inatomic should be avoiding, not calling, the fixups.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc/include/asm/uaccess_64.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/sparc/include/asm/uaccess_64.h
+++ b/arch/sparc/include/asm/uaccess_64.h
@@ -265,8 +265,8 @@ extern long __strnlen_user(const char __
 
 #define strlen_user __strlen_user
 #define strnlen_user __strnlen_user
-#define __copy_to_user_inatomic __copy_to_user
-#define __copy_from_user_inatomic __copy_from_user
+#define __copy_to_user_inatomic ___copy_to_user
+#define __copy_from_user_inatomic ___copy_from_user
 
 #endif  /* __ASSEMBLY__ */
 

[patch 09/83] sparc64: Fix PCI resource mapping on sparc64

[Greg KH]

[-- Attachment #1: 0003-sparc64-Fix-PCI-resource-mapping-on-sparc64.patch --]
[-- Type: text/plain, Size: 1734 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Max Dmitrichenko <dmitrmax@gmail.com>

[ Upstream commit 145e1c0023585e0e8f6df22316308ec61c5066b2 ]

There is a problem discovered in recent versions of ATI Mach64 driver
in X.org on sparc64 architecture. In short, the driver fails to mmap
MMIO aperture (PCI resource #2).

I've found that kernel's __pci_mmap_make_offset() returns EINVAL. It
checks whether user attempts to mmap more than the resource length,
which is 0x1000 bytes in our case. But PAGE_SIZE on SPARC64 is 0x2000
and this is what actually is being mmaped. So __pci_mmap_make_offset()
failed for this PCI resource.

Signed-off-by: Max Dmitrichenko <dmitrmax@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc64/kernel/pci.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/arch/sparc64/kernel/pci.c
+++ b/arch/sparc64/kernel/pci.c
@@ -1017,6 +1017,7 @@ static int __pci_mmap_make_offset(struct
 
 	for (i = 0; i <= PCI_ROM_RESOURCE; i++) {
 		struct resource *rp = &pdev->resource[i];
+		resource_size_t aligned_end;
 
 		/* Active? */
 		if (!rp->flags)
@@ -1034,8 +1035,15 @@ static int __pci_mmap_make_offset(struct
 				continue;
 		}
 
+		/* Align the resource end to the next page address.
+		 * PAGE_SIZE intentionally added instead of (PAGE_SIZE - 1),
+		 * because actually we need the address of the next byte
+		 * after rp->end.
+		 */
+		aligned_end = (rp->end + PAGE_SIZE) & PAGE_MASK;
+
 		if ((rp->start <= user_paddr) &&
-		    (user_paddr + user_size) <= (rp->end + 1UL))
+		    (user_paddr + user_size) <= aligned_end)
 			break;
 	}
 

[patch 10/83] sparc64: Fix bug in PTRACE_SETFPREGS64 handling.

[Greg KH]

[-- Attachment #1: 0004-sparc64-Fix-bug-in-PTRACE_SETFPREGS64-handling.patch --]
[-- Type: text/plain, Size: 1026 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Chris Torek <chris.torek@windriver.com>

[ Upstream commit 5769907ade8dda7002b304c03ef9e4ee5c1e0821 ]

From: Chris Torek <chris.torek@windriver.com>

>The SPARC64 kernel code for PTRACE_SETFPREGS64 appears to be an exact copy
>of that for PTRACE_GETFPREGS64.  This means that gdbserver and native
>64-bit GDB cannot set floating-point registers.

It looks like a simple typo.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc64/kernel/ptrace.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/sparc64/kernel/ptrace.c
+++ b/arch/sparc64/kernel/ptrace.c
@@ -1014,7 +1014,7 @@ long arch_ptrace(struct task_struct *chi
 		break;
 
 	case PTRACE_SETFPREGS64:
-		ret = copy_regset_to_user(child, view, REGSET_FP,
+		ret = copy_regset_from_user(child, view, REGSET_FP,
 					  0 * sizeof(u64),
 					  33 * sizeof(u64),
 					  fps);

[patch 11/83] sparc64: Fix VIS emulation bugs

[Greg KH]

[-- Attachment #1: 0005-sparc64-Fix-VIS-emulation-bugs.patch --]
[-- Type: text/plain, Size: 1870 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Joseph Myers <joseph@codesourcery.com>

[ Upstream commit 726c12f57d7e3ff43693d88e13b1ff02464c75d3 ]

This patch fixes some bugs in VIS emulation that cause the GCC test
failure

FAIL: gcc.target/sparc/pdist-3.c execution test

for both 32-bit and 64-bit testing on hardware lacking these
instructions.  The emulation code for the pdist instruction uses
RS1(insn) for both source registers rs1 and rs2, which is obviously
wrong and leads to the instruction doing nothing (the observed
problem), and further inspection of the code shows that RS1 uses a
shift of 24 and RD a shift of 25, which clearly cannot both be right;
examining SPARC documentation indicates the correct shift for RS1 is
14.

This patch fixes the bug if single-stepping over the affected
instruction in the debugger, but not if the testcase is run
standalone.  For that, Wind River has another patch I hope they will
send as a followup to this patch submission.

Signed-off-by: Joseph Myers <joseph@codesourcery.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc64/kernel/visemul.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/sparc64/kernel/visemul.c
+++ b/arch/sparc64/kernel/visemul.c
@@ -131,7 +131,7 @@
 #define VIS_OPF_SHIFT	5
 #define VIS_OPF_MASK	(0x1ff << VIS_OPF_SHIFT)
 
-#define RS1(INSN)	(((INSN) >> 24) & 0x1f)
+#define RS1(INSN)	(((INSN) >> 14) & 0x1f)
 #define RS2(INSN)	(((INSN) >>  0) & 0x1f)
 #define RD(INSN)	(((INSN) >> 25) & 0x1f)
 
@@ -445,7 +445,7 @@ static void pdist(struct pt_regs *regs, 
 	unsigned long i;
 
 	rs1 = fpd_regval(f, RS1(insn));
-	rs2 = fpd_regval(f, RS1(insn));
+	rs2 = fpd_regval(f, RS2(insn));
 	rd = fpd_regaddr(f, RD(insn));
 
 	rd_val = *rd;

[patch 12/83] sparc64: Sync FPU state in VIS emulation handler.

[Greg KH]

[-- Attachment #1: 0006-sparc64-Sync-FPU-state-in-VIS-emulation-handler.patch --]
[-- Type: text/plain, Size: 841 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Hong H. Pham <hong.pham@windriver.com>

[ Upstream commit 410d2c8187ed969238ba98008c1d57307a56cfd8 ]

Copy the FPU state to the task's thread_info->fpregs for the VIS emulation
functions to access.

Signed-off-by: Hong H. Pham <hong.pham@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc64/kernel/visemul.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/sparc64/kernel/visemul.c
+++ b/arch/sparc64/kernel/visemul.c
@@ -807,6 +807,8 @@ int vis_emul(struct pt_regs *regs, unsig
 	if (get_user(insn, (u32 __user *) pc))
 		return -EFAULT;
 
+	save_and_clear_fpu();
+
 	opf = (insn & VIS_OPF_MASK) >> VIS_OPF_SHIFT;
 	switch (opf) {
 	default:

[patch 13/83] Enforce a minimum SG_IO timeout

[Greg KH]

[-- Attachment #1: enforce-a-minimum-sg_io-timeout.patch --]
[-- Type: text/plain, Size: 1952 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Linus Torvalds <torvalds@linux-foundation.org>

commit f2f1fa78a155524b849edf359e42a3001ea652c0 upstream.

There's no point in having too short SG_IO timeouts, since if the
command does end up timing out, we'll end up through the reset sequence
that is several seconds long in order to abort the command that timed
out.

As a result, shorter timeouts than a few seconds simply do not make
sense, as the recovery would be longer than the timeout itself.

Add a BLK_MIN_SG_TIMEOUT to match the existign BLK_DEFAULT_SG_TIMEOUT.

Suggested-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Acked-by: Tejun Heo <tj@kernel.org>
Acked-by: Jens Axboe <jens.axboe@oracle.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 block/bsg.c            |    2 ++
 block/scsi_ioctl.c     |    2 ++
 include/linux/blkdev.h |    1 +
 3 files changed, 5 insertions(+)

--- a/block/bsg.c
+++ b/block/bsg.c
@@ -202,6 +202,8 @@ static int blk_fill_sgv4_hdr_rq(struct r
 		rq->timeout = q->sg_timeout;
 	if (!rq->timeout)
 		rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
+	if (rq->timeout < BLK_MIN_SG_TIMEOUT)
+		rq->timeout = BLK_MIN_SG_TIMEOUT;
 
 	return 0;
 }
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -208,6 +208,8 @@ static int blk_fill_sghdr_rq(struct requ
 		rq->timeout = q->sg_timeout;
 	if (!rq->timeout)
 		rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
+	if (rq->timeout < BLK_MIN_SG_TIMEOUT)
+		rq->timeout = BLK_MIN_SG_TIMEOUT;
 
 	return 0;
 }
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -623,6 +623,7 @@ extern unsigned long blk_max_low_pfn, bl
  * default timeout for SG_IO if none specified
  */
 #define BLK_DEFAULT_SG_TIMEOUT	(60 * HZ)
+#define BLK_MIN_SG_TIMEOUT	(7 * HZ)
 
 #ifdef CONFIG_BOUNCE
 extern int init_emergency_isa_pool(void);

[patch 14/83] Fix a race condition in FASYNC handling

[Greg KH]

[-- Attachment #1: fix-a-race-condition-in-fasync-handling.patch --]
[-- Type: text/plain, Size: 2564 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Jonathan Corbet <corbet@lwn.net>

commit 218d11a8b071b23b76c484fd5f72a4fe3306801e upstream.

Changeset a238b790d5f99c7832f9b73ac8847025815b85f7 (Call fasync()
functions without the BKL) introduced a race which could leave
file->f_flags in a state inconsistent with what the underlying
driver/filesystem believes.  Revert that change, and also fix the same
races in ioctl_fioasync() and ioctl_fionbio().

This is a minimal, short-term fix; the real fix will not involve the
BKL.

Reported-by: Oleg Nesterov <oleg@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/fcntl.c |    7 +++++++
 fs/ioctl.c |   12 ++++++++----
 2 files changed, 15 insertions(+), 4 deletions(-)

--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -19,6 +19,7 @@
 #include <linux/signal.h>
 #include <linux/rcupdate.h>
 #include <linux/pid_namespace.h>
+#include <linux/smp_lock.h>
 
 #include <asm/poll.h>
 #include <asm/siginfo.h>
@@ -175,6 +176,11 @@ static int setfl(int fd, struct file * f
 	if (error)
 		return error;
 
+	/*
+	 * We still need a lock here for now to keep multiple FASYNC calls
+	 * from racing with each other.
+	 */
+	lock_kernel();
 	if ((arg ^ filp->f_flags) & FASYNC) {
 		if (filp->f_op && filp->f_op->fasync) {
 			error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
@@ -185,6 +191,7 @@ static int setfl(int fd, struct file * f
 
 	filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
  out:
+	unlock_kernel();
 	return error;
 }
 
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -123,11 +123,9 @@ static int ioctl_fioasync(unsigned int f
 
 	/* Did FASYNC state change ? */
 	if ((flag ^ filp->f_flags) & FASYNC) {
-		if (filp->f_op && filp->f_op->fasync) {
-			lock_kernel();
+		if (filp->f_op && filp->f_op->fasync)
 			error = filp->f_op->fasync(fd, filp, on);
-			unlock_kernel();
-		} else
+		else
 			error = -ENOTTY;
 	}
 	if (error)
@@ -163,11 +161,17 @@ int do_vfs_ioctl(struct file *filp, unsi
 		break;
 
 	case FIONBIO:
+		/* BKL needed to avoid races tweaking f_flags */
+		lock_kernel();
 		error = ioctl_fionbio(filp, argp);
+		unlock_kernel();
 		break;
 
 	case FIOASYNC:
+		/* BKL needed to avoid races tweaking f_flags */
+		lock_kernel();
 		error = ioctl_fioasync(fd, filp, argp);
+		unlock_kernel();
 		break;
 
 	case FIOQSIZE:

[patch 15/83] ACPI suspend: Blacklist boxes that require us to set SCI_EN directly on resume

[Greg KH]

[-- Attachment #1: acpi-suspend-blacklist-boxes-that-require-us-to-set-sci_en-directly-on-resume.patch --]
[-- Type: text/plain, Size: 3561 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Rafael J. Wysocki <rjw@sisk.pl>

commit 65df78473ffbf3bff5e2034df1638acc4f3ddd50 upstream.

Some Apple boxes evidently require us to set SCI_EN on resume
directly, because if we don't do that, they hung somewhere in the
resume code path.  Moreover, on these boxes it is not sufficient to
use acpi_enable() to turn ACPI on during resume.  All of this is
against the ACPI specification which states that (1) the BIOS is
supposed to return from the S3 sleep state with ACPI enabled
(SCI_EN set) and (2) the SCI_EN bit is owned by the hardware and we
are not supposed to change it.

For this reason, blacklist the affected systems so that the SCI_EN
bit is set during resume on them.

[NOTE: Unconditional setting SCI_EN for all system on resume doesn't
 work, because it makes some other systems crash (that's to be
 expected).  Also, it is not entirely clear right now if all of the
 Apple boxes require this workaround.]

This patch fixes the recent regression tracked as
http://bugzilla.kernel.org/show_bug.cgi?id=12038

Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Tested-by: Tino Keitel <tino.keitel@gmx.de>
Tested-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/acpi/sleep/main.c |   40 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

--- a/drivers/acpi/sleep/main.c
+++ b/drivers/acpi/sleep/main.c
@@ -60,6 +60,18 @@ void __init acpi_old_suspend_ordering(vo
 	old_suspend_ordering = true;
 }
 
+/*
+ * According to the ACPI specification the BIOS should make sure that ACPI is
+ * enabled and SCI_EN bit is set on wake-up from S1 - S3 sleep states.  Still,
+ * some BIOSes don't do that and therefore we use acpi_enable() to enable ACPI
+ * on such systems during resume.  Unfortunately that doesn't help in
+ * particularly pathological cases in which SCI_EN has to be set directly on
+ * resume, although the specification states very clearly that this flag is
+ * owned by the hardware.  The set_sci_en_on_resume variable will be set in such
+ * cases.
+ */
+static bool set_sci_en_on_resume;
+
 /**
  *	acpi_pm_disable_gpes - Disable the GPEs.
  */
@@ -201,7 +213,11 @@ static int acpi_suspend_enter(suspend_st
 	}
 
 	/* If ACPI is not enabled by the BIOS, we need to enable it here. */
-	acpi_enable();
+	if (set_sci_en_on_resume)
+		acpi_set_register(ACPI_BITREG_SCI_ENABLE, 1);
+	else
+		acpi_enable();
+
 	/* Reprogram control registers and execute _BFS */
 	acpi_leave_sleep_state_prep(acpi_state);
 
@@ -289,6 +305,12 @@ static int __init init_old_suspend_order
 	return 0;
 }
 
+static int __init init_set_sci_en_on_resume(const struct dmi_system_id *d)
+{
+	set_sci_en_on_resume = true;
+	return 0;
+}
+
 static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
 	{
 	.callback = init_old_suspend_ordering,
@@ -306,6 +328,22 @@ static struct dmi_system_id __initdata a
 		DMI_MATCH(DMI_PRODUCT_NAME, "HP xw4600 Workstation"),
 		},
 	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Apple MacBook 1,1",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Apple Computer, Inc."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "MacBook1,1"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Apple MacMini 1,1",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Apple Computer, Inc."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "Macmini1,1"),
+		},
+	},
 	{},
 };
 #endif /* CONFIG_SUSPEND */

[patch 16/83] jbd: fix error handling for checkpoint io

[Greg KH]

[-- Attachment #1: jbd-fix-error-handling-for-checkpoint-io.patch --]
[-- Type: text/plain, Size: 10443 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>

commit 4afe978530702c934dfdb11f54073136818b2119 upstream.

When a checkpointing IO fails, current JBD code doesn't check the error
and continue journaling.  This means latest metadata can be lost from both
the journal and filesystem.

This patch leaves the failed metadata blocks in the journal space and
aborts journaling in the case of log_do_checkpoint().  To achieve this, we
need to do:

1. don't remove the failed buffer from the checkpoint list where in
   the case of __try_to_free_cp_buf() because it may be released or
   overwritten by a later transaction
2. log_do_checkpoint() is the last chance, remove the failed buffer
   from the checkpoint list and abort the journal
3. when checkpointing fails, don't update the journal super block to
   prevent the journaled contents from being cleaned.  For safety,
   don't update j_tail and j_tail_sequence either
4. when checkpointing fails, notify this error to the ext3 layer so
   that ext3 don't clear the needs_recovery flag, otherwise the
   journaled contents are ignored and cleaned in the recovery phase
5. if the recovery fails, keep the needs_recovery flag
6. prevent cleanup_journal_tail() from being called between
   __journal_drop_transaction() and journal_abort() (a race issue
   between journal_flush() and __log_wait_for_space()

Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
Acked-by: Jan Kara <jack@suse.cz>
Cc: <linux-ext4@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/jbd/checkpoint.c |   49 +++++++++++++++++++++++++++++++++++++------------
 fs/jbd/journal.c    |   28 ++++++++++++++++++++++------
 fs/jbd/recovery.c   |    7 +++++--
 include/linux/jbd.h |    2 +-
 4 files changed, 65 insertions(+), 21 deletions(-)

--- a/fs/jbd/checkpoint.c
+++ b/fs/jbd/checkpoint.c
@@ -93,7 +93,8 @@ static int __try_to_free_cp_buf(struct j
 	int ret = 0;
 	struct buffer_head *bh = jh2bh(jh);
 
-	if (jh->b_jlist == BJ_None && !buffer_locked(bh) && !buffer_dirty(bh)) {
+	if (jh->b_jlist == BJ_None && !buffer_locked(bh) &&
+	    !buffer_dirty(bh) && buffer_uptodate(bh)) {
 		JBUFFER_TRACE(jh, "remove from checkpoint list");
 		ret = __journal_remove_checkpoint(jh) + 1;
 		jbd_unlock_bh_state(bh);
@@ -160,21 +161,25 @@ static void jbd_sync_bh(journal_t *journ
  * buffers. Note that we take the buffers in the opposite ordering
  * from the one in which they were submitted for IO.
  *
+ * Return 0 on success, and return <0 if some buffers have failed
+ * to be written out.
+ *
  * Called with j_list_lock held.
  */
-static void __wait_cp_io(journal_t *journal, transaction_t *transaction)
+static int __wait_cp_io(journal_t *journal, transaction_t *transaction)
 {
 	struct journal_head *jh;
 	struct buffer_head *bh;
 	tid_t this_tid;
 	int released = 0;
+	int ret = 0;
 
 	this_tid = transaction->t_tid;
 restart:
 	/* Did somebody clean up the transaction in the meanwhile? */
 	if (journal->j_checkpoint_transactions != transaction ||
 			transaction->t_tid != this_tid)
-		return;
+		return ret;
 	while (!released && transaction->t_checkpoint_io_list) {
 		jh = transaction->t_checkpoint_io_list;
 		bh = jh2bh(jh);
@@ -194,6 +199,9 @@ restart:
 			spin_lock(&journal->j_list_lock);
 			goto restart;
 		}
+		if (unlikely(!buffer_uptodate(bh)))
+			ret = -EIO;
+
 		/*
 		 * Now in whatever state the buffer currently is, we know that
 		 * it has been written out and so we can drop it from the list
@@ -203,6 +211,8 @@ restart:
 		journal_remove_journal_head(bh);
 		__brelse(bh);
 	}
+
+	return ret;
 }
 
 #define NR_BATCH	64
@@ -226,7 +236,8 @@ __flush_batch(journal_t *journal, struct
  * Try to flush one buffer from the checkpoint list to disk.
  *
  * Return 1 if something happened which requires us to abort the current
- * scan of the checkpoint list.
+ * scan of the checkpoint list.  Return <0 if the buffer has failed to
+ * be written out.
  *
  * Called with j_list_lock held and drops it if 1 is returned
  * Called under jbd_lock_bh_state(jh2bh(jh)), and drops it
@@ -256,6 +267,9 @@ static int __process_buffer(journal_t *j
 		log_wait_commit(journal, tid);
 		ret = 1;
 	} else if (!buffer_dirty(bh)) {
+		ret = 1;
+		if (unlikely(!buffer_uptodate(bh)))
+			ret = -EIO;
 		J_ASSERT_JH(jh, !buffer_jbddirty(bh));
 		BUFFER_TRACE(bh, "remove from checkpoint");
 		__journal_remove_checkpoint(jh);
@@ -263,7 +277,6 @@ static int __process_buffer(journal_t *j
 		jbd_unlock_bh_state(bh);
 		journal_remove_journal_head(bh);
 		__brelse(bh);
-		ret = 1;
 	} else {
 		/*
 		 * Important: we are about to write the buffer, and
@@ -295,6 +308,7 @@ static int __process_buffer(journal_t *j
  * to disk. We submit larger chunks of data at once.
  *
  * The journal should be locked before calling this function.
+ * Called with j_checkpoint_mutex held.
  */
 int log_do_checkpoint(journal_t *journal)
 {
@@ -318,6 +332,7 @@ int log_do_checkpoint(journal_t *journal
 	 * OK, we need to start writing disk blocks.  Take one transaction
 	 * and write it.
 	 */
+	result = 0;
 	spin_lock(&journal->j_list_lock);
 	if (!journal->j_checkpoint_transactions)
 		goto out;
@@ -334,7 +349,7 @@ restart:
 		int batch_count = 0;
 		struct buffer_head *bhs[NR_BATCH];
 		struct journal_head *jh;
-		int retry = 0;
+		int retry = 0, err;
 
 		while (!retry && transaction->t_checkpoint_list) {
 			struct buffer_head *bh;
@@ -347,6 +362,8 @@ restart:
 				break;
 			}
 			retry = __process_buffer(journal, jh, bhs,&batch_count);
+			if (retry < 0 && !result)
+				result = retry;
 			if (!retry && (need_resched() ||
 				spin_needbreak(&journal->j_list_lock))) {
 				spin_unlock(&journal->j_list_lock);
@@ -371,14 +388,18 @@ restart:
 		 * Now we have cleaned up the first transaction's checkpoint
 		 * list. Let's clean up the second one
 		 */
-		__wait_cp_io(journal, transaction);
+		err = __wait_cp_io(journal, transaction);
+		if (!result)
+			result = err;
 	}
 out:
 	spin_unlock(&journal->j_list_lock);
-	result = cleanup_journal_tail(journal);
 	if (result < 0)
-		return result;
-	return 0;
+		journal_abort(journal, result);
+	else
+		result = cleanup_journal_tail(journal);
+
+	return (result < 0) ? result : 0;
 }
 
 /*
@@ -394,8 +415,9 @@ out:
  * This is the only part of the journaling code which really needs to be
  * aware of transaction aborts.  Checkpointing involves writing to the
  * main filesystem area rather than to the journal, so it can proceed
- * even in abort state, but we must not update the journal superblock if
- * we have an abort error outstanding.
+ * even in abort state, but we must not update the super block if
+ * checkpointing may have failed.  Otherwise, we would lose some metadata
+ * buffers which should be written-back to the filesystem.
  */
 
 int cleanup_journal_tail(journal_t *journal)
@@ -404,6 +426,9 @@ int cleanup_journal_tail(journal_t *jour
 	tid_t		first_tid;
 	unsigned long	blocknr, freed;
 
+	if (is_journal_aborted(journal))
+		return 1;
+
 	/* OK, work out the oldest transaction remaining in the log, and
 	 * the log block it starts at.
 	 *
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -1121,9 +1121,12 @@ recovery_error:
  *
  * Release a journal_t structure once it is no longer in use by the
  * journaled object.
+ * Return <0 if we couldn't clean up the journal.
  */
-void journal_destroy(journal_t *journal)
+int journal_destroy(journal_t *journal)
 {
+	int err = 0;
+
 	/* Wait for the commit thread to wake up and die. */
 	journal_kill_thread(journal);
 
@@ -1146,11 +1149,16 @@ void journal_destroy(journal_t *journal)
 	J_ASSERT(journal->j_checkpoint_transactions == NULL);
 	spin_unlock(&journal->j_list_lock);
 
-	/* We can now mark the journal as empty. */
-	journal->j_tail = 0;
-	journal->j_tail_sequence = ++journal->j_transaction_sequence;
 	if (journal->j_sb_buffer) {
-		journal_update_superblock(journal, 1);
+		if (!is_journal_aborted(journal)) {
+			/* We can now mark the journal as empty. */
+			journal->j_tail = 0;
+			journal->j_tail_sequence =
+				++journal->j_transaction_sequence;
+			journal_update_superblock(journal, 1);
+		} else {
+			err = -EIO;
+		}
 		brelse(journal->j_sb_buffer);
 	}
 
@@ -1160,6 +1168,8 @@ void journal_destroy(journal_t *journal)
 		journal_destroy_revoke(journal);
 	kfree(journal->j_wbuf);
 	kfree(journal);
+
+	return err;
 }
 
 
@@ -1359,10 +1369,16 @@ int journal_flush(journal_t *journal)
 	spin_lock(&journal->j_list_lock);
 	while (!err && journal->j_checkpoint_transactions != NULL) {
 		spin_unlock(&journal->j_list_lock);
+		mutex_lock(&journal->j_checkpoint_mutex);
 		err = log_do_checkpoint(journal);
+		mutex_unlock(&journal->j_checkpoint_mutex);
 		spin_lock(&journal->j_list_lock);
 	}
 	spin_unlock(&journal->j_list_lock);
+
+	if (is_journal_aborted(journal))
+		return -EIO;
+
 	cleanup_journal_tail(journal);
 
 	/* Finally, mark the journal as really needing no recovery.
@@ -1384,7 +1400,7 @@ int journal_flush(journal_t *journal)
 	J_ASSERT(journal->j_head == journal->j_tail);
 	J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
 	spin_unlock(&journal->j_state_lock);
-	return err;
+	return 0;
 }
 
 /**
--- a/fs/jbd/recovery.c
+++ b/fs/jbd/recovery.c
@@ -223,7 +223,7 @@ do {									\
  */
 int journal_recover(journal_t *journal)
 {
-	int			err;
+	int			err, err2;
 	journal_superblock_t *	sb;
 
 	struct recovery_info	info;
@@ -261,7 +261,10 @@ int journal_recover(journal_t *journal)
 	journal->j_transaction_sequence = ++info.end_transaction;
 
 	journal_clear_revoke(journal);
-	sync_blockdev(journal->j_fs_dev);
+	err2 = sync_blockdev(journal->j_fs_dev);
+	if (!err)
+		err = err2;
+
 	return err;
 }
 
--- a/include/linux/jbd.h
+++ b/include/linux/jbd.h
@@ -908,7 +908,7 @@ extern int	   journal_set_features
 		   (journal_t *, unsigned long, unsigned long, unsigned long);
 extern int	   journal_create     (journal_t *);
 extern int	   journal_load       (journal_t *journal);
-extern void	   journal_destroy    (journal_t *);
+extern int	   journal_destroy    (journal_t *);
 extern int	   journal_recover    (journal_t *journal);
 extern int	   journal_wipe       (journal_t *, int);
 extern int	   journal_skip_recovery	(journal_t *);

[patch 17/83] jbd: test BH_Write_EIO to detect errors on metadata buffers

[Greg KH]

[-- Attachment #1: jbd-test-bh_write_eio-to-detect-errors-on-metadata-buffers.patch --]
[-- Type: text/plain, Size: 2037 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>

commit 9f818b4ac04f53458d0354950b4f229f54be4dbf upstream.

