.32 patches

15 files changed, 907 insertions, 0 deletions

diff --git a/queue-2.6.32/cifs-add-fallback-in-is_path_accessible-for-old-servers.patch b/queue-2.6.32/cifs-add-fallback-in-is_path_accessible-for-old-servers.patch
new file mode 100644
index 0000000..3cb7b48
--- /dev/null
+++ b/queue-2.6.32/cifs-add-fallback-in-is_path_accessible-for-old-servers.patch
@@ -0,0 +1,36 @@
+From 221d1d797202984cb874e3ed9f1388593d34ee22 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 17 May 2011 06:40:30 -0400
+Subject: cifs: add fallback in is_path_accessible for old servers
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 221d1d797202984cb874e3ed9f1388593d34ee22 upstream.
+
+The is_path_accessible check uses a QPathInfo call, which isn't
+supported by ancient win9x era servers. Fall back to an older
+SMBQueryInfo call if it fails with the magic error codes.
+
+Reported-and-Tested-by: Sandro Bonazzola <sandro.bonazzola@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2231,6 +2231,11 @@ is_path_accessible(int xid, struct cifsT
+ 			      0 /* not legacy */, cifs_sb->local_nls,
+ 			      cifs_sb->mnt_cifs_flags &
+ 				CIFS_MOUNT_MAP_SPECIAL_CHR);
++
++	if (rc == -EOPNOTSUPP || rc == -EINVAL)
++		rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
++				cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
++				  CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 	kfree(pfile_info);
+ 	return rc;
+ }
diff --git a/queue-2.6.32/clocksource-install-completely-before-selecting.patch b/queue-2.6.32/clocksource-install-completely-before-selecting.patch
new file mode 100644
index 0000000..39ed33b
--- /dev/null
+++ b/queue-2.6.32/clocksource-install-completely-before-selecting.patch
@@ -0,0 +1,48 @@
+From e05b2efb82596905ebfe88e8612ee81dec9b6592 Mon Sep 17 00:00:00 2001
+From: john stultz <johnstul@us.ibm.com>
+Date: Wed, 4 May 2011 18:16:50 -0700
+Subject: clocksource: Install completely before selecting
+
+From: john stultz <johnstul@us.ibm.com>
+
+commit e05b2efb82596905ebfe88e8612ee81dec9b6592 upstream.
+
+Christian Hoffmann reported that the command line clocksource override
+with acpi_pm timer fails:
+
+ Kernel command line: <SNIP> clocksource=acpi_pm
+ hpet clockevent registered
+ Switching to clocksource hpet
+ Override clocksource acpi_pm is not HRT compatible.
+ Cannot switch while in HRT/NOHZ mode.
+
+The watchdog code is what enables CLOCK_SOURCE_VALID_FOR_HRES, but we
+actually end up selecting the clocksource before we enqueue it into
+the watchdog list, so that's why we see the warning and fail to switch
+to acpi_pm timer as requested. That's particularly bad when we want to
+debug timekeeping related problems in early boot.
+
+Put the selection call last.
+
+Reported-by: Christian Hoffmann <email@christianhoffmann.info>
+Signed-off-by: John Stultz <johnstul@us.ibm.com>
+Link: http://lkml.kernel.org/r/%3C1304558210.2943.24.camel%40work-vm%3E
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/clocksource.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -561,8 +561,8 @@ int clocksource_register(struct clocksou
+ 
+ 	mutex_lock(&clocksource_mutex);
+ 	clocksource_enqueue(cs);
+-	clocksource_select();
+ 	clocksource_enqueue_watchdog(cs);
++	clocksource_select();
+ 	mutex_unlock(&clocksource_mutex);
+ 	return 0;
+ }
diff --git a/queue-2.6.32/hydra-fix-regression-caused-during-net_device_ops-conversion.patch b/queue-2.6.32/hydra-fix-regression-caused-during-net_device_ops-conversion.patch
new file mode 100644
index 0000000..d9e1490
--- /dev/null
+++ b/queue-2.6.32/hydra-fix-regression-caused-during-net_device_ops-conversion.patch
@@ -0,0 +1,73 @@
+From 0b25e0157dfa236a0629c16c8ad6f222f633f682 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Thu, 12 May 2011 09:11:39 +0000
+Subject: hydra: Fix regression caused during net_device_ops conversion
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit 0b25e0157dfa236a0629c16c8ad6f222f633f682 upstream.
+
+Changeset 5618f0d1193d6b051da9b59b0e32ad24397f06a4 ("hydra: convert to
+net_device_ops") broke hydra by adding 8390.o to the link. That
+meant that lib8390.c was included twice, once in hydra.c and once in
+8390.c, subject to different macros. This patch reverts that by
+avoiding the wrappers in 8390.c.
+
+Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
+fix regression caused during net_device_ops conversion") and
+4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
+NET_POLL_CONTROLLER").
