--- /dev/null
+From 048e78a5bc22c27410cb5ca9680c3c7ac400607f Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Thu, 2 Sep 2010 08:35:47 +0200
+Subject: ALSA: hda - Add a new hp-laptop model for Conexant 5066, tested on HP G60
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 048e78a5bc22c27410cb5ca9680c3c7ac400607f upstream.
+
+This new model adds the following functionality to HP G60:
+- Automute of internal speakers
+- Autoswitch of internal/external mics
+- Remove SPDIF not physically present
+
+BugLink: http://launchpad.net/bugs/587388
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/sound/alsa/HD-Audio-Models.txt | 1
+ sound/pci/hda/patch_conexant.c | 57 +++++++++++++++++++++++++++
+ 2 files changed, 58 insertions(+)
+
+--- a/Documentation/sound/alsa/HD-Audio-Models.txt
++++ b/Documentation/sound/alsa/HD-Audio-Models.txt
+@@ -288,6 +288,7 @@ Conexant 5051
+ Conexant 5066
+ =============
+ laptop Basic Laptop config (default)
++ hp-laptop HP laptops, e g G60
+ dell-laptop Dell laptops
+ olpc-xo-1_5 OLPC XO 1.5
+ ideapad Lenovo IdeaPad U150
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -116,6 +116,7 @@ struct conexant_spec {
+ unsigned int dell_vostro:1;
+ unsigned int ideapad:1;
+ unsigned int thinkpad:1;
++ unsigned int hp_laptop:1;
+
+ unsigned int ext_mic_present;
+ unsigned int recording;
+@@ -2219,6 +2220,18 @@ static void cxt5066_ideapad_automic(stru
+ }
+ }
+
++/* toggle input of built-in digital mic and mic jack appropriately */
++static void cxt5066_hp_laptop_automic(struct hda_codec *codec)
++{
++ unsigned int present;
++
++ present = snd_hda_jack_detect(codec, 0x1b);
++ snd_printdd("CXT5066: external microphone present=%d\n", present);
++ snd_hda_codec_write(codec, 0x17, 0, AC_VERB_SET_CONNECT_SEL,
++ present ? 1 : 3);
++}
++
++
+ /* toggle input of built-in digital mic and mic jack appropriately
+ order is: external mic -> dock mic -> interal mic */
+ static void cxt5066_thinkpad_automic(struct hda_codec *codec)
+@@ -2328,6 +2341,20 @@ static void cxt5066_ideapad_event(struct
+ }
+
+ /* unsolicited event for jack sensing */
++static void cxt5066_hp_laptop_event(struct hda_codec *codec, unsigned int res)
++{
++ snd_printdd("CXT5066_hp_laptop: unsol event %x (%x)\n", res, res >> 26);
++ switch (res >> 26) {
++ case CONEXANT_HP_EVENT:
++ cxt5066_hp_automute(codec);
++ break;
++ case CONEXANT_MIC_EVENT:
++ cxt5066_hp_laptop_automic(codec);
++ break;
++ }
++}
++
++/* unsolicited event for jack sensing */
+ static void cxt5066_thinkpad_event(struct hda_codec *codec, unsigned int res)
+ {
+ snd_printdd("CXT5066_thinkpad: unsol event %x (%x)\n", res, res >> 26);
+@@ -2910,6 +2937,14 @@ static struct hda_verb cxt5066_init_verb
+ { } /* end */
+ };
+
++
++static struct hda_verb cxt5066_init_verbs_hp_laptop[] = {
++ {0x14, AC_VERB_SET_CONNECT_SEL, 0x0},
++ {0x19, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | CONEXANT_HP_EVENT},
++ {0x1b, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | CONEXANT_MIC_EVENT},
++ { } /* end */
++};
++
+ /* initialize jack-sensing, too */
+ static int cxt5066_init(struct hda_codec *codec)
+ {
+@@ -2925,6 +2960,8 @@ static int cxt5066_init(struct hda_codec
+ cxt5066_ideapad_automic(codec);
+ else if (spec->thinkpad)
+ cxt5066_thinkpad_automic(codec);
++ else if (spec->hp_laptop)
++ cxt5066_hp_laptop_automic(codec);
+ }
+ cxt5066_set_mic_boost(codec);
+ return 0;
+@@ -2952,6 +2989,7 @@ enum {
+ CXT5066_DELL_VOSTO, /* Dell Vostro 1015i */
+ CXT5066_IDEAPAD, /* Lenovo IdeaPad U150 */
+ CXT5066_THINKPAD, /* Lenovo ThinkPad T410s, others? */
++ CXT5066_HP_LAPTOP, /* HP Laptop */
+ CXT5066_MODELS
+ };
+
+@@ -2962,6 +3000,7 @@ static const char *cxt5066_models[CXT506
+ [CXT5066_DELL_VOSTO] = "dell-vostro",
+ [CXT5066_IDEAPAD] = "ideapad",
+ [CXT5066_THINKPAD] = "thinkpad",
++ [CXT5066_HP_LAPTOP] = "hp-laptop",
+ };
+
+ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
+@@ -2973,6 +3012,7 @@ static struct snd_pci_quirk cxt5066_cfg_
+ SND_PCI_QUIRK(0x1028, 0x02d8, "Dell Vostro", CXT5066_DELL_VOSTO),
+ SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTO),
+ SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
++ SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
+ SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
+ SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
+ SND_PCI_QUIRK(0x17aa, 0x21b2, "Thinkpad X100e", CXT5066_IDEAPAD),
+@@ -3032,6 +3072,23 @@ static int patch_cxt5066(struct hda_code
+ spec->num_init_verbs++;
+ spec->dell_automute = 1;
+ break;
++ case CXT5066_HP_LAPTOP:
++ codec->patch_ops.init = cxt5066_init;
++ codec->patch_ops.unsol_event = cxt5066_hp_laptop_event;
++ spec->init_verbs[spec->num_init_verbs] =
++ cxt5066_init_verbs_hp_laptop;
++ spec->num_init_verbs++;
++ spec->hp_laptop = 1;
++ spec->mixers[spec->num_mixers++] = cxt5066_mixer_master;
++ spec->mixers[spec->num_mixers++] = cxt5066_mixers;
++ /* no S/PDIF out */
++ spec->multiout.dig_out_nid = 0;
++ /* input source automatically selected */
++ spec->input_mux = NULL;
++ spec->port_d_mode = 0;
++ spec->mic_boost = 3; /* default 30dB gain */
++ break;
++
+ case CXT5066_OLPC_XO_1_5:
+ codec->patch_ops.init = cxt5066_olpc_init;
+ codec->patch_ops.unsol_event = cxt5066_olpc_unsol_event;
--- /dev/null
+From a769cbcf60cee51f4431c0938acd39e7e5b76b8d Mon Sep 17 00:00:00 2001
+From: Brian Austin <brian.austin@cirrus.com>
+Date: Tue, 7 Sep 2010 14:36:22 -0500
+Subject: ALSA: hda - Add errata initverb sequence for CS42xx codecs
+
+From: Brian Austin <brian.austin@cirrus.com>
+
+commit a769cbcf60cee51f4431c0938acd39e7e5b76b8d upstream.
