.39 patches

author: Greg Kroah-Hartman <gregkh@suse.de> 2011-07-07 16:38:11 -0700
committer: Greg Kroah-Hartman <gregkh@suse.de> 2011-07-07 16:38:11 -0700
commit: a34ad26998d864b800c354b63694f4113ffb29e8 (patch)
tree: 7690e87159c6e5ed43b46dad4f49532347ef8634
parent: 0c5b40fb181690fcd94f9bb9d2bccf1dd9d0473b (diff)
download: stable-queue-a34ad26998d864b800c354b63694f4113ffb29e8.tar.gz
58 files changed, 3626 insertions, 0 deletions
diff --git a/queue-2.6.39/6pack-mkiss-fix-lock-inconsistency.patch b/queue-2.6.39/6pack-mkiss-fix-lock-inconsistency.patch
new file mode 100644
index 0000000000..8e36f7350e
--- /dev/null
+++ b/queue-2.6.39/6pack-mkiss-fix-lock-inconsistency.patch
@@ -0,0 +1,67 @@
+From 6e4e2f811bade330126d4029c88c831784a7efd9 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 1 Jul 2011 17:30:00 -0700
+Subject: 6pack,mkiss: fix lock inconsistency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 6e4e2f811bade330126d4029c88c831784a7efd9 upstream.
+
+Lockdep found a locking inconsistency in the mkiss_close function:
+
+> kernel: [ INFO: inconsistent lock state ]
+> kernel: 2.6.39.1 #3
+> kernel: ---------------------------------
+> kernel: inconsistent {IN-SOFTIRQ-R} -> {SOFTIRQ-ON-W} usage.
+> kernel: ax25ipd/2813 [HC0[0]:SC0[0]:HE1:SE1] takes:
+> kernel: (disc_data_lock){+++?.-}, at: [<ffffffffa018552b>] mkiss_close+0x1b/0x90 [mkiss]
+> kernel: {IN-SOFTIRQ-R} state was registered at:
+
+The message hints that disc_data_lock is aquired with softirqs disabled,
+but does not itself disable softirqs, which can in rare circumstances
+lead to a deadlock.
+The same problem is present in the 6pack driver, this patch fixes both
+by using write_lock_bh instead of write_lock.
+
+Reported-by: Bernard F6BVP <f6bvp@free.fr>
+Tested-by: Bernard F6BVP <f6bvp@free.fr>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Ralf Baechle<ralf@linux-mips.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/hamradio/6pack.c |    4 ++--
+ drivers/net/hamradio/mkiss.c |    4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -692,10 +692,10 @@ static void sixpack_close(struct tty_str
+ {
+ 	struct sixpack *sp;
+ 
+-	write_lock(&disc_data_lock);
++	write_lock_bh(&disc_data_lock);
+ 	sp = tty->disc_data;
+ 	tty->disc_data = NULL;
+-	write_unlock(&disc_data_lock);
++	write_unlock_bh(&disc_data_lock);
+ 	if (!sp)
+ 		return;
+ 
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -813,10 +813,10 @@ static void mkiss_close(struct tty_struc
+ {
+ 	struct mkiss *ax;
+ 
+-	write_lock(&disc_data_lock);
++	write_lock_bh(&disc_data_lock);
+ 	ax = tty->disc_data;
+ 	tty->disc_data = NULL;
+-	write_unlock(&disc_data_lock);
++	write_unlock_bh(&disc_data_lock);
+ 
+ 	if (!ax)
+ 		return;
diff --git a/queue-2.6.39/alsa-hda-add-a-new-conexant-codec-id-506c.patch b/queue-2.6.39/alsa-hda-add-a-new-conexant-codec-id-506c.patch
new file mode 100644
index 0000000000..396beb7ca6
--- /dev/null
+++ b/queue-2.6.39/alsa-hda-add-a-new-conexant-codec-id-506c.patch
@@ -0,0 +1,41 @@
+From f0ca89b031d327b80b612a0608d31b8e13e6dc33 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Tue, 21 Jun 2011 20:51:34 +0200
+Subject: ALSA: HDA: Add a new Conexant codec ID (506c)
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit f0ca89b031d327b80b612a0608d31b8e13e6dc33 upstream.
+
+Conexant ID 506c was found on Acer Aspire 3830TG. As users report
+no playback, sending to stable should be safe.
+
+BugLink: https://bugs.launchpad.net/bugs/783582
+Reported-by: andROOM
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3846,6 +3846,8 @@ static struct hda_codec_preset snd_hda_p
+ 	  .patch = patch_cxt5066 },
+ 	{ .id = 0x14f15069, .name = "CX20585",
+ 	  .patch = patch_cxt5066 },
++	{ .id = 0x14f1506c, .name = "CX20588",
++	  .patch = patch_cxt5066 },
+ 	{ .id = 0x14f1506e, .name = "CX20590",
+ 	  .patch = patch_cxt5066 },
+ 	{ .id = 0x14f15097, .name = "CX20631",
+@@ -3874,6 +3876,7 @@ MODULE_ALIAS("snd-hda-codec-id:14f15066"
+ MODULE_ALIAS("snd-hda-codec-id:14f15067");
+ MODULE_ALIAS("snd-hda-codec-id:14f15068");
+ MODULE_ALIAS("snd-hda-codec-id:14f15069");
++MODULE_ALIAS("snd-hda-codec-id:14f1506c");
+ MODULE_ALIAS("snd-hda-codec-id:14f1506e");
+ MODULE_ALIAS("snd-hda-codec-id:14f15097");
+ MODULE_ALIAS("snd-hda-codec-id:14f15098");
diff --git a/queue-2.6.39/alsa-hda-remove-quirk-for-an-hp-device.patch b/queue-2.6.39/alsa-hda-remove-quirk-for-an-hp-device.patch
new file mode 100644
index 0000000000..0b08fb616b
--- /dev/null
+++ b/queue-2.6.39/alsa-hda-remove-quirk-for-an-hp-device.patch
@@ -0,0 +1,33 @@
+From 6f2e810ad5d162c2bfa063c1811087277b299e4e Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 20 Jun 2011 10:27:07 +0200
+Subject: ALSA: HDA: Remove quirk for an HP device
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 6f2e810ad5d162c2bfa063c1811087277b299e4e upstream.
+
+The reporter, who is running kernel 2.6.38, reports that
+he needs to set model=auto for the headphone output to work
+correctly.
+
+BugLink: http://bugs.launchpad.net/bugs/761022
+Reported-by: Jo
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4607,7 +4607,6 @@ static struct snd_pci_quirk alc880_cfg_t
+ 	SND_PCI_QUIRK(0x1025, 0xe309, "ULI", ALC880_3ST_DIG),
+ 	SND_PCI_QUIRK(0x1025, 0xe310, "ULI", ALC880_3ST),
+ 	SND_PCI_QUIRK(0x1039, 0x1234, NULL, ALC880_6ST_DIG),
+-	SND_PCI_QUIRK(0x103c, 0x2a09, "HP", ALC880_5ST),
+ 	SND_PCI_QUIRK(0x1043, 0x10b3, "ASUS W1V", ALC880_ASUS_W1V),
+ 	SND_PCI_QUIRK(0x1043, 0x10c2, "ASUS W6A", ALC880_ASUS_DIG),
+ 	SND_PCI_QUIRK(0x1043, 0x10c3, "ASUS Wxx", ALC880_ASUS_DIG),
diff --git a/queue-2.6.39/asoc-pxa-ssp-correct-check-for-stream-presence.patch b/queue-2.6.39/asoc-pxa-ssp-correct-check-for-stream-presence.patch
new file mode 100644
index 0000000000..680b703da8
--- /dev/null
+++ b/queue-2.6.39/asoc-pxa-ssp-correct-check-for-stream-presence.patch
@@ -0,0 +1,41 @@
+From 53dea36c70c1857149a8c447224e3936eb8b5339 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Wed, 22 Jun 2011 20:48:25 +0200
+Subject: ASoC: pxa-ssp: Correct check for stream presence
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 53dea36c70c1857149a8c447224e3936eb8b5339 upstream.
+
+Don't rely on the codec's channels_min information to decide wheter or
+not allocate a substream's DMA buffer. Rather check if the substream
+itself was allocated previously.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/pxa/pxa2xx-pcm.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/pxa/pxa2xx-pcm.c
++++ b/sound/soc/pxa/pxa2xx-pcm.c
+@@ -95,14 +95,14 @@ static int pxa2xx_soc_pcm_new(struct snd
+ 	if (!card->dev->coherent_dma_mask)
+ 		card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
+ 
+-	if (dai->driver->playback.channels_min) {
++	if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) {
+ 		ret = pxa2xx_pcm_preallocate_dma_buffer(pcm,
+ 			SNDRV_PCM_STREAM_PLAYBACK);
+ 		if (ret)
+ 			goto out;
+ 	}
+ 
+-	if (dai->driver->capture.channels_min) {
++	if (pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream) {
+ 		ret = pxa2xx_pcm_preallocate_dma_buffer(pcm,
+ 			SNDRV_PCM_STREAM_CAPTURE);
+ 		if (ret)
diff --git a/queue-2.6.39/block-add-req_secure-to-req_common_mask.patch b/queue-2.6.39/block-add-req_secure-to-req_common_mask.patch
new file mode 100644
index 0000000000..f6929d9777
--- /dev/null
+++ b/queue-2.6.39/block-add-req_secure-to-req_common_mask.patch
@@ -0,0 +1,32 @@
+From 155d109b5f52ffd749219b27702462dcd9cf4f8d Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Mon, 20 Jun 2011 13:23:14 +0200
+Subject: block: add REQ_SECURE to REQ_COMMON_MASK
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit 155d109b5f52ffd749219b27702462dcd9cf4f8d upstream.
+
+Add REQ_SECURE flag to REQ_COMMON_MASK so that
+init_request_from_bio() can pass it to @req->cmd_flags.
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/blk_types.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/blk_types.h
++++ b/include/linux/blk_types.h
+@@ -168,7 +168,7 @@ enum rq_flag_bits {
+ 	(REQ_FAILFAST_DEV | REQ_FAILFAST_TRANSPORT | REQ_FAILFAST_DRIVER)
+ #define REQ_COMMON_MASK \
+ 	(REQ_WRITE | REQ_FAILFAST_MASK | REQ_SYNC | REQ_META | REQ_DISCARD | \
+-	 REQ_NOIDLE | REQ_FLUSH | REQ_FUA)
++	 REQ_NOIDLE | REQ_FLUSH | REQ_FUA | REQ_SECURE)
+ #define REQ_CLONE_MASK		REQ_COMMON_MASK
+ 
+ #define REQ_RAHEAD		(1 << __REQ_RAHEAD)
diff --git a/queue-2.6.39/block-use-the-passed-in-bdev-when-claiming-if-partno-is.patch b/queue-2.6.39/block-use-the-passed-in-bdev-when-claiming-if-partno-is.patch
new file mode 100644
index 0000000000..8e8b914425
--- /dev/null
+++ b/queue-2.6.39/block-use-the-passed-in-bdev-when-claiming-if-partno-is.patch
@@ -0,0 +1,67 @@
+From d4c208b86b8be4254eba0e74071496e599f94639 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 13 Jun 2011 12:45:48 +0200
+Subject: block: use the passed in @bdev when claiming if partno is
+ zero
+
+From: Tejun Heo <tj@kernel.org>
+
+commit d4c208b86b8be4254eba0e74071496e599f94639 upstream.
+
+6b4517a791 (block: implement bd_claiming and claiming block)
+introduced claiming block to support O_EXCL blkdev opens properly.
+
+bd_start_claiming() looks up the part 0 bdev and starts claiming
+block.  The function assumed that there is only one part 0 bdev and
+always used bdget_disk(disk, 0) to look it up; unfortunately, this
+isn't true for some drivers (floppy) which use multiple block devices
+to denote different operating parameters for the same physical device.
+There can be multiple part 0 bdev's for the same device number.
+
+This incorrect assumption caused the wrong bdev to be used during
+claiming leading to unbalanced bd_holders as reported in the following
+bug.
+
+  https://bugzilla.kernel.org/show_bug.cgi?id=28522
+
+This patch updates bd_start_claiming() such that it uses the bdev
+specified as argument if its partno is zero.
+
+Note that this means that different bdev's can be used for the same
+device and O_EXCL check can be effectively bypassed.  It has always
+been broken that way and floppy is fortunately on its way out.  Leave
+that breakage alone.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Alex Villacis Lasso <avillaci@ceibo.fiec.espol.edu.ec>
+Tested-by: Alex Villacis Lasso <avillaci@ceibo.fiec.espol.edu.ec>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/block_dev.c |   14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -762,7 +762,19 @@ static struct block_device *bd_start_cla
+ 	if (!disk)
+ 		return ERR_PTR(-ENXIO);
+ 
+-	whole = bdget_disk(disk, 0);
++	/*
++	 * Normally, @bdev should equal what's returned from bdget_disk()
++	 * if partno is 0; however, some drivers (floppy) use multiple
++	 * bdev's for the same physical device and @bdev may be one of the
++	 * aliases.  Keep @bdev if partno is 0.  This means claimer
++	 * tracking is broken for those devices but it has always been that
++	 * way.
++	 */
++	if (partno)
++		whole = bdget_disk(disk, 0);
++	else
++		whole = bdgrab(bdev);
++
+ 	module_put(disk->fops->owner);
+ 	put_disk(disk);
+ 	if (!whole)
diff --git a/queue-2.6.39/cfq-iosched-fix-a-rcu-warning.patch b/queue-2.6.39/cfq-iosched-fix-a-rcu-warning.patch
new file mode 100644
index 0000000000..f14d69fdbc
--- /dev/null
+++ b/queue-2.6.39/cfq-iosched-fix-a-rcu-warning.patch
@@ -0,0 +1,38 @@
+From 3181faa85bda3dc3f5e630a1846526c9caaa38e3 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Mon, 27 Jun 2011 09:03:47 +0200
+Subject: cfq-iosched: fix a rcu warning
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 3181faa85bda3dc3f5e630a1846526c9caaa38e3 upstream.
+
+I got a rcu warnning at boot. the ioc->ioc_data is rcu_deferenced, but
+doesn't hold rcu_read_lock.
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/cfq-iosched.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -2704,11 +2704,14 @@ static void __cfq_exit_single_io_context
+ 	smp_wmb();
+ 	cic->key = cfqd_dead_key(cfqd);
+ 
++	rcu_read_lock();
+ 	if (rcu_dereference(ioc->ioc_data) == cic) {
++		rcu_read_unlock();
+ 		spin_lock(&ioc->lock);
+ 		rcu_assign_pointer(ioc->ioc_data, NULL);
+ 		spin_unlock(&ioc->lock);
+-	}
++	} else
++		rcu_read_unlock();
+ 
+ 	if (cic->cfqq[BLK_RW_ASYNC]) {
+ 		cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
diff --git a/queue-2.6.39/cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch b/queue-2.6.39/cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch
new file mode 100644
index 0000000000..05a13bb1e2
--- /dev/null
+++ b/queue-2.6.39/cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch
@@ -0,0 +1,47 @@
+From ab4bd22d3cce6977dc039664cc2d052e3147d662 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <jaxboe@fusionio.com>
+Date: Sun, 5 Jun 2011 06:01:13 +0200
+Subject: cfq-iosched: fix locking around ioc->ioc_data assignment
+
+From: Jens Axboe <jaxboe@fusionio.com>
+
+commit ab4bd22d3cce6977dc039664cc2d052e3147d662 upstream.
+
+Since we are modifying this RCU pointer, we need to hold
+the lock protecting it around it.
+
+This fixes a potential reuse and double free of a cfq
+io_context structure. The bug has been in CFQ for a long
+time, it hit very few people but those it did hit seemed
+to see it a lot.
+
+Tracked in RH bugzilla here:
+
+https://bugzilla.redhat.com/show_bug.cgi?id=577968
+
+Credit goes to Paul Bolle for figuring out that the issue
+was around the one-hit ioc->ioc_data cache. Thanks to his
+hard work the issue is now fixed.
+
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/cfq-iosched.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -2704,8 +2704,11 @@ static void __cfq_exit_single_io_context
+ 	smp_wmb();
+ 	cic->key = cfqd_dead_key(cfqd);
+ 
+-	if (ioc->ioc_data == cic)
++	if (rcu_dereference(ioc->ioc_data) == cic) {
++		spin_lock(&ioc->lock);
+ 		rcu_assign_pointer(ioc->ioc_data, NULL);
++		spin_unlock(&ioc->lock);
++	}
+ 
+ 	if (cic->cfqq[BLK_RW_ASYNC]) {
+ 		cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
diff --git a/queue-2.6.39/cfq-iosched-make-code-consistent.patch b/queue-2.6.39/cfq-iosched-make-code-consistent.patch
new file mode 100644
index 0000000000..b33bba9c91
--- /dev/null
+++ b/queue-2.6.39/cfq-iosched-make-code-consistent.patch
@@ -0,0 +1,32 @@
+From 726e99ab88db059fe1422e15376ae404f8c66eb4 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Mon, 27 Jun 2011 09:03:48 +0200
+Subject: cfq-iosched: make code consistent
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 726e99ab88db059fe1422e15376ae404f8c66eb4 upstream.
+
+ioc->ioc_data is rcu protectd, so uses correct API to access it.
+This doesn't change any behavior, but just make code consistent.
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/cfq-iosched.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -3018,7 +3018,8 @@ cfq_drop_dead_cic(struct cfq_data *cfqd,
+ 
+ 	spin_lock_irqsave(&ioc->lock, flags);
+ 
+-	BUG_ON(ioc->ioc_data == cic);
++	BUG_ON(rcu_dereference_check(ioc->ioc_data,
++		lockdep_is_held(&ioc->lock)) == cic);
+ 
+ 	radix_tree_delete(&ioc->radix_root, cfqd->cic_index);
+ 	hlist_del_rcu(&cic->cic_list);
diff --git a/queue-2.6.39/debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch b/queue-2.6.39/debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch
new file mode 100644
index 0000000000..8953457f22
--- /dev/null
+++ b/queue-2.6.39/debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch
@@ -0,0 +1,64 @@
+From 161b6ae0e067e421b20bb35caf66bdb405c929ac Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Sat, 28 May 2011 13:23:42 +0200
+Subject: debugobjects: Fix boot crash when kmemleak and debugobjects
+ enabled
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit 161b6ae0e067e421b20bb35caf66bdb405c929ac upstream.
+
+Order of initialization look like this:
+...
+debugobjects
+kmemleak
+...(lots of other subsystems)...
+workqueues (through early initcall)
+...
+
+debugobjects use schedule_work for batch freeing of its data and kmemleak
+heavily use debugobjects, so when it comes to freeing and workqueues were
+not initialized yet, kernel crashes:
+
+BUG: unable to handle kernel NULL pointer dereference at           (null)
+IP: [<ffffffff810854d1>] __queue_work+0x29/0x41a
+ [<ffffffff81085910>] queue_work_on+0x16/0x1d
+ [<ffffffff81085abc>] queue_work+0x29/0x55
+ [<ffffffff81085afb>] schedule_work+0x13/0x15
+ [<ffffffff81242de1>] free_object+0x90/0x95
+ [<ffffffff81242f6d>] debug_check_no_obj_freed+0x187/0x1d3
+ [<ffffffff814b6504>] ? _raw_spin_unlock_irqrestore+0x30/0x4d
+ [<ffffffff8110bd14>] ? free_object_rcu+0x68/0x6d
+ [<ffffffff8110890c>] kmem_cache_free+0x64/0x12c
+ [<ffffffff8110bd14>] free_object_rcu+0x68/0x6d
+ [<ffffffff810b58bc>] __rcu_process_callbacks+0x1b6/0x2d9
+...
+
+because system_wq is NULL.
+
+Fix it by checking if workqueues susbystem was initialized before using.