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/Makefile |    2 +-
+ drivers/net/hydra.c  |   14 +++++++-------
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -220,7 +220,7 @@ obj-$(CONFIG_SGI_IOC3_ETH) += ioc3-eth.o
+ obj-$(CONFIG_DECLANCE) += declance.o
+ obj-$(CONFIG_ATARILANCE) += atarilance.o
+ obj-$(CONFIG_A2065) += a2065.o
+-obj-$(CONFIG_HYDRA) += hydra.o 8390.o
++obj-$(CONFIG_HYDRA) += hydra.o
+ obj-$(CONFIG_ARIADNE) += ariadne.o
+ obj-$(CONFIG_CS89x0) += cs89x0.o
+ obj-$(CONFIG_MACSONIC) += macsonic.o
+--- a/drivers/net/hydra.c
++++ b/drivers/net/hydra.c
+@@ -98,15 +98,15 @@ static const struct net_device_ops hydra
+ 	.ndo_open		= hydra_open,
+ 	.ndo_stop		= hydra_close,
+ 
+-	.ndo_start_xmit		= ei_start_xmit,
+-	.ndo_tx_timeout		= ei_tx_timeout,
+-	.ndo_get_stats		= ei_get_stats,
+-	.ndo_set_multicast_list = ei_set_multicast_list,
++	.ndo_start_xmit		= __ei_start_xmit,
++	.ndo_tx_timeout		= __ei_tx_timeout,
++	.ndo_get_stats		= __ei_get_stats,
++	.ndo_set_multicast_list = __ei_set_multicast_list,
+ 	.ndo_validate_addr	= eth_validate_addr,
+-	.ndo_set_mac_address 	= eth_mac_addr,
++	.ndo_set_mac_address	= eth_mac_addr,
+ 	.ndo_change_mtu		= eth_change_mtu,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-	.ndo_poll_controller	= ei_poll,
++	.ndo_poll_controller	= __ei_poll,
+ #endif
+ };
+ 
+@@ -125,7 +125,7 @@ static int __devinit hydra_init(struct z
+ 	0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
+     };
+ 
+-    dev = alloc_ei_netdev();
++    dev = ____alloc_ei_netdev(0);
+     if (!dev)
+ 	return -ENOMEM;
+ 
diff --git a/queue-2.6.32/libertas-fix-cmdpendingq-locking.patch b/queue-2.6.32/libertas-fix-cmdpendingq-locking.patch
new file mode 100644
index 0000000..127003d
--- /dev/null
+++ b/queue-2.6.32/libertas-fix-cmdpendingq-locking.patch
@@ -0,0 +1,60 @@
+From 2ae1b8b35faba31a59b153cbad07f9c15de99740 Mon Sep 17 00:00:00 2001
+From: Paul Fox <pgf@laptop.org>
+Date: Mon, 9 May 2011 10:40:42 +0100
+Subject: libertas: fix cmdpendingq locking
+
+From: Paul Fox <pgf@laptop.org>
+
+commit 2ae1b8b35faba31a59b153cbad07f9c15de99740 upstream.
+
+We occasionally see list corruption using libertas.
+
+While we haven't been able to diagnose this precisely, we have spotted
+a possible cause: cmdpendingq is generally modified with driver_lock
+held. However, there are a couple of points where this is not the case.
+
+Fix up those operations to execute under the lock, it seems like
+the correct thing to do and will hopefully improve the situation.
+
+Signed-off-by: Paul Fox <pgf@laptop.org>
+Signed-off-by: Daniel Drake <dsd@laptop.org>
+Acked-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/cmd.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/libertas/cmd.c
++++ b/drivers/net/wireless/libertas/cmd.c
+@@ -1758,8 +1758,8 @@ int lbs_execute_next_command(struct lbs_
+ 				    cpu_to_le16(CMD_SUBCMD_EXIT_PS)) {
+ 					lbs_deb_host(
+ 					       "EXEC_NEXT_CMD: ignore ENTER_PS cmd\n");
+-					list_del(&cmdnode->list);
+ 					spin_lock_irqsave(&priv->driver_lock, flags);
++					list_del(&cmdnode->list);
+ 					lbs_complete_command(priv, cmdnode, 0);
+ 					spin_unlock_irqrestore(&priv->driver_lock, flags);
+ 
+@@ -1771,8 +1771,8 @@ int lbs_execute_next_command(struct lbs_
+ 				    (priv->psstate == PS_STATE_PRE_SLEEP)) {
+ 					lbs_deb_host(
+ 					       "EXEC_NEXT_CMD: ignore EXIT_PS cmd in sleep\n");
+-					list_del(&cmdnode->list);
+ 					spin_lock_irqsave(&priv->driver_lock, flags);
++					list_del(&cmdnode->list);
+ 					lbs_complete_command(priv, cmdnode, 0);
+ 					spin_unlock_irqrestore(&priv->driver_lock, flags);
+ 					priv->needtowakeup = 1;
+@@ -1785,7 +1785,9 @@ int lbs_execute_next_command(struct lbs_
+ 				       "EXEC_NEXT_CMD: sending EXIT_PS\n");
+ 			}
+ 		}
++		spin_lock_irqsave(&priv->driver_lock, flags);
+ 		list_del(&cmdnode->list);
++		spin_unlock_irqrestore(&priv->driver_lock, flags);
+ 		lbs_deb_host("EXEC_NEXT_CMD: sending command 0x%04x\n",
+ 			    le16_to_cpu(cmd->command));
+ 		lbs_submit_command(priv, cmdnode);
diff --git a/queue-2.6.32/megaraid_sas-sanity-check-user-supplied-length-before-passing-it-to-dma_alloc_coherent.patch b/queue-2.6.32/megaraid_sas-sanity-check-user-supplied-length-before-passing-it-to-dma_alloc_coherent.patch
new file mode 100644
index 0000000..c49ac3f
--- /dev/null
+++ b/queue-2.6.32/megaraid_sas-sanity-check-user-supplied-length-before-passing-it-to-dma_alloc_coherent.patch
@@ -0,0 +1,89 @@
+From 98cb7e4413d189cd2b54daf993a4667d9788c0bb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 19 Jan 2011 10:01:14 +0100
+Subject: [SCSI] megaraid_sas: Sanity check user supplied length before passing it to dma_alloc_coherent()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+
+commit 98cb7e4413d189cd2b54daf993a4667d9788c0bb upstream.
+
+The ioc->sgl[i].iov_len value is supplied by the ioctl caller, and can be
+zero in some cases.  Assume that's valid and continue without error.
