From 06c3346009831b99cf71c143c0d6b8a091405434 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Tue, 3 Feb 2009 14:46:50 -0800
Subject: [PATCH] .27 patches

---
 .../add-enable_ms-to-jsm-driver.patch         |  43 +++++
 ...-config-on-some-powermacs-powerbooks.patch |  56 ++++++
 ...mory-corruption-in-console-selection.patch |  41 +++++
 ...tkbd-broaden-the-dell-dmi-signatures.patch |  40 +++++
 ...ut-atkbd-samsung-nc10-key-repeat-fix.patch |  65 +++++++
 ...et-socket-delivery-in-rx-irq-handler.patch | 166 ++++++++++++++++++
 ...s-the-underlying-filesystem-on-lockt.patch |  86 +++++++++
 ...nfsd4_lockt-if-a-stateowner-is-found.patch |  39 ++++
 ...patch-for-intel-tigerpoint-deviceids.patch |  40 +++++
 queue-2.6.27/sata_nv-fix-mcp5x-reset.patch    | 105 +++++++++++
 queue-2.6.27/series                           |  10 ++
 11 files changed, 691 insertions(+)
 create mode 100644 queue-2.6.27/add-enable_ms-to-jsm-driver.patch
 create mode 100644 queue-2.6.27/fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch
 create mode 100644 queue-2.6.27/fix-memory-corruption-in-console-selection.patch
 create mode 100644 queue-2.6.27/input-atkbd-broaden-the-dell-dmi-signatures.patch
 create mode 100644 queue-2.6.27/input-atkbd-samsung-nc10-key-repeat-fix.patch
 create mode 100644 queue-2.6.27/net-fix-packet-socket-delivery-in-rx-irq-handler.patch
 create mode 100644 queue-2.6.27/nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
 create mode 100644 queue-2.6.27/nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch
 create mode 100644 queue-2.6.27/pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch
 create mode 100644 queue-2.6.27/sata_nv-fix-mcp5x-reset.patch

diff --git a/queue-2.6.27/add-enable_ms-to-jsm-driver.patch b/queue-2.6.27/add-enable_ms-to-jsm-driver.patch
new file mode 100644
index 00000000000..0bad659b424
--- /dev/null
+++ b/queue-2.6.27/add-enable_ms-to-jsm-driver.patch
@@ -0,0 +1,43 @@
+From 0461ec5bc7745b89a8ab67ba0ea497abd58a6301 Mon Sep 17 00:00:00 2001
+From: Paul Larson <pl@linux.vnet.ibm.com>
+Date: Fri, 30 Jan 2009 10:21:49 -0600
+Subject: Add enable_ms to jsm driver
+
+From: Paul Larson <pl@linux.vnet.ibm.com>
+
+commit 0461ec5bc7745b89a8ab67ba0ea497abd58a6301 upstream.
+
+This fixes a crash observed when non-existant enable_ms function is
+called for jsm driver.
+
+Signed-off-by: Scott Kilau <Scott.Kilau@digi.com>
+Signed-off-by: Paul Larson <pl@linux.vnet.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/jsm/jsm_tty.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/serial/jsm/jsm_tty.c
++++ b/drivers/serial/jsm/jsm_tty.c
+@@ -161,6 +161,11 @@ static void jsm_tty_stop_rx(struct uart_
+ 	channel->ch_bd->bd_ops->disable_receiver(channel);
+ }
+ 
++static void jsm_tty_enable_ms(struct uart_port *port)
++{
++	/* Nothing needed */
++}
++
+ static void jsm_tty_break(struct uart_port *port, int break_state)
+ {
+ 	unsigned long lock_flags;
+@@ -345,6 +350,7 @@ static struct uart_ops jsm_ops = {
+ 	.start_tx	= jsm_tty_start_tx,
+ 	.send_xchar	= jsm_tty_send_xchar,
+ 	.stop_rx	= jsm_tty_stop_rx,
++	.enable_ms	= jsm_tty_enable_ms,
+ 	.break_ctl	= jsm_tty_break,
+ 	.startup	= jsm_tty_open,
+ 	.shutdown	= jsm_tty_close,
diff --git a/queue-2.6.27/fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch b/queue-2.6.27/fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch
new file mode 100644
index 00000000000..e57781b548c
--- /dev/null
+++ b/queue-2.6.27/fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch
@@ -0,0 +1,56 @@
+From 7fbb7cadd062baf299fd8b26a80ea99da0c3fe01 Mon Sep 17 00:00:00 2001
+From: Risto Suominen <Risto.Suominen@gmail.com>
+Date: Tue, 13 Jan 2009 20:09:30 +0000
+Subject: fbdev/atyfb: Fix DSP config on some PowerMacs & PowerBooks
+
+From: Risto Suominen <Risto.Suominen@gmail.com>
+
+commit 7fbb7cadd062baf299fd8b26a80ea99da0c3fe01 upstream.