+
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Dipankar Sarma <dipankar@in.ibm.com>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/20110528112342.GA3068@joi.lan
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/debugobjects.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -198,7 +198,7 @@ static void free_object(struct debug_obj
+ 	 * initialized:
+ 	 */
+ 	if (obj_pool_free > ODEBUG_POOL_SIZE && obj_cache)
+-		sched = !work_pending(&debug_obj_work);
++		sched = keventd_up() && !work_pending(&debug_obj_work);
+ 	hlist_add_head(&obj->node, &obj_pool);
+ 	obj_pool_free++;
+ 	obj_pool_used--;
diff --git a/queue-2.6.39/drivers-base-platform.c-don-t-mark.patch b/queue-2.6.39/drivers-base-platform.c-don-t-mark.patch
new file mode 100644
index 0000000000..57de2818cc
--- /dev/null
+++ b/queue-2.6.39/drivers-base-platform.c-don-t-mark.patch
@@ -0,0 +1,43 @@
+From bb2b43fefab723f4a0760146e7bed59d41a50e53 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Mon, 23 May 2011 14:44:19 -0700
+Subject: drivers/base/platform.c: don't mark
+ platform_device_register_resndata() as __init_or_module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit bb2b43fefab723f4a0760146e7bed59d41a50e53 upstream.
+
+This reverts 737a3bb9416ce2a7c7a4 ("Driver core: move platform device
+creation helpers to .init.text (if MODULE=n)").  That patch assumed that
+platform_device_register_resndata() is only ever called from __init code
+but that isn't true in the case ioctl->drm_ioctl->radeon_cp_init().
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=35192
+
+Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reported-by: Anthony Basile <blueness@gentoo.org>
+Cc: Greg KH <gregkh@suse.de>
+Cc: David Airlie <airlied@linux.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/platform.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -367,7 +367,7 @@ EXPORT_SYMBOL_GPL(platform_device_unregi
+  *
+  * Returns &struct platform_device pointer on success, or ERR_PTR() on error.
+  */
+-struct platform_device *__init_or_module platform_device_register_resndata(
++struct platform_device *platform_device_register_resndata(
+ 		struct device *parent,
+ 		const char *name, int id,
+ 		const struct resource *res, unsigned int num,
diff --git a/queue-2.6.39/drivers-misc-lkdtm.c-fix-race-when-crashpoint-is-hit.patch b/queue-2.6.39/drivers-misc-lkdtm.c-fix-race-when-crashpoint-is-hit.patch
new file mode 100644
index 0000000000..3411862ba1
--- /dev/null
+++ b/queue-2.6.39/drivers-misc-lkdtm.c-fix-race-when-crashpoint-is-hit.patch
@@ -0,0 +1,69 @@
+From aa2c96d6f329e66cc59352b0f12e8f04e6a9593b Mon Sep 17 00:00:00 2001
+From: Josh Hunt <johunt@akamai.com>
+Date: Mon, 27 Jun 2011 16:18:08 -0700
+Subject: drivers/misc/lkdtm.c: fix race when crashpoint is hit
+ multiple times before checking count
+
+From: Josh Hunt <johunt@akamai.com>
+
+commit aa2c96d6f329e66cc59352b0f12e8f04e6a9593b upstream.
+
+We observed the crash point count going negative in cases where the
+crash point is hit multiple times before the check of "count == 0" is
+done.  Because of this we never call lkdtm_do_action().  This patch just
+adds a spinlock to protect count.
+
+Reported-by: Tapan Dhimant <tdhimant@akamai.com>
+Signed-off-by: Josh Hunt <johunt@akamai.com>
+Acked-by: Ankita Garg <ankita@in.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/lkdtm.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/misc/lkdtm.c
++++ b/drivers/misc/lkdtm.c
+@@ -120,6 +120,7 @@ static int recur_count = REC_NUM_DEFAULT
+ static enum cname cpoint = CN_INVALID;
+ static enum ctype cptype = CT_NONE;
+ static int count = DEFAULT_COUNT;
++static DEFINE_SPINLOCK(count_lock);
+ 
+ module_param(recur_count, int, 0644);
+ MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
+@@ -230,11 +231,14 @@ static const char *cp_name_to_str(enum c
+ static int lkdtm_parse_commandline(void)
+ {
+ 	int i;
++	unsigned long flags;
+ 
+ 	if (cpoint_count < 1 || recur_count < 1)
+ 		return -EINVAL;
+ 
++	spin_lock_irqsave(&count_lock, flags);
+ 	count = cpoint_count;
++	spin_unlock_irqrestore(&count_lock, flags);
+ 
+ 	/* No special parameters */
+ 	if (!cpoint_type && !cpoint_name)
+@@ -349,6 +353,9 @@ static void lkdtm_do_action(enum ctype w
+ 
+ static void lkdtm_handler(void)
+ {
++	unsigned long flags;
++
++	spin_lock_irqsave(&count_lock, flags);
+ 	count--;
+ 	printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
+ 			cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
+@@ -357,6 +364,7 @@ static void lkdtm_handler(void)
+ 		lkdtm_do_action(cptype);
+ 		count = cpoint_count;
+ 	}
++	spin_unlock_irqrestore(&count_lock, flags);
+ }
+ 
+ static int lkdtm_register_cpoint(enum cname which)
diff --git a/queue-2.6.39/fix-cpu-spinlock-lockups-on-secondary-cpu-bringup.patch b/queue-2.6.39/fix-cpu-spinlock-lockups-on-secondary-cpu-bringup.patch
new file mode 100644
index 0000000000..b3d32b585b
--- /dev/null
+++ b/queue-2.6.39/fix-cpu-spinlock-lockups-on-secondary-cpu-bringup.patch
@@ -0,0 +1,94 @@
+From 1b19ca9f0bdab7d5035821e1ec8f39df9a6e3ee0 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Wed, 22 Jun 2011 11:55:50 +0100
+Subject: Fix CPU spinlock lockups on secondary CPU bringup
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 1b19ca9f0bdab7d5035821e1ec8f39df9a6e3ee0 upstream.
+
+Secondary CPU bringup typically calls calibrate_delay() during its
+initialization.  However, calibrate_delay() modifies a global variable
+(loops_per_jiffy) used for udelay() and __delay().
+
+A side effect of 71c696b1 ("calibrate: extract fall-back calculation
+into own helper") introduced in the 2.6.39 merge window means that we
+end up with a substantial period where loops_per_jiffy is zero.  This
+causes the spinlock debugging code to malfunction:
+
+	u64 loops = loops_per_jiffy * HZ;
+	for (;;) {
+		for (i = 0; i < loops; i++) {
+			if (arch_spin_trylock(&lock->raw_lock))
+				return;
+			__delay(1);
+		}
+		...
+	}
+
+by never calling arch_spin_trylock() - resulting in the CPU locking
+up in an infinite loop inside __spin_lock_debug().
+
+Work around this by only writing to loops_per_jiffy only once we have
+completed all the calibration decisions.
+
+Tested-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: <stable@kernel.org> (2.6.39-stable)
+--
+Better solutions (such as omitting the calibration for secondary CPUs,
+or arranging for calibrate_delay() to return the LPJ value and leave
+it to the caller to decide where to store it) are a possibility, but
+would be much more invasive into each architecture.
+
+I think this is the best solution for -rc and stable, but it should be
+revisited for the next merge window.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ init/calibrate.c |   14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/init/calibrate.c
++++ b/init/calibrate.c
+@@ -185,30 +185,32 @@ recalibrate:
+ 
+ void __cpuinit calibrate_delay(void)
+ {
++	unsigned long lpj;
+ 	static bool printed;
+ 
+ 	if (preset_lpj) {
+-		loops_per_jiffy = preset_lpj;
++		lpj = preset_lpj;
+ 		if (!printed)
+ 			pr_info("Calibrating delay loop (skipped) "
+ 				"preset value.. ");
+ 	} else if ((!printed) && lpj_fine) {
+-		loops_per_jiffy = lpj_fine;
++		lpj = lpj_fine;
+ 		pr_info("Calibrating delay loop (skipped), "
+ 			"value calculated using timer frequency.. ");
+-	} else if ((loops_per_jiffy = calibrate_delay_direct()) != 0) {
++	} else if ((lpj = calibrate_delay_direct()) != 0) {
+ 		if (!printed)
+ 			pr_info("Calibrating delay using timer "
+ 				"specific routine.. ");
+ 	} else {
+ 		if (!printed)
+ 			pr_info("Calibrating delay loop... ");
+-		loops_per_jiffy = calibrate_delay_converge();
++		lpj = calibrate_delay_converge();
+ 	}
+ 	if (!printed)
+ 		pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n",
+-			loops_per_jiffy/(500000/HZ),
+-			(loops_per_jiffy/(5000/HZ)) % 100, loops_per_jiffy);
++			lpj/(500000/HZ),
++			(lpj/(5000/HZ)) % 100, lpj);
+ 
++	loops_per_jiffy = lpj;
+ 	printed = true;
+ }
diff --git a/queue-2.6.39/fs-cache-add-a-helper-to-bulk-uncache-pages-on-an-inode.patch b/queue-2.6.39/fs-cache-add-a-helper-to-bulk-uncache-pages-on-an-inode.patch
new file mode 100644
index 0000000000..ca4ff0eb17
--- /dev/null
+++ b/queue-2.6.39/fs-cache-add-a-helper-to-bulk-uncache-pages-on-an-inode.patch
@@ -0,0 +1,221 @@
+From c902ce1bfb40d8b049bd2319b388b4b68b04bc27 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 7 Jul 2011 12:19:48 +0100
+Subject: FS-Cache: Add a helper to bulk uncache pages on an inode
+
+From: David Howells <dhowells@redhat.com>
+
+commit c902ce1bfb40d8b049bd2319b388b4b68b04bc27 upstream.
+
+Add an FS-Cache helper to bulk uncache pages on an inode.  This will
+only work for the circumstance where the pages in the cache correspond
+1:1 with the pages attached to an inode's page cache.
+
+This is required for CIFS and NFS: When disabling inode cookie, we were
+returning the cookie and setting cifsi->fscache to NULL but failed to
+invalidate any previously mapped pages.  This resulted in "Bad page
+state" errors and manifested in other kind of errors when running
+fsstress.  Fix it by uncaching mapped pages when we disable the inode
+cookie.
+
+This patch should fix the following oops and "Bad page state" errors
+seen during fsstress testing.
+
+  ------------[ cut here ]------------
+  kernel BUG at fs/cachefiles/namei.c:201!
+  invalid opcode: 0000 [#1] SMP
+  Pid: 5, comm: kworker/u:0 Not tainted 2.6.38.7-30.fc15.x86_64 #1 Bochs Bochs
+  RIP: 0010: cachefiles_walk_to_object+0x436/0x745 [cachefiles]
+  RSP: 0018:ffff88002ce6dd00  EFLAGS: 00010282
+  RAX: ffff88002ef165f0 RBX: ffff88001811f500 RCX: 0000000000000000
+  RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000282
+  RBP: ffff88002ce6dda0 R08: 0000000000000100 R09: ffffffff81b3a300
+  R10: 0000ffff00066c0a R11: 0000000000000003 R12: ffff88002ae54840
+  R13: ffff88002ae54840 R14: ffff880029c29c00 R15: ffff88001811f4b0
+  FS:  00007f394dd32720(0000) GS:ffff88002ef00000(0000) knlGS:0000000000000000
+  CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+  CR2: 00007fffcb62ddf8 CR3: 000000001825f000 CR4: 00000000000006e0
+  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+  Process kworker/u:0 (pid: 5, threadinfo ffff88002ce6c000, task ffff88002ce55cc0)
+  Stack:
+   0000000000000246 ffff88002ce55cc0 ffff88002ce6dd58 ffff88001815dc00
+   ffff8800185246c0 ffff88001811f618 ffff880029c29d18 ffff88001811f380
+   ffff88002ce6dd50 ffffffff814757e4 ffff88002ce6dda0 ffffffff8106ac56
+  Call Trace:
+   cachefiles_lookup_object+0x78/0xd4 [cachefiles]
+   fscache_lookup_object+0x131/0x16d [fscache]
+   fscache_object_work_func+0x1bc/0x669 [fscache]
+   process_one_work+0x186/0x298
+   worker_thread+0xda/0x15d
+   kthread+0x84/0x8c
+   kernel_thread_helper+0x4/0x10
+  RIP  cachefiles_walk_to_object+0x436/0x745 [cachefiles]
+  ---[ end trace 1d481c9af1804caa ]---
+
+I tested the uncaching by the following means:
+
+ (1) Create a big file on my NFS server (104857600 bytes).
+
+ (2) Read the file into the cache with md5sum on the NFS client.  Look in
+     /proc/fs/fscache/stats:
+
+	Pages  : mrk=25601 unc=0
+
+ (3) Open the file for read/write ("bash 5<>/warthog/bigfile").  Look in proc
+     again:
+
+	Pages  : mrk=25601 unc=25601
+
+Reported-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-and-Tested-by: Suresh Jayaraman <sjayaraman@suse.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/filesystems/caching/netfs-api.txt |   16 ++++++++
+ fs/cifs/fscache.c                               |    1 
+ fs/fscache/page.c                               |   44 ++++++++++++++++++++++++
+ fs/nfs/fscache.c                                |    8 +---
+ include/linux/fscache.h                         |   21 +++++++++++
+ 5 files changed, 85 insertions(+), 5 deletions(-)
+
+--- a/Documentation/filesystems/caching/netfs-api.txt
++++ b/Documentation/filesystems/caching/netfs-api.txt
+@@ -673,6 +673,22 @@ storage request to complete, or it may a
+ in which case the page will not be stored in the cache this time.
+ 
+ 
++BULK INODE PAGE UNCACHE
++-----------------------
++
++A convenience routine is provided to perform an uncache on all the pages
++attached to an inode.  This assumes that the pages on the inode correspond on a
++1:1 basis with the pages in the cache.
++
++	void fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
++					     struct inode *inode);
++
++This takes the netfs cookie that the pages were cached with and the inode that
++the pages are attached to.  This function will wait for pages to finish being
++written to the cache and for the cache to finish with the page generally.  No
++error is returned.
++
++
+ ==========================
+ INDEX AND DATA FILE UPDATE
+ ==========================
+--- a/fs/cifs/fscache.c
++++ b/fs/cifs/fscache.c
+@@ -94,6 +94,7 @@ static void cifs_fscache_disable_inode_c
+ 	if (cifsi->fscache) {
+ 		cFYI(1, "CIFS disabling inode cookie (0x%p)",
+ 				cifsi->fscache);
++		fscache_uncache_all_inode_pages(cifsi->fscache, inode);
+ 		fscache_relinquish_cookie(cifsi->fscache, 1);
+ 		cifsi->fscache = NULL;
+ 	}
+--- a/fs/fscache/page.c
++++ b/fs/fscache/page.c
+@@ -967,3 +967,47 @@ void fscache_mark_pages_cached(struct fs
+ 	pagevec_reinit(pagevec);
+ }
+ EXPORT_SYMBOL(fscache_mark_pages_cached);
++
++/*
++ * Uncache all the pages in an inode that are marked PG_fscache, assuming them
++ * to be associated with the given cookie.
++ */
++void __fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
++				       struct inode *inode)
++{
++	struct address_space *mapping = inode->i_mapping;
++	struct pagevec pvec;
++	pgoff_t next;
++	int i;
++
++	_enter("%p,%p", cookie, inode);
++
++	if (!mapping || mapping->nrpages == 0) {
++		_leave(" [no pages]");
++		return;
++	}
++
++	pagevec_init(&pvec, 0);
++	next = 0;
++	while (next <= (loff_t)-1 &&
++	       pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)
++	       ) {
++		for (i = 0; i < pagevec_count(&pvec); i++) {
++			struct page *page = pvec.pages[i];
++			pgoff_t page_index = page->index;
++
++			ASSERTCMP(page_index, >=, next);
++			next = page_index + 1;
++
++			if (PageFsCache(page)) {
++				__fscache_wait_on_page_write(cookie, page);
++				__fscache_uncache_page(cookie, page);
++			}
++		}
++		pagevec_release(&pvec);
++		cond_resched();
++	}
++
++	_leave("");
++}
++EXPORT_SYMBOL(__fscache_uncache_all_inode_pages);
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -259,12 +259,10 @@ static void nfs_fscache_disable_inode_co
+ 		dfprintk(FSCACHE,
+ 			 "NFS: nfsi 0x%p turning cache off\n", NFS_I(inode));
+ 
+-		/* Need to invalidate any mapped pages that were read in before
+-		 * turning off the cache.
++		/* Need to uncache any pages attached to this inode that
++		 * fscache knows about before turning off the cache.
+ 		 */
+-		if (inode->i_mapping && inode->i_mapping->nrpages)
+-			invalidate_inode_pages2(inode->i_mapping);
+-
++		fscache_uncache_all_inode_pages(NFS_I(inode)->fscache, inode);
+ 		nfs_fscache_zap_inode_cookie(inode);
+ 	}
+ }
+--- a/include/linux/fscache.h
++++ b/include/linux/fscache.h
+@@ -204,6 +204,8 @@ extern bool __fscache_check_page_write(s
+ extern void __fscache_wait_on_page_write(struct fscache_cookie *, struct page *);
+ extern bool __fscache_maybe_release_page(struct fscache_cookie *, struct page *,
+ 					 gfp_t);
++extern void __fscache_uncache_all_inode_pages(struct fscache_cookie *,
++					      struct inode *);
+ 
+ /**
+  * fscache_register_netfs - Register a filesystem as desiring caching services
+@@ -643,4 +645,23 @@ bool fscache_maybe_release_page(struct f
+ 	return false;
+ }
+ 
++/**
++ * fscache_uncache_all_inode_pages - Uncache all an inode's pages
++ * @cookie: The cookie representing the inode's cache object.
++ * @inode: The inode to uncache pages from.
++ *
++ * Uncache all the pages in an inode that are marked PG_fscache, assuming them
++ * to be associated with the given cookie.
++ *
++ * This function may sleep.  It will wait for pages that are being written out
++ * and will wait whilst the PG_fscache mark is removed by the cache.
++ */
++static inline
++void fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
++				     struct inode *inode)
++{
++	if (fscache_cookie_valid(cookie))
++		__fscache_uncache_all_inode_pages(cookie, inode);
++}
++
+ #endif /* _LINUX_FSCACHE_H */
diff --git a/queue-2.6.39/fs-fix-lock-initialization.patch b/queue-2.6.39/fs-fix-lock-initialization.patch
new file mode 100644
index 0000000000..362ca6c428
--- /dev/null
+++ b/queue-2.6.39/fs-fix-lock-initialization.patch
@@ -0,0 +1,79 @@
+From a51cb91d81f8e6fc4e5e08b772cc3ceb13ac9d37 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Wed, 6 Jul 2011 12:33:55 +0200
+Subject: fs: fix lock initialization
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit a51cb91d81f8e6fc4e5e08b772cc3ceb13ac9d37 upstream.
+
+locks_alloc_lock() assumed that the allocated struct file_lock is
+already initialized to zero members.  This is only true for the first
+allocation of the structure, after reuse some of the members will have
+random values.
+
+This will for example result in passing random fl_start values to
+userspace in fuse for FL_FLOCK locks, which is an information leak at
+best.