+
+Add init verb sequence for errata ER880C3
+http://www.cirrus.com/en/pubs/errata/ER880C3.pdf
+
+Signed-off-by: Brian Austin <brian.austin@cirrus.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_cirrus.c | 50 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -972,6 +972,53 @@ static struct hda_verb cs_coef_init_verb
+ {} /* terminator */
+ };
+
++/* Errata: CS4207 rev C0/C1/C2 Silicon
++ *
++ * http://www.cirrus.com/en/pubs/errata/ER880C3.pdf
++ *
++ * 6. At high temperature (TA > +85°C), the digital supply current (IVD)
++ * may be excessive (up to an additional 200 μA), which is most easily
++ * observed while the part is being held in reset (RESET# active low).
++ *
++ * Root Cause: At initial powerup of the device, the logic that drives
++ * the clock and write enable to the S/PDIF SRC RAMs is not properly
++ * initialized.
++ * Certain random patterns will cause a steady leakage current in those
++ * RAM cells. The issue will resolve once the SRCs are used (turned on).
++ *
++ * Workaround: The following verb sequence briefly turns on the S/PDIF SRC
++ * blocks, which will alleviate the issue.
++ */
++
++static struct hda_verb cs_errata_init_verbs[] = {
++ {0x01, AC_VERB_SET_POWER_STATE, 0x00}, /* AFG: D0 */
++ {0x11, AC_VERB_SET_PROC_STATE, 0x01}, /* VPW: processing on */
++
++ {0x11, AC_VERB_SET_COEF_INDEX, 0x0008},
++ {0x11, AC_VERB_SET_PROC_COEF, 0x9999},
++ {0x11, AC_VERB_SET_COEF_INDEX, 0x0017},
++ {0x11, AC_VERB_SET_PROC_COEF, 0xa412},
++ {0x11, AC_VERB_SET_COEF_INDEX, 0x0001},
++ {0x11, AC_VERB_SET_PROC_COEF, 0x0009},
++
++ {0x07, AC_VERB_SET_POWER_STATE, 0x00}, /* S/PDIF Rx: D0 */
++ {0x08, AC_VERB_SET_POWER_STATE, 0x00}, /* S/PDIF Tx: D0 */
++
++ {0x11, AC_VERB_SET_COEF_INDEX, 0x0017},
++ {0x11, AC_VERB_SET_PROC_COEF, 0x2412},
++ {0x11, AC_VERB_SET_COEF_INDEX, 0x0008},
++ {0x11, AC_VERB_SET_PROC_COEF, 0x0000},
++ {0x11, AC_VERB_SET_COEF_INDEX, 0x0001},
++ {0x11, AC_VERB_SET_PROC_COEF, 0x0008},
++ {0x11, AC_VERB_SET_PROC_STATE, 0x00},
++
++ {0x07, AC_VERB_SET_POWER_STATE, 0x03}, /* S/PDIF Rx: D3 */
++ {0x08, AC_VERB_SET_POWER_STATE, 0x03}, /* S/PDIF Tx: D3 */
++ /*{0x01, AC_VERB_SET_POWER_STATE, 0x03},*/ /* AFG: D3 This is already handled */
++
++ {} /* terminator */
++};
++
+ /* SPDIF setup */
+ static void init_digital(struct hda_codec *codec)
+ {
+@@ -991,6 +1038,9 @@ static int cs_init(struct hda_codec *cod
+ {
+ struct cs_spec *spec = codec->spec;
+
++ /* init_verb sequence for C0/C1/C2 errata*/
++ snd_hda_sequence_write(codec, cs_errata_init_verbs);
++
+ snd_hda_sequence_write(codec, cs_coef_init_verbs);
+
+ if (spec->gpio_mask) {
--- /dev/null
+From 4d155641c81203440da64c4633b4efaab75f63b3 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 7 Sep 2010 11:58:30 +0200
+Subject: ALSA: hda - Add quirk for Lenovo T400s
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4d155641c81203440da64c4633b4efaab75f63b3 upstream.
+
+Lenovo T400s requires the quirk to make automatic HP/mic switching working.
+
+Reported-by: Frank Becker <fb@alien8.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3015,6 +3015,7 @@ static struct snd_pci_quirk cxt5066_cfg_
+ SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
+ SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
+ SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
++ SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400s", CXT5066_THINKPAD),
+ SND_PCI_QUIRK(0x17aa, 0x21b2, "Thinkpad X100e", CXT5066_IDEAPAD),
+ SND_PCI_QUIRK(0x17aa, 0x21b3, "Thinkpad Edge 13 (197)", CXT5066_IDEAPAD),
+ SND_PCI_QUIRK(0x17aa, 0x21b4, "Thinkpad Edge", CXT5066_IDEAPAD),
--- /dev/null
+From 122661b67899980f1372812d907e73ebcfb3d037 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 8 Sep 2010 14:57:04 +0200
+Subject: ALSA: hda - Fix wrong HP pin detection in snd_hda_parse_pin_def_config()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 122661b67899980f1372812d907e73ebcfb3d037 upstream.
+
+snd_hda_parse_pin_def_config() has some workaround for re-assigning
+some pins declared as headphones to line-outs. This didn't work properly
+for some cases because it used memmove() stupidly wrongly.
+
+Reference: Novell bnc#637263
+ https://bugzilla.novell.com/show_bug.cgi?id=637263
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_codec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -4360,7 +4360,7 @@ int snd_hda_parse_pin_def_config(struct
+ cfg->hp_outs--;
+ memmove(cfg->hp_pins + i, cfg->hp_pins + i + 1,
+ sizeof(cfg->hp_pins[0]) * (cfg->hp_outs - i));
+- memmove(sequences_hp + i - 1, sequences_hp + i,
++ memmove(sequences_hp + i, sequences_hp + i + 1,
+ sizeof(sequences_hp[0]) * (cfg->hp_outs - i));
+ }
+ }
--- /dev/null
+From 9cf2657d05f9f9e04c3e113d68bf7cef5a942070 Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Mon, 9 Aug 2010 22:41:40 -0600
+Subject: ALSA: hda - patch_nvhdmi.c: Add missing codec IDs, unify names
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit 9cf2657d05f9f9e04c3e113d68bf7cef5a942070 upstream.
