import of selections paralleling 2.6.32.46

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

19 files changed, 1043 insertions, 0 deletions

diff --git a/audit/from-v2.6.32/audit.txt b/audit/from-v2.6.32/audit.txt
index 2873ec2..5d90994 100644
--- a/audit/from-v2.6.32/audit.txt
+++ b/audit/from-v2.6.32/audit.txt
@@ -3201,3 +3201,26 @@ f562aba7 	966728dd	v3.1		n
 b80a7826 	0584ffa5	v3.1		n
 263b8937 	6e5714ea	v3.1		n
 d792afea 	bc0b96b5	v3.1		n
+---- v2.6.32.46 ----
+Commit		Parent		Parent in	In 34.x		Notes
+========================================================================
+b0b3e41f 	xxxxxxxx	-- ? -- 	n/a	Makefile ver. change
+12361acf 	064b4330	v3.1		n
+7b1ef6c0 	c2183d1e	v3.1		n
+035fac58 	7c4c3960	v3.1		n
+4d3b4b41 	05e33fc2	v3.1		n
+2bbc3e27 	7ca0758c	v3.1		n
+d64ec7bb 	9ea71503	v3.1		n
+3d854ed8 	eade7b28	v3.1		n
+9089b3bd 	da6094ea	v3.1		n
+0af48fa3 	338d0f0a	v3.1		y	in queue already
+098c4cab 	3eb8e74e	v3.0		y	in queue already
+b871297c 	aba8d056	v3.1		n
+14b9d5c8 	f982f915	v3.1		n
+6d05cd30 	15439bde	v3.1		n
+3ca96941 	66a89b21	v3.1		n
+ae2690d0 	a08af810	v3.1		n
+4bb900a7 	e4685617	v3.1		n
+d1a6653b 	a871e4f5	v3.1		n
+36a357ee 	4f1a7a3e	v3.1		n
+b6708a1c 	6768458b	v3.1		n
diff --git a/queue/ALSA-ac97-Add-HP-Compaq-dc5100-SFF-PT003AW-to-Headph.patch b/queue/ALSA-ac97-Add-HP-Compaq-dc5100-SFF-PT003AW-to-Headph.patch
new file mode 100644
index 0000000..56b9a60
--- /dev/null
+++ b/queue/ALSA-ac97-Add-HP-Compaq-dc5100-SFF-PT003AW-to-Headph.patch
@@ -0,0 +1,36 @@
+From 21ae3b66db083e1c99f6ddec8ec06c36895982aa Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Sun, 14 Aug 2011 22:43:01 -0400
+Subject: [PATCH] ALSA: ac97: Add HP Compaq dc5100 SFF(PT003AW) to Headphone
+ Jack Sense whitelist
+
+commit eade7b281c9fc18401b989c77d5e5e660b25a3b7 upstream.
+
+BugLink: https://bugs.launchpad.net/bugs/826081
+
+The original reporter needs 'Headphone Jack Sense' enabled to have
+audible audio, so add his PCI SSID to the whitelist.
+
+Reported-and-tested-by: Muhammad Khurram Khan
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ sound/pci/ac97/ac97_patch.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
+index e68c98e..f26fc25 100644
+--- a/sound/pci/ac97/ac97_patch.c
++++ b/sound/pci/ac97/ac97_patch.c
+@@ -1900,6 +1900,7 @@ static unsigned int ad1981_jacks_whitelist[] = {
+ 	0x103c0944, /* HP nc6220 */
+ 	0x103c0934, /* HP nc8220 */
+ 	0x103c006d, /* HP nx9105 */
++	0x103c300d, /* HP Compaq dc5100 SFF(PT003AW) */
+ 	0x17340088, /* FSC Scenic-W */
+ 	0 /* end */
+ };
+-- 
+1.7.9.6
+
diff --git a/queue/ALSA-snd-usb-caiaq-Correct-offset-fields-of-outbound.patch b/queue/ALSA-snd-usb-caiaq-Correct-offset-fields-of-outbound.patch
new file mode 100644
index 0000000..de0faed
--- /dev/null
+++ b/queue/ALSA-snd-usb-caiaq-Correct-offset-fields-of-outbound.patch
@@ -0,0 +1,56 @@
+From 58a9012c5094e352da2cd5f435fd2c68496d9d40 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Fri, 5 Aug 2011 13:49:52 +0200
+Subject: [PATCH] ALSA: snd-usb-caiaq: Correct offset fields of outbound
+ iso_frame_desc
+
+commit 15439bde3af7ff88459ea2b5520b77312e958df2 upstream.
+
+This fixes faulty outbount packets in case the inbound packets
+received from the hardware are fragmented and contain bogus input
+iso frames. The bug has been there for ages, but for some strange
+reasons, it was only triggered by newer machines in 64bit mode.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-and-tested-by: William Light <wrl@illest.net>
+Reported-by: Pedro Ribeiro <pedrib@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ sound/usb/caiaq/audio.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
+index a184e91..75c8446 100644
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -469,6 +469,7 @@ static void read_completed(struct urb *urb)
+ 	struct snd_usb_caiaqdev *dev;
+ 	struct urb *out;
+ 	int frame, len, send_it = 0, outframe = 0;
++	size_t offset = 0;
+ 
+ 	if (urb->status || !info)
+ 		return;
+@@ -489,7 +490,8 @@ static void read_completed(struct urb *urb)
+ 		len = urb->iso_frame_desc[outframe].actual_length;
+ 		out->iso_frame_desc[outframe].length = len;
+ 		out->iso_frame_desc[outframe].actual_length = 0;
+-		out->iso_frame_desc[outframe].offset = BYTES_PER_FRAME * frame;
++		out->iso_frame_desc[outframe].offset = offset;
++		offset += len;
+ 
+ 		if (len > 0) {
+ 			spin_lock(&dev->spinlock);
+@@ -505,7 +507,7 @@ static void read_completed(struct urb *urb)
+ 	}
+ 
+ 	if (send_it) {
+-		out->number_of_packets = FRAMES_PER_URB;
++		out->number_of_packets = outframe;
+ 		out->transfer_flags = URB_ISO_ASAP;
+ 		usb_submit_urb(out, GFP_ATOMIC);
+ 	}
+-- 
+1.7.9.6
+
diff --git a/queue/ALSA-snd_usb_caiaq-track-submitted-output-urbs.patch b/queue/ALSA-snd_usb_caiaq-track-submitted-output-urbs.patch
new file mode 100644
index 0000000..b30f51a
--- /dev/null
+++ b/queue/ALSA-snd_usb_caiaq-track-submitted-output-urbs.patch
@@ -0,0 +1,129 @@
+From 15068e1855583be6eb74c9d7cc1745054c654d1b Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Sun, 14 Aug 2011 11:31:16 +0200
+Subject: [PATCH] ALSA: snd_usb_caiaq: track submitted output urbs
+
+commit da6094ea7d3c2295473d8f5134279307255d6ebf upstream.