+
+Fix by reinitializing those members which may be non-zero after freeing.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/locks.c |   30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -160,10 +160,28 @@ EXPORT_SYMBOL_GPL(unlock_flocks);
+ 
+ static struct kmem_cache *filelock_cache __read_mostly;
+ 
++static void locks_init_lock_always(struct file_lock *fl)
++{
++	fl->fl_next = NULL;
++	fl->fl_fasync = NULL;
++	fl->fl_owner = NULL;
++	fl->fl_pid = 0;
++	fl->fl_nspid = NULL;
++	fl->fl_file = NULL;
++	fl->fl_flags = 0;
++	fl->fl_type = 0;
++	fl->fl_start = fl->fl_end = 0;
++}
++
+ /* Allocate an empty lock structure. */
+ struct file_lock *locks_alloc_lock(void)
+ {
+-	return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
++	struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
++
++	if (fl)
++		locks_init_lock_always(fl);
++
++	return fl;
+ }
+ EXPORT_SYMBOL_GPL(locks_alloc_lock);
+ 
+@@ -200,17 +218,9 @@ void locks_init_lock(struct file_lock *f
+ 	INIT_LIST_HEAD(&fl->fl_link);
+ 	INIT_LIST_HEAD(&fl->fl_block);
+ 	init_waitqueue_head(&fl->fl_wait);
+-	fl->fl_next = NULL;
+-	fl->fl_fasync = NULL;
+-	fl->fl_owner = NULL;
+-	fl->fl_pid = 0;
+-	fl->fl_nspid = NULL;
+-	fl->fl_file = NULL;
+-	fl->fl_flags = 0;
+-	fl->fl_type = 0;
+-	fl->fl_start = fl->fl_end = 0;
+ 	fl->fl_ops = NULL;
+ 	fl->fl_lmops = NULL;
++	locks_init_lock_always(fl);
+ }
+ 
+ EXPORT_SYMBOL(locks_init_lock);
diff --git a/queue-2.6.39/hfsplus-add-missing-call-to-bio_put.patch b/queue-2.6.39/hfsplus-add-missing-call-to-bio_put.patch
new file mode 100644
index 0000000000..496108d449
--- /dev/null
+++ b/queue-2.6.39/hfsplus-add-missing-call-to-bio_put.patch
@@ -0,0 +1,43 @@
+From 50176ddefa4a942419cb693dd2d8345bfdcde67c Mon Sep 17 00:00:00 2001
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Tue, 31 May 2011 16:35:50 -0500
+Subject: hfsplus: add missing call to bio_put()
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+commit 50176ddefa4a942419cb693dd2d8345bfdcde67c upstream.
+
+hfsplus leaks bio objects by failing to call bio_put() on the bios
+it allocates. Add the missing call to fix the leak.
+
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hfsplus/wrapper.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/fs/hfsplus/wrapper.c
++++ b/fs/hfsplus/wrapper.c
+@@ -36,6 +36,7 @@ int hfsplus_submit_bio(struct block_devi
+ {
+ 	DECLARE_COMPLETION_ONSTACK(wait);
+ 	struct bio *bio;
++	int ret = 0;
+ 
+ 	bio = bio_alloc(GFP_NOIO, 1);
+ 	bio->bi_sector = sector;
+@@ -54,8 +55,10 @@ int hfsplus_submit_bio(struct block_devi
+ 	wait_for_completion(&wait);
+ 
+ 	if (!bio_flagged(bio, BIO_UPTODATE))
+-		return -EIO;
+-	return 0;
++		ret = -EIO;
++
++	bio_put(bio);
++	return ret;
+ }
+ 
+ static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd)
diff --git a/queue-2.6.39/i2c-pca954x-initialize-the-mux-to-disconnected-state.patch b/queue-2.6.39/i2c-pca954x-initialize-the-mux-to-disconnected-state.patch
new file mode 100644
index 0000000000..9904313851
--- /dev/null
+++ b/queue-2.6.39/i2c-pca954x-initialize-the-mux-to-disconnected-state.patch
@@ -0,0 +1,53 @@
+From cd823db8b1161ef0d756514d280715a576d65cc3 Mon Sep 17 00:00:00 2001
+From: Petri Gynther <pgynther@google.com>
+Date: Wed, 29 Jun 2011 11:36:11 +0200
+Subject: i2c/pca954x: Initialize the mux to disconnected state
+
+From: Petri Gynther <pgynther@google.com>
+
+commit cd823db8b1161ef0d756514d280715a576d65cc3 upstream.
+
+pca954x power-on default is channel 0 connected. If multiple pca954x
+muxes are connected to the same physical I2C bus, the parent bus will
+see channel 0 devices behind both muxes by default. This is bad.
+
+Scenario:
+            -- pca954x @ 0x70 -- ch 0 (I2C-bus-101) -- EEPROM @ 0x50
+            |
+I2C-bus-1 ---
+            |
+            -- pca954x @ 0x71 -- ch 0 (I2C-bus-111) -- EEPROM @ 0x50
+
+1. Load I2C bus driver: creates I2C-bus-1
+2. Load pca954x driver: creates virtual I2C-bus-101 and I2C-bus-111
+3. Load eeprom driver
+4. Try to read EEPROM @ 0x50 on I2C-bus-101. The transaction will also bleed
+   onto I2C-bus-111 because pca954x @ 0x71 channel 0 is connected by default.
+
+Fix: Initialize pca954x to disconnected state in pca954x_probe()
+
+Signed-off-by: Petri Gynther <pgynther@google.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/muxes/pca954x.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/muxes/pca954x.c
++++ b/drivers/i2c/muxes/pca954x.c
+@@ -201,10 +201,11 @@ static int pca954x_probe(struct i2c_clie
+ 
+ 	i2c_set_clientdata(client, data);
+ 
+-	/* Read the mux register at addr to verify
+-	 * that the mux is in fact present.
++	/* Write the mux register at addr to verify
++	 * that the mux is in fact present. This also
++	 * initializes the mux to disconnected state.
+ 	 */
+-	if (i2c_smbus_read_byte(client) < 0) {
++	if (i2c_smbus_write_byte(client, 0) < 0) {
+ 		dev_warn(&client->dev, "probe failed\n");
+ 		goto exit_free;
+ 	}
diff --git a/queue-2.6.39/i2c-taos-evm-fix-log-messages.patch b/queue-2.6.39/i2c-taos-evm-fix-log-messages.patch
new file mode 100644
index 0000000000..97e79336db
--- /dev/null
+++ b/queue-2.6.39/i2c-taos-evm-fix-log-messages.patch
@@ -0,0 +1,58 @@
+From 9b640f2e154268cb516efcaf9c434f2e73c6783e Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Wed, 29 Jun 2011 11:36:10 +0200
+Subject: i2c-taos-evm: Fix log messages
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 9b640f2e154268cb516efcaf9c434f2e73c6783e upstream.
+
+* Print all error and information messages even when debugging is
+  disabled.
+* Don't use adapter device to log messages before it is ready.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/busses/i2c-taos-evm.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-taos-evm.c
++++ b/drivers/i2c/busses/i2c-taos-evm.c
+@@ -234,7 +234,7 @@ static int taos_connect(struct serio *se
+ 
+ 	if (taos->state != TAOS_STATE_IDLE) {
+ 		err = -ENODEV;
+-		dev_dbg(&serio->dev, "TAOS EVM reset failed (state=%d, "
++		dev_err(&serio->dev, "TAOS EVM reset failed (state=%d, "
+ 			"pos=%d)\n", taos->state, taos->pos);
+ 		goto exit_close;
+ 	}
+@@ -255,7 +255,7 @@ static int taos_connect(struct serio *se
+ 					 msecs_to_jiffies(250));
+ 	if (taos->state != TAOS_STATE_IDLE) {
+ 		err = -ENODEV;
+-		dev_err(&adapter->dev, "Echo off failed "
++		dev_err(&serio->dev, "TAOS EVM echo off failed "
+ 			"(state=%d)\n", taos->state);
+ 		goto exit_close;
+ 	}
+@@ -263,7 +263,7 @@ static int taos_connect(struct serio *se
+ 	err = i2c_add_adapter(adapter);
+ 	if (err)
+ 		goto exit_close;
+-	dev_dbg(&serio->dev, "Connected to TAOS EVM\n");
++	dev_info(&serio->dev, "Connected to TAOS EVM\n");
+ 
+ 	taos->client = taos_instantiate_device(adapter);
+ 	return 0;
+@@ -288,7 +288,7 @@ static void taos_disconnect(struct serio
+ 	serio_set_drvdata(serio, NULL);
+ 	kfree(taos);
+ 
+-	dev_dbg(&serio->dev, "Disconnected from TAOS EVM\n");
++	dev_info(&serio->dev, "Disconnected from TAOS EVM\n");
+ }
+ 
+ static struct serio_device_id taos_serio_ids[] = {
diff --git a/queue-2.6.39/input-properly-assign-return-value-of-clamp-macro.patch b/queue-2.6.39/input-properly-assign-return-value-of-clamp-macro.patch
new file mode 100644
index 0000000000..475d982e95
--- /dev/null
+++ b/queue-2.6.39/input-properly-assign-return-value-of-clamp-macro.patch
@@ -0,0 +1,50 @@
+From 8c127f0717b438e6abc3d92d4ae248c4224b9dcb Mon Sep 17 00:00:00 2001
+From: Hans Petter Selasky <hselasky@c2i.net>
+Date: Wed, 25 May 2011 09:24:32 -0700
+Subject: Input: properly assign return value of clamp() macro.
+
+From: Hans Petter Selasky <hselasky@c2i.net>
+
+commit 8c127f0717b438e6abc3d92d4ae248c4224b9dcb upstream.
+
+[dtor@mail.ru: added mousedev changes]
+Signed-off-by: Hans Petter Selasky <hselasky@c2i.net>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/input.c    |    2 +-
+ drivers/input/mousedev.c |    4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -1757,7 +1757,7 @@ static unsigned int input_estimate_event
+ 	} else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
+ 		mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
+ 			   dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
+-		clamp(mt_slots, 2, 32);
++		mt_slots = clamp(mt_slots, 2, 32);
+ 	} else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+ 		mt_slots = 2;
+ 	} else {
+--- a/drivers/input/mousedev.c
++++ b/drivers/input/mousedev.c
+@@ -187,7 +187,7 @@ static void mousedev_abs_event(struct in
+ 		if (size == 0)
+ 			size = xres ? : 1;
+ 
+-		clamp(value, min, max);
++		value = clamp(value, min, max);
+ 
+ 		mousedev->packet.x = ((value - min) * xres) / size;
+ 		mousedev->packet.abs_event = 1;
+@@ -201,7 +201,7 @@ static void mousedev_abs_event(struct in
+ 		if (size == 0)
+ 			size = yres ? : 1;
+ 
+-		clamp(value, min, max);
++		value = clamp(value, min, max);
+ 
+ 		mousedev->packet.y = yres - ((value - min) * yres) / size;
+ 		mousedev->packet.abs_event = 1;
diff --git a/queue-2.6.39/ipv4-fix-multicast-losses.patch b/queue-2.6.39/ipv4-fix-multicast-losses.patch
new file mode 100644
index 0000000000..81e862a401
--- /dev/null
+++ b/queue-2.6.39/ipv4-fix-multicast-losses.patch
@@ -0,0 +1,38 @@
+From b3ba2c0af575db43e42688e7aaa6cb31e3a2d27b Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sat, 18 Jun 2011 11:59:18 -0700
+Subject: ipv4: fix multicast losses
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 9aa3c94ce59066f545521033007abb6441706068 ]
+
+Knut Tidemann found that first packet of a multicast flow was not
+correctly received, and bisected the regression to commit b23dd4fe42b4
+(Make output route lookup return rtable directly.)
+
+Special thanks to Knut, who provided a very nice bug report, including
+sample programs to demonstrate the bug.
+
+Reported-and-bisectedby: Knut Tidemann <knut.andre.tidemann@jotron.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/route.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1914,9 +1914,7 @@ static int ip_route_input_mc(struct sk_b
+ 
+ 	hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
+ 	rth = rt_intern_hash(hash, rth, skb, dev->ifindex);
+-	err = 0;
+-	if (IS_ERR(rth))
+-		err = PTR_ERR(rth);
++	return IS_ERR(rth) ? PTR_ERR(rth) : 0;
+ 
+ e_nobufs:
+ 	return -ENOBUFS;
diff --git a/queue-2.6.39/ipvs-netns-exit-causes-crash-in-conntrack.patch b/queue-2.6.39/ipvs-netns-exit-causes-crash-in-conntrack.patch
new file mode 100644
index 0000000000..3267cdc57c
--- /dev/null
+++ b/queue-2.6.39/ipvs-netns-exit-causes-crash-in-conntrack.patch
@@ -0,0 +1,60 @@
+From 8f4e0a18682d91abfad72ede3d3cb5f3ebdf54b4 Mon Sep 17 00:00:00 2001
+From: Hans Schillstrom <hans.schillstrom@ericsson.com>
+Date: Mon, 13 Jun 2011 09:06:57 +0200
+Subject: IPVS netns exit causes crash in conntrack
+
+From: Hans Schillstrom <hans.schillstrom@ericsson.com>
+
+commit 8f4e0a18682d91abfad72ede3d3cb5f3ebdf54b4 upstream.
+
+Quote from Patric Mc Hardy
+"This looks like nfnetlink.c excited and destroyed the nfnl socket, but
+ip_vs was still holding a reference to a conntrack. When the conntrack
+got destroyed it created a ctnetlink event, causing an oops in
+netlink_has_listeners when trying to use the destroyed nfnetlink
+socket."
+
+If nf_conntrack_netlink is loaded before ip_vs this is not a problem.
+
+This patch simply avoids calling ip_vs_conn_drop_conntrack()
+when netns is dying as suggested by Julian.
+
+Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/ipvs/ip_vs_conn.c |   10 +++++++++-
+ net/netfilter/ipvs/ip_vs_core.c |    1 +
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -776,8 +776,16 @@ static void ip_vs_conn_expire(unsigned l
+ 		if (cp->control)
+ 			ip_vs_control_del(cp);
+ 
+-		if (cp->flags & IP_VS_CONN_F_NFCT)
++		if (cp->flags & IP_VS_CONN_F_NFCT) {
+ 			ip_vs_conn_drop_conntrack(cp);
++			/* Do not access conntracks during subsys cleanup
++			 * because nf_conntrack_find_get can not be used after
++			 * conntrack cleanup for the net.
++			 */
++			smp_rmb();
++			if (ipvs->enable)
++				ip_vs_conn_drop_conntrack(cp);
++		}
+ 
+ 		ip_vs_pe_put(cp->pe);
+ 		kfree(cp->pe_data);
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1965,6 +1965,7 @@ static void __net_exit __ip_vs_dev_clean
+ {
+ 	EnterFunction(2);
+ 	net_ipvs(net)->enable = 0;	/* Disable packet reception */
++	smp_wmb();
+ 	__ip_vs_sync_cleanup(net);
+ 	LeaveFunction(2);
+ }
diff --git a/queue-2.6.39/ite-cir-8709-needs-to-use-pnp-resource-2.patch b/queue-2.6.39/ite-cir-8709-needs-to-use-pnp-resource-2.patch
new file mode 100644
index 0000000000..dbabe967b2
--- /dev/null
+++ b/queue-2.6.39/ite-cir-8709-needs-to-use-pnp-resource-2.patch
@@ -0,0 +1,116 @@
+From 35d136c8dab034ee14aa00d6082229b4b74607da Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Tue, 7 Jun 2011 18:45:17 -0300
+Subject: [media] ite-cir: 8709 needs to use pnp resource 2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 35d136c8dab034ee14aa00d6082229b4b74607da upstream.
+
+Thanks to the intrepid testing and debugging of Matthijs van Drunen, it
+was uncovered that at least some variants of the ITE8709 need to use pnp
+resource 2, rather than 0, for things to function properly. Resource 0
+has a length of only 1, and if you try to bypass the pnp_port_len check
+and use it anyway (with either a length of 1 or 2), the system in
+question's trackpad ceased to function.
+
+The circa lirc 0.8.7 lirc_ite8709 driver used resource 2, but the value
+was (amusingly) changed to 0 by way of a patch from ITE themselves, so I
+don't know if there may be variants where 0 actually *is* correct, but
+at least in this case and in the original lirc_ite8709 driver author's
+case, it sure looks like 2 is the right value.
+
+This fix should probably be applied to all stable kernels with the
+ite-cir driver, lest we nuke more people's trackpads.
+
+Tested-by: Matthijs van Drunen
+CC: Juan Jesús García de Soria <skandalfo@gmail.com>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/rc/ite-cir.c |   12 +++++++++---
+ drivers/media/rc/ite-cir.h |    3 +++
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -1357,6 +1357,7 @@ static const struct ite_dev_params ite_d
+ 	{	/* 0: ITE8704 */
+ 	       .model = "ITE8704 CIR transceiver",
+ 	       .io_region_size = IT87_IOREG_LENGTH,
++	       .io_rsrc_no = 0,
+ 	       .hw_tx_capable = true,
+ 	       .sample_period = (u32) (1000000000ULL / 115200),
+ 	       .tx_carrier_freq = 38000,
+@@ -1381,6 +1382,7 @@ static const struct ite_dev_params ite_d
+ 	{	/* 1: ITE8713 */
+ 	       .model = "ITE8713 CIR transceiver",
+ 	       .io_region_size = IT87_IOREG_LENGTH,
++	       .io_rsrc_no = 0,
+ 	       .hw_tx_capable = true,
+ 	       .sample_period = (u32) (1000000000ULL / 115200),
+ 	       .tx_carrier_freq = 38000,
+@@ -1405,6 +1407,7 @@ static const struct ite_dev_params ite_d
+ 	{	/* 2: ITE8708 */
+ 	       .model = "ITE8708 CIR transceiver",
+ 	       .io_region_size = IT8708_IOREG_LENGTH,
++	       .io_rsrc_no = 0,
+ 	       .hw_tx_capable = true,
+ 	       .sample_period = (u32) (1000000000ULL / 115200),
+ 	       .tx_carrier_freq = 38000,
+@@ -1430,6 +1433,7 @@ static const struct ite_dev_params ite_d
+ 	{	/* 3: ITE8709 */
+ 	       .model = "ITE8709 CIR transceiver",
+ 	       .io_region_size = IT8709_IOREG_LENGTH,
++	       .io_rsrc_no = 2,
+ 	       .hw_tx_capable = true,
+ 	       .sample_period = (u32) (1000000000ULL / 115200),
+ 	       .tx_carrier_freq = 38000,
+@@ -1471,6 +1475,7 @@ static int ite_probe(struct pnp_dev *pde
+ 	struct rc_dev *rdev = NULL;
+ 	int ret = -ENOMEM;
+ 	int model_no;
++	int io_rsrc_no;
+ 
+ 	ite_dbg("%s called", __func__);
+ 
+@@ -1500,10 +1505,11 @@ static int ite_probe(struct pnp_dev *pde
+ 
+ 	/* get the description for the device */
+ 	dev_desc = &ite_dev_descs[model_no];
++	io_rsrc_no = dev_desc->io_rsrc_no;
+ 
+ 	/* validate pnp resources */
+-	if (!pnp_port_valid(pdev, 0) ||
+-	    pnp_port_len(pdev, 0) != dev_desc->io_region_size) {
++	if (!pnp_port_valid(pdev, io_rsrc_no) ||
++	    pnp_port_len(pdev, io_rsrc_no) != dev_desc->io_region_size) {
+ 		dev_err(&pdev->dev, "IR PNP Port not valid!\n");
+ 		goto failure;
+ 	}
+@@ -1514,7 +1520,7 @@ static int ite_probe(struct pnp_dev *pde
+ 	}
+ 
+ 	/* store resource values */
+-	itdev->cir_addr = pnp_port_start(pdev, 0);
++	itdev->cir_addr = pnp_port_start(pdev, io_rsrc_no);
+ 	itdev->cir_irq = pnp_irq(pdev, 0);
+ 
+ 	/* initialize spinlocks */
+--- a/drivers/media/rc/ite-cir.h
++++ b/drivers/media/rc/ite-cir.h
+@@ -57,6 +57,9 @@ struct ite_dev_params {
+ 	/* size of the I/O region */
+ 	int io_region_size;
+ 
++	/* IR pnp I/O resource number */
++	int io_rsrc_no;
++
+ 	/* true if the hardware supports transmission */
+ 	bool hw_tx_capable;
+ 
diff --git a/queue-2.6.39/iwlagn-fix-change_interface-for-p2p-types.patch b/queue-2.6.39/iwlagn-fix-change_interface-for-p2p-types.patch
new file mode 100644
index 0000000000..1296b16af7
--- /dev/null
+++ b/queue-2.6.39/iwlagn-fix-change_interface-for-p2p-types.patch
@@ -0,0 +1,42 @@
+From 5306c0807491e891125f4fb08b04340c91530f57 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 21 Jun 2011 08:28:31 -0700
+Subject: iwlagn: fix change_interface for P2P types
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 5306c0807491e891125f4fb08b04340c91530f57 upstream.