+
+Since the complete re-write in 2.6.10, some PowerMacs (At least PowerMac 5500
+and PowerMac G3 Beige rev A) with ATI Mach64 chip have suffered from unstable
+columns in their framebuffer image. This seems to depend on a value (4) read
+from PLL_EXT_CNTL register, which leads to incorrect DSP config parameters to
+be written to the chip. This patch uses a value calculated by aty_init_pll_ct
+instead, as a starting point.
+
+There are questions as to whether this should be extended to other platforms
+or maybe made dependent on specific chip types, but in the meantime, this has
+been tested on various powermacs and works for them so let's commit it.
+
+Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com>
+Tested-by: Michael Pettersson <mike@it.uu.se>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/aty/mach64_ct.c |   11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/video/aty/mach64_ct.c
++++ b/drivers/video/aty/mach64_ct.c
+@@ -8,6 +8,9 @@
+ #include <asm/io.h>
+ #include <video/mach64.h>
+ #include "atyfb.h"
++#ifdef CONFIG_PPC
++#include <asm/machdep.h>
++#endif
+ 
+ #undef DEBUG
+ 
+@@ -536,6 +539,14 @@ static int __devinit aty_init_pll_ct(con
+ 	pll->ct.xclk_post_div_real = postdividers[xpost_div];
+ 	pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8;
+ 
++#ifdef CONFIG_PPC
++	if (machine_is(powermac)) {
++		/* Override PLL_EXT_CNTL & 0x07. */
++		pll->ct.xclk_post_div = xpost_div;
++		pll->ct.xclk_ref_div = 1;
++	}
++#endif
++
+ #ifdef DEBUG
+ 	pllmclk = (1000000 * pll->ct.mclk_fb_mult * pll->ct.mclk_fb_div) /
+ 			(par->ref_clk_per * pll->ct.pll_ref_div);
diff --git a/queue-2.6.27/fix-memory-corruption-in-console-selection.patch b/queue-2.6.27/fix-memory-corruption-in-console-selection.patch
new file mode 100644
index 00000000000..c21126de800
--- /dev/null
+++ b/queue-2.6.27/fix-memory-corruption-in-console-selection.patch
@@ -0,0 +1,41 @@
+From 878b8619f711280fd05845e21956434b5e588cc4 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 30 Jan 2009 15:27:14 -0500
+Subject: Fix memory corruption in console selection
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 878b8619f711280fd05845e21956434b5e588cc4 upstream.
+
+Fix an off-by-two memory error in console selection.
+
+The loop below goes from sel_start to sel_end (inclusive), so it writes
+one more character.  This one more character was added to the allocated
+size (+1), but it was not multiplied by an UTF-8 multiplier.
+
+This patch fixes a memory corruption when UTF-8 console is used and the
+user selects a few characters, all of them 3-byte in UTF-8 (for example
+a frame line).
+
+When memory redzones are enabled, a redzone corruption is reported.
