--- /dev/null
+From c19483cc5e56ac5e22dd19cf25ba210ab1537773 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Fri, 22 Oct 2010 14:11:26 +0100
+Subject: bluetooth: Fix missing NULL check
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit c19483cc5e56ac5e22dd19cf25ba210ab1537773 upstream.
+
+Fortunately this is only exploitable on very unusual hardware.
+
+[Reported a while ago but nothing happened so just fixing it]
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/bluetooth/hci_ldisc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -258,9 +258,16 @@ static int hci_uart_tty_open(struct tty_
+
+ BT_DBG("tty %p", tty);
+
++ /* FIXME: This btw is bogus, nothing requires the old ldisc to clear
++ the pointer */
+ if (hu)
+ return -EEXIST;
+
++ /* Error if the tty has no write op instead of leaving an exploitable
++ hole */
++ if (tty->ops->write == NULL)
++ return -EOPNOTSUPP;
++
+ if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
+ BT_ERR("Can't allocate control structure");
+ return -ENFILE;
--- /dev/null
+From 0d91f22b75347d9503b17a42b6c74d3f7750acd6 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Fri, 15 Oct 2010 15:00:06 +0200
+Subject: drivers/net/wireless/p54/eeprom.c: Return -ENOMEM on memory allocation failure
+
+From: Julia Lawall <julia@diku.dk>
+
+commit 0d91f22b75347d9503b17a42b6c74d3f7750acd6 upstream.
+
+In this code, 0 is returned on memory allocation failure, even though other
+failures return -ENOMEM or other similar values.
+
+A simplified version of the semantic match that finds this problem is as
+follows: (http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression ret;
+expression x,e1,e2,e3;
+@@
+
+ret = 0
+... when != ret = e1
+*x = \(kmalloc\|kcalloc\|kzalloc\)(...)
+... when != ret = e2
+if (x == NULL) { ... when != ret = e3
+ return ret;
+}
+// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Acked-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/eeprom.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/p54/eeprom.c
++++ b/drivers/net/wireless/p54/eeprom.c
+@@ -261,8 +261,10 @@ static int p54_generate_channel_lists(st
+ list->max_entries = max_channel_num;
+ list->channels = kzalloc(sizeof(struct p54_channel_entry) *
+ max_channel_num, GFP_KERNEL);
+- if (!list->channels)
++ if (!list->channels) {
++ ret = -ENOMEM;
+ goto free;
++ }
+
+ for (i = 0; i < max_channel_num; i++) {
+ if (i < priv->iq_autocal_len) {
--- /dev/null
+From 7ada876a8703f23befbb20a7465a702ee39b1704 Mon Sep 17 00:00:00 2001
+From: Darren Hart <dvhart@linux.intel.com>
+Date: Sun, 17 Oct 2010 08:35:04 -0700
+Subject: futex: Fix errors in nested key ref-counting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Darren Hart <dvhart@linux.intel.com>
+
+commit 7ada876a8703f23befbb20a7465a702ee39b1704 upstream.
+
+futex_wait() is leaking key references due to futex_wait_setup()
+acquiring an additional reference via the queue_lock() routine. The
+nested key ref-counting has been masking bugs and complicating code
+analysis. queue_lock() is only called with a previously ref-counted
+key, so remove the additional ref-counting from the queue_(un)lock()
+functions.
+
+Also futex_wait_requeue_pi() drops one key reference too many in
+unqueue_me_pi(). Remove the key reference handling from
+unqueue_me_pi(). This was paired with a queue_lock() in
+futex_lock_pi(), so the count remains unchanged.
+
+Document remaining nested key ref-counting sites.
+
+Signed-off-by: Darren Hart <dvhart@linux.intel.com>
+Reported-and-tested-by: Matthieu Fertré<matthieu.fertre@kerlabs.com>
+Reported-by: Louis Rilling<louis.rilling@kerlabs.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: John Kacur <jkacur@redhat.com>
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+LKML-Reference: <4CBB17A8.70401@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 31 ++++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1363,7 +1363,6 @@ static inline struct futex_hash_bucket *
+ {
+ struct futex_hash_bucket *hb;
+
+- get_futex_key_refs(&q->key);
+ hb = hash_futex(&q->key);
+ q->lock_ptr = &hb->lock;
+
+@@ -1375,7 +1374,6 @@ static inline void
+ queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
+ {
+ spin_unlock(&hb->lock);
+- drop_futex_key_refs(&q->key);
+ }
+
+ /**
+@@ -1480,8 +1478,6 @@ static void unqueue_me_pi(struct futex_q
+ q->pi_state = NULL;
+
+ spin_unlock(q->lock_ptr);
+-
+- drop_futex_key_refs(&q->key);
+ }
+
+ /*
+@@ -1812,7 +1808,10 @@ static int futex_wait(u32 __user *uaddr,
+ }
+
+ retry:
+- /* Prepare to wait on uaddr. */
++ /*
++ * Prepare to wait on uaddr. On success, holds hb lock and increments
++ * q.key refs.
++ */
+ ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
+ if (ret)
+ goto out;
+@@ -1822,24 +1821,23 @@ retry:
+
+ /* If we were woken (and unqueued), we succeeded, whatever. */
+ ret = 0;
++ /* unqueue_me() drops q.key ref */
+ if (!unqueue_me(&q))
+- goto out_put_key;
++ goto out;
+ ret = -ETIMEDOUT;
+ if (to && !to->task)
+- goto out_put_key;
++ goto out;
+
+ /*
+ * We expect signal_pending(current), but we might be the
+ * victim of a spurious wakeup as well.
+ */
+- if (!signal_pending(current)) {
+- put_futex_key(fshared, &q.key);
++ if (!signal_pending(current))
+ goto retry;
+- }
+
+ ret = -ERESTARTSYS;
+ if (!abs_time)
+- goto out_put_key;
++ goto out;
+
+ restart = ¤t_thread_info()->restart_block;
+ restart->fn = futex_wait_restart;
+@@ -1856,8 +1854,6 @@ retry:
+
+ ret = -ERESTART_RESTARTBLOCK;
+
+-out_put_key:
+- put_futex_key(fshared, &q.key);
+ out:
+ if (to) {
+ hrtimer_cancel(&to->timer);
+@@ -2236,7 +2232,10 @@ static int futex_wait_requeue_pi(u32 __u
+ q.rt_waiter = &rt_waiter;
+ q.requeue_pi_key = &key2;
+
+- /* Prepare to wait on uaddr. */
++ /*
++ * Prepare to wait on uaddr. On success, increments q.key (key1) ref
++ * count.
++ */
+ ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
+ if (ret)
+ goto out_key2;
+@@ -2254,7 +2253,9 @@ static int futex_wait_requeue_pi(u32 __u
+ * In order for us to be here, we know our q.key == key2, and since
+ * we took the hb->lock above, we also know that futex_requeue() has
+ * completed and we no longer have to concern ourselves with a wakeup
+- * race with the atomic proxy lock acquition by the requeue code.
++ * race with the atomic proxy lock acquisition by the requeue code. The
++ * futex_requeue dropped our key1 reference and incremented our key2
++ * reference count.
+ */
+
+ /* Check if the requeue code acquired the second futex for us. */
--- /dev/null
+From 3ee48b6af49cf534ca2f481ecc484b156a41451d Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw@sgi.com>
+Date: Thu, 16 Sep 2010 11:44:02 -0500
+Subject: mm, x86: Saving vmcore with non-lazy freeing of vmas
+
+From: Cliff Wickman <cpw@sgi.com>
+
+commit 3ee48b6af49cf534ca2f481ecc484b156a41451d upstream.
+
+During the reading of /proc/vmcore the kernel is doing
+ioremap()/iounmap() repeatedly. And the buildup of un-flushed
+vm_area_struct's is causing a great deal of overhead. (rb_next()
+is chewing up most of that time).
+
+This solution is to provide function set_iounmap_nonlazy(). It
+causes a subsequent call to iounmap() to immediately purge the
+vma area (with try_purge_vmap_area_lazy()).
+
+With this patch we have seen the time for writing a 250MB
+compressed dump drop from 71 seconds to 44 seconds.