__try_to_free_cp_buf(), __process_buffer(), and __wait_cp_io() test
BH_Uptodate flag to detect write I/O errors on metadata buffers.  But by
commit 95450f5a7e53d5752ce1a0d0b8282e10fe745ae0 "ext3: don't read inode
block if the buffer has a write error"(*), BH_Uptodate flag can be set to
inode buffers with BH_Write_EIO in order to avoid reading old inode data.
So now, we have to test BH_Write_EIO flag of checkpointing inode buffers
instead of BH_Uptodate.  This patch does it.

Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
Acked-by: Jan Kara <jack@suse.cz>
Acked-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/jbd/checkpoint.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/fs/jbd/checkpoint.c
+++ b/fs/jbd/checkpoint.c
@@ -94,7 +94,7 @@ static int __try_to_free_cp_buf(struct j
 	struct buffer_head *bh = jh2bh(jh);
 
 	if (jh->b_jlist == BJ_None && !buffer_locked(bh) &&
-	    !buffer_dirty(bh) && buffer_uptodate(bh)) {
+	    !buffer_dirty(bh) && !buffer_write_io_error(bh)) {
 		JBUFFER_TRACE(jh, "remove from checkpoint list");
 		ret = __journal_remove_checkpoint(jh) + 1;
 		jbd_unlock_bh_state(bh);
@@ -199,7 +199,7 @@ restart:
 			spin_lock(&journal->j_list_lock);
 			goto restart;
 		}
-		if (unlikely(!buffer_uptodate(bh)))
+		if (unlikely(buffer_write_io_error(bh)))
 			ret = -EIO;
 
 		/*
@@ -268,7 +268,7 @@ static int __process_buffer(journal_t *j
 		ret = 1;
 	} else if (!buffer_dirty(bh)) {
 		ret = 1;
-		if (unlikely(!buffer_uptodate(bh)))
+		if (unlikely(buffer_write_io_error(bh)))
 			ret = -EIO;
 		J_ASSERT_JH(jh, !buffer_jbddirty(bh));
 		BUFFER_TRACE(bh, "remove from checkpoint");

[patch 18/83] spi: avoid spidev crash when device is removed

[Greg KH]

[-- Attachment #1: spi-avoid-spidev-crash-when-device-is-removed.patch --]
[-- Type: text/plain, Size: 2445 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Wolfgang Ocker <weo@reccoware.de>

commit aaacf4bb51b243875b203e6ff73b5047636b4efa upstream.

I saw a kernel oops in spidev_remove() when a spidev device was registered
and I unloaded the SPI master driver:

Unable to handle kernel paging request for data at address 0x00000004
Faulting instruction address: 0xc01c0c50
Oops: Kernel access of bad area, sig: 11 [#1]
CDSPR
Modules linked in: spi_ppc4xx(-)
NIP: c01c0c50 LR: c01bf9e4 CTR: c01c0c34
REGS: cec89c30 TRAP: 0300   Not tainted  (2.6.27.3izt)
MSR: 00021000 <ME>  CR: 24000228  XER: 20000007
DEAR: 00000004, ESR: 00800000
TASK = cf889040[2070] 'rmmod' THREAD: cec88000
GPR00: 00000000 cec89ce0 cf889040 cec8e000 00000004 cec8e000 ffffffff 00000000
GPR08: 0000001c c0336380 00000000 c01c0c34 00000001 1001a338 100e0000 100df49c
GPR16: 100b54c0 100df49c 100ddd20 100f05a8 100b5340 100efd68 00000000 00000000
GPR24: 100ec008 100f0428 c0327788 c0327794 cec8e0ac cec8e000 c0336380 00000000
NIP [c01c0c50] spidev_remove+0x1c/0xe4
LR [c01bf9e4] spi_drv_remove+0x2c/0x3c
Call Trace:
[cec89d00] [c01bf9e4] spi_drv_remove+0x2c/0x3c
[cec89d10] [c01859a0] __device_release_driver+0x78/0xb4
[cec89d20] [c0185ab0] device_release_driver+0x28/0x44
[cec89d40] [c0184be8] bus_remove_device+0xac/0xd8
[cec89d60] [c0183094] device_del+0x100/0x194
[cec89d80] [c0183140] device_unregister+0x18/0x30
[cec89da0] [c01bf30c] __unregister+0x20/0x34
[cec89db0] [c0182778] device_for_each_child+0x38/0x74
[cec89de0] [c01bf2d0] spi_unregister_master+0x28/0x44
[cec89e00] [c01bfeac] spi_bitbang_stop+0x1c/0x58
[cec89e20] [d908a5e0] spi_ppc4xx_of_remove+0x24/0x7c [spi_ppc4xx]
[...]

IMHO a call to spi_set_drvdata() is missing in spidev_probe(). The patch
below helped.

Signed-off-by: Wolfgang Ocker <weo@reccoware.de>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/spi/spidev.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -598,7 +598,9 @@ static int spidev_probe(struct spi_devic
 	}
 	mutex_unlock(&device_list_lock);
 
-	if (status != 0)
+	if (status == 0)
+		spi_set_drvdata(spi, spidev);
+	else
 		kfree(spidev);
 
 	return status;

[patch 19/83] ATM: CVE-2008-5079: duplicate listen() on socket corrupts the vcc table

[Greg KH]

[-- Attachment #1: atm-cve-2008-5079-duplicate-listen-on-socket-corrupts-the-vcc-table.patch --]
[-- Type: text/plain, Size: 1274 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Chas Williams <chas@cmf.nrl.navy.mil>

commit 17b24b3c97498935a2ef9777370b1151dfed3f6f upstream.

As reported by Hugo Dias that it is possible to cause a local denial
of service attack by calling the svc_listen function twice on the same
socket and reading /proc/net/atm/*vc

Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/atm/svc.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -293,7 +293,10 @@ static int svc_listen(struct socket *soc
 		error = -EINVAL;
 		goto out;
 	}
-	vcc_insert_socket(sk);
+	if (test_bit(ATM_VF_LISTEN, &vcc->flags)) {
+		error = -EADDRINUSE;
+		goto out;
+        }
 	set_bit(ATM_VF_WAITING, &vcc->flags);
 	prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
 	sigd_enq(vcc,as_listen,NULL,NULL,&vcc->local);
@@ -307,6 +310,7 @@ static int svc_listen(struct socket *soc
 		goto out;
 	}
 	set_bit(ATM_VF_LISTEN,&vcc->flags);
+	vcc_insert_socket(sk);
 	sk->sk_max_ack_backlog = backlog > 0 ? backlog : ATM_BACKLOG_DEFAULT;
 	error = -sk->sk_err;
 out:

[patch 20/83] powerpc/mpic: Dont reset affinity for secondary MPIC on boot

[Greg KH]

[-- Attachment #1: powerpc-mpic-don-t-reset-affinity-for-secondary-mpic-on-boot.patch --]
[-- Type: text/plain, Size: 2164 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit cc353c30bbdb84f4317a6c149ebb11cde2232e40 upstream.

Kexec/kdump currently fails on the IBM QS2x blades when the kexec happens
on a CPU other than the initial boot CPU.  It turns out that this is the
result of mpic_init trying to set affinity of each interrupt vector to the
current boot CPU.

As far as I can tell,  the same problem is likely to exist on any
secondary MPIC, because they have to deliver interrupts to the first
output all the time. There are two potential solutions for this: either
not set up affinity at all for secondary MPICs, or assume that a single
CPU output is connected to the upstream interrupt controller and hardcode
affinity to that per architecture.

This patch implements the second approach, defaulting to the first output.
Currently, all known secondary MPICs are routed to their upstream port
using the first destination, so we hardcode that.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/powerpc/sysdev/mpic.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -1271,6 +1271,7 @@ void __init mpic_set_default_senses(stru
 void __init mpic_init(struct mpic *mpic)
 {
 	int i;
+	int cpu;
 
 	BUG_ON(mpic->num_sources == 0);
 
@@ -1313,6 +1314,11 @@ void __init mpic_init(struct mpic *mpic)
 
 	mpic_pasemi_msi_init(mpic);
 
+	if (mpic->flags & MPIC_PRIMARY)
+		cpu = hard_smp_processor_id();
+	else
+		cpu = 0;
+
 	for (i = 0; i < mpic->num_sources; i++) {
 		/* start with vector = source number, and masked */
 		u32 vecpri = MPIC_VECPRI_MASK | i |
@@ -1323,8 +1329,7 @@ void __init mpic_init(struct mpic *mpic)
 			continue;
 		/* init hw */
 		mpic_irq_write(i, MPIC_INFO(IRQ_VECTOR_PRI), vecpri);
-		mpic_irq_write(i, MPIC_INFO(IRQ_DESTINATION),
-			       1 << hard_smp_processor_id());
+		mpic_irq_write(i, MPIC_INFO(IRQ_DESTINATION), 1 << cpu);
 	}
 	
 	/* Init spurious vector */

[patch 21/83] Input: i8042 - add Thinkpad R31 to nomux list

[Greg KH]

[-- Attachment #1: input-i8042-add-thinkpad-r31-to-nomux-list.patch --]
[-- Type: text/plain, Size: 1013 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Colin B Macdonald <cbm@m.fsf.org>

commit 5bd8a05e937b3ab88cd7ea569e32738f36c42bd0 upstream.

Thinkpad R31 needs i8042 nomux quirk.  Stops jittery jumping mouse
and random keyboard input. Fixes kernel bug #11723.  Cherry picked
from Ubuntu who have sometimes (on-again-off-again) had a fix in
their patched kernels.

Signed-off-by: Colin B Macdonald <cbm@m.fsf.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/input/serio/i8042-x86ia64io.h |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -322,6 +322,13 @@ static struct dmi_system_id __initdata i
 			DMI_MATCH(DMI_PRODUCT_NAME, "N34AS6"),
 		},
 	},
+	{
+		.ident = "IBM 2656",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "IBM"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "2656"),
+		},
+	},
 	{ }
 };
 

[patch 22/83] Input: i8042 - add Blue FB5601 to noloop exception table

[Greg KH]

[-- Attachment #1: input-i8042-add-blue-fb5601-to-noloop-exception-table.patch --]
[-- Type: text/plain, Size: 856 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Stefan Bader <stefan.bader@canonical.com>

commit 2c6f2cb83b239b7d45da9246cafd27ee615ee35b upstream.

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/input/serio/i8042-x86ia64io.h |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -135,6 +135,14 @@ static struct dmi_system_id __initdata i
 			DMI_MATCH(DMI_PRODUCT_VERSION, "5a"),
 		},
 	},
+	{
+		.ident = "Blue FB5601",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "blue"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "FB5601"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "M606"),
+		},
+	},
 	{ }
 };
 

[patch 23/83] Input: i8042 - add Dell XPS M1530 to nomux list

[Greg KH]

[-- Attachment #1: input-i8042-add-dell-xps-m1530-to-nomux-list.patch --]
[-- Type: text/plain, Size: 1168 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Herton Ronaldo Krzesinski <herton@mandriva.com.br>

commit 786b11cc0f505e44c29f778fd329dafafafed76c upstream.

Dell XPS M1530 needs i8042.nomux=1 for ALPS touchpad to work as
reported on https://qa.mandriva.com/show_bug.cgi?id=43532

It is said that before A08 bios version this isn't needed (I don't
have the hardware so can't check), and suppose this will not break
with bios versions before A08.

Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
Tested-by: Andreas Ericsson <ae@op5.se>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/input/serio/i8042-x86ia64io.h |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -337,6 +337,13 @@ static struct dmi_system_id __initdata i
 			DMI_MATCH(DMI_PRODUCT_NAME, "2656"),
 		},
 	},
+	{
+		.ident = "Dell XPS M1530",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "XPS M1530"),
+		},
+	},
 	{ }
 };
 

[patch 24/83] Input: i8042 - add Compal Hel80 laptop to nomux blacklist

[Greg KH]

[-- Attachment #1: input-i8042-add-compal-hel80-laptop-to-nomux-blacklist.patch --]
[-- Type: text/plain, Size: 808 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 5f4ba04ffd8fc9f6b15b92270ef0517ae52dcf3a upstream.

Reported-by: Jaime Cura <jimyx17@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/input/serio/i8042-x86ia64io.h |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -344,6 +344,13 @@ static struct dmi_system_id __initdata i
 			DMI_MATCH(DMI_PRODUCT_NAME, "XPS M1530"),
 		},
 	},
+	{
+		.ident = "Compal HEL80I",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "COMPAL"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "HEL80I"),
+		},
+	},
 	{ }
 };
 

[patch 25/83] edac: fix enabling of polling cell module

[Greg KH]

[-- Attachment #1: edac-fix-enabling-of-polling-cell-module.patch --]
[-- Type: text/plain, Size: 1317 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

commit 992b692dcf43612be805465ca4b76f434c715023 upstream.

The edac driver on cell turned out to be not enabled because of a missing
op_state.  This patch introduces it.  Verified to work on top of Ben's
next branch.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jens Osterkamp <jens@linux.vnet.ibm.com>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Doug Thompson <dougthompson@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/edac/cell_edac.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/edac/cell_edac.c
+++ b/drivers/edac/cell_edac.c
@@ -9,6 +9,7 @@
  */
 #undef DEBUG
 
+#include <linux/edac.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
@@ -164,6 +165,8 @@ static int __devinit cell_edac_probe(str
 	if (regs == NULL)
 		return -ENODEV;
 
+	edac_op_state = EDAC_OPSTATE_POLL;
+
 	/* Get channel population */
 	reg = in_be64(&regs->mic_mnt_cfg);
 	dev_dbg(&pdev->dev, "MIC_MNT_CFG = 0x%016lx\n", reg);

[patch 26/83] USB: option: add Ericsson F3507g and Dell 5530

[Greg KH]

[-- Attachment #1: usb-option-add-ericsson-f3507g-and-dell-5530.patch --]
[-- Type: text/plain, Size: 1894 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Dan Williams <dcbw@redhat.com>

commit b064eca9b0cdbb2b8f731ae2e44fa02194a1219a upstream.

Add a few more mobile broadband cards.

Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/serial/option.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -220,6 +220,10 @@ static int  option_send_setup(struct tty
 #define ZTE_PRODUCT_MF628			0x0015
 #define ZTE_PRODUCT_CDMA_TECH			0xfffe
 
+/* Ericsson products */
+#define ERICSSON_VENDOR_ID			0x0bdb
+#define ERICSSON_PRODUCT_F3507G			0x1900
+
 static struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -318,6 +322,7 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE(DELL_VENDOR_ID, 0x8136) },	/* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
 	{ USB_DEVICE(DELL_VENDOR_ID, 0x8137) },	/* Dell Wireless HSDPA 5520 */
 	{ USB_DEVICE(DELL_VENDOR_ID, 0x8138) },	/* Dell Wireless 5520 Voda I Mobile Broadband (3G HSDPA) Minicard */
+	{ USB_DEVICE(DELL_VENDOR_ID, 0x8147) },	/* Dell Wireless 5530 Mobile Broadband (3G HSPA) Mini-Card */
 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },
 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
@@ -349,6 +354,7 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
 	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
 	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
+	{ USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) },
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);

[patch 27/83] USB: option.c remove duplicate device ids now supported in hso.c

[Greg KH]

[-- Attachment #1: usb-option.c-remove-duplicate-device-ids-now-supported-in-hso.c.patch --]
[-- Type: text/plain, Size: 3730 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Denis Joseph Barrow <D.Barow@option.com>

commit 631556a0763ac155c82bbcbeed7e4b28bd737927 upstream.

Remove duplicate device ids which are now supported by drivers/usb/net/hso.c

Signed-off-by: Denis Joseph Barrow <D.Barow@option.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/serial/option.c |   22 ----------------------
 1 file changed, 22 deletions(-)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -79,27 +79,16 @@ static int  option_send_setup(struct tty
 #define OPTION_PRODUCT_VIPER			0x6600
 #define OPTION_PRODUCT_VIPER_BUS		0x6601
 #define OPTION_PRODUCT_GT_MAX_READY		0x6701
-#define OPTION_PRODUCT_GT_MAX			0x6711
 #define OPTION_PRODUCT_FUJI_MODEM_LIGHT		0x6721
 #define OPTION_PRODUCT_FUJI_MODEM_GT		0x6741
 #define OPTION_PRODUCT_FUJI_MODEM_EX		0x6761
-#define OPTION_PRODUCT_FUJI_NETWORK_LIGHT	0x6731
-#define OPTION_PRODUCT_FUJI_NETWORK_GT		0x6751
-#define OPTION_PRODUCT_FUJI_NETWORK_EX		0x6771
 #define OPTION_PRODUCT_KOI_MODEM		0x6800
-#define OPTION_PRODUCT_KOI_NETWORK		0x6811
 #define OPTION_PRODUCT_SCORPION_MODEM		0x6901
-#define OPTION_PRODUCT_SCORPION_NETWORK		0x6911
 #define OPTION_PRODUCT_ETNA_MODEM		0x7001
-#define OPTION_PRODUCT_ETNA_NETWORK		0x7011
 #define OPTION_PRODUCT_ETNA_MODEM_LITE		0x7021
 #define OPTION_PRODUCT_ETNA_MODEM_GT		0x7041
 #define OPTION_PRODUCT_ETNA_MODEM_EX		0x7061
-#define OPTION_PRODUCT_ETNA_NETWORK_LITE	0x7031
-#define OPTION_PRODUCT_ETNA_NETWORK_GT		0x7051
-#define OPTION_PRODUCT_ETNA_NETWORK_EX		0x7071
 #define OPTION_PRODUCT_ETNA_KOI_MODEM		0x7100
-#define OPTION_PRODUCT_ETNA_KOI_NETWORK		0x7111
 
 #define HUAWEI_VENDOR_ID			0x12D1
 #define HUAWEI_PRODUCT_E600			0x1001
@@ -239,27 +228,16 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_VIPER) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_VIPER_BUS) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_GT_MAX_READY) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_GT_MAX) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUJI_MODEM_LIGHT) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUJI_MODEM_GT) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUJI_MODEM_EX) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUJI_NETWORK_LIGHT) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUJI_NETWORK_GT) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUJI_NETWORK_EX) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_KOI_MODEM) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_KOI_NETWORK) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_SCORPION_MODEM) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_SCORPION_NETWORK) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_MODEM) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_NETWORK) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_MODEM_LITE) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_MODEM_GT) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_MODEM_EX) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_NETWORK_LITE) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_NETWORK_GT) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_NETWORK_EX) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_KOI_MODEM) },
-	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_KOI_NETWORK) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220BIS, 0xff, 0xff, 0xff) },

[patch 28/83] USB: Option / AnyData new modem, same ID

[Greg KH]

[-- Attachment #1: usb-option-anydata-new-modem-same-id.patch --]
[-- Type: text/plain, Size: 1239 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Jon K Hellan <hellan@acm.org>

commit bb78a825fa91621e52b9a5409fd9ef07895275bf upstream.

The AnyData ADU-310 series of wireless modems uses the same product ID as the ADU-E100 series.

Signed-off-by: Jon K Hellan <hellan@acm.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/serial/option.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -301,7 +301,7 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE(DELL_VENDOR_ID, 0x8137) },	/* Dell Wireless HSDPA 5520 */
 	{ USB_DEVICE(DELL_VENDOR_ID, 0x8138) },	/* Dell Wireless 5520 Voda I Mobile Broadband (3G HSDPA) Minicard */
 	{ USB_DEVICE(DELL_VENDOR_ID, 0x8147) },	/* Dell Wireless 5530 Mobile Broadband (3G HSPA) Mini-Card */
-	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },
+	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },	/* ADU-E100, ADU-310 */
 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
 	{ USB_DEVICE(AXESSTEL_VENDOR_ID, AXESSTEL_PRODUCT_MV110H) },

[patch 29/83] USB: option: add Pantech cards

[Greg KH]

[-- Attachment #1: usb-option-add-pantech-cards.patch --]
[-- Type: text/plain, Size: 1476 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Dan Williams <dcbw@redhat.com>

commit 8b6346ec899713a90890c9e832f7eff91ea73504 upstream

Add some Pantech mobile broadband IDs.

Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/serial/option.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -213,6 +213,12 @@ static int  option_send_setup(struct tty
 #define ERICSSON_VENDOR_ID			0x0bdb
 #define ERICSSON_PRODUCT_F3507G			0x1900
 
+/* Pantech products */
+#define PANTECH_VENDOR_ID			0x106c
+#define PANTECH_PRODUCT_PC5740			0x3701
+#define PANTECH_PRODUCT_PC5750			0x3702  /* PX-500 */
+#define PANTECH_PRODUCT_UM150			0x3711
+
 static struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -333,6 +339,9 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
 	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
 	{ USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) },
+	{ USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_PC5740) },
+	{ USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_PC5750) },
+	{ USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_UM150) },
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);

[patch 30/83] USB: add ZTE MF626 USB GSM modem entry

[Greg KH]

[-- Attachment #1: usb-add-zte-mf626-usb-gsm-modem-entry.patch --]
[-- Type: text/plain, Size: 1199 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Mikhail Gusarov <dottedmag@dottedmag.net>

commit bfd8408d68975759aba1b466af6f5388d7adb836 upstream

Signed-off-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/serial/option.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -207,6 +207,7 @@ static int  option_send_setup(struct tty
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID				0x19d2
 #define ZTE_PRODUCT_MF628			0x0015
+#define ZTE_PRODUCT_MF626			0x0031
 #define ZTE_PRODUCT_CDMA_TECH			0xfffe
 
 /* Ericsson products */
@@ -336,6 +337,7 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
 	{ USB_DEVICE(MAXON_VENDOR_ID, 0x6280) }, /* BP3-USB & BP3-EXT HSDPA */
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
+	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626) },
 	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
 	{ USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
 	{ USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) },

[patch 31/83] USB: support Huawei data card product IDs

[Greg KH]

[-- Attachment #1: usb-support-huawei-data-card-product-ids.patch --]
[-- Type: text/plain, Size: 10026 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: fangxiaozhi <huananhu@huawei.com>

commit 1460e5e44cc5ecad7704f63b10dcb3a59d0e008b upstream

In this patch, we want to do one thing: add more Huawei product IDs into the
USB driver. Then it can support  more Huawei data card devices. So to declare
the unusual device for new Huawei data card devices in unusual_devs.h and to
declare more new product IDs in option.c.

