--- /dev/null
+From 3e420e78ece6f9d2accc1568e80dfd0501e13df1 Mon Sep 17 00:00:00 2001
+From: Luke Yelavich <themuso@ubuntu.com>
+Date: Tue, 16 Dec 2008 12:37:47 +1100
+Subject: ALSA: hda - Add automatic model setting for Samsung Q45
+
+From: Luke Yelavich <themuso@ubuntu.com>
+
+commit 3e420e78ece6f9d2accc1568e80dfd0501e13df1 upstream.
+
+Have the Samsung Q45 (144d:c510) select ALC262_HIPPO by default
+
+Reference: Ubuntu bug 200210
+ http://launchpad.net/bugs/200210
+
+Signed-off-by: Luke Yelavich <themuso@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10473,6 +10473,7 @@ static struct snd_pci_quirk alc262_cfg_t
+ SND_PCI_QUIRK(0x10cf, 0x142d, "Fujitsu Lifebook E8410", ALC262_FUJITSU),
+ SND_PCI_QUIRK(0x144d, 0xc032, "Samsung Q1 Ultra", ALC262_ULTRA),
+ SND_PCI_QUIRK(0x144d, 0xc039, "Samsung Q1U EL", ALC262_ULTRA),
++ SND_PCI_QUIRK(0x144d, 0xc510, "Samsung Q45", ALC262_HIPPO),
+ SND_PCI_QUIRK(0x17aa, 0x384e, "Lenovo 3000 y410", ALC262_LENOVO_3000),
+ SND_PCI_QUIRK(0x17ff, 0x0560, "Benq ED8", ALC262_BENQ_ED8),
+ SND_PCI_QUIRK(0x17ff, 0x058d, "Benq T31-16", ALC262_BENQ_T31),
--- /dev/null
+From dafb70ce1026d4d6ef1b16ad6996c9589bb11cce Mon Sep 17 00:00:00 2001
+From: Giuseppe Bilotta <giuseppe.bilotta@gmail.com>
+Date: Tue, 13 Jan 2009 08:58:49 -0500
+Subject: ALSA: hda - Add quirk for another HP dv5
+
+From: Giuseppe Bilotta <giuseppe.bilotta@gmail.com>
+
+commit dafb70ce1026d4d6ef1b16ad6996c9589bb11cce upstream.
+
+Add the model=hp-m4 quirk for another HP dv5 (103c:3603)
+Reference: kernel bug#12440
+ http://bugzilla.kernel.org/show_bug.cgi?id=12440
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1722,6 +1722,8 @@ static struct snd_pci_quirk stac92hd71bx
+ "HP dv7", STAC_HP_M4),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30fc,
+ "HP dv7", STAC_HP_M4),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3603,
++ "HP dv5", STAC_HP_M4),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x361a,
+ "unknown HP", STAC_HP_M4),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
--- /dev/null
+From 8317e0b0c2234f5f1f5d54804e4093d11bc0dffa Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 14 Jan 2009 07:56:51 +0100
+Subject: ALSA: hda - Don't reset HP pinctl in patch_sigmatel.c
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8317e0b0c2234f5f1f5d54804e4093d11bc0dffa upstream.
+
+Resetting HP pinctl at the unplugged state may cause a sort of regression
+on some devices because of their wrong pin configuration.
+
+A simple workaround is to disable the pin reset. This is ugly and may be
+not good from the power-saving POV (if any), but damn simple.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -3985,8 +3985,19 @@ static void stac92xx_hp_detect(struct hd
+ continue;
+ if (presence)
+ stac92xx_set_pinctl(codec, cfg->hp_pins[i], val);
++#if 0 /* FIXME */
++/* Resetting the pinctl like below may lead to (a sort of) regressions
++ * on some devices since they use the HP pin actually for line/speaker
++ * outs although the default pin config shows a different pin (that is
++ * wrong and useless).
++ *
++ * So, it's basically a problem of default pin configs, likely a BIOS issue.
++ * But, disabling the code below just works around it, and I'm too tired of
++ * bug reports with such devices...
++ */
+ else
+ stac92xx_reset_pinctl(codec, cfg->hp_pins[i], val);
++#endif /* FIXME */
+ }
+ }
+
--- /dev/null
+From 1b0652eb588e57c3ab230e0291e7da99c7e665e0 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 14 Jan 2009 08:27:35 +0100
+Subject: ALSA: hda - Fix HP dv5 mic input
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1b0652eb588e57c3ab230e0291e7da99c7e665e0 upstream.
+
+Fix HP dv5 (103c:3603) built-in mic input.
+
+Reference: kernel bug 12440
+ http://bugzilla.kernel.org/show_bug.cgi?id=12440
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -89,6 +89,7 @@ enum {
+ STAC_DELL_M4_2,
+ STAC_DELL_M4_3,
+ STAC_HP_M4,
++ STAC_HP_DV5,
+ STAC_92HD71BXX_MODELS
+ };
+
+@@ -1702,6 +1703,7 @@ static unsigned int *stac92hd71bxx_brd_t
+ [STAC_DELL_M4_2] = dell_m4_2_pin_configs,
+ [STAC_DELL_M4_3] = dell_m4_3_pin_configs,
+ [STAC_HP_M4] = NULL,
++ [STAC_HP_DV5] = NULL,
+ };
+
+ static const char *stac92hd71bxx_models[STAC_92HD71BXX_MODELS] = {
+@@ -1710,6 +1712,7 @@ static const char *stac92hd71bxx_models[
+ [STAC_DELL_M4_2] = "dell-m4-2",
+ [STAC_DELL_M4_3] = "dell-m4-3",
+ [STAC_HP_M4] = "hp-m4",
++ [STAC_HP_DV5] = "hp-dv5",
+ };
+
+ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
+@@ -1723,7 +1726,7 @@ static struct snd_pci_quirk stac92hd71bx
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30fc,
+ "HP dv7", STAC_HP_M4),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3603,
+- "HP dv5", STAC_HP_M4),
++ "HP dv5", STAC_HP_DV5),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x361a,
+ "unknown HP", STAC_HP_M4),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
--- /dev/null
+From 1725b82a6e2721612a3572d0336f51f1f1c3cf54 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 21 Nov 2008 02:25:48 +0100
+Subject: ALSA: hda - make laptop-eapd model back for AD1986A
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1725b82a6e2721612a3572d0336f51f1f1c3cf54 upstream.
+
+The changes specific for Samsung laptops seem unapplicable to other
+hardware models like ASUS. The mic inputs are lost on such hardware
+by the change 5d5d5f43f1b835c375de9bd270cce030d16e2871.
+
+This patch adds back the old laptop-eapd model, and create a new
+model "samsung" for the new one specific to Samsung laptops with
+automatic mic selection feature.
+
+Reference: kernel bugzilla #12070
+ http://bugzilla.kernel.org/show_bug.cgi?id=12070
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Cc: Daniel Drake <dsd@gentoo.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/sound/alsa/ALSA-Configuration.txt | 3 -
+ sound/pci/hda/patch_analog.c | 49 ++++++++++++++++++++++--
+ 2 files changed, 48 insertions(+), 4 deletions(-)
+
+--- a/Documentation/sound/alsa/ALSA-Configuration.txt
++++ b/Documentation/sound/alsa/ALSA-Configuration.txt
+@@ -979,9 +979,10 @@ Prior to version 0.9.0rc4 options had a
+ 6stack 6-jack, separate surrounds (default)
+ 3stack 3-stack, shared surrounds
+ laptop 2-channel only (FSC V2060, Samsung M50)
+- laptop-eapd 2-channel with EAPD (Samsung R65, ASUS A6J)
++ laptop-eapd 2-channel with EAPD (ASUS A6J)
+ laptop-automute 2-channel with EAPD and HP-automute (Lenovo N100)
+ ultra 2-channel with EAPD (Samsung Ultra tablet PC)
++ samsung 2-channel with EAPD (Samsung R65)
+
+ AD1988/AD1988B/AD1989A/AD1989B
+ 6stack 6-jack
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -629,6 +629,36 @@ static struct snd_kcontrol_new ad1986a_l
+ HDA_BIND_SW("Master Playback Switch", &ad1986a_laptop_master_sw),
+ HDA_CODEC_VOLUME("PCM Playback Volume", 0x03, 0x0, HDA_OUTPUT),
+ HDA_CODEC_MUTE("PCM Playback Switch", 0x03, 0x0, HDA_OUTPUT),
++ HDA_CODEC_VOLUME("Internal Mic Playback Volume", 0x17, 0, HDA_OUTPUT),
++ HDA_CODEC_MUTE("Internal Mic Playback Switch", 0x17, 0, HDA_OUTPUT),
++ HDA_CODEC_VOLUME("Mic Playback Volume", 0x13, 0x0, HDA_OUTPUT),
++ HDA_CODEC_MUTE("Mic Playback Switch", 0x13, 0x0, HDA_OUTPUT),
++ HDA_CODEC_VOLUME("Mic Boost", 0x0f, 0x0, HDA_OUTPUT),
++ HDA_CODEC_VOLUME("Capture Volume", 0x12, 0x0, HDA_OUTPUT),
++ HDA_CODEC_MUTE("Capture Switch", 0x12, 0x0, HDA_OUTPUT),
++ {
++ .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++ .name = "Capture Source",
++ .info = ad198x_mux_enum_info,