+
+* Add missing codec IDs.
+* Modify some existing codec names for discrete GPUs to match newly
+ added IDs. Note: existing names were a mixture of marketing and
+ engineering GPU names. Equally, there's no reason that codec IDs
+ have to be specific to a particular GPU or board, so identify
+ codecs in a less marketing-oriented fashion.
+* Reformat codec ID table so it's easier to read, for me at least.
+
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_nvhdmi.c | 61 ++++++++++++++++++++++++++++---------------
+ 1 file changed, 41 insertions(+), 20 deletions(-)
+
+--- a/sound/pci/hda/patch_nvhdmi.c
++++ b/sound/pci/hda/patch_nvhdmi.c
+@@ -541,26 +541,32 @@ static int patch_nvhdmi_2ch(struct hda_c
+ * patch entries
+ */
+ static struct hda_codec_preset snd_hda_preset_nvhdmi[] = {
+- { .id = 0x10de0002, .name = "MCP77/78 HDMI",
+- .patch = patch_nvhdmi_8ch_7x },
+- { .id = 0x10de0003, .name = "MCP77/78 HDMI",
+- .patch = patch_nvhdmi_8ch_7x },
+- { .id = 0x10de0005, .name = "MCP77/78 HDMI",
+- .patch = patch_nvhdmi_8ch_7x },
+- { .id = 0x10de0006, .name = "MCP77/78 HDMI",
+- .patch = patch_nvhdmi_8ch_7x },
+- { .id = 0x10de0007, .name = "MCP79/7A HDMI",
+- .patch = patch_nvhdmi_8ch_7x },
+- { .id = 0x10de000a, .name = "GT220 HDMI",
+- .patch = patch_nvhdmi_8ch_89 },
+- { .id = 0x10de000b, .name = "GT21x HDMI",
+- .patch = patch_nvhdmi_8ch_89 },
+- { .id = 0x10de000c, .name = "MCP89 HDMI",
+- .patch = patch_nvhdmi_8ch_89 },
+- { .id = 0x10de000d, .name = "GT240 HDMI",
+- .patch = patch_nvhdmi_8ch_89 },
+- { .id = 0x10de0067, .name = "MCP67 HDMI", .patch = patch_nvhdmi_2ch },
+- { .id = 0x10de8001, .name = "MCP73 HDMI", .patch = patch_nvhdmi_2ch },
++ { .id = 0x10de0002, .name = "MCP77/78 HDMI", .patch = patch_nvhdmi_8ch_7x },
++ { .id = 0x10de0003, .name = "MCP77/78 HDMI", .patch = patch_nvhdmi_8ch_7x },
++ { .id = 0x10de0005, .name = "MCP77/78 HDMI", .patch = patch_nvhdmi_8ch_7x },
++ { .id = 0x10de0006, .name = "MCP77/78 HDMI", .patch = patch_nvhdmi_8ch_7x },
++ { .id = 0x10de0007, .name = "MCP79/7A HDMI", .patch = patch_nvhdmi_8ch_7x },
++ { .id = 0x10de000a, .name = "GPU 0a HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de000b, .name = "GPU 0b HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de000c, .name = "MCP89 HDMI", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de000d, .name = "GPU 0d HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0010, .name = "GPU 10 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0011, .name = "GPU 11 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0012, .name = "GPU 12 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0013, .name = "GPU 13 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0014, .name = "GPU 14 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0018, .name = "GPU 18 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0019, .name = "GPU 19 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de001a, .name = "GPU 1a HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de001b, .name = "GPU 1b HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de001c, .name = "GPU 1c HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0040, .name = "GPU 40 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0041, .name = "GPU 41 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0042, .name = "GPU 42 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0043, .name = "GPU 43 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0044, .name = "GPU 44 HDMI/DP", .patch = patch_nvhdmi_8ch_89 },
++ { .id = 0x10de0067, .name = "MCP67 HDMI", .patch = patch_nvhdmi_2ch },
++ { .id = 0x10de8001, .name = "MCP73 HDMI", .patch = patch_nvhdmi_2ch },
+ {} /* terminator */
+ };
+
+@@ -573,6 +579,21 @@ MODULE_ALIAS("snd-hda-codec-id:10de000a"
+ MODULE_ALIAS("snd-hda-codec-id:10de000b");
+ MODULE_ALIAS("snd-hda-codec-id:10de000c");
+ MODULE_ALIAS("snd-hda-codec-id:10de000d");
++MODULE_ALIAS("snd-hda-codec-id:10de0010");
++MODULE_ALIAS("snd-hda-codec-id:10de0011");
++MODULE_ALIAS("snd-hda-codec-id:10de0012");
++MODULE_ALIAS("snd-hda-codec-id:10de0013");
++MODULE_ALIAS("snd-hda-codec-id:10de0014");
++MODULE_ALIAS("snd-hda-codec-id:10de0018");
++MODULE_ALIAS("snd-hda-codec-id:10de0019");
++MODULE_ALIAS("snd-hda-codec-id:10de001a");
++MODULE_ALIAS("snd-hda-codec-id:10de001b");
++MODULE_ALIAS("snd-hda-codec-id:10de001c");
++MODULE_ALIAS("snd-hda-codec-id:10de0040");
++MODULE_ALIAS("snd-hda-codec-id:10de0041");
++MODULE_ALIAS("snd-hda-codec-id:10de0042");
++MODULE_ALIAS("snd-hda-codec-id:10de0043");
++MODULE_ALIAS("snd-hda-codec-id:10de0044");
+ MODULE_ALIAS("snd-hda-codec-id:10de0067");
+ MODULE_ALIAS("snd-hda-codec-id:10de8001");
+
--- /dev/null
+From 27f7ad53829f79e799a253285318bff79ece15bd Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 6 Sep 2010 09:13:45 +0200
+Subject: ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 27f7ad53829f79e799a253285318bff79ece15bd upstream.
+
+The error handling in snd_seq_oss_open() has several bad codes that
+do dereferecing released pointers and double-free of kmalloc'ed data.