+
+When an interface changes type to a P2P type,
+iwlagn will erroneously set vif->type to the
+P2P type and not the reduced/split type. Fix
+this by keeping "newtype" in another variable
+for the assignment to vif->type.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-core.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -1772,6 +1772,7 @@ int iwl_mac_change_interface(struct ieee
+ 	struct iwl_priv *priv = hw->priv;
+ 	struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+ 	struct iwl_rxon_context *tmp;
++	enum nl80211_iftype newviftype = newtype;
+ 	u32 interface_modes;
+ 	int err;
+ 
+@@ -1814,7 +1815,7 @@ int iwl_mac_change_interface(struct ieee
+ 
+ 	/* success */
+ 	iwl_teardown_interface(priv, vif, true);
+-	vif->type = newtype;
++	vif->type = newviftype;
+ 	vif->p2p = newp2p;
+ 	err = iwl_setup_interface(priv, ctx);
+ 	WARN_ON(err);
diff --git a/queue-2.6.39/keymaps-fix-table-for-pinnacle-pctv-hd-devices.patch b/queue-2.6.39/keymaps-fix-table-for-pinnacle-pctv-hd-devices.patch
new file mode 100644
index 0000000000..a718c58239
--- /dev/null
+++ b/queue-2.6.39/keymaps-fix-table-for-pinnacle-pctv-hd-devices.patch
@@ -0,0 +1,96 @@
+From 1ba9268c2bfeebfd70193145685e12faeae92882 Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Wed, 8 Jun 2011 15:00:01 -0300
+Subject: [media] keymaps: fix table for pinnacle pctv hd devices
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 1ba9268c2bfeebfd70193145685e12faeae92882 upstream.
+
+Both consumers of RC_MAP_PINNACLE_PCTV_HD send along full RC-5
+scancodes, so this update makes this keymap actually *have* full
+scancodes, heisted from rc-dib0700-rc5.c. This should fix out of the box
+remote functionality for the Pinnacle PCTV HD 800i (cx88 pci card) and
+PCTV HD Pro 801e (em28xx usb stick).
+
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c |   58 +++++++++++--------------
+ 1 file changed, 27 insertions(+), 31 deletions(-)
+
+--- a/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c
++++ b/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c
+@@ -15,43 +15,39 @@
+ /* Pinnacle PCTV HD 800i mini remote */
+ 
+ static struct rc_map_table pinnacle_pctv_hd[] = {
+-
+-	{ 0x0f, KEY_1 },
+-	{ 0x15, KEY_2 },
+-	{ 0x10, KEY_3 },
+-	{ 0x18, KEY_4 },
+-	{ 0x1b, KEY_5 },
+-	{ 0x1e, KEY_6 },
+-	{ 0x11, KEY_7 },
+-	{ 0x21, KEY_8 },
+-	{ 0x12, KEY_9 },
+-	{ 0x27, KEY_0 },
+-
+-	{ 0x24, KEY_ZOOM },
+-	{ 0x2a, KEY_SUBTITLE },
+-
+-	{ 0x00, KEY_MUTE },
+-	{ 0x01, KEY_ENTER },	/* Pinnacle Logo */
+-	{ 0x39, KEY_POWER },
+-
+-	{ 0x03, KEY_VOLUMEUP },
+-	{ 0x09, KEY_VOLUMEDOWN },
+-	{ 0x06, KEY_CHANNELUP },
+-	{ 0x0c, KEY_CHANNELDOWN },
+-
+-	{ 0x2d, KEY_REWIND },
+-	{ 0x30, KEY_PLAYPAUSE },
+-	{ 0x33, KEY_FASTFORWARD },
+-	{ 0x3c, KEY_STOP },
+-	{ 0x36, KEY_RECORD },
+-	{ 0x3f, KEY_EPG },	/* Labeled "?" */
++	/* Key codes for the tiny Pinnacle remote*/
++	{ 0x0700, KEY_MUTE },
++	{ 0x0701, KEY_MENU }, /* Pinnacle logo */
++	{ 0x0739, KEY_POWER },
++	{ 0x0703, KEY_VOLUMEUP },
++	{ 0x0709, KEY_VOLUMEDOWN },
++	{ 0x0706, KEY_CHANNELUP },
++	{ 0x070c, KEY_CHANNELDOWN },
++	{ 0x070f, KEY_1 },
++	{ 0x0715, KEY_2 },
++	{ 0x0710, KEY_3 },
++	{ 0x0718, KEY_4 },
++	{ 0x071b, KEY_5 },
++	{ 0x071e, KEY_6 },
++	{ 0x0711, KEY_7 },
++	{ 0x0721, KEY_8 },
++	{ 0x0712, KEY_9 },
++	{ 0x0727, KEY_0 },
++	{ 0x0724, KEY_ZOOM }, /* 'Square' key */
++	{ 0x072a, KEY_SUBTITLE },   /* 'T' key */
++	{ 0x072d, KEY_REWIND },
++	{ 0x0730, KEY_PLAYPAUSE },
++	{ 0x0733, KEY_FASTFORWARD },
++	{ 0x0736, KEY_RECORD },
++	{ 0x073c, KEY_STOP },
++	{ 0x073f, KEY_HELP }, /* '?' key */
+ };
+ 
+ static struct rc_map_list pinnacle_pctv_hd_map = {
+ 	.map = {
+ 		.scan    = pinnacle_pctv_hd,
+ 		.size    = ARRAY_SIZE(pinnacle_pctv_hd),
+-		.rc_type = RC_TYPE_UNKNOWN,	/* Legacy IR type */
++		.rc_type = RC_TYPE_RC5,
+ 		.name    = RC_MAP_PINNACLE_PCTV_HD,
+ 	}
+ };
diff --git a/queue-2.6.39/keys-fix-error-handling-in-construct_key_and_link.patch b/queue-2.6.39/keys-fix-error-handling-in-construct_key_and_link.patch
new file mode 100644
index 0000000000..981d4125bd
--- /dev/null
+++ b/queue-2.6.39/keys-fix-error-handling-in-construct_key_and_link.patch
@@ -0,0 +1,61 @@
+From b1d7dd80aadb9042e83f9778b484a2f92e0b04d4 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 21 Jun 2011 14:32:05 +0100
+Subject: KEYS: Fix error handling in construct_key_and_link()
+
+From: David Howells <dhowells@redhat.com>
+
+commit b1d7dd80aadb9042e83f9778b484a2f92e0b04d4 upstream.
+
+Fix error handling in construct_key_and_link().
+
+If construct_alloc_key() returns an error, it shouldn't pass out through
+the normal path as the key_serial() called by the kleave() statement
+will oops when it gets an error code in the pointer:
+
+  BUG: unable to handle kernel paging request at ffffffffffffff84
+  IP: [<ffffffff8120b401>] request_key_and_link+0x4d7/0x52f
+  ..
+  Call Trace:
+   [<ffffffff8120b52c>] request_key+0x41/0x75
+   [<ffffffffa00ed6e8>] cifs_get_spnego_key+0x206/0x226 [cifs]
+   [<ffffffffa00eb0c9>] CIFS_SessSetup+0x511/0x1234 [cifs]
+   [<ffffffffa00d9799>] cifs_setup_session+0x90/0x1ae [cifs]
+   [<ffffffffa00d9c02>] cifs_get_smb_ses+0x34b/0x40f [cifs]
+   [<ffffffffa00d9e05>] cifs_mount+0x13f/0x504 [cifs]
+   [<ffffffffa00caabb>] cifs_do_mount+0xc4/0x672 [cifs]
+   [<ffffffff8113ae8c>] mount_fs+0x69/0x155
+   [<ffffffff8114ff0e>] vfs_kern_mount+0x63/0xa0
+   [<ffffffff81150be2>] do_kern_mount+0x4d/0xdf
+   [<ffffffff81152278>] do_mount+0x63c/0x69f
+   [<ffffffff8115255c>] sys_mount+0x88/0xc2
+   [<ffffffff814fbdc2>] system_call_fastpath+0x16/0x1b
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/keys/request_key.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -470,7 +470,7 @@ static struct key *construct_key_and_lin
+ 	} else if (ret == -EINPROGRESS) {
+ 		ret = 0;
+ 	} else {
+-		key = ERR_PTR(ret);
++		goto couldnt_alloc_key;
+ 	}
+ 
+ 	key_put(dest_keyring);
+@@ -480,6 +480,7 @@ static struct key *construct_key_and_lin
+ construction_failed:
+ 	key_negate_and_link(key, key_negative_timeout, NULL, NULL);
+ 	key_put(key);
++couldnt_alloc_key:
+ 	key_put(dest_keyring);
+ 	kleave(" = %d", ret);
+ 	return ERR_PTR(ret);
diff --git a/queue-2.6.39/kvm-fix-register-corruption-in-pvclock_scale_delta.patch b/queue-2.6.39/kvm-fix-register-corruption-in-pvclock_scale_delta.patch
new file mode 100644
index 0000000000..98f2af035f
--- /dev/null
+++ b/queue-2.6.39/kvm-fix-register-corruption-in-pvclock_scale_delta.patch
@@ -0,0 +1,47 @@
+From mtosatti@redhat.com  Thu Jul  7 16:30:44 2011
+Date: Thu, 23 Jun 2011 13:35:23 -0300
+Subject: KVM: Fix register corruption in pvclock_scale_delta
+To: greg@kroah.com
+Cc: avi@redhat.com, mtosatti@redhat.com, stable@kernel.org, Zachary Amsden <zamsden@redhat.com>
+Message-ID: <20110623163817.382005133@amt.cnet>
+
+From: Zachary Amsden <zamsden@redhat.com>
+
+(cherry picked from commit de2d1a524e94a79078d9fe22c57c0c6009237547)
+
+The 128-bit multiply in pvclock.h was missing an output constraint for
+EDX which caused a register corruption to appear.  Thanks to Ulrich for
+diagnosing the EDX corruption and Avi for providing this fix.
+
+Signed-off-by: Zachary Amsden <zamsden@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/include/asm/pvclock.h |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/pvclock.h
++++ b/arch/x86/include/asm/pvclock.h
+@@ -22,6 +22,8 @@ static inline u64 pvclock_scale_delta(u6
+ 	u64 product;
+ #ifdef __i386__
+ 	u32 tmp1, tmp2;
++#else
++	ulong tmp;
+ #endif
+ 
+ 	if (shift < 0)
+@@ -42,8 +44,11 @@ static inline u64 pvclock_scale_delta(u6
+ 		: "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
+ #elif defined(__x86_64__)
+ 	__asm__ (
+-		"mul %%rdx ; shrd $32,%%rdx,%%rax"
+-		: "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
++		"mul %[mul_frac] ; shrd $32, %[hi], %[lo]"
++		: [lo]"=a"(product),
++		  [hi]"=d"(tmp)
++		: "0"(delta),
++		  [mul_frac]"rm"((u64)mul_frac));
+ #else
+ #error implement me!
+ #endif
diff --git a/queue-2.6.39/lirc_zilog-fix-spinning-rx-thread.patch b/queue-2.6.39/lirc_zilog-fix-spinning-rx-thread.patch
new file mode 100644
index 0000000000..173c184f5a
--- /dev/null
+++ b/queue-2.6.39/lirc_zilog-fix-spinning-rx-thread.patch
@@ -0,0 +1,45 @@
+From 6a8c97ac92461ec57e36b10572e78d4221e8faa8 Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Wed, 8 Jun 2011 18:56:56 -0300
+Subject: [media] lirc_zilog: fix spinning rx thread
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 6a8c97ac92461ec57e36b10572e78d4221e8faa8 upstream.
+
+We were calling schedule_timeout with the rx thread's task state still
+at TASK_RUNNING, which it shouldn't be. Make sure we call
+set_current_state(TASK_INTERRUPTIBLE) *before* schedule_timeout, and
+we're all good here. I believe this problem was mistakenly introduced in
+commit 5bd6b0464b68d429bc8a3fe6595d19c39dfc4d95, and I'm not sure how I
+missed it before, as I swear I tested the patchset that was included in,
+but alas, stuff happens...
+
+Acked-by: Andy Walls <awalls@md.metrocast.net>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/lirc/lirc_zilog.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/lirc/lirc_zilog.c
++++ b/drivers/staging/lirc/lirc_zilog.c
+@@ -475,14 +475,14 @@ static int lirc_thread(void *arg)
+ 	dprintk("poll thread started\n");
+ 
+ 	while (!kthread_should_stop()) {
++		set_current_state(TASK_INTERRUPTIBLE);
++
+ 		/* if device not opened, we can sleep half a second */
+ 		if (atomic_read(&ir->open_count) == 0) {
+ 			schedule_timeout(HZ/2);
+ 			continue;
+ 		}
+ 
+-		set_current_state(TASK_INTERRUPTIBLE);
+-
+ 		/*
+ 		 * This is ~113*2 + 24 + jitter (2*repeat gap + code length).
+ 		 * We use this interval as the chip resets every time you poll
diff --git a/queue-2.6.39/md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch b/queue-2.6.39/md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch
new file mode 100644
index 0000000000..d9dbd9194e
--- /dev/null
+++ b/queue-2.6.39/md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch
@@ -0,0 +1,43 @@
+From 4274215d24633df7302069e51426659d4759c5ed Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 28 Jun 2011 16:59:42 +1000
+Subject: md: avoid endless recovery loop when waiting for fail device
+ to complete.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 4274215d24633df7302069e51426659d4759c5ed upstream.
+
+If a device fails in a way that causes pending request to take a while
+to complete, md will not be able to immediately remove it from the
+array in remove_and_add_spares.
+It will then incorrectly look like a spare device and md will try to
+recover it even though it is failed.
+This leads to a recovery process starting and instantly aborting over
+and over again.
+
+We should check if the device is faulty before considering it to be a
+spare.  This will avoid trying to start a recovery that cannot
+proceed.
+
+This bug was introduced in 2.6.26 so that patch is suitable for any
+kernel since then.
+
+Reported-by: Jim Paradis <james.paradis@stratus.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7062,6 +7062,7 @@ static int remove_and_add_spares(mddev_t
+ 		list_for_each_entry(rdev, &mddev->disks, same_set) {
+ 			if (rdev->raid_disk >= 0 &&
+ 			    !test_bit(In_sync, &rdev->flags) &&
++			    !test_bit(Faulty, &rdev->flags) &&
+ 			    !test_bit(Blocked, &rdev->flags))
+ 				spares++;
+ 			if (rdev->raid_disk < 0
diff --git a/queue-2.6.39/mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch b/queue-2.6.39/mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch
new file mode 100644
index 0000000000..68733bc57c
--- /dev/null
+++ b/queue-2.6.39/mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch
@@ -0,0 +1,73 @@
+From b0320c7b7d1ac1bd5c2d9dff3258524ab39bad32 Mon Sep 17 00:00:00 2001
+From: Rafael Aquini <aquini@linux.com>
+Date: Wed, 15 Jun 2011 15:08:39 -0700
+Subject: mm: fix negative commitlimit when gigantic hugepages are
+ allocated
+
+From: Rafael Aquini <aquini@linux.com>
+
+commit b0320c7b7d1ac1bd5c2d9dff3258524ab39bad32 upstream.
+
+When 1GB hugepages are allocated on a system, free(1) reports less
+available memory than what really is installed in the box.  Also, if the
+total size of hugepages allocated on a system is over half of the total
+memory size, CommitLimit becomes a negative number.
+
+The problem is that gigantic hugepages (order > MAX_ORDER) can only be
+allocated at boot with bootmem, thus its frames are not accounted to
+'totalram_pages'.  However, they are accounted to hugetlb_total_pages()
+
+What happens to turn CommitLimit into a negative number is this
+calculation, in fs/proc/meminfo.c:
+
+        allowed = ((totalram_pages - hugetlb_total_pages())
+                * sysctl_overcommit_ratio / 100) + total_swap_pages;
+
+A similar calculation occurs in __vm_enough_memory() in mm/mmap.c.
+
+Also, every vm statistic which depends on 'totalram_pages' will render
+confusing values, as if system were 'missing' some part of its memory.
+
+Impact of this bug:
+
+When gigantic hugepages are allocated and sysctl_overcommit_memory ==
+OVERCOMMIT_NEVER.  In a such situation, __vm_enough_memory() goes through
+the mentioned 'allowed' calculation and might end up mistakenly returning
+-ENOMEM, thus forcing the system to start reclaiming pages earlier than it
+would be ususal, and this could cause detrimental impact to overall
+system's performance, depending on the workload.
+
+Besides the aforementioned scenario, I can only think of this causing
+annoyances with memory reports from /proc/meminfo and free(1).
+
+[akpm@linux-foundation.org: standardize comment layout]
+Reported-by: Russ Anderson <rja@sgi.com>
+Signed-off-by: Rafael Aquini <aquini@linux.com>
+Acked-by: Russ Anderson <rja@sgi.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Christoph Lameter <cl@linux.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1111,6 +1111,14 @@ static void __init gather_bootmem_preall
+ 		WARN_ON(page_count(page) != 1);
+ 		prep_compound_huge_page(page, h->order);
+ 		prep_new_huge_page(h, page, page_to_nid(page));
++		/*
++		 * If we had gigantic hugepages allocated at boot time, we need
++		 * to restore the 'stolen' pages to totalram_pages in order to
++		 * fix confusing memory reports from free(1) and another
++		 * side-effects, like CommitLimit going negative.
++		 */
++		if (h->order > (MAX_ORDER - 1))
++			totalram_pages += 1 << h->order;
+ 	}
+ }
+ 
diff --git a/queue-2.6.39/mm-hotplug-fix-error-handling-in-mem_online_node.patch b/queue-2.6.39/mm-hotplug-fix-error-handling-in-mem_online_node.patch
new file mode 100644
index 0000000000..5d58c9bcfa
--- /dev/null
+++ b/queue-2.6.39/mm-hotplug-fix-error-handling-in-mem_online_node.patch
@@ -0,0 +1,41 @@
+From 7553e8f2d5161a2b7a9b7a9f37be1b77e735552f Mon Sep 17 00:00:00 2001
+From: David Rientjes <rientjes@google.com>
+Date: Wed, 22 Jun 2011 18:13:01 -0700
+Subject: mm, hotplug: fix error handling in mem_online_node()
+
+From: David Rientjes <rientjes@google.com>
+
+commit 7553e8f2d5161a2b7a9b7a9f37be1b77e735552f upstream.
+
+The error handling in mem_online_node() is incorrect: hotadd_new_pgdat()
+returns NULL if the new pgdat could not have been allocated and a pointer
+to it otherwise.
+
+mem_online_node() should fail if hotadd_new_pgdat() fails, not the
+inverse.  This fixes an issue when memoryless nodes are not onlined and
+their sysfs interface is not registered when their first cpu is brought
+up.
+
+The bug was introduced by commit cf23422b9d76 ("cpu/mem hotplug: enable
+CPUs online before local memory online") iow v2.6.35.
