Add in semi cooked commits for 2.6.34 based on 2.6.32.41 content

Extracted and applied. Not yet build tested.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

18 files changed, 1019 insertions, 0 deletions

diff --git a/queue/CIFS-Fix-memory-over-bound-bug-in-cifs_parse_mount_o.patch b/queue/CIFS-Fix-memory-over-bound-bug-in-cifs_parse_mount_o.patch
new file mode 100644
index 0000000..1308a56
--- /dev/null
+++ b/queue/CIFS-Fix-memory-over-bound-bug-in-cifs_parse_mount_o.patch
@@ -0,0 +1,49 @@
+From d4e8f7fb97bed3a2f1bed7e687e965da8b0e30df Mon Sep 17 00:00:00 2001
+From: Pavel Shilovsky <piastry@etersoft.ru>
+Date: Thu, 14 Apr 2011 22:00:56 +0400
+Subject: [PATCH] CIFS: Fix memory over bound bug in cifs_parse_mount_options
+
+commit 4906e50b37e6f6c264e7ee4237343eb2b7f8d16d upstream.
+
+While password processing we can get out of options array bound if
+the next character after array is delimiter. The patch adds a check
+if we reach the end.
+
+Signed-off-by: Pavel Shilovsky <piastry@etersoft.ru>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index f6afb59..cebbc29 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -800,8 +800,7 @@ static int
+ cifs_parse_mount_options(char *options, const char *devname,
+ 			 struct smb_vol *vol)
+ {
+-	char *value;
+-	char *data;
++	char *value, *data, *end;
+ 	unsigned int  temp_len, i, j;
+ 	char separator[2];
+ 	short int override_uid = -1;
+@@ -844,6 +843,7 @@ cifs_parse_mount_options(char *options, const char *devname,
+ 	if (!options)
+ 		return 1;
+ 
++	end = options + strlen(options);
+ 	if (strncmp(options, "sep=", 4) == 0) {
+ 		if (options[4] != 0) {
+ 			separator[0] = options[4];
+@@ -908,6 +908,7 @@ cifs_parse_mount_options(char *options, const char *devname,
+ 			the only illegal character in a password is null */
+ 
+ 			if ((value[temp_len] == 0) &&
++			    (value + temp_len < end) &&
+ 			    (value[temp_len+1] == separator[0])) {
+ 				/* reinsert comma */
+ 				value[temp_len] = separator[0];
+-- 
+1.7.7
+
diff --git a/queue/NET-slip-fix-ldisc-open-retval.patch b/queue/NET-slip-fix-ldisc-open-retval.patch
new file mode 100644
index 0000000..97ac3d0
--- /dev/null
+++ b/queue/NET-slip-fix-ldisc-open-retval.patch
@@ -0,0 +1,34 @@
+From c53790d60c59cf7e667cfc2de158e511da98646d Mon Sep 17 00:00:00 2001
+From: Matvejchikov Ilya <matvejchikov@gmail.com>
+Date: Fri, 6 May 2011 06:23:09 +0000
+Subject: [PATCH] NET: slip, fix ldisc->open retval
+
+commit 057bef938896e6266ae24ec4266d24792d27c29a upstream.
+
+TTY layer expects 0 if the ldisc->open operation succeeded.
+
+Signed-off-by : Matvejchikov Ilya <matvejchikov@gmail.com>
+Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Acked-by: Alan Cox <alan@linux.intel.com>
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/drivers/net/slip.c b/drivers/net/slip.c
+index 8969615..2605f3d 100644
+--- a/drivers/net/slip.c
++++ b/drivers/net/slip.c
+@@ -852,7 +852,9 @@ static int slip_open(struct tty_struct *tty)
+ 	/* Done.  We have linked the TTY line to a channel. */
+ 	rtnl_unlock();
+ 	tty->receive_room = 65536;	/* We don't flow control */
+-	return sl->dev->base_addr;
++
++	/* TTY layer expects 0 on success */
++	return 0;
+ 
+ err_free_bufs:
+ 	sl_free_bufs(sl);
+-- 
+1.7.7
+
diff --git a/queue/Validate-size-of-EFI-GUID-partition-entries.patch b/queue/Validate-size-of-EFI-GUID-partition-entries.patch
new file mode 100644
index 0000000..8a0f463
--- /dev/null
+++ b/queue/Validate-size-of-EFI-GUID-partition-entries.patch
@@ -0,0 +1,33 @@
+From f25b2756ab5f08a601b286d3f86c0a97ad6fee90 Mon Sep 17 00:00:00 2001
+From: Timo Warns <Warns@pre-sense.de>
+Date: Fri, 6 May 2011 13:47:35 +0200
+Subject: [PATCH] Validate size of EFI GUID partition entries.
+
+commit fa039d5f6b126fbd65eefa05db2f67e44df8f121 upstream.
+
+Otherwise corrupted EFI partition tables can cause total confusion.
+
+Signed-off-by: Timo Warns <warns@pre-sense.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
+index 91babda..ee59684 100644
+--- a/fs/partitions/efi.c
++++ b/fs/partitions/efi.c
+@@ -350,6 +350,12 @@ is_gpt_valid(struct block_device *bdev, u64 lba,
+ 		goto fail;
+ 	}
+ 
++	/* Check that sizeof_partition_entry has the correct value */
++	if (le32_to_cpu((*gpt)->sizeof_partition_entry) != sizeof(gpt_entry)) {
++		pr_debug("GUID Partitition Entry Size check failed.\n");
++		goto fail;
++	}
++
+ 	if (!(*ptes = alloc_read_gpt_entries(bdev, *gpt)))
+ 		goto fail;
+ 
+-- 
+1.7.7
+
diff --git a/queue/cifs-add-fallback-in-is_path_accessible-for-old-serv.patch b/queue/cifs-add-fallback-in-is_path_accessible-for-old-serv.patch
new file mode 100644
index 0000000..e0d711d
--- /dev/null
+++ b/queue/cifs-add-fallback-in-is_path_accessible-for-old-serv.patch
@@ -0,0 +1,35 @@
+From 891131803d77b28452e621e3d7357dcf0da00513 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 17 May 2011 06:40:30 -0400
+Subject: [PATCH] cifs: add fallback in is_path_accessible for old servers
+
+commit 221d1d797202984cb874e3ed9f1388593d34ee22 upstream.
