Add patches corresponding to 32.39 longterm

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

26 files changed, 1535 insertions, 0 deletions

diff --git a/queue/MAINTAINERS-update-STABLE-BRANCH-info.patch b/queue/MAINTAINERS-update-STABLE-BRANCH-info.patch
new file mode 100644
index 0000000..bfc7f15
--- /dev/null
+++ b/queue/MAINTAINERS-update-STABLE-BRANCH-info.patch
@@ -0,0 +1,35 @@
+From 2b249dd4162ca55f55e2c70376c0e38d0f266ccc Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <randy.dunlap@oracle.com>
+Date: Thu, 14 Apr 2011 15:22:07 -0700
+Subject: [PATCH 09/25] MAINTAINERS: update STABLE BRANCH info
+
+commit d00ebeac5f24f290636f7a895dafc124b2930a08 upstream.
+
+Drop Chris Wright from STABLE maintainers.  He hasn't done STABLE release
+work for quite some time.
+
+Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
+Acked-by: Chris Wright <chrisw@sous-sol.org>
+Cc: Greg KH <gregkh@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ MAINTAINERS |    1 -
+ 1 files changed, 0 insertions(+), 1 deletions(-)
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 502b380..52bec00 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -5306,7 +5306,6 @@ F:	arch/alpha/kernel/srm_env.c
+ 
+ STABLE BRANCH
+ M:	Greg Kroah-Hartman <greg@kroah.com>
+-M:	Chris Wright <chrisw@sous-sol.org>
+ L:	stable@kernel.org
+ S:	Maintained
+ 
+-- 
+1.7.4.4
+
diff --git a/queue/NET-cdc-phonet-handle-empty-phonet-header.patch b/queue/NET-cdc-phonet-handle-empty-phonet-header.patch
new file mode 100644
index 0000000..b30193f
--- /dev/null
+++ b/queue/NET-cdc-phonet-handle-empty-phonet-header.patch
@@ -0,0 +1,74 @@
+From 1f43eca0cc0d2c2f3d2b90b81e32a750ee48389d Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Sun, 13 Mar 2011 06:54:31 +0000
+Subject: [PATCH 04/25] NET: cdc-phonet, handle empty phonet header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 468c3f924f043cad7a04f4f4d5224a2c9bc886c1 upstream.
+
+Currently, for N 5800 XM I get:
+cdc_phonet: probe of 1-6:1.10 failed with error -22
+
+It's because phonet_header is empty. Extra altsetting looks like
+there:
+E 05 24 00 01 10 03 24 ab 05 24 06 0a 0b 04 24 fd  .$....$..$....$.
+E 00                                               .
+
+I don't see the header used anywhere so just check if the phonet
+descriptor is there, not the structure itself.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Cc: David S. Miller <davem@davemloft.net>
+Acked-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/net/usb/cdc-phonet.c |    9 +++------
+ 1 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
+index dc94445..b18cda4 100644
+--- a/drivers/net/usb/cdc-phonet.c
++++ b/drivers/net/usb/cdc-phonet.c
+@@ -326,13 +326,13 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ {
+ 	static const char ifname[] = "usbpn%d";
+ 	const struct usb_cdc_union_desc *union_header = NULL;
+-	const struct usb_cdc_header_desc *phonet_header = NULL;
+ 	const struct usb_host_interface *data_desc;
+ 	struct usb_interface *data_intf;
+ 	struct usb_device *usbdev = interface_to_usbdev(intf);
+ 	struct net_device *dev;
+ 	struct usbpn_dev *pnd;
+ 	u8 *data;
++	int phonet = 0;
+ 	int len, err;
+ 
+ 	data = intf->altsetting->extra;
+@@ -353,10 +353,7 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ 					(struct usb_cdc_union_desc *)data;
+ 				break;
+ 			case 0xAB:
+-				if (phonet_header || dlen < 5)
+-					break;
+-				phonet_header =
+-					(struct usb_cdc_header_desc *)data;
++				phonet = 1;
+ 				break;
+ 			}
+ 		}
+@@ -364,7 +361,7 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ 		len -= dlen;
+ 	}
+ 
+-	if (!union_header || !phonet_header)
++	if (!union_header || !phonet)
+ 		return -EINVAL;
+ 
+ 	data_intf = usb_ifnum_to_if(usbdev, union_header->bSlaveInterface0);
+-- 
+1.7.4.4
+
diff --git a/queue/UBIFS-fix-oops-when-R-O-file-system-is-fsync-ed.patch b/queue/UBIFS-fix-oops-when-R-O-file-system-is-fsync-ed.patch
new file mode 100644
index 0000000..7ef4573
--- /dev/null
+++ b/queue/UBIFS-fix-oops-when-R-O-file-system-is-fsync-ed.patch
@@ -0,0 +1,51 @@
+From a2898a33a48e520afb8a8d5e333fcb2fb7024954 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Date: Wed, 13 Apr 2011 10:31:52 +0300
+Subject: [PATCH 10/25] UBIFS: fix oops when R/O file-system is fsync'ed
+
+commit 78530bf7f2559b317c04991b52217c1608d5a58d upstream.
+
+This patch fixes severe UBIFS bug: UBIFS oopses when we 'fsync()' an
+file on R/O-mounter file-system. We (the UBIFS authors) incorrectly
+thought that VFS would not propagate 'fsync()' down to the file-system
+if it is read-only, but this is not the case.
+
+It is easy to exploit this bug using the following simple perl script:
+
+use strict;
+use File::Sync qw(fsync sync);
+
+die "File path is not specified" if not defined $ARGV[0];
+my $path = $ARGV[0];
+
+open FILE, "<", "$path" or die "Cannot open $path: $!";
+fsync(\*FILE) or die "cannot fsync $path: $!";
+close FILE or die "Cannot close $path: $!";
+
+Thanks to Reuben Dowle <Reuben.Dowle@navico.com> for reporting about this
+issue.
+
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Reported-by: Reuben Dowle <Reuben.Dowle@navico.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ fs/ubifs/file.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index 5692cf7..1a411fd 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -1312,6 +1312,9 @@ int ubifs_fsync(struct file *file, struct dentry *dentry, int datasync)
+ 
+ 	dbg_gen("syncing inode %lu", inode->i_ino);
+ 
++	if (inode->i_sb->s_flags & MS_RDONLY)
++		return 0;
++
+ 	/*
+ 	 * VFS has already synchronized dirty pages for this inode. Synchronize
+ 	 * the inode unless this is a 'datasync()' call.
+-- 
+1.7.4.4
+
diff --git a/queue/UBIFS-restrict-world-writable-debugfs-files.patch b/queue/UBIFS-restrict-world-writable-debugfs-files.patch
new file mode 100644
index 0000000..406ca51
--- /dev/null
+++ b/queue/UBIFS-restrict-world-writable-debugfs-files.patch
@@ -0,0 +1,46 @@
+From fef12dbacc850955f75b7eba9d9e0ea57ddc8599 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Fri, 4 Feb 2011 15:24:19 +0300
+Subject: [PATCH 03/25] UBIFS: restrict world-writable debugfs files
+
+commit 8c559d30b4e59cf6994215ada1fe744928f494bf upstream.
+
+Don't allow everybody to dump sensitive information about filesystems.
+
+Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ fs/ubifs/debug.c |    6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
+index 923d697..a0c09fc 100644
+--- a/fs/ubifs/debug.c
++++ b/fs/ubifs/debug.c
+@@ -2687,19 +2687,19 @@ int dbg_debugfs_init_fs(struct ubifs_info *c)
+ 	}
+ 
+ 	fname = "dump_lprops";
+-	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
++	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
+ 	if (IS_ERR(dent))
+ 		goto out_remove;
+ 	d->dfs_dump_lprops = dent;
+ 
+ 	fname = "dump_budg";
+-	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
++	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
+ 	if (IS_ERR(dent))
+ 		goto out_remove;
+ 	d->dfs_dump_budg = dent;
+ 
+ 	fname = "dump_tnc";
+-	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
++	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
+ 	if (IS_ERR(dent))
+ 		goto out_remove;
+ 	d->dfs_dump_tnc = dent;
+-- 
+1.7.4.4
+
diff --git a/queue/USB-EHCI-unlink-unused-QHs-when-the-controller-is-st.patch b/queue/USB-EHCI-unlink-unused-QHs-when-the-controller-is-st.patch
new file mode 100644
index 0000000..cb63d6a
--- /dev/null
+++ b/queue/USB-EHCI-unlink-unused-QHs-when-the-controller-is-st.patch
@@ -0,0 +1,80 @@
+From 8f6291de1da4b1ff6c1e4e3a42370f325603ef5c Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 5 Apr 2011 13:36:15 -0400
+Subject: [PATCH 20/25] USB: EHCI: unlink unused QHs when the controller is
+ stopped
+
+commit 94ae4976e253757e9b03a44d27d41b20f1829d80 upstream.