+When they are not enabled, trashing of random memory occurs.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/selection.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/selection.c
++++ b/drivers/char/selection.c
+@@ -268,7 +268,7 @@ int set_selection(const struct tiocl_sel
+ 
+ 	/* Allocate a new buffer before freeing the old one ... */
+ 	multiplier = use_unicode ? 3 : 1;  /* chars can take up to 3 bytes */
+-	bp = kmalloc((sel_end-sel_start)/2*multiplier+1, GFP_KERNEL);
++	bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL);
+ 	if (!bp) {
+ 		printk(KERN_WARNING "selection: kmalloc() failed\n");
+ 		clear_selection();
diff --git a/queue-2.6.27/input-atkbd-broaden-the-dell-dmi-signatures.patch b/queue-2.6.27/input-atkbd-broaden-the-dell-dmi-signatures.patch
new file mode 100644
index 00000000000..c328e16c073
--- /dev/null
+++ b/queue-2.6.27/input-atkbd-broaden-the-dell-dmi-signatures.patch
@@ -0,0 +1,40 @@
+From 2a3ec3265741c3b2a7ebbd1b33f538e5a5583c48 Mon Sep 17 00:00:00 2001
+From: Matthew Garrett <mjg59@srcf.ucam.org>
+Date: Tue, 30 Dec 2008 00:43:11 -0800
+Subject: Input: atkbd - broaden the Dell DMI signatures
+
+From: Matthew Garrett <mjg59@srcf.ucam.org>
+
+commit 2a3ec3265741c3b2a7ebbd1b33f538e5a5583c48 upstream.
+
+Some Dells need the dell input quirk applied but have a different vendor
+string in their DMI tables. Add an extra entry to cover these machines as
+well.
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/keyboard/atkbd.c |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/input/keyboard/atkbd.c
++++ b/drivers/input/keyboard/atkbd.c
+@@ -1486,6 +1486,15 @@ static struct dmi_system_id atkbd_dmi_qu
+ 		.driver_data = atkbd_dell_laptop_keymap_fixup,
+ 	},
+ 	{
++		.ident = "Dell Laptop",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
++			DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
++		},
++		.callback = atkbd_setup_fixup,
++		.driver_data = atkbd_dell_laptop_keymap_fixup,
++	},
++	{
+ 		.ident = "HP 2133",
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
diff --git a/queue-2.6.27/input-atkbd-samsung-nc10-key-repeat-fix.patch b/queue-2.6.27/input-atkbd-samsung-nc10-key-repeat-fix.patch
new file mode 100644
index 00000000000..ee363a19ca7
--- /dev/null
+++ b/queue-2.6.27/input-atkbd-samsung-nc10-key-repeat-fix.patch
@@ -0,0 +1,65 @@
+From 4200844bd9dc511088258437d564a187f0ffc94e Mon Sep 17 00:00:00 2001
+From: Stuart Hopkins <stuart@dodgy-geeza.com>
+Date: Sat, 20 Dec 2008 04:12:33 -0500
+Subject: Input: atkbd - Samsung NC10 key repeat fix
+
+From: Stuart Hopkins <stuart@dodgy-geeza.com>
+
+commit 4200844bd9dc511088258437d564a187f0ffc94e upstream.
+
+This patch fixes the key repeat issue with the Fn+F? keys on the new
+Samsung NC10 Netbook, so that the keys can be defined and used within
+ACPID correctly, otherwise the keys repeat indefinately.