++ .get = ad198x_mux_enum_get,
++ .put = ad198x_mux_enum_put,
++ },
++ {
++ .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++ .name = "External Amplifier",
++ .info = ad198x_eapd_info,
++ .get = ad198x_eapd_get,
++ .put = ad198x_eapd_put,
++ .private_value = 0x1b | (1 << 8), /* port-D, inversed */
++ },
++ { } /* end */
++};
++
++static struct snd_kcontrol_new ad1986a_samsung_mixers[] = {
++ HDA_BIND_VOL("Master Playback Volume", &ad1986a_laptop_master_vol),
++ HDA_BIND_SW("Master Playback Switch", &ad1986a_laptop_master_sw),
++ HDA_CODEC_VOLUME("PCM Playback Volume", 0x03, 0x0, HDA_OUTPUT),
++ HDA_CODEC_MUTE("PCM Playback Switch", 0x03, 0x0, HDA_OUTPUT),
+ HDA_CODEC_VOLUME("Mic Playback Volume", 0x13, 0x0, HDA_OUTPUT),
+ HDA_CODEC_MUTE("Mic Playback Switch", 0x13, 0x0, HDA_OUTPUT),
+ HDA_CODEC_VOLUME("Mic Boost", 0x0f, 0x0, HDA_OUTPUT),
+@@ -917,6 +947,7 @@ enum {
+ AD1986A_LAPTOP_EAPD,
+ AD1986A_LAPTOP_AUTOMUTE,
+ AD1986A_ULTRA,
++ AD1986A_SAMSUNG,
+ AD1986A_MODELS
+ };
+
+@@ -927,6 +958,7 @@ static const char *ad1986a_models[AD1986
+ [AD1986A_LAPTOP_EAPD] = "laptop-eapd",
+ [AD1986A_LAPTOP_AUTOMUTE] = "laptop-automute",
+ [AD1986A_ULTRA] = "ultra",
++ [AD1986A_SAMSUNG] = "samsung",
+ };
+
+ static struct snd_pci_quirk ad1986a_cfg_tbl[] = {
+@@ -949,9 +981,9 @@ static struct snd_pci_quirk ad1986a_cfg_
+ SND_PCI_QUIRK(0x1179, 0xff40, "Toshiba", AD1986A_LAPTOP_EAPD),
+ SND_PCI_QUIRK(0x144d, 0xb03c, "Samsung R55", AD1986A_3STACK),
+ SND_PCI_QUIRK(0x144d, 0xc01e, "FSC V2060", AD1986A_LAPTOP),
+- SND_PCI_QUIRK(0x144d, 0xc023, "Samsung X60", AD1986A_LAPTOP_EAPD),
+- SND_PCI_QUIRK(0x144d, 0xc024, "Samsung R65", AD1986A_LAPTOP_EAPD),
+- SND_PCI_QUIRK(0x144d, 0xc026, "Samsung X11", AD1986A_LAPTOP_EAPD),
++ SND_PCI_QUIRK(0x144d, 0xc023, "Samsung X60", AD1986A_SAMSUNG),
++ SND_PCI_QUIRK(0x144d, 0xc024, "Samsung R65", AD1986A_SAMSUNG),
++ SND_PCI_QUIRK(0x144d, 0xc026, "Samsung X11", AD1986A_SAMSUNG),
+ SND_PCI_QUIRK(0x144d, 0xc027, "Samsung Q1", AD1986A_ULTRA),
+ SND_PCI_QUIRK(0x144d, 0xc504, "Samsung Q35", AD1986A_3STACK),
+ SND_PCI_QUIRK(0x17aa, 0x1011, "Lenovo M55", AD1986A_LAPTOP),
+@@ -1033,6 +1065,17 @@ static int patch_ad1986a(struct hda_code
+ break;
+ case AD1986A_LAPTOP_EAPD:
+ spec->mixers[0] = ad1986a_laptop_eapd_mixers;
++ spec->num_init_verbs = 2;
++ spec->init_verbs[1] = ad1986a_eapd_init_verbs;
++ spec->multiout.max_channels = 2;
++ spec->multiout.num_dacs = 1;
++ spec->multiout.dac_nids = ad1986a_laptop_dac_nids;
++ if (!is_jack_available(codec, 0x25))
++ spec->multiout.dig_out_nid = 0;
++ spec->input_mux = &ad1986a_laptop_eapd_capture_source;
++ break;
++ case AD1986A_SAMSUNG:
++ spec->mixers[0] = ad1986a_samsung_mixers;
+ spec->num_init_verbs = 3;
+ spec->init_verbs[1] = ad1986a_eapd_init_verbs;
+ spec->init_verbs[2] = ad1986a_automic_verbs;
--- /dev/null
+From 2950e952920811be465ec95c6b56f03dc66a05c0 Mon Sep 17 00:00:00 2001
+From: Jos-Vicente Gilabert <josevteg@gmail.com>
+Date: Wed, 14 Jan 2009 20:55:00 -0800
+Subject: drivers/net/irda/irda-usb.c: fix buffer overflow
+
+From: Jos-Vicente Gilabert <josevteg@gmail.com>
+
+commit 2950e952920811be465ec95c6b56f03dc66a05c0 upstream.
+
+Taken from http://bugzilla.kernel.org/show_bug.cgi?id=12397
+
+We're doing an sprintf of an 11-char string into an 11-char buffer.
+Whoops. It breaks firmware uploading.
+
+Reported-by: Jos-Vicente Gilabert <josevteg@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/irda/irda-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/irda/irda-usb.c
++++ b/drivers/net/irda/irda-usb.c
+@@ -1075,7 +1075,7 @@ static int stir421x_patch_device(struct
+ {
+ unsigned int i;
+ int ret;
+- char stir421x_fw_name[11];
++ char stir421x_fw_name[12];
+ const struct firmware *fw;
+ const unsigned char *fw_version_ptr; /* pointer to version string */
+ unsigned long fw_version = 0;
--- /dev/null
+From 0773a6cf673316440999752e23f8c3d4f85e48b9 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Thu, 15 Jan 2009 10:29:17 -0800
+Subject: IA64: Turn on CONFIG_HAVE_UNSTABLE_CLOCK
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit 0773a6cf673316440999752e23f8c3d4f85e48b9 upstream.
+
+sched_clock() on ia64 is based on ar.itc, so is never
+completely synchronized between cpus. On some platforms
+(e.g. certain models of SGI Altix) it may be running at
+radically different frequencies.
+
+Based on a patch from Dimitri Sivanich which set this
+just for SN2 && GENERIC kernels ... it is needed for
+all ia64 machines.
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ia64/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/ia64/Kconfig
++++ b/arch/ia64/Kconfig
+@@ -17,6 +17,7 @@ config IA64
+ select ACPI if (!IA64_HP_SIM)
+ select PM if (!IA64_HP_SIM)
+ select ARCH_SUPPORTS_MSI
++ select HAVE_UNSTABLE_SCHED_CLOCK
+ select HAVE_IDE
+ select HAVE_OPROFILE
+ select HAVE_KPROBES
--- /dev/null
+From 364ee7f3b15ba760d421573990d96bf27ce342ee Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Tue, 20 Jan 2009 14:06:49 -0800
+Subject: ipv6: Fix fib6_dump_table walker leak
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit: 7891cc818967e186be68caac32d84bfd0a3f0bd2 ]
+
+When a fib6 table dump is prematurely ended, we won't unlink
+its walker from the list. This causes all sorts of grief for
+other users of the list later.
+
+Reported-by: Chris Caputo <ccaputo@alt.net>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/ip6_fib.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -298,6 +298,10 @@ static void fib6_dump_end(struct netlink
+ struct fib6_walker_t *w = (void*)cb->args[2];
+
+ if (w) {
++ if (cb->args[4]) {
++ cb->args[4] = 0;
++ fib6_walker_unlink(w);
++ }
+ cb->args[2] = 0;
+ kfree(w);
+ }
+@@ -330,15 +334,12 @@ static int fib6_dump_table(struct fib6_t
+ read_lock_bh(&table->tb6_lock);
+ res = fib6_walk_continue(w);
+ read_unlock_bh(&table->tb6_lock);
+- if (res != 0) {
+- if (res < 0)
+- fib6_walker_unlink(w);
+- goto end;
++ if (res <= 0) {
++ fib6_walker_unlink(w);
++ cb->args[4] = 0;
+ }
+- fib6_walker_unlink(w);
+- cb->args[4] = 0;
+ }
+-end:
++
+ return res;
+ }
+
--- /dev/null
+From 5b019e99016f3a692ba45bf68fba73a402d7c01a Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Thu, 15 Jan 2009 13:51:21 -0800
+Subject: lib/idr.c: use kmem_cache_zalloc() for the idr_layer cache
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 5b019e99016f3a692ba45bf68fba73a402d7c01a upstream.
+
+David points out that the idr_remove_all() function returns unused slabs
+to the kmem cache, but needs to zero them first or else they will be
+uninitialized upon next use. This causes crashes which have been observed
+in the firewire subsystem.
+
+He fixed this by zeroing the object before freeing it in idr_remove_all().
+
+But we agree that simply removing the constructor and zeroing the object
+at allocation time is simpler than relying upon slab constructor machinery
+and might even be faster.
+
+This problem was introduced by "idr: make idr_remove rcu-safe" (commit
+cf481c20c476ad2c0febdace9ce23f5a4db19582), which was first released in
+2.6.27.
+
+There are no known codesites which trigger this bug in 2.6.27 or 2.6.28.
+The post-2.6.28 firewire changes are the only known triggerer.
+
+There might of course be not-yet-discovered triggerers in 2.6.27 and
+2.6.28, and there might be out-of-tree triggerers which are added to those
+kernel versions. I'll let the -stable guys decide whether they want to
+backport this fix.