+
+This patch (as1458) fixes a problem affecting ultra-reliable systems:
+When hardware failover of an EHCI controller occurs, the data
+structures do not get released correctly.  This is because the routine
+responsible for removing unused QHs from the async schedule assumes
+the controller is running properly (the frame counter is used in
+determining how long the QH has been idle) -- but when a failover
+causes the controller to be electronically disconnected from the PCI
+bus, obviously it stops running.
+
+The solution is simple: Allow scan_async() to remove a QH from the
+async schedule if it has been idle for long enough _or_ if the
+controller is stopped.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-Tested-by: Dan Duval <dan.duval@stratus.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/host/ehci-q.c |   15 +++++++++------
+ 1 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index d1d4bb1..781c573 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -1246,24 +1246,27 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
+ 
+ static void scan_async (struct ehci_hcd *ehci)
+ {
++	bool			stopped;
+ 	struct ehci_qh		*qh;
+ 	enum ehci_timer_action	action = TIMER_IO_WATCHDOG;
+ 
+ 	ehci->stamp = ehci_readl(ehci, &ehci->regs->frame_index);
+ 	timer_action_done (ehci, TIMER_ASYNC_SHRINK);
+ rescan:
++	stopped = !HC_IS_RUNNING(ehci_to_hcd(ehci)->state);
+ 	qh = ehci->async->qh_next.qh;
+ 	if (likely (qh != NULL)) {
+ 		do {
+ 			/* clean any finished work for this qh */
+-			if (!list_empty (&qh->qtd_list)
+-					&& qh->stamp != ehci->stamp) {
++			if (!list_empty(&qh->qtd_list) && (stopped ||
++					qh->stamp != ehci->stamp)) {
+ 				int temp;
+ 
+ 				/* unlinks could happen here; completion
+ 				 * reporting drops the lock.  rescan using
+ 				 * the latest schedule, but don't rescan
+-				 * qhs we already finished (no looping).
++				 * qhs we already finished (no looping)
++				 * unless the controller is stopped.
+ 				 */
+ 				qh = qh_get (qh);
+ 				qh->stamp = ehci->stamp;
+@@ -1284,9 +1287,9 @@ rescan:
+ 			 */
+ 			if (list_empty(&qh->qtd_list)
+ 					&& qh->qh_state == QH_STATE_LINKED) {
+-				if (!ehci->reclaim
+-					&& ((ehci->stamp - qh->stamp) & 0x1fff)
+-						>= (EHCI_SHRINK_FRAMES * 8))
++				if (!ehci->reclaim && (stopped ||
++					((ehci->stamp - qh->stamp) & 0x1fff)
++						>= EHCI_SHRINK_FRAMES * 8))
+ 					start_unlink_async(ehci, qh);
+ 				else
+ 					action = TIMER_ASYNC_SHRINK;
+-- 
+1.7.4.4
+
diff --git a/queue/USB-fix-formatting-of-SuperSpeed-endpoints-in-proc-b.patch b/queue/USB-fix-formatting-of-SuperSpeed-endpoints-in-proc-b.patch
new file mode 100644
index 0000000..040e98d
--- /dev/null
+++ b/queue/USB-fix-formatting-of-SuperSpeed-endpoints-in-proc-b.patch
@@ -0,0 +1,60 @@
+From 2ad9365d94c78b8282ecd5c4024f4c6d172dfd0a Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dtor@vmware.com>
+Date: Fri, 18 Mar 2011 21:29:01 -0700
+Subject: [PATCH 21/25] USB: fix formatting of SuperSpeed endpoints in
+ /proc/bus/usb/devices
+
+commit 2868a2b1ba8f9c7f6c4170519ebb6c62934df70e upstream.
+
+Isochronous and interrupt SuperSpeed endpoints use the same mechanisms
+for decoding bInterval values as HighSpeed ones so adjust the code
+accordingly.
+
+Also bandwidth reservation for SuperSpeed matches highspeed, not
+low/full speed.
+
+Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/core/devices.c |   10 ++++++----
+ 1 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
+index 19bc03a..7013296 100644
+--- a/drivers/usb/core/devices.c
++++ b/drivers/usb/core/devices.c
+@@ -219,7 +219,7 @@ static char *usb_dump_endpoint_descriptor(int speed, char *start, char *end,
+ 		break;
+ 	case USB_ENDPOINT_XFER_INT:
+ 		type = "Int.";
+-		if (speed == USB_SPEED_HIGH)
++		if (speed == USB_SPEED_HIGH || speed == USB_SPEED_SUPER)
+ 			interval = 1 << (desc->bInterval - 1);
+ 		else
+ 			interval = desc->bInterval;
+@@ -227,7 +227,8 @@ static char *usb_dump_endpoint_descriptor(int speed, char *start, char *end,
+ 	default:	/* "can't happen" */
+ 		return start;
+ 	}
+-	interval *= (speed == USB_SPEED_HIGH) ? 125 : 1000;
++	interval *= (speed == USB_SPEED_HIGH ||
++		     speed == USB_SPEED_SUPER) ? 125 : 1000;
+ 	if (interval % 1000)
+ 		unit = 'u';
+ 	else {
+@@ -537,8 +538,9 @@ static ssize_t usb_device_dump(char __user **buffer, size_t *nbytes,
+ 	if (level == 0) {
+ 		int	max;
+ 
+-		/* high speed reserves 80%, full/low reserves 90% */
+-		if (usbdev->speed == USB_SPEED_HIGH)
++		/* super/high speed reserves 80%, full/low reserves 90% */
++		if (usbdev->speed == USB_SPEED_HIGH ||
++		    usbdev->speed == USB_SPEED_SUPER)
+ 			max = 800;
+ 		else
+ 			max = FRAME_TIME_MAX_USECS_ALLOC;
+-- 
+1.7.4.4
+
diff --git a/queue/USB-ftdi_sio-Added-IDs-for-CTI-USB-Serial-Devices.patch b/queue/USB-ftdi_sio-Added-IDs-for-CTI-USB-Serial-Devices.patch
new file mode 100644
index 0000000..433a58d
--- /dev/null
+++ b/queue/USB-ftdi_sio-Added-IDs-for-CTI-USB-Serial-Devices.patch
@@ -0,0 +1,51 @@
+From 3fe26d3c24fd012f970cebf5d0daa82cef40faf5 Mon Sep 17 00:00:00 2001
+From: Christian Simon <simon@swine.de>
+Date: Mon, 28 Mar 2011 21:54:47 +0200
+Subject: [PATCH 15/25] USB: ftdi_sio: Added IDs for CTI USB Serial Devices
+
+commit 5a9443f08c83c294c5c806a689c1184b27cb26b3 upstream.
+
+I added new ProdutIds for two devices from CTI GmbH Leipzig.
+
+Signed-off-by: Christian Simon <simon@swine.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/serial/ftdi_sio.c     |    2 ++
+ drivers/usb/serial/ftdi_sio_ids.h |   10 ++++++++++
+ 2 files changed, 12 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 05dcaa0..193a59b 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -155,6 +155,8 @@ static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
+  * /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
+  */
+ static struct usb_device_id id_table_combined [] = {
++	{ USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 73d8c79..cdcd224 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1146,3 +1146,13 @@
+  */
+ #define QIHARDWARE_VID			0x20B7
+ #define MILKYMISTONE_JTAGSERIAL_PID	0x0713
++
++/*
++ * CTI GmbH RS485 Converter http://www.cti-lean.com/
++ */
++/* USB-485-Mini*/
++#define FTDI_CTI_MINI_PID	0xF608
++/* USB-Nano-485*/
++#define FTDI_CTI_NANO_PID	0xF60B
++
++
+-- 
+1.7.4.4
+
diff --git a/queue/USB-ftdi_sio-add-PID-for-OCT-DK201-docking-station.patch b/queue/USB-ftdi_sio-add-PID-for-OCT-DK201-docking-station.patch
new file mode 100644
index 0000000..8deb79c
--- /dev/null
+++ b/queue/USB-ftdi_sio-add-PID-for-OCT-DK201-docking-station.patch
@@ -0,0 +1,45 @@
+From 47d0d3ca4bebbeb6bff39034c271659f063b14c3 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Fri, 8 Apr 2011 17:38:22 +0200
+Subject: [PATCH 16/25] USB: ftdi_sio: add PID for OCT DK201 docking station
+
+commit 11a31d84129dc3133417d626643d714c9df5317e upstream.