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: kexec@lists.infradead.org
+LKML-Reference: <E1OwHZ4-0005WK-Tw@eag09.americas.sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/io.h | 1 +
+ arch/x86/kernel/crash_dump_64.c | 1 +
+ mm/vmalloc.c | 9 +++++++++
+ 3 files changed, 11 insertions(+)
+
+--- a/arch/x86/include/asm/io.h
++++ b/arch/x86/include/asm/io.h
+@@ -172,6 +172,7 @@ static inline void __iomem *ioremap(reso
+
+ extern void iounmap(volatile void __iomem *addr);
+
++extern void set_iounmap_nonlazy(void);
+
+ #ifdef CONFIG_X86_32
+ # include "io_32.h"
+--- a/arch/x86/kernel/crash_dump_64.c
++++ b/arch/x86/kernel/crash_dump_64.c
+@@ -46,6 +46,7 @@ ssize_t copy_oldmem_page(unsigned long p
+ } else
+ memcpy(buf, vaddr + offset, csize);
+
++ set_iounmap_nonlazy();
+ iounmap(vaddr);
+ return csize;
+ }
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -513,6 +513,15 @@ static atomic_t vmap_lazy_nr = ATOMIC_IN
+ static void purge_fragmented_blocks_allcpus(void);
+
+ /*
++ * called before a call to iounmap() if the caller wants vm_area_struct's
++ * immediately freed.
++ */
++void set_iounmap_nonlazy(void)
++{
++ atomic_set(&vmap_lazy_nr, lazy_max_pages()+1);
++}
++
++/*
+ * Purges all lazily-freed vmap areas.
+ *
+ * If sync is 0 then don't purge if there is already a purge in progress.
--- /dev/null
+From 3df7169e73fc1d71a39cffeacc969f6840cdf52b Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 10 Sep 2010 16:37:05 -0400
+Subject: OHCI: work around for nVidia shutdown problem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 3df7169e73fc1d71a39cffeacc969f6840cdf52b upstream.
+
+This patch (as1417) fixes a problem affecting some (or all) nVidia
+chipsets. When the computer is shut down, the OHCI controllers
+continue to power the USB buses and evidently they drive a Reset
+signal out all their ports. This prevents attached devices from going
+to low power. Mouse LEDs stay on, for example, which is disconcerting
+for users and a drain on laptop batteries.
+
+The fix involves leaving each OHCI controller in the OPERATIONAL state
+during system shutdown rather than putting it in the RESET state.
+Although this nominally means the controller is running, in fact it's
+not doing very much since all the schedules are all disabled. However
+there is ongoing DMA to the Host Controller Communications Area, so
+the patch also disables the bus-master capability of all PCI USB
+controllers after the shutdown routine runs.
+
+The fix is applied only to nVidia-based PCI OHCI controllers, so it
+shouldn't cause problems on systems using other hardware. As an added
+safety measure, in case the kernel encounters one of these running
+controllers during boot, the patch changes quirk_usb_handoff_ohci()
+(which runs early on during PCI discovery) to reset the controller
+before anything bad can happen.
+
+Reported-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: David Brownell <david-b@pacbell.net>
+Tested-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd-pci.c | 4 +++-
+ drivers/usb/host/ohci-hcd.c | 9 ++++++++-
+ drivers/usb/host/ohci-pci.c | 18 ++++++++++++++++++
+ drivers/usb/host/ohci.h | 1 +
+ drivers/usb/host/pci-quirks.c | 18 +++++++++++-------
+ 5 files changed, 41 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -197,8 +197,10 @@ void usb_hcd_pci_shutdown(struct pci_dev
+ if (!hcd)
+ return;
+
+- if (hcd->driver->shutdown)
++ if (hcd->driver->shutdown) {
+ hcd->driver->shutdown(hcd);
++ pci_disable_device(dev);
++ }
+ }
+ EXPORT_SYMBOL_GPL(usb_hcd_pci_shutdown);
+
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -398,7 +398,14 @@ ohci_shutdown (struct usb_hcd *hcd)
+
+ ohci = hcd_to_ohci (hcd);
+ ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
+- ohci_usb_reset (ohci);
++ ohci->hc_control = ohci_readl(ohci, &ohci->regs->control);
++
++ /* If the SHUTDOWN quirk is set, don't put the controller in RESET */
++ ohci->hc_control &= (ohci->flags & OHCI_QUIRK_SHUTDOWN ?
++ OHCI_CTRL_RWC | OHCI_CTRL_HCFS :
++ OHCI_CTRL_RWC);
++ ohci_writel(ohci, ohci->hc_control, &ohci->regs->control);
++
+ /* flush the writes */
+ (void) ohci_readl (ohci, &ohci->regs->control);
+ }
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -201,6 +201,20 @@ static int ohci_quirk_amd700(struct usb_
+ return 0;
+ }
+
++/* nVidia controllers continue to drive Reset signalling on the bus
++ * even after system shutdown, wasting power. This flag tells the
++ * shutdown routine to leave the controller OPERATIONAL instead of RESET.
++ */
++static int ohci_quirk_nvidia_shutdown(struct usb_hcd *hcd)
++{
++ struct ohci_hcd *ohci = hcd_to_ohci(hcd);
++
++ ohci->flags |= OHCI_QUIRK_SHUTDOWN;
++ ohci_dbg(ohci, "enabled nVidia shutdown quirk\n");
++
++ return 0;
++}
++
+ /*
+ * The hardware normally enables the A-link power management feature, which
+ * lets the system lower the power consumption in idle states.
+@@ -332,6 +346,10 @@ static const struct pci_device_id ohci_p
+ PCI_DEVICE(PCI_VENDOR_ID_ATI, 0x4399),
+ .driver_data = (unsigned long)ohci_quirk_amd700,
+ },
++ {
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID),
++ .driver_data = (unsigned long) ohci_quirk_nvidia_shutdown,
++ },
+
+ /* FIXME for some of the early AMD 760 southbridges, OHCI
+ * won't work at all. blacklist them.
+--- a/drivers/usb/host/ohci.h
++++ b/drivers/usb/host/ohci.h
+@@ -403,6 +403,7 @@ struct ohci_hcd {
+ #define OHCI_QUIRK_HUB_POWER 0x100 /* distrust firmware power/oc setup */
+ #define OHCI_QUIRK_AMD_ISO 0x200 /* ISO transfers*/
+ #define OHCI_QUIRK_AMD_PREFETCH 0x400 /* pre-fetch for ISO transfer */
++#define OHCI_QUIRK_SHUTDOWN 0x800 /* nVidia power bug */
+ // there are also chip quirks/bugs in init logic
+
+ struct work_struct nec_work; /* Worker for NEC quirk */
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -169,6 +169,7 @@ static int __devinit mmio_resource_enabl
+ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ {
+ void __iomem *base;
++ u32 control;
+
+ if (!mmio_resource_enabled(pdev, 0))
+ return;
+@@ -177,10 +178,14 @@ static void __devinit quirk_usb_handoff_
+ if (base == NULL)
+ return;
+
++ control = readl(base + OHCI_CONTROL);
++
+ /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
+-#ifndef __hppa__
+-{
+- u32 control = readl(base + OHCI_CONTROL);
++#ifdef __hppa__
++#define OHCI_CTRL_MASK (OHCI_CTRL_RWC | OHCI_CTRL_IR)
++#else
++#define OHCI_CTRL_MASK OHCI_CTRL_RWC
++
+ if (control & OHCI_CTRL_IR) {
+ int wait_time = 500; /* arbitrary; 5 seconds */
+ writel(OHCI_INTR_OC, base + OHCI_INTRENABLE);
+@@ -194,13 +199,12 @@ static void __devinit quirk_usb_handoff_
+ dev_warn(&pdev->dev, "OHCI: BIOS handoff failed"
+ " (BIOS bug?) %08x\n",
+ readl(base + OHCI_CONTROL));
+-
+- /* reset controller, preserving RWC */
+- writel(control & OHCI_CTRL_RWC, base + OHCI_CONTROL);
+ }
+-}
+ #endif
+
++ /* reset controller, preserving RWC (and possibly IR) */
++ writel(control & OHCI_CTRL_MASK, base + OHCI_CONTROL);
++
+ /*
+ * disable interrupts
+ */
--- /dev/null
+From 1a92795dac419128eb511dce30a6aad672064b88 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Fri, 1 Oct 2010 22:01:24 +0200
+Subject: p54usb: add five more USBIDs
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 1a92795dac419128eb511dce30a6aad672064b88 upstream.