+
+The is_path_accessible check uses a QPathInfo call, which isn't
+supported by ancient win9x era servers. Fall back to an older
+SMBQueryInfo call if it fails with the magic error codes.
+
+Reported-and-Tested-by: Sandro Bonazzola <sandro.bonazzola@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index cebbc29..1f6aae0 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2254,6 +2254,11 @@ is_path_accessible(int xid, struct cifsTconInfo *tcon,
+ 			      0 /* not legacy */, cifs_sb->local_nls,
+ 			      cifs_sb->mnt_cifs_flags &
+ 				CIFS_MOUNT_MAP_SPECIAL_CHR);
++
++	if (rc == -EOPNOTSUPP || rc == -EINVAL)
++		rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
++				cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
++				  CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 	kfree(pfile_info);
+ 	return rc;
+ }
+-- 
+1.7.7
+
diff --git a/queue/cifs-check-for-bytes_remaining-going-to-zero-in-CIFS.patch b/queue/cifs-check-for-bytes_remaining-going-to-zero-in-CIFS.patch
new file mode 100644
index 0000000..80ce02c
--- /dev/null
+++ b/queue/cifs-check-for-bytes_remaining-going-to-zero-in-CIFS.patch
@@ -0,0 +1,37 @@
+From 05ccb39a77c85b5a896d81911a50a98eaa7654fc Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Wed, 27 Apr 2011 13:25:51 -0400
+Subject: [PATCH] cifs: check for bytes_remaining going to zero in
+ CIFS_SessSetup
+
+commit fcda7f4578bbf9717444ca6da8a421d21489d078 upstream.
+
+It's possible that when we go to decode the string area in the
+SESSION_SETUP response, that bytes_remaining will be 0. Decrementing it at
+that point will mean that it can go "negative" and wrap. Check for a
+bytes_remaining value of 0, and don't try to decode the string area if
+that's the case.
+
+Reported-and-Acked-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index c7d78c0..ff4f5b1 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -906,7 +906,9 @@ ssetup_ntlmssp_authenticate:
+ 	}
+ 
+ 	/* BB check if Unicode and decode strings */
+-	if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
++	if (bytes_remaining == 0) {
++		/* no string area to decode, do nothing */
++	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
+ 		/* unicode string area must be word-aligned */
+ 		if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
+ 			++bcc_ptr;
+-- 
+1.7.7
+
diff --git a/queue/clocksource-Install-completely-before-selecting.patch b/queue/clocksource-Install-completely-before-selecting.patch
new file mode 100644
index 0000000..eee5040
--- /dev/null
+++ b/queue/clocksource-Install-completely-before-selecting.patch
@@ -0,0 +1,49 @@
+From 441662e1c2e32a1dae3c3c18b1531603bea2d228 Mon Sep 17 00:00:00 2001
+From: john stultz <johnstul@us.ibm.com>
+Date: Wed, 4 May 2011 18:16:50 -0700
+Subject: [PATCH] clocksource: Install completely before selecting
+
+commit e05b2efb82596905ebfe88e8612ee81dec9b6592 upstream.
+
+Christian Hoffmann reported that the command line clocksource override
+with acpi_pm timer fails:
+
+ Kernel command line: <SNIP> clocksource=acpi_pm
+ hpet clockevent registered
+ Switching to clocksource hpet
+ Override clocksource acpi_pm is not HRT compatible.
+ Cannot switch while in HRT/NOHZ mode.
+
+The watchdog code is what enables CLOCK_SOURCE_VALID_FOR_HRES, but we
+actually end up selecting the clocksource before we enqueue it into
+the watchdog list, so that's why we see the warning and fail to switch
+to acpi_pm timer as requested. That's particularly bad when we want to
+debug timekeeping related problems in early boot.
+
+Put the selection call last.
+
+[PG: 34 doesn't have __clocksource_register_scale, so drop that 1/2]
+
+Reported-by: Christian Hoffmann <email@christianhoffmann.info>
+Signed-off-by: John Stultz <johnstul@us.ibm.com>
+Link: http://lkml.kernel.org/r/%3C1304558210.2943.24.camel%40work-vm%3E
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
+index 1f5dde6..db24c5c 100644
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -638,8 +638,8 @@ int clocksource_register(struct clocksource *cs)
+ 
+ 	mutex_lock(&clocksource_mutex);
+ 	clocksource_enqueue(cs);
+-	clocksource_select();
+ 	clocksource_enqueue_watchdog(cs);
++	clocksource_select();
+ 	mutex_unlock(&clocksource_mutex);
+ 	return 0;
+ }
+-- 
+1.7.7
+
diff --git a/queue/ehea-fix-wrongly-reported-speed-and-port.patch b/queue/ehea-fix-wrongly-reported-speed-and-port.patch
new file mode 100644
index 0000000..7e6b14b
--- /dev/null
+++ b/queue/ehea-fix-wrongly-reported-speed-and-port.patch
@@ -0,0 +1,54 @@
+From 236742271a0e0cb819de03bac75635ac0fe8081b Mon Sep 17 00:00:00 2001
+From: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+Date: Wed, 4 May 2011 13:05:11 +0000
+Subject: [PATCH] ehea: fix wrongly reported speed and port
+
+commit dcbe14b91a920657ff3a9ba0efb7c5b5562f956a upstream.
+
+Currently EHEA reports to ethtool as supporting 10M, 100M, 1G and
+10G and connected to FIBRE independent of the hardware configuration.
+However, when connected to FIBRE the only supported speed is 10G
+full-duplex, and the other speeds and modes are only supported
+when connected to twisted pair.
