32.50: import parallel commits made from that release

Pull in the upstream commits made to the 2.6.32.50 release.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

25 files changed, 1348 insertions, 0 deletions

diff --git a/queue/ALSA-lx6464es-fix-device-communication-via-command-b.patch b/queue/ALSA-lx6464es-fix-device-communication-via-command-b.patch
new file mode 100644
index 0000000..230f74d
--- /dev/null
+++ b/queue/ALSA-lx6464es-fix-device-communication-via-command-b.patch
@@ -0,0 +1,61 @@
+From 3525723df5573aa62f702546b035b64cf8a468de Mon Sep 17 00:00:00 2001
+From: Tim Blechmann <tim@klingt.org>
+Date: Tue, 22 Nov 2011 11:15:45 +0100
+Subject: [PATCH 05/24] ALSA: lx6464es - fix device communication via command
+ bus
+
+commit a29878553a9a7b4c06f93c7e383527cf014d4ceb upstream.
+
+commit 6175ddf06b6172046a329e3abfd9c901a43efd2e optimized the mem*io
+functions that have been used to send commands to the device. these
+optimizations somehow corrupted the communication with the lx6464es,
+that resulted the device to be unusable with kernels after 2.6.33.
+
+this patch emulates the memcpy_*_io functions via a loop to avoid these
+problems.
+
+Signed-off-by: Tim Blechmann <tim@klingt.org>
+LKML-Reference: <4ECB5257.4040600@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ sound/pci/lx6464es/lx_core.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index 3086b75..2313a51 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -80,8 +80,12 @@ unsigned long lx_dsp_reg_read(struct lx6464es *chip, int port)
+ 
+ void lx_dsp_reg_readbuf(struct lx6464es *chip, int port, u32 *data, u32 len)
+ {
+-	void __iomem *address = lx_dsp_register(chip, port);
+-	memcpy_fromio(data, address, len*sizeof(u32));
++	u32 __iomem *address = lx_dsp_register(chip, port);
++	int i;
++
++	/* we cannot use memcpy_fromio */
++	for (i = 0; i != len; ++i)
++		data[i] = ioread32(address + i);
+ }
+ 
+ 
+@@ -94,8 +98,12 @@ void lx_dsp_reg_write(struct lx6464es *chip, int port, unsigned data)
+ void lx_dsp_reg_writebuf(struct lx6464es *chip, int port, const u32 *data,
+ 			 u32 len)
+ {
+-	void __iomem *address = lx_dsp_register(chip, port);
+-	memcpy_toio(address, data, len*sizeof(u32));
++	u32 __iomem *address = lx_dsp_register(chip, port);
++	int i;
++
++	/* we cannot use memcpy_to */
++	for (i = 0; i != len; ++i)
++		iowrite32(data[i], address + i);
+ }
+ 
+ 
+-- 
+1.7.12.1
+
diff --git a/queue/ARM-7161-1-errata-no-automatic-store-buffer-drain.patch b/queue/ARM-7161-1-errata-no-automatic-store-buffer-drain.patch
new file mode 100644
index 0000000..88450ec
--- /dev/null
+++ b/queue/ARM-7161-1-errata-no-automatic-store-buffer-drain.patch
@@ -0,0 +1,66 @@
+From 8b7f1ae81694f49543af37be9f7c94272f4325ed Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Mon, 14 Nov 2011 17:24:58 +0100
+Subject: [PATCH 04/24] ARM: 7161/1: errata: no automatic store buffer drain
+
+commit 11ed0ba1754841316d4095478944300acf19acc3 upstream.
+
+This patch implements a workaround for PL310 erratum 769419. On
+revisions of the PL310 prior to r3p2, the Store Buffer does not
+automatically drain. This can cause normal, non-cacheable writes to be
+retained when the memory system is idle, leading to suboptimal I/O
+performance for drivers using coherent DMA.
+
+This patch adds an optional wmb() call to the cpu_idle loop. On systems
+with an outer cache, this causes an explicit flush of the store buffer.
+
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Tested-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/arm/Kconfig          | 12 ++++++++++++
+ arch/arm/kernel/process.c |  3 +++
+ 2 files changed, 15 insertions(+)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 811dedc..3ee6a06 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1380,6 +1380,18 @@ config UACCESS_WITH_MEMCPY
+ 	  However, if the CPU data cache is using a write-allocate mode,
+ 	  this option is unlikely to provide any performance gain.
+ 
++config PL310_ERRATA_769419
++	bool "PL310 errata: no automatic Store Buffer drain"
++	depends on CACHE_L2X0
++	help
++	  On revisions of the PL310 prior to r3p2, the Store Buffer does
++	  not automatically drain. This can cause normal, non-cacheable
++	  writes to be retained when the memory system is idle, leading
++	  to suboptimal I/O performance for drivers using coherent DMA.
++	  This option adds a write barrier to the cpu_idle loop so that,
++	  on systems with an outer cache, the store buffer is drained
++	  explicitly.
++
+ endmenu
+ 
+ menu "Boot options"
+diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
+index acf5e6f..7f170f4 100644
+--- a/arch/arm/kernel/process.c
++++ b/arch/arm/kernel/process.c
+@@ -155,6 +155,9 @@ void cpu_idle(void)
+ #endif
+ 
+ 			local_irq_disable();
++#ifdef CONFIG_PL310_ERRATA_769419
++			wmb();
++#endif
+ 			if (hlt_counter) {
+ 				local_irq_enable();
+ 				cpu_relax();
+-- 
+1.7.12.1
+
diff --git a/queue/PCI-hotplug-shpchp-don-t-blindly-claim-non-AMD-0x745.patch b/queue/PCI-hotplug-shpchp-don-t-blindly-claim-non-AMD-0x745.patch
new file mode 100644
index 0000000..63b9372
--- /dev/null
+++ b/queue/PCI-hotplug-shpchp-don-t-blindly-claim-non-AMD-0x745.patch
@@ -0,0 +1,59 @@
+From 7b07cdea7995a429206bf9dda711eaafaf890028 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Tue, 23 Aug 2011 10:16:43 -0600
+Subject: [PATCH 03/24] PCI hotplug: shpchp: don't blindly claim non-AMD
+ 0x7450 device IDs
+
+commit 4cac2eb158c6da0c761689345c6cc5df788a6292 upstream.
+
+Previously we claimed device ID 0x7450, regardless of the vendor, which is
+clearly wrong.  Now we'll claim that device ID only for AMD.
+
+I suspect this was just a typo in the original code, but it's possible this
+change will break shpchp on non-7450 AMD bridges.  If so, we'll have to fix
+them as we find them.