To modify the data value and length in the function of
usb_stor_huawei_e220_init in initializers.c That's because based on the USB
standard, while sending SET_FETURE_D to the device, it requires the
corresponding data to be zero, and its sending length also must be zero.  In
our old solution, it can be compatible with our WCDMA data card devices, but
can not support our CDMA data card devices.  But in this new solution, it can
be compatible with all of our data card devices.

Signed-off-by: fangxiaozhi <huananhu@huawei.com>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/serial/option.c |   94 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -95,11 +95,20 @@ static int  option_send_setup(struct tty
 #define HUAWEI_PRODUCT_E220			0x1003
 #define HUAWEI_PRODUCT_E220BIS			0x1004
 #define HUAWEI_PRODUCT_E1401			0x1401
+#define HUAWEI_PRODUCT_E1402			0x1402
 #define HUAWEI_PRODUCT_E1403			0x1403
+#define HUAWEI_PRODUCT_E1404			0x1404
 #define HUAWEI_PRODUCT_E1405			0x1405
 #define HUAWEI_PRODUCT_E1406			0x1406
+#define HUAWEI_PRODUCT_E1407			0x1407
 #define HUAWEI_PRODUCT_E1408			0x1408
 #define HUAWEI_PRODUCT_E1409			0x1409
+#define HUAWEI_PRODUCT_E140A			0x140A
+#define HUAWEI_PRODUCT_E140B			0x140B
+#define HUAWEI_PRODUCT_E140C			0x140C
+#define HUAWEI_PRODUCT_E140D			0x140D
+#define HUAWEI_PRODUCT_E140E			0x140E
+#define HUAWEI_PRODUCT_E140F			0x140F
 #define HUAWEI_PRODUCT_E1410			0x1410
 #define HUAWEI_PRODUCT_E1411			0x1411
 #define HUAWEI_PRODUCT_E1412			0x1412
@@ -110,6 +119,44 @@ static int  option_send_setup(struct tty
 #define HUAWEI_PRODUCT_E1417			0x1417
 #define HUAWEI_PRODUCT_E1418			0x1418
 #define HUAWEI_PRODUCT_E1419			0x1419
+#define HUAWEI_PRODUCT_E141A			0x141A
+#define HUAWEI_PRODUCT_E141B			0x141B
+#define HUAWEI_PRODUCT_E141C			0x141C
+#define HUAWEI_PRODUCT_E141D			0x141D
+#define HUAWEI_PRODUCT_E141E			0x141E
+#define HUAWEI_PRODUCT_E141F			0x141F
+#define HUAWEI_PRODUCT_E1420			0x1420
+#define HUAWEI_PRODUCT_E1421			0x1421
+#define HUAWEI_PRODUCT_E1422			0x1422
+#define HUAWEI_PRODUCT_E1423			0x1423
+#define HUAWEI_PRODUCT_E1424			0x1424
+#define HUAWEI_PRODUCT_E1425			0x1425
+#define HUAWEI_PRODUCT_E1426			0x1426
+#define HUAWEI_PRODUCT_E1427			0x1427
+#define HUAWEI_PRODUCT_E1428			0x1428
+#define HUAWEI_PRODUCT_E1429			0x1429
+#define HUAWEI_PRODUCT_E142A			0x142A
+#define HUAWEI_PRODUCT_E142B			0x142B
+#define HUAWEI_PRODUCT_E142C			0x142C
+#define HUAWEI_PRODUCT_E142D			0x142D
+#define HUAWEI_PRODUCT_E142E			0x142E
+#define HUAWEI_PRODUCT_E142F			0x142F
+#define HUAWEI_PRODUCT_E1430			0x1430
+#define HUAWEI_PRODUCT_E1431			0x1431
+#define HUAWEI_PRODUCT_E1432			0x1432
+#define HUAWEI_PRODUCT_E1433			0x1433
+#define HUAWEI_PRODUCT_E1434			0x1434
+#define HUAWEI_PRODUCT_E1435			0x1435
+#define HUAWEI_PRODUCT_E1436			0x1436
+#define HUAWEI_PRODUCT_E1437			0x1437
+#define HUAWEI_PRODUCT_E1438			0x1438
+#define HUAWEI_PRODUCT_E1439			0x1439
+#define HUAWEI_PRODUCT_E143A			0x143A
+#define HUAWEI_PRODUCT_E143B			0x143B
+#define HUAWEI_PRODUCT_E143C			0x143C
+#define HUAWEI_PRODUCT_E143D			0x143D
+#define HUAWEI_PRODUCT_E143E			0x143E
+#define HUAWEI_PRODUCT_E143F			0x143F
 
 #define NOVATELWIRELESS_VENDOR_ID		0x1410
 
@@ -249,11 +296,20 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220BIS, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1401, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1402, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1403, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1404, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1405, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1406, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1407, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1408, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1409, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140A, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140B, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140C, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140D, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140E, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140F, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1410, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1411, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1412, 0xff, 0xff, 0xff) },
@@ -264,6 +320,44 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1417, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1418, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1419, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141A, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141B, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141C, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141D, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141E, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141F, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1420, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1421, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1422, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1423, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1424, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1425, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1426, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1427, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1428, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1429, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142A, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142B, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142C, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142D, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142E, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142F, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1430, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1431, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1432, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1433, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1434, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1435, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1436, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1437, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1438, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1439, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143A, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143B, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143C, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_9508) },
 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, /* Novatel Merlin V640/XV620 */
 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, /* Novatel Merlin V620/S620 */

[patch 32/83] USB: Add YISO u893 usb modem vendor and product IDs to option driver

[Greg KH]

[-- Attachment #1: usb-add-yiso-u893-usb-modem-vendor-and-product-ids-to-option-driver.patch --]
[-- Type: text/plain, Size: 1408 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Leslie Watter <leslie.watter@gmail.com>

commit c6206faa4f18bcc837a12552b8c184ab1668fdea upstream

This patch adds YISO u893 usb modem vendor and product ID to option.c.

I had a better experience using this modification and the same system.

Signed-off-by: Leslie Harlley Watter <leslie@watter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/serial/option.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -160,6 +160,11 @@ static int  option_send_setup(struct tty
 
 #define NOVATELWIRELESS_VENDOR_ID		0x1410
 
+/* YISO PRODUCTS */
+
+#define YISO_VENDOR_ID				0x0EAB
+#define YISO_PRODUCT_U893			0xC893
+
 /* MERLIN EVDO PRODUCTS */
 #define NOVATELWIRELESS_PRODUCT_V640		0x1100
 #define NOVATELWIRELESS_PRODUCT_V620		0x1110
@@ -408,6 +413,7 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE(AXESSTEL_VENDOR_ID, AXESSTEL_PRODUCT_MV110H) },
 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_MSA501HS) },
 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_ET502HS) },
+	{ USB_DEVICE(YISO_VENDOR_ID, YISO_PRODUCT_U893) },
 	{ USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_1) },
 	{ USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_2) },
 	{ USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_1004) },

[patch 33/83] USB: serial: add more Onda device ids to option driver

[Greg KH]

[-- Attachment #1: usb-serial-add-more-onda-device-ids-to-option-driver.patch --]
[-- Type: text/plain, Size: 2686 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Greg Kroah-Hartman <gregkh@suse.de>

commit 5bb4bd9895df508ed2bd8b3280252d8a8170e4ac upstream.

Thanks to Domenico Riccio for pointing these out.

Cc: Domenico Riccio <domenico.riccio@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/usb/serial/option.c |   35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -224,6 +224,7 @@ static int  option_send_setup(struct tty
 #define ONDA_VENDOR_ID				0x19d2
 #define ONDA_PRODUCT_MSA501HS			0x0001
 #define ONDA_PRODUCT_ET502HS			0x0002
+#define ONDA_PRODUCT_MT503HS			0x0200
 
 #define BANDRICH_VENDOR_ID			0x1A8D
 #define BANDRICH_PRODUCT_C100_1			0x1002
@@ -413,6 +414,40 @@ static struct usb_device_id option_ids[]
 	{ USB_DEVICE(AXESSTEL_VENDOR_ID, AXESSTEL_PRODUCT_MV110H) },
 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_MSA501HS) },
 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_ET502HS) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0003) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0004) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0005) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0006) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0007) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0008) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0009) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x000a) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x000b) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x000c) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x000d) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x000e) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x000f) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0010) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0011) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0012) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0013) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0014) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0015) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0016) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0017) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0018) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0019) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0020) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0021) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0022) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0023) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0024) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0025) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0026) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0027) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0028) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, 0x0029) },
+	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_MT503HS) },
 	{ USB_DEVICE(YISO_VENDOR_ID, YISO_PRODUCT_U893) },
 	{ USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_1) },
 	{ USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_2) },

[patch 34/83] USB: unusual-devs: support Huawei data card product IDs

[Greg KH]

[-- Attachment #1: usb-unusual-devs-support-huawei-data-card-product-ids.patch --]
[-- Type: text/plain, Size: 12342 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: fangxiaozhi <huananhu@huawei.com>

commit 1460e5e44cc5ecad7704f63b10dcb3a59d0e008b upstream.

In this patch, we want to do one thing: add more Huawei product IDs into the
USB driver. Then it can support  more Huawei data card devices. So to declare
the unusual device for new Huawei data card devices in unusual_devs.h and to
declare more new product IDs in option.c.

To modify the data value and length in the function of
usb_stor_huawei_e220_init in initializers.c That's because based on the USB
standard, while sending SET_FETURE_D to the device, it requires the
corresponding data to be zero, and its sending length also must be zero.  In
our old solution, it can be compatible with our WCDMA data card devices, but
can not support our CDMA data card devices.  But in this new solution, it can
be compatible with all of our data card devices.

Signed-off-by: fangxiaozhi <huananhu@huawei.com>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/storage/unusual_devs.h |  273 ++++++++++++++++++++++++++++++++++---
 1 file changed, 254 insertions(+), 19 deletions(-)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1635,97 +1635,332 @@ UNUSUAL_DEV(  0x1210, 0x0003, 0x0100, 0x
 /* Reported by fangxiaozhi <huananhu@huawei.com>
  * This brings the HUAWEI data card devices into multi-port mode
  */
-UNUSUAL_DEV( 0x12d1, 0x1001, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1001, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1003, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1003, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1004, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1004, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1401, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1401, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1403, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1402, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1405, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1403, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1406, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1404, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1408, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1405, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1409, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1406, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1410, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1407, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1411, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1408, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1412, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1409, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1413, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x140A, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1414, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x140B, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1415, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x140C, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1416, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x140D, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1417, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x140E, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1418, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x140F, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
 		0),
-UNUSUAL_DEV( 0x12d1, 0x1419, 0x0000, 0x0000,
+UNUSUAL_DEV(  0x12d1, 0x1410, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1411, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1412, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1413, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1414, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1415, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1416, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1417, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1418, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1419, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x141A, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x141B, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x141C, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x141D, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x141E, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x141F, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1420, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1421, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1422, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1423, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1424, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1425, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1426, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1427, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1428, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1429, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x142A, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x142B, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x142C, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x142D, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x142E, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x142F, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1430, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1431, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1432, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1433, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1434, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1435, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1436, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1437, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1438, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x1439, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x143A, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x143B, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x143C, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x143D, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x143E, 0x0000, 0x0000,
+		"HUAWEI MOBILE",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,
+		0),
+UNUSUAL_DEV(  0x12d1, 0x143F, 0x0000, 0x0000,
 		"HUAWEI MOBILE",
 		"Mass Storage",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_huawei_e220_init,

[patch 35/83] USB: Unusual dev for Mio moov 330 gps

[Greg KH]

[-- Attachment #1: usb-unusual-dev-for-mio-moov-330-gps.patch --]
[-- Type: text/plain, Size: 1234 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Frédéric Marchal <frederic.marchal@wowcompany.com>

commit e8fab4ce763c36869624c5388714ff19c30a91a7 upstream

Here is an entry for the unusual_devs.h file to handle a Mio Moov 330 GPS that
stops responding when it is requested to transfer more than 64KB. The patch is
taken against kernel-2.6.27-git3.

Signed-off-by: Frédéric Marchal <frederic.marchal@wowcompany.com>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/storage/unusual_devs.h |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2069,6 +2069,15 @@ UNUSUAL_DEV(  0x2770, 0x915d, 0x0010, 0x
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_FIX_CAPACITY ),
 
+/* Reported by Frederic Marchal <frederic.marchal@wowcompany.com>
+ * Mio Moov 330
+ */
+UNUSUAL_DEV(  0x3340, 0xffff, 0x0000, 0x0000,
+		"Mitac",
+		"Mio DigiWalker USB Sync",
+		US_SC_DEVICE,US_PR_DEVICE,NULL,
+		US_FL_MAX_SECTORS_64 ),
+
 /* Reported by Andrey Rahmatullin <wrar@altlinux.org> */
 UNUSUAL_DEV(  0x4102, 0x1020, 0x0100,  0x0100,
 		"iRiver",

[patch 36/83] USB: Unusual dev for the "Kyocera / Contax SL300R T*" digital camera.

[Greg KH]

[-- Attachment #1: usb-unusual-dev-for-the-kyocera-contax-sl300r-t-digital-camera.patch --]
[-- Type: text/plain, Size: 1313 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Jens Taprogge <jens.taprogge@taprogge.org>

commit 74511bb340059be5a3fceb032213c7f325344694 upstream

The camera reports an incorrect size and fails to handle PREVENT-ALLOW
MEDIUM REMOVAL commands.  The patch marks the camera as an unusual dev
and adds the flags to enable the workarounds for both shortcomings.

Signed-off-by: Jens Taprogge <jens.taprogge@taprogge.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/storage/unusual_devs.h |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -333,6 +333,13 @@ UNUSUAL_DEV(  0x0482, 0x0103, 0x0100, 0x
 		"Finecam S5",
 		US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_FIX_INQUIRY),
 
+/* Patch submitted by Jens Taprogge <jens.taprogge@taprogge.org> */
+UNUSUAL_DEV(  0x0482, 0x0107, 0x0100, 0x0100,
+		"Kyocera",
+		"CONTAX SL300R T*",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_FIX_CAPACITY | US_FL_NOT_LOCKABLE),
+
 /* Reported by Paul Stewart <stewart@wetlogic.net>
  * This entry is needed because the device reports Sub=ff */
 UNUSUAL_DEV(  0x04a4, 0x0004, 0x0001, 0x0001,

[patch 37/83] USB: add Nikon D300 camera to unusual_devs

[Greg KH]

[-- Attachment #1: usb-add-nikon-d300-camera-to-unusual_devs.patch --]
[-- Type: text/plain, Size: 1642 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Paul Ready <lxtwin@homecall.co.uk>

commit 0047ca0a45c6a481abd467fb52d2a480ffc8c6b9 upstream

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11685

When A Nikon D300 camera is connected to a system it is seen in
/proc/bus/pci/devices but is not accessible.

This is seen in the above file:

T:  Bus=01 Lev=01 Prnt=01 Port=05 Cnt=03 Dev#= 11 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=04b0 ProdID=041a Rev= 1.03
S:  Manufacturer=NIKON
S:  Product=NIKON DSC D300
S:  SerialNumber=000008014379
C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=  2mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=06(still) Sub=01 Prot=01 Driver=usbfs
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=   8 Ivl=32ms

Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/storage/unusual_devs.h |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -418,6 +418,13 @@ UNUSUAL_DEV(  0x04b0, 0x0417, 0x0100, 0x
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_FIX_CAPACITY),
 
+/* Reported by paul ready <lxtwin@homecall.co.uk> */
+UNUSUAL_DEV(  0x04b0, 0x0419, 0x0100, 0x0200,
+		"NIKON",
+		"NIKON DSC D300",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_FIX_CAPACITY),
+
 /* Reported by Doug Maxey (dwm@austin.ibm.com) */
 UNUSUAL_DEV(  0x04b3, 0x4001, 0x0110, 0x0110,
 		"IBM",

[patch 38/83] USB: unusual devs patch for Nokia 7610 Supernova

[Greg KH]

[-- Attachment #1: usb-unusual-devs-patch-for-nokia-7610-supernova.patch --]
[-- Type: text/plain, Size: 1177 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Ricky Wong <evilbladewarrior@gmail.com>

commit ed4103b3fcf38985995e732dab6c3e2b9693f6cb upstream.

Additional sectors were reported by the Nokia 7610 Supernova phone in
usb storage mode. The following patch rectifies the aforementioned
problem.

Signed-off-by: Ricky Wong Yung Fei <evilbladewarrior@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/storage/unusual_devs.h |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -253,6 +253,14 @@ UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x
 	US_SC_DEVICE, US_PR_DEVICE, NULL,
 	US_FL_FIX_CAPACITY ),
 
+/* Submitted by Ricky Wong Yung Fei <evilbladewarrior@gmail.com> */
+/* Nokia 7610 Supernova - Too many sectors reported in usb storage mode */
+UNUSUAL_DEV(  0x0421, 0x00f5, 0x0000, 0x0470,
+	"Nokia",
+	"7610 Supernova",
+	US_SC_DEVICE, US_PR_DEVICE, NULL,
+	US_FL_FIX_CAPACITY ),
+
 /* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
 UNUSUAL_DEV(  0x0424, 0x0fdc, 0x0210, 0x0210,
 		"SMSC",

[patch 39/83] USB: storage: updates unusual_devs entry for the Nokia 6300

[Greg KH]

[-- Attachment #1: usb-storage-updates-unusual_devs-entry-for-the-nokia-6300.patch --]
[-- Type: text/plain, Size: 1015 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

commit 9beba53dc5c330d781ecc0ad8ea081c2d100ff9f upstream

This patch (as1169) modifies the unusual_devs entry for the Nokia
6300.  According to Maciej Gierok <mgierok@gmail.com> and David
McBride <dwm@doc.ic.ac.uk>, the revision limits need to be wider.

This fixes Bugzilla #11768.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/storage/unusual_devs.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -240,7 +240,7 @@ UNUSUAL_DEV(  0x0421, 0x04b9, 0x0551, 0x
 		US_FL_FIX_CAPACITY ),
 
 /* Reported by Richard Nauber <RichardNauber@web.de> */
-UNUSUAL_DEV(  0x0421, 0x04fa, 0x0601, 0x0601,
+UNUSUAL_DEV(  0x0421, 0x04fa, 0x0550, 0x0660,
 		"Nokia",
 		"6300",
 		US_SC_DEVICE, US_PR_DEVICE, NULL,

[patch 40/83] USB: storage: update unusual_devs entries for Nokia 5300 and 5310

[Greg KH]

[-- Attachment #1: usb-storage-update-unusual_devs-entries-for-nokia-5300-and-5310.patch --]
[-- Type: text/plain, Size: 1507 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

commit 589afd3bec907f02c133d7b8185b8af534f14a8e upstream

This patch (as1168) updates the unusual_devs entry for the Nokia 5300.
According to Jorge Lucangeli Obes <t4m5yn@gmail.com>, some existing
models have a revision number lower than the lower limit of the
current entry.

The patch also moves the entry for the Nokia 5310 to its correct place
in the file.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/storage/unusual_devs.h |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -167,6 +167,13 @@ UNUSUAL_DEV(  0x0421, 0x005d, 0x0001, 0x
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_FIX_CAPACITY ),
 
+/* Patch for Nokia 5310 capacity */
+UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x0591,
+		"Nokia",
+		"5310",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_FIX_CAPACITY ),
+
 /* Reported by Mario Rettig <mariorettig@web.de> */
 UNUSUAL_DEV(  0x0421, 0x042e, 0x0100, 0x0100,
 		"Nokia",
@@ -233,7 +240,7 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x
 		US_FL_MAX_SECTORS_64 ),
 
 /* Reported by Cedric Godin <cedric@belbone.be> */
-UNUSUAL_DEV(  0x0421, 0x04b9, 0x0551, 0x0551,
+UNUSUAL_DEV(  0x0421, 0x04b9, 0x0500, 0x0551,
 		"Nokia",
 		"5300",
 		US_SC_DEVICE, US_PR_DEVICE, NULL,

[patch 41/83] USB: storage: unusual_devs entry for Mio C520-GPS

[Greg KH]

[-- Attachment #1: usb-storage-unusual_devs-entry-for-mio-c520-gps.patch --]
[-- Type: text/plain, Size: 1457 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

commit a6b7b034d7f20761c55743be2acb762ce09a0c6b upstream

This patch (as1176) adds an unusual_devs entry for the Mio C520 GPS
unit.  Other devices also based on the Mitac hardware use the same USB
interface firmware, so the Vendor and Product names are generalized.

This fixes Bugzilla #11583.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Tamas Kerecsen <kerecsen@bigfoot.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/storage/unusual_devs.h |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -318,6 +318,18 @@ UNUSUAL_DEV(  0x045a, 0x5210, 0x0101, 0x
 		US_SC_SCSI, US_PR_KARMA, rio_karma_init, 0),
 #endif
 
+/* Reported by Tamas Kerecsen <kerecsen@bigfoot.com>
+ * Obviously the PROM has not been customized by the VAR;
+ * the Vendor and Product string descriptors are:
+ *	Generic Mass Storage (PROTOTYPE--Remember to change idVendor)
+ *	Generic Manufacturer (PROTOTYPE--Remember to change idVendor)
+ */
+UNUSUAL_DEV(  0x045e, 0xffff, 0x0000, 0x0000,
+		"Mitac",
+		"GPS",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_MAX_SECTORS_64 ),
+
 /*
  * This virtual floppy is found in Sun equipment (x4600, x4200m2, etc.)
  * Reported by Pete Zaitcev <zaitcev@redhat.com>

[patch 42/83] USB: usb-storage: unusual_devs entry for Nikon D2H

[Greg KH]

[-- Attachment #1: usb-usb-storage-unusual_devs-entry-for-nikon-d2h.patch --]
[-- Type: text/plain, Size: 1036 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Tobias Kunze Briseño <t@fictive.com>,

commit 621b239d75b790ac66854d46b094874f69e6776e upstream

This patch adds an unusual_devs entry for the Nikon D2H camera.

From: Tobias Kunze Briseño <t@fictive.com>,
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/storage/unusual_devs.h |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -389,6 +389,13 @@ UNUSUAL_DEV(  0x04b0, 0x0401, 0x0200, 0x
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_FIX_CAPACITY),
 
+/* Reported by Tobias Kunze Briseno <t-linux@fictive.com> */
+UNUSUAL_DEV(  0x04b0, 0x0403, 0x0200, 0x0200,
+		"NIKON",
+		"NIKON DSC D2H",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_FIX_CAPACITY),
+
 /* Reported by Milinevsky Dmitry <niam.niam@gmail.com> */
 UNUSUAL_DEV(  0x04b0, 0x0409, 0x0100, 0x0100,
 		"NIKON",

[patch 43/83] ALSA: HDA: hda_proc: Fix printf format specifier

[Greg KH]

[-- Attachment #1: alsa-hda-hda_proc-fix-printf-format-specifier.patch --]
[-- Type: text/plain, Size: 1048 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Robin H. Johnson <robbat2@gentoo.org>

commit 0481f4534910e644626a3607b2a1a979420a2d05 upstream.

The Pincap output had a typod format specifier, leading to an extraneous "08"
in the output, which is a reserved bit of the Vref field, and was really
confused :-).

Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/hda/hda_proc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -216,7 +216,7 @@ static void print_pin_caps(struct snd_in
 	unsigned int caps, val;
 
 	caps = snd_hda_param_read(codec, nid, AC_PAR_PIN_CAP);
-	snd_iprintf(buffer, "  Pincap 0x08%x:", caps);
+	snd_iprintf(buffer, "  Pincap 0x%08x:", caps);
 	if (caps & AC_PINCAP_IN)
 		snd_iprintf(buffer, " IN");
 	if (caps & AC_PINCAP_OUT)

[patch 44/83] ALSA: hda - Fix sound on NEC Versa S9100

[Greg KH]

[-- Attachment #1: alsa-hda-fix-sound-on-nec-versa-s9100.patch --]
[-- Type: text/plain, Size: 3511 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Pascal Terjan <pterjan@mandriva.com>

commit e8f9ae2a4a0654e7798b8c0ae956e3f0fdc23c8d upstream

This patch adds sound support for NEC Versa S9100
With it, we get sound on the internal speaker and headphone (with
automute working) while there is no sound by default.
External mic also works fine but I don't know if there is an internal
one (if there is an internal mic it does not work currently), and I
had to send back the hardware.