+
+The snd_usb_caiaq driver currently assumes that output urbs are serviced
+in time and doesn't track when and whether they are given back by the
+USB core. That usually works fine, but due to temporary limitations of
+the XHCI stack, we faced that urbs were submitted more than once with
+this approach.
+
+As it's no good practice to fire and forget urbs anyway, this patch
+introduces a proper bit mask to track which requests have been submitted
+and given back.
+
+That alone however doesn't make the driver work in case the host
+controller is broken and doesn't give back urbs at all, and the output
+stream will stop once all pre-allocated output urbs are consumed. But
+it does prevent crashes of the controller stack in such cases.
+
+See http://bugzilla.kernel.org/show_bug.cgi?id=40702 for more details.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-and-tested-by: Matej Laitl <matej@laitl.cz>
+Cc: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ sound/usb/caiaq/audio.c  |   31 +++++++++++++++++++++++++++----
+ sound/usb/caiaq/device.h |    1 +
+ 2 files changed, 28 insertions(+), 4 deletions(-)
+
+diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
+index 75c8446..155d6d7 100644
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -139,8 +139,12 @@ static void stream_stop(struct snd_usb_caiaqdev *dev)
+ 
+ 	for (i = 0; i < N_URBS; i++) {
+ 		usb_kill_urb(dev->data_urbs_in[i]);
+-		usb_kill_urb(dev->data_urbs_out[i]);
++
++		if (test_bit(i, &dev->outurb_active_mask))
++			usb_kill_urb(dev->data_urbs_out[i]);
+ 	}
++
++	dev->outurb_active_mask = 0;
+ }
+ 
+ static int snd_usb_caiaq_substream_open(struct snd_pcm_substream *substream)
+@@ -467,8 +471,8 @@ static void read_completed(struct urb *urb)
+ {
+ 	struct snd_usb_caiaq_cb_info *info = urb->context;
+ 	struct snd_usb_caiaqdev *dev;
+-	struct urb *out;
+-	int frame, len, send_it = 0, outframe = 0;
++	struct urb *out = NULL;
++	int i, frame, len, send_it = 0, outframe = 0;
+ 	size_t offset = 0;
+ 
+ 	if (urb->status || !info)
+@@ -479,7 +483,17 @@ static void read_completed(struct urb *urb)
+ 	if (!dev->streaming)
+ 		return;
+ 
+-	out = dev->data_urbs_out[info->index];
++	/* find an unused output urb that is unused */
++	for (i = 0; i < N_URBS; i++)
++		if (test_and_set_bit(i, &dev->outurb_active_mask) == 0) {
++			out = dev->data_urbs_out[i];
++			break;
++		}
++
++	if (!out) {
++		log("Unable to find an output urb to use\n");
++		goto requeue;
++	}
+ 
+ 	/* read the recently received packet and send back one which has
+ 	 * the same layout */
+@@ -510,8 +524,12 @@ static void read_completed(struct urb *urb)
+ 		out->number_of_packets = outframe;
+ 		out->transfer_flags = URB_ISO_ASAP;
+ 		usb_submit_urb(out, GFP_ATOMIC);
++	} else {
++		struct snd_usb_caiaq_cb_info *oinfo = out->context;
++		clear_bit(oinfo->index, &dev->outurb_active_mask);
+ 	}
+ 
++requeue:
+ 	/* re-submit inbound urb */
+ 	for (frame = 0; frame < FRAMES_PER_URB; frame++) {
+ 		urb->iso_frame_desc[frame].offset = BYTES_PER_FRAME * frame;
+@@ -533,6 +551,8 @@ static void write_completed(struct urb *urb)
+ 		dev->output_running = 1;
+ 		wake_up(&dev->prepare_wait_queue);
+ 	}
++
++	clear_bit(info->index, &dev->outurb_active_mask);
+ }
+ 
+ static struct urb **alloc_urbs(struct snd_usb_caiaqdev *dev, int dir, int *ret)
+@@ -683,6 +703,9 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *dev)
+ 	if (!dev->data_cb_info)
+ 		return -ENOMEM;
+ 
++	dev->outurb_active_mask = 0;
++	BUILD_BUG_ON(N_URBS > (sizeof(dev->outurb_active_mask) * 8));
++
+ 	for (i = 0; i < N_URBS; i++) {
+ 		dev->data_cb_info[i].dev = dev;
+ 		dev->data_cb_info[i].index = i;
+diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
+index 44e3edf..94c0c36 100644
+--- a/sound/usb/caiaq/device.h
++++ b/sound/usb/caiaq/device.h
+@@ -92,6 +92,7 @@ struct snd_usb_caiaqdev {
+ 	int input_panic, output_panic, warned;
+ 	char *audio_in_buf, *audio_out_buf;
+ 	unsigned int samplerates, bpp;
++	unsigned long outurb_active_mask;
+ 
+ 	struct snd_pcm_substream *sub_playback[MAX_STREAMS];
+ 	struct snd_pcm_substream *sub_capture[MAX_STREAMS];
+-- 
+1.7.9.6
+
diff --git a/queue/USB-Serial-Added-device-ID-for-Qualcomm-Modem-in-Sag.patch b/queue/USB-Serial-Added-device-ID-for-Qualcomm-Modem-in-Sag.patch
new file mode 100644
index 0000000..e077419
--- /dev/null
+++ b/queue/USB-Serial-Added-device-ID-for-Qualcomm-Modem-in-Sag.patch
@@ -0,0 +1,32 @@
+From 9388b95ca45febc805294eb4e729fcc34f5fecde Mon Sep 17 00:00:00 2001
+From: Vijay Chavan <vijaychavan007@gmail.com>
+Date: Tue, 9 Aug 2011 02:41:12 +0530
+Subject: [PATCH] USB: Serial: Added device ID for Qualcomm Modem in
+ Sagemcom's HiLo3G
+
+commit e468561739fffb972d486b98f66c723936335136 upstream.