+
+Reported-by: David Moore <dcm@acm.org>
+Cc: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Cc: Nadia Derbey <Nadia.Derbey@bull.net>
+Cc: Paul E. McKenney <paulmck@us.ibm.com>
+Cc: Manfred Spraul <manfred@colorfullife.com>
+Cc: Kristian Hgsberg <krh@redhat.com>
+Acked-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/idr.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/lib/idr.c
++++ b/lib/idr.c
+@@ -121,7 +121,7 @@ int idr_pre_get(struct idr *idp, gfp_t g
+ {
+ while (idp->id_free_cnt < IDR_FREE_MAX) {
+ struct idr_layer *new;
+- new = kmem_cache_alloc(idr_layer_cache, gfp_mask);
++ new = kmem_cache_zalloc(idr_layer_cache, gfp_mask);
+ if (new == NULL)
+ return (0);
+ move_to_free_list(idp, new);
+@@ -623,16 +623,10 @@ void *idr_replace(struct idr *idp, void
+ }
+ EXPORT_SYMBOL(idr_replace);
+
+-static void idr_cache_ctor(void *idr_layer)
+-{
+- memset(idr_layer, 0, sizeof(struct idr_layer));
+-}
+-
+ void __init idr_init_cache(void)
+ {
+ idr_layer_cache = kmem_cache_create("idr_layer_cache",
+- sizeof(struct idr_layer), 0, SLAB_PANIC,
+- idr_cache_ctor);
++ sizeof(struct idr_layer), 0, SLAB_PANIC, NULL);
+ }
+
+ /**
--- /dev/null
+From 55ef1274dddd4de387c54d110e354ffbb6cdc706 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Sat, 20 Dec 2008 11:58:38 -0800
+Subject: nfsd: Ensure nfsv4 calls the underlying filesystem on LOCKT
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit 55ef1274dddd4de387c54d110e354ffbb6cdc706 upstream.
+
+Since nfsv4 allows LOCKT without an open, but the ->lock() method is a
+file method, we fake up a struct file in the nfsv4 code with just the
+fields we need initialized. But we forgot to initialize the file
+operations, with the result that LOCKT never results in a call to the
+filesystem's ->lock() method (if it exists).
+
+We could just add that one more initialization. But this hack of faking
+up a struct file with only some fields initialized seems the kind of
+thing that might cause more problems in the future. We should either do
+an open and get a real struct file, or make lock-testing an inode (not a
+file) method.
+
+This patch does the former.
+
+Reported-by: Marc Eshel <eshel@almaden.ibm.com>
+Tested-by: Marc Eshel <eshel@almaden.ibm.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+
+---
+ fs/nfsd/nfs4state.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -2769,6 +2769,25 @@ out:
+ }
+
+ /*
++ * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
++ * so we do a temporary open here just to get an open file to pass to
++ * vfs_test_lock. (Arguably perhaps test_lock should be done with an
++ * inode operation.)
++ */
++static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
++{
++ struct file *file;
++ int err;
++
++ err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
++ if (err)
++ return err;
++ err = vfs_test_lock(file, lock);
++ nfsd_close(file);
++ return err;
++}
++
++/*
+ * LOCKT operation
+ */
+ __be32
+@@ -2776,7 +2795,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+ struct nfsd4_lockt *lockt)
+ {
+ struct inode *inode;
+- struct file file;
+ struct file_lock file_lock;
+ int error;
+ __be32 status;
+@@ -2834,16 +2852,8 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+
+ nfs4_transform_lock_offset(&file_lock);
+
+- /* vfs_test_lock uses the struct file _only_ to resolve the inode.
+- * since LOCKT doesn't require an OPEN, and therefore a struct
+- * file may not exist, pass vfs_test_lock a struct file with
+- * only the dentry:inode set.
+- */
+- memset(&file, 0, sizeof (struct file));
+- file.f_path.dentry = cstate->current_fh.fh_dentry;
+-
+ status = nfs_ok;
+- error = vfs_test_lock(&file, &file_lock);
++ error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+ if (error) {
+ status = nfserrno(error);
+ goto out;
--- /dev/null
+From 878e6a432f85690a2c0d88d96f177e54ff1d4a57 Mon Sep 17 00:00:00 2001
+From: Michiel <michiel@ettema.net>
+Date: Sun, 4 Jan 2009 17:22:28 -0600
+Subject: p54usb: Add USB ID for Thomson Speedtouch 121g
+
+From: Michiel <michiel@ettema.net>
+
+commit 878e6a432f85690a2c0d88d96f177e54ff1d4a57 upstream.
+
+Add the USB ID for Thomson Speedtouch 121g to p54usb.
+
+Signed-off-by: Michiel <michiel@ettema.net>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -54,6 +54,7 @@ static struct usb_device_id p54u_table[]
+ {USB_DEVICE(0x050d, 0x7050)}, /* Belkin F5D7050 ver 1000 */
+ {USB_DEVICE(0x0572, 0x2000)}, /* Cohiba Proto board */
+ {USB_DEVICE(0x0572, 0x2002)}, /* Cohiba Proto board */
++ {USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */
+ {USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */
+ {USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */
+ {USB_DEVICE(0x0846, 0x4240)}, /* Netgear WG111 (v2) */
--- /dev/null
+From 46bbdfa44cfc0d352148a0dc33ba9f6db02ccdf0 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Fri, 19 Dec 2008 09:27:42 +0800
+Subject: PCI: keep ASPM link state consistent throughout PCIe hierarchy
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 46bbdfa44cfc0d352148a0dc33ba9f6db02ccdf0 upstream.
+
+In a PCIe hierarchy with a switch present, if the link state of an
+endpoint device is changed, we must check the whole hierarchy from the
+endpoint device to root port, and for each link in the hierarchy, the new
+link state should be configured. Previously, the implementation checked
+the state but forgot to configure the links between root port to switch.
+Fixes Novell bz #448987.
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Tested-by: Andrew Patterson <andrew.patterson@hp.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pcie/aspm.c | 127 ++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 107 insertions(+), 20 deletions(-)
+
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -33,6 +33,11 @@ struct endpoint_state {
+ struct pcie_link_state {
+ struct list_head sibiling;
+ struct pci_dev *pdev;
++ bool downstream_has_switch;
++
++ struct pcie_link_state *parent;
++ struct list_head children;
++ struct list_head link;
+
+ /* ASPM state */
+ unsigned int support_state;
+@@ -125,7 +130,7 @@ static void pcie_set_clock_pm(struct pci
+ link_state->clk_pm_enabled = !!enable;
+ }
+
+-static void pcie_check_clock_pm(struct pci_dev *pdev)
++static void pcie_check_clock_pm(struct pci_dev *pdev, int blacklist)
+ {
+ int pos;
+ u32 reg32;
+@@ -149,10 +154,26 @@ static void pcie_check_clock_pm(struct p
+ if (!(reg16 & PCI_EXP_LNKCTL_CLKREQ_EN))
+ enabled = 0;
+ }
+- link_state->clk_pm_capable = capable;
+ link_state->clk_pm_enabled = enabled;
+ link_state->bios_clk_state = enabled;
+- pcie_set_clock_pm(pdev, policy_to_clkpm_state(pdev));
++ if (!blacklist) {
++ link_state->clk_pm_capable = capable;
++ pcie_set_clock_pm(pdev, policy_to_clkpm_state(pdev));
++ } else {
++ link_state->clk_pm_capable = 0;
++ pcie_set_clock_pm(pdev, 0);
++ }
++}
++
++static bool pcie_aspm_downstream_has_switch(struct pci_dev *pdev)
++{
++ struct pci_dev *child_dev;
++
++ list_for_each_entry(child_dev, &pdev->subordinate->devices, bus_list) {
++ if (child_dev->pcie_type == PCI_EXP_TYPE_UPSTREAM)
++ return true;
++ }
++ return false;
+ }
+
+ /*
+@@ -419,9 +440,9 @@ static unsigned int pcie_aspm_check_stat
+ {
+ struct pci_dev *child_dev;
+
+- /* If no child, disable the link */
++ /* If no child, ignore the link */
+ if (list_empty(&pdev->subordinate->devices))
+- return 0;
++ return state;
+ list_for_each_entry(child_dev, &pdev->subordinate->devices, bus_list) {
+ if (child_dev->pcie_type == PCI_EXP_TYPE_PCI_BRIDGE) {
+ /*
+@@ -462,6 +483,9 @@ static void __pcie_aspm_config_link(stru
+ int valid = 1;
+ struct pcie_link_state *link_state = pdev->link_state;
+
++ /* If no child, disable the link */
++ if (list_empty(&pdev->subordinate->devices))
++ state = 0;
+ /*
+ * if the downstream component has pci bridge function, don't do ASPM
+ * now
+@@ -493,20 +517,52 @@ static void __pcie_aspm_config_link(stru
+ link_state->enabled_state = state;
+ }
+
++static struct pcie_link_state *get_root_port_link(struct pcie_link_state *link)
++{
++ struct pcie_link_state *root_port_link = link;
++ while (root_port_link->parent)
++ root_port_link = root_port_link->parent;
++ return root_port_link;
++}
++
++/* check the whole hierarchy, and configure each link in the hierarchy */
+ static void __pcie_aspm_configure_link_state(struct pci_dev *pdev,
+ unsigned int state)
+ {