+
+Add PID 0x0103 for serial port of the OCT DK201 docking station.
+
+Reported-by: Jan Hoogenraad <jan@hoogenraad.net>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/serial/ftdi_sio.c     |    1 +
+ drivers/usb/serial/ftdi_sio_ids.h |    1 +
+ 2 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 193a59b..ecaad2b 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -531,6 +531,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(SEALEVEL_VID, SEALEVEL_2803_8_PID) },
+ 	{ USB_DEVICE(IDTECH_VID, IDTECH_IDT1221U_PID) },
+ 	{ USB_DEVICE(OCT_VID, OCT_US101_PID) },
++	{ USB_DEVICE(OCT_VID, OCT_DK201_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_HE_TIRA1_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_HE_TIRA1_quirk },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_USB_UIRT_PID),
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index cdcd224..7c6b9a1 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -579,6 +579,7 @@
+ /* Note: OCT US101 is also rebadged as Dick Smith Electronics (NZ) XH6381 */
+ /* Also rebadged as Dick Smith Electronics (Aus) XH6451 */
+ /* Also rebadged as SIIG Inc. model US2308 hardware version 1 */
++#define OCT_DK201_PID		0x0103	/* OCT DK201 USB docking station */
+ #define OCT_US101_PID		0x0421	/* OCT US101 USB to RS-232 */
+ 
+ /*
+-- 
+1.7.4.4
+
diff --git a/queue/USB-ftdi_sio-add-ids-for-Hameg-HO720-and-HO730.patch b/queue/USB-ftdi_sio-add-ids-for-Hameg-HO720-and-HO730.patch
new file mode 100644
index 0000000..eeb033f
--- /dev/null
+++ b/queue/USB-ftdi_sio-add-ids-for-Hameg-HO720-and-HO730.patch
@@ -0,0 +1,46 @@
+From 242ba812a714c9aa68f0d3d89ff496d78d5cca49 Mon Sep 17 00:00:00 2001
+From: Paul Friedrich <Paul.Friedrich@hameg.com>
+Date: Fri, 18 Mar 2011 11:13:55 +0100
+Subject: [PATCH 17/25] USB: ftdi_sio: add ids for Hameg HO720 and HO730
+
+commit c53c2fab40cf16e13af66f40bfd27200cda98d2f upstream.
+
+usb serial: ftdi_sio: add two missing USB ID's for Hameg interfaces HO720
+and HO730
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/serial/ftdi_sio.c     |    2 ++
+ drivers/usb/serial/ftdi_sio_ids.h |    2 ++
+ 2 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index ecaad2b..7d0107a 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -793,6 +793,8 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
++	{ USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
++	{ USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
+ 	{ USB_DEVICE(FTDI_VID, HAMEG_HO870_PID) },
+ 	{ USB_DEVICE(FTDI_VID, MJSG_GENERIC_PID) },
+ 	{ USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 7c6b9a1..5f34a05 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -300,6 +300,8 @@
+  * Hameg HO820 and HO870 interface (using VID 0x0403)
+  */
+ #define        HAMEG_HO820_PID         0xed74
++#define        HAMEG_HO730_PID         0xed73
++#define        HAMEG_HO720_PID         0xed72
+ #define        HAMEG_HO870_PID         0xed71
+ 
+ /*
+-- 
+1.7.4.4
+
diff --git a/queue/USB-option-Add-new-ONDA-vendor-id-and-product-id-for.patch b/queue/USB-option-Add-new-ONDA-vendor-id-and-product-id-for.patch
new file mode 100644
index 0000000..f0a0ed7
--- /dev/null
+++ b/queue/USB-option-Add-new-ONDA-vendor-id-and-product-id-for.patch
@@ -0,0 +1,57 @@
+From 1c356d9f078f5b2c4e103940cc1b981bc2d58d89 Mon Sep 17 00:00:00 2001
+From: Enrico Mioso <mrkiko.rs@gmail.com>
+Date: Fri, 17 Sep 2010 10:54:23 +0200
+Subject: [PATCH 18/25] USB: option: Add new ONDA vendor id and product id for
+ ONDA MT825UP
+
+commit c6991b6fd2b4201174dc4620d0c8c4f5ff27b36f upstream.
+
+This patch, adds to the option driver the Onda Communication
+(http://www.ondacommunication.com) vendor id, and the MT825UP modem
+device id.
+
+Note that many variants of this same device are being release here in
+Italy (at least one or two per telephony operator).
+
+These devices are perfectly equivalent except for some predefined
+settings (which can be changed of course).
+
+It should be noted that most ONDA devices are allready supported (they
+used other vendor's ids in the past). The patch seems working fine here,
+and the rest of the driver seems uninfluenced.
+
+Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/serial/option.c |    7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index e8323de..d1baa77 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -402,6 +402,12 @@ static int  option_resume(struct usb_serial *serial);
+ #define CELOT_VENDOR_ID				0x211f
+ #define CELOT_PRODUCT_CT680M			0x6801
+ 
++/* ONDA Communication vendor id */
++#define ONDA_VENDOR_ID       0x1ee8
++
++/* ONDA MT825UP HSDPA 14.2 modem */
++#define ONDA_MT825UP         0x000b
++
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ 		OPTION_BLACKLIST_NONE = 0,
+@@ -955,6 +961,7 @@ static const struct usb_device_id option_ids[] = {
+ 
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
++	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+-- 
+1.7.4.4
+
diff --git a/queue/USB-option-Added-support-for-Samsung-GT-B3730-GT-B37.patch b/queue/USB-option-Added-support-for-Samsung-GT-B3730-GT-B37.patch
new file mode 100644
index 0000000..a0ed5b0
--- /dev/null
+++ b/queue/USB-option-Added-support-for-Samsung-GT-B3730-GT-B37.patch
@@ -0,0 +1,43 @@
+From 1d940bb7e40d9e375fa7ece498e44e1eab9a0c15 Mon Sep 17 00:00:00 2001
+From: Marius B. Kotsbak <marius@kotsbak.com>
+Date: Tue, 22 Mar 2011 00:01:53 +0100
+Subject: [PATCH 19/25] USB: option: Added support for Samsung
+ GT-B3730/GT-B3710 LTE USB modem.
+
+commit 80f9df3e0093ad9f1eeefd2ff7fd27daaa518d25 upstream.
+
+Bind only modem AT command endpoint to option.
+
+Signed-off-by: Marius B. Kotsbak <marius@kotsbak.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/serial/option.c |    5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index d1baa77..335dbed 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -408,6 +408,10 @@ static int  option_resume(struct usb_serial *serial);
+ /* ONDA MT825UP HSDPA 14.2 modem */
+ #define ONDA_MT825UP         0x000b
+ 
++/* Samsung products */
++#define SAMSUNG_VENDOR_ID                       0x04e8
++#define SAMSUNG_PRODUCT_GT_B3730                0x6889
++
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ 		OPTION_BLACKLIST_NONE = 0,
+@@ -962,6 +966,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
++	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730/GT-B3710 LTE USB modem.*/
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+-- 
+1.7.4.4
+
diff --git a/queue/USB-xhci-fix-math-in-xhci_get_endpoint_interval.patch b/queue/USB-xhci-fix-math-in-xhci_get_endpoint_interval.patch
new file mode 100644
index 0000000..4dec149
--- /dev/null
+++ b/queue/USB-xhci-fix-math-in-xhci_get_endpoint_interval.patch
@@ -0,0 +1,150 @@
+From 54f41735b5af2bd3329b7cec6c95a29a990c498a Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dtor@vmware.com>
+Date: Wed, 23 Mar 2011 22:41:23 -0700
+Subject: [PATCH 23/25] USB: xhci - fix math in xhci_get_endpoint_interval()
+
+commit dfa49c4ad120a784ef1ff0717168aa79f55a483a upstream.