+
+Fixes (multiple individual reports of the same problem for quite a while):
+
+http://marc.info/?l=linux-ide&m=128941801715301
+http://bugs.debian.org/604627
+http://www.mail-archive.com/linux-poweredge@dell.com/msg02575.html
+
+megasas: Failed to alloc kernel SGL buffer for IOCTL
+
+and
+
+[   69.162538] ------------[ cut here ]------------
+[   69.162806] kernel BUG at /build/buildd/linux-2.6.32/lib/swiotlb.c:368!
+[   69.163134] invalid opcode: 0000 [#1] SMP
+[   69.163570] last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map
+[   69.163975] CPU 0
+[   69.164227] Modules linked in: fbcon tileblit font bitblit softcursor vga16fb vgastate ioatdma radeon ttm drm_kms_helper shpchp drm i2c_algo_bit lp parport floppy pata_jmicron megaraid_sas igb dca
+[   69.167419] Pid: 1206, comm: smartctl Tainted: G        W  2.6.32-25-server #45-Ubuntu X8DTN
+[   69.167843] RIP: 0010:[<ffffffff812c4dc5>]  [<ffffffff812c4dc5>] map_single+0x255/0x260
+[   69.168370] RSP: 0018:ffff88081c0ebc58  EFLAGS: 00010246
+[   69.168655] RAX: 000000000003bffc RBX: 00000000ffffffff RCX: 0000000000000002
+[   69.169000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88001dffe000
+[   69.169346] RBP: ffff88081c0ebcb8 R08: 0000000000000000 R09: ffff880000030840
+[   69.169691] R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000000
+[   69.170036] R13: 00000000ffffffff R14: 0000000000000001 R15: 0000000000200000
+[   69.170382] FS:  00007fb8de189720(0000) GS:ffff88001de00000(0000) knlGS:0000000000000000
+[   69.170794] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[   69.171094] CR2: 00007fb8dd59237c CR3: 000000081a790000 CR4: 00000000000006f0
+[   69.171439] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[   69.171784] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+[   69.172130] Process smartctl (pid: 1206, threadinfo ffff88081c0ea000, task ffff88081a760000)
+[   69.194513] Stack:
+[   69.205788]  0000000000000034 00000002817e3390 0000000000000000 ffff88081c0ebe00
+[   69.217739] <0> 0000000000000000 000000000003bffc 0000000000000000 0000000000000000
+[   69.241250] <0> 0000000000000000 00000000ffffffff ffff88081c5b4080 ffff88081c0ebe00
+[   69.277310] Call Trace:
+[   69.289278]  [<ffffffff812c52ac>] swiotlb_alloc_coherent+0xec/0x130
+[   69.301118]  [<ffffffff81038b31>] x86_swiotlb_alloc_coherent+0x61/0x70
+[   69.313045]  [<ffffffffa002d0ce>] megasas_mgmt_fw_ioctl+0x1ae/0x690 [megaraid_sas]
+[   69.336399]  [<ffffffffa002d748>] megasas_mgmt_ioctl_fw+0x198/0x240 [megaraid_sas]
+[   69.359346]  [<ffffffffa002f695>] megasas_mgmt_ioctl+0x35/0x50 [megaraid_sas]
+[   69.370902]  [<ffffffff81153b12>] vfs_ioctl+0x22/0xa0
+[   69.382322]  [<ffffffff8115da2a>] ? alloc_fd+0x10a/0x150
+[   69.393622]  [<ffffffff81153cb1>] do_vfs_ioctl+0x81/0x410
+[   69.404696]  [<ffffffff8155cc13>] ? do_page_fault+0x153/0x3b0
+[   69.415761]  [<ffffffff811540c1>] sys_ioctl+0x81/0xa0
+[   69.426640]  [<ffffffff810121b2>] system_call_fastpath+0x16/0x1b
+[   69.437491] Code: fe ff ff 48 8b 3d 74 38 76 00 41 bf 00 00 20 00 e8 51 f5 d7 ff 83 e0 ff 48 05 ff 07 00 00 48 c1 e8 0b 48 89 45 c8 e9 13 fe ff ff <0f> 0b eb fe 0f 1f 80 00 00 00 00 55 48 89 e5 48 83 ec 20 4c 89
+[   69.478216] RIP  [<ffffffff812c4dc5>] map_single+0x255/0x260
+[   69.489668]  RSP <ffff88081c0ebc58>
+[   69.500975] ---[ end trace 6a2181b634e2abc7 ]---
+
+Reported-by: Bokhan Artem <aptem@ngs.ru>
+Reported by: Marc-Christian Petersen <m.c.p@gmx.de>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Cc: "Benz, Michael" <Michael.Benz@lsi.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/megaraid/megaraid_sas.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/megaraid/megaraid_sas.c
++++ b/drivers/scsi/megaraid/megaraid_sas.c
+@@ -3072,6 +3072,9 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
+ 	 * For each user buffer, create a mirror buffer and copy in
+ 	 */
+ 	for (i = 0; i < ioc->sge_count; i++) {
++		if (!ioc->sgl[i].iov_len)
++			continue;
++
+ 		kbuff_arr[i] = dma_alloc_coherent(&instance->pdev->dev,
+ 						    ioc->sgl[i].iov_len,
+ 						    &buf_handle, GFP_KERNEL);
diff --git a/queue-2.6.32/ne-h8300-fix-regression-caused-during-net_device_ops-conversion.patch b/queue-2.6.32/ne-h8300-fix-regression-caused-during-net_device_ops-conversion.patch
new file mode 100644
index 0000000..ac2c79d
--- /dev/null
+++ b/queue-2.6.32/ne-h8300-fix-regression-caused-during-net_device_ops-conversion.patch
@@ -0,0 +1,82 @@
+From 2592a7354092afd304a8c067319b15ab1e441e35 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Thu, 12 May 2011 09:11:40 +0000
+Subject: ne-h8300: Fix regression caused during net_device_ops conversion
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit 2592a7354092afd304a8c067319b15ab1e441e35 upstream.
