[kernel] r17398 - in dists/squeeze/linux-2.6/debian: . patches/bugfix/all patches/bugfix/all/stable patches/debian patches/series
Ben Hutchings
benh at alioth.debian.org
Mon May 16 00:28:08 UTC 2011
Author: benh
Date: Mon May 16 00:28:03 2011
New Revision: 17398
Log:
Apply longterm release 2.6.32.40
Added:
dists/squeeze/linux-2.6/debian/patches/bugfix/all/netxen-Remove-references-to-unified-firmware-file.patch
dists/squeeze/linux-2.6/debian/patches/bugfix/all/stable/2.6.32.40.patch
dists/squeeze/linux-2.6/debian/patches/debian/mmc-Avoid-ABI-change-from-suspend-fix-2.patch
- copied, changed from r17294, dists/squeeze/linux-2.6/debian/patches/debian/mmc-Avoid-ABI-change-from-suspend-fix.patch
Modified:
dists/squeeze/linux-2.6/debian/changelog
dists/squeeze/linux-2.6/debian/patches/series/35
Modified: dists/squeeze/linux-2.6/debian/changelog
==============================================================================
--- dists/squeeze/linux-2.6/debian/changelog Sun May 15 14:04:58 2011 (r17397)
+++ dists/squeeze/linux-2.6/debian/changelog Mon May 16 00:28:03 2011 (r17398)
@@ -9,6 +9,20 @@
* bnx2x: Add support for BCM84823
* ar9170usb: Add several additional USB device IDs
* net: Add bna driver for Brocade Ethernet adapters
+ * Add longterm release 2.6.32.40, including:
+ - ubifs: Fix master node recovery
+ - dasd: Correct device table
+ - udp: Fix bogus UFO packet generation (Closes: #626284)
+ - pmcraid: Reject negative request size
+ - af_unix: Only allow recv on connected seqpacket sockets.
+ - [armel] Prevent heap corruption in OABI semtimedop
+ - usb: musb: core: set has_tt flag
+ For the complete list of changes, see:
+ http://www.kernel.org/pub/linux/kernel/v2.6/longterm/v2.6.32/ChangeLog-2.6.32.40
+ * USB: Prevent buggy hubs from crashing the USB stack (deferred from
+ 2.6.32.29 due to regressions which were fixed in 2.6.32.40)
+ * [x86] cpu: Set ARAT feature on some AMD processors (deferred from
+ 2.6.32.39 due to apparent regression which was fixed in 2.6.32.40)
[ Ian Campbell ]
* Remove lazy vunmap for non-Xen flavours too. (Closes: #613634)
Added: dists/squeeze/linux-2.6/debian/patches/bugfix/all/netxen-Remove-references-to-unified-firmware-file.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/squeeze/linux-2.6/debian/patches/bugfix/all/netxen-Remove-references-to-unified-firmware-file.patch Mon May 16 00:28:03 2011 (r17398)
@@ -0,0 +1,57 @@
+From 48741c09d217357ef286af320ab0b4c5032a2062 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Sun, 15 May 2011 17:51:13 +0100
+Subject: [PATCH] netxen: Remove references to unified firmware file
+
+Commit c23a103f0d9c2560c6839ed366feebec4cd5e556 wrongly introduced
+references to the unified firmware file "phanfw.bin", which is not
+supported by netxen in 2.6.32. The driver reports this filename when
+loading firmware from flash, and includes a MODULE_FIRMWARE hint for
+the filename even though it will never use it.
+
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+---
+ drivers/net/netxen/netxen_nic.h | 1 -
+ drivers/net/netxen/netxen_nic_init.c | 1 -
+ drivers/net/netxen/netxen_nic_main.c | 1 -
+ 3 files changed, 0 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
+index 71975ba..e52af5b 100644
+--- a/drivers/net/netxen/netxen_nic.h
++++ b/drivers/net/netxen/netxen_nic.h
+@@ -490,7 +490,6 @@ struct status_desc {
+ #define NX_P2_MN_ROMIMAGE_NAME "nxromimg.bin"
+ #define NX_P3_CT_ROMIMAGE_NAME "nx3fwct.bin"
+ #define NX_P3_MN_ROMIMAGE_NAME "nx3fwmn.bin"
+-#define NX_UNIFIED_ROMIMAGE_NAME "phanfw.bin"
+ #define NX_FLASH_ROMIMAGE_NAME "flash"
+
+ extern char netxen_nic_driver_name[];
+diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
+index 562a488..7167c91 100644
+--- a/drivers/net/netxen/netxen_nic_init.c
++++ b/drivers/net/netxen/netxen_nic_init.c
+@@ -676,7 +676,6 @@ static char *fw_name[] = {
+ NX_P2_MN_ROMIMAGE_NAME,
+ NX_P3_CT_ROMIMAGE_NAME,
+ NX_P3_MN_ROMIMAGE_NAME,
+- NX_UNIFIED_ROMIMAGE_NAME,
+ NX_FLASH_ROMIMAGE_NAME,
+ };
+
+diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
+index 9890a7e..166fc23 100644
+--- a/drivers/net/netxen/netxen_nic_main.c
++++ b/drivers/net/netxen/netxen_nic_main.c
+@@ -41,7 +41,6 @@ MODULE_VERSION(NETXEN_NIC_LINUX_VERSIONID);
+ MODULE_FIRMWARE(NX_P2_MN_ROMIMAGE_NAME);
+ MODULE_FIRMWARE(NX_P3_CT_ROMIMAGE_NAME);
+ MODULE_FIRMWARE(NX_P3_MN_ROMIMAGE_NAME);
+-MODULE_FIRMWARE(NX_UNIFIED_ROMIMAGE_NAME);
+
+ char netxen_nic_driver_name[] = "netxen_nic";
+ static char netxen_nic_driver_string[] = "NetXen Network Driver version "
+--
+1.7.4.4
+
Added: dists/squeeze/linux-2.6/debian/patches/bugfix/all/stable/2.6.32.40.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/squeeze/linux-2.6/debian/patches/bugfix/all/stable/2.6.32.40.patch Mon May 16 00:28:03 2011 (r17398)
@@ -0,0 +1,4711 @@
+diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
+index 4c7f9ae..92dc1ab 100644
+--- a/Documentation/sound/alsa/HD-Audio-Models.txt
++++ b/Documentation/sound/alsa/HD-Audio-Models.txt
+@@ -401,4 +401,5 @@ STAC9872
+ Cirrus Logic CS4206/4207
+ ========================
+ mbp55 MacBook Pro 5,5
++ imac27 IMac 27 Inch
+ auto BIOS setup (default)
+diff --git a/Documentation/usb/proc_usb_info.txt b/Documentation/usb/proc_usb_info.txt
+index fafcd47..afe596d 100644
+--- a/Documentation/usb/proc_usb_info.txt
++++ b/Documentation/usb/proc_usb_info.txt
+@@ -1,12 +1,17 @@
+ /proc/bus/usb filesystem output
+ ===============================
+-(version 2003.05.30)
++(version 2010.09.13)
+
+
+ The usbfs filesystem for USB devices is traditionally mounted at
+ /proc/bus/usb. It provides the /proc/bus/usb/devices file, as well as
+ the /proc/bus/usb/BBB/DDD files.
+
++In many modern systems the usbfs filsystem isn't used at all. Instead
++USB device nodes are created under /dev/usb/ or someplace similar. The
++"devices" file is available in debugfs, typically as
++/sys/kernel/debug/usb/devices.
++
+
+ **NOTE**: If /proc/bus/usb appears empty, and a host controller
+ driver has been linked, then you need to mount the
+@@ -106,8 +111,8 @@ Legend:
+
+ Topology info:
+
+-T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd
+-| | | | | | | | |__MaxChildren
++T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd
++| | | | | | | | |__MaxChildren
+ | | | | | | | |__Device Speed in Mbps
+ | | | | | | |__DeviceNumber
+ | | | | | |__Count of devices at this level
+@@ -120,8 +125,13 @@ T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd
+ Speed may be:
+ 1.5 Mbit/s for low speed USB
+ 12 Mbit/s for full speed USB
+- 480 Mbit/s for high speed USB (added for USB 2.0)
++ 480 Mbit/s for high speed USB (added for USB 2.0);
++ also used for Wireless USB, which has no fixed speed
++ 5000 Mbit/s for SuperSpeed USB (added for USB 3.0)
+
++ For reasons lost in the mists of time, the Port number is always
++ too low by 1. For example, a device plugged into port 4 will
++ show up with "Port=03".
+
+ Bandwidth info:
+ B: Alloc=ddd/ddd us (xx%), #Int=ddd, #Iso=ddd
+@@ -291,7 +301,7 @@ Here's an example, from a system which has a UHCI root hub,
+ an external hub connected to the root hub, and a mouse and
+ a serial converter connected to the external hub.
+
+-T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
++T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
+ B: Alloc= 28/900 us ( 3%), #Int= 2, #Iso= 0
+ D: Ver= 1.00 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
+ P: Vendor=0000 ProdID=0000 Rev= 0.00
+@@ -301,21 +311,21 @@ C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr= 0mA
+ I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
+ E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=255ms
+
+-T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
++T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
+ D: Ver= 1.00 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
+ P: Vendor=0451 ProdID=1446 Rev= 1.00
+ C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=100mA
+ I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
+ E: Ad=81(I) Atr=03(Int.) MxPS= 1 Ivl=255ms
+
+-T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
++T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
+ D: Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
+ P: Vendor=04b4 ProdID=0001 Rev= 0.00
+ C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA
+ I: If#= 0 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=01 Prot=02 Driver=mouse
+ E: Ad=81(I) Atr=03(Int.) MxPS= 3 Ivl= 10ms
+
+-T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
++T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
+ D: Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
+ P: Vendor=0565 ProdID=0001 Rev= 1.08
+ S: Manufacturer=Peracom Networks, Inc.
+@@ -330,12 +340,12 @@ E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl= 8ms
+ Selecting only the "T:" and "I:" lines from this (for example, by using
+ "procusb ti"), we have:
+
+-T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
+-T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
++T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
++T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
+ I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
+-T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
++T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
+ I: If#= 0 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=01 Prot=02 Driver=mouse
+-T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
++T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
+ I: If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=serial
+
+
+diff --git a/Makefile b/Makefile
+index 1889944..b31b10c 100644
+diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
+index d59a0cd..897b879 100644
+--- a/arch/arm/kernel/sys_oabi-compat.c
++++ b/arch/arm/kernel/sys_oabi-compat.c
+@@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int semid,
+ long err;
+ int i;
+
+- if (nsops < 1)
++ if (nsops < 1 || nsops > SEMOPM)
+ return -EINVAL;
+ sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
+ if (!sops)
+diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
+index 4665fc8..e7ad9ca 100644
+--- a/arch/m68k/mm/motorola.c
++++ b/arch/m68k/mm/motorola.c
+@@ -299,6 +299,8 @@ void __init paging_init(void)
+ zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
+ free_area_init_node(i, zones_size,
+ m68k_memory[i].addr >> PAGE_SHIFT, NULL);
++ if (node_present_pages(i))
++ node_set_state(i, N_NORMAL_MEMORY);
+ }
+ }
+
+diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
+index 9367e33..3d9bb9b 100644
+--- a/arch/mips/mm/dma-default.c
++++ b/arch/mips/mm/dma-default.c
+@@ -43,27 +43,39 @@ static inline int cpu_is_noncoherent_r10000(struct device *dev)
+
+ static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
+ {
++ gfp_t dma_flag;
++
+ /* ignore region specifiers */
+ gfp &= ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM);
+
+-#ifdef CONFIG_ZONE_DMA
++#ifdef CONFIG_ISA
+ if (dev == NULL)
+- gfp |= __GFP_DMA;
+- else if (dev->coherent_dma_mask < DMA_BIT_MASK(24))
+- gfp |= __GFP_DMA;
++ dma_flag = __GFP_DMA;
+ else
+ #endif
+-#ifdef CONFIG_ZONE_DMA32
++#if defined(CONFIG_ZONE_DMA32) && defined(CONFIG_ZONE_DMA)
+ if (dev->coherent_dma_mask < DMA_BIT_MASK(32))
+- gfp |= __GFP_DMA32;
++ dma_flag = __GFP_DMA;
++ else if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
++ dma_flag = __GFP_DMA32;
++ else
++#endif
++#if defined(CONFIG_ZONE_DMA32) && !defined(CONFIG_ZONE_DMA)
++ if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
++ dma_flag = __GFP_DMA32;
++ else
++#endif
++#if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
++ if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
++ dma_flag = __GFP_DMA;
+ else
+ #endif
+- ;
++ dma_flag = 0;
+
+ /* Don't invoke OOM killer */
+ gfp |= __GFP_NORETRY;
+
+- return gfp;
++ return gfp | dma_flag;
+ }
+
+ void *dma_alloc_noncoherent(struct device *dev, size_t size,
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index 13b6e3e..2609f4d 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -265,8 +265,10 @@ static void __init setup_bootmem(void)
+ }
+ memset(pfnnid_map, 0xff, sizeof(pfnnid_map));
+
+- for (i = 0; i < npmem_ranges; i++)
++ for (i = 0; i < npmem_ranges; i++) {
++ node_set_state(i, N_NORMAL_MEMORY);
+ node_set_online(i);
++ }
+ #endif
+
+ /*
+diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
+index 7bfc8ad..2ce2ed2 100644
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -364,7 +364,7 @@ INSTALL := install
+ extra-installed := $(patsubst $(obj)/%, $(DESTDIR)$(WRAPPER_OBJDIR)/%, $(extra-y))
+ hostprogs-installed := $(patsubst %, $(DESTDIR)$(WRAPPER_BINDIR)/%, $(hostprogs-y))
+ wrapper-installed := $(DESTDIR)$(WRAPPER_BINDIR)/wrapper
+-dts-installed := $(patsubst $(obj)/dts/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(obj)/dts/*.dts))
++dts-installed := $(patsubst $(dtstree)/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(dtstree)/*.dts))
+
+ all-installed := $(extra-installed) $(hostprogs-installed) $(wrapper-installed) $(dts-installed)
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 600807b..08bc2ff 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -357,6 +357,9 @@ struct kvm_vcpu_arch {
+ struct page *time_page;
+
+ bool singlestep; /* guest is single stepped by KVM */
++ u64 last_guest_tsc;
++ u64 last_kernel_ns;
++
+ bool nmi_pending;
+ bool nmi_injected;
+
+diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
+index daaacab..982aa32 100644
+--- a/arch/x86/include/asm/pvclock.h
++++ b/arch/x86/include/asm/pvclock.h
+@@ -12,4 +12,42 @@ void pvclock_read_wallclock(struct pvclock_wall_clock *wall,
+ struct timespec *ts);
+ void pvclock_resume(void);
+
++/*
++ * Scale a 64-bit delta by scaling and multiplying by a 32-bit fraction,
++ * yielding a 64-bit result.
++ */
++static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
++{
++ u64 product;
++#ifdef __i386__
++ u32 tmp1, tmp2;
++#endif
++
++ if (shift < 0)
++ delta >>= -shift;
++ else
++ delta <<= shift;
++
++#ifdef __i386__
++ __asm__ (
++ "mul %5 ; "
++ "mov %4,%%eax ; "
++ "mov %%edx,%4 ; "
++ "mul %5 ; "
++ "xor %5,%5 ; "
++ "add %4,%%eax ; "
++ "adc %5,%%edx ; "
++ : "=A" (product), "=r" (tmp1), "=r" (tmp2)
++ : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
++#elif defined(__x86_64__)
++ __asm__ (
++ "mul %%rdx ; shrd $32,%%rdx,%%rax"
++ : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
++#else
++#error implement me!
++#endif
++
++ return product;
++}
++
+ #endif /* _ASM_X86_PVCLOCK_H */
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index f893f73..8f9c307 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -653,7 +653,7 @@ cpu_dev_register(amd_cpu_dev);
+ */
+
+ const int amd_erratum_400[] =
+- AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),
++ AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0x0f, 0x4, 0x2, 0xff, 0xf),
+ AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf));
+
+
+diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
+index b12fe8d..929047c 100644
+--- a/arch/x86/kernel/pvclock.c
++++ b/arch/x86/kernel/pvclock.c
+@@ -74,7 +74,8 @@ static inline u64 scale_delta(u64 delta, u32 mul_frac, int shift)
+ static u64 pvclock_get_nsec_offset(struct pvclock_shadow_time *shadow)
+ {
+ u64 delta = native_read_tsc() - shadow->tsc_timestamp;
+- return scale_delta(delta, shadow->tsc_to_nsec_mul, shadow->tsc_shift);
++ return pvclock_scale_delta(delta, shadow->tsc_to_nsec_mul,
++ shadow->tsc_shift);
+ }
+
+ /*
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index b2c02a2..df1cefb 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -47,6 +47,7 @@
+ #include <asm/desc.h>
+ #include <asm/mtrr.h>
+ #include <asm/mce.h>
++#include <asm/pvclock.h>
+
+ #define MAX_IO_MSRS 256
+ #define CR0_RESERVED_BITS \
+@@ -633,6 +634,8 @@ static void kvm_write_guest_time(struct kvm_vcpu *v)
+ struct kvm_vcpu_arch *vcpu = &v->arch;
+ void *shared_kaddr;
+ unsigned long this_tsc_khz;
++ s64 kernel_ns, max_kernel_ns;
++ u64 tsc_timestamp;
+
+ if ((!vcpu->time_page))
+ return;
+@@ -646,15 +649,52 @@ static void kvm_write_guest_time(struct kvm_vcpu *v)
+
+ /* Keep irq disabled to prevent changes to the clock */
+ local_irq_save(flags);
+- kvm_get_msr(v, MSR_IA32_TSC, &vcpu->hv_clock.tsc_timestamp);
++ kvm_get_msr(v, MSR_IA32_TSC, &tsc_timestamp);
+ ktime_get_ts(&ts);
+ monotonic_to_bootbased(&ts);
++ kernel_ns = timespec_to_ns(&ts);
+ local_irq_restore(flags);
+
++ /*
++ * Time as measured by the TSC may go backwards when resetting the base
++ * tsc_timestamp. The reason for this is that the TSC resolution is
++ * higher than the resolution of the other clock scales. Thus, many
++ * possible measurments of the TSC correspond to one measurement of any
++ * other clock, and so a spread of values is possible. This is not a
++ * problem for the computation of the nanosecond clock; with TSC rates
++ * around 1GHZ, there can only be a few cycles which correspond to one
++ * nanosecond value, and any path through this code will inevitably
++ * take longer than that. However, with the kernel_ns value itself,
++ * the precision may be much lower, down to HZ granularity. If the
++ * first sampling of TSC against kernel_ns ends in the low part of the
++ * range, and the second in the high end of the range, we can get:
++ *
++ * (TSC - offset_low) * S + kns_old > (TSC - offset_high) * S + kns_new
++ *
++ * As the sampling errors potentially range in the thousands of cycles,
++ * it is possible such a time value has already been observed by the
++ * guest. To protect against this, we must compute the system time as
++ * observed by the guest and ensure the new system time is greater.
++ */
++ max_kernel_ns = 0;
++ if (vcpu->hv_clock.tsc_timestamp && vcpu->last_guest_tsc) {
++ max_kernel_ns = vcpu->last_guest_tsc -
++ vcpu->hv_clock.tsc_timestamp;
++ max_kernel_ns = pvclock_scale_delta(max_kernel_ns,
++ vcpu->hv_clock.tsc_to_system_mul,
++ vcpu->hv_clock.tsc_shift);
++ max_kernel_ns += vcpu->last_kernel_ns;
++ }
++
++ if (max_kernel_ns > kernel_ns)
++ kernel_ns = max_kernel_ns;
++
+ /* With all the info we got, fill in the values */
+
+- vcpu->hv_clock.system_time = ts.tv_nsec +
+- (NSEC_PER_SEC * (u64)ts.tv_sec) + v->kvm->arch.kvmclock_offset;
++ vcpu->hv_clock.tsc_timestamp = tsc_timestamp;
++ vcpu->hv_clock.system_time = kernel_ns + v->kvm->arch.kvmclock_offset;
++ vcpu->last_kernel_ns = kernel_ns;
++ vcpu->last_guest_tsc = tsc_timestamp;
+
+ /*
+ * The interface expects us to write an even number signaling that the
+@@ -3695,6 +3735,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+ kvm_x86_ops->prepare_guest_switch(vcpu);
+ kvm_load_guest_fpu(vcpu);
+
++ kvm_get_msr(vcpu, MSR_IA32_TSC, &vcpu->arch.last_guest_tsc);
++
+ local_irq_disable();
+
+ clear_bit(KVM_REQ_KICK, &vcpu->requests);
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 8a6d81a..bb9c5ea 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -440,8 +440,10 @@ int blk_register_queue(struct gendisk *disk)
+ return ret;
+
+ ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
+- if (ret < 0)
++ if (ret < 0) {
++ blk_trace_remove_sysfs(dev);
+ return ret;
++ }
+
+ kobject_uevent(&q->kobj, KOBJ_ADD);
+
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index a158a6c..553edcc 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -1099,13 +1099,13 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
+ /* configure max sectors */
+ blk_queue_max_sectors(sdev->request_queue, dev->max_sectors);
+
++ sdev->sector_size = ATA_SECT_SIZE;
++
+ if (dev->class == ATA_DEV_ATAPI) {
+ struct request_queue *q = sdev->request_queue;
+ void *buf;
+
+- /* set the min alignment and padding */
+- blk_queue_update_dma_alignment(sdev->request_queue,
+- ATA_DMA_PAD_SZ - 1);
++ /* set DMA padding */
+ blk_queue_update_dma_pad(sdev->request_queue,
+ ATA_DMA_PAD_SZ - 1);
+
+@@ -1119,12 +1119,24 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
+
+ blk_queue_dma_drain(q, atapi_drain_needed, buf, ATAPI_MAX_DRAIN);
+ } else {
+- /* ATA devices must be sector aligned */
+- blk_queue_update_dma_alignment(sdev->request_queue,
+- ATA_SECT_SIZE - 1);
+ sdev->manage_start_stop = 1;
+ }
+
++ /*
++ * ata_pio_sectors() expects buffer for each sector to not cross
++ * page boundary. Enforce it by requiring buffers to be sector
++ * aligned, which works iff sector_size is not larger than
++ * PAGE_SIZE. ATAPI devices also need the alignment as
++ * IDENTIFY_PACKET is executed as ATA_PROT_PIO.