+
+When parsing exponent-expressed intervals we subtract 1 from the
+value and then expect it to match with original + 1, which is
+highly unlikely, and we end with frequent spew:
+
+	usb 3-4: ep 0x83 - rounding interval to 512 microframes
+
+Also, parsing interval for fullspeed isochronous endpoints was
+incorrect - according to USB spec they use exponent-based
+intervals (but xHCI spec claims frame-based intervals). I trust
+USB spec more, especially since USB core agrees with it.
+
+This should be queued for stable kernels back to 2.6.31.
+
+Reviewed-by: Micah Elizabeth Scott <micah@vmware.com>
+Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/host/xhci-mem.c |   90 +++++++++++++++++++++++++++++-------------
+ 1 files changed, 62 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index e560dd4..e1dbcc2 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -520,6 +520,47 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
+ 	return 0;
+ }
+ 
++/*
++ * Convert interval expressed as 2^(bInterval - 1) == interval into
++ * straight exponent value 2^n == interval.
++ *
++ */
++static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
++		struct usb_host_endpoint *ep)
++{
++	unsigned int interval;
++
++	interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
++	if (interval != ep->desc.bInterval - 1)
++		dev_warn(&udev->dev,
++			 "ep %#x - rounding interval to %d microframes\n",
++			 ep->desc.bEndpointAddress,
++			 1 << interval);
++
++	return interval;
++}
++
++/*
++ * Convert bInterval expressed in frames (in 1-255 range) to exponent of
++ * microframes, rounded down to nearest power of 2.
++ */
++static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
++		struct usb_host_endpoint *ep)
++{
++	unsigned int interval;
++
++	interval = fls(8 * ep->desc.bInterval) - 1;
++	interval = clamp_val(interval, 3, 10);
++	if ((1 << interval) != 8 * ep->desc.bInterval)
++		dev_warn(&udev->dev,
++			 "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
++			 ep->desc.bEndpointAddress,
++			 1 << interval,
++			 8 * ep->desc.bInterval);
++
++	return interval;
++}
++
+ /* Return the polling or NAK interval.
+  *
+  * The polling interval is expressed in "microframes".  If xHCI's Interval field
+@@ -537,45 +578,38 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
+ 	case USB_SPEED_HIGH:
+ 		/* Max NAK rate */
+ 		if (usb_endpoint_xfer_control(&ep->desc) ||
+-				usb_endpoint_xfer_bulk(&ep->desc))
++		    usb_endpoint_xfer_bulk(&ep->desc)) {
+ 			interval = ep->desc.bInterval;
++			break;
++		}
+ 		/* Fall through - SS and HS isoc/int have same decoding */
++
+ 	case USB_SPEED_SUPER:
+ 		if (usb_endpoint_xfer_int(&ep->desc) ||
+-				usb_endpoint_xfer_isoc(&ep->desc)) {
+-			if (ep->desc.bInterval == 0)
+-				interval = 0;
+-			else
+-				interval = ep->desc.bInterval - 1;
+-			if (interval > 15)
+-				interval = 15;
+-			if (interval != ep->desc.bInterval + 1)
+-				dev_warn(&udev->dev, "ep %#x - rounding interval to %d microframes\n",
+-						ep->desc.bEndpointAddress, 1 << interval);
++		    usb_endpoint_xfer_isoc(&ep->desc)) {
++			interval = xhci_parse_exponent_interval(udev, ep);
+ 		}
+ 		break;
+-	/* Convert bInterval (in 1-255 frames) to microframes and round down to
+-	 * nearest power of 2.
+-	 */
++
+ 	case USB_SPEED_FULL:
++		if (usb_endpoint_xfer_int(&ep->desc)) {
++			interval = xhci_parse_exponent_interval(udev, ep);
++			break;
++		}
++		/*
++		 * Fall through for isochronous endpoint interval decoding
++		 * since it uses the same rules as low speed interrupt
++		 * endpoints.
++		 */
++
+ 	case USB_SPEED_LOW:
+ 		if (usb_endpoint_xfer_int(&ep->desc) ||
+-				usb_endpoint_xfer_isoc(&ep->desc)) {
+-			interval = fls(8*ep->desc.bInterval) - 1;
+-			if (interval > 10)
+-				interval = 10;
+-			if (interval < 3)
+-				interval = 3;
+-			if ((1 << interval) != 8*ep->desc.bInterval)
+-				dev_warn(&udev->dev,
+-						"ep %#x - rounding interval"
+-						" to %d microframes, "
+-						"ep desc says %d microframes\n",
+-						ep->desc.bEndpointAddress,
+-						1 << interval,
+-						8*ep->desc.bInterval);
++		    usb_endpoint_xfer_isoc(&ep->desc)) {
++
++			interval = xhci_parse_frame_interval(udev, ep);
+ 		}
+ 		break;
++
+ 	default:
+ 		BUG();
+ 	}
+-- 
+1.7.4.4
+
diff --git a/queue/USB-xhci-fix-unsafe-macro-definitions.patch b/queue/USB-xhci-fix-unsafe-macro-definitions.patch
new file mode 100644
index 0000000..2be5045
--- /dev/null
+++ b/queue/USB-xhci-fix-unsafe-macro-definitions.patch
@@ -0,0 +1,49 @@
+From feec72ec696d7109a275cda18f3734598c01d4cd Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dtor@vmware.com>
+Date: Sun, 20 Mar 2011 02:15:17 -0700
+Subject: [PATCH 22/25] USB: xhci - fix unsafe macro definitions
+
+commit 5a6c2f3ff039154872ce597952f8b8900ea0d732 upstream.
+
+Macro arguments used in expressions need to be enclosed in parenthesis
+to avoid unpleasant surprises.
+
+This should be queued for kernels back to 2.6.31
+
+Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/host/xhci.h |    6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index ea389e9..a51358b 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -232,7 +232,7 @@ struct xhci_op_regs {
+  * notification type that matches a bit set in this bit field.
+  */
+ #define	DEV_NOTE_MASK		(0xffff)
+-#define ENABLE_DEV_NOTE(x)	(1 << x)
++#define ENABLE_DEV_NOTE(x)	(1 << (x))
+ /* Most of the device notification types should only be used for debug.
+  * SW does need to pay attention to function wake notifications.
+  */
+@@ -579,11 +579,11 @@ struct xhci_ep_ctx {
+ #define EP_STATE_STOPPED	3
+ #define EP_STATE_ERROR		4
+ /* Mult - Max number of burtst within an interval, in EP companion desc. */
+-#define EP_MULT(p)		((p & 0x3) << 8)
++#define EP_MULT(p)		(((p) & 0x3) << 8)
+ /* bits 10:14 are Max Primary Streams */
+ /* bit 15 is Linear Stream Array */
+ /* Interval - period between requests to an endpoint - 125u increments. */
+-#define EP_INTERVAL(p)		((p & 0xff) << 16)
++#define EP_INTERVAL(p)		(((p) & 0xff) << 16)
+ #define EP_INTERVAL_TO_UFRAMES(p)		(1 << (((p) >> 16) & 0xff))
+ 
+ /* ep_info2 bitmasks */
+-- 
+1.7.4.4
+
diff --git a/queue/cifs-always-do-is_path_accessible-check-in-cifs_moun.patch b/queue/cifs-always-do-is_path_accessible-check-in-cifs_moun.patch
new file mode 100644
index 0000000..43be88a
--- /dev/null
+++ b/queue/cifs-always-do-is_path_accessible-check-in-cifs_moun.patch
@@ -0,0 +1,44 @@
+From b98cbac7c2463e963905aa0875968ae7fbf7d657 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 14 Mar 2011 13:48:08 -0400
+Subject: [PATCH 01/25] cifs: always do is_path_accessible check in cifs_mount
+
+commit 70945643722ffeac779d2529a348f99567fa5c33 upstream.