+
+Signed-off-by: David Rientjes <rientjes@google.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memory_hotplug.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -518,7 +518,7 @@ int mem_online_node(int nid)
+ 
+ 	lock_memory_hotplug();
+ 	pgdat = hotadd_new_pgdat(nid, 0);
+-	if (pgdat) {
++	if (!pgdat) {
+ 		ret = -ENOMEM;
+ 		goto out;
+ 	}
diff --git a/queue-2.6.39/mmc-add-pci-fixup-quirks-for-ricoh-1180-e823-reader.patch b/queue-2.6.39/mmc-add-pci-fixup-quirks-for-ricoh-1180-e823-reader.patch
new file mode 100644
index 0000000000..2209eae75e
--- /dev/null
+++ b/queue-2.6.39/mmc-add-pci-fixup-quirks-for-ricoh-1180-e823-reader.patch
@@ -0,0 +1,39 @@
+From be98ca652faa6468916a9b7608befff215a8ca70 Mon Sep 17 00:00:00 2001
+From: Manoj Iyer <manoj.iyer@canonical.com>
+Date: Thu, 26 May 2011 11:19:05 -0500
+Subject: mmc: Add PCI fixup quirks for Ricoh 1180:e823 reader
+
+From: Manoj Iyer <manoj.iyer@canonical.com>
+
+commit be98ca652faa6468916a9b7608befff215a8ca70 upstream.
+
+Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c    |    2 ++
+ include/linux/pci_ids.h |    1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2758,6 +2758,8 @@ static void ricoh_mmc_fixup_r5c832(struc
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
+ #endif /*CONFIG_MMC_RICOH_MMC*/
+ 
+ #if defined(CONFIG_DMAR) || defined(CONFIG_INTR_REMAP)
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1537,6 +1537,7 @@
+ #define PCI_DEVICE_ID_RICOH_RL5C476	0x0476
+ #define PCI_DEVICE_ID_RICOH_RL5C478	0x0478
+ #define PCI_DEVICE_ID_RICOH_R5C822	0x0822
++#define PCI_DEVICE_ID_RICOH_R5CE823	0xe823
+ #define PCI_DEVICE_ID_RICOH_R5C832	0x0832
+ #define PCI_DEVICE_ID_RICOH_R5C843	0x0843
+ 
diff --git a/queue-2.6.39/mmc-tmio-fix-regression-in-tmio_mmc_wrprotect_disable.patch b/queue-2.6.39/mmc-tmio-fix-regression-in-tmio_mmc_wrprotect_disable.patch
new file mode 100644
index 0000000000..6da81edea0
--- /dev/null
+++ b/queue-2.6.39/mmc-tmio-fix-regression-in-tmio_mmc_wrprotect_disable.patch
@@ -0,0 +1,35 @@
+From 7d8b4c2a4b73da8e3632603691838ca5b2a8c26d Mon Sep 17 00:00:00 2001
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Mon, 20 Jun 2011 16:51:10 +0200
+Subject: mmc: tmio: fix regression in TMIO_MMC_WRPROTECT_DISABLE
+ handling
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit 7d8b4c2a4b73da8e3632603691838ca5b2a8c26d upstream.
+
+Commit b6147490e6aac82 ("mmc: tmio: split core functionality, DMA and
+MFD glue") broke handling of the TMIO_MMC_WRPROTECT_DISABLE flag by
+the tmio-mmc driver. This patch restores the original behaviour.
+
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/host/tmio_mmc_pio.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/tmio_mmc_pio.c
++++ b/drivers/mmc/host/tmio_mmc_pio.c
+@@ -760,8 +760,8 @@ static int tmio_mmc_get_ro(struct mmc_ho
+ 	struct tmio_mmc_host *host = mmc_priv(mmc);
+ 	struct tmio_mmc_data *pdata = host->pdata;
+ 
+-	return ((pdata->flags & TMIO_MMC_WRPROTECT_DISABLE) ||
+-		!(sd_ctrl_read32(host, CTL_STATUS) & TMIO_STAT_WRPROTECT));
++	return !((pdata->flags & TMIO_MMC_WRPROTECT_DISABLE) ||
++		 (sd_ctrl_read32(host, CTL_STATUS) & TMIO_STAT_WRPROTECT));
+ }
+ 
+ static int tmio_mmc_get_cd(struct mmc_host *mmc)
diff --git a/queue-2.6.39/netfilter-fix-ip_route_me_harder-triggering-ip_rt_bug.patch b/queue-2.6.39/netfilter-fix-ip_route_me_harder-triggering-ip_rt_bug.patch
new file mode 100644
index 0000000000..00ca1628cb
--- /dev/null
+++ b/queue-2.6.39/netfilter-fix-ip_route_me_harder-triggering-ip_rt_bug.patch
@@ -0,0 +1,159 @@
+From 80d1dd9b4283f16ded80aec0e9f8382dcbb10b63 Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Sat, 18 Jun 2011 07:53:59 +0000
+Subject: netfilter: Fix ip_route_me_harder triggering ip_rt_bug
+
+
+From: Julian Anastasov <ja@ssi.bg>
+
+[ Upstream commit ed6e4ef836d425bc35e33bf20fcec95e68203afa ]
+
+	Avoid creating input routes with ip_route_me_harder.
+It does not work for locally generated packets. Instead,
+restrict sockets to provide valid saddr for output route (or
+unicast saddr for transparent proxy). For other traffic
+allow saddr to be unicast or local but if callers forget
+to check saddr type use 0 for the output route.
+
+	The resulting handling should be:
+
+- REJECT TCP:
+	- in INPUT we can provide addr_type = RTN_LOCAL but
+	better allow rejecting traffic delivered with
+	local route (no IP address => use RTN_UNSPEC to
+	allow also RTN_UNICAST).
+	- FORWARD: RTN_UNSPEC => allow RTN_LOCAL/RTN_UNICAST
+	saddr, add fix to ignore RTN_BROADCAST and RTN_MULTICAST
+	- OUTPUT: RTN_UNSPEC
+
+- NAT, mangle, ip_queue, nf_ip_reroute: RTN_UNSPEC in LOCAL_OUT
+
+- IPVS:
+	- use RTN_LOCAL in LOCAL_OUT and FORWARD after SNAT
+	to restrict saddr to be local
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/netfilter.c            |   60 ++++++++++++++--------------------------
+ net/ipv4/netfilter/ipt_REJECT.c |   14 ++-------
+ 2 files changed, 26 insertions(+), 48 deletions(-)
+
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -17,51 +17,35 @@ int ip_route_me_harder(struct sk_buff *s
+ 	const struct iphdr *iph = ip_hdr(skb);
+ 	struct rtable *rt;
+ 	struct flowi4 fl4 = {};
+-	unsigned long orefdst;
++	__be32 saddr = iph->saddr;
++	__u8 flags = 0;
+ 	unsigned int hh_len;
+-	unsigned int type;
+ 
+-	type = inet_addr_type(net, iph->saddr);
+-	if (skb->sk && inet_sk(skb->sk)->transparent)
+-		type = RTN_LOCAL;
+-	if (addr_type == RTN_UNSPEC)
+-		addr_type = type;
++	if (!skb->sk && addr_type != RTN_LOCAL) {
++		if (addr_type == RTN_UNSPEC)
++			addr_type = inet_addr_type(net, saddr);
++		if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
++			flags |= FLOWI_FLAG_ANYSRC;
++		else
++			saddr = 0;
++	}
+ 
+ 	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
+ 	 * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
+ 	 */
+-	if (addr_type == RTN_LOCAL) {
+-		fl4.daddr = iph->daddr;
+-		if (type == RTN_LOCAL)
+-			fl4.saddr = iph->saddr;
+-		fl4.flowi4_tos = RT_TOS(iph->tos);
+-		fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
+-		fl4.flowi4_mark = skb->mark;
+-		fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
+-		rt = ip_route_output_key(net, &fl4);
+-		if (IS_ERR(rt))
+-			return -1;
+-
+-		/* Drop old route. */
+-		skb_dst_drop(skb);
+-		skb_dst_set(skb, &rt->dst);
+-	} else {
+-		/* non-local src, find valid iif to satisfy
+-		 * rp-filter when calling ip_route_input. */
+-		fl4.daddr = iph->saddr;
+-		rt = ip_route_output_key(net, &fl4);
+-		if (IS_ERR(rt))
+-			return -1;
++	fl4.daddr = iph->daddr;
++	fl4.saddr = saddr;
++	fl4.flowi4_tos = RT_TOS(iph->tos);
++	fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
++	fl4.flowi4_mark = skb->mark;
++	fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags;
++	rt = ip_route_output_key(net, &fl4);
++	if (IS_ERR(rt))
++		return -1;
+ 
+-		orefdst = skb->_skb_refdst;
+-		if (ip_route_input(skb, iph->daddr, iph->saddr,
+-				   RT_TOS(iph->tos), rt->dst.dev) != 0) {
+-			dst_release(&rt->dst);
+-			return -1;
+-		}
+-		dst_release(&rt->dst);
+-		refdst_drop(orefdst);
+-	}
++	/* Drop old route. */
++	skb_dst_drop(skb);
++	skb_dst_set(skb, &rt->dst);
+ 
+ 	if (skb_dst(skb)->error)
+ 		return -1;
+--- a/net/ipv4/netfilter/ipt_REJECT.c
++++ b/net/ipv4/netfilter/ipt_REJECT.c
+@@ -40,7 +40,6 @@ static void send_reset(struct sk_buff *o
+ 	struct iphdr *niph;
+ 	const struct tcphdr *oth;
+ 	struct tcphdr _otcph, *tcph;
+-	unsigned int addr_type;
+ 
+ 	/* IP header checks: fragment. */
+ 	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+@@ -55,6 +54,9 @@ static void send_reset(struct sk_buff *o
+ 	if (oth->rst)
+ 		return;
+ 
++	if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
++		return;
++
+ 	/* Check checksum */
+ 	if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
+ 		return;
+@@ -101,19 +103,11 @@ static void send_reset(struct sk_buff *o
+ 	nskb->csum_start = (unsigned char *)tcph - nskb->head;
+ 	nskb->csum_offset = offsetof(struct tcphdr, check);
+ 
+-	addr_type = RTN_UNSPEC;
+-	if (hook != NF_INET_FORWARD
+-#ifdef CONFIG_BRIDGE_NETFILTER
+-	    || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED)
+-#endif
+-	   )
+-		addr_type = RTN_LOCAL;
+-
+ 	/* ip_route_me_harder expects skb->dst to be set */
+ 	skb_dst_set_noref(nskb, skb_dst(oldskb));
+ 
+ 	nskb->protocol = htons(ETH_P_IP);
+-	if (ip_route_me_harder(nskb, addr_type))
++	if (ip_route_me_harder(nskb, RTN_UNSPEC))
+ 		goto free_nskb;
+ 
+ 	niph->ttl	= ip4_dst_hoplimit(skb_dst(nskb));
diff --git a/queue-2.6.39/nfs41-do-not-update-isize-if-inode-needs-layoutcommit.patch b/queue-2.6.39/nfs41-do-not-update-isize-if-inode-needs-layoutcommit.patch
new file mode 100644
index 0000000000..b0afb82bb2
--- /dev/null
+++ b/queue-2.6.39/nfs41-do-not-update-isize-if-inode-needs-layoutcommit.patch
@@ -0,0 +1,36 @@
+From 0f66b5984df2fe1617c05900a39a7ef493ca9de9 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Sat, 16 Oct 2010 22:07:46 -0700
+Subject: NFS41: do not update isize if inode needs layoutcommit
+
+From: Peng Tao <bergwolf@gmail.com>
+
+commit 0f66b5984df2fe1617c05900a39a7ef493ca9de9 upstream.
+
+nfs_update_inode will update isize if there is no queued pages. For pNFS,
+layoutcommit is supposed to change file size on server, the same effect as queued
+pages. nfs_update_inode may be called when dirty pages are written back (nfsi->npages==0)
+but layoutcommit is not sent, and it will change client file size according to server
+file size. Then client ends up losing what it just writes back in pNFS path.
+So we should skip updating client file size if file needs layoutcommit.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/inode.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1294,7 +1294,8 @@ static int nfs_update_inode(struct inode
+ 		if (new_isize != cur_isize) {
+ 			/* Do we perhaps have any outstanding writes, or has
+ 			 * the file grown beyond our last write? */
+-			if (nfsi->npages == 0 || new_isize > cur_isize) {
++			if ((nfsi->npages == 0 && !test_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) ||
++			     new_isize > cur_isize) {
+ 				i_size_write(inode, new_isize);
+ 				invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+ 			}
diff --git a/queue-2.6.39/nfsd-fix-dependency-of-nfsd-on-auth_rpcgss.patch b/queue-2.6.39/nfsd-fix-dependency-of-nfsd-on-auth_rpcgss.patch
new file mode 100644
index 0000000000..021e3e091e
--- /dev/null
+++ b/queue-2.6.39/nfsd-fix-dependency-of-nfsd-on-auth_rpcgss.patch
@@ -0,0 +1,106 @@
+From b084f598df36b62dfae83c10ed17f0b66b50f442 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 31 May 2011 12:24:58 -0400
+Subject: nfsd: fix dependency of nfsd on auth_rpcgss
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit b084f598df36b62dfae83c10ed17f0b66b50f442 upstream.
+
+Commit b0b0c0a26e84 "nfsd: add proc file listing kernel's gss_krb5
+enctypes" added an nunnecessary dependency of nfsd on the auth_rpcgss
+module.
+
+It's a little ad hoc, but since the only piece of information nfsd needs
+from rpcsec_gss_krb5 is a single static string, one solution is just to
+share it with an include file.
+
+Reported-by: Michael Guntsche <mike@it-loops.com>
+Cc: Kevin Coffman <kwc@citi.umich.edu>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfsctl.c                         |   19 ++++++-------------
+ include/linux/sunrpc/gss_krb5_enctypes.h |    4 ++++
+ net/sunrpc/auth_gss/gss_krb5_mech.c      |    3 ++-
+ 3 files changed, 12 insertions(+), 14 deletions(-)
+
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -13,6 +13,7 @@
+ #include <linux/lockd/lockd.h>
+ #include <linux/sunrpc/clnt.h>
+ #include <linux/sunrpc/gss_api.h>
++#include <linux/sunrpc/gss_krb5_enctypes.h>
+ 
+ #include "idmap.h"
+ #include "nfsd.h"
+@@ -189,18 +190,10 @@ static struct file_operations export_fea
+ 	.release	= single_release,
+ };
+ 
+-#ifdef CONFIG_SUNRPC_GSS
++#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
+ static int supported_enctypes_show(struct seq_file *m, void *v)
+ {
+-	struct gss_api_mech *k5mech;
+-
+-	k5mech = gss_mech_get_by_name("krb5");
+-	if (k5mech == NULL)
+-		goto out;
+-	if (k5mech->gm_upcall_enctypes != NULL)
+-		seq_printf(m, k5mech->gm_upcall_enctypes);
+-	gss_mech_put(k5mech);
+-out:
++	seq_printf(m, KRB5_SUPPORTED_ENCTYPES);
+ 	return 0;
+ }
+ 
+@@ -215,7 +208,7 @@ static struct file_operations supported_
+ 	.llseek		= seq_lseek,
+ 	.release	= single_release,
+ };
+-#endif /* CONFIG_SUNRPC_GSS */
++#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
+ 
+ extern int nfsd_pool_stats_open(struct inode *inode, struct file *file);
+ extern int nfsd_pool_stats_release(struct inode *inode, struct file *file);
+@@ -1427,9 +1420,9 @@ static int nfsd_fill_super(struct super_
+ 		[NFSD_Versions] = {"versions", &transaction_ops, S_IWUSR|S_IRUSR},
+ 		[NFSD_Ports] = {"portlist", &transaction_ops, S_IWUSR|S_IRUGO},
+ 		[NFSD_MaxBlkSize] = {"max_block_size", &transaction_ops, S_IWUSR|S_IRUGO},
+-#ifdef CONFIG_SUNRPC_GSS
++#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
+ 		[NFSD_SupportedEnctypes] = {"supported_krb5_enctypes", &supported_enctypes_ops, S_IRUGO},
+-#endif /* CONFIG_SUNRPC_GSS */
++#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
+ #ifdef CONFIG_NFSD_V4
+ 		[NFSD_Leasetime] = {"nfsv4leasetime", &transaction_ops, S_IWUSR|S_IRUSR},
+ 		[NFSD_Gracetime] = {"nfsv4gracetime", &transaction_ops, S_IWUSR|S_IRUSR},
+--- /dev/null
++++ b/include/linux/sunrpc/gss_krb5_enctypes.h
+@@ -0,0 +1,4 @@
++/*
++ * Dumb way to share this static piece of information with nfsd
++ */
++#define KRB5_SUPPORTED_ENCTYPES "18,17,16,23,3,1,2"
+--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
++++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
+@@ -43,6 +43,7 @@
+ #include <linux/sunrpc/gss_krb5.h>
+ #include <linux/sunrpc/xdr.h>
+ #include <linux/crypto.h>
++#include <linux/sunrpc/gss_krb5_enctypes.h>
+ 
+ #ifdef RPC_DEBUG
+ # define RPCDBG_FACILITY	RPCDBG_AUTH
+@@ -750,7 +751,7 @@ static struct gss_api_mech gss_kerberos_
+ 	.gm_ops		= &gss_kerberos_ops,
+ 	.gm_pf_num	= ARRAY_SIZE(gss_kerberos_pfs),
+ 	.gm_pfs		= gss_kerberos_pfs,
+-	.gm_upcall_enctypes = "18,17,16,23,3,1,2",
++	.gm_upcall_enctypes = KRB5_SUPPORTED_ENCTYPES,
+ };
+ 
+ static int __init init_kerberos_module(void)
diff --git a/queue-2.6.39/nfsd-link-returns-nfserr_delay-when-breaking-lease.patch b/queue-2.6.39/nfsd-link-returns-nfserr_delay-when-breaking-lease.patch
new file mode 100644
index 0000000000..613f622878
--- /dev/null
+++ b/queue-2.6.39/nfsd-link-returns-nfserr_delay-when-breaking-lease.patch
@@ -0,0 +1,39 @@
+From 7d751f6f8c679f51b73d01a1b5269347a929004c Mon Sep 17 00:00:00 2001
+From: Casey Bodley <cbodley@citi.umich.edu>
+Date: Fri, 3 Jun 2011 12:21:23 -0400
+Subject: nfsd: link returns nfserr_delay when breaking lease
+
+From: Casey Bodley <cbodley@citi.umich.edu>
+
+commit 7d751f6f8c679f51b73d01a1b5269347a929004c upstream.
+
+fix for commit 4795bb37effb7b8fe77e2d2034545d062d3788a8, nfsd: break
+lease on unlink, link, and rename
+
+if the LINK operation breaks a delegation, it returns NFS4ERR_NOENT
+(which is not a valid error in rfc 5661) instead of NFS4ERR_DELAY.
+the return value of nfsd_break_lease() in nfsd_link() must be
+converted from host_err to err
+
+Signed-off-by: Casey Bodley <cbodley@citi.umich.edu>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1653,8 +1653,10 @@ nfsd_link(struct svc_rqst *rqstp, struct
+ 	if (!dold->d_inode)
+ 		goto out_drop_write;
+ 	host_err = nfsd_break_lease(dold->d_inode);
+-	if (host_err)
++	if (host_err) {
++		err = nfserrno(host_err);
+ 		goto out_drop_write;
++	}
+ 	host_err = vfs_link(dold, dirp, dnew);
+ 	if (!host_err) {
+ 		err = nfserrno(commit_metadata(ffhp));
diff --git a/queue-2.6.39/nfsd-v4-support-requires-crypto.patch b/queue-2.6.39/nfsd-v4-support-requires-crypto.patch
new file mode 100644
index 0000000000..7e373623c7
--- /dev/null
+++ b/queue-2.6.39/nfsd-v4-support-requires-crypto.patch
@@ -0,0 +1,34 @@
+From be1f4084b4824301e640e81d63b6275cd99ee6a1 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <randy.dunlap@oracle.com>
+Date: Mon, 6 Jun 2011 11:22:17 -0700
+Subject: nfsd: v4 support requires CRYPTO
+
+From: Randy Dunlap <randy.dunlap@oracle.com>
+
+commit be1f4084b4824301e640e81d63b6275cd99ee6a1 upstream.