+
+Changeset dcd39c90290297f6e6ed8a04bb20da7ac2b043c5 ("ne-h8300: convert to
+net_device_ops") broke ne-h8300 by adding 8390.o to the link. That
+meant that lib8390.c was included twice, once in ne-h8300.c and once in
+8390.c, subject to different macros. This patch reverts that by
+avoiding the wrappers in 8390.c.
+
+Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
+fix regression caused during net_device_ops conversion") and
+4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
+NET_POLL_CONTROLLER").
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/Makefile   |    2 +-
+ drivers/net/ne-h8300.c |   16 ++++++++--------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -138,7 +138,7 @@ obj-$(CONFIG_NE3210) += ne3210.o 8390.o
+ obj-$(CONFIG_SB1250_MAC) += sb1250-mac.o
+ obj-$(CONFIG_B44) += b44.o
+ obj-$(CONFIG_FORCEDETH) += forcedeth.o
+-obj-$(CONFIG_NE_H8300) += ne-h8300.o 8390.o
++obj-$(CONFIG_NE_H8300) += ne-h8300.o
+ obj-$(CONFIG_AX88796) += ax88796.o
+ obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
+ 
+--- a/drivers/net/ne-h8300.c
++++ b/drivers/net/ne-h8300.c
+@@ -167,7 +167,7 @@ static void cleanup_card(struct net_devi
+ #ifndef MODULE
+ struct net_device * __init ne_probe(int unit)
+ {
+-	struct net_device *dev = alloc_ei_netdev();
++	struct net_device *dev = ____alloc_ei_netdev(0);
+ 	int err;
+ 
+ 	if (!dev)
+@@ -197,15 +197,15 @@ static const struct net_device_ops ne_ne
+ 	.ndo_open		= ne_open,
+ 	.ndo_stop		= ne_close,
+ 
+-	.ndo_start_xmit		= ei_start_xmit,
+-	.ndo_tx_timeout		= ei_tx_timeout,
+-	.ndo_get_stats		= ei_get_stats,
+-	.ndo_set_multicast_list = ei_set_multicast_list,
++	.ndo_start_xmit		= __ei_start_xmit,
++	.ndo_tx_timeout		= __ei_tx_timeout,
++	.ndo_get_stats		= __ei_get_stats,
++	.ndo_set_multicast_list = __ei_set_multicast_list,
+ 	.ndo_validate_addr	= eth_validate_addr,
+-	.ndo_set_mac_address 	= eth_mac_addr,
++	.ndo_set_mac_address	= eth_mac_addr,
+ 	.ndo_change_mtu		= eth_change_mtu,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-	.ndo_poll_controller	= ei_poll,
++	.ndo_poll_controller	= __ei_poll,
+ #endif
+ };
+ 
+@@ -638,7 +638,7 @@ int init_module(void)
+ 	int err;
+ 
+ 	for (this_dev = 0; this_dev < MAX_NE_CARDS; this_dev++) {
+-		struct net_device *dev = alloc_ei_netdev();
++		struct net_device *dev = ____alloc_ei_netdev(0);
+ 		if (!dev)
+ 			break;
+ 		if (io[this_dev]) {
diff --git a/queue-2.6.32/netxen-remove-references-to-unified-firmware-file.patch b/queue-2.6.32/netxen-remove-references-to-unified-firmware-file.patch
new file mode 100644
index 0000000..5ed61dc
--- /dev/null
+++ b/queue-2.6.32/netxen-remove-references-to-unified-firmware-file.patch
@@ -0,0 +1,52 @@
+From ben@decadent.org.uk  Wed May 18 17:29:07 2011
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Tue, 17 May 2011 01:48:14 +0100
+Subject: netxen: Remove references to unified firmware file
+To: stable@kernel.org
+Message-ID: <1305593294.19966.39.camel@localhost>
+
+
+Commit c23a103f0d9c2560c6839ed366feebec4cd5e556 wrongly introduced
+references to the unified firmware file "phanfw.bin", which is not
+supported by netxen in 2.6.32.  The driver reports this filename when
+loading firmware from flash, and includes a MODULE_FIRMWARE hint for
+the filename even though it will never use it.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/netxen/netxen_nic.h      |    1 -
+ drivers/net/netxen/netxen_nic_init.c |    1 -
+ drivers/net/netxen/netxen_nic_main.c |    1 -
+ 3 files changed, 3 deletions(-)
+
+--- a/drivers/net/netxen/netxen_nic.h
++++ b/drivers/net/netxen/netxen_nic.h
+@@ -490,7 +490,6 @@ struct status_desc {
+ #define NX_P2_MN_ROMIMAGE_NAME		"nxromimg.bin"
+ #define NX_P3_CT_ROMIMAGE_NAME		"nx3fwct.bin"
+ #define NX_P3_MN_ROMIMAGE_NAME		"nx3fwmn.bin"
+-#define NX_UNIFIED_ROMIMAGE_NAME	"phanfw.bin"
+ #define NX_FLASH_ROMIMAGE_NAME		"flash"
+ 
+ extern char netxen_nic_driver_name[];
+--- a/drivers/net/netxen/netxen_nic_init.c
++++ b/drivers/net/netxen/netxen_nic_init.c
+@@ -676,7 +676,6 @@ static char *fw_name[] = {
+ 	NX_P2_MN_ROMIMAGE_NAME,
+ 	NX_P3_CT_ROMIMAGE_NAME,
+ 	NX_P3_MN_ROMIMAGE_NAME,
+-	NX_UNIFIED_ROMIMAGE_NAME,
+ 	NX_FLASH_ROMIMAGE_NAME,
+ };
+ 
+--- a/drivers/net/netxen/netxen_nic_main.c
++++ b/drivers/net/netxen/netxen_nic_main.c
+@@ -41,7 +41,6 @@ MODULE_VERSION(NETXEN_NIC_LINUX_VERSIONI
+ MODULE_FIRMWARE(NX_P2_MN_ROMIMAGE_NAME);
+ MODULE_FIRMWARE(NX_P3_CT_ROMIMAGE_NAME);