+
+A new device ID pair is added for Qualcomm Modem present in Sagemcom's HiLo3G module.
+
+Signed-off-by: Vijay Chavan <VijayChavan007@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/serial/qcserial.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 53a2d5a..225fc88 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -43,6 +43,7 @@ static const struct usb_device_id id_table[] = {
+ 	{USB_DEVICE(0x05c6, 0x9203)},	/* Generic Gobi Modem device */
+ 	{USB_DEVICE(0x05c6, 0x9222)},	/* Generic Gobi Modem device */
+ 	{USB_DEVICE(0x05c6, 0x9008)},	/* Generic Gobi QDL device */
++	{USB_DEVICE(0x05c6, 0x9009)},	/* Generic Gobi Modem device */
+ 	{USB_DEVICE(0x05c6, 0x9201)},	/* Generic Gobi QDL device */
+ 	{USB_DEVICE(0x05c6, 0x9221)},	/* Generic Gobi QDL device */
+ 	{USB_DEVICE(0x05c6, 0x9231)},	/* Generic Gobi QDL device */
+-- 
+1.7.9.6
+
diff --git a/queue/USB-assign-instead-of-equal-in-usbtmc.c.patch b/queue/USB-assign-instead-of-equal-in-usbtmc.c.patch
new file mode 100644
index 0000000..65f5303
--- /dev/null
+++ b/queue/USB-assign-instead-of-equal-in-usbtmc.c.patch
@@ -0,0 +1,32 @@
+From fabce10659fe35fcb402690014141cd103b40ef6 Mon Sep 17 00:00:00 2001
+From: Maxim Nikulin <m.a.nikulin@gmail.com>
+Date: Sat, 9 Jul 2011 23:44:44 +0700
+Subject: [PATCH] USB: assign instead of equal in usbtmc.c
+
+commit 4f1a7a3e78037721496283ea3e87cfefc64d99c7 upstream.
+
+Assign operator instead of equality test in the usbtmc_ioctl_abort_bulk_in() function.
+
+Signed-off-by: Maxim A. Nikulin <M.A.Nikulin@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/class/usbtmc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
+index 3e7c1b8..cdce915 100644
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -268,7 +268,7 @@ usbtmc_abort_bulk_in_status:
+ 				dev_err(dev, "usb_bulk_msg returned %d\n", rv);
+ 				goto exit;
+ 			}
+-		} while ((actual = max_size) &&
++		} while ((actual == max_size) &&
+ 			 (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
+ 
+ 	if (actual == max_size) {
+-- 
+1.7.9.6
+
diff --git a/queue/USB-usb-storage-unusual_devs-entry-for-ARM-V2M-mothe.patch b/queue/USB-usb-storage-unusual_devs-entry-for-ARM-V2M-mothe.patch
new file mode 100644
index 0000000..f7ebb00
--- /dev/null
+++ b/queue/USB-usb-storage-unusual_devs-entry-for-ARM-V2M-mothe.patch
@@ -0,0 +1,51 @@
+From 997eea373ade641cfb5dca9853ad71d97ae64e30 Mon Sep 17 00:00:00 2001
+From: Nick Bowler <nbowler@elliptictech.com>
+Date: Wed, 13 Jul 2011 11:40:09 -0400
+Subject: [PATCH] USB: usb-storage: unusual_devs entry for ARM V2M
+ motherboard.
+
+commit a871e4f5519d8c52430052e1d340dd5710eb5ad6 upstream.
+
+Connecting the V2M to a Linux host results in a constant stream of
+errors spammed to the console, all of the form
+
+  sd 1:0:0:0: ioctl_internal_command return code = 8070000
+     : Sense Key : 0x4 [current]
+     : ASC=0x0 ASCQ=0x0
+
+The errors appear to be otherwise harmless.  Add an unusual_devs entry
+which eliminates all of the error messages.
+
+Signed-off-by: Nick Bowler <nbowler@elliptictech.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+[PG: 2.6.34 uses US_ prefix, not USB_ prefix, change accordingly]
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/storage/unusual_devs.h |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index a33e2ba..ee5a8ba 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1972,6 +1972,16 @@ UNUSUAL_DEV(  0x4146, 0xba01, 0x0100, 0x0100,
+ 		"Micro Mini 1GB",
+ 		US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ),
+ 
++/*
++ * Nick Bowler <nbowler@elliptictech.com>
++ * SCSI stack spams (otherwise harmless) error messages.
++ */
++UNUSUAL_DEV(  0xc251, 0x4003, 0x0100, 0x0100,
++		"Keil Software, Inc.",
++		"V2M MotherBoard",
++		US_SC_DEVICE, US_PR_DEVICE, NULL,
++		US_FL_NOT_LOCKABLE),
++
+ /* Reported by Andrew Simmons <andrew.simmons@gmail.com> */
+ UNUSUAL_DEV(  0xed06, 0x4500, 0x0001, 0x0001,
+ 		"DataStor",
+-- 
+1.7.9.6
+
diff --git a/queue/USB-xhci-fix-OS-want-to-own-HC.patch b/queue/USB-xhci-fix-OS-want-to-own-HC.patch
new file mode 100644
index 0000000..e8c1094
--- /dev/null
+++ b/queue/USB-xhci-fix-OS-want-to-own-HC.patch
@@ -0,0 +1,34 @@
+From 0e7ba34d8b191d81f99c88a0f4338e67e5023b84 Mon Sep 17 00:00:00 2001
+From: JiSheng Zhang <jszhang3@gmail.com>
+Date: Sat, 16 Jul 2011 11:04:19 +0800
+Subject: [PATCH] USB: xhci: fix OS want to own HC
+
+commit 6768458b17f9bf48a4c3a34e49b20344091b5f7e upstream.