+The object dp is release in free_devinfo() that is called via
+private_free callback. The rest shouldn't touch this object any more.
+
+The patch changes delete_port() to call kfree() in any case, and gets
+rid of unnecessary calls of destructors in snd_seq_oss_open().
+
+Fixes CVE-2010-3080.
+
+Reported-and-tested-by: Tavis Ormandy <taviso@cmpxchg8b.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/seq/oss/seq_oss_init.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/sound/core/seq/oss/seq_oss_init.c
++++ b/sound/core/seq/oss/seq_oss_init.c
+@@ -281,13 +281,10 @@ snd_seq_oss_open(struct file *file, int
+ return 0;
+
+ _error:
+- snd_seq_oss_writeq_delete(dp->writeq);
+- snd_seq_oss_readq_delete(dp->readq);
+ snd_seq_oss_synth_cleanup(dp);
+ snd_seq_oss_midi_cleanup(dp);
+- delete_port(dp);
+ delete_seq_queue(dp->queue);
+- kfree(dp);
++ delete_port(dp);
+
+ return rc;
+ }
+@@ -350,8 +347,10 @@ create_port(struct seq_oss_devinfo *dp)
+ static int
+ delete_port(struct seq_oss_devinfo *dp)
+ {
+- if (dp->port < 0)
++ if (dp->port < 0) {
++ kfree(dp);
+ return 0;
++ }
+
+ debug_printk(("delete_port %i\n", dp->port));
+ return snd_seq_event_port_detach(dp->cseq, dp->port);
--- /dev/null
+From 7b6717e144de6592e614fd7fc3b914b6bf686a9d Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@caiaq.de>
+Date: Thu, 2 Sep 2010 17:13:15 +0800
+Subject: ALSA: usb-audio: Assume first control interface is for audio
+
+From: Daniel Mack <daniel@caiaq.de>
+
+commit 7b6717e144de6592e614fd7fc3b914b6bf686a9d upstream.
+
+For devices with more than one control interface, let's assume the first
+one contains the audio controls. Unfortunately, there is no field in any
+of the descriptors to tell us whether a control interface is for audio
+or MIDI controls, so a better check is not easy to implement.
+
+On a composite device with audio and MIDI functions, for example, the
+code currently overwrites chip->ctrl_intf, causing operations on the
+control interface to fail if they are issued after the device probe.
+
+Signed-off-by: Daniel Mack <daniel@caiaq.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/card.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -466,7 +466,13 @@ static void *snd_usb_audio_probe(struct
+ goto __error;
+ }
+
+- chip->ctrl_intf = alts;
++ /*
++ * For devices with more than one control interface, we assume the
++ * first contains the audio controls. We might need a more specific
++ * check here in the future.
++ */
++ if (!chip->ctrl_intf)
++ chip->ctrl_intf = alts;
+
+ if (err > 0) {
+ /* create normal USB audio interfaces */
--- /dev/null
+From a2acad8298a42b7be684a32fafaf83332bba9c2b Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Fri, 3 Sep 2010 10:53:11 +0200
+Subject: ALSA: usb-audio: fix detection of vendor-specific device protocol settings
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit a2acad8298a42b7be684a32fafaf83332bba9c2b upstream.
+
+The Audio Class v2 support code in 2.6.35 added checks for the
+bInterfaceProtocol field. However, there are devices (usually those
+detected by vendor-specific quirks) that do not have one of the
+predefined values in this field, which made the driver reject them.
+
+To fix this regression, restore the old behaviour, i.e., assume that
+a device with an unknown bInterfaceProtocol field (other than
+UAC_VERSION_2) has more or less UAC-v1-compatible descriptors.
+
+[compile warning fixes by tiwai]
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Cc: Daniel Mack <daniel@caiaq.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/card.c | 9 +++++----
+ sound/usb/clock.c | 3 +--
+ sound/usb/endpoint.c | 11 ++++++-----
+ sound/usb/format.c | 14 ++++++++++----
+ sound/usb/mixer.c | 10 +++++++++-
+ sound/usb/pcm.c | 3 +--
+ 6 files changed, 32 insertions(+), 18 deletions(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -216,6 +216,11 @@ static int snd_usb_create_streams(struct
+ }
+
+ switch (protocol) {
++ default:
++ snd_printdd(KERN_WARNING "unknown interface protocol %#02x, assuming v1\n",
++ protocol);
++ /* fall through */
++
+ case UAC_VERSION_1: {
+ struct uac_ac_header_descriptor_v1 *h1 = control_header;
+
+@@ -253,10 +258,6 @@ static int snd_usb_create_streams(struct
+
+ break;
+ }
+-
+- default:
+- snd_printk(KERN_ERR "unknown protocol version 0x%02x\n", protocol);
+- return -EINVAL;
+ }
+
+ return 0;
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -304,12 +304,11 @@ int snd_usb_init_sample_rate(struct snd_
+
+ switch (altsd->bInterfaceProtocol) {
+ case UAC_VERSION_1:
++ default:
+ return set_sample_rate_v1(chip, iface, alts, fmt, rate);
+
+ case UAC_VERSION_2:
+ return set_sample_rate_v2(chip, iface, alts, fmt, rate);
+ }
+-
+- return -EINVAL;
+ }
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -274,6 +274,12 @@ int snd_usb_parse_audio_endpoints(struct
+
+ /* get audio formats */
+ switch (protocol) {
++ default:
++ snd_printdd(KERN_WARNING "%d:%u:%d: unknown interface protocol %#02x, assuming v1\n",
++ dev->devnum, iface_no, altno, protocol);
++ protocol = UAC_VERSION_1;
++ /* fall through */
++
+ case UAC_VERSION_1: {
+ struct uac_as_header_descriptor_v1 *as =
+ snd_usb_find_csint_desc(alts->extra, alts->extralen, NULL, UAC_AS_GENERAL);
+@@ -335,11 +341,6 @@ int snd_usb_parse_audio_endpoints(struct
+ dev->devnum, iface_no, altno, as->bTerminalLink);
+ continue;
+ }
+-
+- default:
+- snd_printk(KERN_ERR "%d:%u:%d : unknown interface protocol %04x\n",
+- dev->devnum, iface_no, altno, protocol);
+- continue;
+ }
+
+ /* get format type */
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -49,7 +49,8 @@ static u64 parse_audio_format_i_type(str
+ u64 pcm_formats;
+
+ switch (protocol) {
+- case UAC_VERSION_1: {
++ case UAC_VERSION_1:
++ default: {
+ struct uac_format_type_i_discrete_descriptor *fmt = _fmt;
+ sample_width = fmt->bBitResolution;
+ sample_bytes = fmt->bSubframeSize;
+@@ -64,9 +65,6 @@ static u64 parse_audio_format_i_type(str
+ format <<= 1;
+ break;
+ }
+-
+- default:
+- return -EINVAL;
+ }
+
+ pcm_formats = 0;
+@@ -385,6 +383,10 @@ static int parse_audio_format_i(struct s
+ * audio class v2 uses class specific EP0 range requests for that.