+
+Reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=638863
+Reported-by: Ralf Jung <ralfjung-e@gmx.de>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/pci/hotplug/shpchp_core.c | 4 ++--
+ drivers/pci/hotplug/shpchp_hpc.c  | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
+index a7bd504..2ee01b6 100644
+--- a/drivers/pci/hotplug/shpchp_core.c
++++ b/drivers/pci/hotplug/shpchp_core.c
+@@ -278,8 +278,8 @@ static int get_adapter_status (struct hotplug_slot *hotplug_slot, u8 *value)
+ 
+ static int is_shpc_capable(struct pci_dev *dev)
+ {
+-	if ((dev->vendor == PCI_VENDOR_ID_AMD) || (dev->device ==
+-						PCI_DEVICE_ID_AMD_GOLAM_7450))
++	if (dev->vendor == PCI_VENDOR_ID_AMD &&
++	    dev->device == PCI_DEVICE_ID_AMD_GOLAM_7450)
+ 		return 1;
+ 	if (!pci_find_capability(dev, PCI_CAP_ID_SHPC))
+ 		return 0;
+diff --git a/drivers/pci/hotplug/shpchp_hpc.c b/drivers/pci/hotplug/shpchp_hpc.c
+index 5f5e8d2..f13e724 100644
+--- a/drivers/pci/hotplug/shpchp_hpc.c
++++ b/drivers/pci/hotplug/shpchp_hpc.c
+@@ -953,8 +953,8 @@ int shpc_init(struct controller *ctrl, struct pci_dev *pdev)
+ 	ctrl->pci_dev = pdev;  /* pci_dev of the P2P bridge */
+ 	ctrl_dbg(ctrl, "Hotplug Controller:\n");
+ 
+-	if ((pdev->vendor == PCI_VENDOR_ID_AMD) || (pdev->device ==
+-				PCI_DEVICE_ID_AMD_GOLAM_7450)) {
++	if (pdev->vendor == PCI_VENDOR_ID_AMD &&
++	    pdev->device == PCI_DEVICE_ID_AMD_GOLAM_7450) {
+ 		/* amd shpc driver doesn't use Base Offset; assume 0 */
+ 		ctrl->mmio_base = pci_resource_start(pdev, 0);
+ 		ctrl->mmio_size = pci_resource_len(pdev, 0);
+-- 
+1.7.12.1
+
diff --git a/queue/SUNRPC-Ensure-we-return-EAGAIN-in-xs_nospace-if-cong.patch b/queue/SUNRPC-Ensure-we-return-EAGAIN-in-xs_nospace-if-cong.patch
new file mode 100644
index 0000000..c166b06
--- /dev/null
+++ b/queue/SUNRPC-Ensure-we-return-EAGAIN-in-xs_nospace-if-cong.patch
@@ -0,0 +1,49 @@
+From f60490718c60b0252e018bb088270d728eaace85 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Tue, 22 Nov 2011 14:44:28 +0200
+Subject: [PATCH 06/24] SUNRPC: Ensure we return EAGAIN in xs_nospace if
+ congestion is cleared
+
+commit 24ca9a847791fd53d9b217330b15f3c285827a18 upstream.
+
+By returning '0' instead of 'EAGAIN' when the tests in xs_nospace() fail
+to find evidence of socket congestion, we are making the RPC engine believe
+that the message was incorrectly sent and so it disconnects the socket
+instead of just retrying.
+
+The bug appears to have been introduced by commit
+5e3771ce2d6a69e10fcc870cdf226d121d868491 (SUNRPC: Ensure that xs_nospace
+return values are propagated).
+
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ net/sunrpc/xprtsock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index b502700..fc5b9f3 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -478,7 +478,7 @@ static int xs_nospace(struct rpc_task *task)
+ 	struct rpc_rqst *req = task->tk_rqstp;
+ 	struct rpc_xprt *xprt = req->rq_xprt;
+ 	struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+-	int ret = 0;
++	int ret = -EAGAIN;
+ 
+ 	dprintk("RPC: %5u xmit incomplete (%u left of %u)\n",
+ 			task->tk_pid, req->rq_slen - req->rq_bytes_sent,
+@@ -490,7 +490,6 @@ static int xs_nospace(struct rpc_task *task)
+ 	/* Don't race with disconnect */
+ 	if (xprt_connected(xprt)) {
+ 		if (test_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags)) {
+-			ret = -EAGAIN;
+ 			/*
+ 			 * Notify TCP that we're limited by the application
+ 			 * window size
+-- 
+1.7.12.1
+
diff --git a/queue/Silencing-killing-requests-for-dead-queue.patch b/queue/Silencing-killing-requests-for-dead-queue.patch
new file mode 100644
index 0000000..9cb59f6
--- /dev/null
+++ b/queue/Silencing-killing-requests-for-dead-queue.patch
@@ -0,0 +1,46 @@
+From 1a8cbf2ffb7e6f2cfcc1e4de0567773314a7f27f Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Wed, 9 Nov 2011 08:39:24 +0100
+Subject: [PATCH 18/24] Silencing 'killing requests for dead queue'
+
+commit 745718132c3c7cac98a622b610e239dcd5217f71 upstream.
+
+When we tear down a device we try to flush all outstanding
+commands in scsi_free_queue(). However the check in
+scsi_request_fn() is imperfect as it only signals that
+we _might start_ aborting commands, not that we've actually
+aborted some.
+So move the printk inside the scsi_kill_request function,
+this will also give us a hint about which commands are aborted.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/scsi/scsi_lib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 9f240f4..ca8666b 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1383,6 +1383,8 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
+ 		BUG();
+ 	}
+ 
++	scmd_printk(KERN_INFO, cmd, "killing request\n");
++
+ 	sdev = cmd->device;
+ 	starget = scsi_target(sdev);
+ 	shost = sdev->host;
+@@ -1469,7 +1471,6 @@ static void scsi_request_fn(struct request_queue *q)
+ 	struct request *req;
+ 
+ 	if (!sdev) {
+-		printk("scsi: killing requests for dead queue\n");
+ 		while ((req = blk_peek_request(q)) != NULL)
+ 			scsi_kill_request(req, q);
+ 		return;
+-- 
+1.7.12.1
+
diff --git a/queue/Staging-comedi-fix-signal-handling-in-read-and-write.patch b/queue/Staging-comedi-fix-signal-handling-in-read-and-write.patch
new file mode 100644
index 0000000..f9ac7e0
--- /dev/null
+++ b/queue/Staging-comedi-fix-signal-handling-in-read-and-write.patch
@@ -0,0 +1,51 @@
+From 15ae44b83e09f5200d30d3a7a3cb595824438fb5 Mon Sep 17 00:00:00 2001
+From: Federico Vaga <federico.vaga@gmail.com>
+Date: Sat, 29 Oct 2011 09:47:39 +0200
+Subject: [PATCH 13/24] Staging: comedi: fix signal handling in read and write
+
+commit 6a9ce6b654e491981f6ef7e214cbd4f63e033848 upstream.
+
+After sleeping on a wait queue, signal_pending(current) should be
+checked (not before sleeping).
+
+Acked-by: Alessandro Rubini <rubini@gnudd.com>
+Signed-off-by: Federico Vaga <federico.vaga@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/staging/comedi/comedi_fops.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 48ac52b..f6a0e76 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1594,11 +1594,11 @@ static ssize_t comedi_write(struct file *file, const char *buf, size_t nbytes,
+ 				retval = -EAGAIN;
+ 				break;
+ 			}
++			schedule();
+ 			if (signal_pending(current)) {
+ 				retval = -ERESTARTSYS;
+ 				break;
+ 			}
+-			schedule();
+ 			if (!s->busy)
+ 				break;
+ 			if (s->busy != file) {
+@@ -1701,11 +1701,11 @@ static ssize_t comedi_read(struct file *file, char *buf, size_t nbytes,
+ 				retval = -EAGAIN;
+ 				break;
+ 			}
++			schedule();
+ 			if (signal_pending(current)) {
+ 				retval = -ERESTARTSYS;
+ 				break;
+ 			}
+-			schedule();
+ 			if (!s->busy) {
+ 				retval = 0;
+ 				break;
+-- 
+1.7.12.1
+
diff --git a/queue/USB-usb-storage-unusual_devs-entry-for-Kingston-DT-1.patch b/queue/USB-usb-storage-unusual_devs-entry-for-Kingston-DT-1.patch
new file mode 100644
index 0000000..d8c47ff
--- /dev/null
+++ b/queue/USB-usb-storage-unusual_devs-entry-for-Kingston-DT-1.patch
@@ -0,0 +1,39 @@
+From 2bede73cbf2528b7ee221dd68467e370a5b417a4 Mon Sep 17 00:00:00 2001
+From: Qinglin Ye <yestyle@gmail.com>
+Date: Wed, 23 Nov 2011 23:39:32 +0800
+Subject: [PATCH 17/24] USB: usb-storage: unusual_devs entry for Kingston DT
+ 101 G2
+
+commit cec28a5428793b6bc64e56687fb239759d6da74e upstream.