+
+Currently, we skip doing the is_path_accessible check in cifs_mount if
+there is no prefixpath. I have a report of at least one server however
+that allows a TREE_CONNECT to a share that has a DFS referral at its
+root. The reporter in this case was using a UNC that had no prefixpath,
+so the is_path_accessible check was not triggered and the box later hit
+a BUG() because we were chasing a DFS referral on the root dentry for
+the mount.
+
+This patch fixes this by removing the check for a zero-length
+prefixpath.  That should make the is_path_accessible check be done in
+this situation and should allow the client to chase the DFS referral at
+mount time instead.
+
+Reported-and-Tested-by: Yogesh Sharma <ysharma@cymer.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ fs/cifs/connect.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index d9566bf..f6afb59 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2555,7 +2555,7 @@ try_mount_again:
+ 
+ remote_path_check:
+ 	/* check if a whole path (including prepath) is not remote */
+-	if (!rc && cifs_sb->prepathlen && tcon) {
++	if (!rc && tcon) {
+ 		/* build_path_to_root works only when we have a valid tcon */
+ 		full_path = cifs_build_path_to_root(cifs_sb);
+ 		if (full_path == NULL) {
+-- 
+1.7.4.4
+
diff --git a/queue/mca.c-Fix-cast-from-integer-to-pointer-warning.patch b/queue/mca.c-Fix-cast-from-integer-to-pointer-warning.patch
new file mode 100644
index 0000000..d0254ea
--- /dev/null
+++ b/queue/mca.c-Fix-cast-from-integer-to-pointer-warning.patch
@@ -0,0 +1,45 @@
+From 8114a62c527e012bc0805b360e4c3bca6314824a Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Thu, 24 Feb 2011 17:23:09 -0500
+Subject: [PATCH 07/25] mca.c: Fix cast from integer to pointer warning
+
+commit c1d036c4d1cb00b7e8473a2ad0a78f13e13a8183 upstream.
+
+ia64_mca_cpu_init has a void *data local variable that is assigned
+the value from either __get_free_pages() or mca_bootmem(). The problem
+is that __get_free_pages returns an unsigned long and mca_bootmem, via
+alloc_bootmem(), returns a void *. format_mca_init_stack takes the void *,
+and it's also used with __pa(), but that casts it to long anyway.
+
+This results in the following build warning:
+
+arch/ia64/kernel/mca.c:1898: warning: assignment makes pointer from
+integer without a cast
+
+Cast the return of __get_free_pages to a void * to avoid
+the warning.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/ia64/kernel/mca.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
+index a0220dc..6871c1b 100644
+--- a/arch/ia64/kernel/mca.c
++++ b/arch/ia64/kernel/mca.c
+@@ -1859,7 +1859,8 @@ ia64_mca_cpu_init(void *cpu_data)
+ 			data = mca_bootmem();
+ 			first_time = 0;
+ 		} else
+-			data = __get_free_pages(GFP_KERNEL, get_order(sz));
++			data = (void *)__get_free_pages(GFP_KERNEL,
++							get_order(sz));
+ 		if (!data)
+ 			panic("Could not allocate MCA memory for cpu %d\n",
+ 					cpu);
+-- 
+1.7.4.4
+
diff --git a/queue/net-ax25-fix-information-leak-to-userland-harder.patch b/queue/net-ax25-fix-information-leak-to-userland-harder.patch
new file mode 100644
index 0000000..cb2a1b0
--- /dev/null
+++ b/queue/net-ax25-fix-information-leak-to-userland-harder.patch
@@ -0,0 +1,35 @@
+From 8744a04136af9e184e60a2be7fab67130e4d3338 Mon Sep 17 00:00:00 2001
+From: Kees Cook <kees.cook@canonical.com>
+Date: Wed, 12 Jan 2011 00:34:49 -0800
+Subject: [PATCH 25/25] net: ax25: fix information leak to userland harder
+
+commit 5b919f833d9d60588d026ad82d17f17e8872c7a9 upstream.
+
+Commit fe10ae53384e48c51996941b7720ee16995cbcb7 adds a memset() to clear
+the structure being sent back to userspace, but accidentally used the
+wrong size.
+
+Reported-by: Brad Spengler <spender@grsecurity.net>
+Signed-off-by: Kees Cook <kees.cook@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ net/ax25/af_ax25.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index eb100ce..12c350c 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -1392,7 +1392,7 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
+ 	ax25_cb *ax25;
+ 	int err = 0;
+ 
+-	memset(fsa, 0, sizeof(fsa));
++	memset(fsa, 0, sizeof(*fsa));
+ 	lock_sock(sk);
+ 	ax25 = ax25_sk(sk);
+ 
+-- 
+1.7.4.4
+
diff --git a/queue/ramfs-fix-memleak-on-no-mmu-arch.patch b/queue/ramfs-fix-memleak-on-no-mmu-arch.patch
new file mode 100644
index 0000000..2373c16
--- /dev/null
+++ b/queue/ramfs-fix-memleak-on-no-mmu-arch.patch
@@ -0,0 +1,90 @@
+From 809d8fe9b54ba019695e3a33e37ef5ed50c9616c Mon Sep 17 00:00:00 2001
+From: Bob Liu <lliubbo@gmail.com>
+Date: Thu, 14 Apr 2011 15:22:20 -0700
+Subject: [PATCH 08/25] ramfs: fix memleak on no-mmu arch
+
+commit b836aec53e2bce71de1d5415313380688c851477 upstream.
+
+On no-mmu arch, there is a memleak during shmem test.  The cause of this
+memleak is ramfs_nommu_expand_for_mapping() added page refcount to 2
+which makes iput() can't free that pages.
+
+The simple test file is like this:
+
+  int main(void)
+  {
+	int i;
+	key_t k = ftok("/etc", 42);
+
+	for ( i=0; i<100; ++i) {
+		int id = shmget(k, 10000, 0644|IPC_CREAT);
+		if (id == -1) {
+			printf("shmget error\n");
+		}
+		if(shmctl(id, IPC_RMID, NULL ) == -1) {
+			printf("shm  rm error\n");
+			return -1;
+		}
+	}
+	printf("run ok...\n");
+	return 0;
+  }
+
+And the result:
+
+  root:/> free
+               total         used         free       shared      buffers
+  Mem:         60320        17912        42408            0            0
+  -/+ buffers:              17912        42408
+  root:/> shmem
+  run ok...
+  root:/> free
+               total         used         free       shared      buffers
+  Mem:         60320        19096        41224            0            0
+  -/+ buffers:              19096        41224
+  root:/> shmem
+  run ok...
+  root:/> free
+               total         used         free       shared      buffers
+  Mem:         60320        20296        40024            0            0
+  -/+ buffers:              20296        40024
+  ...
+
+After this patch the test result is:(no memleak anymore)
+
+  root:/> free
+               total         used         free       shared      buffers
+  Mem:         60320        16668        43652            0            0
+  -/+ buffers:              16668        43652
+  root:/> shmem
+  run ok...