+
+Signed-off-by: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+Acked-by: Breno Leitao <leitao@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/drivers/net/ehea/ehea_ethtool.c b/drivers/net/ehea/ehea_ethtool.c
+index 75b099c..f97da2a 100644
+--- a/drivers/net/ehea/ehea_ethtool.c
++++ b/drivers/net/ehea/ehea_ethtool.c
+@@ -53,15 +53,20 @@ static int ehea_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+ 		cmd->duplex = -1;
+ 	}
+ 
+-	cmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_1000baseT_Full
+-		       | SUPPORTED_100baseT_Full |  SUPPORTED_100baseT_Half
+-		       | SUPPORTED_10baseT_Full | SUPPORTED_10baseT_Half
+-		       | SUPPORTED_Autoneg | SUPPORTED_FIBRE);
+-
+-	cmd->advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_Autoneg
+-			 | ADVERTISED_FIBRE);
++	if (cmd->speed == SPEED_10000) {
++		cmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
++		cmd->advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_FIBRE);
++		cmd->port = PORT_FIBRE;
++	} else {
++		cmd->supported = (SUPPORTED_1000baseT_Full | SUPPORTED_100baseT_Full
++			       | SUPPORTED_100baseT_Half | SUPPORTED_10baseT_Full
++			       | SUPPORTED_10baseT_Half | SUPPORTED_Autoneg
++			       | SUPPORTED_TP);
++		cmd->advertising = (ADVERTISED_1000baseT_Full | ADVERTISED_Autoneg
++				 | ADVERTISED_TP);
++		cmd->port = PORT_TP;
++	}
+ 
+-	cmd->port = PORT_FIBRE;
+ 	cmd->autoneg = port->autoneg == 1 ? AUTONEG_ENABLE : AUTONEG_DISABLE;
+ 
+ 	return 0;
+-- 
+1.7.7
+
diff --git a/queue/hydra-Fix-regression-caused-during-net_device_ops-co.patch b/queue/hydra-Fix-regression-caused-during-net_device_ops-co.patch
new file mode 100644
index 0000000..46c20c5
--- /dev/null
+++ b/queue/hydra-Fix-regression-caused-during-net_device_ops-co.patch
@@ -0,0 +1,74 @@
+From 4865ae88efd9d74efb4354c9e5ad66dd1a0c3b11 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Thu, 12 May 2011 09:11:39 +0000
+Subject: [PATCH] hydra: Fix regression caused during net_device_ops
+ conversion
+
+commit 0b25e0157dfa236a0629c16c8ad6f222f633f682 upstream.
+
+Changeset 5618f0d1193d6b051da9b59b0e32ad24397f06a4 ("hydra: convert to
+net_device_ops") broke hydra by adding 8390.o to the link. That
+meant that lib8390.c was included twice, once in hydra.c and once in
+8390.c, subject to different macros. This patch reverts that by
+avoiding the wrappers in 8390.c.
+
+Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
+fix regression caused during net_device_ops conversion") and
+4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
+NET_POLL_CONTROLLER").
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/drivers/net/Makefile b/drivers/net/Makefile
+index 9ae1951..1c60c32 100644
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -225,7 +225,7 @@ obj-$(CONFIG_SGI_IOC3_ETH) += ioc3-eth.o
+ obj-$(CONFIG_DECLANCE) += declance.o
+ obj-$(CONFIG_ATARILANCE) += atarilance.o
+ obj-$(CONFIG_A2065) += a2065.o
+-obj-$(CONFIG_HYDRA) += hydra.o 8390.o
++obj-$(CONFIG_HYDRA) += hydra.o
+ obj-$(CONFIG_ARIADNE) += ariadne.o
+ obj-$(CONFIG_CS89x0) += cs89x0.o
+ obj-$(CONFIG_MACSONIC) += macsonic.o
+diff --git a/drivers/net/hydra.c b/drivers/net/hydra.c
+index 24724b4..4b6cb8a 100644
+--- a/drivers/net/hydra.c
++++ b/drivers/net/hydra.c
+@@ -97,15 +97,15 @@ static const struct net_device_ops hydra_netdev_ops = {
+ 	.ndo_open		= hydra_open,
+ 	.ndo_stop		= hydra_close,
+ 
+-	.ndo_start_xmit		= ei_start_xmit,
+-	.ndo_tx_timeout		= ei_tx_timeout,
+-	.ndo_get_stats		= ei_get_stats,
+-	.ndo_set_multicast_list = ei_set_multicast_list,
++	.ndo_start_xmit		= __ei_start_xmit,
++	.ndo_tx_timeout		= __ei_tx_timeout,
++	.ndo_get_stats		= __ei_get_stats,
++	.ndo_set_multicast_list = __ei_set_multicast_list,
+ 	.ndo_validate_addr	= eth_validate_addr,
+-	.ndo_set_mac_address 	= eth_mac_addr,
++	.ndo_set_mac_address	= eth_mac_addr,
+ 	.ndo_change_mtu		= eth_change_mtu,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-	.ndo_poll_controller	= ei_poll,
++	.ndo_poll_controller	= __ei_poll,
+ #endif
+ };
+ 
+@@ -124,7 +124,7 @@ static int __devinit hydra_init(struct zorro_dev *z)
+ 	0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
+     };
+ 
+-    dev = alloc_ei_netdev();
++    dev = ____alloc_ei_netdev(0);
+     if (!dev)
+ 	return -ENOMEM;
+ 
+-- 
+1.7.7
+
diff --git a/queue/libertas-fix-cmdpendingq-locking.patch b/queue/libertas-fix-cmdpendingq-locking.patch
new file mode 100644
index 0000000..c72d626
--- /dev/null
+++ b/queue/libertas-fix-cmdpendingq-locking.patch
@@ -0,0 +1,59 @@
+From 2d32f9be9648eb07dcb4cf5224207f09739cec72 Mon Sep 17 00:00:00 2001
+From: Paul Fox <pgf@laptop.org>
+Date: Mon, 9 May 2011 10:40:42 +0100
+Subject: [PATCH] libertas: fix cmdpendingq locking
+
+commit 2ae1b8b35faba31a59b153cbad07f9c15de99740 upstream.
+
+We occasionally see list corruption using libertas.
+
+While we haven't been able to diagnose this precisely, we have spotted
+a possible cause: cmdpendingq is generally modified with driver_lock
+held. However, there are a couple of points where this is not the case.
+
+Fix up those operations to execute under the lock, it seems like
+the correct thing to do and will hopefully improve the situation.