Signed-off-by: Pascal Terjan <pterjan@mandriva.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |   48 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -100,6 +100,7 @@ enum {
 	ALC262_BENQ_T31,
 	ALC262_ULTRA,
 	ALC262_LENOVO_3000,
+	ALC262_NEC,
 	ALC262_AUTO,
 	ALC262_MODEL_LAST /* last tag */
 };
@@ -8948,6 +8949,41 @@ static void alc262_hippo1_unsol_event(st
 }
 
 /*
+ * nec model
+ *  0x15 = headphone
+ *  0x16 = internal speaker
+ *  0x18 = external mic
+ */
+
+static struct snd_kcontrol_new alc262_nec_mixer[] = {
+	HDA_CODEC_VOLUME_MONO("Speaker Playback Volume", 0x0e, 1, 0x0, HDA_OUTPUT),
+	HDA_CODEC_MUTE_MONO("Speaker Playback Switch", 0x16, 0, 0x0, HDA_OUTPUT),
+
+	HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x0, HDA_INPUT),
+	HDA_CODEC_MUTE("Mic Playback Switch", 0x0b, 0x0, HDA_INPUT),
+	HDA_CODEC_VOLUME("Mic Boost", 0x18, 0, HDA_INPUT),
+
+	HDA_CODEC_VOLUME("Headphone Playback Volume", 0x0d, 0x0, HDA_OUTPUT),
+	HDA_CODEC_MUTE("Headphone Playback Switch", 0x15, 0x0, HDA_OUTPUT),
+	{ } /* end */
+};
+
+static struct hda_verb alc262_nec_verbs[] = {
+	/* Unmute Speaker */
+	{0x16, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
+
+	/* Headphone */
+	{0x15, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
+	{0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
+
+	/* External mic to headphone */
+	{0x0d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(1)},
+	/* External mic to speaker */
+	{0x0e, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(1)},
+	{}
+};
+
+/*
  * fujitsu model
  *  0x14 = headphone/spdif-out, 0x15 = internal speaker,
  *  0x1b = port replicator headphone out
@@ -9731,11 +9767,13 @@ static const char *alc262_models[ALC262_
 	[ALC262_SONY_ASSAMD]	= "sony-assamd",
 	[ALC262_ULTRA]		= "ultra",
 	[ALC262_LENOVO_3000]	= "lenovo-3000",
+	[ALC262_NEC]		= "nec",
 	[ALC262_AUTO]		= "auto",
 };
 
 static struct snd_pci_quirk alc262_cfg_tbl[] = {
 	SND_PCI_QUIRK(0x1002, 0x437b, "Hippo", ALC262_HIPPO),
+	SND_PCI_QUIRK(0x1033, 0x8895, "NEC Versa S9100", ALC262_NEC),
 	SND_PCI_QUIRK(0x103c, 0x12fe, "HP xw9400", ALC262_HP_BPC),
 	SND_PCI_QUIRK(0x103c, 0x12ff, "HP xw4550", ALC262_HP_BPC),
 	SND_PCI_QUIRK(0x103c, 0x1306, "HP xw8600", ALC262_HP_BPC),
@@ -9946,6 +9984,16 @@ static struct alc_config_preset alc262_p
 		.input_mux = &alc262_fujitsu_capture_source,
 		.unsol_event = alc262_lenovo_3000_unsol_event,
 	},
+	[ALC262_NEC] = {
+		.mixers = { alc262_nec_mixer },
+		.init_verbs = { alc262_nec_verbs },
+		.num_dacs = ARRAY_SIZE(alc262_dac_nids),
+		.dac_nids = alc262_dac_nids,
+		.hp_nid = 0x03,
+		.num_channel_mode = ARRAY_SIZE(alc262_modes),
+		.channel_mode = alc262_modes,
+		.input_mux = &alc262_capture_source,
+	},
 };
 
 static int patch_alc262(struct hda_codec *codec)

[patch 45/83] ALSA: hda: Add support for ECS/PC Chips boards with Sigmatel codecs

[Greg KH]

[-- Attachment #1: alsa-hda-add-support-for-ecs-pc-chips-boards-with-sigmatel-codecs.patch --]
[-- Type: text/plain, Size: 3277 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Mauro Carvalho Chehab <mchehab@infradead.org>

commit 8c650087992f1d7a3a7be2e632f4e85a52d20619 upstream

Thanks to Sistema Fenix (http://www.sistemafenix.com.br/) and CDI Brasil
(www.cdibrasil.com.br/) for sponsoring this development.

Signed-off-by: Gilberto <gilberto@sistemafenix.com.br>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_sigmatel.c |   35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -105,6 +105,7 @@ enum {
 	STAC_MACBOOK_PRO_V2,
 	STAC_IMAC_INTEL,
 	STAC_IMAC_INTEL_20,
+	STAC_ECS_202,
 	STAC_922X_DELL_D81,
 	STAC_922X_DELL_D82,
 	STAC_922X_DELL_M81,
@@ -1478,6 +1479,11 @@ static unsigned int intel_mac_v5_pin_con
 	0x400000fc, 0x400000fb,
 };
 
+static unsigned int ecs202_pin_configs[10] = {
+	0x0221401f, 0x02a19020, 0x01a19020, 0x01114010,
+	0x408000f0, 0x01813022, 0x074510a0, 0x40c400f1,
+	0x9037012e, 0x40e000f2,
+};
 
 static unsigned int *stac922x_brd_tbl[STAC_922X_MODELS] = {
 	[STAC_D945_REF] = ref922x_pin_configs,
@@ -1496,6 +1502,7 @@ static unsigned int *stac922x_brd_tbl[ST
 	[STAC_MACBOOK_PRO_V2] = intel_mac_v3_pin_configs,
 	[STAC_IMAC_INTEL] = intel_mac_v2_pin_configs,
 	[STAC_IMAC_INTEL_20] = intel_mac_v3_pin_configs,
+	[STAC_ECS_202] = ecs202_pin_configs,
 	[STAC_922X_DELL_D81] = dell_922x_d81_pin_configs,
 	[STAC_922X_DELL_D82] = dell_922x_d82_pin_configs,	
 	[STAC_922X_DELL_M81] = dell_922x_m81_pin_configs,
@@ -1519,6 +1526,7 @@ static const char *stac922x_models[STAC_
 	[STAC_MACBOOK_PRO_V2]	= "macbook-pro",
 	[STAC_IMAC_INTEL] = "imac-intel",
 	[STAC_IMAC_INTEL_20] = "imac-intel-20",
+	[STAC_ECS_202] = "ecs202",
 	[STAC_922X_DELL_D81] = "dell-d81",
 	[STAC_922X_DELL_D82] = "dell-d82",
 	[STAC_922X_DELL_M81] = "dell-m81",
@@ -1605,6 +1613,33 @@ static struct snd_pci_quirk stac922x_cfg
 		      "unknown Dell", STAC_922X_DELL_D81),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01d7,
 		      "Dell XPS M1210", STAC_922X_DELL_M82),
+	/* ECS/PC Chips boards */
+	SND_PCI_QUIRK(0x1019, 0x2144,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2608,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2633,
+		      "ECS/PC chips P17G/1333", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2811,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2812,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2813,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2814,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2815,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2816,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2817,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2818,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2819,
+		      "ECS/PC chips", STAC_ECS_202),
+	SND_PCI_QUIRK(0x1019, 0x2820,
+		      "ECS/PC chips", STAC_ECS_202),
 	{} /* terminator */
 };
 

[patch 46/83] ALSA: hda - Fix ALC269 capture source

[Greg KH]

[-- Attachment #1: alsa-hda-fix-alc269-capture-source.patch --]
[-- Type: text/plain, Size: 1621 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit e01bf5091f044011823aefa1882eb3fba0434918 upstream

ALC269 capture source wasn't properly set up.
It's an independent MUX (0x23), not a source of ADC.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |   13 +++++++++++++
 1 file changed, 13 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -11038,6 +11038,14 @@ static hda_nid_t alc269_adc_nids[1] = {
 	0x08,
 };
 
+static hda_nid_t alc269_capsrc_nids[1] = {
+	0x23,
+};
+
+/* NOTE: ADC2 (0x07) is connected from a recording *MIXER* (0x24),
+ *       not a mux!
+ */
+
 static struct hda_input_mux alc269_eeepc_dmic_capture_source = {
 	.num_items = 2,
 	.items = {
@@ -11404,6 +11412,10 @@ static int alc269_parse_auto_config(stru
 	spec->init_verbs[spec->num_init_verbs++] = alc269_init_verbs;
 	spec->num_mux_defs = 1;
 	spec->input_mux = &spec->private_imux;
+	/* set default input source */
+	snd_hda_codec_write_cache(codec, alc269_capsrc_nids[0],
+				  0, AC_VERB_SET_CONNECT_SEL,
+				  spec->input_mux->items[0].index);
 
 	err = alc_auto_add_mic_boost(codec);
 	if (err < 0)
@@ -11536,6 +11548,7 @@ static int patch_alc269(struct hda_codec
 
 	spec->adc_nids = alc269_adc_nids;
 	spec->num_adc_nids = ARRAY_SIZE(alc269_adc_nids);
+	spec->capsrc_nids = alc269_capsrc_nids;
 
 	codec->patch_ops = alc_patch_ops;
 	if (board_config == ALC269_AUTO)

[patch 47/83] ALSA: hda - Add model for Toshiba L305 laptop

[Greg KH]

[-- Attachment #1: alsa-hda-add-model-for-toshiba-l305-laptop.patch --]
[-- Type: text/plain, Size: 1189 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Travis Place <wishie@wishie.net>

commit 2346d0cde544179a8d235375f1bfbca5c141a31b upstream

Added Subsystem IDs (0x1179, 0xff64) for the Toshiba Satellite L305
laptop, so it automatically uses the ALC268_TOSHIBA quirk.

Signed-off-by: Travis Place <wishie@wishie.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10806,6 +10806,7 @@ static struct snd_pci_quirk alc268_cfg_t
 	SND_PCI_QUIRK(0x1043, 0x1205, "ASUS W7J", ALC268_3ST),
 	SND_PCI_QUIRK(0x1179, 0xff10, "TOSHIBA A205", ALC268_TOSHIBA),
 	SND_PCI_QUIRK(0x1179, 0xff50, "TOSHIBA A305", ALC268_TOSHIBA),
+	SND_PCI_QUIRK(0x1179, 0xff64, "TOSHIBA L305", ALC268_TOSHIBA),
 	SND_PCI_QUIRK(0x14c0, 0x0025, "COMPAL IFL90/JFL-92", ALC268_TOSHIBA),
 	SND_PCI_QUIRK(0x152d, 0x0763, "Diverse (CPR2000)", ALC268_ACER),
 	SND_PCI_QUIRK(0x152d, 0x0771, "Quanta IL1", ALC267_QUANTA_IL1),

[patch 48/83] ALSA: hda: fixed hp_nid DAC for DELL_M6

[Greg KH]

[-- Attachment #1: alsa-hda-fixed-hp_nid-dac-for-dell_m6.patch --]
[-- Type: text/plain, Size: 1154 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Matthew Ranostay <mranostay@embeddedalley.com>

commit f7cf0a7ce56eb91752fa441cff2669f8d61d4e5e upstream

This patch sets the HP out not used by the "Headphone to Line Out" switch to the
hp_nid.

Signed-off-by: Matthew Ranostay <mranostay@embeddedalley.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_sigmatel.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -548,8 +548,8 @@ static struct hda_verb dell_eq_core_init
 	{ 0x1f, AC_VERB_SET_VOLUME_KNOB_CONTROL, 0xec},
 	/* setup audio connections */
 	{ 0x0d, AC_VERB_SET_CONNECT_SEL, 0x00},
-	{ 0x0a, AC_VERB_SET_CONNECT_SEL, 0x01},
-	{ 0x0f, AC_VERB_SET_CONNECT_SEL, 0x02},
+	{ 0x0a, AC_VERB_SET_CONNECT_SEL, 0x02},
+	{ 0x0f, AC_VERB_SET_CONNECT_SEL, 0x01},
 	/* setup adcs to point to mixer */
 	{ 0x20, AC_VERB_SET_CONNECT_SEL, 0x0b},
 	{ 0x21, AC_VERB_SET_CONNECT_SEL, 0x0b},

[patch 49/83] ALSA: HDA: patch_analog: Fix SPDIF output on AD1989B

[Greg KH]

[-- Attachment #1: alsa-hda-patch_analog-fix-spdif-output-on-ad1989b.patch --]
[-- Type: text/plain, Size: 1202 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Robin H. Johnson <robbat2@gentoo.org>

commit e8bfc6c1d22395ab706784cb1bcd60f6f9569ed6 upstream

The SPDIF pins for AD1989 are not enabled by default. Set OUT bit so that they
actually work. Also initialize the HDMI SPDIF at the same time.

Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_analog.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -2247,8 +2247,12 @@ static struct hda_verb ad1988_spdif_init
 
 /* AD1989 has no ADC -> SPDIF route */
 static struct hda_verb ad1989_spdif_init_verbs[] = {
-	/* SPDIF out pin */
+	/* SPDIF-1 out pin */
+	{0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT },
 	{0x1b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE | 0x27}, /* 0dB */
+	/* SPDIF-2/HDMI out pin */
+	{0x1d, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT },
+	{0x1d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE | 0x27}, /* 0dB */
 	{ }
 };
 

[patch 50/83] ALSA: HDA: patch_analog: Quirk for Asus P5Q Premium/Pro boards.

[Greg KH]

[-- Attachment #1: alsa-hda-patch_analog-quirk-for-asus-p5q-premium-pro-boards.patch --]
[-- Type: text/plain, Size: 1030 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Robin H. Johnson <robbat2@orbis-terrarum.net>

commit f51ff9937bc6732ed5fc08088fdbe89ab8ed27c3 upstream

Use 6STACK_DIG for the AD2000BX variant of the AD1989B chip used by Asus
on their Asus P5Q Premium and Pro boards.

Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_analog.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -2872,6 +2872,7 @@ static struct snd_pci_quirk ad1988_cfg_t
 	SND_PCI_QUIRK(0x1043, 0x81ec, "Asus P5B-DLX", AD1988_6STACK_DIG),
 	SND_PCI_QUIRK(0x1043, 0x81f6, "Asus M2N-SLI", AD1988_6STACK_DIG),
 	SND_PCI_QUIRK(0x1043, 0x8277, "Asus P5K-E/WIFI-AP", AD1988_6STACK_DIG),
+	SND_PCI_QUIRK(0x1043, 0x8311, "Asus P5Q-Premium/Pro", AD1988_6STACK_DIG),
 	{}
 };
 

[patch 51/83] ALSA: hda: appletv support

[Greg KH]

[-- Attachment #1: alsa-hda-appletv-support.patch --]
[-- Type: text/plain, Size: 883 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Peter Korsgaard <jacmet@sunsite.dk>

commit f3911c5ab93e4295938b2013104d2986ea601454 upstream

The AppleTV needs the same handling as the 24" iMac.

Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6555,6 +6555,7 @@ static int patch_alc882(struct hda_codec
 			board_config = ALC885_MACPRO;
 			break;
 		case 0x106b1000: /* iMac 24 */
+		case 0x106b2800: /* AppleTV */
 			board_config = ALC885_IMAC24;
 			break;
 		case 0x106b00a1: /* Macbook (might be wrong - PCI SSID?) */

[patch 52/83] ALSA: hda - Fix another ALC889A (rev 0x100101)

[Greg KH]

[-- Attachment #1: alsa-hda-fix-another-alc889a.patch --]
[-- Type: text/plain, Size: 1549 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Clive Messer <clive@vacuumtube.org.uk>

commit 669faba27f2f7b04b9228d20e30e7f584f0becd5 upstream

ALC889A hardware (id 0x10ec0885 rev 0x100101) to use patch_alc883

Signed-off-by: Clive Messer <clive@vacuumtube.org.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6565,7 +6565,8 @@ static int patch_alc882(struct hda_codec
 			break;
 		default:
 			/* ALC889A is handled better as ALC888-compatible */
-			if (codec->revision_id == 0x100103) {
+			if (codec->revision_id == 0x100101 ||
+			    codec->revision_id == 0x100103) {
 				alc_free(codec);
 				return patch_alc883(codec);
 			}
@@ -14959,6 +14960,8 @@ struct hda_codec_preset snd_hda_preset_r
 	{ .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
 	{ .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
 	{ .id = 0x10ec0883, .name = "ALC883", .patch = patch_alc883 },
+	{ .id = 0x10ec0885, .rev = 0x100101, .name = "ALC889A",
+	  .patch = patch_alc882 }, /* should be patch_alc883() in future */
 	{ .id = 0x10ec0885, .rev = 0x100103, .name = "ALC889A",
 	  .patch = patch_alc882 }, /* should be patch_alc883() in future */
 	{ .id = 0x10ec0885, .name = "ALC885", .patch = patch_alc882 },

[patch 53/83] ALSA: hda - Add ALC887 support

[Greg KH]

[-- Attachment #1: alsa-hda-add-alc887-support.patch --]
[-- Type: text/plain, Size: 1034 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Kailang Yang <kailang@realtek.com>

commit a385a52925398e53bedf1a8b30a9a3e002569f27 upstream

Added ALC887 support.  It's almost compatible with ALC883/888.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -14965,6 +14965,7 @@ struct hda_codec_preset snd_hda_preset_r
 	{ .id = 0x10ec0885, .rev = 0x100103, .name = "ALC889A",
 	  .patch = patch_alc882 }, /* should be patch_alc883() in future */
 	{ .id = 0x10ec0885, .name = "ALC885", .patch = patch_alc882 },
+	{ .id = 0x10ec0887, .name = "ALC887", .patch = patch_alc883 },
 	{ .id = 0x10ec0888, .name = "ALC888", .patch = patch_alc883 },
 	{ .id = 0x10ec0889, .name = "ALC889", .patch = patch_alc883 },
 	{} /* terminator */

[patch 54/83] ALSA: hda - Add support of ALC272

[Greg KH]

[-- Attachment #1: alsa-hda-add-support-of-alc272.patch --]
[-- Type: text/plain, Size: 1504 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Kailang Yang <kailang@realtek.com>

commit 01afd41f55524e8378601dbf33b858d8dd4b3f31 upstream

Added the support of ALC272 codec.  It's almost compatible with ALC663.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -14910,6 +14910,9 @@ static int patch_alc662(struct hda_codec
 	if (codec->vendor_id == 0x10ec0663) {
 		spec->stream_name_analog = "ALC663 Analog";
 		spec->stream_name_digital = "ALC663 Digital";
+	} else if (codec->vendor_id == 0x10ec0272) {
+		spec->stream_name_analog = "ALC272 Analog";
+		spec->stream_name_digital = "ALC272 Digital";
 	} else {
 		spec->stream_name_analog = "ALC662 Analog";
 		spec->stream_name_digital = "ALC662 Digital";
@@ -14947,6 +14950,7 @@ struct hda_codec_preset snd_hda_preset_r
 	{ .id = 0x10ec0267, .name = "ALC267", .patch = patch_alc268 },
 	{ .id = 0x10ec0268, .name = "ALC268", .patch = patch_alc268 },
 	{ .id = 0x10ec0269, .name = "ALC269", .patch = patch_alc269 },
+	{ .id = 0x10ec0272, .name = "ALC272", .patch = patch_alc662 },
 	{ .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
 	  .patch = patch_alc861 },
 	{ .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd },

[patch 55/83] ALSA: hda - Restore default pin configs for realtek codecs

[Greg KH]

[-- Attachment #1: alsa-hda-restore-default-pin-configs-for-realtek-codecs.patch --]
[-- Type: text/plain, Size: 4612 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit e044c39ae258678d6ebb09fccb2a0fdf7ec51847 upstream

Some machines have broken BIOS resume that doesn't restore the default
pin configuration properly, which results in a wrong detection of HP
pin.  This causes a silent speaker output due to missing HP detection.
Related bug: Novell bug#406101
	https://bugzilla.novell.com/show_bug.cgi?id=406101

This patch fixes the issue by saving/restoring the default pin configs
by the driver itself.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |   77 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -292,6 +292,13 @@ struct alc_spec {
 	/* for PLL fix */
 	hda_nid_t pll_nid;
 	unsigned int pll_coef_idx, pll_coef_bit;
+
+#ifdef SND_HDA_NEEDS_RESUME
+#define ALC_MAX_PINS	16
+	unsigned int num_pins;
+	hda_nid_t pin_nids[ALC_MAX_PINS];
+	unsigned int pin_cfgs[ALC_MAX_PINS];
+#endif
 };
 
 /*
@@ -2723,6 +2730,64 @@ static void alc_free(struct hda_codec *c
 	codec->spec = NULL; /* to be sure */
 }
 
+#ifdef SND_HDA_NEEDS_RESUME
+static void store_pin_configs(struct hda_codec *codec)
+{
+	struct alc_spec *spec = codec->spec;
+	hda_nid_t nid, end_nid;
+
+	end_nid = codec->start_nid + codec->num_nodes;
+	for (nid = codec->start_nid; nid < end_nid; nid++) {
+		unsigned int wid_caps = get_wcaps(codec, nid);
+		unsigned int wid_type =
+			(wid_caps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT;
+		if (wid_type != AC_WID_PIN)
+			continue;
+		if (spec->num_pins >= ARRAY_SIZE(spec->pin_nids))
+			break;
+		spec->pin_nids[spec->num_pins] = nid;
+		spec->pin_cfgs[spec->num_pins] =
+			snd_hda_codec_read(codec, nid, 0,
+					   AC_VERB_GET_CONFIG_DEFAULT, 0);
+		spec->num_pins++;
+	}
+}
+
+static void resume_pin_configs(struct hda_codec *codec)
+{
+	struct alc_spec *spec = codec->spec;
+	int i;
+
+	for (i = 0; i < spec->num_pins; i++) {
+		hda_nid_t pin_nid = spec->pin_nids[i];
+		unsigned int pin_config = spec->pin_cfgs[i];
+		snd_hda_codec_write(codec, pin_nid, 0,
+				    AC_VERB_SET_CONFIG_DEFAULT_BYTES_0,
+				    pin_config & 0x000000ff);
+		snd_hda_codec_write(codec, pin_nid, 0,
+				    AC_VERB_SET_CONFIG_DEFAULT_BYTES_1,
+				    (pin_config & 0x0000ff00) >> 8);
+		snd_hda_codec_write(codec, pin_nid, 0,
+				    AC_VERB_SET_CONFIG_DEFAULT_BYTES_2,
+				    (pin_config & 0x00ff0000) >> 16);
+		snd_hda_codec_write(codec, pin_nid, 0,
+				    AC_VERB_SET_CONFIG_DEFAULT_BYTES_3,
+				    pin_config >> 24);
+	}
+}
+
+static int alc_resume(struct hda_codec *codec)
+{
+	resume_pin_configs(codec);
+	codec->patch_ops.init(codec);
+	snd_hda_codec_resume_amp(codec);
+	snd_hda_codec_resume_cache(codec);
+	return 0;
+}
+#else
+#define store_pin_configs(codec)
+#endif
+
 /*
  */
 static struct hda_codec_ops alc_patch_ops = {
@@ -2731,6 +2796,9 @@ static struct hda_codec_ops alc_patch_op
 	.init = alc_init,
 	.free = alc_free,
 	.unsol_event = alc_unsol_event,
+#ifdef SND_HDA_NEEDS_RESUME
+	.resume = alc_resume,
+#endif
 #ifdef CONFIG_SND_HDA_POWER_SAVE
 	.check_power_status = alc_check_power_status,
 #endif
@@ -3777,6 +3845,7 @@ static int alc880_parse_auto_config(stru
 	spec->num_mux_defs = 1;
 	spec->input_mux = &spec->private_imux;
 
+	store_pin_configs(codec);
 	return 1;
 }
 
@@ -5125,6 +5194,7 @@ static int alc260_parse_auto_config(stru
 	}
 	spec->num_mixers++;
 
+	store_pin_configs(codec);
 	return 1;
 }
 
@@ -9731,6 +9801,7 @@ static int alc262_parse_auto_config(stru
 	if (err < 0)
 		return err;
 
+	store_pin_configs(codec);
 	return 1;
 }
 
@@ -10762,6 +10833,7 @@ static int alc268_parse_auto_config(stru
 	if (err < 0)
 		return err;
 
+	store_pin_configs(codec);
 	return 1;
 }
 
@@ -11427,6 +11499,7 @@ static int alc269_parse_auto_config(stru
 	spec->mixers[spec->num_mixers] = alc269_capture_mixer;
 	spec->num_mixers++;
 