+
+Software should set XHCI_HC_OS_OWNED bit to request ownership of xHC.
+
+This patch should be backported to kernels as far back as 2.6.31.
+
+Signed-off-by: JiSheng Zhang <jszhang3@gmail.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/host/pci-quirks.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index bcf7a88..eae8b18 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -444,7 +444,7 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
+ 
+ 	/* If the BIOS owns the HC, signal that the OS wants it, and wait */
+ 	if (val & XHCI_HC_BIOS_OWNED) {
+-		writel(val & XHCI_HC_OS_OWNED, base + ext_cap_offset);
++		writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
+ 
+ 		/* Wait for 5 seconds with 10 microsecond polling interval */
+ 		timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
+-- 
+1.7.9.6
+
diff --git a/queue/atm-br2864-sent-packets-truncated-in-VC-routed-mode.patch b/queue/atm-br2864-sent-packets-truncated-in-VC-routed-mode.patch
new file mode 100644
index 0000000..5add156
--- /dev/null
+++ b/queue/atm-br2864-sent-packets-truncated-in-VC-routed-mode.patch
@@ -0,0 +1,31 @@
+From a85a33810f17c04e661cab32c44630d39ae9b0c6 Mon Sep 17 00:00:00 2001
+From: Chas Williams <chas@cmf.nrl.navy.mil>
+Date: Mon, 1 Aug 2011 17:56:14 -0700
+Subject: [PATCH] atm: br2864: sent packets truncated in VC routed mode
+
+commit a08af810cdc29d2ca930e8a869d3d01744c392d8 upstream.
+
+Reported-by: Pascal Hambourg <pascal@plouf.fr.eu.org>
+Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ net/atm/br2684.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/net/atm/br2684.c b/net/atm/br2684.c
+index d6c7cea..f3bae14 100644
+--- a/net/atm/br2684.c
++++ b/net/atm/br2684.c
+@@ -205,8 +205,6 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev,
+ 		if (brdev->payload == p_bridged) {
+ 			skb_push(skb, 2);
+ 			memset(skb->data, 0, 2);
+-		} else { /* p_routed */
+-			skb_pull(skb, ETH_HLEN);
+ 		}
+ 	}
+ 	skb_debug(skb);
+-- 
+1.7.9.6
+
diff --git a/queue/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch b/queue/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch
new file mode 100644
index 0000000..20f0cc6
--- /dev/null
+++ b/queue/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch
@@ -0,0 +1,37 @@
+From e10e3aa7a09eb934957c8699f1d22550694846b6 Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Mon, 22 Aug 2011 21:17:57 +0000
+Subject: [PATCH] drm/ttm: fix ttm_bo_add_ttm(user) failure path
+
+commit 7c4c3960dff109bc5db4c35da481c212dadb5eb5 upstream.
+
+ttm_tt_destroy kfrees passed object, so we need to nullify
+a reference to it.
+
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/gpu/drm/ttm/ttm_bo.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 0e3754a3..778fa1a 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -343,8 +343,10 @@ static int ttm_bo_add_ttm(struct ttm_buffer_object *bo, bool zero_alloc)
+ 
+ 		ret = ttm_tt_set_user(bo->ttm, current,
+ 				      bo->buffer_start, bo->num_pages);
+-		if (unlikely(ret != 0))
++		if (unlikely(ret != 0)) {
+ 			ttm_tt_destroy(bo->ttm);
++			bo->ttm = NULL;
++		}
+ 		break;
+ 	default:
+ 		printk(KERN_ERR TTM_PFX "Illegal buffer object type\n");
+-- 
+1.7.9.6
+
diff --git a/queue/fuse-check-size-of-FUSE_NOTIFY_INVAL_ENTRY-message.patch b/queue/fuse-check-size-of-FUSE_NOTIFY_INVAL_ENTRY-message.patch
new file mode 100644
index 0000000..809eee5
--- /dev/null
+++ b/queue/fuse-check-size-of-FUSE_NOTIFY_INVAL_ENTRY-message.patch
@@ -0,0 +1,36 @@
+From 66d2a69a060f79eba6d5d15bcdb008c3a211e7b1 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Wed, 24 Aug 2011 10:20:17 +0200
+Subject: [PATCH] fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message
+
+commit c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae upstream.
+
+FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the
+message processing could overrun and result in a "kernel BUG at
+fs/fuse/dev.c:629!"
+
+Reported-by: Han-Wen Nienhuys <hanwenn@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ fs/fuse/dev.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index c235afc..9897fe3 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -901,6 +901,10 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
+ 	if (outarg.namelen > FUSE_NAME_MAX)
+ 		goto err;
+ 
++	err = -EINVAL;
++	if (size != sizeof(outarg) + outarg.namelen + 1)
++		goto err;
++
+ 	name.name = buf;
+ 	name.len = outarg.namelen;
+ 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
+-- 
+1.7.9.6
+
diff --git a/queue/futex-Fix-regression-with-read-only-mappings.patch b/queue/futex-Fix-regression-with-read-only-mappings.patch
new file mode 100644
index 0000000..7680229
--- /dev/null
+++ b/queue/futex-Fix-regression-with-read-only-mappings.patch
@@ -0,0 +1,239 @@
+From 595c0b23f285357ce7a8c6325b2e0ae498569c05 Mon Sep 17 00:00:00 2001
+From: Shawn Bohrer <sbohrer@rgmadvisors.com>
+Date: Thu, 30 Jun 2011 11:21:32 -0500
+Subject: [PATCH] futex: Fix regression with read only mappings
+
+commit 9ea71503a8ed9184d2d0b8ccc4d269d05f7940ae upstream.