+ struct pcie_link_state *link_state = pdev->link_state;
++ struct pcie_link_state *root_port_link = get_root_port_link(link_state);
++ struct pcie_link_state *leaf;
+
+- if (link_state->support_state == 0)
+- return;
+ state &= PCIE_LINK_STATE_L0S|PCIE_LINK_STATE_L1;
+
+- /* state 0 means disabling aspm */
+- state = pcie_aspm_check_state(pdev, state);
++ /* check all links who have specific root port link */
++ list_for_each_entry(leaf, &link_list, sibiling) {
++ if (!list_empty(&leaf->children) ||
++ get_root_port_link(leaf) != root_port_link)
++ continue;
++ state = pcie_aspm_check_state(leaf->pdev, state);
++ }
++ /* check root port link too in case it hasn't children */
++ state = pcie_aspm_check_state(root_port_link->pdev, state);
++
+ if (link_state->enabled_state == state)
+ return;
+- __pcie_aspm_config_link(pdev, state);
++
++ /*
++ * we must change the hierarchy. See comments in
++ * __pcie_aspm_config_link for the order
++ **/
++ if (state & PCIE_LINK_STATE_L1) {
++ list_for_each_entry(leaf, &link_list, sibiling) {
++ if (get_root_port_link(leaf) == root_port_link)
++ __pcie_aspm_config_link(leaf->pdev, state);
++ }
++ } else {
++ list_for_each_entry_reverse(leaf, &link_list, sibiling) {
++ if (get_root_port_link(leaf) == root_port_link)
++ __pcie_aspm_config_link(leaf->pdev, state);
++ }
++ }
+ }
+
+ /*
+@@ -570,6 +626,7 @@ void pcie_aspm_init_link_state(struct pc
+ unsigned int state;
+ struct pcie_link_state *link_state;
+ int error = 0;
++ int blacklist;
+
+ if (aspm_disabled || !pdev->is_pcie || pdev->link_state)
+ return;
+@@ -580,29 +637,58 @@ void pcie_aspm_init_link_state(struct pc
+ if (list_empty(&pdev->subordinate->devices))
+ goto out;
+
+- if (pcie_aspm_sanity_check(pdev))
+- goto out;
++ blacklist = !!pcie_aspm_sanity_check(pdev);
+
+ mutex_lock(&aspm_lock);
+
+ link_state = kzalloc(sizeof(*link_state), GFP_KERNEL);
+ if (!link_state)
+ goto unlock_out;
+- pdev->link_state = link_state;
+
+- pcie_aspm_configure_common_clock(pdev);
+-
+- pcie_aspm_cap_init(pdev);
++ link_state->downstream_has_switch = pcie_aspm_downstream_has_switch(pdev);
++ INIT_LIST_HEAD(&link_state->children);
++ INIT_LIST_HEAD(&link_state->link);
++ if (pdev->bus->self) {/* this is a switch */
++ struct pcie_link_state *parent_link_state;
++
++ parent_link_state = pdev->bus->parent->self->link_state;
++ if (!parent_link_state) {
++ kfree(link_state);
++ goto unlock_out;
++ }
++ list_add(&link_state->link, &parent_link_state->children);
++ link_state->parent = parent_link_state;
++ }
+
+- /* config link state to avoid BIOS error */
+- state = pcie_aspm_check_state(pdev, policy_to_aspm_state(pdev));
+- __pcie_aspm_config_link(pdev, state);
++ pdev->link_state = link_state;
+
+- pcie_check_clock_pm(pdev);
++ if (!blacklist) {
++ pcie_aspm_configure_common_clock(pdev);
++ pcie_aspm_cap_init(pdev);
++ } else {
++ link_state->enabled_state = PCIE_LINK_STATE_L0S|PCIE_LINK_STATE_L1;
++ link_state->bios_aspm_state = 0;
++ /* Set support state to 0, so we will disable ASPM later */
++ link_state->support_state = 0;
++ }
+
+ link_state->pdev = pdev;
+ list_add(&link_state->sibiling, &link_list);
+
++ if (link_state->downstream_has_switch) {
++ /*
++ * If link has switch, delay the link config. The leaf link
++ * initialization will config the whole hierarchy. but we must
++ * make sure BIOS doesn't set unsupported link state
++ **/
++ state = pcie_aspm_check_state(pdev, link_state->bios_aspm_state);
++ __pcie_aspm_config_link(pdev, state);
++ } else
++ __pcie_aspm_configure_link_state(pdev,
++ policy_to_aspm_state(pdev));
++
++ pcie_check_clock_pm(pdev, blacklist);
++
+ unlock_out:
+ if (error)
+ free_link_state(pdev);
+@@ -635,6 +721,7 @@ void pcie_aspm_exit_link_state(struct pc
+ /* All functions are removed, so just disable ASPM for the link */
+ __pcie_aspm_config_one_dev(parent, 0);
+ list_del(&link_state->sibiling);
++ list_del(&link_state->link);
+ /* Clock PM is for endpoint device */
+
+ free_link_state(parent);
--- /dev/null
+From d7273aa0d1317dde4c52d1ba734aedf970e574da Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Tue, 20 Jan 2009 14:08:23 -0800
+Subject: pkt_sched: cls_u32: Fix locking in u32_change()
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+[ Upstream commit: 6f57321422e0d359e83c978c2b03db77b967b7d5 ]
+
+New nodes are inserted in u32_change() under rtnl_lock() with wmb(),
+so without tcf_tree_lock() like in other classifiers (e.g. cls_fw).
+This isn't enough without rmb() on the read side, but on the other
+hand adding such barriers doesn't give any savings, so the lock is
+added instead.
+
+Reported-by: m0sia <m0sia@plotinka.ru>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/cls_u32.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -637,8 +637,9 @@ static int u32_change(struct tcf_proto *
+ break;
+
+ n->next = *ins;
+- wmb();
++ tcf_tree_lock(tp);
+ *ins = n;
++ tcf_tree_unlock(tp);
+
+ *arg = (unsigned long)n;
+ return 0;
--- /dev/null
+From ea9922a627dbb38fdcc42ed1b374a257d0652d35 Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Tue, 20 Jan 2009 14:06:26 -0800
+Subject: pkt_sched: sch_htb: Fix deadlock in hrtimers triggered by HTB
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+[ Upstream commit: none
+
+ This is a quick fix for -stable purposes. Upstream fixes these
+ problems via a large set of invasive hrtimer changes. ]
+
+Most probably there is a (still unproven) race in hrtimers (before
+2.6.29 kernels), which causes a corruption of hrtimers rbtree. This
+patch doesn't fix it, but should let HTB avoid triggering the bug.
+
+Reported-by: Denys Fedoryschenko <denys@visp.net.lb>
+Reported-by: Badalian Vyacheslav <slavon@bigtelecom.ru>
+Reported-by: Chris Caputo <ccaputo@alt.net>
+Tested-by: Badalian Vyacheslav <slavon@bigtelecom.ru>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/sch_htb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -924,6 +924,7 @@ static struct sk_buff *htb_dequeue(struc
+ }
+ }
+ sch->qstats.overlimits++;
++ qdisc_watchdog_cancel(&q->watchdog);
+ qdisc_watchdog_schedule(&q->watchdog, next_event);
+ fin:
+ return skb;
--- /dev/null
+From b1b00c2e699d3905305e130a6fe11bd6efae4506 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Mon, 22 Dec 2008 19:40:38 -0800
+Subject: r6040: bump release number to 0.19
+
+From: Florian Fainelli <florian@openwrt.org>
+
+[ Upstream commit: 4707470ae7441733822efcd680b0ef3971921c4d ]
+
+This patch bumps the release number of the driver.
+
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/r6040.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/r6040.c
++++ b/drivers/net/r6040.c
+@@ -49,8 +49,8 @@
+ #include <asm/processor.h>
+
+ #define DRV_NAME "r6040"
+-#define DRV_VERSION "0.18"
+-#define DRV_RELDATE "13Jul2008"
++#define DRV_VERSION "0.19"
++#define DRV_RELDATE "18Dec2008"
+
+ /* PHY CHIP Address */
+ #define PHY1_ADDR 1 /* For MAC1 */
--- /dev/null
+From 46312f49ee0eca77bdb5cd318109624d2cbd8a01 Mon Sep 17 00:00:00 2001
+From: Joe Chou <Joe.Chou@rdc.com.tw>
+Date: Mon, 22 Dec 2008 19:38:17 -0800
+Subject: r6040: fix wrong logic in mdio code
+
+From: Joe Chou <Joe.Chou@rdc.com.tw>
+
+[ Upstream commit: 11e5e8f5d14a1229706576184d2cf4c4556ed94c ]
+
+This patch fixes a reverse logic in the MDIO code.
+
+Signed-off-by: Joe Chou <Joe.Chou@rdc.com.tw>
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/r6040.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/r6040.c
++++ b/drivers/net/r6040.c
+@@ -214,7 +214,7 @@ static int r6040_phy_read(void __iomem *
+ /* Wait for the read bit to be cleared */
+ while (limit--) {
+ cmd = ioread16(ioaddr + MMDIO);
+- if (cmd & MDIO_READ)
++ if (!(cmd & MDIO_READ))
+ break;
+ }
+
+@@ -233,7 +233,7 @@ static void r6040_phy_write(void __iomem
+ /* Wait for the write bit to be cleared */
+ while (limit--) {
+ cmd = ioread16(ioaddr + MMDIO);
+- if (cmd & MDIO_WRITE)
++ if (!(cmd & MDIO_WRITE))
+ break;
+ }
+ }
--- /dev/null
+From 2008eaf5aba4f7ca31f3d9a6ec1b220af4be04cd Mon Sep 17 00:00:00 2001
+From: Joe Chou <Joe.Chou@rdc.com.tw>
+Date: Mon, 22 Dec 2008 19:40:02 -0800
+Subject: r6040: save and restore MIER correctly in the interrupt routine
+
+From: Joe Chou <Joe.Chou@rdc.com.tw>
+
+[ Upstream commit: 3e7c469f07ff14cbf9a814739e1fc99a863e0943 ]
+
+This patch saves the MIER register contents before treating
+interrupts, then restores them correcty at the end of the
+interrupt routine.