+
+Signed-off-by: Paul Fox <pgf@laptop.org>
+Signed-off-by: Daniel Drake <dsd@laptop.org>
+Acked-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
+index cdb9b96..91bafae 100644
+--- a/drivers/net/wireless/libertas/cmd.c
++++ b/drivers/net/wireless/libertas/cmd.c
+@@ -1267,8 +1267,8 @@ int lbs_execute_next_command(struct lbs_private *priv)
+ 				    cpu_to_le16(CMD_SUBCMD_EXIT_PS)) {
+ 					lbs_deb_host(
+ 					       "EXEC_NEXT_CMD: ignore ENTER_PS cmd\n");
+-					list_del(&cmdnode->list);
+ 					spin_lock_irqsave(&priv->driver_lock, flags);
++					list_del(&cmdnode->list);
+ 					lbs_complete_command(priv, cmdnode, 0);
+ 					spin_unlock_irqrestore(&priv->driver_lock, flags);
+ 
+@@ -1280,8 +1280,8 @@ int lbs_execute_next_command(struct lbs_private *priv)
+ 				    (priv->psstate == PS_STATE_PRE_SLEEP)) {
+ 					lbs_deb_host(
+ 					       "EXEC_NEXT_CMD: ignore EXIT_PS cmd in sleep\n");
+-					list_del(&cmdnode->list);
+ 					spin_lock_irqsave(&priv->driver_lock, flags);
++					list_del(&cmdnode->list);
+ 					lbs_complete_command(priv, cmdnode, 0);
+ 					spin_unlock_irqrestore(&priv->driver_lock, flags);
+ 					priv->needtowakeup = 1;
+@@ -1294,7 +1294,9 @@ int lbs_execute_next_command(struct lbs_private *priv)
+ 				       "EXEC_NEXT_CMD: sending EXIT_PS\n");
+ 			}
+ 		}
++		spin_lock_irqsave(&priv->driver_lock, flags);
+ 		list_del(&cmdnode->list);
++		spin_unlock_irqrestore(&priv->driver_lock, flags);
+ 		lbs_deb_host("EXEC_NEXT_CMD: sending command 0x%04x\n",
+ 			    le16_to_cpu(cmd->command));
+ 		lbs_submit_command(priv, cmdnode);
+-- 
+1.7.7
+
diff --git a/queue/megaraid_sas-Sanity-check-user-supplied-length-befor.patch b/queue/megaraid_sas-Sanity-check-user-supplied-length-befor.patch
new file mode 100644
index 0000000..c430e17
--- /dev/null
+++ b/queue/megaraid_sas-Sanity-check-user-supplied-length-befor.patch
@@ -0,0 +1,91 @@
+From 40764ec69c95f7eec733d50535432c933ae80c70 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 19 Jan 2011 10:01:14 +0100
+Subject: [PATCH] megaraid_sas: Sanity check user supplied length before
+ passing it to dma_alloc_coherent()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 98cb7e4413d189cd2b54daf993a4667d9788c0bb upstream.
+
+The ioc->sgl[i].iov_len value is supplied by the ioctl caller, and can be
+zero in some cases.  Assume that's valid and continue without error.
+
+Fixes (multiple individual reports of the same problem for quite a while):
+
+http://marc.info/?l=linux-ide&m=128941801715301
+http://bugs.debian.org/604627
+http://www.mail-archive.com/linux-poweredge@dell.com/msg02575.html
+
+megasas: Failed to alloc kernel SGL buffer for IOCTL
+
+and
+
+[   69.162538] ------------[ cut here ]------------
+[   69.162806] kernel BUG at /build/buildd/linux-2.6.32/lib/swiotlb.c:368!
+[   69.163134] invalid opcode: 0000 [#1] SMP
+[   69.163570] last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map
+[   69.163975] CPU 0
+[   69.164227] Modules linked in: fbcon tileblit font bitblit softcursor vga16fb vgastate ioatdma radeon ttm drm_kms_helper shpchp drm i2c_algo_bit lp parport floppy pata_jmicron megaraid_sas igb dca
+[   69.167419] Pid: 1206, comm: smartctl Tainted: G        W  2.6.32-25-server #45-Ubuntu X8DTN
+[   69.167843] RIP: 0010:[<ffffffff812c4dc5>]  [<ffffffff812c4dc5>] map_single+0x255/0x260
+[   69.168370] RSP: 0018:ffff88081c0ebc58  EFLAGS: 00010246
+[   69.168655] RAX: 000000000003bffc RBX: 00000000ffffffff RCX: 0000000000000002
+[   69.169000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88001dffe000
+[   69.169346] RBP: ffff88081c0ebcb8 R08: 0000000000000000 R09: ffff880000030840
+[   69.169691] R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000000
+[   69.170036] R13: 00000000ffffffff R14: 0000000000000001 R15: 0000000000200000
+[   69.170382] FS:  00007fb8de189720(0000) GS:ffff88001de00000(0000) knlGS:0000000000000000
+[   69.170794] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[   69.171094] CR2: 00007fb8dd59237c CR3: 000000081a790000 CR4: 00000000000006f0
+[   69.171439] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[   69.171784] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+[   69.172130] Process smartctl (pid: 1206, threadinfo ffff88081c0ea000, task ffff88081a760000)
+[   69.194513] Stack:
+[   69.205788]  0000000000000034 00000002817e3390 0000000000000000 ffff88081c0ebe00
+[   69.217739] <0> 0000000000000000 000000000003bffc 0000000000000000 0000000000000000
+[   69.241250] <0> 0000000000000000 00000000ffffffff ffff88081c5b4080 ffff88081c0ebe00
+[   69.277310] Call Trace:
+[   69.289278]  [<ffffffff812c52ac>] swiotlb_alloc_coherent+0xec/0x130
+[   69.301118]  [<ffffffff81038b31>] x86_swiotlb_alloc_coherent+0x61/0x70
+[   69.313045]  [<ffffffffa002d0ce>] megasas_mgmt_fw_ioctl+0x1ae/0x690 [megaraid_sas]
+[   69.336399]  [<ffffffffa002d748>] megasas_mgmt_ioctl_fw+0x198/0x240 [megaraid_sas]
+[   69.359346]  [<ffffffffa002f695>] megasas_mgmt_ioctl+0x35/0x50 [megaraid_sas]
+[   69.370902]  [<ffffffff81153b12>] vfs_ioctl+0x22/0xa0
+[   69.382322]  [<ffffffff8115da2a>] ? alloc_fd+0x10a/0x150
+[   69.393622]  [<ffffffff81153cb1>] do_vfs_ioctl+0x81/0x410
+[   69.404696]  [<ffffffff8155cc13>] ? do_page_fault+0x153/0x3b0
+[   69.415761]  [<ffffffff811540c1>] sys_ioctl+0x81/0xa0
+[   69.426640]  [<ffffffff810121b2>] system_call_fastpath+0x16/0x1b
+[   69.437491] Code: fe ff ff 48 8b 3d 74 38 76 00 41 bf 00 00 20 00 e8 51 f5 d7 ff 83 e0 ff 48 05 ff 07 00 00 48 c1 e8 0b 48 89 45 c8 e9 13 fe ff ff <0f> 0b eb fe 0f 1f 80 00 00 00 00 55 48 89 e5 48 83 ec 20 4c 89
+[   69.478216] RIP  [<ffffffff812c4dc5>] map_single+0x255/0x260
+[   69.489668]  RSP <ffff88081c0ebc58>