++ */
++ if (sdev->sector_size > PAGE_SIZE)
++ ata_dev_printk(dev, KERN_WARNING,
++ "sector_size=%u > PAGE_SIZE, PIO may malfunction\n",
++ sdev->sector_size);
++
++ blk_queue_update_dma_alignment(sdev->request_queue,
++ sdev->sector_size - 1);
++
+ if (dev->flags & ATA_DFLAG_AN)
+ set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events);
+
+diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
+index e35596b..f5dcca7 100644
+--- a/drivers/ata/sata_via.c
++++ b/drivers/ata/sata_via.c
+@@ -40,6 +40,8 @@
+ #include <linux/blkdev.h>
+ #include <linux/delay.h>
+ #include <linux/device.h>
++#include <scsi/scsi.h>
++#include <scsi/scsi_cmnd.h>
+ #include <scsi/scsi_host.h>
+ #include <linux/libata.h>
+
+@@ -80,6 +82,7 @@ static int vt8251_scr_write(struct ata_link *link, unsigned int scr, u32 val);
+ static void svia_tf_load(struct ata_port *ap, const struct ata_taskfile *tf);
+ static void svia_noop_freeze(struct ata_port *ap);
+ static int vt6420_prereset(struct ata_link *link, unsigned long deadline);
++static void vt6420_bmdma_start(struct ata_queued_cmd *qc);
+ static int vt6421_pata_cable_detect(struct ata_port *ap);
+ static void vt6421_set_pio_mode(struct ata_port *ap, struct ata_device *adev);
+ static void vt6421_set_dma_mode(struct ata_port *ap, struct ata_device *adev);
+@@ -121,6 +124,7 @@ static struct ata_port_operations vt6420_sata_ops = {
+ .inherits = &svia_base_ops,
+ .freeze = svia_noop_freeze,
+ .prereset = vt6420_prereset,
++ .bmdma_start = vt6420_bmdma_start,
+ };
+
+ static struct ata_port_operations vt6421_pata_ops = {
+@@ -377,6 +381,17 @@ static int vt6420_prereset(struct ata_link *link, unsigned long deadline)
+ return 0;
+ }
+
++static void vt6420_bmdma_start(struct ata_queued_cmd *qc)
++{
++ struct ata_port *ap = qc->ap;
++ if ((qc->tf.command == ATA_CMD_PACKET) &&
++ (qc->scsicmd->sc_data_direction == DMA_TO_DEVICE)) {
++ /* Prevents corruption on some ATAPI burners */
++ ata_sff_pause(ap);
++ }
++ ata_bmdma_start(qc);
++}
++
+ static int vt6421_pata_cable_detect(struct ata_port *ap)
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c12d0fb..75185a6 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -59,9 +59,18 @@ static struct usb_device_id btusb_table[] = {
+ /* Generic Bluetooth USB device */
+ { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
+
++ /* Apple MacBookPro 7,1 */
++ { USB_DEVICE(0x05ac, 0x8213) },
++
+ /* Apple iMac11,1 */
+ { USB_DEVICE(0x05ac, 0x8215) },
+
++ /* Apple MacBookPro6,2 */
++ { USB_DEVICE(0x05ac, 0x8218) },
++
++ /* Apple MacBookAir3,1, MacBookAir3,2 */
++ { USB_DEVICE(0x05ac, 0x821b) },
++
+ /* Apple MacBookPro8,2 */
+ { USB_DEVICE(0x05ac, 0x821a) },
+
+diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
+index c505439..0d8d60c 100644
+--- a/drivers/char/agp/generic.c
++++ b/drivers/char/agp/generic.c
+@@ -123,6 +123,9 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
+ struct agp_memory *new;
+ unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
+
++ if (INT_MAX/sizeof(struct page *) < num_agp_pages)
++ return NULL;
++
+ new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
+ if (new == NULL)
+ return NULL;
+@@ -242,11 +245,14 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
+ int scratch_pages;
+ struct agp_memory *new;
+ size_t i;
++ int cur_memory;
+
+ if (!bridge)
+ return NULL;
+
+- if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
++ cur_memory = atomic_read(&bridge->current_memory_agp);
++ if ((cur_memory + page_count > bridge->max_memory_agp) ||
++ (cur_memory + page_count < page_count))
+ return NULL;
+
+ if (type >= AGP_USER_TYPES) {
+@@ -1123,8 +1129,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
+ return -EINVAL;
+ }
+
+- /* AK: could wrap */
+- if ((pg_start + mem->page_count) > num_entries)
++ if (((pg_start + mem->page_count) > num_entries) ||
++ ((pg_start + mem->page_count) < pg_start))
+ return -EINVAL;
+
+ j = pg_start;
+@@ -1158,7 +1164,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+ {
+ size_t i;
+ struct agp_bridge_data *bridge;
+- int mask_type;
++ int mask_type, num_entries;
+
+ bridge = mem->bridge;
+ if (!bridge)
+@@ -1170,6 +1176,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+ if (type != mem->type)
+ return -EINVAL;
+
++ num_entries = agp_num_entries();
++ if (((pg_start + mem->page_count) > num_entries) ||
++ ((pg_start + mem->page_count) < pg_start))
++ return -EINVAL;
++
+ mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
+ if (mask_type != 0) {
+ /* The generic routines know nothing of memory types */
+diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
+index fc8cf7a..4365717 100644
+--- a/drivers/char/i8k.c
++++ b/drivers/char/i8k.c
+@@ -119,7 +119,7 @@ static int i8k_smm(struct smm_regs *regs)
+ int eax = regs->eax;
+
+ #if defined(CONFIG_X86_64)
+- asm("pushq %%rax\n\t"
++ asm volatile("pushq %%rax\n\t"
+ "movl 0(%%rax),%%edx\n\t"
+ "pushq %%rdx\n\t"
+ "movl 4(%%rax),%%ebx\n\t"
+@@ -145,7 +145,7 @@ static int i8k_smm(struct smm_regs *regs)
+ : "a"(regs)
+ : "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
+ #else
+- asm("pushl %%eax\n\t"
++ asm volatile("pushl %%eax\n\t"
+ "movl 0(%%eax),%%edx\n\t"
+ "push %%edx\n\t"
+ "movl 4(%%eax),%%ebx\n\t"
+@@ -166,7 +166,8 @@ static int i8k_smm(struct smm_regs *regs)
+ "movl %%edx,0(%%eax)\n\t"
+ "lahf\n\t"
+ "shrl $8,%%eax\n\t"
+- "andl $1,%%eax\n":"=a"(rc)
++ "andl $1,%%eax\n"
++ :"=a"(rc)
+ : "a"(regs)
+ : "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
+ #endif
+diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
+index fed2291..dd72b91 100644
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 5b4d66d..5f38014 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -53,6 +53,27 @@ struct apple_key_translation {
+ u8 flags;
+ };
+
++static const struct apple_key_translation macbookair_fn_keys[] = {
++ { KEY_BACKSPACE, KEY_DELETE },
++ { KEY_ENTER, KEY_INSERT },
++ { KEY_F1, KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY },
++ { KEY_F2, KEY_BRIGHTNESSUP, APPLE_FLAG_FKEY },
++ { KEY_F3, KEY_SCALE, APPLE_FLAG_FKEY },
++ { KEY_F4, KEY_DASHBOARD, APPLE_FLAG_FKEY },
++ { KEY_F6, KEY_PREVIOUSSONG, APPLE_FLAG_FKEY },
++ { KEY_F7, KEY_PLAYPAUSE, APPLE_FLAG_FKEY },
++ { KEY_F8, KEY_NEXTSONG, APPLE_FLAG_FKEY },
++ { KEY_F9, KEY_MUTE, APPLE_FLAG_FKEY },
++ { KEY_F10, KEY_VOLUMEDOWN, APPLE_FLAG_FKEY },
++ { KEY_F11, KEY_VOLUMEUP, APPLE_FLAG_FKEY },
++ { KEY_F12, KEY_EJECTCD, APPLE_FLAG_FKEY },
++ { KEY_UP, KEY_PAGEUP },
++ { KEY_DOWN, KEY_PAGEDOWN },
++ { KEY_LEFT, KEY_HOME },
++ { KEY_RIGHT, KEY_END },
++ { }
++};
++
+ static const struct apple_key_translation apple_fn_keys[] = {
+ { KEY_BACKSPACE, KEY_DELETE },
+ { KEY_ENTER, KEY_INSERT },
+@@ -151,10 +172,15 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ if (fnmode) {
+ int do_translate;
+
+- trans = apple_find_translation((hid->product < 0x21d ||
+- hid->product >= 0x300) ?
+- powerbook_fn_keys : apple_fn_keys,
+- usage->code);
++ if(hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
++ hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) {
++ trans = apple_find_translation(macbookair_fn_keys, usage->code);
++ } else if (hid->product < 0x21d || hid->product >= 0x300) {
++ trans = apple_find_translation(powerbook_fn_keys, usage->code);
++ } else {
++ trans = apple_find_translation(apple_fn_keys, usage->code);
++ }
++
+ if (trans) {
+ if (test_bit(usage->code, asc->pressed_fn))
+ do_translate = 1;
+@@ -431,6 +457,18 @@ static const struct hid_device_id apple_devices[] = {
+ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
+ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI),
++ .driver_data = APPLE_HAS_FN },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO),
++ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS),
++ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI),
++ .driver_data = APPLE_HAS_FN },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO),
++ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS),
++ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
+ .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 5e1b522..f3f1415 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1287,6 +1287,12 @@ static const struct hid_device_id hid_blacklist[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
+@@ -1705,6 +1711,12 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+ { }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index d993e97..aef92bb 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -88,6 +88,12 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI 0x0236
+ #define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO 0x0237
+ #define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS 0x0238
++#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI 0x023f
++#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO 0x0240
++#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS 0x0241
++#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI 0x0242
++#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO 0x0243
++#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS 0x0244
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI 0x0239
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO 0x023a
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS 0x023b
+diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
+index 7ea6a8f..f69f930 100644
+--- a/drivers/hwmon/applesmc.c
++++ b/drivers/hwmon/applesmc.c
+@@ -142,6 +142,30 @@ static const char *temperature_sensors_sets[][41] = {
+ "TM1S", "TM2P", "TM2S", "TM3S", "TM8P", "TM8S", "TM9P", "TM9S",
+ "TN0C", "TN0D", "TN0H", "TS0C", "Tp0C", "Tp1C", "Tv0S", "Tv1S",
+ NULL },
++/* Set 17: iMac 9,1 */
++ { "TA0P", "TC0D", "TC0H", "TC0P", "TG0D", "TG0H", "TH0P", "TL0P",
++ "TN0D", "TN0H", "TN0P", "TO0P", "Tm0P", "Tp0P", NULL },
++/* Set 18: MacBook Pro 2,2 */
++ { "TB0T", "TC0D", "TC0P", "TG0H", "TG0P", "TG0T", "TM0P", "TTF0",
++ "Th0H", "Th1H", "Tm0P", "Ts0P", NULL },
++/* Set 19: Macbook Pro 5,3 */
++ { "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TG0D",
++ "TG0F", "TG0H", "TG0P", "TG0T", "TN0D", "TN0P", "TTF0", "Th2H",
++ "Tm0P", "Ts0P", "Ts0S", NULL },
++/* Set 20: MacBook Pro 5,4 */
++ { "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TN0D",
++ "TN0P", "TTF0", "Th2H", "Ts0P", "Ts0S", NULL },
++/* Set 21: MacBook Pro 6,2 */
++ { "TB0T", "TB1T", "TB2T", "TC0C", "TC0D", "TC0P", "TC1C", "TG0D",
++ "TG0P", "TG0T", "TMCD", "TP0P", "TPCD", "Th1H", "Th2H", "Tm0P",
++ "Ts0P", "Ts0S", NULL },
++/* Set 22: MacBook Pro 7,1 */
++ { "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S",
++ "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL },
++/* Set 23: MacBook Air 3,1 */
++ { "TB0T", "TB1T", "TB2T", "TC0D", "TC0E", "TC0P", "TC1E", "TCZ3",
++ "TCZ4", "TCZ5", "TG0E", "TG1E", "TG2E", "TGZ3", "TGZ4", "TGZ5",
++ "TH0F", "TH0O", "TM0P" },
+ };
+
+ /* List of keys used to read/write fan speeds */
+@@ -1350,11 +1374,29 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
+ { .accelerometer = 1, .light = 1, .temperature_set = 15 },
+ /* MacPro3,1: temperature set 16 */
+ { .accelerometer = 0, .light = 0, .temperature_set = 16 },
++/* iMac 9,1: light sensor only, temperature set 17 */
++ { .accelerometer = 0, .light = 0, .temperature_set = 17 },
++/* MacBook Pro 2,2: accelerometer, backlight and temperature set 18 */
++ { .accelerometer = 1, .light = 1, .temperature_set = 18 },
++/* MacBook Pro 5,3: accelerometer, backlight and temperature set 19 */
++ { .accelerometer = 1, .light = 1, .temperature_set = 19 },
++/* MacBook Pro 5,4: accelerometer, backlight and temperature set 20 */
++ { .accelerometer = 1, .light = 1, .temperature_set = 20 },
++/* MacBook Pro 6,2: accelerometer, backlight and temperature set 21 */
++ { .accelerometer = 1, .light = 1, .temperature_set = 21 },
++/* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */
++ { .accelerometer = 1, .light = 1, .temperature_set = 22 },
++/* MacBook Air 3,1: accelerometer, backlight and temperature set 23 */
++ { .accelerometer = 0, .light = 0, .temperature_set = 23 },
+ };
+
+ /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
+ * So we need to put "Apple MacBook Pro" before "Apple MacBook". */
+ static __initdata struct dmi_system_id applesmc_whitelist[] = {
++ { applesmc_dmi_match, "Apple MacBook Air 3", {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3") },
++ &applesmc_dmi_data[23]},
+ { applesmc_dmi_match, "Apple MacBook Air 2", {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir2") },
+@@ -1363,6 +1405,22 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir") },
+ &applesmc_dmi_data[7]},
++ { applesmc_dmi_match, "Apple MacBook Pro 7", {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro7") },
++ &applesmc_dmi_data[22]},
++ { applesmc_dmi_match, "Apple MacBook Pro 5,4", {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,4") },
++ &applesmc_dmi_data[20]},
++ { applesmc_dmi_match, "Apple MacBook Pro 5,3", {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,3") },
++ &applesmc_dmi_data[19]},
++ { applesmc_dmi_match, "Apple MacBook Pro 6", {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro6") },
++ &applesmc_dmi_data[21]},
+ { applesmc_dmi_match, "Apple MacBook Pro 5", {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5") },
+@@ -1375,6 +1433,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro3") },
+ &applesmc_dmi_data[9]},
++ { applesmc_dmi_match, "Apple MacBook Pro 2,2", {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple Computer, Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro2,2") },
++ &applesmc_dmi_data[18]},
+ { applesmc_dmi_match, "Apple MacBook Pro", {
+ DMI_MATCH(DMI_BOARD_VENDOR,"Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME,"MacBookPro") },
+@@ -1415,6 +1477,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacPro") },
+ &applesmc_dmi_data[4]},
++ { applesmc_dmi_match, "Apple iMac 9,1", {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1") },
++ &applesmc_dmi_data[17]},
+ { applesmc_dmi_match, "Apple iMac 8", {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac8") },
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index fda35e6..5b2339a 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -24,6 +24,10 @@
+ printk(KERN_DEBUG format, ##arg); \
+ } while (0)
+
++static bool force_elantech;
++module_param_named(force_elantech, force_elantech, bool, 0644);
++MODULE_PARM_DESC(force_elantech, "Force the Elantech PS/2 protocol extension to be used, 1 = enabled, 0 = disabled (default).");
++
+ /*
+ * Send a Synaptics style sliced query command
+ */
+@@ -178,36 +182,44 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
+ struct elantech_data *etd = psmouse->private;
+ unsigned char *packet = psmouse->packet;
+ int fingers;
+- static int old_fingers;
+
+- if (etd->fw_version_maj == 0x01) {
+- /* byte 0: D U p1 p2 1 p3 R L
+- byte 1: f 0 th tw x9 x8 y9 y8 */
++ if (etd->fw_version < 0x020000) {
++ /*
++ * byte 0: D U p1 p2 1 p3 R L
++ * byte 1: f 0 th tw x9 x8 y9 y8
++ */
+ fingers = ((packet[1] & 0x80) >> 7) +
+ ((packet[1] & 0x30) >> 4);
+ } else {
+- /* byte 0: n1 n0 p2 p1 1 p3 R L
+- byte 1: 0 0 0 0 x9 x8 y9 y8 */
++ /*
++ * byte 0: n1 n0 p2 p1 1 p3 R L
++ * byte 1: 0 0 0 0 x9 x8 y9 y8
++ */
+ fingers = (packet[0] & 0xc0) >> 6;
+ }
+
+ if (etd->jumpy_cursor) {
+- /* Discard packets that are likely to have bogus coordinates */
+- if (fingers > old_fingers) {
++ if (fingers != 1) {
++ etd->single_finger_reports = 0;
++ } else if (etd->single_finger_reports < 2) {
++ /* Discard first 2 reports of one finger, bogus */
++ etd->single_finger_reports++;
+ elantech_debug("elantech.c: discarding packet\n");
+- goto discard_packet_v1;
++ return;
+ }
+ }
+
+ input_report_key(dev, BTN_TOUCH, fingers != 0);
+
+- /* byte 2: x7 x6 x5 x4 x3 x2 x1 x0
+- byte 3: y7 y6 y5 y4 y3 y2 y1 y0 */
++ /*
++ * byte 2: x7 x6 x5 x4 x3 x2 x1 x0
++ * byte 3: y7 y6 y5 y4 y3 y2 y1 y0
++ */
+ if (fingers) {
+ input_report_abs(dev, ABS_X,
+ ((packet[1] & 0x0c) << 6) | packet[2]);
+- input_report_abs(dev, ABS_Y, ETP_YMAX_V1 -
+- (((packet[1] & 0x03) << 8) | packet[3]));
++ input_report_abs(dev, ABS_Y,
++ ETP_YMAX_V1 - (((packet[1] & 0x03) << 8) | packet[3]));
+ }
+
+ input_report_key(dev, BTN_TOOL_FINGER, fingers == 1);
+@@ -216,7 +228,7 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
+ input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
+ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
+
+- if ((etd->fw_version_maj == 0x01) &&
++ if (etd->fw_version < 0x020000 &&
+ (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
+ /* rocker up */
+ input_report_key(dev, BTN_FORWARD, packet[0] & 0x40);
+@@ -225,9 +237,6 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
+ }
+
+ input_sync(dev);
+-
+- discard_packet_v1:
+- old_fingers = fingers;
+ }
+
+ /*
+@@ -246,34 +255,47 @@ static void elantech_report_absolute_v2(struct psmouse *psmouse)
+
+ switch (fingers) {
+ case 1:
+- /* byte 1: x15 x14 x13 x12 x11 x10 x9 x8
+- byte 2: x7 x6 x5 x4 x4 x2 x1 x0 */
+- input_report_abs(dev, ABS_X, (packet[1] << 8) | packet[2]);
+- /* byte 4: y15 y14 y13 y12 y11 y10 y8 y8
+- byte 5: y7 y6 y5 y4 y3 y2 y1 y0 */
+- input_report_abs(dev, ABS_Y, ETP_YMAX_V2 -
+- ((packet[4] << 8) | packet[5]));
++ /*
++ * byte 1: . . . . . x10 x9 x8
++ * byte 2: x7 x6 x5 x4 x4 x2 x1 x0
++ */
++ input_report_abs(dev, ABS_X,
++ ((packet[1] & 0x07) << 8) | packet[2]);
++ /*
++ * byte 4: . . . . . . y9 y8
++ * byte 5: y7 y6 y5 y4 y3 y2 y1 y0
++ */
++ input_report_abs(dev, ABS_Y,
++ ETP_YMAX_V2 - (((packet[4] & 0x03) << 8) | packet[5]));
+ break;
+
+ case 2:
+- /* The coordinate of each finger is reported separately with
+- a lower resolution for two finger touches */
+- /* byte 0: . . ay8 ax8 . . . .
+- byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0 */
++ /*
++ * The coordinate of each finger is reported separately
++ * with a lower resolution for two finger touches:
++ * byte 0: . . ay8 ax8 . . . .
++ * byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0
++ */
+ x1 = ((packet[0] & 0x10) << 4) | packet[1];
+ /* byte 2: ay7 ay6 ay5 ay4 ay3 ay2 ay1 ay0 */
+ y1 = ETP_2FT_YMAX - (((packet[0] & 0x20) << 3) | packet[2]);
+- /* byte 3: . . by8 bx8 . . . .
+- byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0 */
++ /*
++ * byte 3: . . by8 bx8 . . . .
++ * byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0
++ */
+ x2 = ((packet[3] & 0x10) << 4) | packet[4];
+ /* byte 5: by7 by8 by5 by4 by3 by2 by1 by0 */
+ y2 = ETP_2FT_YMAX - (((packet[3] & 0x20) << 3) | packet[5]);
+- /* For compatibility with the X Synaptics driver scale up one
+- coordinate and report as ordinary mouse movent */
++ /*
++ * For compatibility with the X Synaptics driver scale up
++ * one coordinate and report as ordinary mouse movent
++ */
+ input_report_abs(dev, ABS_X, x1 << 2);
+ input_report_abs(dev, ABS_Y, y1 << 2);
+- /* For compatibility with the proprietary X Elantech driver
+- report both coordinates as hat coordinates */
++ /*
++ * For compatibility with the proprietary X Elantech driver
++ * report both coordinates as hat coordinates
++ */
+ input_report_abs(dev, ABS_HAT0X, x1);
+ input_report_abs(dev, ABS_HAT0Y, y1);
+ input_report_abs(dev, ABS_HAT1X, x2);
+@@ -297,7 +319,7 @@ static int elantech_check_parity_v1(struct psmouse *psmouse)
+ unsigned char p1, p2, p3;
+
+ /* Parity bits are placed differently */
+- if (etd->fw_version_maj == 0x01) {
++ if (etd->fw_version < 0x020000) {
+ /* byte 0: D U p1 p2 1 p3 R L */
+ p1 = (packet[0] & 0x20) >> 5;
+ p2 = (packet[0] & 0x10) >> 4;
+@@ -420,6 +442,7 @@ static void elantech_set_input_params(struct psmouse *psmouse)
+
+ __set_bit(EV_KEY, dev->evbit);
+ __set_bit(EV_ABS, dev->evbit);
++ __clear_bit(EV_REL, dev->evbit);
+
+ __set_bit(BTN_LEFT, dev->keybit);
+ __set_bit(BTN_RIGHT, dev->keybit);
+@@ -432,7 +455,7 @@ static void elantech_set_input_params(struct psmouse *psmouse)
+ switch (etd->hw_version) {
+ case 1:
+ /* Rocker button */
+- if ((etd->fw_version_maj == 0x01) &&
++ if (etd->fw_version < 0x020000 &&
+ (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
+ __set_bit(BTN_FORWARD, dev->keybit);
+ __set_bit(BTN_BACK, dev->keybit);
+@@ -550,6 +573,24 @@ static struct attribute_group elantech_attr_group = {
+ .attrs = elantech_attrs,
+ };
+
++static bool elantech_is_signature_valid(const unsigned char *param)
++{
++ static const unsigned char rates[] = { 200, 100, 80, 60, 40, 20, 10 };
++ int i;
++
++ if (param[0] == 0)
++ return false;
++
++ if (param[1] == 0)
++ return true;
++
++ for (i = 0; i < ARRAY_SIZE(rates); i++)
++ if (param[2] == rates[i])
++ return false;
++
++ return true;
++}
++
+ /*
+ * Use magic knock to detect Elantech touchpad
+ */
+@@ -593,9 +634,13 @@ int elantech_detect(struct psmouse *psmouse, bool set_properties)
+ pr_debug("elantech.c: Elantech version query result 0x%02x, 0x%02x, 0x%02x.\n",
+ param[0], param[1], param[2]);
+
+- if (param[0] == 0 || param[1] != 0) {
+- pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
+- return -1;
++ if (!elantech_is_signature_valid(param)) {
++ if (!force_elantech) {
++ pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
++ return -1;
++ }
++
++ pr_debug("elantech.c: Probably not a real Elantech touchpad. Enabling anyway due to force_elantech.\n");
+ }
+
+ if (set_properties) {
+@@ -657,14 +702,14 @@ int elantech_init(struct psmouse *psmouse)
+ pr_err("elantech.c: failed to query firmware version.\n");
+ goto init_fail;
+ }
+- etd->fw_version_maj = param[0];
+- etd->fw_version_min = param[2];
++
++ etd->fw_version = (param[0] << 16) | (param[1] << 8) | param[2];
+
+ /*
+ * Assume every version greater than this is new EeePC style
+ * hardware with 6 byte packets
+ */
+- if (etd->fw_version_maj >= 0x02 && etd->fw_version_min >= 0x30) {
++ if (etd->fw_version >= 0x020030) {
+ etd->hw_version = 2;
+ /* For now show extra debug information */
+ etd->debug = 1;
+@@ -674,8 +719,9 @@ int elantech_init(struct psmouse *psmouse)
+ etd->hw_version = 1;
+ etd->paritycheck = 1;
+ }
+- pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d\n",
+- etd->hw_version, etd->fw_version_maj, etd->fw_version_min);
++
++ pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d.%d\n",
++ etd->hw_version, param[0], param[1], param[2]);
+
+ if (synaptics_send_cmd(psmouse, ETP_CAPABILITIES_QUERY, param)) {
+ pr_err("elantech.c: failed to query capabilities.\n");
+@@ -686,14 +732,14 @@ int elantech_init(struct psmouse *psmouse)
+ etd->capabilities = param[0];
+
+ /*
+- * This firmware seems to suffer from misreporting coordinates when
++ * This firmware suffers from misreporting coordinates when
+ * a touch action starts causing the mouse cursor or scrolled page
+ * to jump. Enable a workaround.
+ */
+- if (etd->fw_version_maj == 0x02 && etd->fw_version_min == 0x22) {
+- pr_info("elantech.c: firmware version 2.34 detected, "
++ if (etd->fw_version == 0x020022 || etd->fw_version == 0x020600) {
++ pr_info("elantech.c: firmware version 2.0.34/2.6.0 detected, "
+ "enabling jumpy cursor workaround\n");
+- etd->jumpy_cursor = 1;
++ etd->jumpy_cursor = true;
+ }
+
+ if (elantech_set_absolute_mode(psmouse)) {
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index feac5f7..aa4aac5 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -100,11 +100,11 @@ struct elantech_data {
+ unsigned char reg_26;
+ unsigned char debug;
+ unsigned char capabilities;
+- unsigned char fw_version_maj;
+- unsigned char fw_version_min;
++ bool paritycheck;
++ bool jumpy_cursor;
+ unsigned char hw_version;
+- unsigned char paritycheck;
+- unsigned char jumpy_cursor;
++ unsigned int fw_version;
++ unsigned int single_finger_reports;
+ unsigned char parity[256];
+ };
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index f4a6125..391f91a 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -135,7 +135,8 @@ static int synaptics_capability(struct psmouse *psmouse)
+ if (synaptics_send_cmd(psmouse, SYN_QUE_CAPABILITIES, cap))
+ return -1;
+ priv->capabilities = (cap[0] << 16) | (cap[1] << 8) | cap[2];
+- priv->ext_cap = 0;
++ priv->ext_cap = priv->ext_cap_0c = 0;
++
+ if (!SYN_CAP_VALID(priv->capabilities))
+ return -1;
+
+@@ -148,7 +149,7 @@ static int synaptics_capability(struct psmouse *psmouse)
+ if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 1) {
+ if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB, cap)) {
+ printk(KERN_ERR "Synaptics claims to have extended capabilities,"
+- " but I'm not able to read them.");
++ " but I'm not able to read them.\n");
+ } else {
+ priv->ext_cap = (cap[0] << 16) | (cap[1] << 8) | cap[2];
+
+@@ -160,6 +161,16 @@ static int synaptics_capability(struct psmouse *psmouse)
+ priv->ext_cap &= 0xff0fff;
+ }
+ }
++
++ if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 4) {
++ if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB_0C, cap)) {
++ printk(KERN_ERR "Synaptics claims to have extended capability 0x0c,"
++ " but I'm not able to read it.\n");
++ } else {
++ priv->ext_cap_0c = (cap[0] << 16) | (cap[1] << 8) | cap[2];
++ }
++ }
++
+ return 0;
+ }
+
+@@ -346,7 +357,15 @@ static void synaptics_parse_hw_state(unsigned char buf[], struct synaptics_data
+ hw->left = (buf[0] & 0x01) ? 1 : 0;
+ hw->right = (buf[0] & 0x02) ? 1 : 0;
+
+- if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
++ if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
++ /*
++ * Clickpad's button is transmitted as middle button,
++ * however, since it is primary button, we will report
++ * it as BTN_LEFT.
++ */
++ hw->left = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
++
++ } else if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
+ hw->middle = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
+ if (hw->w == 2)
+ hw->scroll = (signed char)(buf[1]);
+@@ -591,6 +610,12 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
+
+ dev->absres[ABS_X] = priv->x_res;
+ dev->absres[ABS_Y] = priv->y_res;
++
++ if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
++ /* Clickpads report only left button */
++ __clear_bit(BTN_RIGHT, dev->keybit);
++ __clear_bit(BTN_MIDDLE, dev->keybit);
++ }
+ }
+
+ static void synaptics_disconnect(struct psmouse *psmouse)
+@@ -689,10 +714,10 @@ int synaptics_init(struct psmouse *psmouse)
+
+ priv->pkt_type = SYN_MODEL_NEWABS(priv->model_id) ? SYN_NEWABS : SYN_OLDABS;
+
+- printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx\n",
++ printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx/%#lx\n",
+ SYN_ID_MODEL(priv->identity),
+ SYN_ID_MAJOR(priv->identity), SYN_ID_MINOR(priv->identity),
+- priv->model_id, priv->capabilities, priv->ext_cap);
++ priv->model_id, priv->capabilities, priv->ext_cap, priv->ext_cap_0c);
+
+ set_input_params(psmouse->dev, priv);
+
+diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
+index 871f6fe..c197d94 100644
+--- a/drivers/input/mouse/synaptics.h
++++ b/drivers/input/mouse/synaptics.h
+@@ -18,6 +18,7 @@
+ #define SYN_QUE_SERIAL_NUMBER_SUFFIX 0x07
+ #define SYN_QUE_RESOLUTION 0x08
+ #define SYN_QUE_EXT_CAPAB 0x09
++#define SYN_QUE_EXT_CAPAB_0C 0x0c
+
+ /* synatics modes */
+ #define SYN_BIT_ABSOLUTE_MODE (1 << 7)
+@@ -48,6 +49,8 @@
+ #define SYN_CAP_VALID(c) ((((c) & 0x00ff00) >> 8) == 0x47)
+ #define SYN_EXT_CAP_REQUESTS(c) (((c) & 0x700000) >> 20)
+ #define SYN_CAP_MULTI_BUTTON_NO(ec) (((ec) & 0x00f000) >> 12)
++#define SYN_CAP_PRODUCT_ID(ec) (((ec) & 0xff0000) >> 16)
++#define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100100)
+
+ /* synaptics modes query bits */
+ #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7))
+@@ -96,6 +99,7 @@ struct synaptics_data {
+ unsigned long int model_id; /* Model-ID */
+ unsigned long int capabilities; /* Capabilities */
+ unsigned long int ext_cap; /* Extended Capabilities */
++ unsigned long int ext_cap_0c; /* Ext Caps from 0x0c query */
+ unsigned long int identity; /* Identification */
+ int x_res; /* X resolution in units/mm */
+ int y_res; /* Y resolution in units/mm */
+diff --git a/drivers/input/xen-kbdfront.c b/drivers/input/xen-kbdfront.c
+index eb88f40..480d5d2 100644
+--- a/drivers/input/xen-kbdfront.c
++++ b/drivers/input/xen-kbdfront.c
+@@ -281,7 +281,7 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
+ enum xenbus_state backend_state)
+ {
+ struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
+- int val;
++ int ret, val;
+
+ switch (backend_state) {
+ case XenbusStateInitialising:
+@@ -292,6 +292,16 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
+
+ case XenbusStateInitWait:
+ InitWait:
++ ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
++ "feature-abs-pointer", "%d", &val);
++ if (ret < 0)
++ val = 0;
++ if (val) {
++ ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
++ "request-abs-pointer", "1");
++ if (ret)
++ pr_warning("can't request abs-pointer\n");
++ }
+ xenbus_switch_state(dev, XenbusStateConnected);
+ break;
+
+diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
+index 227c020..4f3e3ce 100644
+--- a/drivers/media/dvb/b2c2/flexcop-pci.c
++++ b/drivers/media/dvb/b2c2/flexcop-pci.c
+@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
+ DEBSTATUS);
+
+ #define DRIVER_VERSION "0.1"
+-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
++#define DRIVER_NAME "flexcop-pci"
+ #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher at desy.de>"
+
+ struct flexcop_pci {
+diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
+index 6bd8951..524acf5 100644
+--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
++++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
+@@ -874,6 +874,43 @@ static struct dvb_usb_rc_key dib0700_rc_keys[] = {
+ { 0x1d37, KEY_RECORD },
+ { 0x1d3b, KEY_GOTO },
+ { 0x1d3d, KEY_POWER },
++
++ /* Key codes for the Elgato EyeTV Diversity silver remote,
++ set dvb_usb_dib0700_ir_proto=0 */
++ { 0x4501, KEY_POWER },
++ { 0x4502, KEY_MUTE },
++ { 0x4503, KEY_1 },
++ { 0x4504, KEY_2 },
++ { 0x4505, KEY_3 },
++ { 0x4506, KEY_4 },
++ { 0x4507, KEY_5 },
++ { 0x4508, KEY_6 },
++ { 0x4509, KEY_7 },
++ { 0x450a, KEY_8 },
++ { 0x450b, KEY_9 },
++ { 0x450c, KEY_LAST },
++ { 0x450d, KEY_0 },
++ { 0x450e, KEY_ENTER },
++ { 0x450f, KEY_RED },
++ { 0x4510, KEY_CHANNELUP },
++ { 0x4511, KEY_GREEN },
++ { 0x4512, KEY_VOLUMEDOWN },
++ { 0x4513, KEY_OK },
++ { 0x4514, KEY_VOLUMEUP },
++ { 0x4515, KEY_YELLOW },
++ { 0x4516, KEY_CHANNELDOWN },
++ { 0x4517, KEY_BLUE },
++ { 0x4518, KEY_LEFT }, /* Skip backwards */
++ { 0x4519, KEY_PLAYPAUSE },
++ { 0x451a, KEY_RIGHT }, /* Skip forward */
++ { 0x451b, KEY_REWIND },
++ { 0x451c, KEY_L }, /* Live */
++ { 0x451d, KEY_FASTFORWARD },
++ { 0x451e, KEY_STOP }, /* 'Reveal' for Teletext */
++ { 0x451f, KEY_MENU }, /* KEY_TEXT for Teletext */
++ { 0x4540, KEY_RECORD }, /* Font 'Size' for Teletext */
++ { 0x4541, KEY_SCREEN }, /* Full screen toggle, 'Hold' for Teletext */
++ { 0x4542, KEY_SELECT }, /* Select video input, 'Select' for Teletext */
+ };
+
+ /* STK7700P: Hauppauge Nova-T Stick, AVerMedia Volar */
+@@ -1861,6 +1898,7 @@ struct usb_device_id dib0700_usb_id_table[] = {
+ { USB_DEVICE(USB_VID_DIBCOM, USB_PID_DIBCOM_STK807XPVR) },
+ { USB_DEVICE(USB_VID_DIBCOM, USB_PID_DIBCOM_STK807XP) },
+ { USB_DEVICE(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD) },
++ { USB_DEVICE(USB_VID_ELGATO, USB_PID_ELGATO_EYETV_DIVERSITY) },
+ { 0 } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
+@@ -2173,7 +2211,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
+ }
+ },
+
+- .num_device_descs = 6,
++ .num_device_descs = 7,
+ .devices = {
+ { "DiBcom STK7070PD reference design",
+ { &dib0700_usb_id_table[17], NULL },
+@@ -2199,7 +2237,11 @@ struct dvb_usb_device_properties dib0700_devices[] = {
+ { "Sony PlayTV",
+ { &dib0700_usb_id_table[44], NULL },
+ { NULL },
+- }
++ },
++ { "Elgato EyeTV Diversity",
++ { &dib0700_usb_id_table[64], NULL },
++ { NULL },
++ },
+ },
+ .rc_interval = DEFAULT_RC_INTERVAL,
+ .rc_key_map = dib0700_rc_keys,
+diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
+index a548c14..a7ae7b6 100644
+--- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
++++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
+@@ -271,6 +271,7 @@
+ #define USB_PID_TELESTAR_STARSTICK_2 0x8000
+ #define USB_PID_MSI_DIGI_VOX_MINI_III 0x8807
+ #define USB_PID_SONY_PLAYTV 0x0003
++#define USB_PID_ELGATO_EYETV_DIVERSITY 0x0011
+ #define USB_PID_ELGATO_EYETV_DTT 0x0021
+ #define USB_PID_ELGATO_EYETV_DTT_Dlx 0x0020
+ #define USB_PID_DVB_T_USB_STICK_HIGH_SPEED_COLD 0x5000
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 7dab2e5..f3320f2 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1041,6 +1041,17 @@ void mmc_rescan(struct work_struct *work)
+ container_of(work, struct mmc_host, detect.work);
+ u32 ocr;
+ int err;
++ unsigned long flags;
++
++ spin_lock_irqsave(&host->lock, flags);
++
++ if (host->rescan_disable) {
++ spin_unlock_irqrestore(&host->lock, flags);
++ return;
++ }
++
++ spin_unlock_irqrestore(&host->lock, flags);
++
+
+ mmc_bus_get(host);
+
+@@ -1247,18 +1258,6 @@ int mmc_suspend_host(struct mmc_host *host, pm_message_t state)
+ if (host->bus_ops && !host->bus_dead) {
+ if (host->bus_ops->suspend)
+ err = host->bus_ops->suspend(host);
+- if (err == -ENOSYS || !host->bus_ops->resume) {
+- /*
+- * We simply "remove" the card in this case.
+- * It will be redetected on resume.
+- */
+- if (host->bus_ops->remove)
+- host->bus_ops->remove(host);
+- mmc_claim_host(host);
+- mmc_detach_bus(host);
+- mmc_release_host(host);
+- err = 0;
+- }
+ }
+ mmc_bus_put(host);
+
+@@ -1288,28 +1287,60 @@ int mmc_resume_host(struct mmc_host *host)
+ printk(KERN_WARNING "%s: error %d during resume "
+ "(card was removed?)\n",
+ mmc_hostname(host), err);
+- if (host->bus_ops->remove)
+- host->bus_ops->remove(host);
+- mmc_claim_host(host);
+- mmc_detach_bus(host);
+- mmc_release_host(host);
+- /* no need to bother upper layers */
+ err = 0;
+ }
+ }
+ mmc_bus_put(host);
+
+- /*
+- * We add a slight delay here so that resume can progress
+- * in parallel.
+- */
+- mmc_detect_change(host, 1);
+-
+ return err;
+ }
+-
+ EXPORT_SYMBOL(mmc_resume_host);
+
++/* Do the card removal on suspend if card is assumed removeable
++ * Do that in pm notifier while userspace isn't yet frozen, so we will be able
++ to sync the card.
++*/
++int mmc_pm_notify(struct notifier_block *notify_block,
++ unsigned long mode, void *unused)
++{
++ struct mmc_host *host = container_of(
++ notify_block, struct mmc_host, pm_notify);
++ unsigned long flags;
++
++
++ switch (mode) {
++ case PM_HIBERNATION_PREPARE:
++ case PM_SUSPEND_PREPARE:
++
++ spin_lock_irqsave(&host->lock, flags);
++ host->rescan_disable = 1;
++ spin_unlock_irqrestore(&host->lock, flags);
++ cancel_delayed_work_sync(&host->detect);
++
++ if (!host->bus_ops || host->bus_ops->suspend)
++ break;
++
++ mmc_claim_host(host);
++
++ if (host->bus_ops->remove)
++ host->bus_ops->remove(host);
++
++ mmc_detach_bus(host);
++ mmc_release_host(host);
++ break;
++
++ case PM_POST_SUSPEND:
++ case PM_POST_HIBERNATION:
++
++ spin_lock_irqsave(&host->lock, flags);
++ host->rescan_disable = 0;
++ spin_unlock_irqrestore(&host->lock, flags);
++ mmc_detect_change(host, 0);
++
++ }
++
++ return 0;
++}
+ #endif
+
+ static int __init mmc_init(void)
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index a268d12..bc875cd 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -16,6 +16,7 @@
+ #include <linux/idr.h>
+ #include <linux/pagemap.h>
+ #include <linux/leds.h>
++#include <linux/suspend.h>
+
+ #include <linux/mmc/host.h>
+
+@@ -84,6 +85,9 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
+ init_waitqueue_head(&host->wq);
+ INIT_DELAYED_WORK(&host->detect, mmc_rescan);
+ INIT_DELAYED_WORK_DEFERRABLE(&host->disable, mmc_host_deeper_disable);
++#ifdef CONFIG_PM
++ host->pm_notify.notifier_call = mmc_pm_notify;
++#endif
+
+ /*
+ * By default, hosts do not support SGIO or large requests.
+@@ -132,6 +136,7 @@ int mmc_add_host(struct mmc_host *host)
+ #endif
+
+ mmc_start_host(host);
++ register_pm_notifier(&host->pm_notify);
+
+ return 0;
+ }
+@@ -148,6 +153,7 @@ EXPORT_SYMBOL(mmc_add_host);
+ */
+ void mmc_remove_host(struct mmc_host *host)
+ {
++ unregister_pm_notifier(&host->pm_notify);
+ mmc_stop_host(host);
+
+ #ifdef CONFIG_DEBUG_FS
+diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
+index e035664..6fd20b42 100644
+--- a/drivers/mmc/host/sdhci-pci.c
++++ b/drivers/mmc/host/sdhci-pci.c
+@@ -569,6 +569,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
+ host->ioaddr = pci_ioremap_bar(pdev, bar);
+ if (!host->ioaddr) {
+ dev_err(&pdev->dev, "failed to remap registers\n");
++ ret = -ENOMEM;
+ goto release;
+ }
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index c279fbc..e6c65a7 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1266,6 +1266,13 @@ static void sdhci_tasklet_finish(unsigned long param)
+
+ host = (struct sdhci_host*)param;
+
++ /*
++ * If this tasklet gets rescheduled while running, it will
++ * be run again afterwards but without any active request.