+
+Source:
+http://www.wikidevi.com/wiki/Intersil/p54/usb/windows
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -32,8 +32,17 @@ MODULE_ALIAS("prism54usb");
+ MODULE_FIRMWARE("isl3886usb");
+ MODULE_FIRMWARE("isl3887usb");
+
++/*
++ * Note:
++ *
++ * Always update our wiki's device list (located at:
++ * http://wireless.kernel.org/en/users/Drivers/p54/devices ),
++ * whenever you add a new device.
++ */
++
+ static struct usb_device_id p54u_table[] __devinitdata = {
+ /* Version 1 devices (pci chip + net2280) */
++ {USB_DEVICE(0x045e, 0x00c2)}, /* Microsoft MN-710 */
+ {USB_DEVICE(0x0506, 0x0a11)}, /* 3COM 3CRWE254G72 */
+ {USB_DEVICE(0x0707, 0xee06)}, /* SMC 2862W-G */
+ {USB_DEVICE(0x07aa, 0x001c)}, /* Corega CG-WLUSB2GT */
+@@ -45,7 +54,9 @@ static struct usb_device_id p54u_table[]
+ {USB_DEVICE(0x0846, 0x4220)}, /* Netgear WG111 */
+ {USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */
+ {USB_DEVICE(0x0cde, 0x0006)}, /* Medion 40900, Roper Europe */
++ {USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
+ {USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
++ {USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */
+ {USB_DEVICE(0x1915, 0x2234)}, /* Linksys WUSB54G OEM */
+ {USB_DEVICE(0x1915, 0x2235)}, /* Linksys WUSB54G Portable OEM */
+ {USB_DEVICE(0x2001, 0x3701)}, /* DLink DWL-G120 Spinnaker */
+@@ -58,6 +69,7 @@ static struct usb_device_id p54u_table[]
+ {USB_DEVICE(0x050d, 0x7050)}, /* Belkin F5D7050 ver 1000 */
+ {USB_DEVICE(0x0572, 0x2000)}, /* Cohiba Proto board */
+ {USB_DEVICE(0x0572, 0x2002)}, /* Cohiba Proto board */
++ {USB_DEVICE(0x06a9, 0x000e)}, /* Westell 802.11g USB (A90-211WG-01) */
+ {USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */
+ {USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */
+ {USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */
+@@ -77,6 +89,7 @@ static struct usb_device_id p54u_table[]
+ {USB_DEVICE(0x13B1, 0x000C)}, /* Linksys WUSB54AG */
+ {USB_DEVICE(0x1413, 0x5400)}, /* Telsey 802.11g USB2.0 Adapter */
+ {USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */
++ {USB_DEVICE(0x1668, 0x1050)}, /* Actiontec 802UIG-1 */
+ {USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */
+ {USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */
+ {USB_DEVICE(0x413c, 0x8102)}, /* Spinnaker DUT */
--- /dev/null
+From 11791a6f7534906b4a01ffb54ba0b02ca39398ef Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Sun, 22 Aug 2010 22:41:33 +0200
+Subject: p54usb: fix off-by-one on !CONFIG_PM
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 11791a6f7534906b4a01ffb54ba0b02ca39398ef upstream.
+
+The ISL3887 chip needs a USB reset, whenever the
+usb-frontend module "p54usb" is reloaded.
+
+This patch fixes an off-by-one bug, if the user
+is running a kernel without the CONFIG_PM option
+set and for some reason (e.g.: compat-wireless)
+wants to switch between different p54usb modules.
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -929,8 +929,8 @@ static int __devinit p54u_probe(struct u
+ #ifdef CONFIG_PM
+ /* ISL3887 needs a full reset on resume */
+ udev->reset_resume = 1;
++#endif /* CONFIG_PM */
+ err = p54u_device_reset(dev);
+-#endif
+
+ priv->hw_type = P54U_3887;
+ dev->extra_tx_headroom += sizeof(struct lm87_tx_hdr);
--- /dev/null
+From 5b917a1420d3d1a9c8da49fb0090692dc9aaee86 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segooon@gmail.com>
+Date: Sun, 17 Oct 2010 18:41:24 +0400
+Subject: pcmcia: synclink_cs: fix information leak to userland
+
+From: Vasiliy Kulikov <segooon@gmail.com>
+
+commit 5b917a1420d3d1a9c8da49fb0090692dc9aaee86 upstream.
+
+Structure new_line is copied to userland with some padding fields unitialized.
+It leads to leaking of stack memory.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/pcmcia/synclink_cs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/char/pcmcia/synclink_cs.c
++++ b/drivers/char/pcmcia/synclink_cs.c
+@@ -4144,6 +4144,8 @@ static int hdlcdev_ioctl(struct net_devi
+ if (cmd != SIOCWANDEV)
+ return hdlc_ioctl(dev, ifr, cmd);
+
++ memset(&new_line, 0, size);
++
+ switch(ifr->ifr_settings.type) {
+ case IF_GET_IFACE: /* return current sync_serial_settings */
+
--- /dev/null
+From e5953cbdff26f7cbae7eff30cd9b18c4e19b7594 Mon Sep 17 00:00:00 2001
+From: Nicolas Kaiser <nikai@nikai.net>
+Date: Thu, 21 Oct 2010 14:56:00 +0200
+Subject: pipe: fix failure to return error code on ->confirm()
+
+From: Nicolas Kaiser <nikai@nikai.net>
+
+commit e5953cbdff26f7cbae7eff30cd9b18c4e19b7594 upstream.
+
+The arguments were transposed, we want to assign the error code to
+'ret', which is being returned.
+
+Signed-off-by: Nicolas Kaiser <nikai@nikai.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/pipe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -363,7 +363,7 @@ pipe_read(struct kiocb *iocb, const stru
+ error = ops->confirm(pipe, buf);
+ if (error) {
+ if (!ret)
+- error = ret;
++ ret = error;
+ break;
+ }
+
--- /dev/null
+From 9f5f9ffe50e90ed73040d2100db8bfc341cee352 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@samba.org>
+Date: Thu, 9 Sep 2010 19:02:40 +0000
+Subject: powerpc/perf: Fix sampling enable for PPC970
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit 9f5f9ffe50e90ed73040d2100db8bfc341cee352 upstream.
+
+The logic to distinguish marked instruction events from ordinary events
+on PPC970 and derivatives was flawed. The result is that instruction
+sampling didn't get enabled in the PMU for some marked instruction
+events, so they would never trigger. This fixes it by adding the
+appropriate break statements in the switch statement.
+
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/ppc970-pmu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/powerpc/kernel/ppc970-pmu.c
++++ b/arch/powerpc/kernel/ppc970-pmu.c
+@@ -169,9 +169,11 @@ static int p970_marked_instr_event(u64 e
+ switch (unit) {
+ case PM_VPU:
+ mask = 0x4c; /* byte 0 bits 2,3,6 */
++ break;
+ case PM_LSU0:
+ /* byte 2 bits 0,2,3,4,6; all of byte 1 */
+ mask = 0x085dff00;
++ break;
+ case PM_LSU1L:
+ mask = 0x50 << 24; /* byte 3 bits 4,6 */
+ break;
--- /dev/null
+From 7740191cd909b75d75685fb08a5d1f54b8a9d28b Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Mon, 13 Sep 2010 17:47:00 -0400
+Subject: sched: Fix string comparison in /proc/sched_features
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+commit 7740191cd909b75d75685fb08a5d1f54b8a9d28b upstream.
+
+Fix incorrect handling of the following case:
+
+ INTERACTIVE
+ INTERACTIVE_SOMETHING_ELSE
+
+The comparison only checks up to each element's length.
+
+Changelog since v1:
+ - Embellish using some Rostedtisms.