+
+This solves part of http://bugzilla.kernel.org/show_bug.cgi?id=12021
+
+Signed-off-by: Stuart Hopkins <stuart@dodgy-geeza.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/keyboard/atkbd.c |   25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/input/keyboard/atkbd.c
++++ b/drivers/input/keyboard/atkbd.c
+@@ -884,6 +884,22 @@ static void atkbd_inventec_keymap_fixup(
+ }
+ 
+ /*
++ * Samsung NC10 with Fn+F? key release not working
++ */
++static void atkbd_samsung_keymap_fixup(struct atkbd *atkbd)
++{
++	const unsigned int forced_release_keys[] = {
++		0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9,
++	};
++	int i;
++
++	if (atkbd->set == 2)
++		for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
++			__set_bit(forced_release_keys[i],
++				  atkbd->force_release_mask);
++}
++
++/*
+  * atkbd_set_keycode_table() initializes keyboard's keycode table
+  * according to the selected scancode set
+  */
+@@ -1512,6 +1528,15 @@ static struct dmi_system_id atkbd_dmi_qu
+ 		.callback = atkbd_setup_fixup,
+ 		.driver_data = atkbd_inventec_keymap_fixup,
+ 	},
++	{
++		.ident = "Samsung NC10",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
++		},
++		.callback = atkbd_setup_fixup,
++		.driver_data = atkbd_samsung_keymap_fixup,
++	},
+ 	{ }
+ };
+ 
diff --git a/queue-2.6.27/net-fix-packet-socket-delivery-in-rx-irq-handler.patch b/queue-2.6.27/net-fix-packet-socket-delivery-in-rx-irq-handler.patch
new file mode 100644
index 00000000000..df22e803e5b
--- /dev/null
+++ b/queue-2.6.27/net-fix-packet-socket-delivery-in-rx-irq-handler.patch
@@ -0,0 +1,166 @@
+From 9b22ea560957de1484e6b3e8538f7eef202e3596 Mon Sep 17 00:00:00 2001
+From: Patrick McHardy <kaber@trash.net>
+Date: Tue, 4 Nov 2008 14:49:57 -0800
+Subject: net: fix packet socket delivery in rx irq handler
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit 9b22ea560957de1484e6b3e8538f7eef202e3596 upstream.
+
+The changes to deliver hardware accelerated VLAN packets to packet
+sockets (commit bc1d0411) caused a warning for non-NAPI drivers.
+The __vlan_hwaccel_rx() function is called directly from the drivers
+RX function, for non-NAPI drivers that means its still in RX IRQ
+context:
+
+[   27.779463] ------------[ cut here ]------------
+[   27.779509] WARNING: at kernel/softirq.c:136 local_bh_enable+0x37/0x81()
+...
+[   27.782520]  [<c0264755>] netif_nit_deliver+0x5b/0x75
+[   27.782590]  [<c02bba83>] __vlan_hwaccel_rx+0x79/0x162
+[   27.782664]  [<f8851c1d>] atl1_intr+0x9a9/0xa7c [atl1]
+[   27.782738]  [<c0155b17>] handle_IRQ_event+0x23/0x51
+[   27.782808]  [<c015692e>] handle_edge_irq+0xc2/0x102
+[   27.782878]  [<c0105fd5>] do_IRQ+0x4d/0x64
+
+Split hardware accelerated VLAN reception into two parts to fix this:
+
+- __vlan_hwaccel_rx just stores the VLAN TCI and performs the VLAN
+  device lookup, then calls netif_receive_skb()/netif_rx()
+
+- vlan_hwaccel_do_receive(), which is invoked by netif_receive_skb()
+  in softirq context, performs the real reception and delivery to
+  packet sockets.
+
+Reported-and-tested-by: Ramon Casellas <ramon.casellas@cttc.es>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/if_vlan.h |    7 +++++++
+ net/8021q/vlan_core.c   |   46 +++++++++++++++++++++++++++++++++-------------
+ net/core/dev.c          |    3 +++
+ 3 files changed, 43 insertions(+), 13 deletions(-)
+
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -114,6 +114,8 @@ extern u16 vlan_dev_vlan_id(const struct
+ 
+ extern int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
+ 			     u16 vlan_tci, int polling);
++extern int vlan_hwaccel_do_receive(struct sk_buff *skb);
++
+ #else