++ */
++ if (!host->mrq)
++ return;
++
+ spin_lock_irqsave(&host->lock, flags);
+
+ del_timer(&host->timer);
+@@ -1277,7 +1284,7 @@ static void sdhci_tasklet_finish(unsigned long param)
+ * upon error conditions.
+ */
+ if (!(host->flags & SDHCI_DEVICE_DEAD) &&
+- (mrq->cmd->error ||
++ ((mrq->cmd && mrq->cmd->error) ||
+ (mrq->data && (mrq->data->error ||
+ (mrq->data->stop && mrq->data->stop->error))) ||
+ (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {
+diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
+index be00ee9..77d9f3d 100644
+--- a/drivers/net/atl1c/atl1c_main.c
++++ b/drivers/net/atl1c/atl1c_main.c
+@@ -1976,8 +1976,6 @@ static void atl1c_tx_map(struct atl1c_adapter *adapter,
+ else {
+ use_tpd = atl1c_get_tpd(adapter, type);
+ memcpy(use_tpd, tpd, sizeof(struct atl1c_tpd_desc));
+- use_tpd = atl1c_get_tpd(adapter, type);
+- memcpy(use_tpd, tpd, sizeof(struct atl1c_tpd_desc));
+ }
+ buffer_info = atl1c_get_tx_buffer(adapter, use_tpd);
+ buffer_info->length = buf_len - mapped_len;
+diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
+index 20f0ed9..96b17de 100644
+--- a/drivers/net/bnx2x_main.c
++++ b/drivers/net/bnx2x_main.c
+@@ -49,6 +49,7 @@
+ #include <linux/prefetch.h>
+ #include <linux/zlib.h>
+ #include <linux/io.h>
++#include <linux/stringify.h>
+
+
+ #include "bnx2x.h"
+@@ -63,8 +64,13 @@
+ #include <linux/firmware.h>
+ #include "bnx2x_fw_file_hdr.h"
+ /* FW files */
+-#define FW_FILE_PREFIX_E1 "bnx2x-e1-"
+-#define FW_FILE_PREFIX_E1H "bnx2x-e1h-"
++#define FW_FILE_VERSION \
++ __stringify(BCM_5710_FW_MAJOR_VERSION) "." \
++ __stringify(BCM_5710_FW_MINOR_VERSION) "." \
++ __stringify(BCM_5710_FW_REVISION_VERSION) "." \
++ __stringify(BCM_5710_FW_ENGINEERING_VERSION)
++#define FW_FILE_NAME_E1 "bnx2x-e1-" FW_FILE_VERSION ".fw"
++#define FW_FILE_NAME_E1H "bnx2x-e1h-" FW_FILE_VERSION ".fw"
+
+ /* Time in jiffies before concluding the transmitter is hung */
+ #define TX_TIMEOUT (5*HZ)
+@@ -77,6 +83,8 @@ MODULE_AUTHOR("Eliezer Tamir");
+ MODULE_DESCRIPTION("Broadcom NetXtreme II BCM57710/57711/57711E Driver");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(DRV_MODULE_VERSION);
++MODULE_FIRMWARE(FW_FILE_NAME_E1);
++MODULE_FIRMWARE(FW_FILE_NAME_E1H);
+
+ static int multi_mode = 1;
+ module_param(multi_mode, int, 0);
+@@ -11830,21 +11838,14 @@ static inline void be16_to_cpu_n(const u8 *_source, u8 *_target, u32 n)
+
+ static int __devinit bnx2x_init_firmware(struct bnx2x *bp, struct device *dev)
+ {
+- char fw_file_name[40] = {0};
++ const char *fw_file_name;
+ struct bnx2x_fw_file_hdr *fw_hdr;
+- int rc, offset;
++ int rc;
+
+- /* Create a FW file name */
+ if (CHIP_IS_E1(bp))
+- offset = sprintf(fw_file_name, FW_FILE_PREFIX_E1);
++ fw_file_name = FW_FILE_NAME_E1;
+ else
+- offset = sprintf(fw_file_name, FW_FILE_PREFIX_E1H);
+-
+- sprintf(fw_file_name + offset, "%d.%d.%d.%d.fw",
+- BCM_5710_FW_MAJOR_VERSION,
+- BCM_5710_FW_MINOR_VERSION,
+- BCM_5710_FW_REVISION_VERSION,
+- BCM_5710_FW_ENGINEERING_VERSION);
++ fw_file_name = FW_FILE_NAME_E1H;
+
+ printk(KERN_INFO PFX "Loading %s\n", fw_file_name);
+
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index d3854ac..223990d 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -2451,6 +2451,10 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
+ if (!(dev->flags & IFF_MASTER))
+ goto out;
+
++ skb = skb_share_check(skb, GFP_ATOMIC);
++ if (!skb)
++ goto out;
++
+ if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
+ goto out;
+
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 7114375..36a7ac8 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -370,6 +370,10 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct
+ goto out;
+ }
+
++ skb = skb_share_check(skb, GFP_ATOMIC);
++ if (!skb)
++ goto out;
++
+ if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
+ goto out;
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 40fb5ee..6ffbfb7 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2692,6 +2692,10 @@ static int bond_arp_rcv(struct sk_buff *skb, struct net_device *dev, struct pack
+ if (!slave || !slave_do_arp_validate(bond, slave))
+ goto out_unlock;
+
++ skb = skb_share_check(skb, GFP_ATOMIC);
++ if (!skb)
++ goto out_unlock;
++
+ if (!pskb_may_pull(skb, arp_hdr_len(dev)))
+ goto out_unlock;
+
+diff --git a/drivers/net/cxgb3/common.h b/drivers/net/cxgb3/common.h
+index 1b2c305..6ff356d 100644
+--- a/drivers/net/cxgb3/common.h
++++ b/drivers/net/cxgb3/common.h
+@@ -125,11 +125,9 @@ enum { /* adapter interrupt-maintained statistics */
+ IRQ_NUM_STATS /* keep last */
+ };
+
+-enum {
+- TP_VERSION_MAJOR = 1,
+- TP_VERSION_MINOR = 1,
+- TP_VERSION_MICRO = 0
+-};
++#define TP_VERSION_MAJOR 1
++#define TP_VERSION_MINOR 1
++#define TP_VERSION_MICRO 0
+
+ #define S_TP_VERSION_MAJOR 16
+ #define M_TP_VERSION_MAJOR 0xFF
+diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
+index 2b378e7..1f9a06f 100644
+--- a/drivers/net/cxgb3/cxgb3_main.c
++++ b/drivers/net/cxgb3/cxgb3_main.c
+@@ -44,6 +44,7 @@
+ #include <linux/rtnetlink.h>
+ #include <linux/firmware.h>
+ #include <linux/log2.h>
++#include <linux/stringify.h>
+ #include <asm/uaccess.h>
+
+ #include "common.h"
+@@ -989,11 +990,21 @@ static int bind_qsets(struct adapter *adap)
+ return err;
+ }
+
+-#define FW_FNAME "cxgb3/t3fw-%d.%d.%d.bin"
+-#define TPSRAM_NAME "cxgb3/t3%c_psram-%d.%d.%d.bin"
++#define FW_VERSION __stringify(FW_VERSION_MAJOR) "." \
++ __stringify(FW_VERSION_MINOR) "." __stringify(FW_VERSION_MICRO)
++#define FW_FNAME "cxgb3/t3fw-" FW_VERSION ".bin"
++#define TPSRAM_VERSION __stringify(TP_VERSION_MAJOR) "." \
++ __stringify(TP_VERSION_MINOR) "." __stringify(TP_VERSION_MICRO)
++#define TPSRAM_NAME "cxgb3/t3%c_psram-" TPSRAM_VERSION ".bin"
+ #define AEL2005_OPT_EDC_NAME "cxgb3/ael2005_opt_edc.bin"
+ #define AEL2005_TWX_EDC_NAME "cxgb3/ael2005_twx_edc.bin"
+ #define AEL2020_TWX_EDC_NAME "cxgb3/ael2020_twx_edc.bin"
++MODULE_FIRMWARE(FW_FNAME);
++MODULE_FIRMWARE("cxgb3/t3b_psram-" TPSRAM_VERSION ".bin");
++MODULE_FIRMWARE("cxgb3/t3c_psram-" TPSRAM_VERSION ".bin");
++MODULE_FIRMWARE(AEL2005_OPT_EDC_NAME);
++MODULE_FIRMWARE(AEL2005_TWX_EDC_NAME);
++MODULE_FIRMWARE(AEL2020_TWX_EDC_NAME);
+
+ static inline const char *get_edc_fw_name(int edc_idx)
+ {
+@@ -1064,16 +1075,13 @@ int t3_get_edc_fw(struct cphy *phy, int edc_idx, int size)
+ static int upgrade_fw(struct adapter *adap)
+ {
+ int ret;
+- char buf[64];
+ const struct firmware *fw;
+ struct device *dev = &adap->pdev->dev;
+
+- snprintf(buf, sizeof(buf), FW_FNAME, FW_VERSION_MAJOR,
+- FW_VERSION_MINOR, FW_VERSION_MICRO);
+- ret = request_firmware(&fw, buf, dev);
++ ret = request_firmware(&fw, FW_FNAME, dev);
+ if (ret < 0) {
+ dev_err(dev, "could not upgrade firmware: unable to load %s\n",
+- buf);
++ FW_FNAME);
+ return ret;
+ }
+ ret = t3_load_fw(adap, fw->data, fw->size);
+@@ -1117,8 +1125,7 @@ static int update_tpsram(struct adapter *adap)
+ if (!rev)
+ return 0;
+
+- snprintf(buf, sizeof(buf), TPSRAM_NAME, rev,
+- TP_VERSION_MAJOR, TP_VERSION_MINOR, TP_VERSION_MICRO);
++ snprintf(buf, sizeof(buf), TPSRAM_NAME, rev);
+
+ ret = request_firmware(&tpsram, buf, dev);
+ if (ret < 0) {
+diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
+index 1a23f16..4079a33 100644
+--- a/drivers/net/e1000/e1000_main.c
++++ b/drivers/net/e1000/e1000_main.c
+@@ -790,6 +790,70 @@ static const struct net_device_ops e1000_netdev_ops = {
+ };
+
+ /**
++ * e1000_init_hw_struct - initialize members of hw struct
++ * @adapter: board private struct
++ * @hw: structure used by e1000_hw.c
++ *
++ * Factors out initialization of the e1000_hw struct to its own function
++ * that can be called very early at init (just after struct allocation).
++ * Fields are initialized based on PCI device information and
++ * OS network device settings (MTU size).
++ * Returns negative error codes if MAC type setup fails.
++ */
++static int e1000_init_hw_struct(struct e1000_adapter *adapter,
++ struct e1000_hw *hw)
++{
++ struct pci_dev *pdev = adapter->pdev;
++
++ /* PCI config space info */
++ hw->vendor_id = pdev->vendor;
++ hw->device_id = pdev->device;
++ hw->subsystem_vendor_id = pdev->subsystem_vendor;
++ hw->subsystem_id = pdev->subsystem_device;
++ hw->revision_id = pdev->revision;
++
++ pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
++
++ hw->max_frame_size = adapter->netdev->mtu +
++ ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
++ hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE;
++
++ /* identify the MAC */
++ if (e1000_set_mac_type(hw)) {
++ DPRINTK(PROBE, ERR, "Unknown MAC Type\n");
++ return -EIO;
++ }
++
++ switch (hw->mac_type) {
++ default:
++ break;
++ case e1000_82541:
++ case e1000_82547:
++ case e1000_82541_rev_2:
++ case e1000_82547_rev_2:
++ hw->phy_init_script = 1;
++ break;
++ }
++
++ e1000_set_media_type(hw);
++ e1000_get_bus_info(hw);
++
++ hw->wait_autoneg_complete = false;
++ hw->tbi_compatibility_en = true;
++ hw->adaptive_ifs = true;
++
++ /* Copper options */
++
++ if (hw->media_type == e1000_media_type_copper) {
++ hw->mdix = AUTO_ALL_MODES;
++ hw->disable_polarity_correction = false;
++ hw->master_slave = E1000_MASTER_SLAVE;
++ }
++
++ return 0;
++}
++
++/**
+ * e1000_probe - Device Initialization Routine
+ * @pdev: PCI device information struct
+ * @ent: entry in e1000_pci_tbl
+@@ -826,22 +890,6 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
+ if (err)
+ return err;
+
+- if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
+- !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+- pci_using_dac = 1;
+- } else {
+- err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+- if (err) {
+- err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+- if (err) {
+- E1000_ERR("No usable DMA configuration, "
+- "aborting\n");
+- goto err_dma;
+- }
+- }
+- pci_using_dac = 0;
+- }
+-
+ err = pci_request_selected_regions(pdev, bars, e1000_driver_name);
+ if (err)
+ goto err_pci_reg;
+@@ -882,6 +930,32 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
+ }
+ }
+
++ /* make ready for any if (hw->...) below */
++ err = e1000_init_hw_struct(adapter, hw);
++ if (err)
++ goto err_sw_init;
++
++ /*
++ * there is a workaround being applied below that limits
++ * 64-bit DMA addresses to 64-bit hardware. There are some
++ * 32-bit adapters that Tx hang when given 64-bit DMA addresses
++ */
++ pci_using_dac = 0;
++ if ((hw->bus_type == e1000_bus_type_pcix) &&
++ !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
++ /*
++ * according to DMA-API-HOWTO, coherent calls will always
++ * succeed if the set call did
++ */
++ pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
++ pci_using_dac = 1;
++ } else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) {
++ pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
++ } else {
++ E1000_ERR("No usable DMA configuration, aborting\n");
++ goto err_dma;
++ }
++
+ netdev->netdev_ops = &e1000_netdev_ops;
+ e1000_set_ethtool_ops(netdev);
+ netdev->watchdog_timeo = 5 * HZ;
+@@ -956,8 +1030,6 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
+ if (!is_valid_ether_addr(netdev->perm_addr))
+ DPRINTK(PROBE, ERR, "Invalid MAC Address\n");
+
+- e1000_get_bus_info(hw);
+-
+ init_timer(&adapter->tx_fifo_stall_timer);
+ adapter->tx_fifo_stall_timer.function = &e1000_82547_tx_fifo_stall;
+ adapter->tx_fifo_stall_timer.data = (unsigned long)adapter;
+@@ -1070,6 +1142,7 @@ err_eeprom:
+ iounmap(hw->flash_address);
+ kfree(adapter->tx_ring);
+ kfree(adapter->rx_ring);
++err_dma:
+ err_sw_init:
+ iounmap(hw->hw_addr);
+ err_ioremap:
+@@ -1077,7 +1150,6 @@ err_ioremap:
+ err_alloc_etherdev:
+ pci_release_selected_regions(pdev, bars);
+ err_pci_reg:
+-err_dma:
+ pci_disable_device(pdev);
+ return err;
+ }
+@@ -1129,62 +1201,12 @@ static void __devexit e1000_remove(struct pci_dev *pdev)
+ * @adapter: board private structure to initialize
+ *
+ * e1000_sw_init initializes the Adapter private data structure.
+- * Fields are initialized based on PCI device information and
+- * OS network device settings (MTU size).
++ * e1000_init_hw_struct MUST be called before this function
+ **/
+
+ static int __devinit e1000_sw_init(struct e1000_adapter *adapter)
+ {
+- struct e1000_hw *hw = &adapter->hw;
+- struct net_device *netdev = adapter->netdev;
+- struct pci_dev *pdev = adapter->pdev;
+-
+- /* PCI config space info */
+-
+- hw->vendor_id = pdev->vendor;
+- hw->device_id = pdev->device;
+- hw->subsystem_vendor_id = pdev->subsystem_vendor;
+- hw->subsystem_id = pdev->subsystem_device;
+- hw->revision_id = pdev->revision;
+-
+- pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
+-
+ adapter->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE;
+- hw->max_frame_size = netdev->mtu +
+- ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
+- hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE;
+-
+- /* identify the MAC */
+-
+- if (e1000_set_mac_type(hw)) {
+- DPRINTK(PROBE, ERR, "Unknown MAC Type\n");
+- return -EIO;
+- }
+-
+- switch (hw->mac_type) {
+- default:
+- break;
+- case e1000_82541:
+- case e1000_82547:
+- case e1000_82541_rev_2:
+- case e1000_82547_rev_2:
+- hw->phy_init_script = 1;
+- break;
+- }
+-
+- e1000_set_media_type(hw);
+-
+- hw->wait_autoneg_complete = false;
+- hw->tbi_compatibility_en = true;
+- hw->adaptive_ifs = true;
+-
+- /* Copper options */
+-
+- if (hw->media_type == e1000_media_type_copper) {
+- hw->mdix = AUTO_ALL_MODES;
+- hw->disable_polarity_correction = false;
+- hw->master_slave = E1000_MASTER_SLAVE;
+- }
+
+ adapter->num_tx_queues = 1;
+ adapter->num_rx_queues = 1;
+diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
+index c688b55..de39f9a 100644
+--- a/drivers/net/e1000e/ich8lan.c
++++ b/drivers/net/e1000e/ich8lan.c
+@@ -274,6 +274,16 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
+ phy->ops.write_phy_reg_locked = e1000_write_phy_reg_hv_locked;
+ phy->autoneg_mask = AUTONEG_ADVERTISE_SPEED_DEFAULT;
+
++ /*
++ * Reset the PHY before any acccess to it. Doing so, ensures that
++ * the PHY is in a known good state before we read/write PHY registers.
++ * The generic reset is sufficient here, because we haven't determined
++ * the PHY type yet.