+[   69.500975] ---[ end trace 6a2181b634e2abc7 ]---
+
+[PG: in 34, file is megaraid_sas.c - not megaraid_sas_base.c]
+
+Reported-by: Bokhan Artem <aptem@ngs.ru>
+Reported by: Marc-Christian Petersen <m.c.p@gmx.de>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Cc: "Benz, Michael" <Michael.Benz@lsi.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
+index 99e4478..1d2e162 100644
+--- a/drivers/scsi/megaraid/megaraid_sas.c
++++ b/drivers/scsi/megaraid/megaraid_sas.c
+@@ -3669,6 +3669,9 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
+ 	 * For each user buffer, create a mirror buffer and copy in
+ 	 */
+ 	for (i = 0; i < ioc->sge_count; i++) {
++		if (!ioc->sgl[i].iov_len)
++			continue;
++
+ 		kbuff_arr[i] = dma_alloc_coherent(&instance->pdev->dev,
+ 						    ioc->sgl[i].iov_len,
+ 						    &buf_handle, GFP_KERNEL);
+-- 
+1.7.7
+
diff --git a/queue/ne-h8300-Fix-regression-caused-during-net_device_ops.patch b/queue/ne-h8300-Fix-regression-caused-during-net_device_ops.patch
new file mode 100644
index 0000000..74b11de
--- /dev/null
+++ b/queue/ne-h8300-Fix-regression-caused-during-net_device_ops.patch
@@ -0,0 +1,83 @@
+From 85cfe0b4128122232e0717940d6b89e4d2b97ae5 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Thu, 12 May 2011 09:11:40 +0000
+Subject: [PATCH] ne-h8300: Fix regression caused during net_device_ops
+ conversion
+
+commit 2592a7354092afd304a8c067319b15ab1e441e35 upstream.
+
+Changeset dcd39c90290297f6e6ed8a04bb20da7ac2b043c5 ("ne-h8300: convert to
+net_device_ops") broke ne-h8300 by adding 8390.o to the link. That
+meant that lib8390.c was included twice, once in ne-h8300.c and once in
+8390.c, subject to different macros. This patch reverts that by
+avoiding the wrappers in 8390.c.
+
+Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
+fix regression caused during net_device_ops conversion") and
+4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
+NET_POLL_CONTROLLER").
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/drivers/net/Makefile b/drivers/net/Makefile
+index 12b280a..9ae1951 100644
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -141,7 +141,7 @@ obj-$(CONFIG_NE3210) += ne3210.o 8390.o
+ obj-$(CONFIG_SB1250_MAC) += sb1250-mac.o
+ obj-$(CONFIG_B44) += b44.o
+ obj-$(CONFIG_FORCEDETH) += forcedeth.o
+-obj-$(CONFIG_NE_H8300) += ne-h8300.o 8390.o
++obj-$(CONFIG_NE_H8300) += ne-h8300.o
+ obj-$(CONFIG_AX88796) += ax88796.o
+ obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
+ 
+diff --git a/drivers/net/ne-h8300.c b/drivers/net/ne-h8300.c
+index 7bd6662..31da04f 100644
+--- a/drivers/net/ne-h8300.c
++++ b/drivers/net/ne-h8300.c
+@@ -167,7 +167,7 @@ static void cleanup_card(struct net_device *dev)
+ #ifndef MODULE
+ struct net_device * __init ne_probe(int unit)
+ {
+-	struct net_device *dev = alloc_ei_netdev();
++	struct net_device *dev = ____alloc_ei_netdev(0);
+ 	int err;
+ 
+ 	if (!dev)
+@@ -197,15 +197,15 @@ static const struct net_device_ops ne_netdev_ops = {
+ 	.ndo_open		= ne_open,
+ 	.ndo_stop		= ne_close,
+ 
+-	.ndo_start_xmit		= ei_start_xmit,
+-	.ndo_tx_timeout		= ei_tx_timeout,
+-	.ndo_get_stats		= ei_get_stats,
+-	.ndo_set_multicast_list = ei_set_multicast_list,
++	.ndo_start_xmit		= __ei_start_xmit,
++	.ndo_tx_timeout		= __ei_tx_timeout,
++	.ndo_get_stats		= __ei_get_stats,
++	.ndo_set_multicast_list = __ei_set_multicast_list,
+ 	.ndo_validate_addr	= eth_validate_addr,
+-	.ndo_set_mac_address 	= eth_mac_addr,
++	.ndo_set_mac_address	= eth_mac_addr,
+ 	.ndo_change_mtu		= eth_change_mtu,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-	.ndo_poll_controller	= ei_poll,
++	.ndo_poll_controller	= __ei_poll,
+ #endif
+ };
+ 
+@@ -638,7 +638,7 @@ int init_module(void)
+ 	int err;
+ 
+ 	for (this_dev = 0; this_dev < MAX_NE_CARDS; this_dev++) {
+-		struct net_device *dev = alloc_ei_netdev();
++		struct net_device *dev = ____alloc_ei_netdev(0);
+ 		if (!dev)
+ 			break;
+ 		if (io[this_dev]) {
+-- 
+1.7.7
+
diff --git a/queue/series b/queue/series
index d5d5995..82259d7 100644
--- a/queue/series
+++ b/queue/series
@@ -182,6 +182,23 @@ fix-oops-in-scsi_run_queue.patch
 
 # Content taken from v2.6.32.41
 dccp-handle-invalid-feature-options-length.patch
+cifs-check-for-bytes_remaining-going-to-zero-in-CIFS.patch
+Validate-size-of-EFI-GUID-partition-entries.patch
+CIFS-Fix-memory-over-bound-bug-in-cifs_parse_mount_o.patch
+ehea-fix-wrongly-reported-speed-and-port.patch
+NET-slip-fix-ldisc-open-retval.patch
+ne-h8300-Fix-regression-caused-during-net_device_ops.patch
+hydra-Fix-regression-caused-during-net_device_ops-co.patch
+libertas-fix-cmdpendingq-locking.patch
+zorro8390-Fix-regression-caused-during-net_device_op.patch
+cifs-add-fallback-in-is_path_accessible-for-old-serv.patch
+x86-AMD-Fix-ARAT-feature-setting-again.patch
+clocksource-Install-completely-before-selecting.patch
+tick-Clear-broadcast-active-bit-when-switching-to-on.patch
+x86-apic-Fix-spurious-error-interrupts-triggering-on.patch
+x86-mce-AMD-Fix-leaving-freed-data-in-a-list.patch
+megaraid_sas-Sanity-check-user-supplied-length-befor.patch
+vmxnet3-Fix-inconsistent-LRO-state-after-initializat.patch
 
 # Content taken from v2.6.32.42
 
diff --git a/queue/tick-Clear-broadcast-active-bit-when-switching-to-on.patch b/queue/tick-Clear-broadcast-active-bit-when-switching-to-on.patch
new file mode 100644
index 0000000..89d90e9
--- /dev/null
+++ b/queue/tick-Clear-broadcast-active-bit-when-switching-to-on.patch
@@ -0,0 +1,84 @@
+From c89b1de9e02b3241295a6a831a50ad85ef623bca Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 16 May 2011 11:07:48 +0200
+Subject: [PATCH] tick: Clear broadcast active bit when switching to oneshot
+
+commit 07f4beb0b5bbfaf36a64aa00d59e670ec578a95a upstream.