+ static inline struct net_device *vlan_dev_real_dev(const struct net_device *dev)
+ {
+@@ -133,6 +135,11 @@ static inline int __vlan_hwaccel_rx(stru
+ 	BUG();
+ 	return NET_XMIT_SUCCESS;
+ }
++
++static inline int vlan_hwaccel_do_receive(struct sk_buff *skb)
++{
++	return 0;
++}
+ #endif
+ 
+ /**
+--- a/net/8021q/vlan_core.c
++++ b/net/8021q/vlan_core.c
+@@ -3,11 +3,20 @@
+ #include <linux/if_vlan.h>
+ #include "vlan.h"
+ 
++struct vlan_hwaccel_cb {
++	struct net_device	*dev;
++};
++
++static inline struct vlan_hwaccel_cb *vlan_hwaccel_cb(struct sk_buff *skb)
++{
++	return (struct vlan_hwaccel_cb *)skb->cb;
++}
++
+ /* VLAN rx hw acceleration helper.  This acts like netif_{rx,receive_skb}(). */
+ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
+ 		      u16 vlan_tci, int polling)
+ {
+-	struct net_device_stats *stats;
++	struct vlan_hwaccel_cb *cb = vlan_hwaccel_cb(skb);
+ 
+ 	if (skb_bond_should_drop(skb)) {
+ 		dev_kfree_skb_any(skb);
+@@ -15,23 +24,35 @@ int __vlan_hwaccel_rx(struct sk_buff *sk
+ 	}
+ 
+ 	skb->vlan_tci = vlan_tci;
++	cb->dev = vlan_group_get_device(grp, vlan_tci & VLAN_VID_MASK);
++
++	return (polling ? netif_receive_skb(skb) : netif_rx(skb));
++}
++EXPORT_SYMBOL(__vlan_hwaccel_rx);
++
++int vlan_hwaccel_do_receive(struct sk_buff *skb)
++{
++	struct vlan_hwaccel_cb *cb = vlan_hwaccel_cb(skb);
++	struct net_device *dev = cb->dev;
++	struct net_device_stats *stats;
++
+ 	netif_nit_deliver(skb);
+ 
+-	skb->dev = vlan_group_get_device(grp, vlan_tci & VLAN_VID_MASK);
+-	if (skb->dev == NULL) {
+-		dev_kfree_skb_any(skb);
+-		/* Not NET_RX_DROP, this is not being dropped
+-		 * due to congestion. */
+-		return NET_RX_SUCCESS;
++	if (dev == NULL) {
++		kfree_skb(skb);
++		return -1;
+ 	}
+-	skb->dev->last_rx = jiffies;
++
++	skb->dev = dev;
++	skb->priority = vlan_get_ingress_priority(dev, skb->vlan_tci);
+ 	skb->vlan_tci = 0;
+ 
+-	stats = &skb->dev->stats;
++	dev->last_rx = jiffies;
++
++	stats = &dev->stats;
+ 	stats->rx_packets++;
+ 	stats->rx_bytes += skb->len;
+ 
+-	skb->priority = vlan_get_ingress_priority(skb->dev, vlan_tci);
+ 	switch (skb->pkt_type) {
+ 	case PACKET_BROADCAST:
+ 		break;
+@@ -43,13 +64,12 @@ int __vlan_hwaccel_rx(struct sk_buff *sk
+ 		 * This allows the VLAN to have a different MAC than the
+ 		 * underlying device, and still route correctly. */
+ 		if (!compare_ether_addr(eth_hdr(skb)->h_dest,
+-					skb->dev->dev_addr))
++					dev->dev_addr))
+ 			skb->pkt_type = PACKET_HOST;
+ 		break;
+ 	};
+-	return (polling ? netif_receive_skb(skb) : netif_rx(skb));
++	return 0;
+ }
+-EXPORT_SYMBOL(__vlan_hwaccel_rx);
+ 
+ struct net_device *vlan_dev_real_dev(const struct net_device *dev)
+ {
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2187,6 +2187,9 @@ int netif_receive_skb(struct sk_buff *sk
+ 	int ret = NET_RX_DROP;
+ 	__be16 type;
+ 
++	if (skb->vlan_tci && vlan_hwaccel_do_receive(skb))
++		return NET_RX_SUCCESS;
++
+ 	/* if we've gotten here through NAPI, check netpoll */
+ 	if (netpoll_receive_skb(skb))
+ 		return NET_RX_DROP;
diff --git a/queue-2.6.27/nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch b/queue-2.6.27/nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
new file mode 100644
index 00000000000..cffe1f358f6
--- /dev/null
+++ b/queue-2.6.27/nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
@@ -0,0 +1,86 @@
+From 55ef1274dddd4de387c54d110e354ffbb6cdc706 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Sat, 20 Dec 2008 11:58:38 -0800
+Subject: nfsd: Ensure nfsv4 calls the underlying filesystem on LOCKT
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit 55ef1274dddd4de387c54d110e354ffbb6cdc706 upstream.