++ */
++ ret_val = e1000e_phy_hw_reset_generic(hw);
++ if (ret_val)
++ goto out;
++
+ phy->id = e1000_phy_unknown;
+ e1000e_get_phy_id(hw);
+ phy->type = e1000e_get_phy_type_from_id(phy->id);
+@@ -287,6 +297,7 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
+ phy->ops.commit_phy = e1000e_phy_sw_reset;
+ }
+
++ out:
+ return ret_val;
+ }
+
+diff --git a/drivers/net/igbvf/igbvf.h b/drivers/net/igbvf/igbvf.h
+index 8e9b67e..6012410 100644
+--- a/drivers/net/igbvf/igbvf.h
++++ b/drivers/net/igbvf/igbvf.h
+@@ -125,7 +125,6 @@ struct igbvf_buffer {
+ unsigned int page_offset;
+ };
+ };
+- struct page *page;
+ };
+
+ union igbvf_desc {
+diff --git a/drivers/net/ipg.c b/drivers/net/ipg.c
+index 9f7b5d4..41dd89e 100644
+--- a/drivers/net/ipg.c
++++ b/drivers/net/ipg.c
+@@ -88,7 +88,6 @@ static const char *ipg_brand_name[] = {
+ "Sundance Technology ST2021 based NIC",
+ "Tamarack Microelectronics TC9020/9021 based NIC",
+ "Tamarack Microelectronics TC9020/9021 based NIC",
+- "D-Link NIC",
+ "D-Link NIC IP1000A"
+ };
+
+@@ -97,8 +96,7 @@ static struct pci_device_id ipg_pci_tbl[] __devinitdata = {
+ { PCI_VDEVICE(SUNDANCE, 0x2021), 1 },
+ { PCI_VDEVICE(SUNDANCE, 0x1021), 2 },
+ { PCI_VDEVICE(DLINK, 0x9021), 3 },
+- { PCI_VDEVICE(DLINK, 0x4000), 4 },
+- { PCI_VDEVICE(DLINK, 0x4020), 5 },
++ { PCI_VDEVICE(DLINK, 0x4020), 4 },
+ { 0, }
+ };
+
+diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
+index b8dc2d1..5178674 100644
+--- a/drivers/net/myri10ge/myri10ge.c
++++ b/drivers/net/myri10ge/myri10ge.c
+@@ -264,6 +264,10 @@ static char *myri10ge_fw_unaligned = "myri10ge_ethp_z8e.dat";
+ static char *myri10ge_fw_aligned = "myri10ge_eth_z8e.dat";
+ static char *myri10ge_fw_rss_unaligned = "myri10ge_rss_ethp_z8e.dat";
+ static char *myri10ge_fw_rss_aligned = "myri10ge_rss_eth_z8e.dat";
++MODULE_FIRMWARE("myri10ge_ethp_z8e.dat");
++MODULE_FIRMWARE("myri10ge_eth_z8e.dat");
++MODULE_FIRMWARE("myri10ge_rss_ethp_z8e.dat");
++MODULE_FIRMWARE("myri10ge_rss_eth_z8e.dat");
+
+ static char *myri10ge_fw_name = NULL;
+ module_param(myri10ge_fw_name, charp, S_IRUGO | S_IWUSR);
+diff --git a/drivers/net/netx-eth.c b/drivers/net/netx-eth.c
+index 9f42354..a0d65f5 100644
+--- a/drivers/net/netx-eth.c
++++ b/drivers/net/netx-eth.c
+@@ -510,3 +510,6 @@ module_exit(netx_eth_cleanup);
+ MODULE_AUTHOR("Sascha Hauer, Pengutronix");
+ MODULE_LICENSE("GPL");
+ MODULE_ALIAS("platform:" CARDNAME);
++MODULE_FIRMWARE("xc0.bin");
++MODULE_FIRMWARE("xc1.bin");
++MODULE_FIRMWARE("xc2.bin");
+diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
+index e1237b8..71975ba 100644
+--- a/drivers/net/netxen/netxen_nic.h
++++ b/drivers/net/netxen/netxen_nic.h
+@@ -487,6 +487,12 @@ struct status_desc {
+ #define NX_P3_MN_ROMIMAGE 2
+ #define NX_FLASH_ROMIMAGE 3
+
++#define NX_P2_MN_ROMIMAGE_NAME "nxromimg.bin"
++#define NX_P3_CT_ROMIMAGE_NAME "nx3fwct.bin"
++#define NX_P3_MN_ROMIMAGE_NAME "nx3fwmn.bin"
++#define NX_UNIFIED_ROMIMAGE_NAME "phanfw.bin"
++#define NX_FLASH_ROMIMAGE_NAME "flash"
++
+ extern char netxen_nic_driver_name[];
+
+ /* Number of status descriptors to handle per interrupt */
+diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
+index 0f3ae46..562a488 100644
+--- a/drivers/net/netxen/netxen_nic_init.c
++++ b/drivers/net/netxen/netxen_nic_init.c
+@@ -673,7 +673,11 @@ netxen_need_fw_reset(struct netxen_adapter *adapter)
+ }
+
+ static char *fw_name[] = {
+- "nxromimg.bin", "nx3fwct.bin", "nx3fwmn.bin", "flash",
++ NX_P2_MN_ROMIMAGE_NAME,
++ NX_P3_CT_ROMIMAGE_NAME,
++ NX_P3_MN_ROMIMAGE_NAME,
++ NX_UNIFIED_ROMIMAGE_NAME,
++ NX_FLASH_ROMIMAGE_NAME,
+ };
+
+ int
+diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
+index 3bf78db..9890a7e 100644
+--- a/drivers/net/netxen/netxen_nic_main.c
++++ b/drivers/net/netxen/netxen_nic_main.c
+@@ -38,6 +38,10 @@
+ MODULE_DESCRIPTION("NetXen Multi port (1/10) Gigabit Network Driver");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(NETXEN_NIC_LINUX_VERSIONID);
++MODULE_FIRMWARE(NX_P2_MN_ROMIMAGE_NAME);
++MODULE_FIRMWARE(NX_P3_CT_ROMIMAGE_NAME);
++MODULE_FIRMWARE(NX_P3_MN_ROMIMAGE_NAME);
++MODULE_FIRMWARE(NX_UNIFIED_ROMIMAGE_NAME);
+
+ char netxen_nic_driver_name[] = "netxen_nic";
+ static char netxen_nic_driver_string[] = "NetXen Network Driver version "
+diff --git a/drivers/net/niu.c b/drivers/net/niu.c
+index d6c7ac6..2dce134 100644
+--- a/drivers/net/niu.c
++++ b/drivers/net/niu.c
+@@ -7315,33 +7315,28 @@ static int niu_get_ethtool_tcam_all(struct niu *np,
+ struct niu_parent *parent = np->parent;
+ struct niu_tcam_entry *tp;
+ int i, idx, cnt;
+- u16 n_entries;
+ unsigned long flags;
+-
++ int ret = 0;
+
+ /* put the tcam size here */
+ nfc->data = tcam_get_size(np);
+
+ niu_lock_parent(np, flags);
+- n_entries = nfc->rule_cnt;
+ for (cnt = 0, i = 0; i < nfc->data; i++) {
+ idx = tcam_get_index(np, i);
+ tp = &parent->tcam[idx];
+ if (!tp->valid)
+ continue;
++ if (cnt == nfc->rule_cnt) {
++ ret = -EMSGSIZE;
++ break;
++ }
+ rule_locs[cnt] = i;
+ cnt++;
+ }
+ niu_unlock_parent(np, flags);
+
+- if (n_entries != cnt) {
+- /* print warning, this should not happen */
+- pr_info(PFX "niu%d: %s In niu_get_ethtool_tcam_all, "
+- "n_entries[%d] != cnt[%d]!!!\n\n",
+- np->parent->index, np->dev->name, n_entries, cnt);
+- }
+-
+- return 0;
++ return ret;
+ }
+
+ static int niu_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
+index 94c9ad2..4696844 100644
+--- a/drivers/net/pcmcia/pcnet_cs.c
++++ b/drivers/net/pcmcia/pcnet_cs.c
+@@ -1768,6 +1768,13 @@ static struct pcmcia_device_id pcnet_ids[] = {
+ PCMCIA_DEVICE_NULL
+ };
+ MODULE_DEVICE_TABLE(pcmcia, pcnet_ids);
++MODULE_FIRMWARE("cis/PCMLM28.cis");
++MODULE_FIRMWARE("cis/DP83903.cis");
++MODULE_FIRMWARE("cis/LA-PCM.cis");
++MODULE_FIRMWARE("PE520.cis");
++MODULE_FIRMWARE("cis/NE2K.cis");
++MODULE_FIRMWARE("cis/PE-200.cis");
++MODULE_FIRMWARE("cis/tamarack.cis");
+
+ static struct pcmcia_driver pcnet_driver = {
+ .drv = {
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index b724d7f..9235901 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -756,6 +756,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
+
+ /* Try to dequeue as many skbs from reorder_q as we can. */
+ pppol2tp_recv_dequeue(session);
++ sock_put(sock);
+
+ return 0;
+
+@@ -772,6 +773,7 @@ discard_bad_csum:
+ UDP_INC_STATS_USER(&init_net, UDP_MIB_INERRORS, 0);
+ tunnel->stats.rx_errors++;
+ kfree_skb(skb);
++ sock_put(sock);
+
+ return 0;
+
+@@ -1658,6 +1660,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ if (tunnel_sock == NULL)
+ goto end;
+
++ sock_hold(tunnel_sock);
+ tunnel = tunnel_sock->sk_user_data;
+ } else {
+ tunnel = pppol2tp_tunnel_find(sock_net(sk), sp->pppol2tp.s_tunnel);
+diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
+index 90e663f..782910c 100644
+--- a/drivers/net/spider_net.c
++++ b/drivers/net/spider_net.c
+@@ -57,6 +57,7 @@ MODULE_AUTHOR("Utz Bacher <utz.bacher at de.ibm.com> and Jens Osterkamp " \
+ MODULE_DESCRIPTION("Spider Southbridge Gigabit Ethernet driver");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(VERSION);
++MODULE_FIRMWARE(SPIDER_NET_FIRMWARE_NAME);
+
+ static int rx_descriptors = SPIDER_NET_RX_DESCRIPTORS_DEFAULT;
+ static int tx_descriptors = SPIDER_NET_TX_DESCRIPTORS_DEFAULT;
+diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
+index ec9dfb2..489994c 100644
+--- a/drivers/net/tehuti.c
++++ b/drivers/net/tehuti.c
+@@ -324,7 +324,7 @@ static int bdx_fw_load(struct bdx_priv *priv)
+ ENTER;
+ master = READ_REG(priv, regINIT_SEMAPHORE);
+ if (!READ_REG(priv, regINIT_STATUS) && master) {
+- rc = request_firmware(&fw, "tehuti/firmware.bin", &priv->pdev->dev);
++ rc = request_firmware(&fw, "tehuti/bdx.bin", &priv->pdev->dev);
+ if (rc)
+ goto out;
+ bdx_tx_push_desc_safe(priv, (char *)fw->data, fw->size);
+@@ -2524,4 +2524,4 @@ module_exit(bdx_module_exit);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR(DRIVER_AUTHOR);
+ MODULE_DESCRIPTION(BDX_DRV_DESC);
+-MODULE_FIRMWARE("tehuti/firmware.bin");
++MODULE_FIRMWARE("tehuti/bdx.bin");
+diff --git a/drivers/net/tokenring/tms380tr.c b/drivers/net/tokenring/tms380tr.c
+index a7b6888..fa15214 100644
+--- a/drivers/net/tokenring/tms380tr.c
++++ b/drivers/net/tokenring/tms380tr.c
+@@ -1364,6 +1364,8 @@ static int tms380tr_reset_adapter(struct net_device *dev)
+ return (-1);
+ }
+
++MODULE_FIRMWARE("tms380tr.bin");
++
+ /*
+ * Starts bring up diagnostics of token ring adapter and evaluates
+ * diagnostic results.
+diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
+index 88bf54f..43b1fcb 100644
+--- a/drivers/net/tulip/tulip_core.c
++++ b/drivers/net/tulip/tulip_core.c
+@@ -249,6 +249,7 @@ static struct pci_device_id tulip_pci_tbl[] = {
+ { 0x17B3, 0xAB08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
+ { 0x10b7, 0x9300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* 3Com 3CSOHO100B-TX */
+ { 0x14ea, 0xab08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Planex FNW-3602-TX */
++ { 0x1414, 0x0001, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Microsoft MN-120 */
+ { 0x1414, 0x0002, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
+ { } /* terminate list */
+ };
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 7e3788d..bf6d850 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -391,6 +391,20 @@ static void skb_recv_done(struct virtqueue *rvq)
+ }
+ }
+
++static void virtnet_napi_enable(struct virtnet_info *vi)
++{
++ napi_enable(&vi->napi);
++
++ /* If all buffers were filled by other side before we napi_enabled, we
++ * won't get another interrupt, so process any outstanding packets
++ * now. virtnet_poll wants re-enable the queue, so we disable here.
++ * We synchronize against interrupts via NAPI_STATE_SCHED */
++ if (napi_schedule_prep(&vi->napi)) {
++ vi->rvq->vq_ops->disable_cb(vi->rvq);
++ __napi_schedule(&vi->napi);
++ }
++}
++
+ static void refill_work(struct work_struct *work)
+ {
+ struct virtnet_info *vi;
+@@ -399,7 +413,7 @@ static void refill_work(struct work_struct *work)
+ vi = container_of(work, struct virtnet_info, refill.work);
+ napi_disable(&vi->napi);
+ still_empty = !try_fill_recv(vi, GFP_KERNEL);
+- napi_enable(&vi->napi);
++ virtnet_napi_enable(vi);
+
+ /* In theory, this can happen: if we don't get any buffers in
+ * we will *never* try to fill again. */
+@@ -511,7 +525,6 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
+ struct virtnet_info *vi = netdev_priv(dev);
+ int capacity;
+
+-again:
+ /* Free up any pending old buffers before queueing new ones. */
+ free_old_xmit_skbs(vi);
+
+@@ -520,14 +533,20 @@ again:
+
+ /* This can happen with OOM and indirect buffers. */
+ if (unlikely(capacity < 0)) {
+- netif_stop_queue(dev);
+- dev_warn(&dev->dev, "Unexpected full queue\n");
+- if (unlikely(!vi->svq->vq_ops->enable_cb(vi->svq))) {
+- vi->svq->vq_ops->disable_cb(vi->svq);
+- netif_start_queue(dev);
+- goto again;
++ if (net_ratelimit()) {
++ if (likely(capacity == -ENOMEM)) {
++ dev_warn(&dev->dev,
++ "TX queue failure: out of memory\n");
++ } else {
++ dev->stats.tx_fifo_errors++;
++ dev_warn(&dev->dev,
++ "Unexpected TX queue failure: %d\n",
++ capacity);
++ }
+ }
+- return NETDEV_TX_BUSY;
++ dev->stats.tx_dropped++;
++ kfree_skb(skb);
++ return NETDEV_TX_OK;
+ }
+ vi->svq->vq_ops->kick(vi->svq);
+
+@@ -591,16 +610,7 @@ static int virtnet_open(struct net_device *dev)
+ {
+ struct virtnet_info *vi = netdev_priv(dev);
+
+- napi_enable(&vi->napi);
+-
+- /* If all buffers were filled by other side before we napi_enabled, we
+- * won't get another interrupt, so process any outstanding packets
+- * now. virtnet_poll wants re-enable the queue, so we disable here.
+- * We synchronize against interrupts via NAPI_STATE_SCHED */
+- if (napi_schedule_prep(&vi->napi)) {
+- vi->rvq->vq_ops->disable_cb(vi->rvq);
+- __napi_schedule(&vi->napi);
+- }
++ virtnet_napi_enable(vi);
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
+index 9847af7..b4221b4 100644
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
+ {APL9_WORLD, CTL_ETSI, CTL_ETSI},
+
+ {APL3_FCCA, CTL_FCC, CTL_FCC},
++ {APL7_FCCA, CTL_FCC, CTL_FCC},
+ {APL1_ETSIC, CTL_FCC, CTL_ETSI},
+ {APL2_ETSIC, CTL_FCC, CTL_ETSI},
+ {APL2_APLD, CTL_FCC, NO_CTL},
+diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
+index 0d3ac641..3300dfe 100644
+--- a/drivers/net/wireless/b43/sdio.c
++++ b/drivers/net/wireless/b43/sdio.c
+@@ -162,6 +162,7 @@ static int b43_sdio_probe(struct sdio_func *func,
+ err_free_ssb:
+ kfree(sdio);
+ err_disable_func:
++ sdio_claim_host(func);
+ sdio_disable_func(func);
+ err_release_host:
+ sdio_release_host(func);
+@@ -174,7 +175,9 @@ static void b43_sdio_remove(struct sdio_func *func)
+ struct b43_sdio *sdio = sdio_get_drvdata(func);
+
+ ssb_bus_unregister(&sdio->ssb);
++ sdio_claim_host(func);
+ sdio_disable_func(func);
++ sdio_release_host(func);
+ kfree(sdio);
+ sdio_set_drvdata(func, NULL);
+ }
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
+index 1f423f2..dbceac7 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -47,7 +47,7 @@
+ #include "iwl-6000-hw.h"
+
+ /* Highest firmware API version supported */
+-#define IWL5000_UCODE_API_MAX 2
++#define IWL5000_UCODE_API_MAX 5
+ #define IWL5150_UCODE_API_MAX 2
+
+ /* Lowest firmware API version supported */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
+index d21c06e..c3d7dd6 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -1088,11 +1088,15 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
+ q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+
+ tx_info = &txq->txb[txq->q.read_ptr];
+- ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]);
++
++ if (WARN_ON_ONCE(tx_info->skb == NULL))
++ continue;
+
+ hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
+- if (hdr && ieee80211_is_data_qos(hdr->frame_control))
++ if (ieee80211_is_data_qos(hdr->frame_control))
+ nfreed++;
++
++ ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]);
+ tx_info->skb[0] = NULL;
+
+ if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
+diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
+index 9000787..24a1763 100644
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -703,7 +703,7 @@ int p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
+ struct p54_tx_info *p54info;
+ struct p54_hdr *hdr;
+ struct p54_tx_data *txhdr;
+- unsigned int padding, len, extra_len;
++ unsigned int padding, len, extra_len = 0;
+ int i, j, ridx;
+ u16 hdr_flags = 0, aid = 0;
+ u8 rate, queue = 0, crypt_offset = 0;
+diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
+index 798f625..f6b8a9b 100644
+--- a/drivers/net/wireless/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/rt2x00/rt2400pci.c
+@@ -1431,7 +1431,6 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ IEEE80211_HW_SIGNAL_DBM |
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK;
+- rt2x00dev->hw->extra_tx_headroom = 0;
+
+ SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
+ SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
+@@ -1628,6 +1627,7 @@ static const struct rt2x00_ops rt2400pci_ops = {
+ .eeprom_size = EEPROM_SIZE,
+ .rf_size = RF_SIZE,
+ .tx_queues = NUM_TX_QUEUES,
++ .extra_tx_headroom = 0,
+ .rx = &rt2400pci_queue_rx,
+ .tx = &rt2400pci_queue_tx,
+ .bcn = &rt2400pci_queue_bcn,
+diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
+index 2e872ac..5a4b9ba 100644
+--- a/drivers/net/wireless/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/rt2x00/rt2500pci.c
+@@ -1732,8 +1732,6 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK;
+
+- rt2x00dev->hw->extra_tx_headroom = 0;
+-
+ SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
+ SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
+ rt2x00_eeprom_addr(rt2x00dev,
+@@ -1927,6 +1925,7 @@ static const struct rt2x00_ops rt2500pci_ops = {
+ .eeprom_size = EEPROM_SIZE,
+ .rf_size = RF_SIZE,
+ .tx_queues = NUM_TX_QUEUES,
++ .extra_tx_headroom = 0,
+ .rx = &rt2500pci_queue_rx,
+ .tx = &rt2500pci_queue_tx,
+ .bcn = &rt2500pci_queue_bcn,
+diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
+index 22dd6d9..99d6fd7 100644
+--- a/drivers/net/wireless/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/rt2x00/rt2500usb.c
+@@ -347,6 +347,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
+ int timeout;
+ u32 mask;
+ u16 reg;
++ enum cipher curr_cipher;
+
+ if (crypto->cmd == SET_KEY) {
+ /*
+@@ -357,6 +358,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
+ mask = TXRX_CSR0_KEY_ID.bit_mask;
+
+ rt2500usb_register_read(rt2x00dev, TXRX_CSR0, ®);
++ curr_cipher = rt2x00_get_field16(reg, TXRX_CSR0_ALGORITHM);
+ reg &= mask;
+
+ if (reg && reg == mask)
+@@ -365,6 +367,14 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
+ reg = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID);
+
+ key->hw_key_idx += reg ? ffz(reg) : 0;
++ /*
++ * Hardware requires that all keys use the same cipher
++ * (e.g. TKIP-only, AES-only, but not TKIP+AES).
++ * If this is not the first key, compare the cipher with the
++ * first one and fall back to SW crypto if not the same.
++ */
++ if (key->hw_key_idx > 0 && crypto->cipher != curr_cipher)
++ return -EOPNOTSUPP;
+
+ /*
+ * The encryption key doesn't fit within the CSR cache,
+@@ -1788,8 +1798,6 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK;
+
+- rt2x00dev->hw->extra_tx_headroom = TXD_DESC_SIZE;
+-
+ SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
+ SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
+ rt2x00_eeprom_addr(rt2x00dev,
+@@ -1962,6 +1970,7 @@ static const struct rt2x00_ops rt2500usb_ops = {
+ .eeprom_size = EEPROM_SIZE,
+ .rf_size = RF_SIZE,
+ .tx_queues = NUM_TX_QUEUES,
++ .extra_tx_headroom = TXD_DESC_SIZE,
+ .rx = &rt2500usb_queue_rx,
+ .tx = &rt2500usb_queue_tx,
+ .bcn = &rt2500usb_queue_bcn,
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index 9fe770f..db2b635 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -2509,7 +2509,6 @@ static int rt2800usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ IEEE80211_HW_SIGNAL_DBM |
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK;
+- rt2x00dev->hw->extra_tx_headroom = TXINFO_DESC_SIZE + TXWI_DESC_SIZE;
+
+ SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
+ SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
+@@ -2858,6 +2857,7 @@ static const struct rt2x00_ops rt2800usb_ops = {
+ .eeprom_size = EEPROM_SIZE,
+ .rf_size = RF_SIZE,
+ .tx_queues = NUM_TX_QUEUES,
++ .extra_tx_headroom = TXINFO_DESC_SIZE + TXWI_DESC_SIZE,
+ .rx = &rt2800usb_queue_rx,
+ .tx = &rt2800usb_queue_tx,
+ .bcn = &rt2800usb_queue_bcn,
+diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
+index 27bc6b7..6d7a9a7 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/rt2x00/rt2x00.h
+@@ -112,6 +112,12 @@
+ ( ((unsigned long)((__skb)->data + (__header))) & 3 )
+
+ /*
++ * Constants for extra TX headroom for alignment purposes.
++ */
++#define RT2X00_ALIGN_SIZE 4 /* Only whole frame needs alignment */
++#define RT2X00_L2PAD_SIZE 8 /* Both header & payload need alignment */
++
++/*
+ * Standard timing and size defines.
+ * These values should follow the ieee80211 specifications.
+ */
+@@ -579,6 +585,7 @@ struct rt2x00_ops {
+ const unsigned int eeprom_size;
+ const unsigned int rf_size;
+ const unsigned int tx_queues;
++ const unsigned int extra_tx_headroom;
+ const struct data_queue_desc *rx;
+ const struct data_queue_desc *tx;
+ const struct data_queue_desc *bcn;
+diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
+index 73bbec5..6604c27 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -684,6 +684,21 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
+ rt2x00dev->hw->queues = rt2x00dev->ops->tx_queues;
+
+ /*
++ * Initialize extra TX headroom required.
++ */
++ rt2x00dev->hw->extra_tx_headroom =
++ max_t(unsigned int, IEEE80211_TX_STATUS_HEADROOM,
++ rt2x00dev->ops->extra_tx_headroom);
++
++ /*
++ * Take TX headroom required for alignment into account.
++ */
++ if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags))
++ rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
++ else if (test_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags))
++ rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
++
++ /*
+ * Register HW.
+ */
+ status = ieee80211_register_hw(rt2x00dev->hw);
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index 577029e..2ec9c14 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -103,7 +103,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
+ * is also mapped to the DMA so it can be used for transfering
+ * additional descriptor information to the hardware.
+ */
+- skb_push(skb, rt2x00dev->hw->extra_tx_headroom);
++ skb_push(skb, rt2x00dev->ops->extra_tx_headroom);
+
+ skbdesc->skb_dma =
+ dma_map_single(rt2x00dev->dev, skb->data, skb->len, DMA_TO_DEVICE);
+@@ -111,7 +111,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
+ /*
+ * Restore data pointer to original location again.
+ */
+- skb_pull(skb, rt2x00dev->hw->extra_tx_headroom);
++ skb_pull(skb, rt2x00dev->ops->extra_tx_headroom);
+
+ skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
+ }
+@@ -133,7 +133,7 @@ void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
+ * by the driver, but it was actually mapped to DMA.