+
+Signed-off-by: Joe Chou <Joe.Chou@rdc.com.tw>
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/r6040.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/r6040.c
++++ b/drivers/net/r6040.c
+@@ -681,8 +681,10 @@ static irqreturn_t r6040_interrupt(int i
+ struct net_device *dev = dev_id;
+ struct r6040_private *lp = netdev_priv(dev);
+ void __iomem *ioaddr = lp->base;
+- u16 status;
++ u16 misr, status;
+
++ /* Save MIER */
++ misr = ioread16(ioaddr + MIER);
+ /* Mask off RDC MAC interrupt */
+ iowrite16(MSK_INT, ioaddr + MIER);
+ /* Read MISR status and clear */
+@@ -702,7 +704,7 @@ static irqreturn_t r6040_interrupt(int i
+ dev->stats.rx_fifo_errors++;
+
+ /* Mask off RX interrupt */
+- iowrite16(ioread16(ioaddr + MIER) & ~RX_INTS, ioaddr + MIER);
++ misr &= ~RX_INTS;
+ netif_rx_schedule(dev, &lp->napi);
+ }
+
+@@ -710,6 +712,9 @@ static irqreturn_t r6040_interrupt(int i
+ if (status & TX_INTS)
+ r6040_tx(dev);
+
++ /* Restore RDC MAC interrupt */
++ iowrite16(misr, ioaddr + MIER);
++
+ return IRQ_HANDLED;
+ }
+
--- /dev/null
+From 3be36ae223271f9c2cfbe7406846c8fdcd2f50c3 Mon Sep 17 00:00:00 2001
+From: Stefan Lippers-Hollmann <s.L-H@gmx.de>
+Date: Sun, 4 Jan 2009 01:10:49 +0100
+Subject: rt2x00: add USB ID for the Linksys WUSB200.
+
+From: Stefan Lippers-Hollmann <s.L-H@gmx.de>
+
+commit 3be36ae223271f9c2cfbe7406846c8fdcd2f50c3 upstream.
+
+add USB ID for the Linksys WUSB200 Wireless-G Business USB Adapter to
+rt73usb.
+
+Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt73usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/rt2x00/rt73usb.c
+@@ -2434,6 +2434,7 @@ static struct usb_device_id rt73usb_devi
+ /* Linksys */
+ { USB_DEVICE(0x13b1, 0x0020), USB_DEVICE_DATA(&rt73usb_ops) },
+ { USB_DEVICE(0x13b1, 0x0023), USB_DEVICE_DATA(&rt73usb_ops) },
++ { USB_DEVICE(0x13b1, 0x0028), USB_DEVICE_DATA(&rt73usb_ops) },
+ /* MSI */
+ { USB_DEVICE(0x0db0, 0x6877), USB_DEVICE_DATA(&rt73usb_ops) },
+ { USB_DEVICE(0x0db0, 0x6874), USB_DEVICE_DATA(&rt73usb_ops) },
--- /dev/null
+From e17036dac189dd034c092a91df56aa740db7146d Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Thu, 15 Jan 2009 14:53:39 +0100
+Subject: sched: fix update_min_vruntime
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit e17036dac189dd034c092a91df56aa740db7146d upstream.
+
+Impact: fix SCHED_IDLE latency problems
+
+OK, so we have 1 running task A (which is obviously curr and the tree is
+equally obviously empty).
+
+'A' nicely chugs along, doing its thing, carrying min_vruntime along as it
+goes.
+
+Then some whacko speed freak SCHED_IDLE task gets inserted due to SMP
+balancing, which is very likely far right, in that case
+
+update_curr
+ update_min_vruntime
+ cfs_rq->rb_leftmost := true (the crazy task sitting in a tree)
+ vruntime = se->vruntime
+
+and voila, min_vruntime is waaay right of where it ought to be.
+
+OK, so why did I write it like that to begin with...
+
+Aah, yes.
+
+Say we've just dequeued current
+
+schedule
+ deactivate_task(prev)
+ dequeue_entity
+ update_min_vruntime
+
+Then we'll set
+
+ vruntime = cfs_rq->min_vruntime;
+
+we find !cfs_rq->curr, but do find someone in the tree. Then we _must_
+do vruntime = se->vruntime, because
+
+ vruntime = min_vruntime(vruntime := cfs_rq->min_vruntime, se->vruntime)
+
+will not advance vruntime, and cause lags the other way around (which we
+fixed with that initial patch: 1af5f730fc1bf7c62ec9fb2d307206e18bf40a69
+(sched: more accurate min_vruntime accounting).
+
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Tested-by: Mike Galbraith <efault@gmx.de>
+Acked-by: Mike Galbraith <efault@gmx.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched_fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -283,7 +283,7 @@ static void update_min_vruntime(struct c
+ struct sched_entity,
+ run_node);
+
+- if (vruntime == cfs_rq->min_vruntime)
++ if (!cfs_rq->curr)
+ vruntime = se->vruntime;
+ else
+ vruntime = min_vruntime(vruntime, se->vruntime);
--- /dev/null
+From 3d41c2bd66b1618aa1062c3d98450a9a5f0d119e Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+Date: Tue, 20 Jan 2009 14:08:01 -0800
+Subject: sctp: Avoid memory overflow while FWD-TSN chunk is received with bad stream ID
+
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+
+[ Upstream commit: 9fcb95a105758b81ef0131cd18e2db5149f13e95 ]
+
+If FWD-TSN chunk is received with bad stream ID, the sctp will not do the
+validity check, this may cause memory overflow when overwrite the TSN of
+the stream ID.
+
+The FORWARD-TSN chunk is like this:
+
+FORWARD-TSN chunk
+ Type = 192
+ Flags = 0
+ Length = 172
+ NewTSN = 99
+ Stream = 10000
+ StreamSequence = 0xFFFF
+
+This patch fix this problem by discard the chunk if stream ID is not
+less than MIS.
+
+Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
+Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sctp/sm_statefuns.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -3691,6 +3691,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(c
+ {
+ struct sctp_chunk *chunk = arg;
+ struct sctp_fwdtsn_hdr *fwdtsn_hdr;
++ struct sctp_fwdtsn_skip *skip;
+ __u16 len;
+ __u32 tsn;
+
+@@ -3720,6 +3721,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(c
+ if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
+ goto discard_noforce;
+
++ /* Silently discard the chunk if stream-id is not valid */
++ sctp_walk_fwdtsn(skip, chunk) {
++ if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
++ goto discard_noforce;
++ }
++
+ sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
+ if (len > sizeof(struct sctp_fwdtsn_hdr))
+ sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
+@@ -3751,6 +3758,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_f
+ {
+ struct sctp_chunk *chunk = arg;
+ struct sctp_fwdtsn_hdr *fwdtsn_hdr;
++ struct sctp_fwdtsn_skip *skip;
+ __u16 len;
+ __u32 tsn;
+
+@@ -3780,6 +3788,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_f
+ if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
+ goto gen_shutdown;
+
++ /* Silently discard the chunk if stream-id is not valid */
++ sctp_walk_fwdtsn(skip, chunk) {
++ if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
++ goto gen_shutdown;
++ }
++
+ sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
+ if (len > sizeof(struct sctp_fwdtsn_hdr))
+ sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
--- /dev/null
+From 0d54ee1c7850a954026deec4cd4885f331da35cc Mon Sep 17 00:00:00 2001
+From: Vegard Nossum <vegard.nossum@gmail.com>
+Date: Sat, 17 Jan 2009 17:45:45 +0100
+Subject: security: introduce missing kfree
+
+From: Vegard Nossum <vegard.nossum@gmail.com>
+
+commit 0d54ee1c7850a954026deec4cd4885f331da35cc upstream.
+
+Plug this leak.
+
+Acked-by: David Howells <dhowells@redhat.com>
+Cc: James Morris <jmorris@namei.org>
+Signed-off-by: Vegard Nossum <vegard.nossum@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/keys/keyctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -270,6 +270,7 @@ long keyctl_join_session_keyring(const c
+
+ /* join the session */
+ ret = join_session_keyring(name);
++ kfree(name);
+
+ error:
+ return ret;
--- /dev/null
+nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
+pci-keep-aspm-link-state-consistent-throughout-pcie-hierarchy.patch
+security-introduce-missing-kfree.patch
+rt2x00-add-usb-id-for-the-linksys-wusb200.patch
+p54usb-add-usb-id-for-thomson-speedtouch-121g.patch
+lib-idr.c-use-kmem_cache_zalloc-for-the-idr_layer-cache.patch
+sgi-xp-eliminate-false-detection-of-no-heartbeat.patch
+sched-fix-update_min_vruntime.patch
+ia64-turn-on-config_have_unstable_clock.patch
+sound-virtuoso-do-not-overwrite-eeprom-on-xonar-d2-d2x.patch
+alsa-hda-add-quirk-for-another-hp-dv5.patch
+alsa-hda-fix-hp-dv5-mic-input.patch
+alsa-hda-add-automatic-model-setting-for-samsung-q45.patch
+alsa-hda-don-t-reset-hp-pinctl-in-patch_sigmatel.c.patch
+alsa-hda-make-laptop-eapd-model-back-for-ad1986a.patch
+drivers-net-irda-irda-usb.c-fix-buffer-overflow.patch
+usb-storage-add-last-sector-hacks.patch
+usb-storage-set-capacity_heuristics-flag-for-bad-vendors.patch
+pkt_sched-sch_htb-fix-deadlock-in-hrtimers-triggered-by-htb.patch
+ipv6-fix-fib6_dump_table-walker-leak.patch
+sctp-avoid-memory-overflow-while-fwd-tsn-chunk-is-received-with-bad-stream-id.patch
+pkt_sched-cls_u32-fix-locking-in-u32_change.patch
+r6040-fix-wrong-logic-in-mdio-code.patch
+r6040-save-and-restore-mier-correctly-in-the-interrupt-routine.patch
+r6040-bump-release-number-to-0.19.patch
+tcp-don-t-mask-eof-and-socket-errors-on-nonblocking-splice-receive.patch
--- /dev/null
+From 158bc69effbf96f59c01cdeb20f8d4c184e59f8e Mon Sep 17 00:00:00 2001
+From: Dean Nelson <dcn@sgi.com>
+Date: Thu, 15 Jan 2009 13:50:57 -0800
+Subject: sgi-xp: eliminate false detection of no heartbeat
+
+From: Dean Nelson <dcn@sgi.com>
+
+commit 158bc69effbf96f59c01cdeb20f8d4c184e59f8e upstream.