+ MODULE_FIRMWARE(NX_P3_MN_ROMIMAGE_NAME);
+-MODULE_FIRMWARE(NX_UNIFIED_ROMIMAGE_NAME);
+ 
+ char netxen_nic_driver_name[] = "netxen_nic";
+ static char netxen_nic_driver_string[] = "NetXen Network Driver version "
diff --git a/queue-2.6.32/revert-x86-amd-fix-apic-timer-erratum-400-affecting-k8-rev.a-e-processors.patch b/queue-2.6.32/revert-x86-amd-fix-apic-timer-erratum-400-affecting-k8-rev.a-e-processors.patch
new file mode 100644
index 0000000..8f1587b
--- /dev/null
+++ b/queue-2.6.32/revert-x86-amd-fix-apic-timer-erratum-400-affecting-k8-rev.a-e-processors.patch
@@ -0,0 +1,47 @@
+From 328935e6348c6a7cb34798a68c326f4b8372e68a Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <borislav.petkov@amd.com>
+Date: Tue, 17 May 2011 14:55:18 +0200
+Subject: Revert "x86, AMD: Fix APIC timer erratum 400 affecting K8 Rev.A-E processors"
+
+From: Borislav Petkov <borislav.petkov@amd.com>
+
+commit 328935e6348c6a7cb34798a68c326f4b8372e68a upstream.
+
+This reverts commit e20a2d205c05cef6b5783df339a7d54adeb50962, as it crashes
+certain boxes with specific AMD CPU models.
+
+Moving the lower endpoint of the Erratum 400 check to accomodate
+earlier K8 revisions (A-E) opens a can of worms which is simply
+not worth to fix properly by tweaking the errata checking
+framework:
+
+* missing IntPenging MSR on revisions < CG cause #GP:
+
+http://marc.info/?l=linux-kernel&m=130541471818831
+
+* makes earlier revisions use the LAPIC timer instead of the C1E
+idle routine which switches to HPET, thus not waking up in
+deeper C-states:
+
+http://lkml.org/lkml/2011/4/24/20
+
+Therefore, leave the original boundary starting with K8-revF.
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/amd.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -653,7 +653,7 @@ cpu_dev_register(amd_cpu_dev);
+  */
+ 
+ const int amd_erratum_400[] =
+-	AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0x0f, 0x4, 0x2, 0xff, 0xf),
++	AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),
+ 			    AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf));
+ 
+ 
diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index f4f67a1..38fc6d6 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -5,3 +5,17 @@ cifs-fix-memory-over-bound-bug-in-cifs_parse_mount_options.patch
 fix-time-inconsistencies-caused-by-intermediate-xtime_cache-values-being-read.patch
 ehea-fix-wrongly-reported-speed-and-port.patch
 net-slip-fix-ldisc-open-retval.patch
+ne-h8300-fix-regression-caused-during-net_device_ops-conversion.patch
+hydra-fix-regression-caused-during-net_device_ops-conversion.patch
+libertas-fix-cmdpendingq-locking.patch
+zorro8390-fix-regression-caused-during-net_device_ops-conversion.patch
+cifs-add-fallback-in-is_path_accessible-for-old-servers.patch
+revert-x86-amd-fix-apic-timer-erratum-400-affecting-k8-rev.a-e-processors.patch
+x86-amd-fix-arat-feature-setting-again.patch
+clocksource-install-completely-before-selecting.patch
+tick-clear-broadcast-active-bit-when-switching-to-oneshot.patch
+x86-apic-fix-spurious-error-interrupts-triggering-on-all-non-boot-aps.patch
+x86-mce-amd-fix-leaving-freed-data-in-a-list.patch
+megaraid_sas-sanity-check-user-supplied-length-before-passing-it-to-dma_alloc_coherent.patch
+vmxnet3-fix-inconsistent-lro-state-after-initialization.patch
+netxen-remove-references-to-unified-firmware-file.patch
diff --git a/queue-2.6.32/tick-clear-broadcast-active-bit-when-switching-to-oneshot.patch b/queue-2.6.32/tick-clear-broadcast-active-bit-when-switching-to-oneshot.patch
new file mode 100644
index 0000000..c494dc3
--- /dev/null
+++ b/queue-2.6.32/tick-clear-broadcast-active-bit-when-switching-to-oneshot.patch
@@ -0,0 +1,85 @@
+From 07f4beb0b5bbfaf36a64aa00d59e670ec578a95a Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 16 May 2011 11:07:48 +0200
+Subject: tick: Clear broadcast active bit when switching to oneshot
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 07f4beb0b5bbfaf36a64aa00d59e670ec578a95a upstream.
+
+The first cpu which switches from periodic to oneshot mode switches
+also the broadcast device into oneshot mode. The broadcast device
+serves as a backup for per cpu timers which stop in deeper
+C-states. To avoid starvation of the cpus which might be in idle and
+depend on broadcast mode it marks the other cpus as broadcast active
+and sets the brodcast expiry value of those cpus to the next tick.