+
+commit 7485d0d3758e8e6491a5c9468114e74dc050785d (futexes: Remove rw
+parameter from get_futex_key()) in 2.6.33 fixed two problems:  First, It
+prevented a loop when encountering a ZERO_PAGE. Second, it fixed RW
+MAP_PRIVATE futex operations by forcing the COW to occur by
+unconditionally performing a write access get_user_pages_fast() to get
+the page.  The commit also introduced a user-mode regression in that it
+broke futex operations on read-only memory maps.  For example, this
+breaks workloads that have one or more reader processes doing a
+FUTEX_WAIT on a futex within a read only shared file mapping, and a
+writer processes that has a writable mapping issuing the FUTEX_WAKE.
+
+This fixes the regression for valid futex operations on RO mappings by
+trying a RO get_user_pages_fast() when the RW get_user_pages_fast()
+fails. This change makes it necessary to also check for invalid use
+cases, such as anonymous RO mappings (which can never change) and the
+ZERO_PAGE which the commit referenced above was written to address.
+
+This patch does restore the original behavior with RO MAP_PRIVATE
+mappings, which have inherent user-mode usage problems and don't really
+make sense.  With this patch performing a FUTEX_WAIT within a RO
+MAP_PRIVATE mapping will be successfully woken provided another process
+updates the region of the underlying mapped file.  However, the mmap()
+man page states that for a MAP_PRIVATE mapping:
+
+  It is unspecified whether changes made to the file after
+  the mmap() call are visible in the mapped region.
+
+So user-mode users attempting to use futex operations on RO MAP_PRIVATE
+mappings are depending on unspecified behavior.  Additionally a
+RO MAP_PRIVATE mapping could fail to wake up in the following case.
+
+  Thread-A: call futex(FUTEX_WAIT, memory-region-A).
+            get_futex_key() return inode based key.
+            sleep on the key
+  Thread-B: call mprotect(PROT_READ|PROT_WRITE, memory-region-A)
+  Thread-B: write memory-region-A.
+            COW happen. This process's memory-region-A become related
+            to new COWed private (ie PageAnon=1) page.
+  Thread-B: call futex(FUETX_WAKE, memory-region-A).
+            get_futex_key() return mm based key.
+            IOW, we fail to wake up Thread-A.
+
+Once again doing something like this is just silly and users who do
+something like this get what they deserve.
+
+While RO MAP_PRIVATE mappings are nonsensical, checking for a private
+mapping requires walking the vmas and was deemed too costly to avoid a
+userspace hang.
+
+This Patch is based on Peter Zijlstra's initial patch with modifications to
+only allow RO mappings for futex operations that need VERIFY_READ access.
+
+Reported-by: David Oliver <david@rgmadvisors.com>
+Signed-off-by: Shawn Bohrer <sbohrer@rgmadvisors.com>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Darren Hart <dvhart@linux.intel.com>
+Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: peterz@infradead.org
+Cc: eric.dumazet@gmail.com
+Cc: zvonler@rgmadvisors.com
+Cc: hughd@google.com
+Link: http://lkml.kernel.org/r/1309450892-30676-1-git-send-email-sbohrer@rgmadvisors.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+[PG: in 34, the variable is "page"; in original 9ea71503a it is page_head]
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ kernel/futex.c |   54 ++++++++++++++++++++++++++++++++++++++++++------------
+ 1 file changed, 42 insertions(+), 12 deletions(-)
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index e328f57..98a354d 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -203,6 +203,8 @@ static void drop_futex_key_refs(union futex_key *key)
+  * @uaddr:	virtual address of the futex
+  * @fshared:	0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
+  * @key:	address where result is stored.
++ * @rw:		mapping needs to be read/write (values: VERIFY_READ,
++ *              VERIFY_WRITE)
+  *
+  * Returns a negative error code or 0
+  * The key words are stored in *key on success.
+@@ -214,12 +216,12 @@ static void drop_futex_key_refs(union futex_key *key)
+  * lock_page() might sleep, the caller should not hold a spinlock.
+  */
+ static int
+-get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key)
++get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
+ {
+ 	unsigned long address = (unsigned long)uaddr;
+ 	struct mm_struct *mm = current->mm;
+ 	struct page *page;
+-	int err;
++	int err, ro = 0;
+ 
+ 	/*
+ 	 * The futex address must be "naturally" aligned.
+@@ -247,14 +249,31 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key)
+ 
+ again:
+ 	err = get_user_pages_fast(address, 1, 1, &page);
++	/*
++	 * If write access is not required (eg. FUTEX_WAIT), try
++	 * and get read-only access.
++	 */
++	if (err == -EFAULT && rw == VERIFY_READ) {
++		err = get_user_pages_fast(address, 1, 0, &page);
++		ro = 1;
++	}
+ 	if (err < 0)
+ 		return err;
++	else
++		err = 0;
+ 
+ 	page = compound_head(page);
+ 	lock_page(page);
+ 	if (!page->mapping) {
+ 		unlock_page(page);
+ 		put_page(page);
++		/*
++		* ZERO_PAGE pages don't have a mapping. Avoid a busy loop
++		* trying to find one. RW mapping would have COW'd (and thus
++		* have a mapping) so this page is RO and won't ever change.
++		*/
++		if ((page == ZERO_PAGE(address)))
++			return -EFAULT;
+ 		goto again;
+ 	}
+ 
+@@ -266,6 +285,15 @@ again:
+ 	 * the object not the particular process.
+ 	 */
+ 	if (PageAnon(page)) {
++		/*
++		 * A RO anonymous page will never change and thus doesn't make
++		 * sense for futex operations.