+
+After XPC has been up and running on multiple partitions for any length of
+time, if XPC on one of the partitions is stopped and restarted (either by
+a rmmod/insmod or a system restart), it is possible for the XPCs running
+on the other partitions to falsely detect a lack of heartbeat from the XPC
+that was just restarted. This false detection will occur if the restarted
+XPC comes up within the five-seconds preceding one of the other XPC's
+heartbeat check (which occurs once every twenty seconds).
+
+The detection of no heartbeat results in the detecting XPC deactivating
+from the just restarted XPC. The only remedy is to restart one of the
+XPCs and hope that one doesn't hit this five-second window on any of the
+other partitions.
+
+Signed-off-by: Dean Nelson <dcn@sgi.com>
+Signed-off-by: Robin Holt <holt@sgi.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/sgi-xp/xpc_sn2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/sgi-xp/xpc_sn2.c
++++ b/drivers/misc/sgi-xp/xpc_sn2.c
+@@ -904,7 +904,7 @@ xpc_update_partition_info_sn2(struct xpc
+ dev_dbg(xpc_part, " remote_vars_pa = 0x%016lx\n",
+ part_sn2->remote_vars_pa);
+
+- part->last_heartbeat = remote_vars->heartbeat;
++ part->last_heartbeat = remote_vars->heartbeat - 1;
+ dev_dbg(xpc_part, " last_heartbeat = 0x%016lx\n",
+ part->last_heartbeat);
+
--- /dev/null
+From 7e86c0e6850504ec9516b953f316a47277825e33 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Thu, 15 Jan 2009 10:21:23 +0100
+Subject: sound: virtuoso: do not overwrite EEPROM on Xonar D2/D2X
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 7e86c0e6850504ec9516b953f316a47277825e33 upstream.
+
+On the Asus Xonar D2 and D2X models, the SPI chip select signal for the
+fourth DAC shares its pin with the serial clock for the EEPROM that
+contains the PCI subdevice ID values. It appears that when DAC
+registers are written and some other unknown conditions occur (probably
+noise on the EEPROM's chip select line), the EEPROM gets overwritten
+with garbage, which makes it impossible to properly detect the card
+later.
+
+Therefore, we better avoid DAC register writes and make sure that the
+driver works with the DAC's registers' default values. Consequently,
+the sample format is now I2S instead of left-justified (no user-visible
+change), and the DAC's volume/mute registers cannot be used anymore
+(volume changes are now done by the software volume plugin).
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/virtuoso.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/oxygen/virtuoso.c
++++ b/sound/pci/oxygen/virtuoso.c
+@@ -26,7 +26,7 @@
+ * SPI 0 -> 1st PCM1796 (front)
+ * SPI 1 -> 2nd PCM1796 (surround)
+ * SPI 2 -> 3rd PCM1796 (center/LFE)
+- * SPI 4 -> 4th PCM1796 (back)
++ * SPI 4 -> 4th PCM1796 (back) and EEPROM self-destruct (do not use!)
+ *
+ * GPIO 2 -> M0 of CS5381
+ * GPIO 3 -> M1 of CS5381
+@@ -207,6 +207,12 @@ static void xonar_gpio_changed(struct ox
+ static inline void pcm1796_write_spi(struct oxygen *chip, unsigned int codec,
+ u8 reg, u8 value)
+ {
++ /*
++ * We don't want to do writes on SPI 4 because the EEPROM, which shares
++ * the same pin, might get confused and broken. We'd better take care
++ * that the driver works with the default register values ...
++ */
++#if 0
+ /* maps ALSA channel pair number to SPI output */
+ static const u8 codec_map[4] = {
+ 0, 1, 2, 4
+@@ -217,6 +223,7 @@ static inline void pcm1796_write_spi(str
+ (codec_map[codec] << OXYGEN_SPI_CODEC_SHIFT) |
+ OXYGEN_SPI_CEN_LATCH_CLOCK_HI,
+ (reg << 8) | value);
++#endif
+ }
+
+ static inline void pcm1796_write_i2c(struct oxygen *chip, unsigned int codec,
+@@ -750,6 +757,9 @@ static const DECLARE_TLV_DB_SCALE(cs4362
+
+ static int xonar_d2_control_filter(struct snd_kcontrol_new *template)
+ {
++ if (!strncmp(template->name, "Master Playback ", 16))
++ /* disable volume/mute because they would require SPI writes */
++ return 1;
+ if (!strncmp(template->name, "CD Capture ", 11))
+ /* CD in is actually connected to the video in pin */
+ template->private_value ^= AC97_CD ^ AC97_VIDEO;
+@@ -840,9 +850,8 @@ static const struct oxygen_model model_x
+ .dac_volume_min = 0x0f,
+ .dac_volume_max = 0xff,
+ .misc_flags = OXYGEN_MISC_MIDI,
+- .function_flags = OXYGEN_FUNCTION_SPI |
+- OXYGEN_FUNCTION_ENABLE_SPI_4_5,
+- .dac_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
++ .function_flags = OXYGEN_FUNCTION_SPI,
++ .dac_i2s_format = OXYGEN_I2S_FORMAT_I2S,
+ .adc_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
+ };
+
--- /dev/null
+From db76deb171d8ba2e30ab4928863d1ac59b186f97 Mon Sep 17 00:00:00 2001
+From: Lennert Buytenhek <buytenh@marvell.com>
+Date: Tue, 20 Jan 2009 15:25:21 -0800
+Subject: tcp: don't mask EOF and socket errors on nonblocking splice receive
+
+From: Lennert Buytenhek <buytenh@marvell.com>
+
+[ Upstream commit: 4f7d54f59bc470f0aaa932f747a95232d7ebf8b1 ]
+
+Currently, setting SPLICE_F_NONBLOCK on splice from a TCP socket
+results in masking of EOF (RDHUP) and error conditions on the socket
+by an -EAGAIN return. Move the NONBLOCK check in tcp_splice_read()
+to be after the EOF and error checks to fix this.
+
+Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -578,10 +578,6 @@ ssize_t tcp_splice_read(struct socket *s
+ else if (!ret) {
+ if (spliced)
+ break;
+- if (flags & SPLICE_F_NONBLOCK) {
+- ret = -EAGAIN;
+- break;
+- }
+ if (sock_flag(sk, SOCK_DONE))
+ break;
+ if (sk->sk_err) {
+@@ -599,6 +595,10 @@ ssize_t tcp_splice_read(struct socket *s
+ ret = -ENOTCONN;
+ break;
+ }
++ if (flags & SPLICE_F_NONBLOCK) {
++ ret = -EAGAIN;
++ break;
++ }
+ if (!timeo) {
+ ret = -EAGAIN;
+ break;
--- /dev/null
+From stern@rowland.harvard.edu Thu Jan 22 11:18:30 2009
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 20 Jan 2009 15:33:26 -0500 (EST)
+Subject: usb-storage: add last-sector hacks
+To: Greg KH <greg@kroah.com>
+Cc: stable@kernel.org, USB Storage list <usb-storage@lists.one-eyed-alien.net>
+Message-ID: <Pine.LNX.4.44L0.0901201525420.2260-100000@iolanthe.rowland.org>
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 25ff1c316f6a763f1eefe7f8984b2d8c03888432 upstream.
+
+This patch (as1189c) adds some hacks to usb-storage for dealing with
+the growing problems involving bad capacity values and last-sector
+accesses:
+
+ A new flag, US_FL_CAPACITY_OK, is created to indicate that
+ the device is known to report its capacity correctly. An
+ unusual_devs entry for Linux's own File-backed Storage Gadget
+ is added with this flag set, since g_file_storage always
+ reports the correct capacity and since the capacity need
+ not be even (it is determined by the size of the backing
+ file).
+
+ An entry in unusual_devs.h which has only the CAPACITY_OK
+ flag set shouldn't prejudice libusual, since the device will
+ work perfectly well with either usb-storage or ub. So a
+ new macro, COMPLIANT_DEV, is added to let libusual know
+ about these entries.
+
+ When a last-sector access fails three times in a row and
+ neither the FIX_CAPACITY nor the CAPACITY_OK flag is set,
+ we assume the last-sector bug is present. We replace the
+ existing status and sense data with values that will cause
+ the SCSI core to fail the access immediately rather than
+ retry indefinitely. This should fix the difficulties
+ people have been having with Nokia phones.