+
+The oneshot mode broadcast bit for the other cpus is sticky and gets
+only cleared when those cpus exit idle. If a cpu was not idle while
+the bit got set in consequence the bit prevents that the broadcast
+device is armed on behalf of that cpu when it enters idle for the
+first time after it switched to oneshot mode.
+
+In most cases that goes unnoticed as one of the other cpus has usually
+a timer pending which keeps the broadcast device armed with a short
+timeout. Now if the only cpu which has a short timer active has the
+bit set then the broadcast device will not be armed on behalf of that
+cpu and will fire way after the expected timer expiry. In the case of
+Christians bug report it took ~145 seconds which is about half of the
+wrap around time of HPET (the limit for that device) due to the fact
+that all other cpus had no timers armed which expired before the 145
+seconds timeframe.
+
+The solution is simply to clear the broadcast active bit
+unconditionally when a cpu switches to oneshot mode after the first
+cpu switched the broadcast device over. It's not idle at that point
+otherwise it would not be executing that code.
+
+[ I fundamentally hate that broadcast crap. Why the heck thought some
+  folks that when going into deep idle it's a brilliant concept to
+  switch off the last device which brings the cpu back from that
+  state? ]
+
+Thanks to Christian for providing all the valuable debug information!
+
+Reported-and-tested-by: Christian Hoffmann <email@christianhoffmann.info>
+Cc: John Stultz <johnstul@us.ibm.com>
+Link: http://lkml.kernel.org/r/%3Calpine.LFD.2.02.1105161105170.3078%40ionos%3E
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/tick-broadcast.c |   12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -523,10 +523,11 @@ static void tick_broadcast_init_next_eve
+  */
+ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
+ {
++	int cpu = smp_processor_id();
++
+ 	/* Set it up only once ! */
+ 	if (bc->event_handler != tick_handle_oneshot_broadcast) {
+ 		int was_periodic = bc->mode == CLOCK_EVT_MODE_PERIODIC;
+-		int cpu = smp_processor_id();
+ 
+ 		bc->event_handler = tick_handle_oneshot_broadcast;
+ 		clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
+@@ -552,6 +553,15 @@ void tick_broadcast_setup_oneshot(struct
+ 			tick_broadcast_set_event(tick_next_period, 1);
+ 		} else
+ 			bc->next_event.tv64 = KTIME_MAX;
++	} else {
++		/*
++		 * The first cpu which switches to oneshot mode sets
++		 * the bit for all other cpus which are in the general
++		 * (periodic) broadcast mask. So the bit is set and
++		 * would prevent the first broadcast enter after this
++		 * to program the bc device.
++		 */
++		tick_broadcast_clear_oneshot(cpu);
+ 	}
+ }
+ 
diff --git a/queue-2.6.32/vmxnet3-fix-inconsistent-lro-state-after-initialization.patch b/queue-2.6.32/vmxnet3-fix-inconsistent-lro-state-after-initialization.patch
new file mode 100644
index 0000000..69408cc
--- /dev/null
+++ b/queue-2.6.32/vmxnet3-fix-inconsistent-lro-state-after-initialization.patch
@@ -0,0 +1,56 @@
+From ebde6f8acba92abfc203585198a54f47e83e2cd0 Mon Sep 17 00:00:00 2001
+From: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Date: Mon, 16 May 2011 06:28:15 +0000
+Subject: vmxnet3: Fix inconsistent LRO state after initialization
+
+From: Thomas Jarosch <thomas.jarosch@intra2net.com>
+
+commit ebde6f8acba92abfc203585198a54f47e83e2cd0 upstream.
+
+During initialization of vmxnet3, the state of LRO
+gets out of sync with netdev->features.
+
+This leads to very poor TCP performance in a IP forwarding
+setup and is hitting many VMware users.
+
+Simplified call sequence:
+1. vmxnet3_declare_features() initializes "adapter->lro" to true.
+
+2. The kernel automatically disables LRO if IP forwarding is enabled,
+so vmxnet3_set_flags() gets called. This also updates netdev->features.
+
+3. Now vmxnet3_setup_driver_shared() is called. "adapter->lro" is still
+set to true and LRO gets enabled again, even though
+netdev->features shows it's disabled.
+
+Fix it by updating "adapter->lro", too.
+
+The private vmxnet3 adapter flags are scheduled for removal
+in net-next, see commit a0d2730c9571aeba793cb5d3009094ee1d8fda35
+"net: vmxnet3: convert to hw_features".
+
+Patch applies to 2.6.37 / 2.6.38 and 2.6.39-rc6.
+
+Please CC: comments.
+
+Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Acked-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/vmxnet3/vmxnet3_ethtool.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
++++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
+@@ -288,6 +288,9 @@ vmxnet3_set_flags(struct net_device *net
+ 		/* toggle the LRO feature*/
+ 		netdev->features ^= NETIF_F_LRO;
+ 
++		/* Update private LRO flag */
++		adapter->lro = lro_requested;
++
+ 		/* update harware LRO capability accordingly */
+ 		if (lro_requested)
+ 			adapter->shared->devRead.misc.uptFeatures &= UPT1_F_LRO;
diff --git a/queue-2.6.32/x86-amd-fix-arat-feature-setting-again.patch b/queue-2.6.32/x86-amd-fix-arat-feature-setting-again.patch
new file mode 100644
index 0000000..ed93a1a
--- /dev/null
+++ b/queue-2.6.32/x86-amd-fix-arat-feature-setting-again.patch
@@ -0,0 +1,43 @@
+From 14fb57dccb6e1defe9f89a66f548fcb24c374c1d Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <borislav.petkov@amd.com>
+Date: Tue, 17 May 2011 14:55:19 +0200
+Subject: x86, AMD: Fix ARAT feature setting again
+
+From: Borislav Petkov <borislav.petkov@amd.com>
+
+commit 14fb57dccb6e1defe9f89a66f548fcb24c374c1d upstream.