+ */
+ switch (protocol) {
++ default:
++ snd_printdd(KERN_WARNING "%d:%u:%d : invalid protocol version %d, assuming v1\n",
++ chip->dev->devnum, fp->iface, fp->altsetting, protocol);
++ /* fall through */
+ case UAC_VERSION_1:
+ fp->channels = fmt->bNrChannels;
+ ret = parse_audio_format_rates_v1(chip, fp, (unsigned char *) fmt, 7);
+@@ -435,6 +437,10 @@ static int parse_audio_format_ii(struct
+ fp->channels = 1;
+
+ switch (protocol) {
++ default:
++ snd_printdd(KERN_WARNING "%d:%u:%d : invalid protocol version %d, assuming v1\n",
++ chip->dev->devnum, fp->iface, fp->altsetting, protocol);
++ /* fall through */
+ case UAC_VERSION_1: {
+ struct uac_format_type_ii_discrete_descriptor *fmt = _fmt;
+ brate = le16_to_cpu(fmt->wMaxBitRate);
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2168,7 +2168,15 @@ int snd_usb_create_mixer(struct snd_usb_
+ }
+
+ host_iface = &usb_ifnum_to_if(chip->dev, ctrlif)->altsetting[0];
+- mixer->protocol = get_iface_desc(host_iface)->bInterfaceProtocol;
++ switch (get_iface_desc(host_iface)->bInterfaceProtocol) {
++ case UAC_VERSION_1:
++ default:
++ mixer->protocol = UAC_VERSION_1;
++ break;
++ case UAC_VERSION_2:
++ mixer->protocol = UAC_VERSION_2;
++ break;
++ }
+
+ if ((err = snd_usb_mixer_controls(mixer)) < 0 ||
+ (err = snd_usb_mixer_status_create(mixer)) < 0)
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -173,13 +173,12 @@ int snd_usb_init_pitch(struct snd_usb_au
+
+ switch (altsd->bInterfaceProtocol) {
+ case UAC_VERSION_1:
++ default:
+ return init_pitch_v1(chip, iface, alts, fmt);
+
+ case UAC_VERSION_2:
+ return init_pitch_v2(chip, iface, alts, fmt);
+ }
+-
+- return -EINVAL;
+ }
+
+ /*
--- /dev/null
+From 76195fb096ca6db2f8bbaffb96e3025aaf1649a0 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 8 Sep 2010 08:27:02 +0200
+Subject: ALSA: usb - Release capture substream URBs properly
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 76195fb096ca6db2f8bbaffb96e3025aaf1649a0 upstream.
+
+Due to the wrong "return" in the loop, a capture substream won't be
+released at disconnection properly if the device is capture only and has
+no playback substream. This caused Oops occasionally at the device
+reconnection.
+
+Reported-by: Kim Minhyoung <minhyoung.kim@lge.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -126,7 +126,7 @@ static void snd_usb_stream_disconnect(st
+ for (idx = 0; idx < 2; idx++) {
+ subs = &as->substream[idx];
+ if (!subs->num_formats)
+- return;
++ continue;
+ snd_usb_release_substream_urbs(subs, 1);
+ subs->interface = -1;
+ }
--- /dev/null
+From fe6ce80ae25953d95ebaf9bce27b585218cda25c Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Tue, 7 Sep 2010 13:38:49 +0200
+Subject: ALSA: virtuoso: fix setting of Xonar DS line-in/mic-in controls
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit fe6ce80ae25953d95ebaf9bce27b585218cda25c upstream.
+
+The Line and Mic inputs cannot be used at the same time, so the driver
+has to automatically disable one of them if both are set. However, it
+forgot to notify userspace about this change, so the mixer state would
+be inconsistent. To fix this, check if the other control gets muted,
+and send a notification event in this case.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Reported-and-tested-by: Nathan Schagen
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/xonar_wm87x6.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/oxygen/xonar_wm87x6.c
++++ b/sound/pci/oxygen/xonar_wm87x6.c
+@@ -53,6 +53,8 @@ struct xonar_wm87x6 {
+ struct xonar_generic generic;
+ u16 wm8776_regs[0x17];
+ u16 wm8766_regs[0x10];
++ struct snd_kcontrol *line_adcmux_control;
++ struct snd_kcontrol *mic_adcmux_control;
+ struct snd_kcontrol *lc_controls[13];
+ };
+
+@@ -604,6 +606,7 @@ static int wm8776_input_mux_put(struct s
+ {
+ struct oxygen *chip = ctl->private_data;
+ struct xonar_wm87x6 *data = chip->model_data;
++ struct snd_kcontrol *other_ctl;
+ unsigned int mux_bit = ctl->private_value;
+ u16 reg;
+ int changed;
+@@ -611,8 +614,18 @@ static int wm8776_input_mux_put(struct s
+ mutex_lock(&chip->mutex);
+ reg = data->wm8776_regs[WM8776_ADCMUX];
+ if (value->value.integer.value[0]) {
+- reg &= ~0x003;
+ reg |= mux_bit;
++ /* line-in and mic-in are exclusive */
++ mux_bit ^= 3;
++ if (reg & mux_bit) {
++ reg &= ~mux_bit;
++ if (mux_bit == 1)
++ other_ctl = data->line_adcmux_control;
++ else
++ other_ctl = data->mic_adcmux_control;
++ snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
++ &other_ctl->id);
++ }
+ } else
+ reg &= ~mux_bit;
+ changed = reg != data->wm8776_regs[WM8776_ADCMUX];
+@@ -964,7 +977,13 @@ static int xonar_ds_mixer_init(struct ox
+ err = snd_ctl_add(chip->card, ctl);
+ if (err < 0)
+ return err;
++ if (!strcmp(ctl->id.name, "Line Capture Switch"))
++ data->line_adcmux_control = ctl;
++ else if (!strcmp(ctl->id.name, "Mic Capture Switch"))
++ data->mic_adcmux_control = ctl;
+ }
++ if (!data->line_adcmux_control || !data->mic_adcmux_control)
++ return -ENXIO;
+ BUILD_BUG_ON(ARRAY_SIZE(lc_controls) != ARRAY_SIZE(data->lc_controls));
+ for (i = 0; i < ARRAY_SIZE(lc_controls); ++i) {
+ ctl = snd_ctl_new1(&lc_controls[i], chip);
--- /dev/null
+From 4c25b93223340deff73381cc47f9244fb379a74d Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Tue, 7 Sep 2010 13:37:10 +0200
+Subject: ALSA: virtuoso: work around missing reset in the Xonar DS Windows driver
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 4c25b93223340deff73381cc47f9244fb379a74d upstream.