+  root:/> free
+               total         used         free       shared      buffers
+  Mem:         60320        16668        43652            0            0
+  -/+ buffers:              16668        43652
+
+Signed-off-by: Bob Liu <lliubbo@gmail.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ fs/ramfs/file-nommu.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
+index 5ea4ad8..e9f6f9b 100644
+--- a/fs/ramfs/file-nommu.c
++++ b/fs/ramfs/file-nommu.c
+@@ -112,6 +112,7 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
+ 		SetPageDirty(page);
+ 
+ 		unlock_page(page);
++		put_page(page);
+ 	}
+ 
+ 	return 0;
+-- 
+1.7.4.4
+
diff --git a/queue/series b/queue/series
index c71d83e..4c3069b 100644
--- a/queue/series
+++ b/queue/series
@@ -59,6 +59,31 @@ exec-copy-and-paste-the-fixes-into-compat_do_execve-.patch
 # Content taken from v2.6.32.38
 
 # Content taken from v2.6.32.39
+cifs-always-do-is_path_accessible-check-in-cifs_moun.patch
+video-sn9c102-world-wirtable-sysfs-files.patch
+UBIFS-restrict-world-writable-debugfs-files.patch
+NET-cdc-phonet-handle-empty-phonet-header.patch
+x86-Fix-a-bogus-unwind-annotation-in-lib-semaphore_3.patch
+tioca-Fix-assignment-from-incompatible-pointer-warni.patch
+mca.c-Fix-cast-from-integer-to-pointer-warning.patch
+ramfs-fix-memleak-on-no-mmu-arch.patch
+MAINTAINERS-update-STABLE-BRANCH-info.patch
+UBIFS-fix-oops-when-R-O-file-system-is-fsync-ed.patch
+x86-cpu-AMD-errata-checking-framework.patch
+x86-cpu-Clean-up-AMD-erratum-400-workaround.patch
+x86-AMD-Set-ARAT-feature-on-AMD-processors.patch
+x86-amd-Disable-GartTlbWlkErr-when-BIOS-forgets-it.patch
+USB-ftdi_sio-Added-IDs-for-CTI-USB-Serial-Devices.patch
+USB-ftdi_sio-add-PID-for-OCT-DK201-docking-station.patch
+USB-ftdi_sio-add-ids-for-Hameg-HO720-and-HO730.patch
+USB-option-Add-new-ONDA-vendor-id-and-product-id-for.patch
+USB-option-Added-support-for-Samsung-GT-B3730-GT-B37.patch
+USB-EHCI-unlink-unused-QHs-when-the-controller-is-st.patch
+USB-fix-formatting-of-SuperSpeed-endpoints-in-proc-b.patch
+USB-xhci-fix-unsafe-macro-definitions.patch
+USB-xhci-fix-math-in-xhci_get_endpoint_interval.patch
+x86-cpu-Fix-regression-in-AMD-errata-checking-code.patch
+net-ax25-fix-information-leak-to-userland-harder.patch
 
 # Content taken from v2.6.32.40
 next_pidmap-fix-overflow-condition.patch
diff --git a/queue/tioca-Fix-assignment-from-incompatible-pointer-warni.patch b/queue/tioca-Fix-assignment-from-incompatible-pointer-warni.patch
new file mode 100644
index 0000000..b55a08d
--- /dev/null
+++ b/queue/tioca-Fix-assignment-from-incompatible-pointer-warni.patch
@@ -0,0 +1,34 @@
+From eeb21fc8a40d8bffd5994e355a23e6e9db43ef17 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Thu, 24 Feb 2011 15:33:24 -0500
+Subject: [PATCH 06/25] tioca: Fix assignment from incompatible pointer
+ warnings
+
+commit b4a6b3436531f6c5256e6d60d388c3c28ff1a0e9 upstream.
+
+The prototype for sn_pci_provider->{dma_map,dma_map_consistent} expects
+an unsigned long instead of a u64.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/ia64/sn/pci/tioca_provider.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/arch/ia64/sn/pci/tioca_provider.c b/arch/ia64/sn/pci/tioca_provider.c
+index 4d4536e..9c271be 100644
+--- a/arch/ia64/sn/pci/tioca_provider.c
++++ b/arch/ia64/sn/pci/tioca_provider.c
+@@ -509,7 +509,7 @@ tioca_dma_unmap(struct pci_dev *pdev, dma_addr_t bus_addr, int dir)
+  * use the GART mapped mode.
+  */
+ static u64
+-tioca_dma_map(struct pci_dev *pdev, u64 paddr, size_t byte_count, int dma_flags)
++tioca_dma_map(struct pci_dev *pdev, unsigned long paddr, size_t byte_count, int dma_flags)
+ {
+ 	u64 mapaddr;
+ 
+-- 
+1.7.4.4
+
diff --git a/queue/video-sn9c102-world-wirtable-sysfs-files.patch b/queue/video-sn9c102-world-wirtable-sysfs-files.patch
new file mode 100644
index 0000000..2e2d5d2
--- /dev/null
+++ b/queue/video-sn9c102-world-wirtable-sysfs-files.patch
@@ -0,0 +1,38 @@
+From 9ae760a9e7387dd725f6109bf0fcb62efd1b7b23 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Fri, 4 Feb 2011 09:23:33 -0300
+Subject: [PATCH 02/25] video: sn9c102: world-wirtable sysfs files
+
+commit 14ddc3188d50855ae2a419a6aced995e2834e5d4 upstream.
+
+Don't allow everybody to change video settings.
+
+Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Acked-by: Luca Risolia <luca.risolia@studio.unibo.it>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/media/video/sn9c102/sn9c102_core.c |    6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/video/sn9c102/sn9c102_core.c b/drivers/media/video/sn9c102/sn9c102_core.c
+index cbf8087..8e86f20 100644
+--- a/drivers/media/video/sn9c102/sn9c102_core.c
++++ b/drivers/media/video/sn9c102/sn9c102_core.c
+@@ -1430,9 +1430,9 @@ static DEVICE_ATTR(i2c_reg, S_IRUGO | S_IWUSR,
+ 		   sn9c102_show_i2c_reg, sn9c102_store_i2c_reg);
+ static DEVICE_ATTR(i2c_val, S_IRUGO | S_IWUSR,
+ 		   sn9c102_show_i2c_val, sn9c102_store_i2c_val);
+-static DEVICE_ATTR(green, S_IWUGO, NULL, sn9c102_store_green);
+-static DEVICE_ATTR(blue, S_IWUGO, NULL, sn9c102_store_blue);
+-static DEVICE_ATTR(red, S_IWUGO, NULL, sn9c102_store_red);
++static DEVICE_ATTR(green, S_IWUSR, NULL, sn9c102_store_green);
++static DEVICE_ATTR(blue, S_IWUSR, NULL, sn9c102_store_blue);
++static DEVICE_ATTR(red, S_IWUSR, NULL, sn9c102_store_red);
+ static DEVICE_ATTR(frame_header, S_IRUGO, sn9c102_show_frame_header, NULL);
+ 
+ 
+-- 
+1.7.4.4
+
diff --git a/queue/x86-AMD-Set-ARAT-feature-on-AMD-processors.patch b/queue/x86-AMD-Set-ARAT-feature-on-AMD-processors.patch
new file mode 100644
index 0000000..c522be5
--- /dev/null
+++ b/queue/x86-AMD-Set-ARAT-feature-on-AMD-processors.patch
@@ -0,0 +1,48 @@
+From c9bb7f7097f0aa99af2db879700f236fc5d9d589 Mon Sep 17 00:00:00 2001
+From: Boris Ostrovsky <boris.ostrovsky@amd.com>
+Date: Tue, 15 Mar 2011 12:13:44 -0400
+Subject: [PATCH 13/25] x86, AMD: Set ARAT feature on AMD processors
+
+commit b87cf80af3ba4b4c008b4face3c68d604e1715c6 upstream.
+
+Support for Always Running APIC timer (ARAT) was introduced in
+commit db954b5898dd3ef3ef93f4144158ea8f97deb058. This feature
+allows us to avoid switching timers from LAPIC to something else
+(e.g. HPET) and go into timer broadcasts when entering deep
+C-states.
+
+AMD processors don't provide a CPUID bit for that feature but
+they also keep APIC timers running in deep C-states (except for
+cases when the processor is affected by erratum 400). Therefore
+we should set ARAT feature bit on AMD CPUs.
+
+Tested-by: Borislav Petkov <borislav.petkov@amd.com>
+Acked-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Acked-by: Mark Langsdorf <mark.langsdorf@amd.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
+LKML-Reference: <1300205624-4813-1-git-send-email-ostr@amd64.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/kernel/cpu/amd.c |    4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 08dd1be..6f834f8 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -565,6 +565,10 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
+ 		}
+ 	}
+ #endif
++
++	/* As a rule processors have APIC timer running in deep C states */
++	if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
++		set_cpu_cap(c, X86_FEATURE_ARAT);
+ }
+ 
+ #ifdef CONFIG_X86_32
+-- 
+1.7.4.4
+
diff --git a/queue/x86-Fix-a-bogus-unwind-annotation-in-lib-semaphore_3.patch b/queue/x86-Fix-a-bogus-unwind-annotation-in-lib-semaphore_3.patch
new file mode 100644
index 0000000..227f17b
--- /dev/null
+++ b/queue/x86-Fix-a-bogus-unwind-annotation-in-lib-semaphore_3.patch
@@ -0,0 +1,36 @@
+From b44c692efcd222a82d6e3f4f7883576c59d6d534 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@novell.com>
+Date: Tue, 1 Mar 2011 14:28:02 +0000
+Subject: [PATCH 05/25] x86: Fix a bogus unwind annotation in
+ lib/semaphore_32.S
+
+commit e938c287ea8d977e079f07464ac69923412663ce upstream.