+
+nfsd V4 support uses crypto interfaces, so select CRYPTO
+to fix build errors in 2.6.39:
+
+ERROR: "crypto_destroy_tfm" [fs/nfsd/nfsd.ko] undefined!
+ERROR: "crypto_alloc_base" [fs/nfsd/nfsd.ko] undefined!
+
+Reported-by: Wakko Warner <wakko@animx.eu.org>
+Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/Kconfig |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfsd/Kconfig
++++ b/fs/nfsd/Kconfig
+@@ -82,6 +82,7 @@ config NFSD_V4
+ 	select NFSD_V3
+ 	select FS_POSIX_ACL
+ 	select SUNRPC_GSS
++	select CRYPTO
+ 	help
+ 	  This option enables support in your system's NFS server for
+ 	  version 4 of the NFS protocol (RFC 3530).
diff --git a/queue-2.6.39/nfsd4-fix-break_lease-flags-on-nfsd-open.patch b/queue-2.6.39/nfsd4-fix-break_lease-flags-on-nfsd-open.patch
new file mode 100644
index 0000000000..063ececcb7
--- /dev/null
+++ b/queue-2.6.39/nfsd4-fix-break_lease-flags-on-nfsd-open.patch
@@ -0,0 +1,53 @@
+From 105f4622104848ff1ee1f644d661bef9dec3eb27 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 7 Jun 2011 11:50:23 -0400
+Subject: nfsd4: fix break_lease flags on nfsd open
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 105f4622104848ff1ee1f644d661bef9dec3eb27 upstream.
+
+Thanks to Casey Bodley for pointing out that on a read open we pass 0,
+instead of O_RDONLY, to break_lease, with the result that a read open is
+treated like a write open for the purposes of lease breaking!
+
+Reported-by: Casey Bodley <cbodley@citi.umich.edu>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c |   15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -699,7 +699,15 @@ nfsd_access(struct svc_rqst *rqstp, stru
+ }
+ #endif /* CONFIG_NFSD_V3 */
+ 
++static int nfsd_open_break_lease(struct inode *inode, int access)
++{
++	unsigned int mode;
+ 
++	if (access & NFSD_MAY_NOT_BREAK_LEASE)
++		return 0;
++	mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY;
++	return break_lease(inode, mode | O_NONBLOCK);
++}
+ 
+ /*
+  * Open an existing file or directory.
+@@ -747,12 +755,7 @@ nfsd_open(struct svc_rqst *rqstp, struct
+ 	if (!inode->i_fop)
+ 		goto out;
+ 
+-	/*
+-	 * Check to see if there are any leases on this file.
+-	 * This may block while leases are broken.
+-	 */
+-	if (!(access & NFSD_MAY_NOT_BREAK_LEASE))
+-		host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0));
++	host_err = nfsd_open_break_lease(inode, access);
+ 	if (host_err) /* NOMEM or WOULDBLOCK */
+ 		goto out_nfserr;
+ 
diff --git a/queue-2.6.39/nfsv4-fix-a-readdir-regression.patch b/queue-2.6.39/nfsv4-fix-a-readdir-regression.patch
new file mode 100644
index 0000000000..9ea84eb85e
--- /dev/null
+++ b/queue-2.6.39/nfsv4-fix-a-readdir-regression.patch
@@ -0,0 +1,69 @@
+From ee7b75fc4f3ae49e1f25bf56219bb5de3c29afaf Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Thu, 16 Jun 2011 13:15:41 -0400
+Subject: NFSv4: Fix a readdir regression
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit ee7b75fc4f3ae49e1f25bf56219bb5de3c29afaf upstream.
+
+Commit 7ebb9315 (NFS: use secinfo when crossing mountpoints) introduces
+a regression when decoding an NFSv4 readdir entry that sets the
+rdattr_error field.
+By treating the resulting value as if it is a decoding error, the current
+code may cause us to skip valid readdir entries.
+
+Reported-by: Andy Adamson <andros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4xdr.c |   14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -3030,7 +3030,7 @@ out_overflow:
+ 	return -EIO;
+ }
+ 
+-static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap)
++static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap, int32_t *res)
+ {
+ 	__be32 *p;
+ 
+@@ -3041,7 +3041,7 @@ static int decode_attr_error(struct xdr_
+ 		if (unlikely(!p))
+ 			goto out_overflow;
+ 		bitmap[0] &= ~FATTR4_WORD0_RDATTR_ERROR;
+-		return -be32_to_cpup(p);
++		*res = -be32_to_cpup(p);
+ 	}
+ 	return 0;
+ out_overflow:
+@@ -4002,6 +4002,7 @@ static int decode_getfattr_attrs(struct
+ 	int status;
+ 	umode_t fmode = 0;
+ 	uint32_t type;
++	int32_t err;
+ 
+ 	status = decode_attr_type(xdr, bitmap, &type);
+ 	if (status < 0)
+@@ -4027,13 +4028,12 @@ static int decode_getfattr_attrs(struct
+ 		goto xdr_error;
+ 	fattr->valid |= status;
+ 
+-	status = decode_attr_error(xdr, bitmap);
+-	if (status == -NFS4ERR_WRONGSEC) {
+-		nfs_fixup_secinfo_attributes(fattr, fh);
+-		status = 0;
+-	}
++	err = 0;
++	status = decode_attr_error(xdr, bitmap, &err);
+ 	if (status < 0)
+ 		goto xdr_error;
++	if (err == -NFS4ERR_WRONGSEC)
++		nfs_fixup_secinfo_attributes(fattr, fh);
+ 
+ 	status = decode_attr_filehandle(xdr, bitmap, fh);
+ 	if (status < 0)
diff --git a/queue-2.6.39/nfsv4.1-allow-nfs_fhget-to-succeed-with-mounted-on-fileid.patch b/queue-2.6.39/nfsv4.1-allow-nfs_fhget-to-succeed-with-mounted-on-fileid.patch
new file mode 100644
index 0000000000..48e8145fa2
--- /dev/null
+++ b/queue-2.6.39/nfsv4.1-allow-nfs_fhget-to-succeed-with-mounted-on-fileid.patch
@@ -0,0 +1,148 @@
+From 533eb4611c9eea53072eb6a61d5a6393b6a77ed7 Mon Sep 17 00:00:00 2001
+From: Andy Adamson <andros@netapp.com>
+Date: Mon, 13 Jun 2011 18:25:56 -0400
+Subject: NFSv4.1: allow nfs_fhget to succeed with mounted on fileid
+
+From: Andy Adamson <andros@netapp.com>
+
+commit 533eb4611c9eea53072eb6a61d5a6393b6a77ed7 upstream.
+
+Commit 28331a46d88459788c8fca72dbb0415cd7f514c9 "Ensure we request the
+ordinary fileid when doing readdirplus"
+changed the meaning of NFS_ATTR_FATTR_FILEID which used to be set when
+FATTR4_WORD1_MOUNTED_ON_FILED was requested.
+
+Allow nfs_fhget to succeed with only a mounted on fileid when crossing
+a mountpoint or a referral.
+
+Ask for the fileid of the absent file system if mounted_on_fileid is not
+supported.
+
+Signed-off-by: Andy Adamson <andros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/inode.c    |    3 ++-
+ fs/nfs/internal.h |   11 +++++++++++
+ fs/nfs/nfs4proc.c |   33 +++++++++++++++++++++++----------
+ 3 files changed, 36 insertions(+), 11 deletions(-)
+
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -256,7 +256,8 @@ nfs_fhget(struct super_block *sb, struct
+ 
+ 	nfs_attr_check_mountpoint(sb, fattr);
+ 
+-	if ((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0 && (fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0)
++	if (((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0) &&
++	    !nfs_attr_use_mounted_on_fileid(fattr))
+ 		goto out_no_inode;
+ 	if ((fattr->valid & NFS_ATTR_FATTR_TYPE) == 0)
+ 		goto out_no_inode;
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -45,6 +45,17 @@ static inline void nfs_attr_check_mountp
+ 		fattr->valid |= NFS_ATTR_FATTR_MOUNTPOINT;
+ }
+ 
++static inline int nfs_attr_use_mounted_on_fileid(struct nfs_fattr *fattr)
++{
++	if (((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) == 0) ||
++	    (((fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0) &&
++	     ((fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL) == 0)))
++		return 0;
++
++	fattr->fileid = fattr->mounted_on_fileid;
++	return 1;
++}
++
+ struct nfs_clone_mount {
+ 	const struct super_block *sb;
+ 	const struct dentry *dentry;
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2265,12 +2265,14 @@ static int nfs4_proc_get_root(struct nfs
+ 	return nfs4_map_errors(status);
+ }
+ 
++static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr);
+ /*
+  * Get locations and (maybe) other attributes of a referral.
+  * Note that we'll actually follow the referral later when
+  * we detect fsid mismatch in inode revalidation
+  */
+-static int nfs4_get_referral(struct inode *dir, const struct qstr *name, struct nfs_fattr *fattr, struct nfs_fh *fhandle)
++static int nfs4_get_referral(struct inode *dir, const struct qstr *name,
++			     struct nfs_fattr *fattr, struct nfs_fh *fhandle)
+ {
+ 	int status = -ENOMEM;
+ 	struct page *page = NULL;
+@@ -2288,15 +2290,16 @@ static int nfs4_get_referral(struct inod
+ 		goto out;
+ 	/* Make sure server returned a different fsid for the referral */
+ 	if (nfs_fsid_equal(&NFS_SERVER(dir)->fsid, &locations->fattr.fsid)) {
+-		dprintk("%s: server did not return a different fsid for a referral at %s\n", __func__, name->name);
++		dprintk("%s: server did not return a different fsid for"
++			" a referral at %s\n", __func__, name->name);
+ 		status = -EIO;
+ 		goto out;
+ 	}
++	/* Fixup attributes for the nfs_lookup() call to nfs_fhget() */
++	nfs_fixup_referral_attributes(&locations->fattr);
+ 
++	/* replace the lookup nfs_fattr with the locations nfs_fattr */
+ 	memcpy(fattr, &locations->fattr, sizeof(struct nfs_fattr));
+-	fattr->valid |= NFS_ATTR_FATTR_V4_REFERRAL;
+-	if (!fattr->mode)
+-		fattr->mode = S_IFDIR;
+ 	memset(fhandle, 0, sizeof(struct nfs_fh));
+ out:
+ 	if (page)
+@@ -4657,11 +4660,15 @@ static size_t nfs4_xattr_list_nfs4_acl(s
+ 	return len;
+ }
+ 
++/*
++ * nfs_fhget will use either the mounted_on_fileid or the fileid
++ */
+ static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr)
+ {
+-	if (!((fattr->valid & NFS_ATTR_FATTR_FILEID) &&
+-		(fattr->valid & NFS_ATTR_FATTR_FSID) &&
+-		(fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)))
++	if (!(((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) ||
++	       (fattr->valid & NFS_ATTR_FATTR_FILEID)) &&
++	      (fattr->valid & NFS_ATTR_FATTR_FSID) &&
++	      (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)))
+ 		return;
+ 
+ 	fattr->valid |= NFS_ATTR_FATTR_TYPE | NFS_ATTR_FATTR_MODE |
+@@ -4676,7 +4683,6 @@ int nfs4_proc_fs_locations(struct inode
+ 	struct nfs_server *server = NFS_SERVER(dir);
+ 	u32 bitmask[2] = {
+ 		[0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS,
+-		[1] = FATTR4_WORD1_MOUNTED_ON_FILEID,
+ 	};
+ 	struct nfs4_fs_locations_arg args = {
+ 		.dir_fh = NFS_FH(dir),
+@@ -4695,11 +4701,18 @@ int nfs4_proc_fs_locations(struct inode
+ 	int status;
+ 
+ 	dprintk("%s: start\n", __func__);
++
++	/* Ask for the fileid of the absent filesystem if mounted_on_fileid
++	 * is not supported */
++	if (NFS_SERVER(dir)->attr_bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
++		bitmask[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
++	else
++		bitmask[0] |= FATTR4_WORD0_FILEID;
++
+ 	nfs_fattr_init(&fs_locations->fattr);
+ 	fs_locations->server = server;
+ 	fs_locations->nlocations = 0;
+ 	status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, &res.seq_res, 0);
+-	nfs_fixup_referral_attributes(&fs_locations->fattr);
+ 	dprintk("%s: returned status = %d\n", __func__, status);
+ 	return status;
+ }
diff --git a/queue-2.6.39/nfsv4.1-allow-zero-fh-array-in-filelayout-decode-layout.patch b/queue-2.6.39/nfsv4.1-allow-zero-fh-array-in-filelayout-decode-layout.patch
new file mode 100644
index 0000000000..e227b47af3
--- /dev/null
+++ b/queue-2.6.39/nfsv4.1-allow-zero-fh-array-in-filelayout-decode-layout.patch
@@ -0,0 +1,43 @@
+From cec765cf5891c7fc3d905832b481bfb6fd55825d Mon Sep 17 00:00:00 2001
+From: Andy Adamson <andros@netapp.com>
+Date: Mon, 13 Jun 2011 18:36:17 -0400
+Subject: NFSv4.1: allow zero fh array in filelayout decode layout
+
+From: Andy Adamson <andros@netapp.com>
+
+commit cec765cf5891c7fc3d905832b481bfb6fd55825d upstream.
+
+Signed-off-by: Andy Adamson <andros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4filelayout.c |   15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/fs/nfs/nfs4filelayout.c
++++ b/fs/nfs/nfs4filelayout.c
+@@ -554,13 +554,18 @@ filelayout_decode_layout(struct pnfs_lay
+ 		__func__, nfl_util, fl->num_fh, fl->first_stripe_index,
+ 		fl->pattern_offset);
+ 
+-	if (!fl->num_fh)
++	/* Note that a zero value for num_fh is legal for STRIPE_SPARSE.
++	 * Futher checking is done in filelayout_check_layout */
++	if (fl->num_fh < 0 || fl->num_fh >
++	    max(NFS4_PNFS_MAX_STRIPE_CNT, NFS4_PNFS_MAX_MULTI_CNT))
+ 		goto out_err;
+ 
+-	fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
+-			       gfp_flags);
+-	if (!fl->fh_array)
+-		goto out_err;
++	if (fl->num_fh > 0) {
++		fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
++				       gfp_flags);
++		if (!fl->fh_array)
++			goto out_err;
++	}
+ 
+ 	for (i = 0; i < fl->num_fh; i++) {
+ 		/* Do we want to use a mempool here? */
diff --git a/queue-2.6.39/nlm-don-t-hang-forever-on-nlm-unlock-requests.patch b/queue-2.6.39/nlm-don-t-hang-forever-on-nlm-unlock-requests.patch
new file mode 100644
index 0000000000..eaa4ac7367
--- /dev/null
+++ b/queue-2.6.39/nlm-don-t-hang-forever-on-nlm-unlock-requests.patch
@@ -0,0 +1,76 @@
+From 0b760113a3a155269a3fba93a409c640031dd68f Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Tue, 31 May 2011 15:15:34 -0400
+Subject: NLM: Don't hang forever on NLM unlock requests
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 0b760113a3a155269a3fba93a409c640031dd68f upstream.
+
+If the NLM daemon is killed on the NFS server, we can currently end up
+hanging forever on an 'unlock' request, instead of aborting. Basically,
+if the rpcbind request fails, or the server keeps returning garbage, we
+really want to quit instead of retrying.
+
+Tested-by: Vasily Averin <vvs@sw.ru>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/lockd/clntproc.c          |    8 +++++++-
+ include/linux/sunrpc/sched.h |    3 ++-
+ net/sunrpc/clnt.c            |    3 +++
+ net/sunrpc/sched.c           |    1 +
+ 4 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/fs/lockd/clntproc.c
++++ b/fs/lockd/clntproc.c
+@@ -708,7 +708,13 @@ static void nlmclnt_unlock_callback(stru
+ 
+ 	if (task->tk_status < 0) {
+ 		dprintk("lockd: unlock failed (err = %d)\n", -task->tk_status);
+-		goto retry_rebind;
++		switch (task->tk_status) {
++		case -EACCES:
++		case -EIO:
++			goto die;
++		default:
++			goto retry_rebind;
++		}
+ 	}
+ 	if (status == NLM_LCK_DENIED_GRACE_PERIOD) {
+ 		rpc_delay(task, NLMCLNT_GRACE_WAIT);
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -84,7 +84,8 @@ struct rpc_task {
+ #endif
+ 	unsigned char		tk_priority : 2,/* Task priority */
+ 				tk_garb_retry : 2,
+-				tk_cred_retry : 2;
++				tk_cred_retry : 2,
++				tk_rebind_retry : 2;
+ };
+ #define tk_xprt			tk_client->cl_xprt
+ 
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1172,6 +1172,9 @@ call_bind_status(struct rpc_task *task)
+ 			status = -EOPNOTSUPP;
+ 			break;
+ 		}
++		if (task->tk_rebind_retry == 0)
++			break;
++		task->tk_rebind_retry--;
+ 		rpc_delay(task, 3*HZ);
+ 		goto retry_timeout;
+ 	case -ETIMEDOUT:
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -792,6 +792,7 @@ static void rpc_init_task(struct rpc_tas
+ 	/* Initialize retry counters */
+ 	task->tk_garb_retry = 2;
+ 	task->tk_cred_retry = 2;
++	task->tk_rebind_retry = 2;
+ 
+ 	task->tk_priority = task_setup_data->priority - RPC_PRIORITY_LOW;
+ 	task->tk_owner = current->tgid;
diff --git a/queue-2.6.39/pci-pm-block-races-between-runtime-pm-and-system-sleep.patch b/queue-2.6.39/pci-pm-block-races-between-runtime-pm-and-system-sleep.patch
new file mode 100644
index 0000000000..c88520d62a
--- /dev/null
+++ b/queue-2.6.39/pci-pm-block-races-between-runtime-pm-and-system-sleep.patch
@@ -0,0 +1,49 @@
+From a5f76d5eba157bf637beb2dd18026db2917c512e Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Tue, 21 Jun 2011 23:47:15 +0200
+Subject: PCI / PM: Block races between runtime PM and system sleep
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit a5f76d5eba157bf637beb2dd18026db2917c512e upstream.
+
+After commit e8665002477f0278f84f898145b1f141ba26ee26
+(PM: Allow pm_runtime_suspend() to succeed during system suspend) it
+is possible that a device resumed by the pm_runtime_resume(dev) in
+pci_pm_prepare() will be suspended immediately from a work item,
+timer function or otherwise, defeating the very purpose of calling
+pm_runtime_resume(dev) from there.  To prevent that from happening
+it is necessary to increment the runtime PM usage counter of the
+device by replacing pm_runtime_resume() with pm_runtime_get_sync().
+Moreover, the incremented runtime PM usage counter has to be
+decremented by the corresponding pci_pm_complete(), via
+pm_runtime_put_sync().
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci-driver.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -624,7 +624,7 @@ static int pci_pm_prepare(struct device
+ 	 * system from the sleep state, we'll have to prevent it from signaling
+ 	 * wake-up.