+
+For the WM8776 chip, this driver uses a different sample format and
+more features than the Windows driver. When rebooting from Linux into
+Windows, the latter driver does not reset the chip but assumes all its
+registers have their default settings, so we get garbled sound or, if
+the output happened to be muted before rebooting, no sound.
+
+To make that driver happy, hook our driver's cleanup function into the
+shutdown notifier and ensure that the chip gets reset.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Reported-and-tested-by: Nathan Schagen
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/oxygen.h | 1 +
+ sound/pci/oxygen/oxygen_lib.c | 21 ++++++++++++++++++---
+ sound/pci/oxygen/virtuoso.c | 1 +
+ sound/pci/oxygen/xonar_wm87x6.c | 1 +
+ 4 files changed, 21 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/oxygen/oxygen.h
++++ b/sound/pci/oxygen/oxygen.h
+@@ -155,6 +155,7 @@ void oxygen_pci_remove(struct pci_dev *p
+ int oxygen_pci_suspend(struct pci_dev *pci, pm_message_t state);
+ int oxygen_pci_resume(struct pci_dev *pci);
+ #endif
++void oxygen_pci_shutdown(struct pci_dev *pci);
+
+ /* oxygen_mixer.c */
+
+--- a/sound/pci/oxygen/oxygen_lib.c
++++ b/sound/pci/oxygen/oxygen_lib.c
+@@ -519,16 +519,21 @@ static void oxygen_init(struct oxygen *c
+ }
+ }
+
+-static void oxygen_card_free(struct snd_card *card)
++static void oxygen_shutdown(struct oxygen *chip)
+ {
+- struct oxygen *chip = card->private_data;
+-
+ spin_lock_irq(&chip->reg_lock);
+ chip->interrupt_mask = 0;
+ chip->pcm_running = 0;
+ oxygen_write16(chip, OXYGEN_DMA_STATUS, 0);
+ oxygen_write16(chip, OXYGEN_INTERRUPT_MASK, 0);
+ spin_unlock_irq(&chip->reg_lock);
++}
++
++static void oxygen_card_free(struct snd_card *card)
++{
++ struct oxygen *chip = card->private_data;
++
++ oxygen_shutdown(chip);
+ if (chip->irq >= 0)
+ free_irq(chip->irq, chip);
+ flush_scheduled_work();
+@@ -778,3 +783,13 @@ int oxygen_pci_resume(struct pci_dev *pc
+ }
+ EXPORT_SYMBOL(oxygen_pci_resume);
+ #endif /* CONFIG_PM */
++
++void oxygen_pci_shutdown(struct pci_dev *pci)
++{
++ struct snd_card *card = pci_get_drvdata(pci);
++ struct oxygen *chip = card->private_data;
++
++ oxygen_shutdown(chip);
++ chip->model.cleanup(chip);
++}
++EXPORT_SYMBOL(oxygen_pci_shutdown);
+--- a/sound/pci/oxygen/virtuoso.c
++++ b/sound/pci/oxygen/virtuoso.c
+@@ -95,6 +95,7 @@ static struct pci_driver xonar_driver =
+ .suspend = oxygen_pci_suspend,
+ .resume = oxygen_pci_resume,
+ #endif
++ .shutdown = oxygen_pci_shutdown,
+ };
+
+ static int __init alsa_card_xonar_init(void)
+--- a/sound/pci/oxygen/xonar_wm87x6.c
++++ b/sound/pci/oxygen/xonar_wm87x6.c
+@@ -193,6 +193,7 @@ static void xonar_ds_init(struct oxygen
+ static void xonar_ds_cleanup(struct oxygen *chip)
+ {
+ xonar_disable_output(chip);
++ wm8776_write(chip, WM8776_RESET, 0);
+ }
+
+ static void xonar_ds_suspend(struct oxygen *chip)
--- /dev/null
+From e950598d43dce8d97e7d5270808393425d1e5cbd Mon Sep 17 00:00:00 2001
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Date: Tue, 31 Aug 2010 09:38:51 -0400
+Subject: ima: always maintain counters
+
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+
+commit e950598d43dce8d97e7d5270808393425d1e5cbd upstream.
+
+commit 8262bb85da allocated the inode integrity struct (iint) before any
+inodes were created. Only after IMA was initialized in late_initcall were
+the counters updated. This patch updates the counters, whether or not IMA
+has been initialized, to resolve 'imbalance' messages.
+
+This patch fixes the bug as reported in bugzilla: 15673. When the i915
+is builtin, the ring_buffer is initialized before IMA, causing the
+imbalance message on suspend.