+
+'simple' would have required specifying current frame address
+and return address location manually, but that's obviously not
+the case (and not necessary) here.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+LKML-Reference: <4D6D1082020000780003454C@vpn.id2.novell.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/lib/semaphore_32.S |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/lib/semaphore_32.S b/arch/x86/lib/semaphore_32.S
+index 648fe47..f35eec7 100644
+--- a/arch/x86/lib/semaphore_32.S
++++ b/arch/x86/lib/semaphore_32.S
+@@ -36,7 +36,7 @@
+  */
+ #ifdef CONFIG_SMP
+ ENTRY(__write_lock_failed)
+-	CFI_STARTPROC simple
++	CFI_STARTPROC
+ 	FRAME
+ 2: 	LOCK_PREFIX
+ 	addl	$ RW_LOCK_BIAS,(%eax)
+-- 
+1.7.4.4
+
diff --git a/queue/x86-amd-Disable-GartTlbWlkErr-when-BIOS-forgets-it.patch b/queue/x86-amd-Disable-GartTlbWlkErr-when-BIOS-forgets-it.patch
new file mode 100644
index 0000000..27f3ba2
--- /dev/null
+++ b/queue/x86-amd-Disable-GartTlbWlkErr-when-BIOS-forgets-it.patch
@@ -0,0 +1,83 @@
+From 4e423cc7416241f1ba79418a7187dd8fcb674ead Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Fri, 15 Apr 2011 14:47:40 +0200
+Subject: [PATCH 14/25] x86, amd: Disable GartTlbWlkErr when BIOS forgets it
+
+commit 5bbc097d890409d8eff4e3f1d26f11a9d6b7c07e upstream.
+
+This patch disables GartTlbWlk errors on AMD Fam10h CPUs if
+the BIOS forgets to do is (or is just too old). Letting
+these errors enabled can cause a sync-flood on the CPU
+causing a reboot.
+
+The AMD BKDG recommends disabling GART TLB Wlk Error completely.
+
+This patch is the fix for
+
+	https://bugzilla.kernel.org/show_bug.cgi?id=33012
+
+on my machine.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Link: http://lkml.kernel.org/r/20110415131152.GJ18463@8bytes.org
+Tested-by: Alexandre Demers <alexandre.f.demers@gmail.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/include/asm/msr-index.h |    4 ++++
+ arch/x86/kernel/cpu/amd.c        |   19 +++++++++++++++++++
+ 2 files changed, 23 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 5928fc0..ad6338e 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -82,11 +82,15 @@
+ #define MSR_IA32_MC0_ADDR		0x00000402
+ #define MSR_IA32_MC0_MISC		0x00000403
+ 
++#define MSR_AMD64_MC0_MASK		0xc0010044
++
+ #define MSR_IA32_MCx_CTL(x)		(MSR_IA32_MC0_CTL + 4*(x))
+ #define MSR_IA32_MCx_STATUS(x)		(MSR_IA32_MC0_STATUS + 4*(x))
+ #define MSR_IA32_MCx_ADDR(x)		(MSR_IA32_MC0_ADDR + 4*(x))
+ #define MSR_IA32_MCx_MISC(x)		(MSR_IA32_MC0_MISC + 4*(x))
+ 
++#define MSR_AMD64_MCx_MASK(x)		(MSR_AMD64_MC0_MASK + (x))
++
+ /* These are consecutive and not in the normal 4er MCE bank block */
+ #define MSR_IA32_MC0_CTL2		0x00000280
+ #define MSR_IA32_MCx_CTL2(x)		(MSR_IA32_MC0_CTL2 + (x))
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 6f834f8..dba9ca2 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -569,6 +569,25 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
+ 	/* As a rule processors have APIC timer running in deep C states */
+ 	if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
+ 		set_cpu_cap(c, X86_FEATURE_ARAT);
++
++	/*
++	 * Disable GART TLB Walk Errors on Fam10h. We do this here
++	 * because this is always needed when GART is enabled, even in a
++	 * kernel which has no MCE support built in.
++	 */
++	if (c->x86 == 0x10) {
++		/*
++		 * BIOS should disable GartTlbWlk Errors themself. If
++		 * it doesn't do it here as suggested by the BKDG.
++		 *
++		 * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012
++		 */
++		u64 mask;
++
++		rdmsrl(MSR_AMD64_MCx_MASK(4), mask);
++		mask |= (1 << 10);
++		wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
++	}
+ }
+ 
+ #ifdef CONFIG_X86_32
+-- 
+1.7.4.4
+
diff --git a/queue/x86-cpu-AMD-errata-checking-framework.patch b/queue/x86-cpu-AMD-errata-checking-framework.patch
new file mode 100644
index 0000000..3a92db0
--- /dev/null
+++ b/queue/x86-cpu-AMD-errata-checking-framework.patch
@@ -0,0 +1,127 @@
+From e6fd064c82b3d3dbed1d5a7953e88de56f844302 Mon Sep 17 00:00:00 2001
+From: Hans Rosenfeld <hans.rosenfeld@amd.com>
+Date: Wed, 28 Jul 2010 19:09:30 +0200
+Subject: [PATCH 11/25] x86, cpu: AMD errata checking framework
+
+commit d78d671db478eb8b14c78501c0cee1cc7baf6967 upstream.
+
+Errata are defined using the AMD_LEGACY_ERRATUM() or AMD_OSVW_ERRATUM()
+macros. The latter is intended for newer errata that have an OSVW id
+assigned, which it takes as first argument. Both take a variable number
+of family-specific model-stepping ranges created by AMD_MODEL_RANGE().
+
+Iff an erratum has an OSVW id, OSVW is available on the CPU, and the
+OSVW id is known to the hardware, it is used to determine whether an
+erratum is present. Otherwise, the model-stepping ranges are matched
+against the current CPU to find out whether the erratum applies.
+
+For certain special errata, the code using this framework might have to
+conduct further checks to make sure an erratum is really (not) present.
+
+Signed-off-by: Hans Rosenfeld <hans.rosenfeld@amd.com>
+LKML-Reference: <1280336972-865982-1-git-send-email-hans.rosenfeld@amd.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/include/asm/processor.h |   18 +++++++++++
+ arch/x86/kernel/cpu/amd.c        |   60 ++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 78 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index 6757357..b213059 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -1031,4 +1031,22 @@ unsigned long calc_aperfmperf_ratio(struct aperfmperf *old,
+ 	return ratio;
+ }
+ 
++/*
++ * AMD errata checking
++ */
++#ifdef CONFIG_CPU_SUP_AMD
++extern bool cpu_has_amd_erratum(const int *);
++
++#define AMD_LEGACY_ERRATUM(...)		{ -1, __VA_ARGS__, 0 }
++#define AMD_OSVW_ERRATUM(osvw_id, ...)	{ osvw_id, __VA_ARGS__, 0 }
++#define AMD_MODEL_RANGE(f, m_start, s_start, m_end, s_end) \
++	((f << 24) | (m_start << 16) | (s_start << 12) | (m_end << 4) | (s_end))
++#define AMD_MODEL_RANGE_FAMILY(range)	(((range) >> 24) & 0xff)
++#define AMD_MODEL_RANGE_START(range)	(((range) >> 12) & 0xfff)
++#define AMD_MODEL_RANGE_END(range)	((range) & 0xfff)
++
++#else
++#define cpu_has_amd_erratum(x)	(false)
++#endif /* CONFIG_CPU_SUP_AMD */
++
+ #endif /* _ASM_X86_PROCESSOR_H */
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index e485825..1d0c58e 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -609,3 +609,63 @@ static const struct cpu_dev __cpuinitconst amd_cpu_dev = {
+ };
+ 
+ cpu_dev_register(amd_cpu_dev);
++
++/*
++ * AMD errata checking
++ *
++ * Errata are defined as arrays of ints using the AMD_LEGACY_ERRATUM() or
++ * AMD_OSVW_ERRATUM() macros. The latter is intended for newer errata that
++ * have an OSVW id assigned, which it takes as first argument. Both take a
++ * variable number of family-specific model-stepping ranges created by
++ * AMD_MODEL_RANGE(). Each erratum also has to be declared as extern const
++ * int[] in arch/x86/include/asm/processor.h.