+
+Kingston DT 101 G2 replies a wrong tag while transporting, add an
+unusal_devs entry to ignore the tag validation.
+
+Signed-off-by: Qinglin Ye <yestyle@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index ee5a8ba..0d6295e 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1852,6 +1852,13 @@ UNUSUAL_DEV(  0x1370, 0x6828, 0x0110, 0x0110,
+ 		US_SC_DEVICE, US_PR_DEVICE, NULL,
+ 		US_FL_IGNORE_RESIDUE ),
+ 
++/* Reported by Qinglin Ye <yestyle@gmail.com> */
++UNUSUAL_DEV(  0x13fe, 0x3600, 0x0100, 0x0100,
++		"Kingston",
++		"DT 101 G2",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_BULK_IGNORE_TAG ),
++
+ /* Reported by Francesco Foresti <frafore@tiscali.it> */
+ UNUSUAL_DEV(  0x14cd, 0x6600, 0x0201, 0x0201,
+ 		"Super Top",
+-- 
+1.7.12.1
+
diff --git a/queue/USB-whci-hcd-fix-endian-conversion-in-qset_clear.patch b/queue/USB-whci-hcd-fix-endian-conversion-in-qset_clear.patch
new file mode 100644
index 0000000..20db9e1
--- /dev/null
+++ b/queue/USB-whci-hcd-fix-endian-conversion-in-qset_clear.patch
@@ -0,0 +1,33 @@
+From 08273749a389e3f611ee680b32a082f9a2336f6d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 22 Nov 2011 10:28:31 +0300
+Subject: [PATCH 14/24] USB: whci-hcd: fix endian conversion in qset_clear()
+
+commit 8746c83d538cab273d335acb2be226d096f4a5af upstream.
+
+qset->qh.link is an __le64 field and we should be using cpu_to_le64()
+to fill it.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/host/whci/qset.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
+index b388dd1..c0f48e4 100644
+--- a/drivers/usb/host/whci/qset.c
++++ b/drivers/usb/host/whci/qset.c
+@@ -124,7 +124,7 @@ void qset_clear(struct whc *whc, struct whc_qset *qset)
+ {
+ 	qset->td_start = qset->td_end = qset->ntds = 0;
+ 
+-	qset->qh.link = cpu_to_le32(QH_LINK_NTDS(8) | QH_LINK_T);
++	qset->qh.link = cpu_to_le64(QH_LINK_NTDS(8) | QH_LINK_T);
+ 	qset->qh.status = qset->qh.status & QH_STATUS_SEQ_MASK;
+ 	qset->qh.err_count = 0;
+ 	qset->qh.scratch[0] = 0;
+-- 
+1.7.12.1
+
diff --git a/queue/clockevents-Set-noop-handler-in-clockevents_exchange.patch b/queue/clockevents-Set-noop-handler-in-clockevents_exchange.patch
new file mode 100644
index 0000000..bff91f3
--- /dev/null
+++ b/queue/clockevents-Set-noop-handler-in-clockevents_exchange.patch
@@ -0,0 +1,34 @@
+From 21e81c72d4918e25010b46086e2b5e9adb72a1a7 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Fri, 2 Dec 2011 16:02:45 +0100
+Subject: [PATCH 24/24] clockevents: Set noop handler in
+ clockevents_exchange_device()
+
+commit de28f25e8244c7353abed8de0c7792f5f883588c upstream.
+
+If a device is shutdown, then there might be a pending interrupt,
+which will be processed after we reenable interrupts, which causes the
+original handler to be run. If the old handler is the (broadcast)
+periodic handler the shutdown state might hang the kernel completely.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ kernel/time/clockevents.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
+index d7395fd..8198b5b 100644
+--- a/kernel/time/clockevents.c
++++ b/kernel/time/clockevents.c
+@@ -220,6 +220,7 @@ void clockevents_exchange_device(struct clock_event_device *old,
+ 	 * released list and do a notify add later.
+ 	 */
+ 	if (old) {
++		old->event_handler = clockevents_handle_noop;
+ 		clockevents_set_mode(old, CLOCK_EVT_MODE_UNUSED);
+ 		list_del(&old->list);
+ 		list_add(&old->list, &clockevents_released);
+-- 
+1.7.12.1
+
diff --git a/queue/eCryptfs-Extend-array-bounds-for-all-filename-chars.patch b/queue/eCryptfs-Extend-array-bounds-for-all-filename-chars.patch
new file mode 100644
index 0000000..2844cde
--- /dev/null
+++ b/queue/eCryptfs-Extend-array-bounds-for-all-filename-chars.patch
@@ -0,0 +1,58 @@
+From 4f344a7e2fa27791de395dea8099ecd1758c5c09 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@canonical.com>
+Date: Wed, 23 Nov 2011 11:31:24 -0600
+Subject: [PATCH 02/24] eCryptfs: Extend array bounds for all filename chars
+
+commit 0f751e641a71157aa584c2a2e22fda52b52b8a56 upstream.
+
+From mhalcrow's original commit message:
+
+    Characters with ASCII values greater than the size of
+    filename_rev_map[] are valid filename characters.
+    ecryptfs_decode_from_filename() will access kernel memory beyond
+    that array, and ecryptfs_parse_tag_70_packet() will then decrypt
+    those characters. The attacker, using the FNEK of the crafted file,
+    can then re-encrypt the characters to reveal the kernel memory past
+    the end of the filename_rev_map[] array. I expect low security
+    impact since this array is statically allocated in the text area,
+    and the amount of memory past the array that is accessible is
+    limited by the largest possible ASCII filename character.
+
+This patch solves the issue reported by mhalcrow but with an
+implementation suggested by Linus to simply extend the length of
+filename_rev_map[] to 256. Characters greater than 0x7A are mapped to
+0x00, which is how invalid characters less than 0x7A were previously
+being handled.
+
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Reported-by: Michael Halcrow <mhalcrow@google.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ fs/ecryptfs/crypto.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 1cc0876..45dc658 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -1934,7 +1934,7 @@ static unsigned char *portable_filename_chars = ("-.0123456789ABCD"
+ 
+ /* We could either offset on every reverse map or just pad some 0x00's
+  * at the front here */
+-static const unsigned char filename_rev_map[] = {
++static const unsigned char filename_rev_map[256] = {
+ 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 7 */
+ 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 15 */
+ 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 23 */
+@@ -1950,7 +1950,7 @@ static const unsigned char filename_rev_map[] = {
+ 	0x00, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, /* 103 */
+ 	0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, /* 111 */
+ 	0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, /* 119 */
+-	0x3D, 0x3E, 0x3F
++	0x3D, 0x3E, 0x3F /* 123 - 255 initialized to 0x00 */
+ };
+ 
+ /**
+-- 
+1.7.12.1
+
diff --git a/queue/genirq-Fix-race-condition-when-stopping-the-irq-thre.patch b/queue/genirq-Fix-race-condition-when-stopping-the-irq-thre.patch
new file mode 100644
index 0000000..aea0460
--- /dev/null
+++ b/queue/genirq-Fix-race-condition-when-stopping-the-irq-thre.patch
@@ -0,0 +1,71 @@
+From e44f5886438c05bdb6c793623a40bbbedb9251aa Mon Sep 17 00:00:00 2001
+From: Ido Yariv <ido@wizery.com>
+Date: Thu, 1 Dec 2011 13:55:08 +0200
+Subject: [PATCH 22/24] genirq: Fix race condition when stopping the irq
+ thread
+
+commit 550acb19269d65f32e9ac4ddb26c2b2070e37f1c upstream.