+ 	 */
+-	pm_runtime_resume(dev);
++	pm_runtime_get_sync(dev);
+ 
+ 	if (drv && drv->pm && drv->pm->prepare)
+ 		error = drv->pm->prepare(dev);
+@@ -638,6 +638,8 @@ static void pci_pm_complete(struct devic
+ 
+ 	if (drv && drv->pm && drv->pm->complete)
+ 		drv->pm->complete(dev);
++
++	pm_runtime_put_sync(dev);
+ }
+ 
+ #else /* !CONFIG_PM_SLEEP */
diff --git a/queue-2.6.39/pm-fix-async-resume-following-suspend-failure.patch b/queue-2.6.39/pm-fix-async-resume-following-suspend-failure.patch
new file mode 100644
index 0000000000..07765db542
--- /dev/null
+++ b/queue-2.6.39/pm-fix-async-resume-following-suspend-failure.patch
@@ -0,0 +1,101 @@
+From 6d0e0e84f66d32c33511984dd3badd32364b863c Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Sat, 18 Jun 2011 22:42:09 +0200
+Subject: PM: Fix async resume following suspend failure
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 6d0e0e84f66d32c33511984dd3badd32364b863c upstream.
+
+The PM core doesn't handle suspend failures correctly when it comes to
+asynchronously suspended devices.  These devices are moved onto the
+dpm_suspended_list as soon as the corresponding async thread is
+started up, and they remain on the list even if they fail to suspend
+or the sleep transition is cancelled before they get suspended.  As a
+result, when the PM core unwinds the transition, it tries to resume
+the devices even though they were never suspended.
+
+This patch (as1474) fixes the problem by adding a new "is_suspended"
+flag to dev_pm_info.  Devices are resumed only if the flag is set.
+
+[rjw:
+ * Moved the dev->power.is_suspended check into device_resume(),
+   because we need to complete dev->power.completion and clear
+   dev->power.is_prepared too for devices whose
+   dev->power.is_suspended flags are unset.
+ * Fixed __device_suspend() to avoid setting dev->power.is_suspended
+   if async_error is different from zero.]
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/power/main.c |   14 ++++++++++++--
+ include/linux/pm.h        |    1 +
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -58,6 +58,7 @@ static int async_error;
+ void device_pm_init(struct device *dev)
+ {
+ 	dev->power.is_prepared = false;
++	dev->power.is_suspended = false;
+ 	init_completion(&dev->power.completion);
+ 	complete_all(&dev->power.completion);
+ 	dev->power.wakeup = NULL;
+@@ -519,6 +520,9 @@ static int device_resume(struct device *
+ 	 */
+ 	dev->power.is_prepared = false;
+ 
++	if (!dev->power.is_suspended)
++		goto Unlock;
++
+ 	if (dev->pwr_domain) {
+ 		pm_dev_dbg(dev, state, "power domain ");
+ 		pm_op(dev, &dev->pwr_domain->ops, state);
+@@ -553,6 +557,9 @@ static int device_resume(struct device *
+ 	}
+ 
+  End:
++	dev->power.is_suspended = false;
++
++ Unlock:
+ 	device_unlock(dev);
+ 	complete_all(&dev->power.completion);
+ 
+@@ -838,11 +845,11 @@ static int __device_suspend(struct devic
+ 	device_lock(dev);
+ 
+ 	if (async_error)
+-		goto End;
++		goto Unlock;
+ 
+ 	if (pm_wakeup_pending()) {
+ 		async_error = -EBUSY;
+-		goto End;
++		goto Unlock;
+ 	}
+ 
+ 	if (dev->type && dev->type->pm) {
+@@ -880,6 +887,9 @@ static int __device_suspend(struct devic
+ 	}
+ 
+  End:
++	dev->power.is_suspended = !error;
++
++ Unlock:
+ 	device_unlock(dev);
+ 	complete_all(&dev->power.completion);
+ 
+--- a/include/linux/pm.h
++++ b/include/linux/pm.h
+@@ -426,6 +426,7 @@ struct dev_pm_info {
+ 	unsigned int		can_wakeup:1;
+ 	unsigned int		async_suspend:1;
+ 	bool			is_prepared:1;	/* Owned by the PM core */
++	bool			is_suspended:1;	/* Ditto */
+ 	spinlock_t		lock;
+ #ifdef CONFIG_PM_SLEEP
+ 	struct list_head	entry;
diff --git a/queue-2.6.39/pm-hibernate-fix-free_unnecessary_pages.patch b/queue-2.6.39/pm-hibernate-fix-free_unnecessary_pages.patch
new file mode 100644
index 0000000000..02d8ddea64
--- /dev/null
+++ b/queue-2.6.39/pm-hibernate-fix-free_unnecessary_pages.patch
@@ -0,0 +1,46 @@
+From 4d4cf23cdde2f8f9324f5684a7f349e182039529 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Wed, 6 Jul 2011 20:15:23 +0200
+Subject: PM / Hibernate: Fix free_unnecessary_pages()
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit 4d4cf23cdde2f8f9324f5684a7f349e182039529 upstream.
+
+There is a bug in free_unnecessary_pages() that causes it to
+attempt to free too many pages in some cases, which triggers the
+BUG_ON() in memory_bm_clear_bit() for copy_bm.  Namely, if
+count_data_pages() is initially greater than alloc_normal, we get
+to_free_normal equal to 0 and "save" greater from 0.  In that case,
+if the sum of "save" and count_highmem_pages() is greater than
+alloc_highmem, we subtract a positive number from to_free_normal.
+Hence, since to_free_normal was 0 before the subtraction and is
+an unsigned int, the result is converted to a huge positive number
+that is used as the number of pages to free.
+
+Fix this bug by checking if to_free_normal is actually greater
+than or equal to the number we're going to subtract from it.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Reported-and-tested-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/power/snapshot.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1199,7 +1199,11 @@ static void free_unnecessary_pages(void)
+ 		to_free_highmem = alloc_highmem - save;
+ 	} else {
+ 		to_free_highmem = 0;
+-		to_free_normal -= save - alloc_highmem;
++		save -= alloc_highmem;
++		if (to_free_normal > save)
++			to_free_normal -= save;
++		else
++			to_free_normal = 0;
+ 	}
+ 
+ 	memory_bm_position_reset(&copy_bm);
diff --git a/queue-2.6.39/pm-rename-dev_pm_info.in_suspend-to-is_prepared.patch b/queue-2.6.39/pm-rename-dev_pm_info.in_suspend-to-is_prepared.patch
new file mode 100644
index 0000000000..a2aced9fc2
--- /dev/null
+++ b/queue-2.6.39/pm-rename-dev_pm_info.in_suspend-to-is_prepared.patch
@@ -0,0 +1,133 @@
+From f76b168b6f117a49d36307053e1acbe30580ea5b Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Sat, 18 Jun 2011 20:22:23 +0200
+Subject: PM: Rename dev_pm_info.in_suspend to is_prepared
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f76b168b6f117a49d36307053e1acbe30580ea5b upstream.
+
+This patch (as1473) renames the "in_suspend" field in struct
+dev_pm_info to "is_prepared", in preparation for an upcoming change.
+The new name is more descriptive of what the field really means.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/power/main.c |   14 +++++++++-----
+ drivers/usb/core/driver.c |    6 +++---
+ include/linux/device.h    |    4 ++--
+ include/linux/pm.h        |    2 +-
+ 4 files changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -57,7 +57,7 @@ static int async_error;
+  */
+ void device_pm_init(struct device *dev)
+ {
+-	dev->power.in_suspend = false;
++	dev->power.is_prepared = false;
+ 	init_completion(&dev->power.completion);
+ 	complete_all(&dev->power.completion);
+ 	dev->power.wakeup = NULL;
+@@ -91,7 +91,7 @@ void device_pm_add(struct device *dev)
+ 	pr_debug("PM: Adding info for %s:%s\n",
+ 		 dev->bus ? dev->bus->name : "No Bus", dev_name(dev));
+ 	mutex_lock(&dpm_list_mtx);
+-	if (dev->parent && dev->parent->power.in_suspend)
++	if (dev->parent && dev->parent->power.is_prepared)
+ 		dev_warn(dev, "parent %s should not be sleeping\n",
+ 			dev_name(dev->parent));
+ 	list_add_tail(&dev->power.entry, &dpm_list);
+@@ -513,7 +513,11 @@ static int device_resume(struct device *
+ 	dpm_wait(dev->parent, async);
+ 	device_lock(dev);
+ 
+-	dev->power.in_suspend = false;
++	/*
++	 * This is a fib.  But we'll allow new children to be added below
++	 * a resumed device, even if the device hasn't been completed yet.
++	 */
++	dev->power.is_prepared = false;
+ 
+ 	if (dev->pwr_domain) {
+ 		pm_dev_dbg(dev, state, "power domain ");
+@@ -668,7 +672,7 @@ static void dpm_complete(pm_message_t st
+ 		struct device *dev = to_device(dpm_prepared_list.prev);
+ 
+ 		get_device(dev);
+-		dev->power.in_suspend = false;
++		dev->power.is_prepared = false;
+ 		list_move(&dev->power.entry, &list);
+ 		mutex_unlock(&dpm_list_mtx);
+ 
+@@ -1037,7 +1041,7 @@ static int dpm_prepare(pm_message_t stat
+ 			put_device(dev);
+ 			break;
+ 		}
+-		dev->power.in_suspend = true;
++		dev->power.is_prepared = true;
+ 		if (!list_empty(&dev->power.entry))
+ 			list_move_tail(&dev->power.entry, &dpm_prepared_list);
+ 		put_device(dev);
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -375,7 +375,7 @@ static int usb_unbind_interface(struct d
+ 		 * Just re-enable it without affecting the endpoint toggles.
+ 		 */
+ 		usb_enable_interface(udev, intf, false);
+-	} else if (!error && !intf->dev.power.in_suspend) {
++	} else if (!error && !intf->dev.power.is_prepared) {
+ 		r = usb_set_interface(udev, intf->altsetting[0].
+ 				desc.bInterfaceNumber, 0);
+ 		if (r < 0)
+@@ -960,7 +960,7 @@ void usb_rebind_intf(struct usb_interfac
+ 	}
+ 
+ 	/* Try to rebind the interface */
+-	if (!intf->dev.power.in_suspend) {
++	if (!intf->dev.power.is_prepared) {
+ 		intf->needs_binding = 0;
+ 		rc = device_attach(&intf->dev);
+ 		if (rc < 0)
+@@ -1107,7 +1107,7 @@ static int usb_resume_interface(struct u
+ 	if (intf->condition == USB_INTERFACE_UNBOUND) {
+ 
+ 		/* Carry out a deferred switch to altsetting 0 */
+-		if (intf->needs_altsetting0 && !intf->dev.power.in_suspend) {
++		if (intf->needs_altsetting0 && !intf->dev.power.is_prepared) {
+ 			usb_set_interface(udev, intf->altsetting[0].
+ 					desc.bInterfaceNumber, 0);
+ 			intf->needs_altsetting0 = 0;
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -506,13 +506,13 @@ static inline int device_is_registered(s
+ 
+ static inline void device_enable_async_suspend(struct device *dev)
+ {
+-	if (!dev->power.in_suspend)
++	if (!dev->power.is_prepared)
+ 		dev->power.async_suspend = true;
+ }
+ 
+ static inline void device_disable_async_suspend(struct device *dev)
+ {
+-	if (!dev->power.in_suspend)
++	if (!dev->power.is_prepared)
+ 		dev->power.async_suspend = false;
+ }
+ 
+--- a/include/linux/pm.h
++++ b/include/linux/pm.h
+@@ -425,7 +425,7 @@ struct dev_pm_info {
+ 	pm_message_t		power_state;
+ 	unsigned int		can_wakeup:1;
+ 	unsigned int		async_suspend:1;
+-	unsigned int		in_suspend:1;	/* Owned by the PM core */
++	bool			is_prepared:1;	/* Owned by the PM core */
+ 	spinlock_t		lock;
+ #ifdef CONFIG_PM_SLEEP
+ 	struct list_head	entry;
diff --git a/queue-2.6.39/rc-fix-ghost-keypresses-with-certain-hw.patch b/queue-2.6.39/rc-fix-ghost-keypresses-with-certain-hw.patch
new file mode 100644
index 0000000000..5629eb64c9
--- /dev/null
+++ b/queue-2.6.39/rc-fix-ghost-keypresses-with-certain-hw.patch
@@ -0,0 +1,54 @@
+From 3f5c4c73322e4d6f3d40b697dac3073d2adffe41 Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Thu, 16 Jun 2011 16:18:37 -0300
+Subject: [media] rc: fix ghost keypresses with certain hw
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 3f5c4c73322e4d6f3d40b697dac3073d2adffe41 upstream.
+
+With hardware that has to use ir_raw_event_store_edge to collect IR
+sample durations, we were not doing an event reset unless
+IR_MAX_DURATION had passed. That's around 4 seconds. So if someone
+presses up, then down, with less than 4 seconds in between, they'd get
+the initial up, then up and down upon pressing down.
+
+To fix this, I've lowered the "send a reset event" logic's threshold to
+the input device's REP_DELAY (defaults to 500ms), and with an
+saa7134-based GPIO-driven IR receiver in a Hauppauge HVR-1150, I get
+*much* better behavior out of the remote now. Special thanks to Devin
+for providing the hardware to investigate this issue.
+
+CC: Devin Heitmueller <dheitmueller@kernellabs.com>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/rc/ir-raw.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/rc/ir-raw.c
++++ b/drivers/media/rc/ir-raw.c
+@@ -114,18 +114,20 @@ int ir_raw_event_store_edge(struct rc_de
+ 	s64			delta; /* ns */
+ 	DEFINE_IR_RAW_EVENT(ev);
+ 	int			rc = 0;
++	int			delay;
+ 
+ 	if (!dev->raw)
+ 		return -EINVAL;
+ 
+ 	now = ktime_get();
+ 	delta = ktime_to_ns(ktime_sub(now, dev->raw->last_event));
++	delay = MS_TO_NS(dev->input_dev->rep[REP_DELAY]);
+ 
+ 	/* Check for a long duration since last event or if we're
+ 	 * being called for the first time, note that delta can't
+ 	 * possibly be negative.
+ 	 */
+-	if (delta > IR_MAX_DURATION || !dev->raw->last_type)
++	if (delta > delay || !dev->raw->last_type)
+ 		type |= IR_START_EVENT;
+ 	else
+ 		ev.duration = delta;
diff --git a/queue-2.6.39/revert-kvm-save-restore-state-of-assigned-pci-device.patch b/queue-2.6.39/revert-kvm-save-restore-state-of-assigned-pci-device.patch
new file mode 100644
index 0000000000..8a8311e6b8
--- /dev/null
+++ b/queue-2.6.39/revert-kvm-save-restore-state-of-assigned-pci-device.patch
@@ -0,0 +1,59 @@
+From mtosatti@redhat.com  Thu Jul  7 16:30:24 2011
+From: Marcelo Tosatti <mtosatti@redhat.com>
+Date: Thu, 23 Jun 2011 13:35:22 -0300
+Subject: Revert "KVM: Save/restore state of assigned PCI device"
+To: greg@kroah.com
+Cc: avi@redhat.com, mtosatti@redhat.com, stable@kernel.org, Alex Williamson <alex.williamson@redhat.com>, "Acked-by: Jan Kiszka" <jan.kiszka@siemens.com>
+Message-ID: <20110623163817.216179016@amt.cnet>
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+This reverts ed78661f2614d3c9f69c23e280db3bafdabdf5bb as it assumes
+the saved PCI state will remain valid for the entire length of time
+that it is attached to a guest.  This fails when userspace makes use
+of the pci-sysfs reset interface, which invalidates the saved device
+state, leaving nothing to be restored after the device is reset on
+de-assignment.  This leaves the device in an unusable state.
+
+3.0.0 will add an interface for KVM to save the PCI state in a
+buffer unaffected by other callers of pci_reset_function(), but the
+most appropriate stable fix seems to be reverting this change since
+the original assumption about the device saved state persisting is
+incorrect.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ virt/kvm/assigned-dev.c |    5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/virt/kvm/assigned-dev.c
++++ b/virt/kvm/assigned-dev.c
+@@ -197,8 +197,7 @@ static void kvm_free_assigned_device(str
+ {
+ 	kvm_free_assigned_irq(kvm, assigned_dev);
+ 
+-	__pci_reset_function(assigned_dev->dev);
+-	pci_restore_state(assigned_dev->dev);
++	pci_reset_function(assigned_dev->dev);
+ 
+ 	pci_release_regions(assigned_dev->dev);
+ 	pci_disable_device(assigned_dev->dev);
+@@ -515,7 +514,6 @@ static int kvm_vm_ioctl_assign_device(st
+ 	}
+ 
+ 	pci_reset_function(dev);
+-	pci_save_state(dev);
+ 
+ 	match->assigned_dev_id = assigned_dev->assigned_dev_id;
+ 	match->host_segnr = assigned_dev->segnr;
+@@ -546,7 +544,6 @@ out:
+ 	mutex_unlock(&kvm->lock);
+ 	return r;
+ out_list_del:
+-	pci_restore_state(dev);
+ 	list_del(&match->list);
+ 	pci_release_regions(dev);
+ out_disable:
diff --git a/queue-2.6.39/series b/queue-2.6.39/series
index f81b3f19aa..c8dc84e1ed 100644
--- a/queue-2.6.39/series
+++ b/queue-2.6.39/series
@@ -48,3 +48,60 @@ pxa168_eth-fix-race-in-transmit-path.patch
 ath9k-fix-suspend-resume-when-no-interface-is-up.patch
 x86-suspend-restore-misc_enable-msr-in-realmode-wakeup.patch
 oprofile-x86-fix-race-in-nmi-handler-while-starting.patch
+mmc-tmio-fix-regression-in-tmio_mmc_wrprotect_disable.patch
+mmc-add-pci-fixup-quirks-for-ricoh-1180-e823-reader.patch
+mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch
+block-add-req_secure-to-req_common_mask.patch
+nfs41-do-not-update-isize-if-inode-needs-layoutcommit.patch
+mm-hotplug-fix-error-handling-in-mem_online_node.patch
+alsa-hda-remove-quirk-for-an-hp-device.patch
+alsa-hda-add-a-new-conexant-codec-id-506c.patch
+rc-fix-ghost-keypresses-with-certain-hw.patch
+lirc_zilog-fix-spinning-rx-thread.patch
+keymaps-fix-table-for-pinnacle-pctv-hd-devices.patch
+uvcvideo-remove-buffers-from-the-queues-when.patch
+ite-cir-8709-needs-to-use-pnp-resource-2.patch
+watchdog-mtx1-wdt-request-gpio-before-using-it.patch
+nfsd-v4-support-requires-crypto.patch
+nfsd-fix-dependency-of-nfsd-on-auth_rpcgss.patch
+nfsd-link-returns-nfserr_delay-when-breaking-lease.patch
+nfsd4-fix-break_lease-flags-on-nfsd-open.patch
+nfsv4.1-allow-nfs_fhget-to-succeed-with-mounted-on-fileid.patch
+nfsv4.1-allow-zero-fh-array-in-filelayout-decode-layout.patch
+nfsv4-fix-a-readdir-regression.patch
+input-properly-assign-return-value-of-clamp-macro.patch
+debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch
+cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch
+cfq-iosched-fix-a-rcu-warning.patch
+cfq-iosched-make-code-consistent.patch
+block-use-the-passed-in-bdev-when-claiming-if-partno-is.patch
+pci-pm-block-races-between-runtime-pm-and-system-sleep.patch
+pm-rename-dev_pm_info.in_suspend-to-is_prepared.patch
+pm-fix-async-resume-following-suspend-failure.patch
+pm-hibernate-fix-free_unnecessary_pages.patch
+keys-fix-error-handling-in-construct_key_and_link.patch
+i2c-taos-evm-fix-log-messages.patch
+i2c-pca954x-initialize-the-mux-to-disconnected-state.patch
+hfsplus-add-missing-call-to-bio_put.patch
+md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch
+sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch
+asoc-pxa-ssp-correct-check-for-stream-presence.patch
+drivers-base-platform.c-don-t-mark.patch
+fs-fix-lock-initialization.patch
+fs-cache-add-a-helper-to-bulk-uncache-pages-on-an-inode.patch
+6pack-mkiss-fix-lock-inconsistency.patch
+iwlagn-fix-change_interface-for-p2p-types.patch
+drivers-misc-lkdtm.c-fix-race-when-crashpoint-is-hit.patch
+taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch
+fix-cpu-spinlock-lockups-on-secondary-cpu-bringup.patch
+nlm-don-t-hang-forever-on-nlm-unlock-requests.patch
+usb-don-t-let-errors-prevent-system-sleep.patch
+usb-don-t-let-the-hub-driver-prevent-system-sleep.patch
+usb-fix-regression-occurring-during-device-removal.patch
+ipv4-fix-multicast-losses.patch
+netfilter-fix-ip_route_me_harder-triggering-ip_rt_bug.patch
+vlan-fix-typo-in-vlan_dev_hard_start_xmit.patch
+xfrm-fix-off-by-one-in-the-replay-advance-functions.patch
+revert-kvm-save-restore-state-of-assigned-pci-device.patch
+kvm-fix-register-corruption-in-pvclock_scale_delta.patch
+ipvs-netns-exit-causes-crash-in-conntrack.patch
diff --git a/queue-2.6.39/sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch b/queue-2.6.39/sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch
new file mode 100644
index 0000000000..3864dca880
--- /dev/null
+++ b/queue-2.6.39/sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch
@@ -0,0 +1,49 @@
+From 5afa9133cfe67f1bfead6049a9640c9262a7101c Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 17 Jun 2011 10:14:59 -0400
+Subject: SUNRPC: Ensure the RPC client only quits on fatal signals
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 5afa9133cfe67f1bfead6049a9640c9262a7101c upstream.