++		 */
++		if (ro) {
++			err = -EFAULT;
++			goto out;
++		}
++
+ 		key->both.offset |= FUT_OFF_MMSHARED; /* ref taken on mm */
+ 		key->private.mm = mm;
+ 		key->private.address = address;
+@@ -277,9 +305,10 @@ again:
+ 
+ 	get_futex_key_refs(key);
+ 
++out:
+ 	unlock_page(page);
+ 	put_page(page);
+-	return 0;
++	return err;
+ }
+ 
+ static inline
+@@ -880,7 +909,7 @@ static int futex_wake(u32 __user *uaddr, int fshared, int nr_wake, u32 bitset)
+ 	if (!bitset)
+ 		return -EINVAL;
+ 
+-	ret = get_futex_key(uaddr, fshared, &key);
++	ret = get_futex_key(uaddr, fshared, &key, VERIFY_READ);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+ 
+@@ -926,10 +955,10 @@ futex_wake_op(u32 __user *uaddr1, int fshared, u32 __user *uaddr2,
+ 	int ret, op_ret;
+ 
+ retry:
+-	ret = get_futex_key(uaddr1, fshared, &key1);
++	ret = get_futex_key(uaddr1, fshared, &key1, VERIFY_READ);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+-	ret = get_futex_key(uaddr2, fshared, &key2);
++	ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
+ 	if (unlikely(ret != 0))
+ 		goto out_put_key1;
+ 
+@@ -1188,10 +1217,11 @@ retry:
+ 		pi_state = NULL;
+ 	}
+ 
+-	ret = get_futex_key(uaddr1, fshared, &key1);
++	ret = get_futex_key(uaddr1, fshared, &key1, VERIFY_READ);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+-	ret = get_futex_key(uaddr2, fshared, &key2);
++	ret = get_futex_key(uaddr2, fshared, &key2,
++			    requeue_pi ? VERIFY_WRITE : VERIFY_READ);
+ 	if (unlikely(ret != 0))
+ 		goto out_put_key1;
+ 
+@@ -1746,7 +1776,7 @@ static int futex_wait_setup(u32 __user *uaddr, u32 val, int fshared,
+ 	 */
+ retry:
+ 	q->key = FUTEX_KEY_INIT;
+-	ret = get_futex_key(uaddr, fshared, &q->key);
++	ret = get_futex_key(uaddr, fshared, &q->key, VERIFY_READ);
+ 	if (unlikely(ret != 0))
+ 		return ret;
+ 
+@@ -1912,7 +1942,7 @@ static int futex_lock_pi(u32 __user *uaddr, int fshared,
+ 	q.requeue_pi_key = NULL;
+ retry:
+ 	q.key = FUTEX_KEY_INIT;
+-	ret = get_futex_key(uaddr, fshared, &q.key);
++	ret = get_futex_key(uaddr, fshared, &q.key, VERIFY_WRITE);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+ 
+@@ -2031,7 +2061,7 @@ retry:
+ 	if ((uval & FUTEX_TID_MASK) != task_pid_vnr(current))
+ 		return -EPERM;
+ 
+-	ret = get_futex_key(uaddr, fshared, &key);
++	ret = get_futex_key(uaddr, fshared, &key, VERIFY_WRITE);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+ 
+@@ -2223,7 +2253,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
+ 	rt_waiter.task = NULL;
+ 
+ 	key2 = FUTEX_KEY_INIT;
+-	ret = get_futex_key(uaddr2, fshared, &key2);
++	ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+ 
+-- 
+1.7.9.6
+
diff --git a/queue/hwmon-ibmaem-add-missing-kfree.patch b/queue/hwmon-ibmaem-add-missing-kfree.patch
new file mode 100644
index 0000000..ce02c02
--- /dev/null
+++ b/queue/hwmon-ibmaem-add-missing-kfree.patch
@@ -0,0 +1,58 @@
+From 1bf67abaa86c07c66651df01e7fd8bdc8938b0ff Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Tue, 9 Aug 2011 11:10:56 -0400
+Subject: [PATCH] hwmon: (ibmaem) add missing kfree
+
+commit 66a89b2164e2d30661edbd1953eacf0594d8203a upstream.
+
+rs_resp is dynamically allocated in aem_read_sensor(), so it should be freed
+before exiting in every case.  This collects the kfree and the return at
+the end of the function.
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/hwmon/ibmaem.c |   15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
+index eaee546..fd4dbef 100644
+--- a/drivers/hwmon/ibmaem.c
++++ b/drivers/hwmon/ibmaem.c
+@@ -430,13 +430,15 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg,
+ 	aem_send_message(ipmi);
+ 
+ 	res = wait_for_completion_timeout(&ipmi->read_complete, IPMI_TIMEOUT);
+-	if (!res)
+-		return -ETIMEDOUT;
++	if (!res) {
++		res = -ETIMEDOUT;
++		goto out;
++	}
+ 
+ 	if (ipmi->rx_result || ipmi->rx_msg_len != rs_size ||
+ 	    memcmp(&rs_resp->id, &system_x_id, sizeof(system_x_id))) {
+-		kfree(rs_resp);
+-		return -ENOENT;
++		res = -ENOENT;
++		goto out;
+ 	}
+ 
+ 	switch (size) {
+@@ -461,8 +463,11 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg,
+ 		break;
+ 	}
+ 	}
++	res = 0;
+ 
+-	return 0;
++out:
++	kfree(rs_resp);
++	return res;
+ }
+ 
+ /* Update AEM energy registers */
+-- 
+1.7.9.6
+
diff --git a/queue/igb-Fix-lack-of-flush-after-register-write-and-befor.patch b/queue/igb-Fix-lack-of-flush-after-register-write-and-befor.patch
new file mode 100644
index 0000000..6cac548
--- /dev/null
+++ b/queue/igb-Fix-lack-of-flush-after-register-write-and-befor.patch
@@ -0,0 +1,36 @@
+From e474f3ec6bd090db337d223593cf67f979fd3663 Mon Sep 17 00:00:00 2001
+From: Carolyn Wyborny <carolyn.wyborny@intel.com>
+Date: Sat, 25 Jun 2011 13:18:12 +0000
+Subject: [PATCH] igb: Fix lack of flush after register write and before delay
+
+commit 064b43304ed8ede8e13ff7b4338d09fd37bcffb1 upstream.
+
+Register writes followed by a delay are required to have a flush
+before the delay in order to commit the values to the register.  Without
+the flush, the code following the delay may not function correctly.