+
+Trying to enable the local APIC timer on early K8 revisions
+uncovers a number of other issues with it, in conjunction with
+the C1E enter path on AMD. Fixing those causes much more churn
+and troubles than the benefit of using that timer brings so
+don't enable it on K8 at all, falling back to the original
+functionality the kernel had wrt to that.
+
+Reported-and-bisected-by: Nick Bowler <nbowler@elliptictech.com>
+Cc: Boris Ostrovsky <Boris.Ostrovsky@amd.com>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Cc: Greg Kroah-Hartman <greg@kroah.com>
+Cc: Hans Rosenfeld <hans.rosenfeld@amd.com>
+Cc: Nick Bowler <nbowler@elliptictech.com>
+Cc: Joerg-Volker-Peetz <jvpeetz@web.de>
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Link: http://lkml.kernel.org/r/1305636919-31165-3-git-send-email-bp@amd64.org
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/amd.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -568,7 +568,7 @@ static void __cpuinit init_amd(struct cp
+ #endif
+ 
+ 	/* As a rule processors have APIC timer running in deep C states */
+-	if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
++	if (c->x86 > 0xf && !cpu_has_amd_erratum(amd_erratum_400))
+ 		set_cpu_cap(c, X86_FEATURE_ARAT);
+ 
+ 	/*
diff --git a/queue-2.6.32/x86-apic-fix-spurious-error-interrupts-triggering-on-all-non-boot-aps.patch b/queue-2.6.32/x86-apic-fix-spurious-error-interrupts-triggering-on-all-non-boot-aps.patch
new file mode 100644
index 0000000..18cb0a8
--- /dev/null
+++ b/queue-2.6.32/x86-apic-fix-spurious-error-interrupts-triggering-on-all-non-boot-aps.patch
@@ -0,0 +1,94 @@
+From e503f9e4b092e2349a9477a333543de8f3c7f5d9 Mon Sep 17 00:00:00 2001
+From: Youquan Song <youquan.song@intel.com>
+Date: Fri, 22 Apr 2011 00:22:43 +0800
+Subject: x86, apic: Fix spurious error interrupts triggering on all non-boot APs
+
+From: Youquan Song <youquan.song@intel.com>
+
+commit e503f9e4b092e2349a9477a333543de8f3c7f5d9 upstream.
+
+This patch fixes a bug reported by a customer, who found
+that many unreasonable error interrupts reported on all
+non-boot CPUs (APs) during the system boot stage.
+
+According to Chapter 10 of Intel Software Developer Manual
+Volume 3A, Local APIC may signal an illegal vector error when
+an LVT entry is set as an illegal vector value (0~15) under
+FIXED delivery mode (bits 8-11 is 0), regardless of whether
+the mask bit is set or an interrupt actually happen. These
+errors are seen as error interrupts.
+
+The initial value of thermal LVT entries on all APs always reads
+0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
+sequence to them and LVT registers are reset to 0s except for
+the mask bits which are set to 1s when APs receive INIT IPI.
+
+When the BIOS takes over the thermal throttling interrupt,
+the LVT thermal deliver mode should be SMI and it is required
+from the kernel to keep AP's LVT thermal monitoring register
+programmed as such as well.
+
+This issue happens when BIOS does not take over thermal throttling
+interrupt, AP's LVT thermal monitor register will be restored to
+0x10000 which means vector 0 and fixed deliver mode, so all APs will
+signal illegal vector error interrupts.
+
+This patch check if interrupt delivery mode is not fixed mode before
+restoring AP's LVT thermal monitor register.
+
+Signed-off-by: Youquan Song <youquan.song@intel.com>
+Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Acked-by: Yong Wang <yong.y.wang@intel.com>
+Cc: hpa@linux.intel.com
+Cc: joe@perches.com
+Cc: jbaron@redhat.com
+Cc: trenn@suse.de
+Cc: kent.liu@intel.com
+Cc: chaohong.guo@intel.com
+Link: http://lkml.kernel.org/r/1303402963-17738-1-git-send-email-youquan.song@intel.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/apicdef.h           |    1 +
+ arch/x86/kernel/cpu/mcheck/therm_throt.c |   12 +++++++-----
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/include/asm/apicdef.h
++++ b/arch/x86/include/asm/apicdef.h
+@@ -72,6 +72,7 @@
+ #define		APIC_DEST_LOGICAL	0x00800
+ #define		APIC_DEST_PHYSICAL	0x00000
+ #define		APIC_DM_FIXED		0x00000
++#define		APIC_DM_FIXED_MASK	0x00700
+ #define		APIC_DM_LOWEST		0x00100
+ #define		APIC_DM_SMI		0x00200
+ #define		APIC_DM_REMRD		0x00300
+--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+@@ -286,18 +286,20 @@ void intel_init_thermal(struct cpuinfo_x
+ 	 */
+ 	rdmsr(MSR_IA32_MISC_ENABLE, l, h);
+ 
++	h = lvtthmr_init;
+ 	/*
+ 	 * The initial value of thermal LVT entries on all APs always reads
+ 	 * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
+ 	 * sequence to them and LVT registers are reset to 0s except for
+ 	 * the mask bits which are set to 1s when APs receive INIT IPI.
+-	 * Always restore the value that BIOS has programmed on AP based on
+-	 * BSP's info we saved since BIOS is always setting the same value
+-	 * for all threads/cores
++	 * If BIOS takes over the thermal interrupt and sets its interrupt
++	 * delivery mode to SMI (not fixed), it restores the value that the
++	 * BIOS has programmed on AP based on BSP's info we saved since BIOS
++	 * is always setting the same value for all threads/cores.