+
+Fix a couple of instances where we were exiting the RPC client on
+arbitrary signals. We should only do so on fatal signals.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/auth_gss.c |    4 ++--
+ net/sunrpc/clnt.c              |    2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -577,13 +577,13 @@ retry:
+ 	}
+ 	inode = &gss_msg->inode->vfs_inode;
+ 	for (;;) {
+-		prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_INTERRUPTIBLE);
++		prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
+ 		spin_lock(&inode->i_lock);
+ 		if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
+ 			break;
+ 		}
+ 		spin_unlock(&inode->i_lock);
+-		if (signalled()) {
++		if (fatal_signal_pending(current)) {
+ 			err = -ERESTARTSYS;
+ 			goto out_intr;
+ 		}
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1058,7 +1058,7 @@ call_allocate(struct rpc_task *task)
+ 
+ 	dprintk("RPC: %5u rpc_buffer allocation failed\n", task->tk_pid);
+ 
+-	if (RPC_IS_ASYNC(task) || !signalled()) {
++	if (RPC_IS_ASYNC(task) || !fatal_signal_pending(current)) {
+ 		task->tk_action = call_allocate;
+ 		rpc_delay(task, HZ>>4);
+ 		return;
diff --git a/queue-2.6.39/taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch b/queue-2.6.39/taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch
new file mode 100644
index 0000000000..24564ba911
--- /dev/null
+++ b/queue-2.6.39/taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch
@@ -0,0 +1,80 @@
+From 26c4caea9d697043cc5a458b96411b86d7f6babd Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Mon, 27 Jun 2011 16:18:11 -0700
+Subject: taskstats: don't allow duplicate entries in listener mode
+
+From: Vasiliy Kulikov <segoon@openwall.com>
+
+commit 26c4caea9d697043cc5a458b96411b86d7f6babd upstream.
+
+Currently a single process may register exit handlers unlimited times.
+It may lead to a bloated listeners chain and very slow process
+terminations.
+
+Eg after 10KK sent TASKSTATS_CMD_ATTR_REGISTER_CPUMASKs ~300 Mb of
+kernel memory is stolen for the handlers chain and "time id" shows 2-7
+seconds instead of normal 0.003.  It makes it possible to exhaust all
+kernel memory and to eat much of CPU time by triggerring numerous exits
+on a single CPU.
+
+The patch limits the number of times a single process may register
+itself on a single CPU to one.
+
+One little issue is kept unfixed - as taskstats_exit() is called before
+exit_files() in do_exit(), the orphaned listener entry (if it was not
+explicitly deregistered) is kept until the next someone's exit() and
+implicit deregistration in send_cpu_listeners().  So, if a process
+registered itself as a listener exits and the next spawned process gets
+the same pid, it would inherit taskstats attributes.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/taskstats.c |   15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -285,16 +285,18 @@ ret:
+ static int add_del_listener(pid_t pid, const struct cpumask *mask, int isadd)
+ {
+ 	struct listener_list *listeners;
+-	struct listener *s, *tmp;
++	struct listener *s, *tmp, *s2;
+ 	unsigned int cpu;
+ 
+ 	if (!cpumask_subset(mask, cpu_possible_mask))
+ 		return -EINVAL;
+ 
++	s = NULL;
+ 	if (isadd == REGISTER) {
+ 		for_each_cpu(cpu, mask) {
+-			s = kmalloc_node(sizeof(struct listener), GFP_KERNEL,
+-					 cpu_to_node(cpu));
++			if (!s)
++				s = kmalloc_node(sizeof(struct listener),
++						 GFP_KERNEL, cpu_to_node(cpu));
+ 			if (!s)
+ 				goto cleanup;
+ 			s->pid = pid;
+@@ -303,9 +305,16 @@ static int add_del_listener(pid_t pid, c
+ 
+ 			listeners = &per_cpu(listener_array, cpu);
+ 			down_write(&listeners->sem);
++			list_for_each_entry_safe(s2, tmp, &listeners->list, list) {
++				if (s2->pid == pid)
++					goto next_cpu;
++			}
+ 			list_add(&s->list, &listeners->list);
++			s = NULL;
++next_cpu:
+ 			up_write(&listeners->sem);
+ 		}
++		kfree(s);
+ 		return 0;
+ 	}
+ 
diff --git a/queue-2.6.39/usb-don-t-let-errors-prevent-system-sleep.patch b/queue-2.6.39/usb-don-t-let-errors-prevent-system-sleep.patch
new file mode 100644
index 0000000000..28dd678134
--- /dev/null
+++ b/queue-2.6.39/usb-don-t-let-errors-prevent-system-sleep.patch
@@ -0,0 +1,56 @@
+From 0af212ba8f123c2eba151af7726c34a50b127962 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 15 Jun 2011 16:27:43 -0400
+Subject: USB: don't let errors prevent system sleep
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 0af212ba8f123c2eba151af7726c34a50b127962 upstream.
+
+This patch (as1464) implements the recommended policy that most errors
+during suspend or hibernation should not prevent the system from going
+to sleep.  In particular, failure to suspend a USB driver or a USB
+device should not prevent the sleep from succeeding:
+
+Failure to suspend a device won't matter, because the device will
+automatically go into suspend mode when the USB bus stops carrying
+packets.  (This might be less true for USB-3.0 devices, but let's not
+worry about them now.)
+
+Failure of a driver to suspend might lead to trouble later on when the
+system wakes up, but it isn't sufficient reason to prevent the system
+from going to sleep.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/driver.c |   11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1187,13 +1187,22 @@ static int usb_suspend_both(struct usb_d
+ 		for (i = n - 1; i >= 0; --i) {
+ 			intf = udev->actconfig->interface[i];
+ 			status = usb_suspend_interface(udev, intf, msg);
++
++			/* Ignore errors during system sleep transitions */
++			if (!(msg.event & PM_EVENT_AUTO))
++				status = 0;
+ 			if (status != 0)
+ 				break;
+ 		}
+ 	}
+-	if (status == 0)
++	if (status == 0) {
+ 		status = usb_suspend_device(udev, msg);
+ 
++		/* Again, ignore errors during system sleep transitions */
++		if (!(msg.event & PM_EVENT_AUTO))
++			status = 0;
++	}
++
+ 	/* If the suspend failed, resume interfaces that did get suspended */
+ 	if (status != 0) {
+ 		msg.event ^= (PM_EVENT_SUSPEND | PM_EVENT_RESUME);
diff --git a/queue-2.6.39/usb-don-t-let-the-hub-driver-prevent-system-sleep.patch b/queue-2.6.39/usb-don-t-let-the-hub-driver-prevent-system-sleep.patch
new file mode 100644
index 0000000000..1d4bd8b0bc
--- /dev/null
+++ b/queue-2.6.39/usb-don-t-let-the-hub-driver-prevent-system-sleep.patch
@@ -0,0 +1,65 @@
+From cbb330045e5df8f665ac60227ff898421fc8fb92 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 15 Jun 2011 16:29:16 -0400
+Subject: USB: don't let the hub driver prevent system sleep
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit cbb330045e5df8f665ac60227ff898421fc8fb92 upstream.
+
+This patch (as1465) continues implementation of the policy that errors
+during suspend or hibernation should not prevent the system from going
+to sleep.
+
+In this case, failure to turn on the Suspend feature for a hub port
+shouldn't be reported as an error.  There are situations where this
+does actually occur (such as when the device plugged into that port
+was disconnected in the recent past), and it turns out to be harmless.
+There's no reason for it to prevent a system sleep.
+
+Also, don't allow the hub driver to fail a system suspend if the
+downstream ports aren't all suspended.  This is also harmless (and
+should never happen, given the change mentioned above); printing a
+warning message in the kernel log is all we really need to do.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hub.c |   13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2311,6 +2311,10 @@ int usb_port_suspend(struct usb_device *
+ 				USB_DEVICE_REMOTE_WAKEUP, 0,
+ 				NULL, 0,
+ 				USB_CTRL_SET_TIMEOUT);
++
++		/* System sleep transitions should never fail */
++		if (!(msg.event & PM_EVENT_AUTO))
++			status = 0;
+ 	} else {
+ 		/* device has up to 10 msec to fully suspend */
+ 		dev_dbg(&udev->dev, "usb %ssuspend\n",
+@@ -2549,16 +2553,15 @@ static int hub_suspend(struct usb_interf
+ 	struct usb_device	*hdev = hub->hdev;
+ 	unsigned		port1;
+ 
+-	/* fail if children aren't already suspended */
++	/* Warn if children aren't already suspended */
+ 	for (port1 = 1; port1 <= hdev->maxchild; port1++) {
+ 		struct usb_device	*udev;
+ 
+ 		udev = hdev->children [port1-1];
+ 		if (udev && udev->can_submit) {
+-			if (!(msg.event & PM_EVENT_AUTO))
+-				dev_dbg(&intf->dev, "port %d nyet suspended\n",
+-						port1);
+-			return -EBUSY;
++			dev_warn(&intf->dev, "port %d nyet suspended\n", port1);
++			if (msg.event & PM_EVENT_AUTO)
++				return -EBUSY;
+ 		}
+ 	}
+ 
diff --git a/queue-2.6.39/usb-fix-regression-occurring-during-device-removal.patch b/queue-2.6.39/usb-fix-regression-occurring-during-device-removal.patch
new file mode 100644
index 0000000000..2db5a7bf7a
--- /dev/null
+++ b/queue-2.6.39/usb-fix-regression-occurring-during-device-removal.patch
@@ -0,0 +1,39 @@
+From e534c5b831c8b8e9f5edee5c8a37753c808b80dc Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 1 Jul 2011 16:43:02 -0400
+Subject: USB: fix regression occurring during device removal
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit e534c5b831c8b8e9f5edee5c8a37753c808b80dc upstream.
+
+This patch (as1476) fixes a regression introduced by
+fccf4e86200b8f5edd9a65da26f150e32ba79808 (USB: Free bandwidth when
+usb_disable_device is called).  usb_disconnect() grabs the
+bandwidth_mutex before calling usb_disable_device(), which calls down
+indirectly to usb_set_interface(), which tries to acquire the
+bandwidth_mutex.
+
+The fix causes usb_set_interface() to return early when it is called
+for an interface that has already been unregistered, which is what
+happens in usb_disable_device().
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/message.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1286,6 +1286,8 @@ int usb_set_interface(struct usb_device
+ 			interface);
+ 		return -EINVAL;
+ 	}
++	if (iface->unregistering)
++		return -ENODEV;
+ 
+ 	alt = usb_altnum_to_altsetting(iface, alternate);
+ 	if (!alt) {
diff --git a/queue-2.6.39/uvcvideo-remove-buffers-from-the-queues-when.patch b/queue-2.6.39/uvcvideo-remove-buffers-from-the-queues-when.patch
new file mode 100644
index 0000000000..f2e7e2c8d3
--- /dev/null
+++ b/queue-2.6.39/uvcvideo-remove-buffers-from-the-queues-when.patch
@@ -0,0 +1,44 @@
+From 8ca2c80b170c47eeb55f0c2a0f2b8edf85f35d49 Mon Sep 17 00:00:00 2001
+From: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+Date: Tue, 24 May 2011 12:22:03 -0300
+Subject: [media] uvcvideo: Remove buffers from the queues when
+ freeing
+
+From: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+
+commit 8ca2c80b170c47eeb55f0c2a0f2b8edf85f35d49 upstream.
+
+When freeing memory for the video buffers also remove them from the
+irq & main queues.
+
+This fixes an oops when doing the following:
+
+open ("/dev/video", ..)
+VIDIOC_REQBUFS
+VIDIOC_QBUF
+VIDIOC_REQBUFS
+close ()
+
+As the second VIDIOC_REQBUFS will cause the list entries of the buffers
+to be cleared while they still hang around on the main and irc queues
+
+Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_queue.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/video/uvc/uvc_queue.c
++++ b/drivers/media/video/uvc/uvc_queue.c
+@@ -104,6 +104,8 @@ static int __uvc_free_buffers(struct uvc
+ 	}
+ 
+ 	if (queue->count) {
++		uvc_queue_cancel(queue, 0);
++		INIT_LIST_HEAD(&queue->mainqueue);
+ 		vfree(queue->mem);
+ 		queue->count = 0;
+ 	}
diff --git a/queue-2.6.39/vlan-fix-typo-in-vlan_dev_hard_start_xmit.patch b/queue-2.6.39/vlan-fix-typo-in-vlan_dev_hard_start_xmit.patch
new file mode 100644
index 0000000000..539eb24864
--- /dev/null
+++ b/queue-2.6.39/vlan-fix-typo-in-vlan_dev_hard_start_xmit.patch
@@ -0,0 +1,35 @@
+From 59ac3e37bdc0bf24b81f946727a01204dbd6344d Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+Date: Tue, 31 May 2011 22:53:19 +0000
+Subject: vlan: fix typo in vlan_dev_hard_start_xmit()
+
+
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+
+[ Upstream commit 307f73df2b9829ee5a261d1ed432ff683c426cdf ]
+
+commit 4af429d29b341bb1735f04c2fb960178ed5d52e7 (vlan: lockless
+transmit path) have a typo in vlan_dev_hard_start_xmit(), using
+u64_stats_update_begin() to end the stat update, it should be
+u64_stats_update_end().
+
+Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
+Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/8021q/vlan_dev.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -338,7 +338,7 @@ static netdev_tx_t vlan_dev_hard_start_x
+ 		u64_stats_update_begin(&stats->syncp);
+ 		stats->tx_packets++;
+ 		stats->tx_bytes += len;
+-		u64_stats_update_begin(&stats->syncp);
++		u64_stats_update_end(&stats->syncp);
+ 	} else {
+ 		this_cpu_inc(vlan_dev_info(dev)->vlan_pcpu_stats->tx_dropped);
+ 	}
diff --git a/queue-2.6.39/watchdog-mtx1-wdt-request-gpio-before-using-it.patch b/queue-2.6.39/watchdog-mtx1-wdt-request-gpio-before-using-it.patch
new file mode 100644
index 0000000000..16601908fc
--- /dev/null
+++ b/queue-2.6.39/watchdog-mtx1-wdt-request-gpio-before-using-it.patch
@@ -0,0 +1,47 @@
+From 9b19d40aa3ebaf1078779da10555da2ab8512422 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Wed, 15 Jun 2011 19:15:23 +0200
+Subject: watchdog: mtx1-wdt: request gpio before using it
+
+From: Florian Fainelli <florian@openwrt.org>
+
+commit 9b19d40aa3ebaf1078779da10555da2ab8512422 upstream.
+
+Otherwise, the gpiolib autorequest feature will produce a WARN_ON():
+
+WARNING: at drivers/gpio/gpiolib.c:101 0x8020ec6c()
+autorequest GPIO-215
+[...]
+
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/watchdog/mtx-1_wdt.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/watchdog/mtx-1_wdt.c
++++ b/drivers/watchdog/mtx-1_wdt.c
+@@ -211,6 +211,12 @@ static int __devinit mtx1_wdt_probe(stru
+ 	int ret;
+ 
+ 	mtx1_wdt_device.gpio = pdev->resource[0].start;
++	ret = gpio_request_one(mtx1_wdt_device.gpio,
++				GPIOF_OUT_INIT_HIGH, "mtx1-wdt");
++	if (ret < 0) {
++		dev_err(&pdev->dev, "failed to request gpio");
++		return ret;
++	}
+ 
+ 	spin_lock_init(&mtx1_wdt_device.lock);
+ 	init_completion(&mtx1_wdt_device.stop);
+@@ -236,6 +242,8 @@ static int __devexit mtx1_wdt_remove(str
+ 		mtx1_wdt_device.queue = 0;
+ 		wait_for_completion(&mtx1_wdt_device.stop);
+ 	}
++
++	gpio_free(mtx1_wdt_device.gpio);
+ 	misc_deregister(&mtx1_wdt_misc);
+ 	return 0;
+ }
diff --git a/queue-2.6.39/xfrm-fix-off-by-one-in-the-replay-advance-functions.patch b/queue-2.6.39/xfrm-fix-off-by-one-in-the-replay-advance-functions.patch
new file mode 100644
index 0000000000..e4610aa7f0
--- /dev/null
+++ b/queue-2.6.39/xfrm-fix-off-by-one-in-the-replay-advance-functions.patch
@@ -0,0 +1,41 @@
+From 989d4bc59dbb997b5a17ff252eb3d1014c47102b Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Sun, 5 Jun 2011 20:46:03 +0000
+Subject: xfrm: Fix off by one in the replay advance functions
+
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+[ Upstream commit e756682c8baa47da1648c0c016e9f48ed66bc32d ]
+
+We may write 4 byte too much when we reinitialize the anti replay
+window in the replay advance functions. This patch fixes this by
+adjusting the last index of the initialization loop.
+
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/xfrm/xfrm_replay.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/xfrm/xfrm_replay.c
++++ b/net/xfrm/xfrm_replay.c
+@@ -265,7 +265,7 @@ static void xfrm_replay_advance_bmp(stru
+ 			bitnr = bitnr & 0x1F;
+ 			replay_esn->bmp[nr] |= (1U << bitnr);
+ 		} else {
+-			nr = replay_esn->replay_window >> 5;
++			nr = (replay_esn->replay_window - 1) >> 5;
+ 			for (i = 0; i <= nr; i++)
+ 				replay_esn->bmp[i] = 0;
+ 
+@@ -471,7 +471,7 @@ static void xfrm_replay_advance_esn(stru
+ 			bitnr = bitnr & 0x1F;
+ 			replay_esn->bmp[nr] |= (1U << bitnr);
+ 		} else {
+-			nr = replay_esn->replay_window >> 5;
++			nr = (replay_esn->replay_window - 1) >> 5;
+ 			for (i = 0; i <= nr; i++)
+ 				replay_esn->bmp[i] = 0;
+
author	Greg Kroah-Hartman <gregkh@suse.de>	2011-07-07 16:38:11 -0700
committer	Greg Kroah-Hartman <gregkh@suse.de>	2011-07-07 16:38:11 -0700
commit	a34ad26998d864b800c354b63694f4113ffb29e8 (patch)
tree	7690e87159c6e5ed43b46dad4f49532347ef8634
parent	0c5b40fb181690fcd94f9bb9d2bccf1dd9d0473b (diff)
download	stable-queue-a34ad26998d864b800c354b63694f4113ffb29e8.tar.gz