+ [ mingo: ^^ == smaller and cleaner ]
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Tony Lindgren <tony@atomide.com>
+LKML-Reference: <20100913214700.GB16118@Krystal>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -740,7 +740,7 @@ sched_feat_write(struct file *filp, cons
+ size_t cnt, loff_t *ppos)
+ {
+ char buf[64];
+- char *cmp = buf;
++ char *cmp;
+ int neg = 0;
+ int i;
+
+@@ -751,6 +751,7 @@ sched_feat_write(struct file *filp, cons
+ return -EFAULT;
+
+ buf[cnt] = 0;
++ cmp = strstrip(buf);
+
+ if (strncmp(buf, "NO_", 3) == 0) {
+ neg = 1;
+@@ -758,9 +759,7 @@ sched_feat_write(struct file *filp, cons
+ }
+
+ for (i = 0; sched_feat_names[i]; i++) {
+- int len = strlen(sched_feat_names[i]);
+-
+- if (strncmp(cmp, sched_feat_names[i], len) == 0) {
++ if (strcmp(cmp, sched_feat_names[i]) == 0) {
+ if (neg)
+ sysctl_sched_features &= ~(1UL << i);
+ else
ssb-look-for-sprom-at-different-offset-on-higher-rev-cc.patch
ssb-fix-null-ptr-deref-when-pcihost_wrapper-is-used.patch
ssb-handle-alternate-ssprom-location.patch
+staging-usbip-notify-usb-core-of-port-status-changes.patch
+staging-usbip-process-event-flags-without-delay.patch
+powerpc-perf-fix-sampling-enable-for-ppc970.patch
+pcmcia-synclink_cs-fix-information-leak-to-userland.patch
+sched-fix-string-comparison-in-proc-sched_features.patch
+bluetooth-fix-missing-null-check.patch
+futex-fix-errors-in-nested-key-ref-counting.patch
+mm-x86-saving-vmcore-with-non-lazy-freeing-of-vmas.patch
+x86-cpu-fix-renamed-not-yet-shipping-amd-cpuid-feature-bit.patch
+x86-kexec-make-sure-to-stop-all-cpus-before-exiting-the-kernel.patch
+x86-olpc-don-t-retry-ec-commands-forever.patch
+x86-mtrr-assume-sys_cfg-exists-on-all-future-amd-cpus.patch
+x86-intr-remap-set-redirection-hint-in-the-irte.patch
+x86-kdump-change-copy_oldmem_page-to-use-cached-addressing.patch
+pipe-fix-failure-to-return-error-code-on-confirm.patch
+p54usb-fix-off-by-one-on-config_pm.patch
+p54usb-add-five-more-usbids.patch
+drivers-net-wireless-p54-eeprom.c-return-enomem-on-memory-allocation-failure.patch
+usb-add-pid-for-ftdi-based-opendcc-hardware.patch
+usb-ftdi_sio-new-vid-pids-for-various-papouch-devices.patch
+usb-musb-blackfin-call-gpio_free-on-error-path-in-musb_platform_init.patch
+usb-option-add-more-zte-modem-usb-id-s.patch
+usb-cp210x-add-renesas-rx-stick-device-id.patch
+usb-cp210x-add-wago-750-923-service-cable-device-id.patch
+usb-atmel_usba_udc-force-vbus_pin-at-einval-when-gpio_request-failled.patch
+usb-disable-endpoints-after-unbinding-interfaces-not-before.patch
+usb-opticon-fix-long-standing-bugs-in-opticon-driver.patch
+usb-accept-some-invalid-ep0-maxpacket-values.patch
+ohci-work-around-for-nvidia-shutdown-problem.patch
--- /dev/null
+From 0c9a32f0192e656daa2ff3c9149f6d71b4a1b873 Mon Sep 17 00:00:00 2001
+From: Max Vozeler <mvz@vozeler.com>
+Date: Tue, 21 Sep 2010 17:31:40 +0200
+Subject: staging: usbip: Notify usb core of port status changes
+
+From: Max Vozeler <mvz@vozeler.com>
+
+commit 0c9a32f0192e656daa2ff3c9149f6d71b4a1b873 upstream.
+
+This patch changes vhci to behave like dummy and
+other hcds when disconnecting a device.
+
+Previously detaching a device from the root hub
+did not notify the usb core of the disconnect and
+left the device visible.
+
+Signed-off-by: Max Vozeler <mvz@vozeler.com>
+Reported-by: Marco Lancione <marco@optikam.com>
+Tested-by: Luc Jalbert <ljalbert@optikam.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/usbip/vhci_hcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/usbip/vhci_hcd.c
++++ b/drivers/staging/usbip/vhci_hcd.c
+@@ -163,6 +163,8 @@ void rh_port_disconnect(int rhport)
+ * spin_unlock(&vdev->ud.lock); */
+
+ spin_unlock_irqrestore(&the_controller->lock, flags);
++
++ usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
+ }
+
+
--- /dev/null
+From 584c5b7cf06194464240280483ee0376cdddbbae Mon Sep 17 00:00:00 2001
+From: Max Vozeler <mvz@vozeler.com>
+Date: Tue, 21 Sep 2010 17:43:30 +0200
+Subject: staging: usbip: Process event flags without delay
+
+From: Max Vozeler <mvz@vozeler.com>
+
+commit 584c5b7cf06194464240280483ee0376cdddbbae upstream.
+
+The way the event handler works can cause it to delay
+events until eventual wakeup for another event.
+
+For example, on device detach (vhci):
+
+ - Write to sysfs detach file
+ -> usbip_event_add(VDEV_EVENT_DOWN)
+ -> wakeup()
+
+#define VDEV_EVENT_DOWN (USBIP_EH_SHUTDOWN | USBIP_EH_RESET).
+
+ - Event thread wakes up and passes the event to
+ event_handler() to process.
+
+ - It processes and clears the USBIP_EH_SHUTDOWN
+ flag then returns.
+
+ - The outer event loop (event_handler_loop()) calls
+ wait_event_interruptible().
+
+The processing of the second flag which is part of
+VDEV_EVENT_DOWN (USBIP_EH_RESET) did not happen yet.
+It is delayed until the next event.
+
+This means the ->reset callback may not happen for
+a long time (if ever), leaving the usbip port in a
+weird state which prevents its reuse.
+
+This patch changes the handler to process all flags
+before waiting for another wakeup.
+
+I have verified this change to fix a problem which
+prevented reattach of a usbip device. It also helps
+for socket errors which missed the RESET as well.
+
+The delayed event processing also affects the stub
+side of usbip and the error handling there.
+
+Signed-off-by: Max Vozeler <mvz@vozeler.com>
+Reported-by: Marco Lancione <marco@optikam.com>
+Tested-by: Luc Jalbert <ljalbert@optikam.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/usbip/usbip_event.c | 16 +++-------------
+ 1 file changed, 3 insertions(+), 13 deletions(-)
+
+--- a/drivers/staging/usbip/usbip_event.c
++++ b/drivers/staging/usbip/usbip_event.c
+@@ -38,21 +38,13 @@ static int event_handler(struct usbip_de
+ ud->eh_ops.shutdown(ud);
+
+ ud->event &= ~USBIP_EH_SHUTDOWN;
+-
+- break;
+ }
+
+- /* Stop the error handler. */
+- if (ud->event & USBIP_EH_BYE)
+- return -1;
+-
+ /* Reset the device. */
+ if (ud->event & USBIP_EH_RESET) {
+ ud->eh_ops.reset(ud);
+
+ ud->event &= ~USBIP_EH_RESET;
+-
+- break;
+ }
+
+ /* Mark the device as unusable. */
+@@ -60,13 +52,11 @@ static int event_handler(struct usbip_de
+ ud->eh_ops.unusable(ud);
+
+ ud->event &= ~USBIP_EH_UNUSABLE;
+-
+- break;
+ }
+
+- /* NOTREACHED */
+- printk(KERN_ERR "%s: unknown event\n", __func__);
+- return -1;
++ /* Stop the error handler. */
++ if (ud->event & USBIP_EH_BYE)
++ return -1;
+ }
+
+ return 0;
--- /dev/null
+From 56626a72a47bf3e50875d960d6b5f17b9bee0ab2 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 14 Oct 2010 15:25:21 -0400
+Subject: USB: accept some invalid ep0-maxpacket values
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 56626a72a47bf3e50875d960d6b5f17b9bee0ab2 upstream.