+ 	 */
+-	apic_write(APIC_LVTTHMR, lvtthmr_init);
++	if ((h & APIC_DM_FIXED_MASK) != APIC_DM_FIXED)
++		apic_write(APIC_LVTTHMR, lvtthmr_init);
+ 
+-	h = lvtthmr_init;
+ 
+ 	if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) {
+ 		printk(KERN_DEBUG
diff --git a/queue-2.6.32/x86-mce-amd-fix-leaving-freed-data-in-a-list.patch b/queue-2.6.32/x86-mce-amd-fix-leaving-freed-data-in-a-list.patch
new file mode 100644
index 0000000..262775c
--- /dev/null
+++ b/queue-2.6.32/x86-mce-amd-fix-leaving-freed-data-in-a-list.patch
@@ -0,0 +1,53 @@
+From d9a5ac9ef306eb5cc874f285185a15c303c50009 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Fri, 13 May 2011 15:52:09 +0200
+Subject: x86, mce, AMD: Fix leaving freed data in a list
+
+From: Julia Lawall <julia@diku.dk>
+
+commit d9a5ac9ef306eb5cc874f285185a15c303c50009 upstream.
+
+b may be added to a list, but is not removed before being freed
+in the case of an error.  This is done in the corresponding
+deallocation function, so the code here has been changed to
+follow that.
+
+The sematic match that finds this problem is as follows:
+(http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression E,E1,E2;
+identifier l;
+@@
+
+*list_add(&E->l,E1);
+... when != E1
+    when != list_del(&E->l)
+    when != list_del_init(&E->l)
+    when != E = E2
+*kfree(E);// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Cc: Borislav Petkov <borislav.petkov@amd.com>
+Cc: Robert Richter <robert.richter@amd.com>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Link: http://lkml.kernel.org/r/1305294731-12127-1-git-send-email-julia@diku.dk
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mcheck/mce_amd.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -468,6 +468,7 @@ recurse:
+ out_free:
+ 	if (b) {
+ 		kobject_put(&b->kobj);
++		list_del(&b->miscj);
+ 		kfree(b);
+ 	}
+ 	return err;
diff --git a/queue-2.6.32/zorro8390-fix-regression-caused-during-net_device_ops-conversion.patch b/queue-2.6.32/zorro8390-fix-regression-caused-during-net_device_ops-conversion.patch
new file mode 100644
index 0000000..e467c77
--- /dev/null
+++ b/queue-2.6.32/zorro8390-fix-regression-caused-during-net_device_ops-conversion.patch
@@ -0,0 +1,75 @@
+From cf7e032fc87d59c475df26c4d40bf45d401b2adb Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Thu, 12 May 2011 09:11:38 +0000
+Subject: zorro8390: Fix regression caused during net_device_ops conversion
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit cf7e032fc87d59c475df26c4d40bf45d401b2adb upstream.
+
+Changeset b6114794a1c394534659f4a17420e48cf23aa922 ("zorro8390: convert to
+net_device_ops") broke zorro8390 by adding 8390.o to the link. That
+meant that lib8390.c was included twice, once in zorro8390.c and once in
+8390.c, subject to different macros. This patch reverts that by
+avoiding the wrappers in 8390.c.
+
+Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
+fix regression caused during net_device_ops conversion") and
+4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
+NET_POLL_CONTROLLER").
+
+Reported-by: Christian T. Steigies <cts@debian.org>
+Suggested-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Tested-by: Christian T. Steigies <cts@debian.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/Makefile    |    2 +-
+ drivers/net/zorro8390.c |   12 ++++++------
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -208,7 +208,7 @@ obj-$(CONFIG_SC92031) += sc92031.o
+ obj-$(CONFIG_LP486E) += lp486e.o
+ 
+ obj-$(CONFIG_ETH16I) += eth16i.o
+-obj-$(CONFIG_ZORRO8390) += zorro8390.o 8390.o
++obj-$(CONFIG_ZORRO8390) += zorro8390.o
+ obj-$(CONFIG_HPLANCE) += hplance.o 7990.o
+ obj-$(CONFIG_MVME147_NET) += mvme147.o 7990.o
+ obj-$(CONFIG_EQUALIZER) += eql.o
+--- a/drivers/net/zorro8390.c
++++ b/drivers/net/zorro8390.c
+@@ -125,7 +125,7 @@ static int __devinit zorro8390_init_one(
+ 
+     board = z->resource.start;
+     ioaddr = board+cards[i].offset;
+-    dev = alloc_ei_netdev();
++    dev = ____alloc_ei_netdev(0);
+     if (!dev)
+ 	return -ENOMEM;
+     if (!request_mem_region(ioaddr, NE_IO_EXTENT*2, DRV_NAME)) {
+@@ -145,15 +145,15 @@ static int __devinit zorro8390_init_one(
+ static const struct net_device_ops zorro8390_netdev_ops = {
+ 	.ndo_open		= zorro8390_open,
+ 	.ndo_stop		= zorro8390_close,
+-	.ndo_start_xmit		= ei_start_xmit,
+-	.ndo_tx_timeout		= ei_tx_timeout,
+-	.ndo_get_stats		= ei_get_stats,
+-	.ndo_set_multicast_list = ei_set_multicast_list,
++	.ndo_start_xmit		= __ei_start_xmit,
++	.ndo_tx_timeout		= __ei_tx_timeout,
++	.ndo_get_stats		= __ei_get_stats,
++	.ndo_set_multicast_list = __ei_set_multicast_list,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ 	.ndo_set_mac_address 	= eth_mac_addr,
+ 	.ndo_change_mtu		= eth_change_mtu,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-	.ndo_poll_controller	= ei_poll,
++	.ndo_poll_controller	= __ei_poll,
+ #endif
+ };
+