+
+In irq_wait_for_interrupt(), the should_stop member is verified before
+setting the task's state to TASK_INTERRUPTIBLE and calling schedule().
+In case kthread_stop sets should_stop and wakes up the process after
+should_stop is checked by the irq thread but before the task's state
+is changed, the irq thread might never exit:
+
+kthread_stop                    irq_wait_for_interrupt
+------------                    ----------------------
+
+                                 ...
+...                              while (!kthread_should_stop()) {
+kthread->should_stop = 1;
+wake_up_process(k);
+wait_for_completion(&kthread->exited);
+...
+                                     set_current_state(TASK_INTERRUPTIBLE);
+
+                                     ...
+
+                                     schedule();
+                                 }
+
+Fix this by checking if the thread should stop after modifying the
+task's state.
+
+[ tglx: Simplified it a bit ]
+
+Signed-off-by: Ido Yariv <ido@wizery.com>
+Link: http://lkml.kernel.org/r/1322740508-22640-1-git-send-email-ido@wizery.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ kernel/irq/manage.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 9080985..8668523 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -479,8 +479,9 @@ static irqreturn_t irq_nested_primary_handler(int irq, void *dev_id)
+ 
+ static int irq_wait_for_interrupt(struct irqaction *action)
+ {
++	set_current_state(TASK_INTERRUPTIBLE);
++
+ 	while (!kthread_should_stop()) {
+-		set_current_state(TASK_INTERRUPTIBLE);
+ 
+ 		if (test_and_clear_bit(IRQTF_RUNTHREAD,
+ 				       &action->thread_flags)) {
+@@ -488,7 +489,9 @@ static int irq_wait_for_interrupt(struct irqaction *action)
+ 			return 0;
+ 		}
+ 		schedule();
++		set_current_state(TASK_INTERRUPTIBLE);
+ 	}
++	__set_current_state(TASK_RUNNING);
+ 	return -1;
+ }
+ 
+-- 
+1.7.12.1
+
diff --git a/queue/i2c-algo-bit-Generate-correct-i2c-address-sequence-f.patch b/queue/i2c-algo-bit-Generate-correct-i2c-address-sequence-f.patch
new file mode 100644
index 0000000..29dd4ad
--- /dev/null
+++ b/queue/i2c-algo-bit-Generate-correct-i2c-address-sequence-f.patch
@@ -0,0 +1,44 @@
+From e435149c5294eb56b2a527473e1e071627b166eb Mon Sep 17 00:00:00 2001
+From: "Jeffrey (Sheng-Hui) Chu" <jeffchu@broadcom.com>
+Date: Wed, 23 Nov 2011 11:33:07 +0100
+Subject: [PATCH 01/24] i2c-algo-bit: Generate correct i2c address sequence
+ for 10-bit target
+
+commit cc6bcf7d2ec2234e7b41770185e4dc826390185e upstream.
+
+The wrong bits were put on the wire, fix that.
+
+This fixes kernel bug #42562.
+
+Signed-off-by: Sheng-Hui J. Chu <jeffchu@broadcom.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/i2c/algos/i2c-algo-bit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
+index a39e6cf..4e1a332 100644
+--- a/drivers/i2c/algos/i2c-algo-bit.c
++++ b/drivers/i2c/algos/i2c-algo-bit.c
+@@ -470,7 +470,7 @@ static int bit_doAddress(struct i2c_adapter *i2c_adap, struct i2c_msg *msg)
+ 
+ 	if (flags & I2C_M_TEN) {
+ 		/* a ten bit address */
+-		addr = 0xf0 | ((msg->addr >> 7) & 0x03);
++		addr = 0xf0 | ((msg->addr >> 7) & 0x06);
+ 		bit_dbg(2, &i2c_adap->dev, "addr0: %d\n", addr);
+ 		/* try extended address code...*/
+ 		ret = try_address(i2c_adap, addr, retries);
+@@ -480,7 +480,7 @@ static int bit_doAddress(struct i2c_adapter *i2c_adap, struct i2c_msg *msg)
+ 			return -EREMOTEIO;
+ 		}
+ 		/* the remaining 8 bit address */
+-		ret = i2c_outb(i2c_adap, msg->addr & 0x7f);
++		ret = i2c_outb(i2c_adap, msg->addr & 0xff);
+ 		if ((ret != 1) && !nak_ok) {
+ 			/* the chip did not ack / xmission error occurred */
+ 			dev_err(&i2c_adap->dev, "died at 2nd address code\n");
+-- 
+1.7.12.1
+
diff --git a/queue/nl80211-fix-MAC-address-validation.patch b/queue/nl80211-fix-MAC-address-validation.patch
new file mode 100644
index 0000000..05284b5
--- /dev/null
+++ b/queue/nl80211-fix-MAC-address-validation.patch
@@ -0,0 +1,36 @@
+From c2a94fc2495b6247a5f5f3349bba2a8f686342cc Mon Sep 17 00:00:00 2001
+From: Eliad Peller <eliad@wizery.com>
+Date: Thu, 24 Nov 2011 18:13:56 +0200
+Subject: [PATCH 10/24] nl80211: fix MAC address validation
+
+commit e007b857e88097c96c45620bf3b04a4e309053d1 upstream.
+
+MAC addresses have a fixed length. The current
+policy allows passing < ETH_ALEN bytes, which
+might result in reading beyond the buffer.
+
+Signed-off-by: Eliad Peller <eliad@wizery.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ net/wireless/nl80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index fde82a8..a316e59 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -76,8 +76,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
+ 	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
+ 	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
+ 
+-	[NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
+-	[NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
++	[NL80211_ATTR_MAC] = { .len = ETH_ALEN },
++	[NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
+ 
+ 	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
+ 	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
+-- 
+1.7.12.1
+
diff --git a/queue/oprofile-x86-Fix-crash-when-unloading-module-nmi-tim.patch b/queue/oprofile-x86-Fix-crash-when-unloading-module-nmi-tim.patch
new file mode 100644
index 0000000..eceeabd
--- /dev/null
+++ b/queue/oprofile-x86-Fix-crash-when-unloading-module-nmi-tim.patch
@@ -0,0 +1,93 @@
+From 50741acc651890e58abdd96c8115f56776e52686 Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter@amd.com>
+Date: Mon, 10 Oct 2011 16:21:10 +0200
+Subject: [PATCH 21/24] oprofile, x86: Fix crash when unloading module (nmi
+ timer mode)
+
+commit 97f7f8189fe54e3cfe324ef9ad35064f3d2d3bff upstream.
+
+If oprofile uses the nmi timer interrupt there is a crash while
+unloading the module. The bug can be triggered with oprofile build as
+module and kernel parameter nolapic set. This patch fixes this.
+
+oprofile: using NMI timer interrupt.