+
+A few devices (such as the RCA VR5220 voice recorder) are so
+non-compliant with the USB spec that they have invalid maxpacket sizes
+for endpoint 0. Nevertheless, as long as we can safely use them, we
+may as well do so.
+
+This patch (as1432) softens our acceptance criterion by allowing
+high-speed devices to have ep0-maxpacket sizes other than 64. A
+warning is printed in the system log when this happens, and the
+existing error message is clarified.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: James <bjlockie@lockie.ca>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hub.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2872,13 +2872,16 @@ hub_port_init (struct usb_hub *hub, stru
+ else
+ i = udev->descriptor.bMaxPacketSize0;
+ if (le16_to_cpu(udev->ep0.desc.wMaxPacketSize) != i) {
+- if (udev->speed != USB_SPEED_FULL ||
++ if (udev->speed == USB_SPEED_LOW ||
+ !(i == 8 || i == 16 || i == 32 || i == 64)) {
+- dev_err(&udev->dev, "ep0 maxpacket = %d\n", i);
++ dev_err(&udev->dev, "Invalid ep0 maxpacket: %d\n", i);
+ retval = -EMSGSIZE;
+ goto fail;
+ }
+- dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
++ if (udev->speed == USB_SPEED_FULL)
++ dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
++ else
++ dev_warn(&udev->dev, "Using ep0 maxpacket: %d\n", i);
+ udev->ep0.desc.wMaxPacketSize = cpu_to_le16(i);
+ usb_ep0_reinit(udev);
+ }
--- /dev/null
+From 99c1e4f89d1033444ce4d0c064bd2826e81c3775 Mon Sep 17 00:00:00 2001
+From: Rainer Keller <mail@rainerkeller.de>
+Date: Tue, 28 Sep 2010 12:27:43 +0200
+Subject: USB: add PID for FTDI based OpenDCC hardware
+
+From: Rainer Keller <mail@rainerkeller.de>
+
+commit 99c1e4f89d1033444ce4d0c064bd2826e81c3775 upstream.
+
+The OpenDCC project is developing a new hardware. This patch adds its
+PID to the list of known FTDI devices. The PID can be found at
+http://www.opendcc.de/elektronik/usb/opendcc_usb.html
+
+Signed-off-by: Rainer Keller <mail@rainerkeller.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -179,6 +179,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_SNIFFER_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) },
+ { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
+ { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -56,6 +56,7 @@
+ #define FTDI_OPENDCC_SNIFFER_PID 0xBFD9
+ #define FTDI_OPENDCC_THROTTLE_PID 0xBFDA
+ #define FTDI_OPENDCC_GATEWAY_PID 0xBFDB
++#define FTDI_OPENDCC_GBM_PID 0xBFDC
+
+ /*
+ * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
--- /dev/null
+From 969affff54702785330de553b790372e261e93f9 Mon Sep 17 00:00:00 2001
+From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Date: Mon, 20 Sep 2010 18:31:07 +0200
+Subject: USB: atmel_usba_udc: force vbus_pin at -EINVAL when gpio_request failled
+
+From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+
+commit 969affff54702785330de553b790372e261e93f9 upstream.
+
+to ensure gpio_is_valid return false
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/atmel_usba_udc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/gadget/atmel_usba_udc.c
++++ b/drivers/usb/gadget/atmel_usba_udc.c
+@@ -2013,6 +2013,9 @@ static int __init usba_udc_probe(struct
+ } else {
+ disable_irq(gpio_to_irq(udc->vbus_pin));
+ }
++ } else {
++ /* gpio_request fail so use -EINVAL for gpio_is_valid */
++ ubc->vbus_pin = -EINVAL;
+ }
+ }
+
--- /dev/null
+From 2f1136d1d08a63dcdbcd462621373f30d8dfe590 Mon Sep 17 00:00:00 2001
+From: DJ Delorie <dj@delorie.com>
+Date: Fri, 17 Sep 2010 11:09:06 -0400
+Subject: USB: cp210x: Add Renesas RX-Stick device ID
+
+From: DJ Delorie <dj@delorie.com>
+
+commit 2f1136d1d08a63dcdbcd462621373f30d8dfe590 upstream.
+
+RX610 development board by Renesas
+
+Bus 001 Device 024: ID 045b:0053 Hitachi, Ltd
+Device Descriptor:
+ bLength 18
+ bDescriptorType 1
+ bcdUSB 1.10
+ bDeviceClass 0 (Defined at Interface level)
+ bDeviceSubClass 0
+ bDeviceProtocol 0
+ bMaxPacketSize0 64
+ idVendor 0x045b Hitachi, Ltd
+ idProduct 0x0053
+ bcdDevice 1.00
+ iManufacturer 1 Silicon Labs
+ iProduct 2 RX-Stick
+ iSerial 3 0001
+ . . .
+
+http://am.renesas.com/rx610stick
+
+Signed-off-by: DJ Delorie <dj@delorie.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -56,6 +56,7 @@ static int cp210x_carrier_raised(struct
+ static int debug;
+
+ static struct usb_device_id id_table [] = {
++ { USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */
+ { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
+ { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
+ { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */
--- /dev/null
+From 93ad03d60b5b18897030038234aa2ebae8234748 Mon Sep 17 00:00:00 2001
+From: Anders Larsen <al@alarsen.net>
+Date: Wed, 6 Oct 2010 23:46:25 +0200
+Subject: USB: cp210x: Add WAGO 750-923 Service Cable device ID
+
+From: Anders Larsen <al@alarsen.net>
+
+commit 93ad03d60b5b18897030038234aa2ebae8234748 upstream.
+
+The WAGO 750-923 USB Service Cable is used for configuration and firmware
+updates of several industrial automation products from WAGO Kontakttechnik GmbH.
+
+Bus 004 Device 002: ID 1be3:07a6
+Device Descriptor:
+ bLength 18
+ bDescriptorType 1
+ bcdUSB 1.10
+ bDeviceClass 0 (Defined at Interface level)
+ bDeviceSubClass 0
+ bDeviceProtocol 0
+ bMaxPacketSize0 64
+ idVendor 0x1be3
+ idProduct 0x07a6
+ bcdDevice 1.00
+ iManufacturer 1 Silicon Labs
+ iProduct 2 WAGO USB Service Cable
+ iSerial 3 1277796751
+ . . .
+
+Signed-off-by: Anders Larsen <al@alarsen.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -128,6 +128,7 @@ static struct usb_device_id id_table []
+ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
++ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
+ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
+ { } /* Terminating Entry */
+ };
--- /dev/null
+From 80f0cf3947889014d3a3dc0ad60fb87cfda4b12a Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 30 Sep 2010 15:16:23 -0400
+Subject: USB: disable endpoints after unbinding interfaces, not before
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 80f0cf3947889014d3a3dc0ad60fb87cfda4b12a upstream.
+
+This patch (as1430) fixes a bug in usbcore. When a device
+configuration change occurs or a device is removed, the endpoints for
+the old config should be completely disabled. However it turns out
+they aren't; this is because usb_unbind_interface() calls
+usb_enable_interface() or usb_set_interface() to put interfaces back
+in altsetting 0, which re-enables the interfaces' endpoints.
+
+As a result, when a device goes through a config change or is
+unconfigured, the ep_in[] and ep_out[] arrays may be left holding old
+pointers to usb_host_endpoint structures. If the device is
+deauthorized these structures get freed, and the stale pointers cause
+errors when the the device is eventually unplugged.
+
+The solution is to disable the endpoints after unbinding the
+interfaces instead of before. This isn't as large a change as it
+sounds, since usb_unbind_interface() disables all the interface's
+endpoints anyway before calling the driver's disconnect routine,
+unless the driver claims to support "soft" unbind.