+ */
+ dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma,
+- skb->len + rt2x00dev->hw->extra_tx_headroom,
++ skb->len + rt2x00dev->ops->extra_tx_headroom,
+ DMA_TO_DEVICE);
+ skbdesc->flags &= ~SKBDESC_DMA_MAPPED_TX;
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
+index 9a6ceb4..da8366d 100644
+--- a/drivers/net/wireless/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/rt2x00/rt61pci.c
+@@ -2550,7 +2550,6 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ IEEE80211_HW_SIGNAL_DBM |
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK;
+- rt2x00dev->hw->extra_tx_headroom = 0;
+
+ SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
+ SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
+@@ -2798,6 +2797,7 @@ static const struct rt2x00_ops rt61pci_ops = {
+ .eeprom_size = EEPROM_SIZE,
+ .rf_size = RF_SIZE,
+ .tx_queues = NUM_TX_QUEUES,
++ .extra_tx_headroom = 0,
+ .rx = &rt61pci_queue_rx,
+ .tx = &rt61pci_queue_tx,
+ .bcn = &rt61pci_queue_bcn,
+diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
+index 1585577..a3ceef2 100644
+--- a/drivers/net/wireless/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/rt2x00/rt73usb.c
+@@ -2068,7 +2068,6 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ IEEE80211_HW_SIGNAL_DBM |
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK;
+- rt2x00dev->hw->extra_tx_headroom = TXD_DESC_SIZE;
+
+ SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
+ SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
+@@ -2311,6 +2310,7 @@ static const struct rt2x00_ops rt73usb_ops = {
+ .eeprom_size = EEPROM_SIZE,
+ .rf_size = RF_SIZE,
+ .tx_queues = NUM_TX_QUEUES,
++ .extra_tx_headroom = TXD_DESC_SIZE,
+ .rx = &rt73usb_queue_rx,
+ .tx = &rt73usb_queue_tx,
+ .bcn = &rt73usb_queue_bcn,
+diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
+index ba83495..5b680df 100644
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -382,7 +382,7 @@ int dmar_disabled = 0;
+ int dmar_disabled = 1;
+ #endif /*CONFIG_DMAR_DEFAULT_ON*/
+
+-static int __initdata dmar_map_gfx = 1;
++static int dmar_map_gfx = 1;
+ static int dmar_forcedac;
+ static int intel_iommu_strict;
+
+@@ -1858,7 +1858,7 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
+
+ ret = iommu_attach_domain(domain, iommu);
+ if (ret) {
+- domain_exit(domain);
++ free_domain_mem(domain);
+ goto error;
+ }
+
+@@ -3244,9 +3244,15 @@ static int device_notifier(struct notifier_block *nb,
+ if (!domain)
+ return 0;
+
+- if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through)
++ if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) {
+ domain_remove_one_dev_info(domain, pdev);
+
++ if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
++ !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
++ list_empty(&domain->devices))
++ domain_exit(domain);
++ }
++
+ return 0;
+ }
+
+@@ -3393,6 +3399,11 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
+ domain->iommu_count--;
+ domain_update_iommu_cap(domain);
+ spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
++
++ spin_lock_irqsave(&iommu->lock, tmp_flags);
++ clear_bit(domain->id, iommu->domain_ids);
++ iommu->domains[domain->id] = NULL;
++ spin_unlock_irqrestore(&iommu->lock, tmp_flags);
+ }
+
+ spin_unlock_irqrestore(&device_domain_lock, flags);
+@@ -3730,6 +3741,12 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
+ */
+ printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
+ rwbf_quirk = 1;
++
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */
++ if (dev->revision == 0x07) {
++ printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
++ dmar_map_gfx = 0;
++ }
+ }
+
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 74909c4..07a74da 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -71,6 +71,19 @@ static const struct dmi_system_id __initdata dell_device_table[] = {
+ DMI_MATCH(DMI_CHASSIS_TYPE, "8"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "9"), /*Laptop*/
++ },
++ },
++ {
++ .ident = "Dell Computer Corporation",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "8"),
++ },
++ },
+ { }
+ };
+
+@@ -397,3 +410,5 @@ MODULE_AUTHOR("Matthew Garrett <mjg at redhat.com>");
+ MODULE_DESCRIPTION("Dell laptop driver");
+ MODULE_LICENSE("GPL");
+ MODULE_ALIAS("dmi:*svnDellInc.:*:ct8:*");
++MODULE_ALIAS("dmi:*svnDellInc.:*:ct9:*");
++MODULE_ALIAS("dmi:*svnDellComputerCorporation.:*:ct8:*");
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index 678bb94..4460e00 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -63,7 +63,7 @@ static struct dasd_discipline dasd_eckd_discipline;
+ static struct ccw_device_id dasd_eckd_ids[] = {
+ { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3390, 0), .driver_info = 0x1},
+ { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3390, 0), .driver_info = 0x2},
+- { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3390, 0), .driver_info = 0x3},
++ { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3380, 0), .driver_info = 0x3},
+ { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3380, 0), .driver_info = 0x4},
+ { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3380, 0), .driver_info = 0x5},
+ { CCW_DEVICE_DEVTYPE (0x9343, 0, 0x9345, 0), .driver_info = 0x6},
+diff --git a/drivers/scsi/device_handler/scsi_dh_emc.c b/drivers/scsi/device_handler/scsi_dh_emc.c
+index 0cffe84..260cbae 100644
+--- a/drivers/scsi/device_handler/scsi_dh_emc.c
++++ b/drivers/scsi/device_handler/scsi_dh_emc.c
+@@ -272,7 +272,7 @@ static struct request *get_req(struct scsi_device *sdev, int cmd,
+ int len = 0;
+
+ rq = blk_get_request(sdev->request_queue,
+- (cmd == MODE_SELECT) ? WRITE : READ, GFP_NOIO);
++ (cmd != INQUIRY) ? WRITE : READ, GFP_NOIO);
+ if (!rq) {
+ sdev_printk(KERN_INFO, sdev, "get_req: blk_get_request failed");
+ return NULL;
+@@ -284,16 +284,17 @@ static struct request *get_req(struct scsi_device *sdev, int cmd,
+ switch (cmd) {
+ case MODE_SELECT:
+ len = sizeof(short_trespass);
+- rq->cmd_flags |= REQ_RW;
+ rq->cmd[1] = 0x10;
++ rq->cmd[4] = len;
+ break;
+ case MODE_SELECT_10:
+ len = sizeof(long_trespass);
+- rq->cmd_flags |= REQ_RW;
+ rq->cmd[1] = 0x10;
++ rq->cmd[8] = len;
+ break;
+ case INQUIRY:
+ len = CLARIION_BUFFER_SIZE;
++ rq->cmd[4] = len;
+ memset(buffer, 0, len);
+ break;
+ default:
+@@ -301,7 +302,6 @@ static struct request *get_req(struct scsi_device *sdev, int cmd,
+ break;
+ }
+
+- rq->cmd[4] = len;
+ rq->cmd_type = REQ_TYPE_BLOCK_PC;
+ rq->cmd_flags |= REQ_FAILFAST_DEV | REQ_FAILFAST_TRANSPORT |
+ REQ_FAILFAST_DRIVER;
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+index 57d7246..7767b8f 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+@@ -636,6 +636,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
+ data_out_sz = karg.data_out_size;
+ data_in_sz = karg.data_in_size;
+
++ /* Check for overflow and wraparound */
++ if (karg.data_sge_offset * 4 > ioc->request_sz ||
++ karg.data_sge_offset > (UINT_MAX / 4)) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ /* copy in request message frame from user */
+ if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
+ printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
+@@ -1809,7 +1816,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
+ Mpi2DiagBufferPostReply_t *mpi_reply;
+ int rc, i;
+ u8 buffer_type;
+- unsigned long timeleft;
++ unsigned long timeleft, request_size, copy_size;
+ u16 smid;
+ u16 ioc_status;
+ u8 issue_reset = 0;
+@@ -1845,6 +1852,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
+ return -ENOMEM;
+ }
+
++ request_size = ioc->diag_buffer_sz[buffer_type];
++
+ if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
+ printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
+ "or bytes_to_read are not 4 byte aligned\n", ioc->name,
+@@ -1852,13 +1861,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
+ return -EINVAL;
+ }
+
++ if (karg.starting_offset > request_size)
++ return -EINVAL;
++
+ diag_data = (void *)(request_data + karg.starting_offset);
+ dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "
+ "offset(%d), sz(%d)\n", ioc->name, __func__,
+ diag_data, karg.starting_offset, karg.bytes_to_read));
+
++ /* Truncate data on requests that are too large */
++ if ((diag_data + karg.bytes_to_read < diag_data) ||
++ (diag_data + karg.bytes_to_read > request_data + request_size))
++ copy_size = request_size - karg.starting_offset;
++ else
++ copy_size = karg.bytes_to_read;
++
+ if (copy_to_user((void __user *)uarg->diagnostic_data,
+- diag_data, karg.bytes_to_read)) {
++ diag_data, copy_size)) {
+ printk(MPT2SAS_ERR_FMT "%s: Unable to write "
+ "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
+ __func__, diag_data);
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index 9e75206..cb972b6 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -945,7 +945,7 @@ _scsih_build_scatter_gather(struct MPT2SAS_ADAPTER *ioc,
+ u32 chain_offset;
+ u32 chain_length;
+ u32 chain_flags;
+- u32 sges_left;
++ int sges_left;
+ u32 sges_in_segment;
+ u32 sgl_flags;
+ u32 sgl_flags_last_element;
+@@ -966,7 +966,7 @@ _scsih_build_scatter_gather(struct MPT2SAS_ADAPTER *ioc,
+
+ sg_scmd = scsi_sglist(scmd);
+ sges_left = scsi_dma_map(scmd);
+- if (!sges_left) {
++ if (sges_left < 0) {
+ sdev_printk(KERN_ERR, scmd->device, "pci_map_sg"
+ " failed: request for %d bytes!\n", scsi_bufflen(scmd));
+ return -ENOMEM;
+diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
+index 0a97bc9..483370f 100644
+--- a/drivers/scsi/pmcraid.c
++++ b/drivers/scsi/pmcraid.c
+@@ -3508,6 +3508,9 @@ static long pmcraid_ioctl_passthrough(
+ rc = -EFAULT;
+ goto out_free_buffer;
+ }
++ } else if (request_size < 0) {
++ rc = -EINVAL;
++ goto out_free_buffer;
+ }
+
+ /* check if we have any additional command parameters */
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index d78828f..1492e3e 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -400,10 +400,15 @@ static inline int scsi_host_is_busy(struct Scsi_Host *shost)
+ static void scsi_run_queue(struct request_queue *q)
+ {
+ struct scsi_device *sdev = q->queuedata;
+- struct Scsi_Host *shost = sdev->host;
++ struct Scsi_Host *shost;
+ LIST_HEAD(starved_list);
+ unsigned long flags;
+
++ /* if the device is dead, sdev will be NULL, so no queue to run */
++ if (!sdev)
++ return;
++
++ shost = sdev->host;
+ if (scsi_target(sdev)->single_lun)
+ scsi_single_lun_run(sdev);
+
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index ad136c2..ab6ac95 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -318,14 +318,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
+ kfree(evt);
+ }
+
+- if (sdev->request_queue) {
+- sdev->request_queue->queuedata = NULL;
+- /* user context needed to free queue */
+- scsi_free_queue(sdev->request_queue);
+- /* temporary expedient, try to catch use of queue lock
+- * after free of sdev */
+- sdev->request_queue = NULL;
+- }
++ /* NULL queue means the device can't be used */
++ sdev->request_queue = NULL;
+
+ scsi_target_reap(scsi_target(sdev));
+
+@@ -925,6 +919,12 @@ void __scsi_remove_device(struct scsi_device *sdev)
+ if (sdev->host->hostt->slave_destroy)
+ sdev->host->hostt->slave_destroy(sdev);
+ transport_destroy_device(dev);
++
++ /* cause the request function to reject all I/O requests */
++ sdev->request_queue->queuedata = NULL;
++
++ /* Freeing the queue signals to block that we're done */
++ scsi_free_queue(sdev->request_queue);
+ put_device(dev);
+ }
+
+diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
+index 2b55018..70ffeb1 100644
+--- a/drivers/serial/imx.c
++++ b/drivers/serial/imx.c
+@@ -382,12 +382,13 @@ static void imx_start_tx(struct uart_port *port)
+ static irqreturn_t imx_rtsint(int irq, void *dev_id)
+ {
+ struct imx_port *sport = dev_id;
+- unsigned int val = readl(sport->port.membase + USR1) & USR1_RTSS;
++ unsigned int val;
+ unsigned long flags;
+
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+ writel(USR1_RTSD, sport->port.membase + USR1);
++ val = readl(sport->port.membase + USR1) & USR1_RTSS;
+ uart_handle_cts_change(&sport->port, !!val);
+ wake_up_interruptible(&sport->port.state->port.delta_msr_wait);
+
+diff --git a/drivers/staging/rtl8192su/r8192S_firmware.c b/drivers/staging/rtl8192su/r8192S_firmware.c
+index 3561adf..6230661 100644
+diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
+index 6d52d6a..80c21e1 100644
+diff --git a/drivers/staging/rtl8192su/r819xU_cmdpkt.c b/drivers/staging/rtl8192su/r819xU_cmdpkt.c
+index e2ba93e..071b5c6 100644
+diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
+index 1c17319..20cd7db 100644
+--- a/drivers/staging/usbip/vhci_hcd.c
++++ b/drivers/staging/usbip/vhci_hcd.c
+@@ -1134,7 +1134,7 @@ static int vhci_hcd_probe(struct platform_device *pdev)
+ usbip_uerr("create hcd failed\n");
+ return -ENOMEM;
+ }
+-
++ hcd->has_tt = 1;
+
+ /* this is private data for vhci_hcd */
+ the_controller = hcd_to_vhci(hcd);
+diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
+index 2ce5963..8a54aa9 100644
+--- a/drivers/usb/core/devices.c
++++ b/drivers/usb/core/devices.c
+@@ -65,8 +65,8 @@
+ #define ALLOW_SERIAL_NUMBER
+
+ static const char *format_topo =
+-/* T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd */
+-"\nT: Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%3s MxCh=%2d\n";
++/* T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd */
++"\nT: Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%-4s MxCh=%2d\n";
+
+ static const char *format_string_manufacturer =
+ /* S: Manufacturer=xxxx */
+@@ -510,11 +510,13 @@ static ssize_t usb_device_dump(char __user **buffer, size_t *nbytes,
+ speed = "1.5"; break;
+ case USB_SPEED_UNKNOWN: /* usb 1.1 root hub code */
+ case USB_SPEED_FULL:
+- speed = "12 "; break;
++ speed = "12"; break;
+ case USB_SPEED_HIGH:
+ speed = "480"; break;
++ case USB_SPEED_SUPER:
++ speed = "5000"; break;
+ default:
+- speed = "?? ";
++ speed = "??";
+ }
+ data_end = pages_start + sprintf(pages_start, format_topo,
+ bus->busnum, level, parent_devnum,
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index fc722a0..283f019 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1424,11 +1424,11 @@ void usb_set_device_state(struct usb_device *udev,
+ || new_state == USB_STATE_SUSPENDED)
+ ; /* No change to wakeup settings */
+ else if (new_state == USB_STATE_CONFIGURED)
+- device_init_wakeup(&udev->dev,
++ device_set_wakeup_capable(&udev->dev,
+ (udev->actconfig->desc.bmAttributes
+ & USB_CONFIG_ATT_WAKEUP));
+ else
+- device_init_wakeup(&udev->dev, 0);
++ device_set_wakeup_capable(&udev->dev, 0);
+ }
+ if (udev->state == USB_STATE_SUSPENDED &&
+ new_state != USB_STATE_SUSPENDED)
+@@ -1786,10 +1786,17 @@ int usb_new_device(struct usb_device *udev)
+ {
+ int err;
+
+- /* Increment the parent's count of unsuspended children */
+- if (udev->parent)
++ if (udev->parent) {
++ /* Increment the parent's count of unsuspended children */
+ usb_autoresume_device(udev->parent);
+
++ /* Initialize non-root-hub device wakeup to disabled;
++ * device (un)configuration controls wakeup capable
++ * sysfs power/wakeup controls wakeup enabled/disabled
++ */
++ device_init_wakeup(&udev->dev, 0);
++ }
++
+ err = usb_enumerate_device(udev); /* Read descriptors */
+ if (err < 0)
+ goto fail;
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 547e0e3..24212be 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1792,6 +1792,7 @@ allocate_instance(struct device *dev,
+ INIT_LIST_HEAD(&musb->out_bulk);
+
+ hcd->uses_new_polling = 1;
++ hcd->has_tt = 1;
+
+ musb->vbuserr_retry = VBUSERR_RETRY_COUNT;
+ musb->a_wait_bcon = OTG_TIME_A_WAIT_BCON;
+diff --git a/drivers/video/backlight/mbp_nvidia_bl.c b/drivers/video/backlight/mbp_nvidia_bl.c
+index 73ab600..99bdfa8 100644
+--- a/drivers/video/backlight/mbp_nvidia_bl.c
++++ b/drivers/video/backlight/mbp_nvidia_bl.c
+@@ -272,6 +272,24 @@ static const struct dmi_system_id __initdata mbp_device_table[] = {
+ },
+ .driver_data = (void *)&nvidia_chipset_data,
+ },
++ {
++ .callback = mbp_dmi_match,
++ .ident = "MacBookAir 3,1",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,1"),
++ },
++ .driver_data = (void *)&nvidia_chipset_data,
++ },
++ {
++ .callback = mbp_dmi_match,
++ .ident = "MacBookAir 3,2",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,2"),
++ },
++ .driver_data = (void *)&nvidia_chipset_data,
++ },
+ { }
+ };
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 41ecbb2..5d56a8d 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -21,6 +21,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/random.h>
+ #include <linux/iocontext.h>
++#include <linux/capability.h>
+ #include <asm/div64.h>
+ #include "compat.h"
+ #include "ctree.h"
+@@ -1900,6 +1901,9 @@ int btrfs_balance(struct btrfs_root *dev_root)
+ if (dev_root->fs_info->sb->s_flags & MS_RDONLY)
+ return -EROFS;
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ mutex_lock(&dev_root->fs_info->volume_mutex);
+ dev_root = dev_root->fs_info->dev_root;
+
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 303fd7f..33fa049 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -688,8 +688,10 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino)
+ rc = cifs_get_inode_info(&inode, full_path, NULL, sb,
+ xid, NULL);
+
+- if (!inode)
+- return ERR_PTR(-ENOMEM);
++ if (!inode) {
++ inode = ERR_PTR(rc);
++ goto out;
++ }
+
+ if (rc && cifs_sb->tcon->ipc) {
+ cFYI(1, ("ipc connection - fake read inode"));
+@@ -700,13 +702,11 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino)
+ inode->i_uid = cifs_sb->mnt_uid;
+ inode->i_gid = cifs_sb->mnt_gid;
+ } else if (rc) {
+- kfree(full_path);
+- _FreeXid(xid);
+ iget_failed(inode);
+- return ERR_PTR(rc);
++ inode = ERR_PTR(rc);
+ }
+
+-
++out:
+ kfree(full_path);
+ /* can not call macro FreeXid here since in a void func
+ * TODO: This is no longer true
+diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
+index 2e9b932..37af9a9 100644
+--- a/fs/gfs2/quota.c
++++ b/fs/gfs2/quota.c
+@@ -15,7 +15,7 @@
+ * fuzziness in the current usage value of IDs that are being used on different
+ * nodes in the cluster simultaneously. So, it is possible for a user on
+ * multiple nodes to overrun their quota, but that overrun is controlable.
+- * Since quota tags are part of transactions, there is no need to a quota check
++ * Since quota tags are part of transactions, there is no need for a quota check
+ * program to be run on node crashes or anything like that.