+
+Since nfsv4 allows LOCKT without an open, but the ->lock() method is a
+file method, we fake up a struct file in the nfsv4 code with just the
+fields we need initialized.  But we forgot to initialize the file
+operations, with the result that LOCKT never results in a call to the
+filesystem's ->lock() method (if it exists).
+
+We could just add that one more initialization.  But this hack of faking
+up a struct file with only some fields initialized seems the kind of
+thing that might cause more problems in the future.  We should either do
+an open and get a real struct file, or make lock-testing an inode (not a
+file) method.
+
+This patch does the former.
+
+Reported-by: Marc Eshel <eshel@almaden.ibm.com>
+Tested-by: Marc Eshel <eshel@almaden.ibm.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4state.c |   30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -2767,6 +2767,25 @@ out:
+ }
+ 
+ /*
++ * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
++ * so we do a temporary open here just to get an open file to pass to
++ * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
++ * inode operation.)
++ */
++static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
++{
++	struct file *file;
++	int err;
++
++	err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
++	if (err)
++		return err;
++	err = vfs_test_lock(file, lock);
++	nfsd_close(file);
++	return err;
++}
++
++/*
+  * LOCKT operation
+  */
+ __be32
+@@ -2774,7 +2793,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+ 	    struct nfsd4_lockt *lockt)
+ {
+ 	struct inode *inode;
+-	struct file file;
+ 	struct file_lock file_lock;
+ 	int error;
+ 	__be32 status;
+@@ -2832,16 +2850,8 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+ 
+ 	nfs4_transform_lock_offset(&file_lock);
+ 
+-	/* vfs_test_lock uses the struct file _only_ to resolve the inode.
+-	 * since LOCKT doesn't require an OPEN, and therefore a struct
+-	 * file may not exist, pass vfs_test_lock a struct file with
+-	 * only the dentry:inode set.
+-	 */
+-	memset(&file, 0, sizeof (struct file));
+-	file.f_path.dentry = cstate->current_fh.fh_dentry;
+-
+ 	status = nfs_ok;
+-	error = vfs_test_lock(&file, &file_lock);
++	error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+ 	if (error) {
+ 		status = nfserrno(error);
+ 		goto out;
diff --git a/queue-2.6.27/nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch b/queue-2.6.27/nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch
new file mode 100644
index 00000000000..9bc61425bf1
--- /dev/null
+++ b/queue-2.6.27/nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch
@@ -0,0 +1,39 @@
+From fa82a491275a613b15489aab4b99acecb00958d3 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Thu, 22 Jan 2009 14:16:04 -0500
+Subject: nfsd: only set file_lock.fl_lmops in nfsd4_lockt if a stateowner is found
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit fa82a491275a613b15489aab4b99acecb00958d3 upstream.
+
+nfsd4_lockt does a search for a lockstateowner when building the lock
+struct to test. If one is found, it'll set fl_owner to it. Regardless of
+whether that happens, it'll also set fl_lmops. Given that this lock is
+basically a "lightweight" lock that's just used for checking conflicts,
+setting fl_lmops is probably not appropriate for it.