+
+This fixes Bugzilla #19192. Thanks to "Tom" Lei Ming for diagnosing
+the underlying cause of the problem.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Carsten Sommer <carsten_sommer@ymail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/message.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1180,13 +1180,6 @@ void usb_disable_device(struct usb_devic
+ {
+ int i;
+
+- dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
+- skip_ep0 ? "non-ep0" : "all");
+- for (i = skip_ep0; i < 16; ++i) {
+- usb_disable_endpoint(dev, i, true);
+- usb_disable_endpoint(dev, i + USB_DIR_IN, true);
+- }
+-
+ /* getting rid of interfaces will disconnect
+ * any drivers bound to them (a key side effect)
+ */
+@@ -1216,6 +1209,13 @@ void usb_disable_device(struct usb_devic
+ if (dev->state == USB_STATE_CONFIGURED)
+ usb_set_device_state(dev, USB_STATE_ADDRESS);
+ }
++
++ dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
++ skip_ep0 ? "non-ep0" : "all");
++ for (i = skip_ep0; i < 16; ++i) {
++ usb_disable_endpoint(dev, i, true);
++ usb_disable_endpoint(dev, i + USB_DIR_IN, true);
++ }
+ }
+
+ /**
--- /dev/null
+From 59c6ccd9f9aecfa59c99ceba6d4d34b180547a05 Mon Sep 17 00:00:00 2001
+From: Daniel Suchy <danny@danysek.cz>
+Date: Tue, 12 Oct 2010 15:44:24 +0200
+Subject: USB: ftdi_sio: new VID/PIDs for various Papouch devices
+
+From: Daniel Suchy <danny@danysek.cz>
+
+commit 59c6ccd9f9aecfa59c99ceba6d4d34b180547a05 upstream.
+
+This patch for FTDI USB serial driver ads new VID/PIDs used on various
+devices manufactured by Papouch (http://www.papouch.com). These devices
+have their own VID/PID, although they're using standard FTDI chip. In
+ftdi_sio.c, I also made small cleanup to have declarations for all
+Papouch devices together.
+
+Signed-off-by: Daniel Suchy <danny@danysek.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 30 +++++++++++++++++++++++++++++-
+ drivers/usb/serial/ftdi_sio_ids.h | 27 ++++++++++++++++++++++++++-
+ 2 files changed, 55 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -677,7 +677,6 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
+ { USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
+- { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
+@@ -718,8 +717,37 @@ static struct usb_device_id id_table_com
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
+ { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
++
++ /* Papouch devices based on FTDI chip */
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AP485_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB422_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485_2_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AP485_2_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB422_2_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485S_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485C_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_LEC_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB232_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_IRAMP_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_DRAK5_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO8x8_PID) },
+ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO4x4_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO2x2_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO10x1_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO30x3_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO60x3_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO2x16_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO3x32_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_DRAK6_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_UPSUSB_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_MU_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SIMUKEY_PID) },
+ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AD4USB_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_GMUX_PID) },
++ { USB_DEVICE(PAPOUCH_VID, PAPOUCH_GMSR_PID) },
++
+ { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DGQG_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
+ { USB_DEVICE(ALTI2_VID, ALTI2_N3_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1004,9 +1004,34 @@
+ */
+
+ #define PAPOUCH_VID 0x5050 /* Vendor ID */
++#define PAPOUCH_SB485_PID 0x0100 /* Papouch SB485 USB-485/422 Converter */
++#define PAPOUCH_AP485_PID 0x0101 /* AP485 USB-RS485 Converter */
++#define PAPOUCH_SB422_PID 0x0102 /* Papouch SB422 USB-RS422 Converter */
++#define PAPOUCH_SB485_2_PID 0x0103 /* Papouch SB485 USB-485/422 Converter */
++#define PAPOUCH_AP485_2_PID 0x0104 /* AP485 USB-RS485 Converter */
++#define PAPOUCH_SB422_2_PID 0x0105 /* Papouch SB422 USB-RS422 Converter */
++#define PAPOUCH_SB485S_PID 0x0106 /* Papouch SB485S USB-485/422 Converter */
++#define PAPOUCH_SB485C_PID 0x0107 /* Papouch SB485C USB-485/422 Converter */
++#define PAPOUCH_LEC_PID 0x0300 /* LEC USB Converter */
++#define PAPOUCH_SB232_PID 0x0301 /* Papouch SB232 USB-RS232 Converter */
+ #define PAPOUCH_TMU_PID 0x0400 /* TMU USB Thermometer */
+-#define PAPOUCH_QUIDO4x4_PID 0x0900 /* Quido 4/4 Module */
++#define PAPOUCH_IRAMP_PID 0x0500 /* Papouch IRAmp Duplex */
++#define PAPOUCH_DRAK5_PID 0x0700 /* Papouch DRAK5 */
++#define PAPOUCH_QUIDO8x8_PID 0x0800 /* Papouch Quido 8/8 Module */
++#define PAPOUCH_QUIDO4x4_PID 0x0900 /* Papouch Quido 4/4 Module */
++#define PAPOUCH_QUIDO2x2_PID 0x0a00 /* Papouch Quido 2/2 Module */
++#define PAPOUCH_QUIDO10x1_PID 0x0b00 /* Papouch Quido 10/1 Module */
++#define PAPOUCH_QUIDO30x3_PID 0x0c00 /* Papouch Quido 30/3 Module */
++#define PAPOUCH_QUIDO60x3_PID 0x0d00 /* Papouch Quido 60(100)/3 Module */
++#define PAPOUCH_QUIDO2x16_PID 0x0e00 /* Papouch Quido 2/16 Module */
++#define PAPOUCH_QUIDO3x32_PID 0x0f00 /* Papouch Quido 3/32 Module */
++#define PAPOUCH_DRAK6_PID 0x1000 /* Papouch DRAK6 */
++#define PAPOUCH_UPSUSB_PID 0x8000 /* Papouch UPS-USB adapter */
++#define PAPOUCH_MU_PID 0x8001 /* MU controller */
++#define PAPOUCH_SIMUKEY_PID 0x8002 /* Papouch SimuKey */
+ #define PAPOUCH_AD4USB_PID 0x8003 /* AD4USB Measurement Module */
++#define PAPOUCH_GMUX_PID 0x8004 /* Papouch GOLIATH MUX */
++#define PAPOUCH_GMSR_PID 0x8005 /* Papouch GOLIATH MSR */
+
+ /*
+ * Marvell SheevaPlug
--- /dev/null
+From 00be545e49d83485d49a598d3b7e090088934be8 Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Date: Wed, 29 Sep 2010 09:54:31 +0300
+Subject: usb: musb: blackfin: call gpio_free() on error path in musb_platform_init()
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 00be545e49d83485d49a598d3b7e090088934be8 upstream.
+
+Blackfin's musb_platform_init() needs to call gpio_free() for error cleanup iff
+otg_get_transceiver() call returns NULL.
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Acked-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/musb/blackfin.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/musb/blackfin.c
++++ b/drivers/usb/musb/blackfin.c
+@@ -298,8 +298,10 @@ int __init musb_platform_init(struct mus
+
+ usb_nop_xceiv_register();
+ musb->xceiv = otg_get_transceiver();
+- if (!musb->xceiv)
++ if (!musb->xceiv) {
++ gpio_free(musb->config->gpio_vrsel);
+ return -ENODEV;
++ }
+
+ if (ANOMALY_05000346) {
+ bfin_write_USB_APHY_CALIB(ANOMALY_05000346_value);
--- /dev/null
+From 97cd8dc4ca9a1a5efb2cc38758e01492e3b013e2 Mon Sep 17 00:00:00 2001
+From: Alon Ziv <alon+git@nolaviz.org>
+Date: Sun, 10 Oct 2010 08:32:18 +0200
+Subject: USB: opticon: Fix long-standing bugs in opticon driver
+
+From: Alon Ziv <alon+git@nolaviz.org>
+
+commit 97cd8dc4ca9a1a5efb2cc38758e01492e3b013e2 upstream.
+
+The bulk-read callback had two bugs:
+a) The bulk-in packet's leading two zeros were returned (and the two last
+ bytes truncated)
+b) The wrong URB was transmitted for the second (and later) read requests,
+ causing further reads to return the entire packet (including leading
+ zeros)
+
+Signed-off-by: Alon Ziv <alon-git@nolaviz.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/opticon.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/opticon.c
++++ b/drivers/usb/serial/opticon.c
+@@ -99,8 +99,8 @@ static void opticon_bulk_callback(struct
+ available_room = tty_buffer_request_room(tty,
+ data_length);
+ if (available_room) {
+- tty_insert_flip_string(tty, data,
+- available_room);
++ tty_insert_flip_string(tty, data + 2,
++ data_length);
+ tty_flip_buffer_push(tty);
+ }
+ tty_kref_put(tty);
+@@ -134,7 +134,7 @@ exit:
+ priv->bulk_address),
+ priv->bulk_in_buffer, priv->buffer_size,
+ opticon_bulk_callback, priv);
+- result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
++ result = usb_submit_urb(priv->bulk_read_urb, GFP_ATOMIC);
+ if (result)
+ dev_err(&port->dev,
+ "%s - failed resubmitting read urb, error %d\n",
--- /dev/null
+From ecfa153ef616b901e86d9a051b329fcda7a6ce7b Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+Date: Sun, 12 Sep 2010 11:41:50 -0300
+Subject: USB: option: Add more ZTE modem USB id's
+
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+
+commit ecfa153ef616b901e86d9a051b329fcda7a6ce7b upstream.