+
+Reported-by: Thomas Meyer <thomas@m3y3r.de>
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Tested-by: Thomas Meyer <thomas@m3y3r.de>
+Tested-by: David Safford<safford@watson.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/integrity/ima/ima.h | 1 +
+ security/integrity/ima/ima_iint.c | 4 +++-
+ security/integrity/ima/ima_main.c | 8 +++++---
+ 3 files changed, 9 insertions(+), 4 deletions(-)
+
+--- a/security/integrity/ima/ima.h
++++ b/security/integrity/ima/ima.h
+@@ -35,6 +35,7 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 =
+ #define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
+
+ /* set during initialization */
++extern int iint_initialized;
+ extern int ima_initialized;
+ extern int ima_used_chip;
+ extern char *ima_hash;
+--- a/security/integrity/ima/ima_iint.c
++++ b/security/integrity/ima/ima_iint.c
+@@ -22,9 +22,10 @@
+
+ RADIX_TREE(ima_iint_store, GFP_ATOMIC);
+ DEFINE_SPINLOCK(ima_iint_lock);
+-
+ static struct kmem_cache *iint_cache __read_mostly;
+
++int iint_initialized = 0;
++
+ /* ima_iint_find_get - return the iint associated with an inode
+ *
+ * ima_iint_find_get gets a reference to the iint. Caller must
+@@ -141,6 +142,7 @@ static int __init ima_iintcache_init(voi
+ iint_cache =
+ kmem_cache_create("iint_cache", sizeof(struct ima_iint_cache), 0,
+ SLAB_PANIC, init_once);
++ iint_initialized = 1;
+ return 0;
+ }
+ security_initcall(ima_iintcache_init);
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -148,12 +148,14 @@ void ima_counts_get(struct file *file)
+ struct ima_iint_cache *iint;
+ int rc;
+
+- if (!ima_initialized || !S_ISREG(inode->i_mode))
++ if (!iint_initialized || !S_ISREG(inode->i_mode))
+ return;
+ iint = ima_iint_find_get(inode);
+ if (!iint)
+ return;
+ mutex_lock(&iint->mutex);
++ if (!ima_initialized)
++ goto out;
+ rc = ima_must_measure(iint, inode, MAY_READ, FILE_CHECK);
+ if (rc < 0)
+ goto out;
+@@ -213,7 +215,7 @@ void ima_file_free(struct file *file)
+ struct inode *inode = file->f_dentry->d_inode;
+ struct ima_iint_cache *iint;
+
+- if (!ima_initialized || !S_ISREG(inode->i_mode))
++ if (!iint_initialized || !S_ISREG(inode->i_mode))
+ return;
+ iint = ima_iint_find_get(inode);
+ if (!iint)
+@@ -230,7 +232,7 @@ static int process_measurement(struct fi
+ {
+ struct inode *inode = file->f_dentry->d_inode;
+ struct ima_iint_cache *iint;
+- int rc;
++ int rc = 0;
+
+ if (!ima_initialized || !S_ISREG(inode->i_mode))
+ return 0;
usb-ftdi_sio-added-custom-pids-for-chamsys-products.patch
usb-serial-mos7840-add-usb-id-to-support-the-b-b-electronics-usoptl4-2p.patch
usb-serial-mos7840-add-usb-ids-to-support-more-b-b-usb-rs485-converters.patch
+ima-always-maintain-counters.patch
+usb-cxacru-use-a-bulk-int-urb-to-access-the-command-endpoint.patch
+usb-cdc-acm-adding-second-acm-channel-support-for-various-nokia-and-one-samsung-phones.patch
+usb-cdc-acm-add-pseudo-modem-without-at-command-capabilities.patch
+usb-cdc-acm-fixing-crash-when-acm-probing-interfaces-with-no-endpoint-descriptors.patch
+alsa-hda-add-a-new-hp-laptop-model-for-conexant-5066-tested-on-hp-g60.patch
+alsa-usb-audio-fix-detection-of-vendor-specific-device-protocol-settings.patch
+alsa-virtuoso-work-around-missing-reset-in-the-xonar-ds-windows-driver.patch
+alsa-virtuoso-fix-setting-of-xonar-ds-line-in-mic-in-controls.patch
+alsa-seq-oss-fix-double-free-at-error-path-of-snd_seq_oss_open.patch
+alsa-usb-release-capture-substream-urbs-properly.patch
+alsa-hda-add-quirk-for-lenovo-t400s.patch
+alsa-hda-add-errata-initverb-sequence-for-cs42xx-codecs.patch
+alsa-hda-fix-wrong-hp-pin-detection-in-snd_hda_parse_pin_def_config.patch
+alsa-usb-audio-assume-first-control-interface-is-for-audio.patch
+alsa-hda-patch_nvhdmi.c-add-missing-codec-ids-unify-names.patch
--- /dev/null
+From 5b239f0aebd4dd6f85b13decf5e18e86e35d57f0 Mon Sep 17 00:00:00 2001
+From: Philippe Corbes <philippe.corbes@gmail.com>
+Date: Tue, 31 Aug 2010 19:31:32 +0200
+Subject: USB: cdc-acm: Add pseudo modem without AT command capabilities
+
+From: Philippe Corbes <philippe.corbes@gmail.com>
+
+commit 5b239f0aebd4dd6f85b13decf5e18e86e35d57f0 upstream.
+
+cdc-acm.c : Manage pseudo-modem without AT commands capabilities
+ Enable to drive electronic simple gadgets based on microcontrolers.
+ The Interface descriptor is like this:
+ bInterfaceClass 2 Communications
+ bInterfaceSubClass 2 Abstract (modem)
+ bInterfaceProtocol 0 None
+
+Signed-off-by: Philippe Corbes <philippe.corbes@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1621,6 +1621,10 @@ static const struct usb_device_id acm_id
+ .driver_info = NOT_A_MODEM,
+ },
+
++ /* control interfaces without any protocol set */
++ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
++ USB_CDC_PROTO_NONE) },
++
+ /* control interfaces with various AT-command sets */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
+ USB_CDC_ACM_PROTO_AT_V25TER) },
--- /dev/null
+From 4035e45632c2a8bb4edae83c20447051bd9a9604 Mon Sep 17 00:00:00 2001
+From: Toby Gray <toby.gray@realvnc.com>
+Date: Wed, 1 Sep 2010 16:01:19 +0100
+Subject: USB: cdc-acm: Adding second ACM channel support for various Nokia and one Samsung phones
+
+From: Toby Gray <toby.gray@realvnc.com>
+
+commit 4035e45632c2a8bb4edae83c20447051bd9a9604 upstream.
+
+S60 phones from Nokia and Samsung expose two ACM channels. The first is a modem
+with a standard AT-command interface, which is picked up correctly by CDC-ACM.
+
+The second ACM port is marked as having a vendor-specific protocol. This means
+that the ACM driver will not claim the second channel by default.
+
+This adds support for the second ACM channel for the following devices:
+ Nokia E63
+ Nokia E75
+ Nokia 6760 Slide
+ Nokia E52
+ Nokia E55
+ Nokia E72
+ Nokia X6
+ Nokia N97 Mini
+ Nokia 5800 Xpressmusic
+ Nokia E90
+ Samsung GTi8510 (INNOV8)
+
+Signed-off-by: Toby Gray <toby.gray@realvnc.com>
+Cc: Oliver Neukum <oliver@neukum.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1487,6 +1487,11 @@ static int acm_reset_resume(struct usb_i
+ USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, \
+ USB_CDC_ACM_PROTO_VENDOR)
+
++#define SAMSUNG_PCSUITE_ACM_INFO(x) \
++ USB_DEVICE_AND_INTERFACE_INFO(0x04e7, x, \
++ USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, \
++ USB_CDC_ACM_PROTO_VENDOR)
++
+ /*
+ * USB driver structure.