+ *
+ * There are couple of knobs that let the administrator manage the quota
+@@ -65,13 +65,6 @@
+ #define QUOTA_USER 1
+ #define QUOTA_GROUP 0
+
+-struct gfs2_quota_host {
+- u64 qu_limit;
+- u64 qu_warn;
+- s64 qu_value;
+- u32 qu_ll_next;
+-};
+-
+ struct gfs2_quota_change_host {
+ u64 qc_change;
+ u32 qc_flags; /* GFS2_QCF_... */
+@@ -617,33 +610,19 @@ static void do_qc(struct gfs2_quota_data *qd, s64 change)
+ mutex_unlock(&sdp->sd_quota_mutex);
+ }
+
+-static void gfs2_quota_in(struct gfs2_quota_host *qu, const void *buf)
+-{
+- const struct gfs2_quota *str = buf;
+-
+- qu->qu_limit = be64_to_cpu(str->qu_limit);
+- qu->qu_warn = be64_to_cpu(str->qu_warn);
+- qu->qu_value = be64_to_cpu(str->qu_value);
+- qu->qu_ll_next = be32_to_cpu(str->qu_ll_next);
+-}
+-
+-static void gfs2_quota_out(const struct gfs2_quota_host *qu, void *buf)
+-{
+- struct gfs2_quota *str = buf;
+-
+- str->qu_limit = cpu_to_be64(qu->qu_limit);
+- str->qu_warn = cpu_to_be64(qu->qu_warn);
+- str->qu_value = cpu_to_be64(qu->qu_value);
+- str->qu_ll_next = cpu_to_be32(qu->qu_ll_next);
+- memset(&str->qu_reserved, 0, sizeof(str->qu_reserved));
+-}
+-
+ /**
+- * gfs2_adjust_quota
++ * gfs2_adjust_quota - adjust record of current block usage
++ * @ip: The quota inode
++ * @loc: Offset of the entry in the quota file
++ * @change: The amount of change to record
++ * @qd: The quota data
+ *
+ * This function was mostly borrowed from gfs2_block_truncate_page which was
+ * in turn mostly borrowed from ext3
++ *
++ * Returns: 0 or -ve on error
+ */
++
+ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
+ s64 change, struct gfs2_quota_data *qd)
+ {
+@@ -654,15 +633,29 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
+ unsigned blocksize, iblock, pos;
+ struct buffer_head *bh;
+ struct page *page;
+- void *kaddr;
+- char *ptr;
+- struct gfs2_quota_host qp;
+- s64 value;
+- int err = -EIO;
++ void *kaddr, *ptr;
++ struct gfs2_quota q, *qp;
++ int err, nbytes;
+
+ if (gfs2_is_stuffed(ip))
+ gfs2_unstuff_dinode(ip, NULL);
+-
++
++ memset(&q, 0, sizeof(struct gfs2_quota));
++ err = gfs2_internal_read(ip, NULL, (char *)&q, &loc, sizeof(q));
++ if (err < 0)
++ return err;
++
++ err = -EIO;
++ qp = &q;
++ qp->qu_value = be64_to_cpu(qp->qu_value);
++ qp->qu_value += change;
++ qp->qu_value = cpu_to_be64(qp->qu_value);
++ qd->qd_qb.qb_value = qp->qu_value;
++
++ /* Write the quota into the quota file on disk */
++ ptr = qp;
++ nbytes = sizeof(struct gfs2_quota);
++get_a_page:
+ page = grab_cache_page(mapping, index);
+ if (!page)
+ return -ENOMEM;
+@@ -684,7 +677,10 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
+ if (!buffer_mapped(bh)) {
+ gfs2_block_map(inode, iblock, bh, 1);
+ if (!buffer_mapped(bh))
+- goto unlock;
++ goto unlock_out;
++ /* If it's a newly allocated disk block for quota, zero it */
++ if (buffer_new(bh))
++ zero_user(page, pos - blocksize, bh->b_size);
+ }
+
+ if (PageUptodate(page))
+@@ -694,25 +690,32 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
+ ll_rw_block(READ_META, 1, &bh);
+ wait_on_buffer(bh);
+ if (!buffer_uptodate(bh))
+- goto unlock;
++ goto unlock_out;
+ }
+
+ gfs2_trans_add_bh(ip->i_gl, bh, 0);
+
+ kaddr = kmap_atomic(page, KM_USER0);
+- ptr = kaddr + offset;
+- gfs2_quota_in(&qp, ptr);
+- qp.qu_value += change;
+- value = qp.qu_value;
+- gfs2_quota_out(&qp, ptr);
++ if (offset + sizeof(struct gfs2_quota) > PAGE_CACHE_SIZE)
++ nbytes = PAGE_CACHE_SIZE - offset;
++ memcpy(kaddr + offset, ptr, nbytes);
+ flush_dcache_page(page);
+ kunmap_atomic(kaddr, KM_USER0);
++ unlock_page(page);
++ page_cache_release(page);
++
++ /* If quota straddles page boundary, we need to update the rest of the
++ * quota at the beginning of the next page */
++ if ((offset + sizeof(struct gfs2_quota)) > PAGE_CACHE_SIZE) {
++ ptr = ptr + nbytes;
++ nbytes = sizeof(struct gfs2_quota) - nbytes;
++ offset = 0;
++ index++;
++ goto get_a_page;
++ }
+ err = 0;
+- qd->qd_qb.qb_magic = cpu_to_be32(GFS2_MAGIC);
+- qd->qd_qb.qb_value = cpu_to_be64(value);
+- ((struct gfs2_quota_lvb*)(qd->qd_gl->gl_lvb))->qb_magic = cpu_to_be32(GFS2_MAGIC);
+- ((struct gfs2_quota_lvb*)(qd->qd_gl->gl_lvb))->qb_value = cpu_to_be64(value);
+-unlock:
++ return err;
++unlock_out:
+ unlock_page(page);
+ page_cache_release(page);
+ return err;
+@@ -740,8 +743,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
+
+ sort(qda, num_qd, sizeof(struct gfs2_quota_data *), sort_qd, NULL);
+ for (qx = 0; qx < num_qd; qx++) {
+- error = gfs2_glock_nq_init(qda[qx]->qd_gl,
+- LM_ST_EXCLUSIVE,
++ error = gfs2_glock_nq_init(qda[qx]->qd_gl, LM_ST_EXCLUSIVE,
+ GL_NOCACHE, &ghs[qx]);
+ if (error)
+ goto out;
+@@ -776,8 +778,10 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
+ * rgrp since it won't be allocated during the transaction
+ */
+ al->al_requested = 1;
+- /* +1 in the end for block requested above for unstuffing */
+- blocks = num_qd * data_blocks + RES_DINODE + num_qd + 1;
++ /* +3 in the end for unstuffing block, inode size update block
++ * and another block in case quota straddles page boundary and
++ * two blocks need to be updated instead of 1 */
++ blocks = num_qd * data_blocks + RES_DINODE + num_qd + 3;
+
+ if (nalloc)
+ al->al_requested += nalloc * (data_blocks + ind_blocks);
+@@ -796,8 +800,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
+ qd = qda[x];
+ offset = qd2offset(qd);
+ error = gfs2_adjust_quota(ip, offset, qd->qd_change_sync,
+- (struct gfs2_quota_data *)
+- qd);
++ (struct gfs2_quota_data *)qd);
+ if (error)
+ goto out_end_trans;
+
+@@ -828,8 +831,7 @@ static int do_glock(struct gfs2_quota_data *qd, int force_refresh,
+ struct gfs2_sbd *sdp = qd->qd_gl->gl_sbd;
+ struct gfs2_inode *ip = GFS2_I(sdp->sd_quota_inode);
+ struct gfs2_holder i_gh;
+- struct gfs2_quota_host q;
+- char buf[sizeof(struct gfs2_quota)];
++ struct gfs2_quota q;
+ int error;
+ struct gfs2_quota_lvb *qlvb;
+
+@@ -853,22 +855,23 @@ restart:
+ if (error)
+ goto fail;
+
+- memset(buf, 0, sizeof(struct gfs2_quota));
++ memset(&q, 0, sizeof(struct gfs2_quota));
+ pos = qd2offset(qd);
+- error = gfs2_internal_read(ip, NULL, buf, &pos,
+- sizeof(struct gfs2_quota));
++ error = gfs2_internal_read(ip, NULL, (char *)&q, &pos, sizeof(q));
+ if (error < 0)
+ goto fail_gunlock;
+-
++ if ((error < sizeof(q)) && force_refresh) {
++ error = -ENOENT;
++ goto fail_gunlock;
++ }
+ gfs2_glock_dq_uninit(&i_gh);
+
+- gfs2_quota_in(&q, buf);
+ qlvb = (struct gfs2_quota_lvb *)qd->qd_gl->gl_lvb;
+ qlvb->qb_magic = cpu_to_be32(GFS2_MAGIC);
+ qlvb->__pad = 0;
+- qlvb->qb_limit = cpu_to_be64(q.qu_limit);
+- qlvb->qb_warn = cpu_to_be64(q.qu_warn);
+- qlvb->qb_value = cpu_to_be64(q.qu_value);
++ qlvb->qb_limit = q.qu_limit;
++ qlvb->qb_warn = q.qu_warn;
++ qlvb->qb_value = q.qu_value;
+ qd->qd_qb = *qlvb;
+
+ if (gfs2_glock_is_blocking(qd->qd_gl)) {
+@@ -1127,7 +1130,6 @@ int gfs2_quota_refresh(struct gfs2_sbd *sdp, int user, u32 id)
+ gfs2_glock_dq_uninit(&q_gh);
+
+ qd_put(qd);
+-
+ return error;
+ }
+
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 3c80474..bfaef7b 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -861,9 +861,10 @@ out:
+ return ret;
+ }
+
+-static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
++static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ {
+ struct nfs_inode *nfsi = NFS_I(inode);
++ unsigned long ret = 0;
+
+ if ((fattr->valid & NFS_ATTR_FATTR_PRECHANGE)
+ && (fattr->valid & NFS_ATTR_FATTR_CHANGE)
+@@ -871,25 +872,32 @@ static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ nfsi->change_attr = fattr->change_attr;
+ if (S_ISDIR(inode->i_mode))
+ nfsi->cache_validity |= NFS_INO_INVALID_DATA;
++ ret |= NFS_INO_INVALID_ATTR;
+ }
+ /* If we have atomic WCC data, we may update some attributes */
+ if ((fattr->valid & NFS_ATTR_FATTR_PRECTIME)
+ && (fattr->valid & NFS_ATTR_FATTR_CTIME)
+- && timespec_equal(&inode->i_ctime, &fattr->pre_ctime))
+- memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
++ && timespec_equal(&inode->i_ctime, &fattr->pre_ctime)) {
++ memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
++ ret |= NFS_INO_INVALID_ATTR;
++ }
+
+ if ((fattr->valid & NFS_ATTR_FATTR_PREMTIME)
+ && (fattr->valid & NFS_ATTR_FATTR_MTIME)
+ && timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) {
+- memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
+- if (S_ISDIR(inode->i_mode))
+- nfsi->cache_validity |= NFS_INO_INVALID_DATA;
++ memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
++ if (S_ISDIR(inode->i_mode))
++ nfsi->cache_validity |= NFS_INO_INVALID_DATA;
++ ret |= NFS_INO_INVALID_ATTR;
+ }
+ if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE)
+ && (fattr->valid & NFS_ATTR_FATTR_SIZE)
+ && i_size_read(inode) == nfs_size_to_loff_t(fattr->pre_size)
+- && nfsi->npages == 0)
+- i_size_write(inode, nfs_size_to_loff_t(fattr->size));
++ && nfsi->npages == 0) {
++ i_size_write(inode, nfs_size_to_loff_t(fattr->size));
++ ret |= NFS_INO_INVALID_ATTR;
++ }
++ return ret;
+ }
+
+ /**
+@@ -1183,7 +1191,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ | NFS_INO_REVAL_PAGECACHE);
+
+ /* Do atomic weak cache consistency updates */
+- nfs_wcc_update_inode(inode, fattr);
++ invalid |= nfs_wcc_update_inode(inode, fattr);
+
+ /* More cache consistency checks */
+ if (fattr->valid & NFS_ATTR_FATTR_CHANGE) {
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 3c7581b..eb4421b 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3133,6 +3133,35 @@ static void buf_to_pages(const void *buf, size_t buflen,
+ }
+ }
+
++static int buf_to_pages_noslab(const void *buf, size_t buflen,
++ struct page **pages, unsigned int *pgbase)
++{
++ struct page *newpage, **spages;
++ int rc = 0;
++ size_t len;
++ spages = pages;
++
++ do {
++ len = min_t(size_t, PAGE_CACHE_SIZE, buflen);
++ newpage = alloc_page(GFP_KERNEL);
++
++ if (newpage == NULL)
++ goto unwind;
++ memcpy(page_address(newpage), buf, len);
++ buf += len;
++ buflen -= len;
++ *pages++ = newpage;
++ rc++;
++ } while (buflen != 0);
++
++ return rc;
++
++unwind:
++ for(; rc > 0; rc--)
++ __free_page(spages[rc-1]);
++ return -ENOMEM;
++}
++
+ struct nfs4_cached_acl {
+ int cached;
+ size_t len;
+@@ -3299,13 +3328,23 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
+ .rpc_argp = &arg,
+ .rpc_resp = &res,
+ };
+- int ret;
++ int ret, i;
+
+ if (!nfs4_server_supports_acls(server))
+ return -EOPNOTSUPP;
++ i = buf_to_pages_noslab(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
++ if (i < 0)
++ return i;
+ nfs_inode_return_delegation(inode);
+- buf_to_pages(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
+ ret = nfs4_call_sync(server, &msg, &arg, &res, 1);
++
++ /*
++ * Free each page after tx, so the only ref left is
++ * held by the network stack
++ */
++ for (; i > 0; i--)
++ put_page(pages[i-1]);
++
+ nfs_access_zap_cache(inode);
+ nfs_zap_acl_cache(inode);
+ return ret;
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 2ef4fec..2fd5287 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1228,7 +1228,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ int status = 0;
+
+ /* Ensure exclusive access to NFSv4 state */
+- for(;;) {
++ do {
+ if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) {
+ /* We're going to have to re-establish a clientid */
+ status = nfs4_reclaim_lease(clp);
+@@ -1304,7 +1304,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ break;
+ if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+ break;
+- }
++ } while (atomic_read(&clp->cl_count) > 1);
+ return;
+ out_error:
+ printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index c0173a8..c346808 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1925,6 +1925,15 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
+ if (error < 0)
+ goto out;
+
++ /*
++ * noac is a special case. It implies -o sync, but that's not
++ * necessarily reflected in the mtab options. do_remount_sb
++ * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the
++ * remount options, so we have to explicitly reset it.
++ */
++ if (data->flags & NFS_MOUNT_NOAC)
++ *flags |= MS_SYNCHRONOUS;
++
+ /* compare new mount options with old ones */
+ error = nfs_compare_remount_data(nfss, data);
+ out:
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 060a889..2e09588 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1379,7 +1379,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ goto out;
+ if (!(iap->ia_valid & ATTR_MODE))
+ iap->ia_mode = 0;
+- err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
++ err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
+ if (err)
+ goto out;
+
+@@ -1401,6 +1401,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ if (IS_ERR(dchild))
+ goto out_nfserr;
+
++ /* If file doesn't exist, check for permissions to create one */
++ if (!dchild->d_inode) {
++ err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
++ if (err)
++ goto out;
++ }
++
+ err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
+ if (err)
+ goto out;
+diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
+index 2cd9e43..a2a14cd 100644
+--- a/fs/partitions/ldm.c
++++ b/fs/partitions/ldm.c
+@@ -1299,6 +1299,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
+
+ BUG_ON (!data || !frags);
+
++ if (size < 2 * VBLK_SIZE_HEAD) {
++ ldm_error("Value of size is to small.");
++ return false;
++ }
++
+ group = get_unaligned_be32(data + 0x08);
+ rec = get_unaligned_be16(data + 0x0C);
+ num = get_unaligned_be16(data + 0x0E);
+@@ -1306,6 +1311,10 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
+ ldm_error ("A VBLK claims to have %d parts.", num);
+ return false;
+ }
++ if (rec >= num) {
++ ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
++ return false;
++ }
+
+ list_for_each (item, frags) {
+ f = list_entry (item, struct frag, list);
+@@ -1334,10 +1343,9 @@ found:
+
+ f->map |= (1 << rec);
+
+- if (num > 0) {
+- data += VBLK_SIZE_HEAD;
+- size -= VBLK_SIZE_HEAD;
+- }
++ data += VBLK_SIZE_HEAD;
++ size -= VBLK_SIZE_HEAD;
++
+ memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
+
+ return true;
+diff --git a/fs/partitions/osf.c b/fs/partitions/osf.c
+index c05c17bc..9ddca58 100644
+--- a/fs/partitions/osf.c
++++ b/fs/partitions/osf.c
+@@ -10,10 +10,13 @@
+ #include "check.h"
+ #include "osf.h"
+
++#define MAX_OSF_PARTITIONS 18
++
+ int osf_partition(struct parsed_partitions *state, struct block_device *bdev)
+ {
+ int i;
+ int slot = 1;
++ unsigned int npartitions;
+ Sector sect;
+ unsigned char *data;
+ struct disklabel {
+@@ -45,7 +48,7 @@ int osf_partition(struct parsed_partitions *state, struct block_device *bdev)
+ u8 p_fstype;
+ u8 p_frag;
+ __le16 p_cpg;
+- } d_partitions[8];
++ } d_partitions[MAX_OSF_PARTITIONS];
+ } * label;
+ struct d_partition * partition;
+
+@@ -63,7 +66,12 @@ int osf_partition(struct parsed_partitions *state, struct block_device *bdev)
+ put_dev_sector(sect);
+ return 0;
+ }
+- for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {
++ npartitions = le16_to_cpu(label->d_npartitions);
++ if (npartitions > MAX_OSF_PARTITIONS) {
++ put_dev_sector(sect);
++ return 0;
++ }
++ for (i = 0 ; i < npartitions; i++, partition++) {
+ if (slot == state->limit)
+ break;
+ if (le32_to_cpu(partition->p_size))
+diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
+index f94ddf7..31d09d1 100644
+--- a/fs/ubifs/recovery.c
++++ b/fs/ubifs/recovery.c
+@@ -299,6 +299,32 @@ int ubifs_recover_master_node(struct ubifs_info *c)
+ goto out_free;
+ }
+ memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ);
++
++ /*
++ * We had to recover the master node, which means there was an
++ * unclean reboot. However, it is possible that the master node
++ * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set.
++ * E.g., consider the following chain of events:
++ *
++ * 1. UBIFS was cleanly unmounted, so the master node is clean
++ * 2. UBIFS is being mounted R/W and starts changing the master
++ * node in the first (%UBIFS_MST_LNUM). A power cut happens,
++ * so this LEB ends up with some amount of garbage at the
++ * end.
++ * 3. UBIFS is being mounted R/O. We reach this place and
++ * recover the master node from the second LEB
++ * (%UBIFS_MST_LNUM + 1). But we cannot update the media
++ * because we are being mounted R/O. We have to defer the
++ * operation.
++ * 4. However, this master node (@c->mst_node) is marked as
++ * clean (since the step 1). And if we just return, the
++ * mount code will be confused and won't recover the master
++ * node when it is re-mounter R/W later.
++ *
++ * Thus, to force the recovery by marking the master node as
++ * dirty.
++ */
++ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
+ } else {
+ /* Write the recovered master node */
+ c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1;
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index eaf3636..475ca8a 100644
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -120,6 +120,7 @@ struct mmc_host {
+ unsigned int f_min;
+ unsigned int f_max;
+ u32 ocr_avail;
++ struct notifier_block pm_notify;
+
+ #define MMC_VDD_165_195 0x00000080 /* VDD voltage 1.65 - 1.95 */
+ #define MMC_VDD_20_21 0x00000100 /* VDD voltage 2.0 ~ 2.1 */
+@@ -177,6 +178,7 @@ struct mmc_host {
+
+ /* Only used with MMC_CAP_DISABLE */
+ int enabled; /* host is enabled */
++ int rescan_disable; /* disable card detection */
+ int nesting_cnt; /* "enable" nesting count */
+ int en_dis_recurs; /* detect recursion */
+ unsigned int disable_delay; /* disable delay in msecs */
+@@ -249,6 +251,7 @@ int mmc_card_can_sleep(struct mmc_host *host);
+ int mmc_host_enable(struct mmc_host *host);
+ int mmc_host_disable(struct mmc_host *host);
+ int mmc_host_lazy_disable(struct mmc_host *host);
++int mmc_pm_notify(struct notifier_block *notify_block, unsigned long, void *);
+
+ static inline void mmc_set_disable_delay(struct mmc_host *host,
+ unsigned int disable_delay)
+diff --git a/include/net/af_unix.h b/include/net/af_unix.h
+index 1614d78..861045f 100644
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -10,6 +10,7 @@ extern void unix_inflight(struct file *fp);
+ extern void unix_notinflight(struct file *fp);
+ extern void unix_gc(void);
+ extern void wait_for_unix_gc(void);
++extern struct sock *unix_get_socket(struct file *filp);
+
+ #define UNIX_HASH_SIZE 256
+
+@@ -56,6 +57,7 @@ struct unix_sock {
+ spinlock_t lock;
+ unsigned int gc_candidate : 1;
+ unsigned int gc_maybe_cycle : 1;
++ unsigned char recursion_level;
+ wait_queue_head_t peer_wait;
+ };
+ #define unix_sk(__sk) ((struct unix_sock *)__sk)
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index c39ed07..a2bd2f9 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1700,6 +1700,12 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb);
+ */
+ void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb);
+
++/*
++ * The TX headroom reserved by mac80211 for its own tx_status functions.
++ * This is enough for the radiotap header.
++ */
++#define IEEE80211_TX_STATUS_HEADROOM 13
++
+ /**
+ * ieee80211_tx_status - transmit status callback
+ *
+diff --git a/init/Kconfig b/init/Kconfig
+index 0d6388a..d72691b 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1028,6 +1028,7 @@ config SLAB
+ per cpu and per node queues.
+
+ config SLUB
++ depends on BROKEN || NUMA || !DISCONTIGMEM
+ bool "SLUB (Unqueued Allocator)"
+ help
+ SLUB is a slab allocator that minimizes cache line usage
+diff --git a/init/main.c b/init/main.c
+index bc109c7..1eb4bd5 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -407,16 +407,24 @@ static void __init setup_command_line(char *command_line)
+ * gcc-3.4 accidentally inlines this function, so use noinline.
+ */
+
++static __initdata DECLARE_COMPLETION(kthreadd_done);
++
+ static noinline void __init_refok rest_init(void)
+ __releases(kernel_lock)
+ {
+ int pid;
+
+ rcu_scheduler_starting();
++ /*
++ * We need to spawn init first so that it obtains pid-1, however
++ * the init task will end up wanting to create kthreads, which, if
++ * we schedule it before we create kthreadd, will OOPS.
++ */
+ kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);
+ numa_default_policy();
+ pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES);
+ kthreadd_task = find_task_by_pid_ns(pid, &init_pid_ns);
++ complete(&kthreadd_done);
+ unlock_kernel();
+
+ /*
+@@ -841,6 +849,10 @@ static noinline int init_post(void)
+
+ static int __init kernel_init(void * unused)
+ {
++ /*
++ * Wait until kthreadd is all set-up.