+
+The first cpu which switches from periodic to oneshot mode switches
+also the broadcast device into oneshot mode. The broadcast device
+serves as a backup for per cpu timers which stop in deeper
+C-states. To avoid starvation of the cpus which might be in idle and
+depend on broadcast mode it marks the other cpus as broadcast active
+and sets the brodcast expiry value of those cpus to the next tick.
+
+The oneshot mode broadcast bit for the other cpus is sticky and gets
+only cleared when those cpus exit idle. If a cpu was not idle while
+the bit got set in consequence the bit prevents that the broadcast
+device is armed on behalf of that cpu when it enters idle for the
+first time after it switched to oneshot mode.
+
+In most cases that goes unnoticed as one of the other cpus has usually
+a timer pending which keeps the broadcast device armed with a short
+timeout. Now if the only cpu which has a short timer active has the
+bit set then the broadcast device will not be armed on behalf of that
+cpu and will fire way after the expected timer expiry. In the case of
+Christians bug report it took ~145 seconds which is about half of the
+wrap around time of HPET (the limit for that device) due to the fact
+that all other cpus had no timers armed which expired before the 145
+seconds timeframe.
+
+The solution is simply to clear the broadcast active bit
+unconditionally when a cpu switches to oneshot mode after the first
+cpu switched the broadcast device over. It's not idle at that point
+otherwise it would not be executing that code.
+
+[ I fundamentally hate that broadcast crap. Why the heck thought some
+  folks that when going into deep idle it's a brilliant concept to
+  switch off the last device which brings the cpu back from that
+  state? ]
+
+Thanks to Christian for providing all the valuable debug information!
+
+Reported-and-tested-by: Christian Hoffmann <email@christianhoffmann.info>
+Cc: John Stultz <johnstul@us.ibm.com>
+Link: http://lkml.kernel.org/r/%3Calpine.LFD.2.02.1105161105170.3078%40ionos%3E
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index 2030f62..0f888cb 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -523,10 +523,11 @@ static void tick_broadcast_init_next_event(struct cpumask *mask,
+  */
+ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
+ {
++	int cpu = smp_processor_id();
++
+ 	/* Set it up only once ! */
+ 	if (bc->event_handler != tick_handle_oneshot_broadcast) {
+ 		int was_periodic = bc->mode == CLOCK_EVT_MODE_PERIODIC;
+-		int cpu = smp_processor_id();
+ 
+ 		bc->event_handler = tick_handle_oneshot_broadcast;
+ 		clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
+@@ -552,6 +553,15 @@ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
+ 			tick_broadcast_set_event(tick_next_period, 1);
+ 		} else
+ 			bc->next_event.tv64 = KTIME_MAX;
++	} else {
++		/*
++		 * The first cpu which switches to oneshot mode sets
++		 * the bit for all other cpus which are in the general
++		 * (periodic) broadcast mask. So the bit is set and
++		 * would prevent the first broadcast enter after this
++		 * to program the bc device.
++		 */
++		tick_broadcast_clear_oneshot(cpu);
+ 	}
+ }
+ 
+-- 
+1.7.7
+
diff --git a/queue/vmxnet3-Fix-inconsistent-LRO-state-after-initializat.patch b/queue/vmxnet3-Fix-inconsistent-LRO-state-after-initializat.patch
new file mode 100644
index 0000000..8d0bbcc
--- /dev/null
+++ b/queue/vmxnet3-Fix-inconsistent-LRO-state-after-initializat.patch
@@ -0,0 +1,55 @@
+From db2fd6577aa434761329823f24c4acc48b4402df Mon Sep 17 00:00:00 2001
+From: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Date: Mon, 16 May 2011 06:28:15 +0000
+Subject: [PATCH] vmxnet3: Fix inconsistent LRO state after initialization
+
+commit ebde6f8acba92abfc203585198a54f47e83e2cd0 upstream.
+
+During initialization of vmxnet3, the state of LRO
+gets out of sync with netdev->features.
+
+This leads to very poor TCP performance in a IP forwarding
+setup and is hitting many VMware users.
+
+Simplified call sequence:
+1. vmxnet3_declare_features() initializes "adapter->lro" to true.
+
+2. The kernel automatically disables LRO if IP forwarding is enabled,
+so vmxnet3_set_flags() gets called. This also updates netdev->features.
+
+3. Now vmxnet3_setup_driver_shared() is called. "adapter->lro" is still
+set to true and LRO gets enabled again, even though
+netdev->features shows it's disabled.
+
+Fix it by updating "adapter->lro", too.
+
+The private vmxnet3 adapter flags are scheduled for removal
+in net-next, see commit a0d2730c9571aeba793cb5d3009094ee1d8fda35
+"net: vmxnet3: convert to hw_features".