+	store_pin_configs(codec);
 	return 1;
 }
 
@@ -12495,6 +12568,7 @@ static int alc861_parse_auto_config(stru
 	spec->mixers[spec->num_mixers] = alc861_capture_mixer;
 	spec->num_mixers++;
 
+	store_pin_configs(codec);
 	return 1;
 }
 
@@ -13606,6 +13680,7 @@ static int alc861vd_parse_auto_config(st
 	if (err < 0)
 		return err;
 
+	store_pin_configs(codec);
 	return 1;
 }
 
@@ -14853,6 +14928,8 @@ static int alc662_parse_auto_config(stru
 
 	spec->mixers[spec->num_mixers] = alc662_capture_mixer;
 	spec->num_mixers++;
+
+	store_pin_configs(codec);
 	return 1;
 }
 

[patch 56/83] ALSA: hda - Add another HP model for AD1884A

[Greg KH]

[-- Attachment #1: alsa-hda-add-another-hp-model-for-ad1884a.patch --]
[-- Type: text/plain, Size: 809 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 5695ff44160e62d9193c0201706853bcfe2a077f upstream

Added a quirk entry for another HP mobile device with AD1884A codec.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_analog.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3847,6 +3847,7 @@ static const char *ad1884a_models[AD1884
 
 static struct snd_pci_quirk ad1884a_cfg_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x3030, "HP", AD1884A_MOBILE),
+	SND_PCI_QUIRK(0x103c, 0x3056, "HP", AD1884A_MOBILE),
 	SND_PCI_QUIRK(0x17aa, 0x20ac, "Thinkpad X300", AD1884A_THINKPAD),
 	{}
 };

[patch 57/83] ALSA: hda - Add a quirk for another Acer Aspire (1025:0090)

[Greg KH]

[-- Attachment #1: alsa-hda-add-a-quirk-for-another-acer-aspire.patch --]
[-- Type: text/plain, Size: 1133 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 69e50282b726bab75c8050c4836dc89b7eb7bf1a upstream

Added a quirk for another Acer Aspier laptop (1025:0090) with ALC883
codec.  Reported in Novell bnc#426935:
    https://bugzilla.novell.com/show_bug.cgi?id=426935

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8013,6 +8013,7 @@ static const char *alc883_models[ALC883_
 static struct snd_pci_quirk alc883_cfg_tbl[] = {
 	SND_PCI_QUIRK(0x1019, 0x6668, "ECS", ALC883_3ST_6ch_DIG),
 	SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_ACER_ASPIRE),
+	SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_ACER_ASPIRE),
 	SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_ACER_ASPIRE),
 	SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_ACER_ASPIRE),
 	SND_PCI_QUIRK(0x1025, 0x0121, "Acer Aspire 5920G", ALC883_ACER_ASPIRE), 

[patch 58/83] ALSA: hda - Add a quirk for MEDION MD96630

[Greg KH]

[-- Attachment #1: alsa-hda-add-a-quirk-for-medion-md96630.patch --]
[-- Type: text/plain, Size: 1157 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 959973b92d3ba235edfa5dcb5df1be1e5d1deba2 upstream

Use model=lenovo-ms7195-dig for MEDION MD96630 laptop (17c0:4085)
with ALC888 codec.
Reference: Novell bnc#412548
	https://bugzilla.novell.com/show_bug.cgi?id=412528

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8064,6 +8064,7 @@ static struct snd_pci_quirk alc883_cfg_t
 	SND_PCI_QUIRK(0x17aa, 0x3bfc, "Lenovo NB0763", ALC883_LENOVO_NB0763),
 	SND_PCI_QUIRK(0x17aa, 0x3bfd, "Lenovo NB0763", ALC883_LENOVO_NB0763),
 	SND_PCI_QUIRK(0x17c0, 0x4071, "MEDION MD2", ALC883_MEDION_MD2),
+	SND_PCI_QUIRK(0x17c0, 0x4085, "MEDION MD96630", ALC888_LENOVO_MS7195_DIG),
 	SND_PCI_QUIRK(0x17f2, 0x5000, "Albatron KI690-AM2", ALC883_6ST_DIG),
 	SND_PCI_QUIRK(0x1991, 0x5625, "Haier W66", ALC883_HAIER_W66),
 	SND_PCI_QUIRK(0x8086, 0x0001, "DG33BUC", ALC883_3ST_6ch_INTEL),

[patch 59/83] ALSA: hda - Add another HP model (6730s) for AD1884A

[Greg KH]

[-- Attachment #1: alsa-hda-add-another-hp-model-6730s-for-ad1884a.patch --]
[-- Type: text/plain, Size: 923 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Michel Marti <mma@objectxp.com>

commit 65b92e5cbc8acd14ea83190b4d016f765dce6075 upstream

Added model=laptop for another HP machine (103c:3614) with AD1884A
codec.

Signed-off-by: Michel Marti <mma@objectxp.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_analog.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3848,6 +3848,7 @@ static const char *ad1884a_models[AD1884
 static struct snd_pci_quirk ad1884a_cfg_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x3030, "HP", AD1884A_MOBILE),
 	SND_PCI_QUIRK(0x103c, 0x3056, "HP", AD1884A_MOBILE),
+	SND_PCI_QUIRK(0x103c, 0x3614, "HP 6730s", AD1884A_LAPTOP),
 	SND_PCI_QUIRK(0x17aa, 0x20ac, "Thinkpad X300", AD1884A_THINKPAD),
 	{}
 };

[patch 60/83] ALSA: hda - Make the HP EliteBook 8530p use AD1884A model laptop

[Greg KH]

[-- Attachment #1: alsa-hda-make-the-hp-elitebook-8530p-use-ad1884a-model-laptop.patch --]
[-- Type: text/plain, Size: 1079 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Travis Place <wishie@wishie.net>

commit 254248313aed7e6ff295ca21a82ca989b1f69c16 upstream

Added a QUIRK to patch_analog.c for the HP Elitebook 8530p
(IDs 0x103c:0x30e7) to use AD1884A model 'laptop' by default.
Playback and Capture confirmed working.

Signed-off-by: Travis Place <wishie@wishie.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_analog.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3848,6 +3848,7 @@ static const char *ad1884a_models[AD1884
 static struct snd_pci_quirk ad1884a_cfg_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x3030, "HP", AD1884A_MOBILE),
 	SND_PCI_QUIRK(0x103c, 0x3056, "HP", AD1884A_MOBILE),
+	SND_PCI_QUIRK(0x103c, 0x30e7, "HP EliteBook 8530p", AD1884A_LAPTOP),
 	SND_PCI_QUIRK(0x103c, 0x3614, "HP 6730s", AD1884A_LAPTOP),
 	SND_PCI_QUIRK(0x17aa, 0x20ac, "Thinkpad X300", AD1884A_THINKPAD),
 	{}

[patch 61/83] ALSA: hda - Add a quirk for Dell Studio 15

[Greg KH]

[-- Attachment #1: alsa-hda-add-a-quirk-for-dell-studio-15.patch --]
[-- Type: text/plain, Size: 794 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit b0fc5e043401df4cd243352f1030c4d23e767347 upstream

Added the matching model=dell-m6 for Dell Studio 15 laptop.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_sigmatel.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1324,6 +1324,8 @@ static struct snd_pci_quirk stac92hd73xx
 				"unknown Dell", STAC_DELL_M6),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0271,
 				"unknown Dell", STAC_DELL_M6),
+	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x029f,
+				"Dell Studio 15", STAC_DELL_M6),
 	{} /* terminator */
 };
 

[patch 62/83] ALSA: hda - No Headphone as Line-out swich without line-outs

[Greg KH]

[-- Attachment #1: alsa-hda-no-headphone-as-line-out-swich-without-line-outs.patch --]
[-- Type: text/plain, Size: 926 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 95026623da32848bc93fbfb472dc8737487df450 upstream

STAC/IDT driver creates "Headphone as Line-Out" switch even if there
is no line-out pins on the machine.  For devices only with headpohnes
and speaker-outs, this switch shouldn't be created.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_sigmatel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -2505,7 +2505,7 @@ static int stac92xx_auto_create_multi_ou
 		}
 	}
 
-	if (cfg->hp_outs > 1) {
+	if (cfg->hp_outs > 1 && cfg->line_out_type == AUTO_PIN_LINE_OUT) {
 		err = stac92xx_add_control(spec,
 			STAC_CTL_WIDGET_HP_SWITCH,
 			"Headphone as Line Out Switch", 0);

[patch 63/83] ALSA: hda - mark Dell studio 1535 quirk

[Greg KH]

[-- Attachment #1: alsa-hda-mark-dell-studio-1535-quirk.patch --]
[-- Type: text/plain, Size: 964 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit c65574abad288d7123bd49e7906fa53b7e420239 upstream

Fixed the quirk string for Dell studio 1535 (the product name wasn't
published at the time the patch was made).

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/pci/hda/patch_sigmatel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1311,7 +1311,7 @@ static struct snd_pci_quirk stac92hd73xx
 	SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
 				"DFI LanParty", STAC_92HD73XX_REF),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0254,
-				"unknown Dell", STAC_DELL_M6),
+				"Dell Studio 1535", STAC_DELL_M6),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0255,
 				"unknown Dell", STAC_DELL_M6),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0256,

[patch 64/83] ALSA: emu10k1 - Add more invert_shared_spdif flag to Audigy models

[Greg KH]

[-- Attachment #1: alsa-emu10k1-add-more-invert_shared_spdif-flag-to-audigy-models.patch --]
[-- Type: text/plain, Size: 1462 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 55e03a68d2489d116a5c5e8111ecef3f69831ed6 upstream.

Reported in Novell bnc#440862:
    https://bugzilla.novell.com/show_bug.cgi?id=440862

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/emu10k1/emu10k1_main.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -1464,6 +1464,7 @@ static struct snd_emu_chip_details emu_c
 	 .ca0151_chip = 1,
 	 .spk71 = 1,
 	 .spdif_bug = 1,
+	 .invert_shared_spdif = 1,	/* digital/analog switch swapped */
 	 .ac97_chip = 1} ,
 	{.vendor = 0x1102, .device = 0x0004, .subsystem = 0x20021102,
 	 .driver = "Audigy2", .name = "Audigy 2 ZS [SB0350]", 
@@ -1473,6 +1474,7 @@ static struct snd_emu_chip_details emu_c
 	 .ca0151_chip = 1,
 	 .spk71 = 1,
 	 .spdif_bug = 1,
+	 .invert_shared_spdif = 1,	/* digital/analog switch swapped */
 	 .ac97_chip = 1} ,
 	{.vendor = 0x1102, .device = 0x0004, .subsystem = 0x20011102,
 	 .driver = "Audigy2", .name = "Audigy 2 ZS [2001]", 
@@ -1482,6 +1484,7 @@ static struct snd_emu_chip_details emu_c
 	 .ca0151_chip = 1,
 	 .spk71 = 1,
 	 .spdif_bug = 1,
+	 .invert_shared_spdif = 1,	/* digital/analog switch swapped */
 	 .ac97_chip = 1} ,
 	/* Audigy 2 */
 	/* Tested by James@superbug.co.uk 3rd July 2005 */

[patch 65/83] cxgb3 - fix race in EEH

[Greg KH]

[-- Attachment #1: cxgb3-fix-race-in-eeh.patch --]
[-- Type: text/plain, Size: 2854 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Divy Le Ray <divy@chelsio.com>

commit 0ca41c0413a4d9ca58767d53d23accea9aa1cdef upstream.

A SGE queue set timer might access registers while in EEH recovery,
triggering an EEH error loop. Stop all timers early in EEH process.

Signed-off-by: Divy Le Ray <divy@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Karsten Keil <kkeil@novell.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/cxgb3/adapter.h    |    1 +
 drivers/net/cxgb3/cxgb3_main.c |    5 +++++
 drivers/net/cxgb3/sge.c        |   21 ++++++++++++++++++---
 3 files changed, 24 insertions(+), 3 deletions(-)

--- a/drivers/net/cxgb3/adapter.h
+++ b/drivers/net/cxgb3/adapter.h
@@ -285,6 +285,7 @@ void t3_os_link_changed(struct adapter *
 
 void t3_sge_start(struct adapter *adap);
 void t3_sge_stop(struct adapter *adap);
+void t3_stop_sge_timers(struct adapter *adap);
 void t3_free_sge_resources(struct adapter *adap);
 void t3_sge_err_intr_handler(struct adapter *adapter);
 irq_handler_t t3_intr_handler(struct adapter *adap, int polling);
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -479,6 +479,7 @@ static int setup_sge_qsets(struct adapte
 							     irq_idx,
 				&adap->params.sge.qset[qset_idx], ntxq, dev);
 			if (err) {
+				t3_stop_sge_timers(adap);
 				t3_free_sge_resources(adap);
 				return err;
 			}
@@ -2449,6 +2450,9 @@ static pci_ers_result_t t3_io_error_dete
 	    test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map))
 		offload_close(&adapter->tdev);
 
+	/* Stop SGE timers */
+	t3_stop_sge_timers(adapter);
+
 	adapter->flags &= ~FULL_INIT_DONE;
 
 	pci_disable_device(pdev);
@@ -2801,6 +2805,7 @@ static void __devexit remove_one(struct 
 		    if (test_bit(i, &adapter->registered_device_map))
 			unregister_netdev(adapter->port[i]);
 
+		t3_stop_sge_timers(adapter);
 		t3_free_sge_resources(adapter);
 		cxgb_disable_msi(adapter);
 
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -603,9 +603,6 @@ static void t3_free_qset(struct adapter 
 	int i;
 	struct pci_dev *pdev = adapter->pdev;
 
-	if (q->tx_reclaim_timer.function)
-		del_timer_sync(&q->tx_reclaim_timer);
-
 	for (i = 0; i < SGE_RXQ_PER_SET; ++i)
 		if (q->fl[i].desc) {
 			spin_lock_irq(&adapter->sge.reg_lock);
@@ -3043,6 +3040,24 @@ err:
 }
 
 /**
+ *	t3_stop_sge_timers - stop SGE timer call backs
+ *	@adap: the adapter
+ *
+ *	Stops each SGE queue set's timer call back
+ */
+void t3_stop_sge_timers(struct adapter *adap)
+{
+	int i;
+
+	for (i = 0; i < SGE_QSETS; ++i) {
+		struct sge_qset *q = &adap->sge.qs[i];
+
+		if (q->tx_reclaim_timer.function)
+			del_timer_sync(&q->tx_reclaim_timer);
+	}
+}
+
+/**
  *	t3_free_sge_resources - free SGE resources
  *	@adap: the adapter
  *

[patch 66/83] cxgb3 - remove duplicate tests in lro

[Greg KH]

[-- Attachment #1: cxgb3-remove-duplicate-tests-in-lro.patch --]
[-- Type: text/plain, Size: 2156 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Divy Le Ray <divy@chelsio.com>

commit 004f23b9d3874efc81d2d1cf18fd0fe48dc2f26f upstream.

The generic lro code checks TCP flags/options.
Remove duplicate tests done in the driver.

Signed-off-by: Divy Le Ray <divy@chelsio.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Cc: Hannes Reinecke <hare@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/cxgb3/sge.c |   35 -----------------------------------
 1 file changed, 35 deletions(-)

--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -1934,38 +1934,6 @@ static inline int lro_frame_ok(const str
 		eh->h_proto == htons(ETH_P_IP) && ih->ihl == (sizeof(*ih) >> 2);
 }
 
-#define TCP_FLAG_MASK (TCP_FLAG_CWR | TCP_FLAG_ECE | TCP_FLAG_URG |\
-                       TCP_FLAG_ACK | TCP_FLAG_PSH | TCP_FLAG_RST |\
-		                       TCP_FLAG_SYN | TCP_FLAG_FIN)
-#define TSTAMP_WORD ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |\
-                     (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP)
-
-/**
- *	lro_segment_ok - check if a TCP segment is eligible for LRO
- *	@tcph: the TCP header of the packet
- *
- *	Returns true if a TCP packet is eligible for LRO.  This requires that
- *	the packet have only the ACK flag set and no TCP options besides
- *	time stamps.
- */
-static inline int lro_segment_ok(const struct tcphdr *tcph)
-{
-	int optlen;
-
-	if (unlikely((tcp_flag_word(tcph) & TCP_FLAG_MASK) != TCP_FLAG_ACK))
-		return 0;
-
-	optlen = (tcph->doff << 2) - sizeof(*tcph);
-	if (optlen) {
-		const u32 *opt = (const u32 *)(tcph + 1);
-
-		if (optlen != TCPOLEN_TSTAMP_ALIGNED ||
-		    *opt != htonl(TSTAMP_WORD) || !opt[2])
-			return 0;
-	}
-	return 1;
-}
-
 static int t3_get_lro_header(void **eh,  void **iph, void **tcph,
 			     u64 *hdr_flags, void *priv)
 {
@@ -1978,9 +1946,6 @@ static int t3_get_lro_header(void **eh, 
 	*iph = (struct iphdr *)((struct ethhdr *)*eh + 1);
 	*tcph = (struct tcphdr *)((struct iphdr *)*iph + 1);
 
-	 if (!lro_segment_ok(*tcph))
-		return -1;
-
 	*hdr_flags = LRO_IPV4 | LRO_TCP;
 	return 0;
 }

[patch 67/83] sched: fix a bug in sched domain degenerate

[Greg KH]

[-- Attachment #1: sched-fix-a-bug-in-sched-domain-degenerate.patch --]
[-- Type: text/plain, Size: 1630 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Li Zefan <lizf@cn.fujitsu.com>

commit f29c9b1ccb52904ee442a933cf3dee628f9f4e62 upstream.

Impact: re-add incorrectly eliminated sched domain layers

(1) on i386 with SCHED_SMT and SCHED_MC enabled
	# mount -t cgroup -o cpuset xxx /mnt
	# echo 0 > /mnt/cpuset.sched_load_balance
	# mkdir /mnt/0
	# echo 0 > /mnt/0/cpuset.cpus
	# dmesg
	CPU0 attaching sched-domain:
	 domain 0: span 0 level CPU
	  groups: 0

(2) on i386 with SCHED_MC enabled but SCHED_SMT disabled
	# same with (1)
	# dmesg
	CPU0 attaching NULL sched-domain.

The bug is that some sched domains may be skipped unintentionally when
degenerating (optimizing) sched domains.

Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Cc: Gregory Haskins <ghaskins@novell.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 kernel/sched.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -6802,15 +6802,17 @@ cpu_attach_domain(struct sched_domain *s
 	struct sched_domain *tmp;
 
 	/* Remove the sched domains which do not contribute to scheduling. */
-	for (tmp = sd; tmp; tmp = tmp->parent) {
+	for (tmp = sd; tmp; ) {
 		struct sched_domain *parent = tmp->parent;
 		if (!parent)
 			break;
+
 		if (sd_parent_degenerate(tmp, parent)) {
 			tmp->parent = parent->parent;
 			if (parent->parent)
 				parent->parent->child = tmp;
-		}
+		} else
+			tmp = tmp->parent;
 	}
 
 	if (sd && sd_degenerate(sd)) {

[patch 68/83] x86: HPET: convert WARN_ON to WARN_ON_ONCE

[Greg KH]

[-- Attachment #1: x86-hpet-convert-warn_on-to-warn_on_once.patch --]
[-- Type: text/plain, Size: 1041 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Matt Fleming <mjf@gentoo.org>

commit 1de5b0854623d30d01d72cd4ea323eb5f39d1f16 upstream.

It is possible to flood the console with call traces if the WARN_ON
condition is true because of the frequency with which this function is
called.

Signed-off-by: Matt Fleming <mjf@gentoo.org>
Cc: mingo@elte.hu
Cc: venkatesh.pallipadi@intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/x86/kernel/hpet.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -283,7 +283,7 @@ static int hpet_legacy_next_event(unsign
 	 * what we wrote hit the chip before we compare it to the
 	 * counter.
 	 */
-	WARN_ON((u32)hpet_readl(HPET_T0_CMP) != cnt);
+	WARN_ON_ONCE((u32)hpet_readl(HPET_T0_CMP) != cnt);
 
 	return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0;
 }

[patch 69/83] x86, memory hotplug: remove wrong -1 in calling init_memory_mapping()

[Greg KH]

[-- Attachment #1: x86-memory-hotplug-remove-wrong-1-in-calling-init_memory_mapping.patch --]
[-- Type: text/plain, Size: 1072 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Shaohua Li <shaohua.li@intel.com>

commit 60817c9b31ef7897d60bca2f384cbc316a3fdd8b upstream.

Impact: fix crash with memory hotplug

Shuahua Li found:

| I just did some experiments on a desktop for memory hotplug and this bug
| triggered a crash in my test.
|
| Yinghai's suggestion also fixed the bug.

We don't need to round it, just remove that extra -1

Signed-off-by: Yinghai <yinghai@kernel.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/x86/mm/init_64.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -721,7 +721,7 @@ int arch_add_memory(int nid, u64 start, 
 	unsigned long nr_pages = size >> PAGE_SHIFT;
 	int ret;
 
-	last_mapped_pfn = init_memory_mapping(start, start + size-1);
+	last_mapped_pfn = init_memory_mapping(start, start + size);
 	if (last_mapped_pfn > max_pfn_mapped)
 		max_pfn_mapped = last_mapped_pfn;
 

[patch 70/83] x86: remove debug code from arch_add_memory()

[Greg KH]

[-- Attachment #1: x86-remove-debug-code-from-arch_add_memory.patch --]
[-- Type: text/plain, Size: 1057 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Gary Hade <garyhade@us.ibm.com>

commit fe8b868eccb9f85a0e231e35f0abac5b39bac801 upstream.

Impact: remove incorrect WARN_ON(1)

Gets rid of dmesg spam created during physical memory hot-add which
will very likely confuse users.  The change removes what appears to
be debugging code which I assume was unintentionally included in:

  x86: arch/x86/mm/init_64.c printk fixes
  commit 10f22dde556d1ed41d55355d1fb8ad495f9810c8

Signed-off-by: Gary Hade <garyhade@us.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/x86/mm/init_64.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -726,7 +726,7 @@ int arch_add_memory(int nid, u64 start, 
 		max_pfn_mapped = last_mapped_pfn;
 
 	ret = __add_pages(zone, start_pfn, nr_pages);
-	WARN_ON(1);
+	WARN_ON_ONCE(ret);
 
 	return ret;
 }

[patch 71/83] sched: CPU remove deadlock fix

[Greg KH]

[-- Attachment #1: sched-cpu-remove-deadlock-fix.patch --]
[-- Type: text/plain, Size: 2149 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Brian King <brking@linux.vnet.ibm.com>

commit 9a2bd244e18ffbb96c8b783210fda4eded7c7e6f upstream.

Impact: fix possible deadlock in CPU hot-remove path

This patch fixes a possible deadlock scenario in the CPU remove path.
migration_call grabs rq->lock, then wakes up everything on rq->migration_queue
with the lock held. Then one of the tasks on the migration queue ends up
calling tg_shares_up which then also tries to acquire the same rq->lock.

[c000000058eab2e0] c000000000502078 ._spin_lock_irqsave+0x98/0xf0
[c000000058eab370] c00000000008011c .tg_shares_up+0x10c/0x20c
[c000000058eab430] c00000000007867c .walk_tg_tree+0xc4/0xfc
[c000000058eab4d0] c0000000000840c8 .try_to_wake_up+0xb0/0x3c4
[c000000058eab590] c0000000000799a0 .__wake_up_common+0x6c/0xe0
[c000000058eab640] c00000000007ada4 .complete+0x54/0x80
[c000000058eab6e0] c000000000509fa8 .migration_call+0x5fc/0x6f8
[c000000058eab7c0] c000000000504074 .notifier_call_chain+0x68/0xe0
[c000000058eab860] c000000000506568 ._cpu_down+0x2b0/0x3f4
[c000000058eaba60] c000000000506750 .cpu_down+0xa4/0x108
[c000000058eabb10] c000000000507e54 .store_online+0x44/0xa8
[c000000058eabba0] c000000000396260 .sysdev_store+0x3c/0x50
[c000000058eabc10] c0000000001a39b8 .sysfs_write_file+0x124/0x18c
[c000000058eabcd0] c00000000013061c .vfs_write+0xd0/0x1bc
[c000000058eabd70] c0000000001308a4 .sys_write+0x68/0x114
[c000000058eabe30] c0000000000086b4 syscall_exit+0x0/0x40

Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 kernel/sched.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -6500,7 +6500,9 @@ migration_call(struct notifier_block *nf
 			req = list_entry(rq->migration_queue.next,
 					 struct migration_req, list);
 			list_del_init(&req->list);
+			spin_unlock_irq(&rq->lock);
 			complete(&req->done);
+			spin_lock_irq(&rq->lock);
 		}
 		spin_unlock_irq(&rq->lock);
 		break;

[patch 72/83] PCI: stop leaking slot_name in pci_create_slot

[Greg KH]

[-- Attachment #1: pci-stop-leaking-slot_name-in-pci_create_slot.patch --]
[-- Type: text/plain, Size: 834 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Alex Chiang <achiang@hp.com>

commit 3b5dd45e947ecd21491e1658fba7bb4bc4a54995 upstream.