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
+IP: [<ffffffff8123c226>] unregister_syscore_ops+0x41/0x58
+PGD 42dbca067 PUD 41da6a067 PMD 0
+Oops: 0002 [#1] PREEMPT SMP
+CPU 5
+Modules linked in: oprofile(-) [last unloaded: oprofile]
+
+Pid: 2518, comm: modprobe Not tainted 3.1.0-rc7-00019-gb2fb49d #19 Advanced Micro Device Anaheim/Anaheim
+RIP: 0010:[<ffffffff8123c226>]  [<ffffffff8123c226>] unregister_syscore_ops+0x41/0x58
+RSP: 0018:ffff88041ef71e98  EFLAGS: 00010296
+RAX: 0000000000000000 RBX: ffffffffa0017100 RCX: dead000000200200
+RDX: 0000000000000000 RSI: dead000000100100 RDI: ffffffff8178c620
+RBP: ffff88041ef71ea8 R08: 0000000000000001 R09: 0000000000000082
+R10: 0000000000000000 R11: ffff88041ef71de8 R12: 0000000000000080
+R13: fffffffffffffff5 R14: 0000000000000001 R15: 0000000000610210
+FS:  00007fc902f20700(0000) GS:ffff88042fd40000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+CR2: 0000000000000008 CR3: 000000041cdb6000 CR4: 00000000000006e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process modprobe (pid: 2518, threadinfo ffff88041ef70000, task ffff88041d348040)
+Stack:
+ ffff88041ef71eb8 ffffffffa0017790 ffff88041ef71eb8 ffffffffa0013532
+ ffff88041ef71ec8 ffffffffa00132d6 ffff88041ef71ed8 ffffffffa00159b2
+ ffff88041ef71f78 ffffffff81073115 656c69666f72706f 0000000000610200
+Call Trace:
+ [<ffffffffa0013532>] op_nmi_exit+0x15/0x17 [oprofile]
+ [<ffffffffa00132d6>] oprofile_arch_exit+0xe/0x10 [oprofile]
+ [<ffffffffa00159b2>] oprofile_exit+0x1e/0x20 [oprofile]
+ [<ffffffff81073115>] sys_delete_module+0x1c3/0x22f
+ [<ffffffff811bf09e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
+ [<ffffffff8148070b>] system_call_fastpath+0x16/0x1b
+Code: 20 c6 78 81 e8 c5 cc 23 00 48 8b 13 48 8b 43 08 48 be 00 01 10 00 00 00 ad de 48 b9 00 02 20 00 00 00 ad de 48 c7 c7 20 c6 78 81
+ 89 42 08 48 89 10 48 89 33 48 89 4b 08 e8 a6 c0 23 00 5a 5b
+RIP  [<ffffffff8123c226>] unregister_syscore_ops+0x41/0x58
+ RSP <ffff88041ef71e98>
+CR2: 0000000000000008
+---[ end trace 43a541a52956b7b0 ]---
+
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/oprofile/init.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/oprofile/init.c b/arch/x86/oprofile/init.c
+index cdfe4c5..f148cf6 100644
+--- a/arch/x86/oprofile/init.c
++++ b/arch/x86/oprofile/init.c
+@@ -21,6 +21,7 @@ extern int op_nmi_timer_init(struct oprofile_operations *ops);
+ extern void op_nmi_exit(void);
+ extern void x86_backtrace(struct pt_regs * const regs, unsigned int depth);
+ 
++static int nmi_timer;
+ 
+ int __init oprofile_arch_init(struct oprofile_operations *ops)
+ {
+@@ -31,8 +32,9 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
+ #ifdef CONFIG_X86_LOCAL_APIC
+ 	ret = op_nmi_init(ops);
+ #endif
++	nmi_timer = (ret != 0);
+ #ifdef CONFIG_X86_IO_APIC
+-	if (ret < 0)
++	if (nmi_timer)
+ 		ret = op_nmi_timer_init(ops);
+ #endif
+ 	ops->backtrace = x86_backtrace;
+@@ -44,6 +46,7 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
+ void oprofile_arch_exit(void)
+ {
+ #ifdef CONFIG_X86_LOCAL_APIC
+-	op_nmi_exit();
++	if (!nmi_timer)
++		op_nmi_exit();
+ #endif
+ }
+-- 
+1.7.12.1
+
diff --git a/queue/p54spi-Add-missing-spin_lock_init.patch b/queue/p54spi-Add-missing-spin_lock_init.patch
new file mode 100644
index 0000000..5490a2d
--- /dev/null
+++ b/queue/p54spi-Add-missing-spin_lock_init.patch
@@ -0,0 +1,32 @@
+From 86fe98ca04ca9c73f7c3eee9122fdf5225c264de Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20B=C3=BCsch?= <m@bues.ch>
+Date: Wed, 16 Nov 2011 23:48:31 +0100
+Subject: [PATCH 08/24] p54spi: Add missing spin_lock_init
+
+commit 32d3a3922d617a5a685a5e2d24b20d0e88f192a9 upstream.
+
+The tx_lock is not initialized properly. Add spin_lock_init().
+
+Signed-off-by: Michael Buesch <m@bues.ch>
+Acked-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/net/wireless/p54/p54spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
+index c8f09da..4cede24 100644
+--- a/drivers/net/wireless/p54/p54spi.c
++++ b/drivers/net/wireless/p54/p54spi.c
+@@ -651,6 +651,7 @@ static int __devinit p54spi_probe(struct spi_device *spi)
+ 	init_completion(&priv->fw_comp);
+ 	INIT_LIST_HEAD(&priv->tx_pending);
+ 	mutex_init(&priv->mutex);
++	spin_lock_init(&priv->tx_lock);
+ 	SET_IEEE80211_DEV(hw, &spi->dev);
+ 	priv->common.open = p54spi_op_start;
+ 	priv->common.stop = p54spi_op_stop;
+-- 
+1.7.12.1
+
diff --git a/queue/p54spi-Fix-workqueue-deadlock.patch b/queue/p54spi-Fix-workqueue-deadlock.patch
new file mode 100644
index 0000000..497ddf2
--- /dev/null
+++ b/queue/p54spi-Fix-workqueue-deadlock.patch
@@ -0,0 +1,46 @@
+From c803551ae885775d6054fd6b90ad7347055ca8fc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20B=C3=BCsch?= <m@bues.ch>
+Date: Wed, 16 Nov 2011 23:55:46 +0100
+Subject: [PATCH 09/24] p54spi: Fix workqueue deadlock
+
+commit 2d1618170eb493d18f66f2ac03775409a6fb97c6 upstream.
+
+priv->work must not be synced while priv->mutex is locked, because
+the mutex is taken in the work handler.
+Move cancel_work_sync down to after the device shutdown code.
+This is safe, because the work handler checks fw_state and bails out
+early in case of a race.
+
+Signed-off-by: Michael Buesch <m@bues.ch>
+Acked-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/net/wireless/p54/p54spi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
+index 4cede24..8cf0301 100644
+--- a/drivers/net/wireless/p54/p54spi.c
++++ b/drivers/net/wireless/p54/p54spi.c
+@@ -582,8 +582,6 @@ static void p54spi_op_stop(struct ieee80211_hw *dev)
+ 
+ 	WARN_ON(priv->fw_state != FW_STATE_READY);
+ 
+-	cancel_work_sync(&priv->work);
+-
+ 	p54spi_power_off(priv);
+ 	spin_lock_irqsave(&priv->tx_lock, flags);
+ 	INIT_LIST_HEAD(&priv->tx_pending);
+@@ -591,6 +589,8 @@ static void p54spi_op_stop(struct ieee80211_hw *dev)
+ 
+ 	priv->fw_state = FW_STATE_OFF;
+ 	mutex_unlock(&priv->mutex);
++
++	cancel_work_sync(&priv->work);
+ }
+ 
+ static int __devinit p54spi_probe(struct spi_device *spi)
+-- 
+1.7.12.1
+
diff --git a/queue/sched-x86-Avoid-unnecessary-overflow-in-sched_clock.patch b/queue/sched-x86-Avoid-unnecessary-overflow-in-sched_clock.patch
new file mode 100644
index 0000000..baf1cef
--- /dev/null
+++ b/queue/sched-x86-Avoid-unnecessary-overflow-in-sched_clock.patch
@@ -0,0 +1,74 @@
+From 41ea3fce42da2b00c7c6150971584e8543d19c24 Mon Sep 17 00:00:00 2001
+From: Salman Qazi <sqazi@google.com>
+Date: Tue, 15 Nov 2011 14:12:06 -0800
+Subject: [PATCH 19/24] sched, x86: Avoid unnecessary overflow in sched_clock
+
+commit 4cecf6d401a01d054afc1e5f605bcbfe553cb9b9 upstream.