+
+This version of the patch differs from the version accepted into the
+mainline only in that it does not trigger a WARN() when an
+odd-numbered last-sector access succeeds. In a stable kernel series
+we don't want to go around spamming users' logs and consoles for no
+good reason.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/libusual.c | 7 +++
+ drivers/usb/storage/scsiglue.c | 8 +++
+ drivers/usb/storage/transport.c | 80 +++++++++++++++++++++++++++++++++++++
+ drivers/usb/storage/unusual_devs.h | 16 ++++++-
+ drivers/usb/storage/usb.c | 6 ++
+ drivers/usb/storage/usb.h | 4 +
+ include/linux/usb_usual.h | 5 +-
+ 7 files changed, 123 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/storage/libusual.c
++++ b/drivers/usb/storage/libusual.c
+@@ -46,6 +46,12 @@ static int usu_probe_thread(void *arg);
+ { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin,bcdDeviceMax), \
+ .driver_info = (flags)|(USB_US_TYPE_STOR<<24) }
+
++#define COMPLIANT_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
++ vendorName, productName, useProtocol, useTransport, \
++ initFunction, flags) \
++{ USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
++ .driver_info = (flags) }
++
+ #define USUAL_DEV(useProto, useTrans, useType) \
+ { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, useProto, useTrans), \
+ .driver_info = ((useType)<<24) }
+@@ -57,6 +63,7 @@ struct usb_device_id storage_usb_ids []
+
+ #undef USUAL_DEV
+ #undef UNUSUAL_DEV
++#undef COMPLIANT_DEV
+
+ MODULE_DEVICE_TABLE(usb, storage_usb_ids);
+ EXPORT_SYMBOL_GPL(storage_usb_ids);
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -196,6 +196,14 @@ static int slave_configure(struct scsi_d
+ * sector in a larger then 1 sector read, since the performance
+ * impact is negible we set this flag for all USB disks */
+ sdev->last_sector_bug = 1;
++
++ /* Enable last-sector hacks for single-target devices using
++ * the Bulk-only transport, unless we already know the
++ * capacity will be decremented or is correct. */
++ if (!(us->fflags & (US_FL_FIX_CAPACITY | US_FL_CAPACITY_OK |
++ US_FL_SCM_MULT_TARG)) &&
++ us->protocol == US_PR_BULK)
++ us->use_last_sector_hacks = 1;
+ } else {
+
+ /* Non-disk-type devices don't need to blacklist any pages
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -57,6 +57,9 @@
+ #include "scsiglue.h"
+ #include "debug.h"
+
++#include <linux/blkdev.h>
++#include "../../scsi/sd.h"
++
+
+ /***********************************************************************
+ * Data transfer routines
+@@ -511,6 +514,80 @@ int usb_stor_bulk_transfer_sg(struct us_
+ * Transport routines
+ ***********************************************************************/
+
++/* There are so many devices that report the capacity incorrectly,
++ * this routine was written to counteract some of the resulting
++ * problems.
++ */
++static void last_sector_hacks(struct us_data *us, struct scsi_cmnd *srb)
++{
++ struct gendisk *disk;
++ struct scsi_disk *sdkp;
++ u32 sector;
++
++ /* To Report "Medium Error: Record Not Found */
++ static unsigned char record_not_found[18] = {
++ [0] = 0x70, /* current error */
++ [2] = MEDIUM_ERROR, /* = 0x03 */
++ [7] = 0x0a, /* additional length */
++ [12] = 0x14 /* Record Not Found */
++ };
++
++ /* If last-sector problems can't occur, whether because the
++ * capacity was already decremented or because the device is
++ * known to report the correct capacity, then we don't need
++ * to do anything.
++ */
++ if (!us->use_last_sector_hacks)
++ return;
++
++ /* Was this command a READ(10) or a WRITE(10)? */
++ if (srb->cmnd[0] != READ_10 && srb->cmnd[0] != WRITE_10)
++ goto done;
++
++ /* Did this command access the last sector? */
++ sector = (srb->cmnd[2] << 24) | (srb->cmnd[3] << 16) |
++ (srb->cmnd[4] << 8) | (srb->cmnd[5]);
++ disk = srb->request->rq_disk;
++ if (!disk)
++ goto done;
++ sdkp = scsi_disk(disk);
++ if (!sdkp)
++ goto done;
++ if (sector + 1 != sdkp->capacity)
++ goto done;
++
++ if (srb->result == SAM_STAT_GOOD && scsi_get_resid(srb) == 0) {
++
++ /* The command succeeded. We know this device doesn't
++ * have the last-sector bug, so stop checking it.
++ */
++ us->use_last_sector_hacks = 0;
++
++ } else {
++ /* The command failed. Allow up to 3 retries in case this
++ * is some normal sort of failure. After that, assume the
++ * capacity is wrong and we're trying to access the sector
++ * beyond the end. Replace the result code and sense data
++ * with values that will cause the SCSI core to fail the
++ * command immediately, instead of going into an infinite
++ * (or even just a very long) retry loop.
++ */
++ if (++us->last_sector_retries < 3)
++ return;
++ srb->result = SAM_STAT_CHECK_CONDITION;
++ memcpy(srb->sense_buffer, record_not_found,
++ sizeof(record_not_found));
++ }
++
++ done:
++ /* Don't reset the retry counter for TEST UNIT READY commands,
++ * because they get issued after device resets which might be
++ * caused by a failed last-sector access.
++ */
++ if (srb->cmnd[0] != TEST_UNIT_READY)
++ us->last_sector_retries = 0;
++}
++
+ /* Invoke the transport and basic error-handling/recovery methods
+ *
+ * This is used by the protocol layers to actually send the message to
+@@ -544,6 +621,7 @@ void usb_stor_invoke_transport(struct sc
+ /* if the transport provided its own sense data, don't auto-sense */
+ if (result == USB_STOR_TRANSPORT_NO_SENSE) {
+ srb->result = SAM_STAT_CHECK_CONDITION;
++ last_sector_hacks(us, srb);
+ return;
+ }
+
+@@ -667,6 +745,7 @@ void usb_stor_invoke_transport(struct sc
+ scsi_bufflen(srb) - scsi_get_resid(srb) < srb->underflow)
+ srb->result = (DID_ERROR << 16) | (SUGGEST_RETRY << 24);
+
++ last_sector_hacks(us, srb);
+ return;
+
+ /* Error and abort processing: try to resynchronize with the device
+@@ -694,6 +773,7 @@ void usb_stor_invoke_transport(struct sc
+ us->transport_reset(us);
+ }
+ clear_bit(US_FLIDX_RESETTING, &us->dflags);
++ last_sector_hacks(us, srb);
+ }
+
+ /* Stop the current URB transfer */
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -27,7 +27,8 @@
+
+ /* IMPORTANT NOTE: This file must be included in another file which does
+ * the following thing for it to work:
+- * The macro UNUSUAL_DEV() must be defined before this file is included
++ * The UNUSUAL_DEV, COMPLIANT_DEV, and USUAL_DEV macros must be defined
++ * before this file is included.
+ */
+
+ /* If you edit this file, please try to keep it sorted first by VendorID,
+@@ -46,6 +47,12 @@
+ * <usb-storage@lists.one-eyed-alien.net>
+ */
+
++/* Note: If you add an entry only in order to set the CAPACITY_OK flag,
++ * use the COMPLIANT_DEV macro instead of UNUSUAL_DEV. This is
++ * because such entries mark devices which actually work correctly,
++ * as opposed to devices that do something strangely or wrongly.
++ */
++
+ /* patch submitted by Vivian Bregier <Vivian.Bregier@imag.fr>
+ */
+ UNUSUAL_DEV( 0x03eb, 0x2002, 0x0100, 0x0100,
+@@ -692,6 +699,13 @@ UNUSUAL_DEV( 0x0525, 0xa140, 0x0100, 0x
+ US_SC_8070, US_PR_DEVICE, NULL,
+ US_FL_FIX_INQUIRY ),
+
++/* Added by Alan Stern <stern@rowland.harvard.edu> */
++COMPLIANT_DEV(0x0525, 0xa4a5, 0x0000, 0x9999,
++ "Linux",
++ "File-backed Storage Gadget",
++ US_SC_DEVICE, US_PR_DEVICE, NULL,
++ US_FL_CAPACITY_OK ),
++
+ /* Yakumo Mega Image 37
+ * Submitted by Stephan Fuhrmann <atomenergie@t-online.de> */
+ UNUSUAL_DEV( 0x052b, 0x1801, 0x0100, 0x0100,
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -126,6 +126,8 @@ MODULE_PARM_DESC(delay_use, "seconds to
+ { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin,bcdDeviceMax), \
+ .driver_info = (flags)|(USB_US_TYPE_STOR<<24) }
+
++#define COMPLIANT_DEV UNUSUAL_DEV
++
+ #define USUAL_DEV(useProto, useTrans, useType) \
+ { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, useProto, useTrans), \
+ .driver_info = (USB_US_TYPE_STOR<<24) }
+@@ -134,6 +136,7 @@ static struct usb_device_id storage_usb_
+
+ # include "unusual_devs.h"
+ #undef UNUSUAL_DEV
++#undef COMPLIANT_DEV
+ #undef USUAL_DEV
+ /* Terminating entry */
+ { }
+@@ -164,6 +167,8 @@ MODULE_DEVICE_TABLE (usb, storage_usb_id
+ .initFunction = init_function, \
+ }
+
++#define COMPLIANT_DEV UNUSUAL_DEV
++
+ #define USUAL_DEV(use_protocol, use_transport, use_type) \
+ { \
+ .useProtocol = use_protocol, \
+@@ -173,6 +178,7 @@ MODULE_DEVICE_TABLE (usb, storage_usb_id
+ static struct us_unusual_dev us_unusual_dev_list[] = {
+ # include "unusual_devs.h"
+ # undef UNUSUAL_DEV
++# undef COMPLIANT_DEV
+ # undef USUAL_DEV
+
+ /* Terminating entry */
+--- a/drivers/usb/storage/usb.h
++++ b/drivers/usb/storage/usb.h
+@@ -155,6 +155,10 @@ struct us_data {
+ #ifdef CONFIG_PM
+ pm_hook suspend_resume_hook;
+ #endif
++
++ /* hacks for READ CAPACITY bug handling */
++ int use_last_sector_hacks;
++ int last_sector_retries;
+ };
+
+ /* Convert between us_data and the corresponding Scsi_Host */
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -52,8 +52,9 @@
+ US_FLAG(MAX_SECTORS_MIN,0x00002000) \
+ /* Sets max_sectors to arch min */ \
+ US_FLAG(BULK_IGNORE_TAG,0x00004000) \
+- /* Ignore tag mismatch in bulk operations */
+-
++ /* Ignore tag mismatch in bulk operations */ \
++ US_FLAG(CAPACITY_OK, 0x00010000) \
++ /* READ CAPACITY response is correct */
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
--- /dev/null
+From stern@rowland.harvard.edu Thu Jan 22 11:19:25 2009
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 20 Jan 2009 15:33:34 -0500 (EST)
+Subject: usb-storage: set CAPACITY_HEURISTICS flag for bad vendors
+To: Greg KH <greg@kroah.com>
+Cc: USB Storage list <usb-storage@lists.one-eyed-alien.net>, stable@kernel.org
+Message-ID: <Pine.LNX.4.44L0.0901201529180.2260-100000@iolanthe.rowland.org>
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit a81a81a25d3ecdab777abca87c5ddf484056103d upstream.