In pci_create_slot(), the local variable 'slot_name' is allocated by
make_slot_name(), but never freed. We never use it after passing it to
the kobject core, so we should free it upon function exit.

Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/pci/slot.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -243,6 +243,7 @@ placeholder:
 		 __func__, pci_domain_nr(parent), parent->number, slot_nr);
 
 out:
+	kfree(slot_name);
 	up_write(&pci_bus_sem);
 	return slot;
 err:

[patch 73/83] PCIe: ASPM: Break out of endless loop waiting for PCI config bits to switch

[Greg KH]

[-- Attachment #1: pcie-aspm-break-out-of-endless-loop-waiting-for-pci-config-bits-to-switch.patch --]
[-- Type: text/plain, Size: 2977 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Thomas Renninger <trenn@suse.de>

commit 2a42d9dba7842422ffb2c02e75288a8bc2fd5065 upstream.

Makes a Compaq 6735s boot reliably again.  It used to hang in the loop
on some boots.  Give the link one second to train, otherwise break out
of the loop and reset the previously set clock bits.

Signed-off-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Signed-off-by: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/pci/pcie/aspm.c |   29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -16,6 +16,7 @@
 #include <linux/pm.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/jiffies.h>
 #include <linux/pci-aspm.h>
 #include "../pci.h"
 
@@ -161,11 +162,12 @@ static void pcie_check_clock_pm(struct p
  */
 static void pcie_aspm_configure_common_clock(struct pci_dev *pdev)
 {
-	int pos, child_pos;
+	int pos, child_pos, i = 0;
 	u16 reg16 = 0;
 	struct pci_dev *child_dev;
 	int same_clock = 1;
-
+	unsigned long start_jiffies;
+	u16 child_regs[8], parent_reg;
 	/*
 	 * all functions of a slot should have the same Slot Clock
 	 * Configuration, so just check one function
@@ -191,16 +193,19 @@ static void pcie_aspm_configure_common_c
 		child_pos = pci_find_capability(child_dev, PCI_CAP_ID_EXP);
 		pci_read_config_word(child_dev, child_pos + PCI_EXP_LNKCTL,
 			&reg16);
+		child_regs[i] = reg16;
 		if (same_clock)
 			reg16 |= PCI_EXP_LNKCTL_CCC;
 		else
 			reg16 &= ~PCI_EXP_LNKCTL_CCC;
 		pci_write_config_word(child_dev, child_pos + PCI_EXP_LNKCTL,
 			reg16);
+		i++;
 	}
 
 	/* Configure upstream component */
 	pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &reg16);
+	parent_reg = reg16;
 	if (same_clock)
 		reg16 |= PCI_EXP_LNKCTL_CCC;
 	else
@@ -212,12 +217,30 @@ static void pcie_aspm_configure_common_c
 	pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, reg16);
 
 	/* Wait for link training end */
-	while (1) {
+	/* break out after waiting for 1 second */
+	start_jiffies = jiffies;
+	while ((jiffies - start_jiffies) < HZ) {
 		pci_read_config_word(pdev, pos + PCI_EXP_LNKSTA, &reg16);
 		if (!(reg16 & PCI_EXP_LNKSTA_LT))
 			break;
 		cpu_relax();
 	}
+	/* training failed -> recover */
+	if ((jiffies - start_jiffies) >= HZ) {
+		dev_printk (KERN_ERR, &pdev->dev, "ASPM: Could not configure"
+			    " common clock\n");
+		i = 0;
+		list_for_each_entry(child_dev, &pdev->subordinate->devices,
+				    bus_list) {
+			child_pos = pci_find_capability(child_dev,
+							PCI_CAP_ID_EXP);
+			pci_write_config_word(child_dev,
+					      child_pos + PCI_EXP_LNKCTL,
+					      child_regs[i]);
+			i++;
+		}
+		pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, parent_reg);
+	}
 }
 
 /*

[patch 74/83] uml: boot broken due to buffer overrun

[Greg KH]

[-- Attachment #1: uml-boot-broken-due-to-buffer-overrun.patch --]
[-- Type: text/plain, Size: 1589 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Balbir Singh <balbir@linux.vnet.ibm.com>

commit 361371201b60ffd686a694c848c1d5ad6061725f upstream.

mconsole_init() passed 256 bytes as length in os_create_unix_socket, while
the sizeof UNIX_PATH_MAX is 108. This patch fixes that problem and avoids
a big overrun bug reported on UML bootup.

sockaddr_un.sun_path is UNIX_PATH_MAX long which causes the problem.
Reported-by: Vikas K Managutte <vikki.km@gmail.com>
Reported-by: Sarvesh Kumar Lal Das <skldas@gmail.com>
Signed-off-by: Balbir Singh <balbir@linux.vnet.ibm.com>
Reviewed-by: Pekka Enberg <penberg@cs.helsinki.fi>
Reviewed-by: WANG Cong <wangcong@zeuux.org>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/um/drivers/mconsole_kern.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -16,6 +16,8 @@
 #include <linux/slab.h>
 #include <linux/syscalls.h>
 #include <linux/utsname.h>
+#include <linux/socket.h>
+#include <linux/un.h>
 #include <linux/workqueue.h>
 #include <linux/mutex.h>
 #include <asm/uaccess.h>
@@ -785,7 +787,7 @@ static int __init mconsole_init(void)
 	/* long to avoid size mismatch warnings from gcc */
 	long sock;
 	int err;
-	char file[256];
+	char file[UNIX_PATH_MAX];
 
 	if (umid_file_name("mconsole", file, sizeof(file)))
 		return -1;

[patch 75/83] pagemap: fix 32-bit pagemap regression

[Greg KH]

[-- Attachment #1: pagemap-fix-32-bit-pagemap-regression.patch --]
[-- Type: text/plain, Size: 1302 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Matt Mackall <mpm@selenic.com>

commit 49c50342c728344b79c8f9e8293637fe80ef5ad5 upstream.

The large pages fix from bcf8039ed45 broke 32-bit pagemap by pulling the
pagemap entry code out into a function with the wrong return type.
Pagemap entries are 64 bits on all systems and unsigned long is only 32
bits on 32-bit systems.

Signed-off-by: Matt Mackall <mpm@selenic.com>
Reported-by: Doug Graham <dgraham@nortel.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Dave Hansen <dave@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/proc/task_mmu.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -563,9 +563,9 @@ static u64 swap_pte_to_pagemap_entry(pte
 	return swp_type(e) | (swp_offset(e) << MAX_SWAPFILES_SHIFT);
 }
 
-static unsigned long pte_to_pagemap_entry(pte_t pte)
+static u64 pte_to_pagemap_entry(pte_t pte)
 {
-	unsigned long pme = 0;
+	u64 pme = 0;
 	if (is_swap_pte(pte))
 		pme = PM_PFRAME(swap_pte_to_pagemap_entry(pte))
 			| PM_PSHIFT(PAGE_SHIFT) | PM_SWAP;

[patch 76/83] fix mapping_writably_mapped()

[Greg KH]

[-- Attachment #1: fix-mapping_writably_mapped.patch --]
[-- Type: text/plain, Size: 2674 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Hugh Dickins <hugh@veritas.com>

commit b88ed20594db2c685555b68c52b693b75738b2f5 upstream.

Lee Schermerhorn noticed yesterday that I broke the mapping_writably_mapped
test in 2.6.7!  Bad bad bug, good good find.

The i_mmap_writable count must be incremented for VM_SHARED (just as
i_writecount is for VM_DENYWRITE, but while holding the i_mmap_lock)
when dup_mmap() copies the vma for fork: it has its own more optimal
version of __vma_link_file(), and I missed this out.  So the count
was later going down to 0 (dangerous) when one end unmapped, then
wrapping negative (inefficient) when the other end unmapped.

The only impact on x86 would have been that setting a mandatory lock on
a file which has at some time been opened O_RDWR and mapped MAP_SHARED
(but not necessarily PROT_WRITE) across a fork, might fail with -EAGAIN
when it should succeed, or succeed when it should fail.

But those architectures which rely on flush_dcache_page() to flush
userspace modifications back into the page before the kernel reads it,
may in some cases have skipped the flush after such a fork - though any
repetitive test will soon wrap the count negative, in which case it will
flush_dcache_page() unnecessarily.

Fix would be a two-liner, but mapping variable added, and comment moved.

Reported-by: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 kernel/fork.c |   15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -313,17 +313,20 @@ static int dup_mmap(struct mm_struct *mm
 		file = tmp->vm_file;
 		if (file) {
 			struct inode *inode = file->f_path.dentry->d_inode;
+			struct address_space *mapping = file->f_mapping;
+
 			get_file(file);
 			if (tmp->vm_flags & VM_DENYWRITE)
 				atomic_dec(&inode->i_writecount);
-
-			/* insert tmp into the share list, just after mpnt */
-			spin_lock(&file->f_mapping->i_mmap_lock);
+			spin_lock(&mapping->i_mmap_lock);
+			if (tmp->vm_flags & VM_SHARED)
+				mapping->i_mmap_writable++;
 			tmp->vm_truncate_count = mpnt->vm_truncate_count;
-			flush_dcache_mmap_lock(file->f_mapping);
+			flush_dcache_mmap_lock(mapping);
+			/* insert tmp into the share list, just after mpnt */
 			vma_prio_tree_add(tmp, mpnt);
-			flush_dcache_mmap_unlock(file->f_mapping);
-			spin_unlock(&file->f_mapping->i_mmap_lock);
+			flush_dcache_mmap_unlock(mapping);
+			spin_unlock(&mapping->i_mmap_lock);
 		}
 
 		/*

[patch 77/83] atv: hid quirk for appletv IR receiver

[Greg KH]

[-- Attachment #1: atv-hid-quirk-for-appletv-ir-receiver.patch --]
[-- Type: text/plain, Size: 1453 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Peter Korsgaard <jacmet@sunsite.dk>

(2.6.27 backport of 0f492f2a)

Similar to the existing IRCONTROL4 handling

Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/hid/usbhid/hid-quirks.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -83,6 +83,7 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_JIS	0x0232
 #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY	0x030a
 #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY	0x030b
+#define USB_DEVICE_ID_APPLE_ATV_IRCONTROL	0x8241
 #define USB_DEVICE_ID_APPLE_IRCONTROL4	0x8242
 
 #define USB_VENDOR_ID_ASUS		0x0b05
@@ -458,6 +459,7 @@ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_AFATECH, USB_DEVICE_ID_AFATECH_AF9016, HID_QUIRK_FULLSPEED_INTERVAL },
 
 	{ USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM, HID_QUIRK_HIDDEV },
+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ATV_IRCONTROL, HID_QUIRK_HIDDEV | HID_QUIRK_IGNORE_HIDINPUT },
 	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4, HID_QUIRK_HIDDEV | HID_QUIRK_IGNORE_HIDINPUT },
 	{ USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE, HID_QUIRK_HIDDEV | HID_QUIRK_IGNORE_HIDINPUT },
 	{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV, HID_QUIRK_HIDINPUT },

[patch 78/83] Allow recursion in binfmt_script and binfmt_misc

[Greg KH]

[-- Attachment #1: allow-recursion-in-binfmt_script-and-binfmt_misc.patch --]
[-- Type: text/plain, Size: 3338 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Kirill A. Shutemov <kirill@shutemov.name>

commit bf2a9a39639b8b51377905397a5005f444e9a892 upstream.

binfmt_script and binfmt_misc disallow recursion to avoid stack overflow
using sh_bang and misc_bang.  It causes problem in some cases:

$ echo '#!/bin/ls' > /tmp/t0
$ echo '#!/tmp/t0' > /tmp/t1
$ echo '#!/tmp/t1' > /tmp/t2
$ chmod +x /tmp/t*
$ /tmp/t2
zsh: exec format error: /tmp/t2

Similar problem with binfmt_misc.

This patch introduces field 'recursion_depth' into struct linux_binprm to
track recursion level in binfmt_misc and binfmt_script.  If recursion
level more then BINPRM_MAX_RECURSION it generates -ENOEXEC.

[akpm@linux-foundation.org: make linux_binprm.recursion_depth a uint]
Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/binfmt_em86.c        |    2 +-
 fs/binfmt_misc.c        |    4 ++--
 fs/binfmt_script.c      |    5 +++--
 include/linux/binfmts.h |    2 ++
 4 files changed, 8 insertions(+), 5 deletions(-)

--- a/fs/binfmt_em86.c
+++ b/fs/binfmt_em86.c
@@ -43,7 +43,7 @@ static int load_em86(struct linux_binprm
 			return -ENOEXEC;
 	}
 
-	bprm->sh_bang = 1;	/* Well, the bang-shell is implicit... */
+	bprm->recursion_depth++; /* Well, the bang-shell is implicit... */
 	allow_write_access(bprm->file);
 	fput(bprm->file);
 	bprm->file = NULL;
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -117,7 +117,7 @@ static int load_misc_binary(struct linux
 		goto _ret;
 
 	retval = -ENOEXEC;
-	if (bprm->misc_bang)
+	if (bprm->recursion_depth > BINPRM_MAX_RECURSION)
 		goto _ret;
 
 	/* to keep locking time low, we copy the interpreter string */
@@ -197,7 +197,7 @@ static int load_misc_binary(struct linux
 	if (retval < 0)
 		goto _error;
 
-	bprm->misc_bang = 1;
+	bprm->recursion_depth++;
 
 	retval = search_binary_handler (bprm, regs);
 	if (retval < 0)
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -22,14 +22,15 @@ static int load_script(struct linux_binp
 	char interp[BINPRM_BUF_SIZE];
 	int retval;
 
-	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') || (bprm->sh_bang)) 
+	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') ||
+	    (bprm->recursion_depth > BINPRM_MAX_RECURSION))
 		return -ENOEXEC;
 	/*
 	 * This section does the #! interpretation.
 	 * Sorta complicated, but hopefully it will work.  -TYT
 	 */
 
-	bprm->sh_bang = 1;
+	bprm->recursion_depth++;
 	allow_write_access(bprm->file);
 	fput(bprm->file);
 	bprm->file = NULL;
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -36,6 +36,7 @@ struct linux_binprm{
 	unsigned long p; /* current top of mem */
 	unsigned int sh_bang:1,
 		     misc_bang:1;
+	unsigned int recursion_depth;
 	struct file * file;
 	int e_uid, e_gid;
 	kernel_cap_t cap_post_exec_permitted;
@@ -58,6 +59,7 @@ struct linux_binprm{
 #define BINPRM_FLAGS_EXECFD_BIT 1
 #define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT)
 
+#define BINPRM_MAX_RECURSION 4
 
 /*
  * This structure defines the functions that are used to load the binary formats that

[patch 79/83] tracehook: exec double-reporting fix

[Greg KH]

[-- Attachment #1: tracehook-exec-double-reporting-fix.patch --]
[-- Type: text/plain, Size: 4729 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Roland McGrath <roland@redhat.com>

commit 85f334666a771680472722eee43ae0fc8730a619 upstream.

The patch 6341c39 "tracehook: exec" introduced a small regression in
2.6.27 regarding binfmt_misc exec event reporting.  Since the reporting
is now done in the common search_binary_handler() function, an exec
of a misc binary will result in two (or possibly multiple) exec events
being reported, instead of just a single one, because the misc handler
contains a recursive call to search_binary_handler.

To add to the confusion, if PTRACE_O_TRACEEXEC is not active, the multiple
SIGTRAP signals will in fact cause only a single ptrace intercept, as the
signals are not queued.  However, if PTRACE_O_TRACEEXEC is on, the debugger
will actually see multiple ptrace intercepts (PTRACE_EVENT_EXEC).

The test program included below demonstrates the problem.

This change fixes the bug by calling tracehook_report_exec() only in the
outermost search_binary_handler() call (bprm->recursion_depth == 0).

The additional change to restore bprm->recursion_depth after each binfmt
load_binary call is actually superfluous for this bug, since we test the
value saved on entry to search_binary_handler().  But it keeps the use of
of the depth count to its most obvious expected meaning.  Depending on what
binfmt handlers do in certain cases, there could have been false-positive
tests for recursion limits before this change.

    /* Test program using PTRACE_O_TRACEEXEC.
       This forks and exec's the first argument with the rest of the arguments,
       while ptrace'ing.  It expects to see one PTRACE_EVENT_EXEC stop and
       then a successful exit, with no other signals or events in between.

       Test for kernel doing two PTRACE_EVENT_EXEC stops for a binfmt_misc exec:

       $ gcc -g traceexec.c -o traceexec
       $ sudo sh -c 'echo :test:M::foobar::/bin/cat: > /proc/sys/fs/binfmt_misc/register'
       $ echo 'foobar test' > ./foobar
       $ chmod +x ./foobar
       $ ./traceexec ./foobar; echo $?
       ==> good <==
       foobar test
       0
       $
       ==> bad <==
       foobar test
       unexpected status 0x4057f != 0
       3
       $

    */

    #include <stdio.h>
    #include <sys/types.h>
    #include <sys/wait.h>
    #include <sys/ptrace.h>
    #include <unistd.h>
    #include <signal.h>
    #include <stdlib.h>

    static void
    wait_for (pid_t child, int expect)
    {
      int status;
      pid_t p = wait (&status);
      if (p != child)
	{
	  perror ("wait");
	  exit (2);
	}
      if (status != expect)
	{
	  fprintf (stderr, "unexpected status %#x != %#x\n", status, expect);
	  exit (3);
	}
    }

    int
    main (int argc, char **argv)
    {
      pid_t child = fork ();

      if (child < 0)
	{
	  perror ("fork");
	  return 127;
	}
      else if (child == 0)
	{
	  ptrace (PTRACE_TRACEME);
	  raise (SIGUSR1);
	  execv (argv[1], &argv[1]);
	  perror ("execve");
	  _exit (127);
	}

      wait_for (child, W_STOPCODE (SIGUSR1));

      if (ptrace (PTRACE_SETOPTIONS, child,
		  0L, (void *) (long) PTRACE_O_TRACEEXEC) != 0)
	{
	  perror ("PTRACE_SETOPTIONS");
	  return 4;
	}

      if (ptrace (PTRACE_CONT, child, 0L, 0L) != 0)
	{
	  perror ("PTRACE_CONT");
	  return 5;
	}

      wait_for (child, W_STOPCODE (SIGTRAP | (PTRACE_EVENT_EXEC << 8)));

      if (ptrace (PTRACE_CONT, child, 0L, 0L) != 0)
	{
	  perror ("PTRACE_CONT");
	  return 6;
	}

      wait_for (child, W_EXITCODE (0, 0));

      return 0;
    }

Reported-by: Arnd Bergmann <arnd@arndb.de>
CC: Ulrich Weigand <ulrich.weigand@de.ibm.com>
Signed-off-by: Roland McGrath <roland@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/exec.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1164,6 +1164,7 @@ EXPORT_SYMBOL(remove_arg_zero);
  */
 int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 {
+	unsigned int depth = bprm->recursion_depth;
 	int try,retval;
 	struct linux_binfmt *fmt;
 #ifdef __alpha__
@@ -1224,8 +1225,15 @@ int search_binary_handler(struct linux_b
 				continue;
 			read_unlock(&binfmt_lock);
 			retval = fn(bprm, regs);
+			/*
+			 * Restore the depth counter to its starting value
+			 * in this call, so we don't have to rely on every
+			 * load_binary function to restore it on return.
+			 */
+			bprm->recursion_depth = depth;
 			if (retval >= 0) {
-				tracehook_report_exec(fmt, bprm, regs);
+				if (depth == 0)
+					tracehook_report_exec(fmt, bprm, regs);
 				put_binfmt(fmt);
 				allow_write_access(bprm->file);
 				if (bprm->file)

[patch 80/83] powerpc/virtex5: Fix Virtex5 machine check handling

[Greg KH]

[-- Attachment #1: powerpc-virtex5-fix-virtex5-machine-check-handling.patch --]
[-- Type: text/plain, Size: 2068 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Grant Likely <grant.likely@secretlab.ca>

commit 640d17d60e83401e10e66a0ab6e9e2d6350df656 upstream.

The 440x5 core in the Virtex5 uses the 440A type machine check
(ie, they have MCSRR0/MCSRR1). They thus need to call the
appropriate fixup function to hook the right variant of the
exception.

Without this, all machine checks become fatal due to loss
of context when entering the exception handler.

Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: Josh Boyer <jwboyer@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/powerpc/kernel/cpu_setup_44x.S |    1 +
 arch/powerpc/kernel/cputable.c      |    3 +++
 2 files changed, 4 insertions(+)

--- a/arch/powerpc/kernel/cpu_setup_44x.S
+++ b/arch/powerpc/kernel/cpu_setup_44x.S
@@ -35,6 +35,7 @@ _GLOBAL(__setup_cpu_440grx)
 _GLOBAL(__setup_cpu_460ex)
 _GLOBAL(__setup_cpu_460gt)
 	b	__init_fpu_44x
+_GLOBAL(__setup_cpu_440x5)
 _GLOBAL(__setup_cpu_440gx)
 _GLOBAL(__setup_cpu_440spe)
 	b	__fixup_440A_mcheck
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -39,6 +39,7 @@ extern void __setup_cpu_440epx(unsigned 
 extern void __setup_cpu_440gx(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_440grx(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_440spe(unsigned long offset, struct cpu_spec* spec);
+extern void __setup_cpu_440x5(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_460ex(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_460gt(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_603(unsigned long offset, struct cpu_spec* spec);
@@ -1463,6 +1464,8 @@ static struct cpu_spec __initdata cpu_sp
 		.cpu_user_features	= COMMON_USER_BOOKE,
 		.icache_bsize		= 32,
 		.dcache_bsize		= 32,
+		.cpu_setup		= __setup_cpu_440x5,
+		.machine_check		= machine_check_440A,
 		.platform		= "ppc440",
 	},
 	{ /* 460EX */

[patch 81/83] ACPI: delete OSI(Linux) DMI dmesg spam

[Greg KH]

[-- Attachment #1: acpi-delete-osi-dmi-dmesg-spam.patch --]
[-- Type: text/plain, Size: 2091 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Len Brown <lenb@kernel.org>

With the 2.6.28 commit a6e0887f21bbab337ee32d9c0a84d7c0b6e9141b, we now
have fixed up the ACPI DMI code, so stop asking for people to report the
issues to the acpi developers, it is no longer needed at all.

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/acpi/osl.c |   36 ------------------------------------
 1 file changed, 36 deletions(-)

--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -1261,34 +1261,6 @@ acpi_status acpi_os_release_object(acpi_
 	return (AE_OK);
 }
 
-/**
- *	acpi_dmi_dump - dump DMI slots needed for blacklist entry
- *
- *	Returns 0 on success
- */
-static int acpi_dmi_dump(void)
-{
-
-	if (!dmi_available)
-		return -1;
-
-	printk(KERN_NOTICE PREFIX "DMI System Vendor: %s\n",
-		dmi_get_system_info(DMI_SYS_VENDOR));
-	printk(KERN_NOTICE PREFIX "DMI Product Name: %s\n",
-		dmi_get_system_info(DMI_PRODUCT_NAME));
-	printk(KERN_NOTICE PREFIX "DMI Product Version: %s\n",
-		dmi_get_system_info(DMI_PRODUCT_VERSION));
-	printk(KERN_NOTICE PREFIX "DMI Board Name: %s\n",
-		dmi_get_system_info(DMI_BOARD_NAME));
-	printk(KERN_NOTICE PREFIX "DMI BIOS Vendor: %s\n",
-		dmi_get_system_info(DMI_BIOS_VENDOR));
-	printk(KERN_NOTICE PREFIX "DMI BIOS Date: %s\n",
-		dmi_get_system_info(DMI_BIOS_DATE));
-
-	return 0;
-}
-
-
 /******************************************************************************
  *
  * FUNCTION:    acpi_os_validate_interface
@@ -1315,14 +1287,6 @@ acpi_os_validate_interface (char *interf
 			osi_linux.cmdline ? " via cmdline" :
 			osi_linux.dmi ? " via DMI" : "");
 
-		if (!osi_linux.dmi) {
-			if (acpi_dmi_dump())
-				printk(KERN_NOTICE PREFIX
-					"[please extract dmidecode output]\n");
-			printk(KERN_NOTICE PREFIX
-				"Please send DMI info above to "
-				"linux-acpi@vger.kernel.org\n");
-		}
 		if (!osi_linux.known && !osi_linux.cmdline) {
 			printk(KERN_NOTICE PREFIX
 				"If \"acpi_osi=%sLinux\" works better, "

[patch 82/83] cifs: fix a regression in cifs umount codepath

[Greg KH]

[-- Attachment #1: cifs-fix-a-regression-in-cifs-umount-codepath.patch --]
[-- Type: text/plain, Size: 4934 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Jeff Layton <jlayton@redhat.com>

backport of 469ee614aaa367d9cde01cbdd2027212f56c6cc6 upstream.