+
+(Added the missing signed-off-by line)
+
+In hundreds of days, the __cycles_2_ns calculation in sched_clock
+has an overflow.  cyc * per_cpu(cyc2ns, cpu) exceeds 64 bits, causing
+the final value to become zero.  We can solve this without losing
+any precision.
+
+We can decompose TSC into quotient and remainder of division by the
+scale factor, and then use this to convert TSC into nanoseconds.
+
+Signed-off-by: Salman Qazi <sqazi@google.com>
+Acked-by: John Stultz <johnstul@us.ibm.com>
+Reviewed-by: Paul Turner <pjt@google.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/r/20111115221121.7262.88871.stgit@dungbeetle.mtv.corp.google.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/include/asm/timer.h | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/timer.h b/arch/x86/include/asm/timer.h
+index 5469630..b93a9aa 100644
+--- a/arch/x86/include/asm/timer.h
++++ b/arch/x86/include/asm/timer.h
+@@ -38,6 +38,22 @@ extern int no_timer_check;
+  *  (mathieu.desnoyers@polymtl.ca)
+  *
+  *			-johnstul@us.ibm.com "math is hard, lets go shopping!"
++ *
++ * In:
++ *
++ * ns = cycles * cyc2ns_scale / SC
++ *
++ * Although we may still have enough bits to store the value of ns,
++ * in some cases, we may not have enough bits to store cycles * cyc2ns_scale,
++ * leading to an incorrect result.
++ *
++ * To avoid this, we can decompose 'cycles' into quotient and remainder
++ * of division by SC.  Then,
++ *
++ * ns = (quot * SC + rem) * cyc2ns_scale / SC
++ *    = quot * cyc2ns_scale + (rem * cyc2ns_scale) / SC
++ *
++ *			- sqazi@google.com
+  */
+ 
+ DECLARE_PER_CPU(unsigned long, cyc2ns);
+@@ -47,9 +63,14 @@ DECLARE_PER_CPU(unsigned long long, cyc2ns_offset);
+ 
+ static inline unsigned long long __cycles_2_ns(unsigned long long cyc)
+ {
++	unsigned long long quot;
++	unsigned long long rem;
+ 	int cpu = smp_processor_id();
+ 	unsigned long long ns = per_cpu(cyc2ns_offset, cpu);
+-	ns += cyc * per_cpu(cyc2ns, cpu) >> CYC2NS_SCALE_FACTOR;
++	quot = (cyc >> CYC2NS_SCALE_FACTOR);
++	rem = cyc & ((1ULL << CYC2NS_SCALE_FACTOR) - 1);
++	ns += quot * per_cpu(cyc2ns, cpu) +
++		((rem * per_cpu(cyc2ns, cpu)) >> CYC2NS_SCALE_FACTOR);
+ 	return ns;
+ }
+ 
+-- 
+1.7.12.1
+
diff --git a/queue/series b/queue/series
index ecd94c1..3a5573a 100644
--- a/queue/series
+++ b/queue/series
@@ -11,3 +11,28 @@ ALSA-hda-Use-position_fix-1-for-Acer-Aspire-5538-to-.patch
 cifs-fix-cifs-stable-patch-cifs-fix-oplock-break-han.patch
 gro-reset-vlan_tci-on-reuse.patch
 
+# from .50
+i2c-algo-bit-Generate-correct-i2c-address-sequence-f.patch
+eCryptfs-Extend-array-bounds-for-all-filename-chars.patch
+PCI-hotplug-shpchp-don-t-blindly-claim-non-AMD-0x745.patch
+ARM-7161-1-errata-no-automatic-store-buffer-drain.patch
+ALSA-lx6464es-fix-device-communication-via-command-b.patch
+SUNRPC-Ensure-we-return-EAGAIN-in-xs_nospace-if-cong.patch
+timekeeping-add-arch_offset-hook-to-ktime_get-functi.patch
+p54spi-Add-missing-spin_lock_init.patch
+p54spi-Fix-workqueue-deadlock.patch
+nl80211-fix-MAC-address-validation.patch
+staging-usbip-bugfix-for-deadlock.patch
+staging-comedi-fix-oops-for-USB-DAQ-devices.patch
+Staging-comedi-fix-signal-handling-in-read-and-write.patch
+USB-whci-hcd-fix-endian-conversion-in-qset_clear.patch
+usb-ftdi_sio-add-PID-for-Propox-ISPcable-III.patch
+usb-option-add-SIMCom-SIM5218.patch
+USB-usb-storage-unusual_devs-entry-for-Kingston-DT-1.patch
+Silencing-killing-requests-for-dead-queue.patch
+sched-x86-Avoid-unnecessary-overflow-in-sched_clock.patch
+x86-mpparse-Account-for-bus-types-other-than-ISA-and.patch
+oprofile-x86-Fix-crash-when-unloading-module-nmi-tim.patch
+genirq-Fix-race-condition-when-stopping-the-irq-thre.patch
+tick-broadcast-Stop-active-broadcast-device-when-rep.patch
+clockevents-Set-noop-handler-in-clockevents_exchange.patch
diff --git a/queue/staging-comedi-fix-oops-for-USB-DAQ-devices.patch b/queue/staging-comedi-fix-oops-for-USB-DAQ-devices.patch
new file mode 100644
index 0000000..3f677f7
--- /dev/null
+++ b/queue/staging-comedi-fix-oops-for-USB-DAQ-devices.patch
@@ -0,0 +1,149 @@
+From d3ba50754cd57999b5fbd4fc3eb8d34c9d4af4e8 Mon Sep 17 00:00:00 2001
+From: Bernd Porr <berndporr@f2s.com>
+Date: Tue, 8 Nov 2011 21:23:03 +0000
+Subject: [PATCH 12/24] staging: comedi: fix oops for USB DAQ devices.
+
+commit 3ffab428f40849ed5f21bcfd7285bdef7902f9ca upstream.
+
+This fixes kernel oops when an USB DAQ device is plugged out while it's
+communicating with the userspace software.