+
+Reported-by: Tong Ho <tong.ho@ericsson.com>
+Reported-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com>
+Tested-by:  Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/net/igb/e1000_82575.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
+index 4a32bed..a6ea91d 100644
+--- a/drivers/net/igb/e1000_82575.c
++++ b/drivers/net/igb/e1000_82575.c
+@@ -1554,6 +1554,7 @@ static s32 igb_reset_hw_82580(struct e1000_hw *hw)
+ 		ctrl |= E1000_CTRL_RST;
+ 
+ 	wr32(E1000_CTRL, ctrl);
++	wrfl();
+ 
+ 	/* Add delay to insure DEV_RST has time to complete */
+ 	if (global_device_reset)
+-- 
+1.7.9.6
+
diff --git a/queue/mm-fix-wrong-vmap-address-calculations-with-odd-NR_C.patch b/queue/mm-fix-wrong-vmap-address-calculations-with-odd-NR_C.patch
new file mode 100644
index 0000000..65eb18c
--- /dev/null
+++ b/queue/mm-fix-wrong-vmap-address-calculations-with-odd-NR_C.patch
@@ -0,0 +1,56 @@
+From 08d8447ae2bccf522295c2b3160a0adaba5dcdda Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Tue, 21 Jun 2011 22:09:50 +0200
+Subject: [PATCH] mm: fix wrong vmap address calculations with odd NR_CPUS
+ values
+
+commit f982f91516fa4cfd9d20518833cd04ad714585be upstream.
+
+Commit db64fe02258f ("mm: rewrite vmap layer") introduced code that does
+address calculations under the assumption that VMAP_BLOCK_SIZE is a
+power of two.  However, this might not be true if CONFIG_NR_CPUS is not
+set to a power of two.
+
+Wrong vmap_block index/offset values could lead to memory corruption.
+However, this has never been observed in practice (or never been
+diagnosed correctly); what caught this was the BUG_ON in vb_alloc() that
+checks for inconsistent vmap_block indices.
+
+To fix this, ensure that VMAP_BLOCK_SIZE always is a power of two.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=31572
+Reported-by: Pavel Kysilka <goldenfish@linuxsoft.cz>
+Reported-by: Matias A. Fonzo <selk@dragora.org>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Cc: Nick Piggin <npiggin@suse.de>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ mm/vmalloc.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 20a402c..d44abdd 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -671,9 +671,10 @@ static void free_unmap_vmap_area_addr(unsigned long addr)
+ #define VMAP_BBMAP_BITS_MIN	(VMAP_MAX_ALLOC*2)
+ #define VMAP_MIN(x, y)		((x) < (y) ? (x) : (y)) /* can't use min() */
+ #define VMAP_MAX(x, y)		((x) > (y) ? (x) : (y)) /* can't use max() */
+-#define VMAP_BBMAP_BITS		VMAP_MIN(VMAP_BBMAP_BITS_MAX,		\
+-					VMAP_MAX(VMAP_BBMAP_BITS_MIN,	\
+-						VMALLOC_PAGES / NR_CPUS / 16))
++#define VMAP_BBMAP_BITS		\
++		VMAP_MIN(VMAP_BBMAP_BITS_MAX,	\
++		VMAP_MAX(VMAP_BBMAP_BITS_MIN,	\
++			VMALLOC_PAGES / roundup_pow_of_two(NR_CPUS) / 16))
+ 
+ #define VMAP_BLOCK_SIZE		(VMAP_BBMAP_BITS * PAGE_SIZE)
+ 
+-- 
+1.7.9.6
+
diff --git a/queue/perf-tools-do-not-look-at-.-config-for-configuration.patch b/queue/perf-tools-do-not-look-at-.-config-for-configuration.patch
new file mode 100644
index 0000000..0c71000
--- /dev/null
+++ b/queue/perf-tools-do-not-look-at-.-config-for-configuration.patch
@@ -0,0 +1,62 @@
+From 81b8889ab61b29213aa999e1f60146f3ba79a72d Mon Sep 17 00:00:00 2001
+From: Jonathan Nieder <jrnieder@gmail.com>
+Date: Fri, 5 Aug 2011 18:58:38 +0200
+Subject: [PATCH] perf tools: do not look at ./config for configuration
+
+commit aba8d056078e47350d85b06a9cabd5afcc4b72ea upstream.
+
+In addition to /etc/perfconfig and $HOME/.perfconfig, perf looks for
+configuration in the file ./config, imitating git which looks at
+$GIT_DIR/config.  If ./config is not a perf configuration file, it
+fails, or worse, treats it as a configuration file and changes behavior
+in some unexpected way.
+
+"config" is not an unusual name for a file to be lying around and perf
+does not have a private directory dedicated for its own use, so let's
+just stop looking for configuration in the cwd.  Callers needing
+context-sensitive configuration can use the PERF_CONFIG environment
+variable.