+
+This patch (as1194b) makes usb-storage set the CAPACITY_HEURISTICS flag
+for all devices made by Nokia, Nikon, or Motorola. These companies
+seem to include the READ CAPACITY bug in all of their devices.
+
+Since cell phones and digital cameras rely on flash storage, which
+always has an even number of sectors, setting CAPACITY_HEURISTICS
+shouldn't cause any problems. Not even if the companies wise up and
+start making devices without the bug.
+
+A large number of unusual_devs entries are now unnecessary, so the
+patch removes them.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/scsiglue.c | 23 +++++
+ drivers/usb/storage/unusual_devs.h | 162 -------------------------------------
+ 2 files changed, 23 insertions(+), 162 deletions(-)
+
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -59,6 +59,13 @@
+ #include "transport.h"
+ #include "protocol.h"
+
++/* Vendor IDs for companies that seem to include the READ CAPACITY bug
++ * in all their devices
++ */
++#define VENDOR_ID_NOKIA 0x0421
++#define VENDOR_ID_NIKON 0x04b0
++#define VENDOR_ID_MOTOROLA 0x22b8
++
+ /***********************************************************************
+ * Host functions
+ ***********************************************************************/
+@@ -134,6 +141,22 @@ static int slave_configure(struct scsi_d
+ * settings can't be overridden via the scsi devinfo mechanism. */
+ if (sdev->type == TYPE_DISK) {
+
++ /* Some vendors seem to put the READ CAPACITY bug into
++ * all their devices -- primarily makers of cell phones
++ * and digital cameras. Since these devices always use
++ * flash media and can be expected to have an even number
++ * of sectors, we will always enable the CAPACITY_HEURISTICS
++ * flag unless told otherwise. */
++ switch (le16_to_cpu(us->pusb_dev->descriptor.idVendor)) {
++ case VENDOR_ID_NOKIA:
++ case VENDOR_ID_NIKON:
++ case VENDOR_ID_MOTOROLA:
++ if (!(us->fflags & (US_FL_FIX_CAPACITY |
++ US_FL_CAPACITY_OK)))
++ us->fflags |= US_FL_CAPACITY_HEURISTICS;
++ break;
++ }
++
+ /* Disk-type devices use MODE SENSE(6) if the protocol
+ * (SubClass) is Transparent SCSI, otherwise they use
+ * MODE SENSE(10). */
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -167,34 +167,6 @@ UNUSUAL_DEV( 0x0421, 0x0019, 0x0592, 0x
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64 ),
+
+-/* Reported by Filip Joelsson <filip@blueturtle.nu> */
+-UNUSUAL_DEV( 0x0421, 0x005d, 0x0001, 0x0600,
+- "Nokia",
+- "Nokia 3110c",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY ),
+-
+-/* Reported by Ozan Sener <themgzzy@gmail.com> */
+-UNUSUAL_DEV( 0x0421, 0x0060, 0x0551, 0x0551,
+- "Nokia",
+- "3500c",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY ),
+-
+-/* Reported by CSECSY Laszlo <boobaa@frugalware.org> */
+-UNUSUAL_DEV( 0x0421, 0x0063, 0x0001, 0x0601,
+- "Nokia",
+- "Nokia 3109c",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY ),
+-
+-/* Patch for Nokia 5310 capacity */
+-UNUSUAL_DEV( 0x0421, 0x006a, 0x0000, 0x0701,
+- "Nokia",
+- "5310",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY ),
+-
+ /* Reported by Mario Rettig <mariorettig@web.de> */
+ UNUSUAL_DEV( 0x0421, 0x042e, 0x0100, 0x0100,
+ "Nokia",
+@@ -260,42 +232,6 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64 ),
+
+-/* Reported by Cedric Godin <cedric@belbone.be> */
+-UNUSUAL_DEV( 0x0421, 0x04b9, 0x0500, 0x0551,
+- "Nokia",
+- "5300",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY ),
+-
+-/* Reported by Paulo Fessel <pfessel@gmail.com> */
+-UNUSUAL_DEV( 0x0421, 0x04bd, 0x0000, 0x9999,
+- "Nokia",
+- "5200",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY ),
+-
+-/* Reported by Richard Nauber <RichardNauber@web.de> */
+-UNUSUAL_DEV( 0x0421, 0x04fa, 0x0550, 0x0660,
+- "Nokia",
+- "6300",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY ),
+-
+-/* Patch for Nokia 5310 capacity */
+-UNUSUAL_DEV( 0x0421, 0x006a, 0x0000, 0x0591,
+- "Nokia",
+- "5310",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY ),
+-
+-/* Submitted by Ricky Wong Yung Fei <evilbladewarrior@gmail.com> */
+-/* Nokia 7610 Supernova - Too many sectors reported in usb storage mode */
+-UNUSUAL_DEV( 0x0421, 0x00f5, 0x0000, 0x0470,
+- "Nokia",
+- "7610 Supernova",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY ),
+-
+ /* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
+ UNUSUAL_DEV( 0x0424, 0x0fdc, 0x0210, 0x0210,
+ "SMSC",
+@@ -410,83 +346,6 @@ UNUSUAL_DEV( 0x04b0, 0x0301, 0x0010, 0x
+ US_SC_DEVICE, US_PR_DEVICE,NULL,
+ US_FL_NOT_LOCKABLE ),
+
+-/* Reported by Stefan de Konink <skinkie@xs4all.nl> */
+-UNUSUAL_DEV( 0x04b0, 0x0401, 0x0200, 0x0200,
+- "NIKON",
+- "NIKON DSC D100",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by Tobias Kunze Briseno <t-linux@fictive.com> */
+-UNUSUAL_DEV( 0x04b0, 0x0403, 0x0200, 0x0200,
+- "NIKON",
+- "NIKON DSC D2H",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by Milinevsky Dmitry <niam.niam@gmail.com> */
+-UNUSUAL_DEV( 0x04b0, 0x0409, 0x0100, 0x0100,
+- "NIKON",
+- "NIKON DSC D50",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by Andreas Bockhold <andreas@bockionline.de> */
+-UNUSUAL_DEV( 0x04b0, 0x0405, 0x0100, 0x0100,
+- "NIKON",
+- "NIKON DSC D70",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by Jamie Kitson <jamie@staberinde.fsnet.co.uk> */
+-UNUSUAL_DEV( 0x04b0, 0x040d, 0x0100, 0x0100,
+- "NIKON",
+- "NIKON DSC D70s",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by Graber and Mike Pagano <mpagano-kernel@mpagano.com> */
+-UNUSUAL_DEV( 0x04b0, 0x040f, 0x0100, 0x0200,
+- "NIKON",
+- "NIKON DSC D200",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by Emil Larsson <emil@swip.net> */
+-UNUSUAL_DEV( 0x04b0, 0x0411, 0x0100, 0x0111,
+- "NIKON",
+- "NIKON DSC D80",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by Ortwin Glueck <odi@odi.ch> */
+-UNUSUAL_DEV( 0x04b0, 0x0413, 0x0110, 0x0111,
+- "NIKON",
+- "NIKON DSC D40",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by Paul Check <paul@openstreet.com> */
+-UNUSUAL_DEV( 0x04b0, 0x0415, 0x0100, 0x0100,
+- "NIKON",
+- "NIKON DSC D2Xs",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by Shan Destromp (shansan@gmail.com) */
+-UNUSUAL_DEV( 0x04b0, 0x0417, 0x0100, 0x0100,
+- "NIKON",
+- "NIKON DSC D40X",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/* Reported by paul ready <lxtwin@homecall.co.uk> */
+-UNUSUAL_DEV( 0x04b0, 0x0419, 0x0100, 0x0200,
+- "NIKON",
+- "NIKON DSC D300",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+ /* Reported by Doug Maxey (dwm@austin.ibm.com) */
+ UNUSUAL_DEV( 0x04b3, 0x4001, 0x0110, 0x0110,
+ "IBM",
+@@ -2121,27 +1980,6 @@ UNUSUAL_DEV( 0x22b8, 0x3010, 0x0001, 0x
+ US_FL_FIX_CAPACITY | US_FL_IGNORE_RESIDUE ),
+
+ /*
+- * Patch by Pete Zaitcev <zaitcev@redhat.com>
+- * Report by Mark Patton. Red Hat bz#208928.
+- * Added support for rev 0x0002 (Motorola ROKR W5)
+- * by Javier Smaldone <javier@smaldone.com.ar>
+- */
+-UNUSUAL_DEV( 0x22b8, 0x4810, 0x0001, 0x0002,
+- "Motorola",
+- "RAZR V3i/ROKR W5",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/*
+- * Patch by Jost Diederichs <jost@qdusa.com>
+- */
+-UNUSUAL_DEV(0x22b8, 0x6410, 0x0001, 0x9999,
+- "Motorola Inc.",
+- "Motorola Phone (RAZRV3xx)",
+- US_SC_DEVICE, US_PR_DEVICE, NULL,
+- US_FL_FIX_CAPACITY),
+-
+-/*
+ * Patch by Constantin Baranov <const@tltsu.ru>
+ * Report by Andreas Koenecke.
+ * Motorola ROKR Z6.
projects / thirdparty / kernel / stable-queue.git / commitdiff