+
+This behavior exposed a bug in DLM's GETLK implementation where it
+wasn't clearing out the fields in the file_lock before filling in
+conflicting lock info. While we were able to fix this in DLM, it
+still seems pointless and dangerous to set the fl_lmops this way
+when we may have a NULL lockstateowner.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@pig.fieldses.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4state.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -2840,7 +2840,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, stru
+ 		file_lock.fl_owner = (fl_owner_t)lockt->lt_stateowner;
+ 	file_lock.fl_pid = current->tgid;
+ 	file_lock.fl_flags = FL_POSIX;
+-	file_lock.fl_lmops = &nfsd_posix_mng_ops;
+ 
+ 	file_lock.fl_start = lockt->lt_offset;
+ 	if ((lockt->lt_length == ~(u64)0) || LOFF_OVERFLOW(lockt->lt_offset, lockt->lt_length))
diff --git a/queue-2.6.27/pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch b/queue-2.6.27/pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch
new file mode 100644
index 00000000000..197f5a69950
--- /dev/null
+++ b/queue-2.6.27/pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch
@@ -0,0 +1,40 @@
+From 57064d213d2e44654d4f13c66df135b5e7389a26 Mon Sep 17 00:00:00 2001
+From: Seth Heasley <seth.heasley@intel.com>
+Date: Fri, 23 Jan 2009 12:43:38 -0800
+Subject: PCI: irq and pci_ids patch for Intel Tigerpoint DeviceIDs
+
+From: Seth Heasley <seth.heasley@intel.com>
+
+commit 57064d213d2e44654d4f13c66df135b5e7389a26 upstream.
+
+This patch adds the Intel Tigerpoint LPC Controller DeviceIDs.
+
+Signed-off-by: Seth Heasley <seth.heasley@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/irq.c      |    1 +
+ include/linux/pci_ids.h |    1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/arch/x86/pci/irq.c
++++ b/arch/x86/pci/irq.c
+@@ -573,6 +573,7 @@ static __init int intel_router_probe(str
+ 	case PCI_DEVICE_ID_INTEL_ICH7_1:
+ 	case PCI_DEVICE_ID_INTEL_ICH7_30:
+ 	case PCI_DEVICE_ID_INTEL_ICH7_31:
++	case PCI_DEVICE_ID_INTEL_TGP_LPC:
+ 	case PCI_DEVICE_ID_INTEL_ESB2_0:
+ 	case PCI_DEVICE_ID_INTEL_ICH8_0:
+ 	case PCI_DEVICE_ID_INTEL_ICH8_1:
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2384,6 +2384,7 @@
+ #define PCI_DEVICE_ID_INTEL_ICH7_0	0x27b8
+ #define PCI_DEVICE_ID_INTEL_ICH7_1	0x27b9
+ #define PCI_DEVICE_ID_INTEL_ICH7_30	0x27b0
++#define PCI_DEVICE_ID_INTEL_TGP_LPC	0x27bc
+ #define PCI_DEVICE_ID_INTEL_ICH7_31	0x27bd
+ #define PCI_DEVICE_ID_INTEL_ICH7_17	0x27da
+ #define PCI_DEVICE_ID_INTEL_ICH7_19	0x27dd
diff --git a/queue-2.6.27/sata_nv-fix-mcp5x-reset.patch b/queue-2.6.27/sata_nv-fix-mcp5x-reset.patch
new file mode 100644
index 00000000000..e6ff9801bf5
--- /dev/null
+++ b/queue-2.6.27/sata_nv-fix-mcp5x-reset.patch
@@ -0,0 +1,105 @@
+From 2d775708bc6613f1be47f1e720781343341ecc94 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Sun, 25 Jan 2009 11:29:38 +0900
+Subject: sata_nv: fix MCP5x reset
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 2d775708bc6613f1be47f1e720781343341ecc94 upstream.
+
+MCP5x family of controllers seem to share much more with nf2's as far
+as reset protocol is concerned.  It requires heardreset to get the PHY
+going and classfication code report after hardreset is unreliable.
+Create a new board type MCP5x and use noclassify hardreset.  SWNCQ is
+modified to inherit from this new type.