Several cifs patches were added to 2.6.27.8 to fix some races in the
mount/umount codepath. When this was done, a couple of prerequisite
patches were missed causing a minor regression.

When the last cifs mount to a server goes away, the kthread that manages
the socket is supposed to come down. The patches that went into 2.6.27.8
removed the kthread_stop calls that used to take down these threads, but
left the thread function expecting them. This made the thread stay up
even after the last mount was gone.

This patch should fix up this regression and also prevent a possible
race where a dead task could be signalled.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Cc: Suresh Jayaraman <sjayaraman@suse.de>
Acked-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/cifs/connect.c |   36 +++++++++++++++++++++---------------
 1 file changed, 21 insertions(+), 15 deletions(-)

--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -128,7 +128,7 @@ cifs_reconnect(struct TCP_Server_Info *s
 	struct mid_q_entry *mid_entry;
 
 	spin_lock(&GlobalMid_Lock);
-	if (kthread_should_stop()) {
+	if (server->tcpStatus == CifsExiting) {
 		/* the demux thread will exit normally
 		next time through the loop */
 		spin_unlock(&GlobalMid_Lock);
@@ -182,7 +182,8 @@ cifs_reconnect(struct TCP_Server_Info *s
 	spin_unlock(&GlobalMid_Lock);
 	up(&server->tcpSem);
 
-	while ((!kthread_should_stop()) && (server->tcpStatus != CifsGood)) {
+	while ((server->tcpStatus != CifsExiting) &&
+	       (server->tcpStatus != CifsGood)) {
 		try_to_freeze();
 		if (server->addr.sockAddr6.sin6_family == AF_INET6) {
 			rc = ipv6_connect(&server->addr.sockAddr6,
@@ -200,7 +201,7 @@ cifs_reconnect(struct TCP_Server_Info *s
 		} else {
 			atomic_inc(&tcpSesReconnectCount);
 			spin_lock(&GlobalMid_Lock);
-			if (!kthread_should_stop())
+			if (server->tcpStatus != CifsExiting)
 				server->tcpStatus = CifsGood;
 			server->sequence_number = 0;
 			spin_unlock(&GlobalMid_Lock);
@@ -355,7 +356,7 @@ cifs_demultiplex_thread(struct TCP_Serve
 				GFP_KERNEL);
 
 	set_freezable();
-	while (!kthread_should_stop()) {
+	while (server->tcpStatus != CifsExiting) {
 		if (try_to_freeze())
 			continue;
 		if (bigbuf == NULL) {
@@ -396,7 +397,7 @@ incomplete_rcv:
 		    kernel_recvmsg(csocket, &smb_msg,
 				&iov, 1, pdu_length, 0 /* BB other flags? */);
 
-		if (kthread_should_stop()) {
+		if (server->tcpStatus == CifsExiting) {
 			break;
 		} else if (server->tcpStatus == CifsNeedReconnect) {
 			cFYI(1, ("Reconnect after server stopped responding"));
@@ -527,7 +528,7 @@ incomplete_rcv:
 		     total_read += length) {
 			length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 						pdu_length - total_read, 0);
-			if (kthread_should_stop() ||
+			if ((server->tcpStatus == CifsExiting) ||
 			    (length == -EINTR)) {
 				/* then will exit */
 				reconnect = 2;
@@ -661,14 +662,6 @@ multi_t2_fnd:
 	spin_unlock(&GlobalMid_Lock);
 	wake_up_all(&server->response_q);
 
-	/* don't exit until kthread_stop is called */
-	set_current_state(TASK_UNINTERRUPTIBLE);
-	while (!kthread_should_stop()) {
-		schedule();
-		set_current_state(TASK_UNINTERRUPTIBLE);
-	}
-	set_current_state(TASK_RUNNING);
-
 	/* check if we have blocked requests that need to free */
 	/* Note that cifs_max_pending is normally 50, but
 	can be set at module install time to as little as two */
@@ -764,6 +757,7 @@ multi_t2_fnd:
 	read_unlock(&cifs_tcp_ses_lock);
 
 	kfree(server->hostname);
+	task_to_wake = xchg(&server->tsk, NULL);
 	kfree(server);
 
 	length = atomic_dec_return(&tcpSesAllocCount);
@@ -771,6 +765,16 @@ multi_t2_fnd:
 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 				GFP_KERNEL);
 
+	/* if server->tsk was NULL then wait for a signal before exiting */
+	if (!task_to_wake) {
+		set_current_state(TASK_INTERRUPTIBLE);
+		while (!signal_pending(current)) {
+			schedule();
+			set_current_state(TASK_INTERRUPTIBLE);
+		}
+		set_current_state(TASK_RUNNING);
+	}
+
 	return 0;
 }
 
@@ -2310,7 +2314,7 @@ cifs_mount(struct super_block *sb, struc
 	/* on error free sesinfo and tcon struct if needed */
 mount_fail_check:
 	if (rc) {
-		 /* If find_unc succeeded then rc == 0 so we can not end */
+		/* If find_unc succeeded then rc == 0 so we can not end */
 		/* up accidently freeing someone elses tcon struct */
 		if (tcon)
 			cifs_put_tcon(tcon);
@@ -3715,8 +3719,10 @@ int cifs_setup_session(unsigned int xid,
 		cERROR(1, ("Send error in SessSetup = %d", rc));
 	} else {
 		cFYI(1, ("CIFS Session Established successfully"));
+			spin_lock(&GlobalMid_Lock);
 			pSesInfo->status = CifsGood;
 			pSesInfo->need_reconnect = false;
+			spin_unlock(&GlobalMid_Lock);
 	}
 
 ss_err_exit:

[patch 83/83] pnp: make the resource type an unsigned long

[Greg KH]

[-- Attachment #1: pnp-make-the-resource-type-an-unsigned-long.patch --]
[-- Type: text/plain, Size: 2712 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Rene Herman <rene.herman@keyaccess.nl>

commit b563cf59c4d67da7d671788a9848416bfa4180ab upstream.

PnP encodes the resource type directly as its struct resource->flags value
which is an unsigned long.  Make it so...

Signed-off-by: Rene Herman <rene.herman@gmail.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Acked-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Andi Kleen <andi@firstfloor.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/pnp/base.h     |    2 +-
 drivers/pnp/quirks.c   |    2 +-
 drivers/pnp/resource.c |    4 ++--
 include/linux/pnp.h    |    6 ++++--
 4 files changed, 8 insertions(+), 6 deletions(-)

--- a/drivers/pnp/base.h
+++ b/drivers/pnp/base.h
@@ -147,7 +147,7 @@ char *pnp_resource_type_name(struct reso
 void dbg_pnp_show_resources(struct pnp_dev *dev, char *desc);
 
 void pnp_free_resources(struct pnp_dev *dev);
-int pnp_resource_type(struct resource *res);
+unsigned long pnp_resource_type(struct resource *res);
 
 struct pnp_resource {
 	struct list_head list;
--- a/drivers/pnp/quirks.c
+++ b/drivers/pnp/quirks.c
@@ -245,7 +245,7 @@ static void quirk_system_pci_resources(s
 	 */
 	for_each_pci_dev(pdev) {
 		for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
-			unsigned int type;
+			unsigned long type;
 
 			type = pci_resource_flags(pdev, i) &
 					(IORESOURCE_IO | IORESOURCE_MEM);
--- a/drivers/pnp/resource.c
+++ b/drivers/pnp/resource.c
@@ -467,14 +467,14 @@ int pnp_check_dma(struct pnp_dev *dev, s
 #endif
 }
 
-int pnp_resource_type(struct resource *res)
+unsigned long pnp_resource_type(struct resource *res)
 {
 	return res->flags & (IORESOURCE_IO  | IORESOURCE_MEM |
 			     IORESOURCE_IRQ | IORESOURCE_DMA);
 }
 
 struct resource *pnp_get_resource(struct pnp_dev *dev,
-				  unsigned int type, unsigned int num)
+				  unsigned long type, unsigned int num)
 {
 	struct pnp_resource *pnp_res;
 	struct resource *res;
--- a/include/linux/pnp.h
+++ b/include/linux/pnp.h
@@ -22,9 +22,11 @@ struct pnp_dev;
  * Resource Management
  */
 #ifdef CONFIG_PNP
-struct resource *pnp_get_resource(struct pnp_dev *, unsigned int, unsigned int);
+struct resource *pnp_get_resource(struct pnp_dev *dev, unsigned long type,
+				unsigned int num);
 #else
-static inline struct resource *pnp_get_resource(struct pnp_dev *dev, unsigned int type, unsigned int num)
+static inline struct resource *pnp_get_resource(struct pnp_dev *dev,
+			unsigned long type, unsigned int num)
 {
 	return NULL;
 }

Re: [patch 37/83] USB: add Nikon D300 camera to unusual_devs

[Chris Wedgwood]

On Thu, Dec 11, 2008 at 11:14:55AM -0800, Greg KH wrote:

> 2.6.27-stable review patch.  If anyone has any objections, please
> let us know.
>
> From: Paul Ready <lxtwin@homecall.co.uk>
>
> commit 0047ca0a45c6a481abd467fb52d2a480ffc8c6b9 upstream
>
> Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11685
>
> When A Nikon D300 camera is connected to a system it is seen in
> /proc/bus/pci/devices but is not accessible.


I can't tell from looking over the bugzilla comments if this fix is
really the right fix or even necessary.

Is this definately the right fix?

Re: [patch 37/83] USB: add Nikon D300 camera to unusual_devs

[Alan Stern]

On Thu, 11 Dec 2008, Chris Wedgwood wrote:

> On Thu, Dec 11, 2008 at 11:14:55AM -0800, Greg KH wrote:
> 
> > 2.6.27-stable review patch.  If anyone has any objections, please
> > let us know.
> >
> > From: Paul Ready <lxtwin@homecall.co.uk>
> >
> > commit 0047ca0a45c6a481abd467fb52d2a480ffc8c6b9 upstream
> >
> > Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11685
> >
> > When A Nikon D300 camera is connected to a system it is seen in
> > /proc/bus/pci/devices but is not accessible.
> 
> 
> I can't tell from looking over the bugzilla comments if this fix is
> really the right fix or even necessary.
> 
> Is this definately the right fix?

It's not entirely clear from the Bugzilla entry that any fix is needed
at all!  In comment #14 I asked Paul Ready (the submitter) to post a
log showing what goes wrong when the entry isn't present, but he never
did.

Alan Stern

Re: [patch 03/83] cxgb3: Fix kernel crash caused by uninitialized l2t_entry.arpq

[Stefan Lippers-Hollmann]

[-- Attachment #1: Type: text/plain, Size: 2560 bytes --]

Hi

On Donnerstag, 11. Dezember 2008, Greg KH wrote:
> 2.6.27-stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> 
> From: Roland Dreier <rdreier@cisco.com>
> 
> [ Upstream commit 6d329af9967e7ab3f4a3d7f1e8ef87539c3a069f ]
> 
> Commit 147e70e6 ("cxgb3: Use SKB list interfaces instead of home-grown
> implementation.") causes a crash in t3_l2t_send_slow() when an iWARP
> connection request is received.  This is because the new l2t_entry.arpq
> skb queue is never initialized, and therefore trying to add an skb to
> it causes a NULL dereference.  With the old code there was no need to
> initialize the queues because the l2t_entry structures were zeroed,
> and the code used NULL to mean empty.
> 
> Fix this by adding __skb_queue_head_init() when all the l2t_entry
> structures get allocated.

This patch doesn't compile.

> Signed-off-by: Roland Dreier <rolandd@cisco.com>
> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> 
> ---
>  drivers/net/cxgb3/l2t.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> --- a/drivers/net/cxgb3/l2t.c
> +++ b/drivers/net/cxgb3/l2t.c
> @@ -436,6 +436,7 @@ struct l2t_data *t3_init_l2t(unsigned in
>  	for (i = 0; i < l2t_capacity; ++i) {
>  		d->l2tab[i].idx = i;
>  		d->l2tab[i].state = L2T_STATE_UNUSED;
> +		__skb_queue_head_init(&d->l2tab[i].arpq);
>  		spin_lock_init(&d->l2tab[i].lock);
>  		atomic_set(&d->l2tab[i].refcnt, 0);
>  	}

  CC [M]  drivers/net/cxgb3/cxgb3_main.o
  CC [M]  drivers/net/cxgb3/ael1002.o
  CC [M]  drivers/net/cxgb3/vsc8211.o
  CC [M]  drivers/net/cxgb3/t3_hw.o
  CC [M]  drivers/net/cxgb3/mc5.o
  CC [M]  drivers/net/cxgb3/xgmac.o
  CC [M]  drivers/net/cxgb3/sge.o
  CC [M]  drivers/net/cxgb3/l2t.o
drivers/net/cxgb3/l2t.c: In function ‘t3_init_l2t’:
drivers/net/cxgb3/l2t.c:439: error: implicit declaration of function ‘__skb_queue_head_init’
drivers/net/cxgb3/l2t.c:439: error: ‘struct l2t_entry’ has no member named ‘arpq’
make[3]: *** [drivers/net/cxgb3/l2t.o] Error 1
make[2]: *** [drivers/net/cxgb3] Error 2
make[1]: *** [drivers/net] Error 2
make: *** [drivers] Error 2

It seems to depend on

commit 147e70e62fdd5af6263106ad634b03c5154c1e56
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Sep 22 01:29:52 2008 -0700

    cxgb3: Use SKB list interfaces instead of home-grown implementation.

    Signed-off-by: David S. Miller <davem@davemloft.net>

Regards
	Stefan Lippers-Hollmann

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: [patch 03/83] cxgb3: Fix kernel crash caused by uninitialized l2t_entry.arpq

[Greg KH]

On Thu, Dec 11, 2008 at 10:12:34PM +0100, Stefan Lippers-Hollmann wrote:
> Hi
> 
> On Donnerstag, 11. Dezember 2008, Greg KH wrote:
> > 2.6.27-stable review patch.  If anyone has any objections, please let us know.
> > 
> > ------------------
> > 
> > From: Roland Dreier <rdreier@cisco.com>
> > 
> > [ Upstream commit 6d329af9967e7ab3f4a3d7f1e8ef87539c3a069f ]
> > 
> > Commit 147e70e6 ("cxgb3: Use SKB list interfaces instead of home-grown
> > implementation.") causes a crash in t3_l2t_send_slow() when an iWARP
> > connection request is received.  This is because the new l2t_entry.arpq
> > skb queue is never initialized, and therefore trying to add an skb to
> > it causes a NULL dereference.  With the old code there was no need to
> > initialize the queues because the l2t_entry structures were zeroed,
> > and the code used NULL to mean empty.
> > 
> > Fix this by adding __skb_queue_head_init() when all the l2t_entry
> > structures get allocated.
> 
> This patch doesn't compile.
> 
> > Signed-off-by: Roland Dreier <rolandd@cisco.com>
> > Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> > 
> > ---
> >  drivers/net/cxgb3/l2t.c |    1 +
> >  1 file changed, 1 insertion(+)
> > 
> > --- a/drivers/net/cxgb3/l2t.c
> > +++ b/drivers/net/cxgb3/l2t.c
> > @@ -436,6 +436,7 @@ struct l2t_data *t3_init_l2t(unsigned in
> >  	for (i = 0; i < l2t_capacity; ++i) {
> >  		d->l2tab[i].idx = i;
> >  		d->l2tab[i].state = L2T_STATE_UNUSED;
> > +		__skb_queue_head_init(&d->l2tab[i].arpq);
> >  		spin_lock_init(&d->l2tab[i].lock);
> >  		atomic_set(&d->l2tab[i].refcnt, 0);
> >  	}
> 
>   CC [M]  drivers/net/cxgb3/cxgb3_main.o
>   CC [M]  drivers/net/cxgb3/ael1002.o
>   CC [M]  drivers/net/cxgb3/vsc8211.o
>   CC [M]  drivers/net/cxgb3/t3_hw.o
>   CC [M]  drivers/net/cxgb3/mc5.o
>   CC [M]  drivers/net/cxgb3/xgmac.o
>   CC [M]  drivers/net/cxgb3/sge.o
>   CC [M]  drivers/net/cxgb3/l2t.o
> drivers/net/cxgb3/l2t.c: In function ‘t3_init_l2t’:
> drivers/net/cxgb3/l2t.c:439: error: implicit declaration of function ‘__skb_queue_head_init’
> drivers/net/cxgb3/l2t.c:439: error: ‘struct l2t_entry’ has no member named ‘arpq’
> make[3]: *** [drivers/net/cxgb3/l2t.o] Error 1
> make[2]: *** [drivers/net/cxgb3] Error 2
> make[1]: *** [drivers/net] Error 2
> make: *** [drivers] Error 2
> 
> It seems to depend on
> 
> commit 147e70e62fdd5af6263106ad634b03c5154c1e56
> Author: David S. Miller <davem@davemloft.net>
> Date:   Mon Sep 22 01:29:52 2008 -0700
> 
>     cxgb3: Use SKB list interfaces instead of home-grown implementation.
> 
>     Signed-off-by: David S. Miller <davem@davemloft.net>
> 
> Regards
> 	Stefan Lippers-Hollmann


Crap, missed this one.  Thanks, I'll respin a -rc2 in a bit after some
more testing.  I found a Cell problem that should also be addressed...

thanks,

greg k-h

Re: [patch 37/83] USB: add Nikon D300 camera to unusual_devs

[Greg KH]

On Thu, Dec 11, 2008 at 11:29:21AM -0800, Chris Wedgwood wrote:
> On Thu, Dec 11, 2008 at 11:14:55AM -0800, Greg KH wrote:
> 
> > 2.6.27-stable review patch.  If anyone has any objections, please
> > let us know.
> >
> > From: Paul Ready <lxtwin@homecall.co.uk>
> >
> > commit 0047ca0a45c6a481abd467fb52d2a480ffc8c6b9 upstream
> >
> > Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11685
> >
> > When A Nikon D300 camera is connected to a system it is seen in
> > /proc/bus/pci/devices but is not accessible.
> 
> 
> I can't tell from looking over the bugzilla comments if this fix is
> really the right fix or even necessary.
> 
> Is this definately the right fix?

Don't know, it's what is in mainline right now, so if it's wrong, it
needs to be resolved there first :)

thanks,

greg k-h

Re: [patch 03/83] cxgb3: Fix kernel crash caused by uninitialized l2t_entry.arpq

[David Miller]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: Text/Plain; charset=utf-8, Size: 1179 bytes --]

From: Greg KH <gregkh@suse.de>
Date: Thu, 11 Dec 2008 15:41:55 -0800

> On Thu, Dec 11, 2008 at 10:12:34PM +0100, Stefan Lippers-Hollmann wrote:
> >   CC [M]  drivers/net/cxgb3/l2t.o
> > drivers/net/cxgb3/l2t.c: In function ‘t3_init_l2t’:
> > drivers/net/cxgb3/l2t.c:439: error: implicit declaration of function ‘__skb_queue_head_init’
> > drivers/net/cxgb3/l2t.c:439: error: ‘struct l2t_entry’ has no member named ‘arpq’
 ...
> > It seems to depend on
> > 
> > commit 147e70e62fdd5af6263106ad634b03c5154c1e56
> > Author: David S. Miller <davem@davemloft.net>
> > Date:   Mon Sep 22 01:29:52 2008 -0700
> > 
> >     cxgb3: Use SKB list interfaces instead of home-grown implementation.
> > 
> >     Signed-off-by: David S. Miller <davem@davemloft.net>
> > 
> > Regards
> > 	Stefan Lippers-Hollmann
> 
> 
> Crap, missed this one.  Thanks, I'll respin a -rc2 in a bit after some
> more testing.  I found a Cell problem that should also be addressed...

Sorry my bad, I checked the dependencies wrongly :-/
ÿôèº{.nÇ+‰·Ÿ®‰­†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a­¢f£¢·hšïêÿ‘êçz_è®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨è­Ú&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥

Re: [patch 03/83] cxgb3: Fix kernel crash caused by uninitialized l2t_entry.arpq

[Greg KH]

On Thu, Dec 11, 2008 at 10:12:34PM +0100, Stefan Lippers-Hollmann wrote:
> Hi
> 
> On Donnerstag, 11. Dezember 2008, Greg KH wrote:
> > 2.6.27-stable review patch.  If anyone has any objections, please let us know.
> > 
> > ------------------
> > 
> > From: Roland Dreier <rdreier@cisco.com>
> > 
> > [ Upstream commit 6d329af9967e7ab3f4a3d7f1e8ef87539c3a069f ]
> > 
> > Commit 147e70e6 ("cxgb3: Use SKB list interfaces instead of home-grown
> > implementation.") causes a crash in t3_l2t_send_slow() when an iWARP
> > connection request is received.  This is because the new l2t_entry.arpq
> > skb queue is never initialized, and therefore trying to add an skb to
> > it causes a NULL dereference.  With the old code there was no need to
> > initialize the queues because the l2t_entry structures were zeroed,
> > and the code used NULL to mean empty.
> > 
> > Fix this by adding __skb_queue_head_init() when all the l2t_entry
> > structures get allocated.
> 
> This patch doesn't compile.
> 
> > Signed-off-by: Roland Dreier <rolandd@cisco.com>
> > Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> > 
> > ---
> >  drivers/net/cxgb3/l2t.c |    1 +
> >  1 file changed, 1 insertion(+)
> > 
> > --- a/drivers/net/cxgb3/l2t.c
> > +++ b/drivers/net/cxgb3/l2t.c
> > @@ -436,6 +436,7 @@ struct l2t_data *t3_init_l2t(unsigned in
> >  	for (i = 0; i < l2t_capacity; ++i) {
> >  		d->l2tab[i].idx = i;
> >  		d->l2tab[i].state = L2T_STATE_UNUSED;
> > +		__skb_queue_head_init(&d->l2tab[i].arpq);
> >  		spin_lock_init(&d->l2tab[i].lock);
> >  		atomic_set(&d->l2tab[i].refcnt, 0);
> >  	}
> 
>   CC [M]  drivers/net/cxgb3/cxgb3_main.o
>   CC [M]  drivers/net/cxgb3/ael1002.o
>   CC [M]  drivers/net/cxgb3/vsc8211.o
>   CC [M]  drivers/net/cxgb3/t3_hw.o
>   CC [M]  drivers/net/cxgb3/mc5.o
>   CC [M]  drivers/net/cxgb3/xgmac.o
>   CC [M]  drivers/net/cxgb3/sge.o
>   CC [M]  drivers/net/cxgb3/l2t.o
> drivers/net/cxgb3/l2t.c: In function ‘t3_init_l2t’:
> drivers/net/cxgb3/l2t.c:439: error: implicit declaration of function ‘__skb_queue_head_init’
> drivers/net/cxgb3/l2t.c:439: error: ‘struct l2t_entry’ has no member named ‘arpq’
> make[3]: *** [drivers/net/cxgb3/l2t.o] Error 1
> make[2]: *** [drivers/net/cxgb3] Error 2
> make[1]: *** [drivers/net] Error 2
> make: *** [drivers] Error 2
> 
> It seems to depend on
> 
> commit 147e70e62fdd5af6263106ad634b03c5154c1e56
> Author: David S. Miller <davem@davemloft.net>
> Date:   Mon Sep 22 01:29:52 2008 -0700
> 
>     cxgb3: Use SKB list interfaces instead of home-grown implementation.
> 
>     Signed-off-by: David S. Miller <davem@davemloft.net>

Hm, no, adding that patch also breaks the build for other reasons :)

David, I'm going to have to drop the original patch you sent me here, as
it doesn't build in the 2.6.27 tree.  If you have a replacement for it
that does build, I'll be glad to take it.

thanks,

greg k-h

Re: [patch 03/83] cxgb3: Fix kernel crash caused by uninitialized l2t_entry.arpq

[David Miller]

From: Greg KH <gregkh@suse.de>
Date: Thu, 11 Dec 2008 20:00:52 -0800

> David, I'm going to have to drop the original patch you sent me here, as
> it doesn't build in the 2.6.27 tree.  If you have a replacement for it
> that does build, I'll be glad to take it.