+
+Signed-off-by: Bernd Porr <berndporr@f2s.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/staging/comedi/comedi_fops.c | 71 +++++++++++++++++++++++++++---------
+ 1 file changed, 53 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index ac6527c..48ac52b 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1391,9 +1391,6 @@ static struct vm_operations_struct comedi_vm_ops = {
+ static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+ 	const unsigned minor = iminor(file->f_dentry->d_inode);
+-	struct comedi_device_file_info *dev_file_info =
+-	    comedi_get_device_file_info(minor);
+-	struct comedi_device *dev = dev_file_info->device;
+ 	struct comedi_async *async = NULL;
+ 	unsigned long start = vma->vm_start;
+ 	unsigned long size;
+@@ -1401,6 +1398,15 @@ static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
+ 	int i;
+ 	int retval;
+ 	struct comedi_subdevice *s;
++	struct comedi_device_file_info *dev_file_info;
++	struct comedi_device *dev;
++
++	dev_file_info = comedi_get_device_file_info(minor);
++	if (dev_file_info == NULL)
++	        return -ENODEV;
++	dev = dev_file_info->device;
++	if (dev == NULL)
++	        return -ENODEV;
+ 
+ 	mutex_lock(&dev->mutex);
+ 	if (!dev->attached) {
+@@ -1467,11 +1473,17 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait)
+ {
+ 	unsigned int mask = 0;
+ 	const unsigned minor = iminor(file->f_dentry->d_inode);
+-	struct comedi_device_file_info *dev_file_info =
+-	    comedi_get_device_file_info(minor);
+-	struct comedi_device *dev = dev_file_info->device;
+ 	struct comedi_subdevice *read_subdev;
+ 	struct comedi_subdevice *write_subdev;
++	struct comedi_device_file_info *dev_file_info;
++	struct comedi_device *dev;
++	dev_file_info = comedi_get_device_file_info(minor);
++
++	if (dev_file_info == NULL)
++	        return -ENODEV;
++	dev = dev_file_info->device;
++	if (dev == NULL)
++	        return -ENODEV;
+ 
+ 	mutex_lock(&dev->mutex);
+ 	if (!dev->attached) {
+@@ -1517,9 +1529,15 @@ static ssize_t comedi_write(struct file *file, const char *buf, size_t nbytes,
+ 	int n, m, count = 0, retval = 0;
+ 	DECLARE_WAITQUEUE(wait, current);
+ 	const unsigned minor = iminor(file->f_dentry->d_inode);
+-	struct comedi_device_file_info *dev_file_info =
+-	    comedi_get_device_file_info(minor);
+-	struct comedi_device *dev = dev_file_info->device;
++	struct comedi_device_file_info *dev_file_info;
++	struct comedi_device *dev;
++	dev_file_info = comedi_get_device_file_info(minor);
++
++	if (dev_file_info == NULL)
++	        return -ENODEV;
++	dev = dev_file_info->device;
++	if (dev == NULL)
++	        return -ENODEV;
+ 
+ 	if (!dev->attached) {
+ 		DPRINTK("no driver configured on comedi%i\n", dev->minor);
+@@ -1619,9 +1637,15 @@ static ssize_t comedi_read(struct file *file, char *buf, size_t nbytes,
+ 	int n, m, count = 0, retval = 0;
+ 	DECLARE_WAITQUEUE(wait, current);
+ 	const unsigned minor = iminor(file->f_dentry->d_inode);
+-	struct comedi_device_file_info *dev_file_info =
+-	    comedi_get_device_file_info(minor);
+-	struct comedi_device *dev = dev_file_info->device;
++	struct comedi_device_file_info *dev_file_info;
++	struct comedi_device *dev;
++	dev_file_info = comedi_get_device_file_info(minor);
++
++	if (dev_file_info == NULL)
++	        return -ENODEV;
++	dev = dev_file_info->device;
++	if (dev == NULL)
++	        return -ENODEV;
+ 
+ 	if (!dev->attached) {
+ 		DPRINTK("no driver configured on comedi%i\n", dev->minor);
+@@ -1814,11 +1838,17 @@ ok:
+ static int comedi_close(struct inode *inode, struct file *file)
+ {
+ 	const unsigned minor = iminor(inode);
+-	struct comedi_device_file_info *dev_file_info =
+-	    comedi_get_device_file_info(minor);
+-	struct comedi_device *dev = dev_file_info->device;
+ 	struct comedi_subdevice *s = NULL;
+ 	int i;
++	struct comedi_device_file_info *dev_file_info;
++	struct comedi_device *dev;
++	dev_file_info = comedi_get_device_file_info(minor);
++
++	if (dev_file_info == NULL)
++	        return -ENODEV;
++	dev = dev_file_info->device;
++	if (dev == NULL)
++	        return -ENODEV;
+ 
+ 	mutex_lock(&dev->mutex);
+ 
+@@ -1852,10 +1882,15 @@ static int comedi_close(struct inode *inode, struct file *file)
+ static int comedi_fasync(int fd, struct file *file, int on)
+ {
+ 	const unsigned minor = iminor(file->f_dentry->d_inode);
+-	struct comedi_device_file_info *dev_file_info =
+-	    comedi_get_device_file_info(minor);
++	struct comedi_device_file_info *dev_file_info;
++	struct comedi_device *dev;
++	dev_file_info = comedi_get_device_file_info(minor);
+ 
+-	struct comedi_device *dev = dev_file_info->device;
++	if (dev_file_info == NULL)
++	        return -ENODEV;
++	dev = dev_file_info->device;
++	if (dev == NULL)
++	        return -ENODEV;
+ 
+ 	return fasync_helper(fd, file, on, &dev->async_queue);
+ }
+-- 
+1.7.12.1
+
diff --git a/queue/staging-usbip-bugfix-for-deadlock.patch b/queue/staging-usbip-bugfix-for-deadlock.patch
new file mode 100644
index 0000000..9d6ff13
--- /dev/null
+++ b/queue/staging-usbip-bugfix-for-deadlock.patch
@@ -0,0 +1,66 @@
+From 0ebac3a404220d0d3ecbe286df31276ae55968b5 Mon Sep 17 00:00:00 2001
+From: Bart Westgeest <bart@elbrys.com>
+Date: Tue, 1 Nov 2011 15:01:28 -0400
+Subject: [PATCH 11/24] staging: usbip: bugfix for deadlock
+
+commit 438957f8d4a84daa7fa5be6978ad5897a2e9e5e5 upstream.
+
+Interrupts must be disabled prior to calling usb_hcd_unlink_urb_from_ep.
+If interrupts are not disabled, it can potentially lead to a deadlock.
+The deadlock is readily reproduceable on a slower (ARM based) device
+such as the TI Pandaboard.
+
+Signed-off-by: Bart Westgeest <bart@elbrys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/staging/usbip/vhci_rx.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
+index a1ac1b8..b09c67a 100644
+--- a/drivers/staging/usbip/vhci_rx.c
++++ b/drivers/staging/usbip/vhci_rx.c
+@@ -69,6 +69,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
+ {
+ 	struct usbip_device *ud = &vdev->ud;
+ 	struct urb *urb;
++	unsigned long flags;
+ 
+ 	spin_lock(&vdev->priv_lock);
+ 
+@@ -109,9 +110,9 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
+ 
+ 	usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
+ 
+-	spin_lock(&the_controller->lock);
++	spin_lock_irqsave(&the_controller->lock, flags);
+ 	usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
+-	spin_unlock(&the_controller->lock);
++	spin_unlock_irqrestore(&the_controller->lock, flags);
+ 
+ 	usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status);
+ 
+@@ -152,6 +153,7 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
+ {
+ 	struct vhci_unlink *unlink;
+ 	struct urb *urb;
++	unsigned long flags;
+ 
+ 	usbip_dump_header(pdu);
+ 
+@@ -183,9 +185,9 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
+ 		urb->status = pdu->u.ret_unlink.status;
+ 		usbip_uinfo("%d\n", urb->status);
+ 
+-		spin_lock(&the_controller->lock);
++		spin_lock_irqsave(&the_controller->lock, flags);
+ 		usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
+-		spin_unlock(&the_controller->lock);
++		spin_unlock_irqrestore(&the_controller->lock, flags);
+ 
+ 		usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
+ 								urb->status);
+-- 
+1.7.12.1
+
diff --git a/queue/tick-broadcast-Stop-active-broadcast-device-when-rep.patch b/queue/tick-broadcast-Stop-active-broadcast-device-when-rep.patch
new file mode 100644
index 0000000..886b177
--- /dev/null
+++ b/queue/tick-broadcast-Stop-active-broadcast-device-when-rep.patch
@@ -0,0 +1,34 @@
+From da9e5fec4d08dc32cbaea1990c3732b91cf523cf Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Fri, 2 Dec 2011 12:34:16 +0100
+Subject: [PATCH 23/24] tick-broadcast: Stop active broadcast device when
+ replacing it
+
+commit c1be84309c58b1e7c6d626e28fba41a22b364c3d upstream.