+
+There are lots of ZTE USB id's currently not covered by usb/serial. Adds them,
+to allow those devices to work properly on Linux.
+
+While here, put the USB ID's for 0x2002/0x2003 at the sorted order.
+
+This patch is based on zte.c file found on MF645.
+
+PS.: The ZTE driver is commenting the USB ID for 0x0053. It also adds, commented,
+an USB ID for 0x0026.
+
+Not sure why, but I think that 0053 is used by their devices in storage mode only.
+So, I opted to keep the comment on this patch.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -572,6 +572,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0011, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff) },
+@@ -583,38 +584,52 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0023, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) },
++ /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) }, */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0032, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0033, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0034, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0037, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0038, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0039, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0040, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0042, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0043, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0044, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0048, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0049, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0050, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff) },
++ /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0053, 0xff, 0xff, 0xff) }, */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0056, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0064, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0065, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0067, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0069, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0076, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0077, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0078, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0079, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0082, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0083, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0087, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) },
+@@ -830,6 +845,8 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
--- /dev/null
+From 7ef8aa72ab176e0288f363d1247079732c5d5792 Mon Sep 17 00:00:00 2001
+From: Andre Przywara <andre.przywara@amd.com>
+Date: Mon, 6 Sep 2010 15:14:17 +0200
+Subject: x86, cpu: Fix renamed, not-yet-shipping AMD CPUID feature bit
+
+From: Andre Przywara <andre.przywara@amd.com>
+
+commit 7ef8aa72ab176e0288f363d1247079732c5d5792 upstream.
+
+The AMD SSE5 feature set as-it has been replaced by some extensions
+to the AVX instruction set. Thus the bit formerly advertised as SSE5
+is re-used for one of these extensions (XOP).
+Although this changes the /proc/cpuinfo output, it is not user visible, as
+there are no CPUs (yet) having this feature.
+To avoid confusion this should be added to the stable series, too.
+
+Signed-off-by: Andre Przywara <andre.przywara@amd.com>
+LKML-Reference: <1283778860-26843-2-git-send-email-andre.przywara@amd.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/cpufeature.h | 2 +-
+ arch/x86/kvm/x86.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -150,7 +150,7 @@
+ #define X86_FEATURE_3DNOWPREFETCH (6*32+ 8) /* 3DNow prefetch instructions */
+ #define X86_FEATURE_OSVW (6*32+ 9) /* OS Visible Workaround */
+ #define X86_FEATURE_IBS (6*32+10) /* Instruction Based Sampling */
+-#define X86_FEATURE_SSE5 (6*32+11) /* SSE-5 */
++#define X86_FEATURE_XOP (6*32+11) /* extended AVX instructions */
+ #define X86_FEATURE_SKINIT (6*32+12) /* SKINIT/STGI instructions */
+ #define X86_FEATURE_WDT (6*32+13) /* Watchdog timer */
+ #define X86_FEATURE_NODEID_MSR (6*32+19) /* NodeId MSR */
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1615,7 +1615,7 @@ static void do_cpuid_ent(struct kvm_cpui
+ const u32 kvm_supported_word6_x86_features =
+ F(LAHF_LM) | F(CMP_LEGACY) | F(SVM) | 0 /* ExtApicSpace */ |
+ F(CR8_LEGACY) | F(ABM) | F(SSE4A) | F(MISALIGNSSE) |
+- F(3DNOWPREFETCH) | 0 /* OSVW */ | 0 /* IBS */ | F(SSE5) |
++ F(3DNOWPREFETCH) | 0 /* OSVW */ | 0 /* IBS */ | F(XOP) |
+ 0 /* SKINIT */ | 0 /* WDT */;
+
+ /* all calls to cpuid_count() should be made on the same cpu */
--- /dev/null
+From 75e3cfbed6f71a8f151dc6e413b6ce3c390030cb Mon Sep 17 00:00:00 2001
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+Date: Fri, 27 Aug 2010 11:09:48 -0700
+Subject: x86, intr-remap: Set redirection hint in the IRTE
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+commit 75e3cfbed6f71a8f151dc6e413b6ce3c390030cb upstream.
+
+Currently the redirection hint in the interrupt-remapping table entry
+is set to 0, which means the remapped interrupt is directed to the
+processors listed in the destination. So in logical flat mode
+in the presence of intr-remapping, this results in a single
+interrupt multi-casted to multiple cpu's as specified by the destination
+bit mask. But what we really want is to send that interrupt to one of the cpus
+based on the lowest priority delivery mode.
+
+Set the redirection hint in the IRTE to '1' to indicate that we want
+the remapped interrupt to be directed to only one of the processors
+listed in the destination.
+
+This fixes the issue of same interrupt getting delivered to multiple cpu's
+in the logical flat mode in the presence of interrupt-remapping. While
+there is no functional issue observed with this behavior, this will
+impact performance of such configurations (<=8 cpu's using logical flat
+mode in the presence of interrupt-remapping)
+
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+LKML-Reference: <20100827181049.013051492@sbsiddha-MOBL3.sc.intel.com>
+Cc: Weidong Han <weidong.han@intel.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/io_apic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1399,6 +1399,7 @@ int setup_ioapic_entry(int apic_id, int
+ irte.dlvry_mode = apic->irq_delivery_mode;
+ irte.vector = vector;
+ irte.dest_id = IRTE_DEST(destination);
++ irte.redir_hint = 1;
+
+ /* Set source-id of interrupt request */
+ set_ioapic_sid(&irte, apic_id);
+@@ -3358,6 +3359,7 @@ static int msi_compose_msg(struct pci_de
+ irte.dlvry_mode = apic->irq_delivery_mode;
+ irte.vector = cfg->vector;
+ irte.dest_id = IRTE_DEST(dest);
++ irte.redir_hint = 1;
+
+ /* Set source-id of interrupt request */
+ if (pdev)
--- /dev/null
+From 37a2f9f30a360fb03522d15c85c78265ccd80287 Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw@sgi.com>
+Date: Wed, 8 Sep 2010 10:14:27 -0500
+Subject: x86, kdump: Change copy_oldmem_page() to use cached addressing
+
+From: Cliff Wickman <cpw@sgi.com>
+
+commit 37a2f9f30a360fb03522d15c85c78265ccd80287 upstream.
+
+The copy of /proc/vmcore to a user buffer proceeds much faster
+if the kernel addresses memory as cached.
+
+With this patch we have seen an increase in transfer rate from
+less than 15MB/s to 80-460MB/s, depending on size of the
+transfer. This makes a big difference in time needed to save a
+system dump.
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Cc: kexec@lists.infradead.org
+LKML-Reference: <E1OtMLz-0001yp-Ia@eag09.americas.sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/crash_dump_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/crash_dump_64.c
++++ b/arch/x86/kernel/crash_dump_64.c
+@@ -34,7 +34,7 @@ ssize_t copy_oldmem_page(unsigned long p
+ if (!csize)
+ return 0;
+
+- vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
++ vaddr = ioremap_cache(pfn << PAGE_SHIFT, PAGE_SIZE);
+ if (!vaddr)
+ return -ENOMEM;
+
--- /dev/null
+From 76fac077db6b34e2c6383a7b4f3f4f7b7d06d8ce Mon Sep 17 00:00:00 2001
+From: Alok Kataria <akataria@vmware.com>
+Date: Mon, 11 Oct 2010 14:37:08 -0700
+Subject: x86, kexec: Make sure to stop all CPUs before exiting the kernel
+
+From: Alok Kataria <akataria@vmware.com>
+
+commit 76fac077db6b34e2c6383a7b4f3f4f7b7d06d8ce upstream.