+
+Patch applies to 2.6.37 / 2.6.38 and 2.6.39-rc6.
+
+Please CC: comments.
+
+Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Acked-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
+index 3935c44..df7cddd 100644
+--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
++++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
+@@ -290,6 +290,9 @@ vmxnet3_set_flags(struct net_device *netdev, u32 data) {
+ 		/* toggle the LRO feature*/
+ 		netdev->features ^= NETIF_F_LRO;
+ 
++		/* Update private LRO flag */
++		adapter->lro = lro_requested;
++
+ 		/* update harware LRO capability accordingly */
+ 		if (lro_requested)
+ 			adapter->shared->devRead.misc.uptFeatures &= UPT1_F_LRO;
+-- 
+1.7.7
+
diff --git a/queue/x86-AMD-Fix-ARAT-feature-setting-again.patch b/queue/x86-AMD-Fix-ARAT-feature-setting-again.patch
new file mode 100644
index 0000000..49f3416
--- /dev/null
+++ b/queue/x86-AMD-Fix-ARAT-feature-setting-again.patch
@@ -0,0 +1,42 @@
+From 247a6321878c00562e16bb0b32defed593e8a04c Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <borislav.petkov@amd.com>
+Date: Tue, 17 May 2011 14:55:19 +0200
+Subject: [PATCH] x86, AMD: Fix ARAT feature setting again
+
+commit 14fb57dccb6e1defe9f89a66f548fcb24c374c1d upstream.
+
+Trying to enable the local APIC timer on early K8 revisions
+uncovers a number of other issues with it, in conjunction with
+the C1E enter path on AMD. Fixing those causes much more churn
+and troubles than the benefit of using that timer brings so
+don't enable it on K8 at all, falling back to the original
+functionality the kernel had wrt to that.
+
+Reported-and-bisected-by: Nick Bowler <nbowler@elliptictech.com>
+Cc: Boris Ostrovsky <Boris.Ostrovsky@amd.com>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Cc: Greg Kroah-Hartman <greg@kroah.com>
+Cc: Hans Rosenfeld <hans.rosenfeld@amd.com>
+Cc: Nick Bowler <nbowler@elliptictech.com>
+Cc: Joerg-Volker-Peetz <jvpeetz@web.de>
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Link: http://lkml.kernel.org/r/1305636919-31165-3-git-send-email-bp@amd64.org
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 89e2071..abe04cf 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -567,7 +567,7 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
+ #endif
+ 
+ 	/* As a rule processors have APIC timer running in deep C states */
+-	if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
++	if (c->x86 > 0xf && !cpu_has_amd_erratum(amd_erratum_400))
+ 		set_cpu_cap(c, X86_FEATURE_ARAT);
+ 
+ 	/*
+-- 
+1.7.7
+
diff --git a/queue/x86-apic-Fix-spurious-error-interrupts-triggering-on.patch b/queue/x86-apic-Fix-spurious-error-interrupts-triggering-on.patch
new file mode 100644
index 0000000..67ae4aa
--- /dev/null
+++ b/queue/x86-apic-Fix-spurious-error-interrupts-triggering-on.patch
@@ -0,0 +1,95 @@
+From 3d598e187af84ca8b1741587ae0f4ed042083288 Mon Sep 17 00:00:00 2001
+From: Youquan Song <youquan.song@intel.com>
+Date: Fri, 22 Apr 2011 00:22:43 +0800
+Subject: [PATCH] x86, apic: Fix spurious error interrupts triggering on all
+ non-boot APs
+
+commit e503f9e4b092e2349a9477a333543de8f3c7f5d9 upstream.
+
+This patch fixes a bug reported by a customer, who found
+that many unreasonable error interrupts reported on all
+non-boot CPUs (APs) during the system boot stage.
+
+According to Chapter 10 of Intel Software Developer Manual
+Volume 3A, Local APIC may signal an illegal vector error when
+an LVT entry is set as an illegal vector value (0~15) under
+FIXED delivery mode (bits 8-11 is 0), regardless of whether
+the mask bit is set or an interrupt actually happen. These
+errors are seen as error interrupts.
+
+The initial value of thermal LVT entries on all APs always reads
+0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
+sequence to them and LVT registers are reset to 0s except for
+the mask bits which are set to 1s when APs receive INIT IPI.
+
+When the BIOS takes over the thermal throttling interrupt,
+the LVT thermal deliver mode should be SMI and it is required
+from the kernel to keep AP's LVT thermal monitoring register
+programmed as such as well.
+
+This issue happens when BIOS does not take over thermal throttling
+interrupt, AP's LVT thermal monitor register will be restored to
+0x10000 which means vector 0 and fixed deliver mode, so all APs will
+signal illegal vector error interrupts.
+
+This patch check if interrupt delivery mode is not fixed mode before
+restoring AP's LVT thermal monitor register.
+
+Signed-off-by: Youquan Song <youquan.song@intel.com>
+Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Acked-by: Yong Wang <yong.y.wang@intel.com>
+Cc: hpa@linux.intel.com
+Cc: joe@perches.com
+Cc: jbaron@redhat.com
+Cc: trenn@suse.de
+Cc: kent.liu@intel.com
+Cc: chaohong.guo@intel.com
+Link: http://lkml.kernel.org/r/1303402963-17738-1-git-send-email-youquan.song@intel.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/arch/x86/include/asm/apicdef.h b/arch/x86/include/asm/apicdef.h
+index 7fe3b30..49d7c96 100644
+--- a/arch/x86/include/asm/apicdef.h
++++ b/arch/x86/include/asm/apicdef.h
+@@ -78,6 +78,7 @@
+ #define		APIC_DEST_LOGICAL	0x00800
+ #define		APIC_DEST_PHYSICAL	0x00000
+ #define		APIC_DM_FIXED		0x00000
++#define		APIC_DM_FIXED_MASK	0x00700
+ #define		APIC_DM_LOWEST		0x00100
+ #define		APIC_DM_SMI		0x00200
+ #define		APIC_DM_REMRD		0x00300
+diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+index 81c499e..493b668 100644
+--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+@@ -293,18 +293,20 @@ void intel_init_thermal(struct cpuinfo_x86 *c)
+ 	 */
+ 	rdmsr(MSR_IA32_MISC_ENABLE, l, h);
+ 
++	h = lvtthmr_init;
+ 	/*
+ 	 * The initial value of thermal LVT entries on all APs always reads
+ 	 * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
+ 	 * sequence to them and LVT registers are reset to 0s except for
+ 	 * the mask bits which are set to 1s when APs receive INIT IPI.