+
+When a better rated broadcast device is installed, then the current
+active device is not disabled, which results in two running broadcast
+devices.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ kernel/time/tick-broadcast.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index 0f888cb..521987f 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -72,7 +72,7 @@ int tick_check_broadcast_device(struct clock_event_device *dev)
+ 	     (dev->features & CLOCK_EVT_FEAT_C3STOP))
+ 		return 0;
+ 
+-	clockevents_exchange_device(NULL, dev);
++	clockevents_exchange_device(tick_broadcast_device.evtdev, dev);
+ 	tick_broadcast_device.evtdev = dev;
+ 	if (!cpumask_empty(tick_get_broadcast_mask()))
+ 		tick_broadcast_start_periodic(dev);
+-- 
+1.7.12.1
+
diff --git a/queue/timekeeping-add-arch_offset-hook-to-ktime_get-functi.patch b/queue/timekeeping-add-arch_offset-hook-to-ktime_get-functi.patch
new file mode 100644
index 0000000..e63b333
--- /dev/null
+++ b/queue/timekeeping-add-arch_offset-hook-to-ktime_get-functi.patch
@@ -0,0 +1,48 @@
+From 4a769fce157eb2e4f02f2dd854526d58f197f2ed Mon Sep 17 00:00:00 2001
+From: Hector Palacios <hector.palacios@digi.com>
+Date: Mon, 14 Nov 2011 11:15:25 +0100
+Subject: [PATCH 07/24] timekeeping: add arch_offset hook to ktime_get
+ functions
+
+commit d004e024058a0eaca097513ce62cbcf978913e0a upstream.
+
+ktime_get and ktime_get_ts were calling timekeeping_get_ns()
+but later they were not calling arch_gettimeoffset() so architectures
+using this mechanism returned 0 ns when calling these functions.
+
+This happened for example when running Busybox's ping which calls
+syscall(__NR_clock_gettime, CLOCK_MONOTONIC, ts) which eventually
+calls ktime_get. As a result the returned ping travel time was zero.
+
+Signed-off-by: Hector Palacios <hector.palacios@digi.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ kernel/time/timekeeping.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 21cd75b..8559968 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -277,6 +277,8 @@ ktime_t ktime_get(void)
+ 		secs = xtime.tv_sec + wall_to_monotonic.tv_sec;
+ 		nsecs = xtime.tv_nsec + wall_to_monotonic.tv_nsec;
+ 		nsecs += timekeeping_get_ns();
++		/* If arch requires, add in gettimeoffset() */
++		nsecs += arch_gettimeoffset();
+ 
+ 	} while (read_seqretry(&xtime_lock, seq));
+ 	/*
+@@ -308,6 +310,8 @@ void ktime_get_ts(struct timespec *ts)
+ 		*ts = xtime;
+ 		tomono = wall_to_monotonic;
+ 		nsecs = timekeeping_get_ns();
++		/* If arch requires, add in gettimeoffset() */
++		nsecs += arch_gettimeoffset();
+ 
+ 	} while (read_seqretry(&xtime_lock, seq));
+ 
+-- 
+1.7.12.1
+
diff --git a/queue/usb-ftdi_sio-add-PID-for-Propox-ISPcable-III.patch b/queue/usb-ftdi_sio-add-PID-for-Propox-ISPcable-III.patch
new file mode 100644
index 0000000..063d063
--- /dev/null
+++ b/queue/usb-ftdi_sio-add-PID-for-Propox-ISPcable-III.patch
@@ -0,0 +1,45 @@
+From fac48e25e38b3158cf328d9d84e6ec8726bee5bd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marcin=20Ko=C5=9Bcielnicki?= <koriakin@0x04.net>
+Date: Wed, 30 Nov 2011 17:01:04 +0100
+Subject: [PATCH 15/24] usb: ftdi_sio: add PID for Propox ISPcable III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 307369b0ca06b27b511b61714e335ddfccf19c4f upstream.
+
+Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/serial/ftdi_sio.c     | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index e4c3da1..646cc53 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -739,6 +739,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
+ 	{ USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID),
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index c4670e5..ce57c40 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -111,6 +111,7 @@
+ 
+ /* Propox devices */
+ #define FTDI_PROPOX_JTAGCABLEII_PID	0xD738
++#define FTDI_PROPOX_ISPCABLEIII_PID	0xD739
+ 
+ /* Lenz LI-USB Computer Interface. */
+ #define FTDI_LENZ_LIUSB_PID	0xD780
+-- 
+1.7.12.1
+
diff --git a/queue/usb-option-add-SIMCom-SIM5218.patch b/queue/usb-option-add-SIMCom-SIM5218.patch
new file mode 100644
index 0000000..e66570d
--- /dev/null
+++ b/queue/usb-option-add-SIMCom-SIM5218.patch
@@ -0,0 +1,31 @@
+From 3db5ad1a2e38e00ee597e5c8f3ce055e7c5cdf4b Mon Sep 17 00:00:00 2001
+From: Veli-Pekka Peltola <veli-pekka.peltola@bluegiga.com>
+Date: Thu, 24 Nov 2011 22:08:56 +0200
+Subject: [PATCH 16/24] usb: option: add SIMCom SIM5218
+
+commit ec0cd94d881ca89cc9fb61d00d0f4b2b52e605b3 upstream.
+
+Tested with SIM5218EVB-KIT evaluation kit.
+
+Signed-off-by: Veli-Pekka Peltola <veli-pekka.peltola@bluegiga.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 335dbed..c626fda 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -612,6 +612,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
++	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
+-- 
+1.7.12.1
+
diff --git a/queue/x86-mpparse-Account-for-bus-types-other-than-ISA-and.patch b/queue/x86-mpparse-Account-for-bus-types-other-than-ISA-and.patch
new file mode 100644
index 0000000..c70ea11
--- /dev/null
+++ b/queue/x86-mpparse-Account-for-bus-types-other-than-ISA-and.patch
@@ -0,0 +1,58 @@
+From 5d22551235a7ef84c0e797c7a885823f08c6b2b8 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Sun, 25 Sep 2011 15:29:00 -0600
+Subject: [PATCH 20/24] x86/mpparse: Account for bus types other than ISA and
+ PCI
+
+commit 9e6866686bdf2dcf3aeb0838076237ede532dcc8 upstream.
+
+In commit f8924e770e04 ("x86: unify mp_bus_info"), the 32-bit
+and 64-bit versions of MP_bus_info were rearranged to match each
+other better.  Unfortunately it introduced a regression: prior
+to that change we used to always set the mp_bus_not_pci bit,
+then clear it if we found a PCI bus.  After it, we set
+mp_bus_not_pci for ISA buses, clear it for PCI buses, and leave
+it alone otherwise.
+
+In the cases of ISA and PCI, there's not much difference.  But
+ISA is not the only non-PCI bus, so it's better to always set
+mp_bus_not_pci and clear it only for PCI.
+
+Without this change, Dan's Dell PowerEdge 4200 panics on boot
+with a log indicating interrupt routing trouble unless the
+"noapic" option is supplied.  With this change, the machine
+boots reliably without "noapic".
+
+Fixes http://bugs.debian.org/586494
+
+Reported-bisected-and-tested-by: Dan McGrath <troubledaemon@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Dan McGrath <troubledaemon@gmail.com>
+Cc: Alexey Starikovskiy <aystarik@gmail.com>
+[jrnieder@gmail.com: clarified commit message]
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Link: http://lkml.kernel.org/r/20111122215000.GA9151@elie.hsd1.il.comcast.net
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+---
+ arch/x86/kernel/mpparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
+index e81030f..d60fa2b 100644
+--- a/arch/x86/kernel/mpparse.c
++++ b/arch/x86/kernel/mpparse.c
+@@ -94,8 +94,8 @@ static void __init MP_bus_info(struct mpc_bus *m)
+ 	}
+ #endif
+ 
++	set_bit(m->busid, mp_bus_not_pci);
+ 	if (strncmp(str, BUSTYPE_ISA, sizeof(BUSTYPE_ISA) - 1) == 0) {
+-		set_bit(m->busid, mp_bus_not_pci);
+ #if defined(CONFIG_EISA) || defined(CONFIG_MCA)
+ 		mp_bus_id_to_type[m->busid] = MP_BUS_ISA;
+ #endif
+-- 
+1.7.12.1
+