+
+Requested-by: Christian Ohm <chr.ohm@gmx.net>
+Cc: 632923@bugs.debian.org
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Cc: Christian Ohm <chr.ohm@gmx.net>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/r/20110805165838.GA7237@elie.gateway.2wire.net
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ tools/perf/util/config.c |    7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
+index 8784649..1720d01 100644
+--- a/tools/perf/util/config.c
++++ b/tools/perf/util/config.c
+@@ -416,7 +416,6 @@ int perf_config_global(void)
+ int perf_config(config_fn_t fn, void *data)
+ {
+ 	int ret = 0, found = 0;
+-	char *repo_config = NULL;
+ 	const char *home = NULL;
+ 
+ 	/* Setting $PERF_CONFIG makes perf read _only_ the given config file. */
+@@ -438,12 +437,6 @@ int perf_config(config_fn_t fn, void *data)
+ 		free(user_config);
+ 	}
+ 
+-	repo_config = perf_pathdup("config");
+-	if (!access(repo_config, R_OK)) {
+-		ret += perf_config_from_file(fn, repo_config, data);
+-		found += 1;
+-	}
+-	free(repo_config);
+ 	if (found == 0)
+ 		return -1;
+ 	return ret;
+-- 
+1.7.9.6
+
diff --git a/queue/series b/queue/series
index 7c25474..f15a191 100644
--- a/queue/series
+++ b/queue/series
@@ -153,3 +153,20 @@ ALSA-timer-Fix-Oops-at-closing-slave-timer.patch
 ALSA-snd-usb-caiaq-Fix-keymap-for-RigKontrol3.patch
 powerpc-Fix-device-tree-claim-code.patch
 powerpc-pseries-Fix-kexec-on-machines-with-more-than.patch
+USB-xhci-fix-OS-want-to-own-HC.patch
+USB-assign-instead-of-equal-in-usbtmc.c.patch
+USB-usb-storage-unusual_devs-entry-for-ARM-V2M-mothe.patch
+USB-Serial-Added-device-ID-for-Qualcomm-Modem-in-Sag.patch
+atm-br2864-sent-packets-truncated-in-VC-routed-mode.patch
+hwmon-ibmaem-add-missing-kfree.patch
+ALSA-snd-usb-caiaq-Correct-offset-fields-of-outbound.patch
+mm-fix-wrong-vmap-address-calculations-with-odd-NR_C.patch
+perf-tools-do-not-look-at-.-config-for-configuration.patch
+ALSA-snd_usb_caiaq-track-submitted-output-urbs.patch
+ALSA-ac97-Add-HP-Compaq-dc5100-SFF-PT003AW-to-Headph.patch
+futex-Fix-regression-with-read-only-mappings.patch
+x86-32-vdso-On-system-call-restart-after-SYSENTER-us.patch
+x86-UV-Remove-UV-delay-in-starting-slave-cpus.patch
+drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch
+fuse-check-size-of-FUSE_NOTIFY_INVAL_ENTRY-message.patch
+igb-Fix-lack-of-flush-after-register-write-and-befor.patch
diff --git a/queue/x86-32-vdso-On-system-call-restart-after-SYSENTER-us.patch b/queue/x86-32-vdso-On-system-call-restart-after-SYSENTER-us.patch
new file mode 100644
index 0000000..54903c4
--- /dev/null
+++ b/queue/x86-32-vdso-On-system-call-restart-after-SYSENTER-us.patch
@@ -0,0 +1,42 @@
+From 68e8f5f0f6ed014cb1ef98d1cbcfa17c38b70ee9 Mon Sep 17 00:00:00 2001
+From: "H. Peter Anvin" <hpa@linux.intel.com>
+Date: Mon, 22 Aug 2011 13:27:06 -0700
+Subject: [PATCH] x86-32, vdso: On system call restart after SYSENTER, use int
+ $0x80
+
+commit 7ca0758cdb7c241cb4e0490a8d95f0eb5b861daf upstream.
+
+When we enter a 32-bit system call via SYSENTER or SYSCALL, we shuffle
+the arguments to match the int $0x80 calling convention.  This was
+probably a design mistake, but it's what it is now.  This causes
+errors if the system call as to be restarted.
+
+For SYSENTER, we have to invoke the instruction from the vdso as the
+return address is hardcoded.  Accordingly, we can simply replace the
+jump in the vdso with an int $0x80 instruction and use the slower
+entry point for a post-restart.
+
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Link: http://lkml.kernel.org/r/CA%2B55aFztZ=r5wa0x26KJQxvZOaQq8s2v3u50wCyJcA-Sc4g8gQ@mail.gmail.com
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/vdso/vdso32/sysenter.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/vdso/vdso32/sysenter.S b/arch/x86/vdso/vdso32/sysenter.S
+index e2800af..e354bce 100644
+--- a/arch/x86/vdso/vdso32/sysenter.S
++++ b/arch/x86/vdso/vdso32/sysenter.S
+@@ -43,7 +43,7 @@ __kernel_vsyscall:
+ 	.space 7,0x90
+ 
+ 	/* 14: System call restart point is here! (SYSENTER_RETURN-2) */
+-	jmp .Lenter_kernel
++	int $0x80
+ 	/* 16: System call normal return point is here! */
+ VDSO32_SYSENTER_RETURN:	/* Symbol used by sysenter.c via vdso32-syms.h */
+ 	pop %ebp
+-- 
+1.7.9.6
+
diff --git a/queue/x86-UV-Remove-UV-delay-in-starting-slave-cpus.patch b/queue/x86-UV-Remove-UV-delay-in-starting-slave-cpus.patch
new file mode 100644
index 0000000..df9bdb8
--- /dev/null
+++ b/queue/x86-UV-Remove-UV-delay-in-starting-slave-cpus.patch
@@ -0,0 +1,36 @@
+From acc87de86bcba0b30abff96064d7a3044d1f2d50 Mon Sep 17 00:00:00 2001
+From: Jack Steiner <steiner@sgi.com>
+Date: Fri, 5 Aug 2011 09:09:00 -0500
+Subject: [PATCH] x86, UV: Remove UV delay in starting slave cpus
+
+commit 05e33fc20ea5e493a2a1e7f1d04f43cdf89f83ed upstream.
+
+Delete the 10 msec delay between the INIT and SIPI when starting
+slave cpus. I can find no requirement for this delay. BIOS also
+has similar code sequences without the delay.
+
+Removing the delay reduces boot time by 40 sec. Every bit helps.
+
+Signed-off-by: Jack Steiner <steiner@sgi.com>
+Link: http://lkml.kernel.org/r/20110805140900.GA6774@sgi.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
+index 25a1b3c..2872559 100644
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -144,7 +144,6 @@ static int __cpuinit uv_wakeup_secondary(int phys_apicid, unsigned long start_ri
+ 	    ((start_rip << UVH_IPI_INT_VECTOR_SHFT) >> 12) |
+ 	    APIC_DM_INIT;
+ 	uv_write_global_mmr64(pnode, UVH_IPI_INT, val);
+-	mdelay(10);
+ 
+ 	val = (1UL << UVH_IPI_INT_SEND_SHFT) |
+ 	    (phys_apicid << UVH_IPI_INT_APIC_ID_SHFT) |
+-- 
+1.7.9.6
+