+
+x86 smp_ops now has a new op, stop_other_cpus which takes a parameter
+"wait" this allows the caller to specify if it wants to stop until all
+the cpus have processed the stop IPI. This is required specifically
+for the kexec case where we should wait for all the cpus to be stopped
+before starting the new kernel. We now wait for the cpus to stop in
+all cases except for panic/kdump where we expect things to be broken
+and we are doing our best to make things work anyway.
+
+This patch fixes a legitimate regression, which was introduced during
+2.6.30, by commit id 4ef702c10b5df18ab04921fc252c26421d4d6c75.
+
+Signed-off-by: Alok N Kataria <akataria@vmware.com>
+LKML-Reference: <1286833028.1372.20.camel@ank32.eng.vmware.com>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: Jeremy Fitzhardinge <jeremy@xensource.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/smp.h | 9 +++++++--
+ arch/x86/kernel/reboot.c | 2 +-
+ arch/x86/kernel/smp.c | 15 +++++++++------
+ arch/x86/xen/enlighten.c | 2 +-
+ arch/x86/xen/smp.c | 6 +++---
+ 5 files changed, 21 insertions(+), 13 deletions(-)
+
+--- a/arch/x86/include/asm/smp.h
++++ b/arch/x86/include/asm/smp.h
+@@ -50,7 +50,7 @@ struct smp_ops {
+ void (*smp_prepare_cpus)(unsigned max_cpus);
+ void (*smp_cpus_done)(unsigned max_cpus);
+
+- void (*smp_send_stop)(void);
++ void (*stop_other_cpus)(int wait);
+ void (*smp_send_reschedule)(int cpu);
+
+ int (*cpu_up)(unsigned cpu);
+@@ -73,7 +73,12 @@ extern struct smp_ops smp_ops;
+
+ static inline void smp_send_stop(void)
+ {
+- smp_ops.smp_send_stop();
++ smp_ops.stop_other_cpus(0);
++}
++
++static inline void stop_other_cpus(void)
++{
++ smp_ops.stop_other_cpus(1);
+ }
+
+ static inline void smp_prepare_boot_cpu(void)
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -633,7 +633,7 @@ void native_machine_shutdown(void)
+ /* O.K Now that I'm on the appropriate processor,
+ * stop all of the others.
+ */
+- smp_send_stop();
++ stop_other_cpus();
+ #endif
+
+ lapic_shutdown();
+--- a/arch/x86/kernel/smp.c
++++ b/arch/x86/kernel/smp.c
+@@ -158,10 +158,10 @@ asmlinkage void smp_reboot_interrupt(voi
+ irq_exit();
+ }
+
+-static void native_smp_send_stop(void)
++static void native_stop_other_cpus(int wait)
+ {
+ unsigned long flags;
+- unsigned long wait;
++ unsigned long timeout;
+
+ if (reboot_force)
+ return;
+@@ -178,9 +178,12 @@ static void native_smp_send_stop(void)
+ if (num_online_cpus() > 1) {
+ apic->send_IPI_allbutself(REBOOT_VECTOR);
+
+- /* Don't wait longer than a second */
+- wait = USEC_PER_SEC;
+- while (num_online_cpus() > 1 && wait--)
++ /*
++ * Don't wait longer than a second if the caller
++ * didn't ask us to wait.
++ */
++ timeout = USEC_PER_SEC;
++ while (num_online_cpus() > 1 && (wait || timeout--))
+ udelay(1);
+ }
+
+@@ -226,7 +229,7 @@ struct smp_ops smp_ops = {
+ .smp_prepare_cpus = native_smp_prepare_cpus,
+ .smp_cpus_done = native_smp_cpus_done,
+
+- .smp_send_stop = native_smp_send_stop,
++ .stop_other_cpus = native_stop_other_cpus,
+ .smp_send_reschedule = native_smp_send_reschedule,
+
+ .cpu_up = native_cpu_up,
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1000,7 +1000,7 @@ static void xen_reboot(int reason)
+ struct sched_shutdown r = { .reason = reason };
+
+ #ifdef CONFIG_SMP
+- smp_send_stop();
++ stop_other_cpus();
+ #endif
+
+ if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -397,9 +397,9 @@ static void stop_self(void *v)
+ BUG();
+ }
+
+-static void xen_smp_send_stop(void)
++static void xen_stop_other_cpus(int wait)
+ {
+- smp_call_function(stop_self, NULL, 0);
++ smp_call_function(stop_self, NULL, wait);
+ }
+
+ static void xen_smp_send_reschedule(int cpu)
+@@ -467,7 +467,7 @@ static const struct smp_ops xen_smp_ops
+ .cpu_disable = xen_cpu_disable,
+ .play_dead = xen_play_dead,
+
+- .smp_send_stop = xen_smp_send_stop,
++ .stop_other_cpus = xen_stop_other_cpus,
+ .smp_send_reschedule = xen_smp_send_reschedule,
+
+ .send_call_func_ipi = xen_smp_send_call_function_ipi,
--- /dev/null
+From 3fdbf004c1706480a7c7fac3c9d836fa6df20d7d Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Thu, 30 Sep 2010 14:32:35 +0200
+Subject: x86, mtrr: Assume SYS_CFG[Tom2ForceMemTypeWB] exists on all future AMD CPUs
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit 3fdbf004c1706480a7c7fac3c9d836fa6df20d7d upstream.
+
+Instead of adapting the CPU family check in amd_special_default_mtrr()
+for each new CPU family assume that all new AMD CPUs support the
+necessary bits in SYS_CFG MSR.
+
+Tom2Enabled is architectural (defined in APM Vol.2).
+Tom2ForceMemTypeWB is defined in all BKDGs starting with K8 NPT.
+In pre K8-NPT BKDG this bit is reserved (read as zero).
+
+W/o this adaption Linux would unnecessarily complain about bad MTRR
+settings on every new AMD CPU family, e.g.
+
+[ 0.000000] WARNING: BIOS bug: CPU MTRRs don't cover all of memory, losing 4863MB of RAM.
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+LKML-Reference: <20100930123235.GB20545@loge.amd.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mtrr/cleanup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
++++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
+@@ -977,7 +977,7 @@ int __init amd_special_default_mtrr(void
+
+ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
+ return 0;
+- if (boot_cpu_data.x86 < 0xf || boot_cpu_data.x86 > 0x11)
++ if (boot_cpu_data.x86 < 0xf)
+ return 0;
+ /* In case some hypervisor doesn't pass SYSCFG through: */
+ if (rdmsr_safe(MSR_K8_SYSCFG, &l, &h) < 0)
--- /dev/null
+From 286e5b97eb22baab9d9a41ca76c6b933a484252c Mon Sep 17 00:00:00 2001
+From: Paul Fox <pgf@laptop.org>
+Date: Fri, 1 Oct 2010 18:17:19 +0100
+Subject: x86, olpc: Don't retry EC commands forever
+
+From: Paul Fox <pgf@laptop.org>
+
+commit 286e5b97eb22baab9d9a41ca76c6b933a484252c upstream.
+
+Avoids a potential infinite loop.
+
+It was observed once, during an EC hacking/debugging
+session - not in regular operation.
+
+Signed-off-by: Daniel Drake <dsd@laptop.org>
+Cc: dilinger@queued.net
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/olpc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/olpc.c
++++ b/arch/x86/kernel/olpc.c
+@@ -115,6 +115,7 @@ int olpc_ec_cmd(unsigned char cmd, unsig
+ unsigned long flags;
+ int ret = -EIO;
+ int i;
++ int restarts = 0;
+
+ spin_lock_irqsave(&ec_lock, flags);
+
+@@ -171,7 +172,9 @@ restart:
+ if (wait_on_obf(0x6c, 1)) {
+ printk(KERN_ERR "olpc-ec: timeout waiting for"
+ " EC to provide data!\n");
+- goto restart;
++ if (restarts++ < 10)
++ goto restart;
++ goto err;
+ }
+ outbuf[i] = inb(0x68);
+ printk(KERN_DEBUG "olpc-ec: received 0x%x\n",
projects / thirdparty / kernel / stable-queue.git / commitdiff