+ */
+@@ -1597,6 +1602,17 @@ static const struct usb_device_id acm_id
+ { NOKIA_PCSUITE_ACM_INFO(0x0108), }, /* Nokia 5320 XpressMusic 2G */
+ { NOKIA_PCSUITE_ACM_INFO(0x01f5), }, /* Nokia N97, RM-505 */
+ { NOKIA_PCSUITE_ACM_INFO(0x02e3), }, /* Nokia 5230, RM-588 */
++ { NOKIA_PCSUITE_ACM_INFO(0x0178), }, /* Nokia E63 */
++ { NOKIA_PCSUITE_ACM_INFO(0x010e), }, /* Nokia E75 */
++ { NOKIA_PCSUITE_ACM_INFO(0x02d9), }, /* Nokia 6760 Slide */
++ { NOKIA_PCSUITE_ACM_INFO(0x01d0), }, /* Nokia E52 */
++ { NOKIA_PCSUITE_ACM_INFO(0x0223), }, /* Nokia E72 */
++ { NOKIA_PCSUITE_ACM_INFO(0x0275), }, /* Nokia X6 */
++ { NOKIA_PCSUITE_ACM_INFO(0x026c), }, /* Nokia N97 Mini */
++ { NOKIA_PCSUITE_ACM_INFO(0x0154), }, /* Nokia 5800 XpressMusic */
++ { NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
++ { NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
++ { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
+
+ /* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
+
--- /dev/null
+From 577045c0a76e34294f902a7d5d60e90b04d094d0 Mon Sep 17 00:00:00 2001
+From: Toby Gray <toby.gray@realvnc.com>
+Date: Thu, 2 Sep 2010 10:46:20 +0100
+Subject: USB: cdc-acm: Fixing crash when ACM probing interfaces with no endpoint descriptors.
+
+From: Toby Gray <toby.gray@realvnc.com>
+
+commit 577045c0a76e34294f902a7d5d60e90b04d094d0 upstream.
+
+Certain USB devices, such as the Nokia X6 mobile phone, don't expose any
+endpoint descriptors on some of their interfaces. If the ACM driver is forced
+to probe all interfaces on a device the a NULL pointer dereference will occur
+when the ACM driver attempts to use the endpoint of the alternative settings.
+One way to get the ACM driver to probe all the interfaces is by using the
+/sys/bus/usb/drivers/cdc_acm/new_id interface.
+
+This patch checks that the endpoint pointer for the current alternate settings
+is non-NULL before using it.
+
+Signed-off-by: Toby Gray <toby.gray@realvnc.com>
+Cc: Oliver Neukum <oliver@neukum.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -971,7 +971,8 @@ static int acm_probe(struct usb_interfac
+ }
+
+ if (!buflen) {
+- if (intf->cur_altsetting->endpoint->extralen &&
++ if (intf->cur_altsetting->endpoint &&
++ intf->cur_altsetting->endpoint->extralen &&
+ intf->cur_altsetting->endpoint->extra) {
+ dev_dbg(&intf->dev,
+ "Seeking extra descriptors on endpoint\n");
--- /dev/null
+From 902ffc3c707c1d459ea57428a619a807cbe412f9 Mon Sep 17 00:00:00 2001
+From: Simon Arlott <simon@fire.lp0.eu>
+Date: Wed, 1 Sep 2010 18:37:12 +0100
+Subject: USB: cxacru: Use a bulk/int URB to access the command endpoint
+
+From: Simon Arlott <simon@fire.lp0.eu>
+
+commit 902ffc3c707c1d459ea57428a619a807cbe412f9 upstream.
+
+The command endpoint is either a bulk or interrupt endpoint, but using
+the wrong type of transfer causes an error if CONFIG_USB_DEBUG is
+enabled after commit f661c6f8c67bd55e93348f160d590ff9edf08904, which
+checks for this mismatch.
+
+Detect which type of endpoint it is and use a bulk/int URB as
+appropriate. There are other function calls specifying a bulk pipe,
+but usb_clear_halt doesn't use the pipe type (only the endpoint) and
+usb_bulk_msg auto-detects interrupt transfers.
+
+Signed-off-by: Simon Arlott <simon@fire.lp0.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/atm/cxacru.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/atm/cxacru.c
++++ b/drivers/usb/atm/cxacru.c
+@@ -1128,6 +1128,7 @@ static int cxacru_bind(struct usbatm_dat
+ {
+ struct cxacru_data *instance;
+ struct usb_device *usb_dev = interface_to_usbdev(intf);
++ struct usb_host_endpoint *cmd_ep = usb_dev->ep_in[CXACRU_EP_CMD];
+ int ret;
+
+ /* instance init */
+@@ -1172,15 +1173,34 @@ static int cxacru_bind(struct usbatm_dat
+ goto fail;
+ }
+
+- usb_fill_int_urb(instance->rcv_urb,
++ if (!cmd_ep) {
++ dbg("cxacru_bind: no command endpoint");
++ ret = -ENODEV;
++ goto fail;
++ }
++
++ if ((cmd_ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
++ == USB_ENDPOINT_XFER_INT) {
++ usb_fill_int_urb(instance->rcv_urb,
+ usb_dev, usb_rcvintpipe(usb_dev, CXACRU_EP_CMD),
+ instance->rcv_buf, PAGE_SIZE,
+ cxacru_blocking_completion, &instance->rcv_done, 1);
+
+- usb_fill_int_urb(instance->snd_urb,
++ usb_fill_int_urb(instance->snd_urb,
+ usb_dev, usb_sndintpipe(usb_dev, CXACRU_EP_CMD),
+ instance->snd_buf, PAGE_SIZE,
+ cxacru_blocking_completion, &instance->snd_done, 4);
++ } else {
++ usb_fill_bulk_urb(instance->rcv_urb,
++ usb_dev, usb_rcvbulkpipe(usb_dev, CXACRU_EP_CMD),
++ instance->rcv_buf, PAGE_SIZE,
++ cxacru_blocking_completion, &instance->rcv_done);
++
++ usb_fill_bulk_urb(instance->snd_urb,
++ usb_dev, usb_sndbulkpipe(usb_dev, CXACRU_EP_CMD),
++ instance->snd_buf, PAGE_SIZE,
++ cxacru_blocking_completion, &instance->snd_done);
++ }
+
+ mutex_init(&instance->cm_serialize);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