+
+This fixes hotplug regression reported in kernel bz#12351.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/sata_nv.c |   42 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 29 insertions(+), 13 deletions(-)
+
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -352,6 +352,7 @@ enum nv_host_type
+ 	NFORCE3 = NFORCE2,	/* NF2 == NF3 as far as sata_nv is concerned */
+ 	CK804,
+ 	ADMA,
++	MCP5x,
+ 	SWNCQ,
+ };
+ 
+@@ -363,10 +364,10 @@ static const struct pci_device_id nv_pci
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_SATA2), CK804 },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA), CK804 },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA2), CK804 },
+-	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), SWNCQ },
+-	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), SWNCQ },
+-	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), SWNCQ },
+-	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), SWNCQ },
++	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), MCP5x },
++	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), MCP5x },
++	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), MCP5x },
++	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), MCP5x },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), GENERIC },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), GENERIC },
+ 	{ PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), GENERIC },
+@@ -467,8 +468,19 @@ static struct ata_port_operations nv_adm
+ 	.host_stop		= nv_adma_host_stop,
+ };
+ 
++/* Kernel bz#12351 reports that when SWNCQ is enabled, for hotplug to
++ * work, hardreset should be used and hardreset can't report proper
++ * signature, which suggests that mcp5x is closer to nf2 as long as
++ * reset quirkiness is concerned.  Define separate ops for mcp5x with
++ * nv_noclassify_hardreset().
++ */
++static struct ata_port_operations nv_mcp5x_ops = {
++	.inherits		= &nv_common_ops,
++	.hardreset		= nv_noclassify_hardreset,
++};
++
+ static struct ata_port_operations nv_swncq_ops = {
+-	.inherits		= &nv_generic_ops,
++	.inherits		= &nv_mcp5x_ops,
+ 
+ 	.qc_defer		= ata_std_qc_defer,
+ 	.qc_prep		= nv_swncq_qc_prep,
+@@ -531,6 +543,15 @@ static const struct ata_port_info nv_por
+ 		.port_ops	= &nv_adma_ops,
+ 		.private_data	= NV_PI_PRIV(nv_adma_interrupt, &nv_adma_sht),
+ 	},
++	/* MCP5x */
++	{
++		.flags		= ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY,
++		.pio_mask	= NV_PIO_MASK,
++		.mwdma_mask	= NV_MWDMA_MASK,
++		.udma_mask	= NV_UDMA_MASK,
++		.port_ops	= &nv_mcp5x_ops,
++		.private_data	= NV_PI_PRIV(nv_generic_interrupt, &nv_sht),
++	},
+ 	/* SWNCQ */
+ 	{
+ 		.flags	        = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+@@ -2355,14 +2376,9 @@ static int nv_init_one(struct pci_dev *p
+ 	if (type == CK804 && adma_enabled) {
+ 		dev_printk(KERN_NOTICE, &pdev->dev, "Using ADMA mode\n");
+ 		type = ADMA;
+-	}
+-
+-	if (type == SWNCQ) {
+-		if (swncq_enabled)
+-			dev_printk(KERN_NOTICE, &pdev->dev,
+-				   "Using SWNCQ mode\n");
+-		else
+-			type = GENERIC;
++	} else if (type == MCP5x && swncq_enabled) {
++		dev_printk(KERN_NOTICE, &pdev->dev, "Using SWNCQ mode\n");
++		type = SWNCQ;
+ 	}
+ 
+ 	ppi[0] = &nv_port_info[type];
diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index 2cd432c378f..421a0eecb4f 100644
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -3,3 +3,13 @@ ixgb-fix-bug-when-freeing-resources.patch
 m68knommu-set-no_dma.patch
 sata_mv-fix-8-port-timeouts-on-508x-6081-chips.patch
 x86-use-early-clobbers-in-usercopy-.c.patch
+add-enable_ms-to-jsm-driver.patch
+fbdev-atyfb-fix-dsp-config-on-some-powermacs-powerbooks.patch
+fix-memory-corruption-in-console-selection.patch
+input-atkbd-broaden-the-dell-dmi-signatures.patch
+input-atkbd-samsung-nc10-key-repeat-fix.patch
+net-fix-packet-socket-delivery-in-rx-irq-handler.patch
+nfsd-ensure-nfsv4-calls-the-underlying-filesystem-on-lockt.patch
+nfsd-only-set-file_lock.fl_lmops-in-nfsd4_lockt-if-a-stateowner-is-found.patch
+pci-irq-and-pci_ids-patch-for-intel-tigerpoint-deviceids.patch
+sata_nv-fix-mcp5x-reset.patch
-- 
2.47.3