++ *
++ * Example:
++ *
++ * const int amd_erratum_319[] =
++ *	AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0x4, 0x2),
++ *			   AMD_MODEL_RANGE(0x10, 0x8, 0x0, 0x8, 0x0),
++ *			   AMD_MODEL_RANGE(0x10, 0x9, 0x0, 0x9, 0x0));
++ */
++
++bool cpu_has_amd_erratum(const int *erratum)
++{
++	struct cpuinfo_x86 *cpu = &current_cpu_data;
++	int osvw_id = *erratum++;
++	u32 range;
++	u32 ms;
++
++	/*
++	 * If called early enough that current_cpu_data hasn't been initialized
++	 * yet, fall back to boot_cpu_data.
++	 */
++	if (cpu->x86 == 0)
++		cpu = &boot_cpu_data;
++
++	if (cpu->x86_vendor != X86_VENDOR_AMD)
++		return false;
++
++	if (osvw_id >= 0 && osvw_id < 65536 &&
++	    cpu_has(cpu, X86_FEATURE_OSVW)) {
++		u64 osvw_len;
++
++		rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, osvw_len);
++		if (osvw_id < osvw_len) {
++			u64 osvw_bits;
++
++			rdmsrl(MSR_AMD64_OSVW_STATUS + (osvw_id >> 6),
++			    osvw_bits);
++			return osvw_bits & (1ULL << (osvw_id & 0x3f));
++		}
++	}
++
++	/* OSVW unavailable or ID unknown, match family-model-stepping range */
++	ms = (cpu->x86_model << 8) | cpu->x86_mask;
++	while ((range = *erratum++))
++		if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
++		    (ms >= AMD_MODEL_RANGE_START(range)) &&
++		    (ms <= AMD_MODEL_RANGE_END(range)))
++			return true;
++
++	return false;
++}
+-- 
+1.7.4.4
+
diff --git a/queue/x86-cpu-Clean-up-AMD-erratum-400-workaround.patch b/queue/x86-cpu-Clean-up-AMD-erratum-400-workaround.patch
new file mode 100644
index 0000000..51667e1
--- /dev/null
+++ b/queue/x86-cpu-Clean-up-AMD-erratum-400-workaround.patch
@@ -0,0 +1,108 @@
+From 0f60fddf7578c897101ce5a9c3afce5cef6f354b Mon Sep 17 00:00:00 2001
+From: Hans Rosenfeld <hans.rosenfeld@amd.com>
+Date: Wed, 28 Jul 2010 19:09:31 +0200
+Subject: [PATCH 12/25] x86, cpu: Clean up AMD erratum 400 workaround
+
+commit 9d8888c2a214aece2494a49e699a097c2ba9498b upstream.
+
+Remove check_c1e_idle() and use the new AMD errata checking framework
+instead.
+
+Signed-off-by: Hans Rosenfeld <hans.rosenfeld@amd.com>
+LKML-Reference: <1280336972-865982-2-git-send-email-hans.rosenfeld@amd.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/include/asm/processor.h |    1 +
+ arch/x86/kernel/cpu/amd.c        |    5 ++++
+ arch/x86/kernel/process.c        |   39 +------------------------------------
+ 3 files changed, 8 insertions(+), 37 deletions(-)
+
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index b213059..7eb1dd7 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -1035,6 +1035,7 @@ unsigned long calc_aperfmperf_ratio(struct aperfmperf *old,
+  * AMD errata checking
+  */
+ #ifdef CONFIG_CPU_SUP_AMD
++extern const int amd_erratum_400[];
+ extern bool cpu_has_amd_erratum(const int *);
+ 
+ #define AMD_LEGACY_ERRATUM(...)		{ -1, __VA_ARGS__, 0 }
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 1d0c58e..08dd1be 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -628,6 +628,11 @@ cpu_dev_register(amd_cpu_dev);
+  *			   AMD_MODEL_RANGE(0x10, 0x9, 0x0, 0x9, 0x0));
+  */
+ 
++const int amd_erratum_400[] =
++	AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),
++			    AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf));
++
++
+ bool cpu_has_amd_erratum(const int *erratum)
+ {
+ 	struct cpuinfo_x86 *cpu = &current_cpu_data;
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 0415c3e..efabf8f 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -525,42 +525,6 @@ static int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
+ 	return (edx & MWAIT_EDX_C1);
+ }
+ 
+-/*
+- * Check for AMD CPUs, where APIC timer interrupt does not wake up CPU from C1e.
+- * For more information see
+- * - Erratum #400 for NPT family 0xf and family 0x10 CPUs
+- * - Erratum #365 for family 0x11 (not affected because C1e not in use)
+- */
+-static int __cpuinit check_c1e_idle(const struct cpuinfo_x86 *c)
+-{
+-	u64 val;
+-	if (c->x86_vendor != X86_VENDOR_AMD)
+-		goto no_c1e_idle;
+-
+-	/* Family 0x0f models < rev F do not have C1E */
+-	if (c->x86 == 0x0F && c->x86_model >= 0x40)
+-		return 1;
+-
+-	if (c->x86 == 0x10) {
+-		/*
+-		 * check OSVW bit for CPUs that are not affected
+-		 * by erratum #400
+-		 */
+-		if (cpu_has(c, X86_FEATURE_OSVW)) {
+-			rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
+-			if (val >= 2) {
+-				rdmsrl(MSR_AMD64_OSVW_STATUS, val);
+-				if (!(val & BIT(1)))
+-					goto no_c1e_idle;
+-			}
+-		}
+-		return 1;
+-	}
+-
+-no_c1e_idle:
+-	return 0;
+-}
+-
+ static cpumask_var_t c1e_mask;
+ static int c1e_detected;
+ 
+@@ -638,7 +602,8 @@ void __cpuinit select_idle_routine(const struct cpuinfo_x86 *c)
+ 		 */
+ 		printk(KERN_INFO "using mwait in idle threads.\n");
+ 		pm_idle = mwait_idle;
+-	} else if (check_c1e_idle(c)) {
++	} else if (cpu_has_amd_erratum(amd_erratum_400)) {
++		/* E400: APIC timer interrupt does not wake up CPU from C1e */
+ 		printk(KERN_INFO "using C1E aware idle routine\n");
+ 		pm_idle = c1e_idle;
+ 	} else
+-- 
+1.7.4.4
+
diff --git a/queue/x86-cpu-Fix-regression-in-AMD-errata-checking-code.patch b/queue/x86-cpu-Fix-regression-in-AMD-errata-checking-code.patch
new file mode 100644
index 0000000..a90edf7
--- /dev/null
+++ b/queue/x86-cpu-Fix-regression-in-AMD-errata-checking-code.patch
@@ -0,0 +1,35 @@
+From 3494ccebcbc6f5117e0398a6eeb337c8695a1877 Mon Sep 17 00:00:00 2001
+From: Hans Rosenfeld <hans.rosenfeld@amd.com>
+Date: Wed, 18 Aug 2010 16:19:50 +0200
+Subject: [PATCH 24/25] x86, cpu: Fix regression in AMD errata checking code
+
+commit 07a7795ca2e6e66d00b184efb46bd0e23d90d3fe upstream.
+
+A bug in the family-model-stepping matching code caused the presence of
+errata to go undetected when OSVW was not used. This causes hangs on
+some K8 systems because the E400 workaround is not enabled.
+
+Signed-off-by: Hans Rosenfeld <hans.rosenfeld@amd.com>
+LKML-Reference: <1282141190-930137-1-git-send-email-hans.rosenfeld@amd.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/kernel/cpu/amd.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index dba9ca2..d618dc1 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -688,7 +688,7 @@ bool cpu_has_amd_erratum(const int *erratum)
+ 	}
+ 
+ 	/* OSVW unavailable or ID unknown, match family-model-stepping range */
+-	ms = (cpu->x86_model << 8) | cpu->x86_mask;
++	ms = (cpu->x86_model << 4) | cpu->x86_mask;
+ 	while ((range = *erratum++))
+ 		if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
+ 		    (ms >= AMD_MODEL_RANGE_START(range)) &&
+-- 
+1.7.4.4
+