+-	 * Always restore the value that BIOS has programmed on AP based on
+-	 * BSP's info we saved since BIOS is always setting the same value
+-	 * for all threads/cores
++	 * If BIOS takes over the thermal interrupt and sets its interrupt
++	 * delivery mode to SMI (not fixed), it restores the value that the
++	 * BIOS has programmed on AP based on BSP's info we saved since BIOS
++	 * is always setting the same value for all threads/cores.
+ 	 */
+-	apic_write(APIC_LVTTHMR, lvtthmr_init);
++	if ((h & APIC_DM_FIXED_MASK) != APIC_DM_FIXED)
++		apic_write(APIC_LVTTHMR, lvtthmr_init);
+ 
+-	h = lvtthmr_init;
+ 
+ 	if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) {
+ 		printk(KERN_DEBUG
+-- 
+1.7.7
+
diff --git a/queue/x86-mce-AMD-Fix-leaving-freed-data-in-a-list.patch b/queue/x86-mce-AMD-Fix-leaving-freed-data-in-a-list.patch
new file mode 100644
index 0000000..d819578
--- /dev/null
+++ b/queue/x86-mce-AMD-Fix-leaving-freed-data-in-a-list.patch
@@ -0,0 +1,52 @@
+From 01588b67ffded594fdac360c1024b94e32d632b1 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Fri, 13 May 2011 15:52:09 +0200
+Subject: [PATCH] x86, mce, AMD: Fix leaving freed data in a list
+
+commit d9a5ac9ef306eb5cc874f285185a15c303c50009 upstream.
+
+b may be added to a list, but is not removed before being freed
+in the case of an error.  This is done in the corresponding
+deallocation function, so the code here has been changed to
+follow that.
+
+The sematic match that finds this problem is as follows:
+(http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression E,E1,E2;
+identifier l;
+@@
+
+*list_add(&E->l,E1);
+... when != E1
+    when != list_del(&E->l)
+    when != list_del_init(&E->l)
+    when != E = E2
+*kfree(E);// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Cc: Borislav Petkov <borislav.petkov@amd.com>
+Cc: Robert Richter <robert.richter@amd.com>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Link: http://lkml.kernel.org/r/1305294731-12127-1-git-send-email-julia@diku.dk
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index f80ff85..1bdce34 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -469,6 +469,7 @@ recurse:
+ out_free:
+ 	if (b) {
+ 		kobject_put(&b->kobj);
++		list_del(&b->miscj);
+ 		kfree(b);
+ 	}
+ 	return err;
+-- 
+1.7.7
+
diff --git a/queue/zorro8390-Fix-regression-caused-during-net_device_op.patch b/queue/zorro8390-Fix-regression-caused-during-net_device_op.patch
new file mode 100644
index 0000000..91f2b5a
--- /dev/null
+++ b/queue/zorro8390-Fix-regression-caused-during-net_device_op.patch
@@ -0,0 +1,76 @@
+From e3979588af9cd24b0d2b73d190790392991757d4 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Thu, 12 May 2011 09:11:38 +0000
+Subject: [PATCH] zorro8390: Fix regression caused during net_device_ops
+ conversion
+
+commit cf7e032fc87d59c475df26c4d40bf45d401b2adb upstream.
+
+Changeset b6114794a1c394534659f4a17420e48cf23aa922 ("zorro8390: convert to
+net_device_ops") broke zorro8390 by adding 8390.o to the link. That
+meant that lib8390.c was included twice, once in zorro8390.c and once in
+8390.c, subject to different macros. This patch reverts that by
+avoiding the wrappers in 8390.c.
+
+Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
+fix regression caused during net_device_ops conversion") and
+4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
+NET_POLL_CONTROLLER").
+
+Reported-by: Christian T. Steigies <cts@debian.org>
+Suggested-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Tested-by: Christian T. Steigies <cts@debian.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+diff --git a/drivers/net/Makefile b/drivers/net/Makefile
+index 1c60c32..263324b 100644
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -213,7 +213,7 @@ obj-$(CONFIG_SC92031) += sc92031.o
+ obj-$(CONFIG_LP486E) += lp486e.o
+ 
+ obj-$(CONFIG_ETH16I) += eth16i.o
+-obj-$(CONFIG_ZORRO8390) += zorro8390.o 8390.o
++obj-$(CONFIG_ZORRO8390) += zorro8390.o
+ obj-$(CONFIG_HPLANCE) += hplance.o 7990.o
+ obj-$(CONFIG_MVME147_NET) += mvme147.o 7990.o
+ obj-$(CONFIG_EQUALIZER) += eql.o
+diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
+index 81c753a..25e720c 100644
+--- a/drivers/net/zorro8390.c
++++ b/drivers/net/zorro8390.c
+@@ -125,7 +125,7 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
+ 
+     board = z->resource.start;
+     ioaddr = board+cards[i].offset;
+-    dev = alloc_ei_netdev();
++    dev = ____alloc_ei_netdev(0);
+     if (!dev)
+ 	return -ENOMEM;
+     if (!request_mem_region(ioaddr, NE_IO_EXTENT*2, DRV_NAME)) {
+@@ -145,15 +145,15 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
+ static const struct net_device_ops zorro8390_netdev_ops = {
+ 	.ndo_open		= zorro8390_open,
+ 	.ndo_stop		= zorro8390_close,
+-	.ndo_start_xmit		= ei_start_xmit,
+-	.ndo_tx_timeout		= ei_tx_timeout,
+-	.ndo_get_stats		= ei_get_stats,
+-	.ndo_set_multicast_list = ei_set_multicast_list,
++	.ndo_start_xmit		= __ei_start_xmit,
++	.ndo_tx_timeout		= __ei_tx_timeout,
++	.ndo_get_stats		= __ei_get_stats,
++	.ndo_set_multicast_list = __ei_set_multicast_list,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ 	.ndo_set_mac_address 	= eth_mac_addr,
+ 	.ndo_change_mtu		= eth_change_mtu,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-	.ndo_poll_controller	= ei_poll,
++	.ndo_poll_controller	= __ei_poll,
+ #endif
+ };
+ 
+-- 
+1.7.7
+