As I replied already, this is fine, sorry for the
misfire :-)

Re: [stable] [patch 00/83] 2.6.27.9-stable review

[Greg KH]

On Thu, Dec 11, 2008 at 11:10:14AM -0800, Greg KH wrote:
> This is the start of the stable review cycle for the 2.6.27.9 release.
> There are 83 patches in this series, all will be posted as a response to
> this one.  If anyone has any issues with these being applied, please let
> us know.  If anyone is a maintainer of the proper subsystem, and wants
> to add a Signed-off-by: line to the patch, please respond with it.
> 
> These patches are sent out with a number of different people on the Cc:
> line.  If you wish to be a reviewer, please email stable@kernel.org to
> add your name to the list.  If you want to be off the reviewer list,
> also email us.
> 
> Responses should be made by December 13, 2008, 20:00:00 UTC.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.9-rc1.gz
> and the diffstat can be found below.

Well, -rc1 had a build error in it that I missed, so I dropped one
patch, and added 2 more that had come in.

So there is now a -rc2 at:
	kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.9-rc2.gz

and the diffstat is down below.

thanks,

greg k-h

 Makefile                              |    2 +-
 arch/powerpc/kernel/cpu_setup_44x.S   |    1 +
 arch/powerpc/kernel/cputable.c        |    3 +
 arch/powerpc/platforms/cell/smp.c     |   10 +-
 arch/powerpc/platforms/pseries/smp.c  |   13 +-
 arch/powerpc/sysdev/mpic.c            |    9 +-
 arch/sparc/include/asm/uaccess_64.h   |    4 +-
 arch/sparc64/kernel/pci.c             |   10 +-
 arch/sparc64/kernel/ptrace.c          |    2 +-
 arch/sparc64/kernel/visemul.c         |    6 +-
 arch/sparc64/lib/user_fixup.c         |    2 +-
 arch/um/drivers/mconsole_kern.c       |    4 +-
 arch/x86/kernel/hpet.c                |    2 +-
 arch/x86/mm/init_64.c                 |    4 +-
 block/bsg.c                           |    2 +
 block/scsi_ioctl.c                    |    2 +
 drivers/acpi/osl.c                    |   36 ----
 drivers/acpi/sleep/main.c             |   40 ++++-
 drivers/ata/libata-sff.c              |   13 +-
 drivers/edac/cell_edac.c              |    3 +
 drivers/hid/usbhid/hid-quirks.c       |    2 +
 drivers/input/serio/i8042-x86ia64io.h |   29 +++
 drivers/net/cxgb3/adapter.h           |    1 +
 drivers/net/cxgb3/cxgb3_main.c        |    5 +
 drivers/net/cxgb3/sge.c               |   56 ++----
 drivers/net/niu.c                     |    3 +-
 drivers/net/pppol2tp.c                |    1 +
 drivers/pci/pcie/aspm.c               |   29 +++-
 drivers/pci/slot.c                    |    1 +
 drivers/pnp/base.h                    |    2 +-
 drivers/pnp/quirks.c                  |    2 +-
 drivers/pnp/resource.c                |    4 +-
 drivers/spi/spidev.c                  |    4 +-
 drivers/usb/serial/option.c           |  176 +++++++++++++++---
 drivers/usb/storage/unusual_devs.h    |  334 ++++++++++++++++++++++++++++++--
 fs/binfmt_em86.c                      |    2 +-
 fs/binfmt_misc.c                      |    4 +-
 fs/binfmt_script.c                    |    5 +-
 fs/cifs/connect.c                     |   36 ++--
 fs/exec.c                             |   10 +-
 fs/fcntl.c                            |    7 +
 fs/ioctl.c                            |   12 +-
 fs/jbd/checkpoint.c                   |   49 ++++--
 fs/jbd/journal.c                      |   28 +++-
 fs/jbd/recovery.c                     |    7 +-
 fs/proc/task_mmu.c                    |    4 +-
 fs/xfs/xfs_rename.c                   |    2 +-
 include/linux/binfmts.h               |    2 +
 include/linux/blkdev.h                |    1 +
 include/linux/jbd.h                   |    2 +-
 include/linux/pnp.h                   |    6 +-
 kernel/fork.c                         |   15 +-
 kernel/sched.c                        |    8 +-
 net/atm/svc.c                         |    6 +-
 net/ipv4/udp.c                        |   12 +-
 net/ipv6/udp.c                        |    8 +-
 net/unix/af_unix.c                    |    2 +-
 sound/pci/emu10k1/emu10k1_main.c      |    3 +
 sound/pci/hda/hda_proc.c              |    2 +-
 sound/pci/hda/patch_analog.c          |   10 +-
 sound/pci/hda/patch_realtek.c         |  152 +++++++++++++++-
 sound/pci/hda/patch_sigmatel.c        |   45 ++++-
 62 files changed, 1019 insertions(+), 238 deletions(-)

[patch 84/83] powerpc: Use cpu_thread_in_core in smp_init for of_spin_map

[Greg KH]

From: Milton Miller <miltonm@bga.com>

commit 6a75a6b8e85e92cc774d42a4e113c76c30b5a539 upstream.

We used to assume that even numbered threads were the primary
threads, ie those that would be listed and started as a cpu from
open firmware.  Replace a left over is even (% 2) check with a check
for it being a primary thread and update the comments.

Tested with a debug print on pseries, identical code found for cell.

Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/powerpc/platforms/cell/smp.c    |   10 +++-------
 arch/powerpc/platforms/pseries/smp.c |   13 ++++---------
 2 files changed, 7 insertions(+), 16 deletions(-)

--- a/arch/powerpc/platforms/cell/smp.c
+++ b/arch/powerpc/platforms/cell/smp.c
@@ -54,8 +54,8 @@
 #endif
 
 /*
- * The primary thread of each non-boot processor is recorded here before
- * smp init.
+ * The Primary thread of each non-boot processor was started from the OF client
+ * interface by prom_hold_cpus and is spinning on secondary_hold_spinloop.
  */
 static cpumask_t of_spin_map;
 
@@ -208,11 +208,7 @@ void __init smp_init_cell(void)
 	/* Mark threads which are still spinning in hold loops. */
 	if (cpu_has_feature(CPU_FTR_SMT)) {
 		for_each_present_cpu(i) {
-			if (i % 2 == 0)
-				/*
-				 * Even-numbered logical cpus correspond to
-				 * primary threads.
-				 */
+			if (cpu_thread_in_core(i) == 0)
 				cpu_set(i, of_spin_map);
 		}
 	} else {
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -52,8 +52,8 @@
 
 
 /*
- * The primary thread of each non-boot processor is recorded here before
- * smp init.
+ * The Primary thread of each non-boot processor was started from the OF client
+ * interface by prom_hold_cpus and is spinning on secondary_hold_spinloop.
  */
 static cpumask_t of_spin_map;
 
@@ -191,8 +191,7 @@ static void __devinit smp_pSeries_kick_c
 static int smp_pSeries_cpu_bootable(unsigned int nr)
 {
 	/* Special case - we inhibit secondary thread startup
-	 * during boot if the user requests it.  Odd-numbered
-	 * cpus are assumed to be secondary threads.
+	 * during boot if the user requests it.
 	 */
 	if (system_state < SYSTEM_RUNNING &&
 	    cpu_has_feature(CPU_FTR_SMT) &&
@@ -229,11 +228,7 @@ static void __init smp_init_pseries(void
 	/* Mark threads which are still spinning in hold loops. */
 	if (cpu_has_feature(CPU_FTR_SMT)) {
 		for_each_present_cpu(i) { 
-			if (i % 2 == 0)
-				/*
-				 * Even-numbered logical cpus correspond to
-				 * primary threads.
-				 */
+			if (cpu_thread_in_core(i) == 0)
 				cpu_set(i, of_spin_map);
 		}
 	} else {

[patch 85/83] XFS: Fix hang after disallowed rename across directory quota domains

[Greg KH]

From: Dave Chinner <david@fromorbit.com>

commit 576a488a27f267af203f3ea69c700a1612335e9f upstream.

When project quota is active and is being used for directory tree
quota control, we disallow rename outside the current directory
tree. This requires a check to be made after all the inodes
involved in the rename are locked. We fail to unlock the inodes
correctly if we disallow the rename when the target is outside the
current directory tree. This results in a hang on the next access
to the inodes involved in failed rename.

Reported-by: Arkadiusz Miskiewicz <arekm@maven.pl>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Tested-by: Arkadiusz Miskiewicz <arekm@maven.pl>
Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/xfs/xfs_rename.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/xfs/xfs_rename.c
+++ b/fs/xfs/xfs_rename.c
@@ -212,7 +212,7 @@ xfs_rename(
 	if (unlikely((target_dp->i_d.di_flags & XFS_DIFLAG_PROJINHERIT) &&
 		     (target_dp->i_d.di_projid != src_ip->i_d.di_projid))) {
 		error = XFS_ERROR(EXDEV);
-		xfs_rename_unlock4(inodes, XFS_ILOCK_SHARED);
+		xfs_rename_unlock4(inodes, XFS_ILOCK_EXCL);
 		xfs_trans_cancel(tp, cancel_flags);
 		goto std_return;
 	}

Re: [patch 00/83] 2.6.27.9-stable review

[François Valenduc]

Greg KH a écrit :
> This is the start of the stable review cycle for the 2.6.27.9 release.
> There are 83 patches in this series, all will be posted as a response to
> this one.  If anyone has any issues with these being applied, please let
> us know.  If anyone is a maintainer of the proper subsystem, and wants
> to add a Signed-off-by: line to the patch, please respond with it.
> 
> These patches are sent out with a number of different people on the Cc:
> line.  If you wish to be a reviewer, please email stable@kernel.org to
> add your name to the list.  If you want to be off the reviewer list,
> also email us.
> 
> Responses should be made by December 13, 2008, 20:00:00 UTC.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.9-rc1.gz
> and the diffstat can be found below.
> 
> 
> thanks,
> 
> greg k-h

Would it be possible to add these two patches ?

commit 8258becf07e71236aac8cf5406a1345712f9ac25
Author: Johannes Berg <johannes@sipsolutions.net>
Date:   Tue Sep 23 19:18:43 2008 +0200

     iwlagn: downgrade BUG_ON in interrupt

commit 199d9de726ff2f949405279665a9c8b38966239b
Author: Johannes Berg <johannes@sipsolutions.net>
Date:   Tue Nov 18 01:47:21 2008 +0100

     iwlagn: fix RX skb alignment

Without these ones, my computer freezes very frequently (see bugs 11393, 
11983 and 12173 which in fact is a duplicate of the previous one).
These two patches can be applied without any rejects on kernel 2.6.27.8.

Thanks,
François Valenduc

Re: [patch 00/83] 2.6.27.9-stable review

[Greg KH]

On Sat, Dec 13, 2008 at 10:29:55AM +0100, François Valenduc wrote:
> Greg KH a écrit :
>> This is the start of the stable review cycle for the 2.6.27.9 release.
>> There are 83 patches in this series, all will be posted as a response to
>> this one.  If anyone has any issues with these being applied, please let
>> us know.  If anyone is a maintainer of the proper subsystem, and wants
>> to add a Signed-off-by: line to the patch, please respond with it.
>> These patches are sent out with a number of different people on the Cc:
>> line.  If you wish to be a reviewer, please email stable@kernel.org to
>> add your name to the list.  If you want to be off the reviewer list,
>> also email us.
>> Responses should be made by December 13, 2008, 20:00:00 UTC.
>> Anything received after that time might be too late.
>> The whole patch series can be found in one patch at:
>> 	kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.9-rc1.gz
>> and the diffstat can be found below.
>> thanks,
>> greg k-h
>
> Would it be possible to add these two patches ?
>
> commit 8258becf07e71236aac8cf5406a1345712f9ac25
> Author: Johannes Berg <johannes@sipsolutions.net>
> Date:   Tue Sep 23 19:18:43 2008 +0200
>
>     iwlagn: downgrade BUG_ON in interrupt
>
> commit 199d9de726ff2f949405279665a9c8b38966239b
> Author: Johannes Berg <johannes@sipsolutions.net>
> Date:   Tue Nov 18 01:47:21 2008 +0100
>
>     iwlagn: fix RX skb alignment
>
> Without these ones, my computer freezes very frequently (see bugs 11393, 
> 11983 and 12173 which in fact is a duplicate of the previous one).
> These two patches can be applied without any rejects on kernel 2.6.27.8.

I don't see these patches in Linus's kernel tree.  Are they not there?

Or if they are there, can you give me the correct git commit ids for
them?

thanks,

greg k-h

Re: [patch 68/83] x86: HPET: convert WARN_ON to WARN_ON_ONCE

[Matt Fleming]

On Thu, Dec 11, 2008 at 11:16:20AM -0800, Greg KH wrote:
> 2.6.27-stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> 
> From: Matt Fleming <mjf@gentoo.org>
> 
> commit 1de5b0854623d30d01d72cd4ea323eb5f39d1f16 upstream.
> 
> It is possible to flood the console with call traces if the WARN_ON
> condition is true because of the frequency with which this function is
> called.
> 

If this commit is going into stable it would be worth adding these
two commits (which are actually the bugfixes).

5ceb1a04187553e08c6ab60d30cee7c454ee139a
x86: HPET: enter hpet_interrupt_handler with interrupts disabled

89d77a1eb60be916d85d9394bedbfa2037af89c5
x86: HPET: read from HPET_Tn_CMP() not HPET_T0_CMP

Re: [patch 68/83] x86: HPET: convert WARN_ON to WARN_ON_ONCE

[Takashi Iwai]

At Wed, 17 Dec 2008 11:26:25 +0000,
Matt Fleming wrote:
> 
> On Thu, Dec 11, 2008 at 11:16:20AM -0800, Greg KH wrote:
> > 2.6.27-stable review patch.  If anyone has any objections, please let us know.
> > 
> > ------------------
> > 
> > From: Matt Fleming <mjf@gentoo.org>
> > 
> > commit 1de5b0854623d30d01d72cd4ea323eb5f39d1f16 upstream.
> > 
> > It is possible to flood the console with call traces if the WARN_ON
> > condition is true because of the frequency with which this function is
> > called.
> > 
> 
> If this commit is going into stable it would be worth adding these
> two commits (which are actually the bugfixes).
> 
> 5ceb1a04187553e08c6ab60d30cee7c454ee139a
> x86: HPET: enter hpet_interrupt_handler with interrupts disabled
> 
> 89d77a1eb60be916d85d9394bedbfa2037af89c5
> x86: HPET: read from HPET_Tn_CMP() not HPET_T0_CMP

I think the latter isn't applicable as 2.6.27 supports only T0.


Takashi

Re: [patch 68/83] x86: HPET: convert WARN_ON to WARN_ON_ONCE

[Matt Fleming]

On Wed, Dec 17, 2008 at 12:33:17PM +0100, Takashi Iwai wrote:
> At Wed, 17 Dec 2008 11:26:25 +0000,
> Matt Fleming wrote:
> > 
> > On Thu, Dec 11, 2008 at 11:16:20AM -0800, Greg KH wrote:
> > > 2.6.27-stable review patch.  If anyone has any objections, please let us know.
> > > 
> > > ------------------
> > > 
> > > From: Matt Fleming <mjf@gentoo.org>
> > > 
> > > commit 1de5b0854623d30d01d72cd4ea323eb5f39d1f16 upstream.
> > > 
> > > It is possible to flood the console with call traces if the WARN_ON
> > > condition is true because of the frequency with which this function is
> > > called.
> > > 
> > 
> > If this commit is going into stable it would be worth adding these
> > two commits (which are actually the bugfixes).
> > 
> > 5ceb1a04187553e08c6ab60d30cee7c454ee139a
> > x86: HPET: enter hpet_interrupt_handler with interrupts disabled
> > 
> > 89d77a1eb60be916d85d9394bedbfa2037af89c5
> > x86: HPET: read from HPET_Tn_CMP() not HPET_T0_CMP
> 
> I think the latter isn't applicable as 2.6.27 supports only T0.
> 

Ah, thanks. I wasn't aware of that.

Re: [patch 68/83] x86: HPET: convert WARN_ON to WARN_ON_ONCE

[Greg KH]

On Wed, Dec 17, 2008 at 12:03:05PM +0000, Matt Fleming wrote:
> On Wed, Dec 17, 2008 at 12:33:17PM +0100, Takashi Iwai wrote:
> > At Wed, 17 Dec 2008 11:26:25 +0000,
> > Matt Fleming wrote:
> > > 
> > > On Thu, Dec 11, 2008 at 11:16:20AM -0800, Greg KH wrote:
> > > > 2.6.27-stable review patch.  If anyone has any objections, please let us know.
> > > > 
> > > > ------------------
> > > > 
> > > > From: Matt Fleming <mjf@gentoo.org>
> > > > 
> > > > commit 1de5b0854623d30d01d72cd4ea323eb5f39d1f16 upstream.
> > > > 
> > > > It is possible to flood the console with call traces if the WARN_ON
> > > > condition is true because of the frequency with which this function is
> > > > called.
> > > > 
> > > 
> > > If this commit is going into stable it would be worth adding these
> > > two commits (which are actually the bugfixes).
> > > 
> > > 5ceb1a04187553e08c6ab60d30cee7c454ee139a
> > > x86: HPET: enter hpet_interrupt_handler with interrupts disabled
> > > 
> > > 89d77a1eb60be916d85d9394bedbfa2037af89c5
> > > x86: HPET: read from HPET_Tn_CMP() not HPET_T0_CMP
> > 
> > I think the latter isn't applicable as 2.6.27 supports only T0.
> > 
> 
> Ah, thanks. I wasn't aware of that.

Ok, so which patch should go into the 2.6.27-stable tree?

thanks,

greg k-h

Re: [patch 00/83] 2.6.27.9-stable review

[François Valenduc]

Greg KH a écrit :
> On Sat, Dec 13, 2008 at 10:29:55AM +0100, François Valenduc wrote:
>   
>> Greg KH a écrit :
>>     
>>> This is the start of the stable review cycle for the 2.6.27.9 release.
>>> There are 83 patches in this series, all will be posted as a response to
>>> this one.  If anyone has any issues with these being applied, please let
>>> us know.  If anyone is a maintainer of the proper subsystem, and wants
>>> to add a Signed-off-by: line to the patch, please respond with it.
>>> These patches are sent out with a number of different people on the Cc:
>>> line.  If you wish to be a reviewer, please email stable@kernel.org to
>>> add your name to the list.  If you want to be off the reviewer list,
>>> also email us.
>>> Responses should be made by December 13, 2008, 20:00:00 UTC.
>>> Anything received after that time might be too late.
>>> The whole patch series can be found in one patch at:
>>> 	kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.9-rc1.gz
>>> and the diffstat can be found below.
>>> thanks,
>>> greg k-h
>>>       
>> Would it be possible to add these two patches ?
>>
>> commit 8258becf07e71236aac8cf5406a1345712f9ac25
>> Author: Johannes Berg <johannes@sipsolutions.net>
>> Date:   Tue Sep 23 19:18:43 2008 +0200
>>
>>     iwlagn: downgrade BUG_ON in interrupt
>>
>> commit 199d9de726ff2f949405279665a9c8b38966239b
>> Author: Johannes Berg <johannes@sipsolutions.net>
>> Date:   Tue Nov 18 01:47:21 2008 +0100
>>
>>     iwlagn: fix RX skb alignment
>>
>> Without these ones, my computer freezes very frequently (see bugs 11393, 
>> 11983 and 12173 which in fact is a duplicate of the previous one).
>> These two patches can be applied without any rejects on kernel 2.6.27.8.
>>     
>
> I don't see these patches in Linus's kernel tree.  Are they not there?
>
> Or if they are there, can you give me the correct git commit ids for
> them?
>
> thanks,
>
> greg k-h
>
>   

These commit ids are indeed not the one of linus's tree and they
correspond to my local tree for kernel 2.6.27. The correct ids should
be  4018517a1a69a85c3d61b20fa02f187b80773137 and 
55d6a3cd0cc85ed90c39cf32e16f622bd003117b.

François

Re: [patch 68/83] x86: HPET: convert WARN_ON to WARN_ON_ONCE

[Matt Fleming]

On Wed, Dec 17, 2008 at 10:42:36AM -0800, Greg KH wrote:
> 
> Ok, so which patch should go into the 2.6.27-stable tree?
> 

Sorry, I was confused about what HPET code was in 2.6.27-stable. The
current patch that you have queued (1de5b0854623d30d01d72cd4ea323eb5f39d1f16)
is the only one that should be in. So you can entirely ignore this
thread ;-)

Re: [patch 68/83] x86: HPET: convert WARN_ON to WARN_ON_ONCE

[Greg KH]

On Wed, Dec 17, 2008 at 07:51:27PM +0000, Matt Fleming wrote:
> On Wed, Dec 17, 2008 at 10:42:36AM -0800, Greg KH wrote:
> > 
> > Ok, so which patch should go into the 2.6.27-stable tree?
> > 
> 
> Sorry, I was confused about what HPET code was in 2.6.27-stable. The
> current patch that you have queued (1de5b0854623d30d01d72cd4ea323eb5f39d1f16)
> is the only one that should be in. So you can entirely ignore this
> thread ;-)

Great, will do, thanks for clearing it up.

greg k-h

Re: [patch 68/83] x86: HPET: convert WARN_ON to WARN_ON_ONCE

[Thomas Gleixner]

On Wed, 17 Dec 2008, Greg KH wrote:
> > Ah, thanks. I wasn't aware of that.
> 
> Ok, so which patch should go into the 2.6.27-stable tree?

Just the WARN_ON_ONCE() one: 1de5b0854623d30d01d72cd4ea323eb5f39d1f16

Thanks,

	tglx

Re: [patch 00/83] 2.6.27.9-stable review

[Greg KH]

On Wed, Dec 17, 2008 at 07:58:35PM +0100, François Valenduc wrote:
> Greg KH a écrit :
> > On Sat, Dec 13, 2008 at 10:29:55AM +0100, François Valenduc wrote:
> >   
> >> Greg KH a écrit :
> >>     
> >>> This is the start of the stable review cycle for the 2.6.27.9 release.
> >>> There are 83 patches in this series, all will be posted as a response to
> >>> this one.  If anyone has any issues with these being applied, please let
> >>> us know.  If anyone is a maintainer of the proper subsystem, and wants
> >>> to add a Signed-off-by: line to the patch, please respond with it.
> >>> These patches are sent out with a number of different people on the Cc:
> >>> line.  If you wish to be a reviewer, please email stable@kernel.org to
> >>> add your name to the list.  If you want to be off the reviewer list,
> >>> also email us.
> >>> Responses should be made by December 13, 2008, 20:00:00 UTC.
> >>> Anything received after that time might be too late.
> >>> The whole patch series can be found in one patch at:
> >>> 	kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.9-rc1.gz
> >>> and the diffstat can be found below.
> >>> thanks,
> >>> greg k-h
> >>>       
> >> Would it be possible to add these two patches ?
> >>
> >> commit 8258becf07e71236aac8cf5406a1345712f9ac25
> >> Author: Johannes Berg <johannes@sipsolutions.net>
> >> Date:   Tue Sep 23 19:18:43 2008 +0200
> >>
> >>     iwlagn: downgrade BUG_ON in interrupt
> >>
> >> commit 199d9de726ff2f949405279665a9c8b38966239b
> >> Author: Johannes Berg <johannes@sipsolutions.net>
> >> Date:   Tue Nov 18 01:47:21 2008 +0100
> >>
> >>     iwlagn: fix RX skb alignment
> >>
> >> Without these ones, my computer freezes very frequently (see bugs 11393, 
> >> 11983 and 12173 which in fact is a duplicate of the previous one).
> >> These two patches can be applied without any rejects on kernel 2.6.27.8.
> >>     
> >
> > I don't see these patches in Linus's kernel tree.  Are they not there?
> >
> > Or if they are there, can you give me the correct git commit ids for
> > them?
> >
> > thanks,
> >
> > greg k-h
> >
> >   
> 
> These commit ids are indeed not the one of linus's tree and they
> correspond to my local tree for kernel 2.6.27. The correct ids should
> be  4018517a1a69a85c3d61b20fa02f187b80773137 and 

That one is already in the 2.6.27.9 release

> 55d6a3cd0cc85ed90c39cf32e16f622bd003117b.

I have queued this one up now.

thanks,

greg k-h

Re: [patch 68/83] x86: HPET: convert WARN_ON to WARN_ON_ONCE

[Greg KH]

On Thu, Dec 18, 2008 at 12:37:50PM +0100, Thomas Gleixner wrote:
> On Wed, 17 Dec 2008, Greg KH wrote:
> > > Ah, thanks. I wasn't aware of that.
> > 
> > Ok, so which patch should go into the 2.6.27-stable tree?
> 
> Just the WARN_ON_ONCE() one: 1de5b0854623d30d01d72cd4ea323eb5f39d1f16

That is already in the 2.6.27.9 release.

thanks,

greg k-h