++ */
++ wait_for_completion(&kthreadd_done);
+ lock_kernel();
+
+ /*
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 029dcc2..2ffd2e0 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -1425,9 +1425,14 @@ static int bcm_init(struct sock *sk)
+ static int bcm_release(struct socket *sock)
+ {
+ struct sock *sk = sock->sk;
+- struct bcm_sock *bo = bcm_sk(sk);
++ struct bcm_sock *bo;
+ struct bcm_op *op, *next;
+
++ if (sk == NULL)
++ return 0;
++
++ bo = bcm_sk(sk);
++
+ /* remove bcm_ops, timer, rx_unregister(), etc. */
+
+ unregister_netdevice_notifier(&bo->notifier);
+diff --git a/net/can/raw.c b/net/can/raw.c
+index b5e8979..c8241d0 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -280,7 +280,12 @@ static int raw_init(struct sock *sk)
+ static int raw_release(struct socket *sock)
+ {
+ struct sock *sk = sock->sk;
+- struct raw_sock *ro = raw_sk(sk);
++ struct raw_sock *ro;
++
++ if (!sk)
++ return 0;
++
++ ro = raw_sk(sk);
+
+ unregister_netdevice_notifier(&ro->notifier);
+
+diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
+index 2a3b4e7..4be1db5 100644
+--- a/net/econet/af_econet.c
++++ b/net/econet/af_econet.c
+@@ -30,6 +30,7 @@
+ #include <linux/wireless.h>
+ #include <linux/skbuff.h>
+ #include <linux/udp.h>
++#include <linux/vmalloc.h>
+ #include <net/sock.h>
+ #include <net/inet_common.h>
+ #include <linux/stat.h>
+@@ -275,12 +276,12 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
+ #endif
+ #ifdef CONFIG_ECONET_AUNUDP
+ struct msghdr udpmsg;
+- struct iovec iov[msg->msg_iovlen+1];
++ struct iovec iov[2];
+ struct aunhdr ah;
+ struct sockaddr_in udpdest;
+ __kernel_size_t size;
+- int i;
+ mm_segment_t oldfs;
++ char *userbuf;
+ #endif
+
+ /*
+@@ -318,17 +319,17 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
+ }
+ }
+
+- if (len + 15 > dev->mtu) {
+- mutex_unlock(&econet_mutex);
+- return -EMSGSIZE;
+- }
+-
+ if (dev->type == ARPHRD_ECONET) {
+ /* Real hardware Econet. We're not worthy etc. */
+ #ifdef CONFIG_ECONET_NATIVE
+ unsigned short proto = 0;
+ int res;
+
++ if (len + 15 > dev->mtu) {
++ mutex_unlock(&econet_mutex);
++ return -EMSGSIZE;
++ }
++
+ dev_hold(dev);
+
+ skb = sock_alloc_send_skb(sk, len+LL_ALLOCATED_SPACE(dev),
+@@ -404,6 +405,11 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
+ return -ENETDOWN; /* No socket - can't send */
+ }
+
++ if (len > 32768) {
++ err = -E2BIG;
++ goto error;
++ }
++
+ /* Make up a UDP datagram and hand it off to some higher intellect. */
+
+ memset(&udpdest, 0, sizeof(udpdest));
+@@ -435,36 +441,26 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
+
+ /* tack our header on the front of the iovec */
+ size = sizeof(struct aunhdr);
+- /*
+- * XXX: that is b0rken. We can't mix userland and kernel pointers
+- * in iovec, since on a lot of platforms copy_from_user() will
+- * *not* work with the kernel and userland ones at the same time,
+- * regardless of what we do with set_fs(). And we are talking about
+- * econet-over-ethernet here, so "it's only ARM anyway" doesn't
+- * apply. Any suggestions on fixing that code? -- AV
+- */
+ iov[0].iov_base = (void *)&ah;
+ iov[0].iov_len = size;
+- for (i = 0; i < msg->msg_iovlen; i++) {
+- void __user *base = msg->msg_iov[i].iov_base;
+- size_t len = msg->msg_iov[i].iov_len;
+- /* Check it now since we switch to KERNEL_DS later. */
+- if (!access_ok(VERIFY_READ, base, len)) {
+- mutex_unlock(&econet_mutex);
+- return -EFAULT;
+- }
+- iov[i+1].iov_base = base;
+- iov[i+1].iov_len = len;
+- size += len;
++
++ userbuf = vmalloc(len);
++ if (userbuf == NULL) {
++ err = -ENOMEM;
++ goto error;
+ }
+
++ iov[1].iov_base = userbuf;
++ iov[1].iov_len = len;
++ err = memcpy_fromiovec(userbuf, msg->msg_iov, len);
++ if (err)
++ goto error_free_buf;
++
+ /* Get a skbuff (no data, just holds our cb information) */
+ if ((skb = sock_alloc_send_skb(sk, 0,
+ msg->msg_flags & MSG_DONTWAIT,
+- &err)) == NULL) {
+- mutex_unlock(&econet_mutex);
+- return err;
+- }
++ &err)) == NULL)
++ goto error_free_buf;
+
+ eb = (struct ec_cb *)&skb->cb;
+
+@@ -480,7 +476,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
+ udpmsg.msg_name = (void *)&udpdest;
+ udpmsg.msg_namelen = sizeof(udpdest);
+ udpmsg.msg_iov = &iov[0];
+- udpmsg.msg_iovlen = msg->msg_iovlen + 1;
++ udpmsg.msg_iovlen = 2;
+ udpmsg.msg_control = NULL;
+ udpmsg.msg_controllen = 0;
+ udpmsg.msg_flags=0;
+@@ -488,9 +484,13 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
+ oldfs = get_fs(); set_fs(KERNEL_DS); /* More privs :-) */
+ err = sock_sendmsg(udpsock, &udpmsg, size);
+ set_fs(oldfs);
++
++error_free_buf:
++ vfree(userbuf);
+ #else
+ err = -EPROTOTYPE;
+ #endif
++ error:
+ mutex_unlock(&econet_mutex);
+
+ return err;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 2ef9026..44b7910 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -867,8 +867,10 @@ int ip_append_data(struct sock *sk,
+ !exthdrlen)
+ csummode = CHECKSUM_PARTIAL;
+
++ skb = skb_peek_tail(&sk->sk_write_queue);
++
+ inet->cork.length += length;
+- if (((length> mtu) || !skb_queue_empty(&sk->sk_write_queue)) &&
++ if (((length > mtu) || (skb && skb_is_gso(skb))) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+ (rt->u.dst.dev->features & NETIF_F_UFO)) {
+ err = ip_ufo_append_data(sk, getfrag, from, length, hh_len,
+@@ -886,7 +888,7 @@ int ip_append_data(struct sock *sk,
+ * adding appropriate IP header.
+ */
+
+- if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
++ if (!skb)
+ goto alloc_new_skb;
+
+ while (length > 0) {
+@@ -1115,7 +1117,8 @@ ssize_t ip_append_page(struct sock *sk, struct page *page,
+ return -EINVAL;
+
+ inet->cork.length += size;
+- if ((sk->sk_protocol == IPPROTO_UDP) &&
++ if ((size + skb->len > mtu) &&
++ (sk->sk_protocol == IPPROTO_UDP) &&
+ (rt->u.dst.dev->features & NETIF_F_UFO)) {
+ skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
+ skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index d1f77cc..8ac3d09 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -407,9 +407,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
+ dev->type == ARPHRD_TUNNEL6 ||
+ dev->type == ARPHRD_SIT ||
+ dev->type == ARPHRD_NONE) {
+- printk(KERN_INFO
+- "%s: Disabled Privacy Extensions\n",
+- dev->name);
+ ndev->cnf.use_tempaddr = -1;
+ } else {
+ in6_dev_hold(ndev);
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 19fbd25..2dfe176 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -859,6 +859,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ * and we need some headroom for passing the frame to monitor
+ * interfaces, but never both at the same time.
+ */
++ BUILD_BUG_ON(IEEE80211_TX_STATUS_HEADROOM !=
++ sizeof(struct ieee80211_tx_status_rtap_hdr));
+ local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
+ sizeof(struct ieee80211_tx_status_rtap_hdr));
+
+diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
+index 5a2275c..d94ca91 100644
+--- a/net/phonet/pn_dev.c
++++ b/net/phonet/pn_dev.c
+@@ -225,6 +225,9 @@ static int phonet_device_notify(struct notifier_block *me, unsigned long what,
+ {
+ struct net_device *dev = arg;
+
++ if (!net_eq(dev_net(dev), &init_net))
++ return 0;
++
+ switch (what) {
+ case NETDEV_REGISTER:
+ if (dev->type == ARPHRD_PHONET)
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index d270403..1d61c33 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -1343,10 +1343,11 @@ static void xs_tcp_state_change(struct sock *sk)
+ if (!(xprt = xprt_from_sock(sk)))
+ goto out;
+ dprintk("RPC: xs_tcp_state_change client %p...\n", xprt);
+- dprintk("RPC: state %x conn %d dead %d zapped %d\n",
++ dprintk("RPC: state %x conn %d dead %d zapped %d sk_shutdown %d\n",
+ sk->sk_state, xprt_connected(xprt),
+ sock_flag(sk, SOCK_DEAD),
+- sock_flag(sk, SOCK_ZAPPED));
++ sock_flag(sk, SOCK_ZAPPED),
++ sk->sk_shutdown);
+
+ switch (sk->sk_state) {
+ case TCP_ESTABLISHED:
+@@ -1817,10 +1818,25 @@ static void xs_tcp_reuse_connection(struct rpc_xprt *xprt, struct sock_xprt *tra
+ {
+ unsigned int state = transport->inet->sk_state;
+
+- if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED)
+- return;
+- if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT))
+- return;
++ if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED) {
++ /* we don't need to abort the connection if the socket
++ * hasn't undergone a shutdown
++ */
++ if (transport->inet->sk_shutdown == 0)
++ return;
++ dprintk("RPC: %s: TCP_CLOSEd and sk_shutdown set to %d\n",
++ __func__, transport->inet->sk_shutdown);
++ }
++ if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT)) {
++ /* we don't need to abort the connection if the socket
++ * hasn't undergone a shutdown
++ */
++ if (transport->inet->sk_shutdown == 0)
++ return;
++ dprintk("RPC: %s: ESTABLISHED/SYN_SENT "
++ "sk_shutdown set to %d\n",
++ __func__, transport->inet->sk_shutdown);
++ }
+ xs_abort_connection(xprt, transport);
+ }
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 065dc66..db8d51a 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -503,6 +503,8 @@ static int unix_dgram_connect(struct socket *, struct sockaddr *,
+ int, int);
+ static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
+ struct msghdr *, size_t);
++static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
++ struct msghdr *, size_t, int);
+
+ static const struct proto_ops unix_stream_ops = {
+ .family = PF_UNIX,
+@@ -562,7 +564,7 @@ static const struct proto_ops unix_seqpacket_ops = {
+ .setsockopt = sock_no_setsockopt,
+ .getsockopt = sock_no_getsockopt,
+ .sendmsg = unix_seqpacket_sendmsg,
+- .recvmsg = unix_dgram_recvmsg,
++ .recvmsg = unix_seqpacket_recvmsg,
+ .mmap = sock_no_mmap,
+ .sendpage = sock_no_sendpage,
+ };
+@@ -1323,9 +1325,25 @@ static void unix_destruct_fds(struct sk_buff *skb)
+ sock_wfree(skb);
+ }
+
++#define MAX_RECURSION_LEVEL 4
++
+ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ {
+ int i;
++ unsigned char max_level = 0;
++ int unix_sock_count = 0;
++
++ for (i = scm->fp->count - 1; i >= 0; i--) {
++ struct sock *sk = unix_get_socket(scm->fp->fp[i]);
++
++ if (sk) {
++ unix_sock_count++;
++ max_level = max(max_level,
++ unix_sk(sk)->recursion_level);
++ }
++ }
++ if (unlikely(max_level > MAX_RECURSION_LEVEL))
++ return -ETOOMANYREFS;
+
+ /*
+ * Need to duplicate file references for the sake of garbage
+@@ -1336,10 +1354,12 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ if (!UNIXCB(skb).fp)
+ return -ENOMEM;
+
+- for (i = scm->fp->count-1; i >= 0; i--)
+- unix_inflight(scm->fp->fp[i]);
++ if (unix_sock_count) {
++ for (i = scm->fp->count - 1; i >= 0; i--)
++ unix_inflight(scm->fp->fp[i]);
++ }
+ skb->destructor = unix_destruct_fds;
+- return 0;
++ return max_level;
+ }
+
+ /*
+@@ -1361,6 +1381,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
+ struct sk_buff *skb;
+ long timeo;
+ struct scm_cookie tmp_scm;
++ int max_level = 0;
+
+ if (NULL == siocb->scm)
+ siocb->scm = &tmp_scm;
+@@ -1401,8 +1422,9 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
+ memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
+ if (siocb->scm->fp) {
+ err = unix_attach_fds(siocb->scm, skb);
+- if (err)
++ if (err < 0)
+ goto out_free;
++ max_level = err + 1;
+ }
+ unix_get_secdata(siocb->scm, skb);
+
+@@ -1483,6 +1505,8 @@ restart:
+ }
+
+ skb_queue_tail(&other->sk_receive_queue, skb);
++ if (max_level > unix_sk(other)->recursion_level)
++ unix_sk(other)->recursion_level = max_level;
+ unix_state_unlock(other);
+ other->sk_data_ready(other, len);
+ sock_put(other);
+@@ -1513,6 +1537,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
+ int sent = 0;
+ struct scm_cookie tmp_scm;
+ bool fds_sent = false;
++ int max_level = 0;
+
+ if (NULL == siocb->scm)
+ siocb->scm = &tmp_scm;
+@@ -1577,10 +1602,11 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
+ /* Only send the fds in the first buffer */
+ if (siocb->scm->fp && !fds_sent) {
+ err = unix_attach_fds(siocb->scm, skb);
+- if (err) {
++ if (err < 0) {
+ kfree_skb(skb);
+ goto out_err;
+ }
++ max_level = err + 1;
+ fds_sent = true;
+ }
+
+@@ -1597,6 +1623,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
+ goto pipe_err_free;
+
+ skb_queue_tail(&other->sk_receive_queue, skb);
++ if (max_level > unix_sk(other)->recursion_level)
++ unix_sk(other)->recursion_level = max_level;
+ unix_state_unlock(other);
+ other->sk_data_ready(other, size);
+ sent += size;
+@@ -1639,6 +1667,18 @@ static int unix_seqpacket_sendmsg(struct kiocb *kiocb, struct socket *sock,
+ return unix_dgram_sendmsg(kiocb, sock, msg, len);
+ }
+
++static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock,
++ struct msghdr *msg, size_t size,
++ int flags)
++{
++ struct sock *sk = sock->sk;
++
++ if (sk->sk_state != TCP_ESTABLISHED)
++ return -ENOTCONN;
++
++ return unix_dgram_recvmsg(iocb, sock, msg, size, flags);
++}
++
+ static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
+ {
+ struct unix_sock *u = unix_sk(sk);
+@@ -1813,6 +1853,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ unix_state_lock(sk);
+ skb = skb_dequeue(&sk->sk_receive_queue);
+ if (skb == NULL) {
++ unix_sk(sk)->recursion_level = 0;
+ if (copied >= target)
+ goto unlock;
+
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index 19c17e4..cb72e91 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -97,7 +97,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
+ unsigned int unix_tot_inflight;
+
+
+-static struct sock *unix_get_socket(struct file *filp)
++struct sock *unix_get_socket(struct file *filp)
+ {
+ struct sock *u_sock = NULL;
+ struct inode *inode = filp->f_path.dentry->d_inode;
+@@ -269,9 +269,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
+ }
+
+ static bool gc_in_progress = false;
++#define UNIX_INFLIGHT_TRIGGER_GC 16000
+
+ void wait_for_unix_gc(void)
+ {
++ /*
++ * If number of inflight sockets is insane,
++ * force a garbage collect right now.
++ */
++ if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
++ unix_gc();
+ wait_event(unix_gc_wait, gc_in_progress == false);
+ }
+
+diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
+index 9960d1c..7f97e3f 100644
+--- a/scripts/kconfig/conf.c
++++ b/scripts/kconfig/conf.c
+@@ -330,7 +330,7 @@ static int conf_choice(struct menu *menu)
+ }
+ if (!child)
+ continue;
+- if (line[strlen(line) - 1] == '?') {
++ if (line[0] && line[strlen(line) - 1] == '?') {
+ print_help(child);
+ continue;
+ }
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index 8ba3068..72c1b56 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -65,7 +65,9 @@ struct cs_spec {
+
+ /* available models */
+ enum {
++ CS420X_MBP53,
+ CS420X_MBP55,
++ CS420X_IMAC27,
+ CS420X_AUTO,
+ CS420X_MODELS
+ };
+@@ -832,7 +834,9 @@ static void cs_automute(struct hda_codec *codec)
+ AC_VERB_SET_PIN_WIDGET_CONTROL,
+ hp_present ? 0 : PIN_OUT);
+ }
+- if (spec->board_config == CS420X_MBP55) {
++ if (spec->board_config == CS420X_MBP53 ||
++ spec->board_config == CS420X_MBP55 ||
++ spec->board_config == CS420X_IMAC27) {
+ unsigned int gpio = hp_present ? 0x02 : 0x08;
+ snd_hda_codec_write(codec, 0x01, 0,
+ AC_VERB_SET_GPIO_DATA, gpio);
+@@ -1077,13 +1081,19 @@ static int cs_parse_auto_config(struct hda_codec *codec)
+ }
+
+ static const char *cs420x_models[CS420X_MODELS] = {
++ [CS420X_MBP53] = "mbp53",
+ [CS420X_MBP55] = "mbp55",
++ [CS420X_IMAC27] = "imac27",
+ [CS420X_AUTO] = "auto",
+ };
+
+
+ static struct snd_pci_quirk cs420x_cfg_tbl[] = {
++ SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53),
++ SND_PCI_QUIRK(0x10de, 0x0d94, "MacBookAir 3,1(2)", CS420X_MBP55),
+ SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55),
++ SND_PCI_QUIRK(0x10de, 0xcb89, "MacBookPro 7,1", CS420X_MBP55),
++ SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),
+ {} /* terminator */
+ };
+
+@@ -1092,6 +1102,20 @@ struct cs_pincfg {
+ u32 val;
+ };
+
++static struct cs_pincfg mbp53_pincfgs[] = {
++ { 0x09, 0x012b4050 },
++ { 0x0a, 0x90100141 },
++ { 0x0b, 0x90100140 },
++ { 0x0c, 0x018b3020 },
++ { 0x0d, 0x90a00110 },
++ { 0x0e, 0x400000f0 },
++ { 0x0f, 0x01cbe030 },
++ { 0x10, 0x014be060 },
++ { 0x12, 0x400000f0 },
++ { 0x15, 0x400000f0 },
++ {} /* terminator */
++};
++
+ static struct cs_pincfg mbp55_pincfgs[] = {
+ { 0x09, 0x012b4030 },
+ { 0x0a, 0x90100121 },
+@@ -1106,8 +1130,24 @@ static struct cs_pincfg mbp55_pincfgs[] = {
+ {} /* terminator */
+ };
+
++static struct cs_pincfg imac27_pincfgs[] = {
++ { 0x09, 0x012b4050 },
++ { 0x0a, 0x90100140 },
++ { 0x0b, 0x90100142 },
++ { 0x0c, 0x018b3020 },
++ { 0x0d, 0x90a00110 },
++ { 0x0e, 0x400000f0 },
++ { 0x0f, 0x01cbe030 },
++ { 0x10, 0x014be060 },
++ { 0x12, 0x01ab9070 },
++ { 0x15, 0x400000f0 },
++ {} /* terminator */
++};
++
+ static struct cs_pincfg *cs_pincfgs[CS420X_MODELS] = {
++ [CS420X_MBP53] = mbp53_pincfgs,
+ [CS420X_MBP55] = mbp55_pincfgs,
++ [CS420X_IMAC27] = imac27_pincfgs,
+ };
+
+ static void fix_pincfg(struct hda_codec *codec, int model)
+@@ -1137,6 +1177,8 @@ static int patch_cs420x(struct hda_codec *codec)
+ fix_pincfg(codec, spec->board_config);
+
+ switch (spec->board_config) {
++ case CS420X_IMAC27:
++ case CS420X_MBP53:
+ case CS420X_MBP55:
+ /* GPIO1 = headphones */
+ /* GPIO3 = speakers */
+diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
+index 08e584d..578c9f2 100644
+--- a/sound/ppc/tumbler.c
++++ b/sound/ppc/tumbler.c
+@@ -30,6 +30,7 @@
+ #include <linux/kmod.h>
+ #include <linux/slab.h>
+ #include <linux/interrupt.h>
++#include <linux/string.h>
+ #include <sound/core.h>
+ #include <asm/io.h>
+ #include <asm/irq.h>
+@@ -46,6 +47,8 @@
+ #define DBG(fmt...)
+ #endif
+
++#define IS_G4DA (machine_is_compatible("PowerMac3,4"))
++
+ /* i2c address for tumbler */
+ #define TAS_I2C_ADDR 0x34
+
+@@ -1134,7 +1137,8 @@ static long tumbler_find_device(const char *device, const char *platform,
+ gp->inactive_val = (*base) ? 0x4 : 0x5;
+ } else {
+ const u32 *prop = NULL;
+- gp->active_state = 0;
++ gp->active_state = IS_G4DA
++ && !strncmp(device, "keywest-gpio1", 13);
+ gp->active_val = 0x4;
+ gp->inactive_val = 0x5;
+ /* Here are some crude hacks to extract the GPIO polarity and
+@@ -1312,6 +1316,9 @@ static int __devinit tumbler_init(struct snd_pmac *chip)
+ if (irq <= NO_IRQ)
+ irq = tumbler_find_device("line-output-detect",
+ NULL, &mix->line_detect, 1);
++ if (IS_G4DA && irq <= NO_IRQ)
++ irq = tumbler_find_device("keywest-gpio16",
++ NULL, &mix->line_detect, 1);
+ mix->lineout_irq = irq;
+
+ tumbler_reset_audio(chip);
+diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
+index e542027..a80f1ad 100644
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -593,12 +593,12 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
+
+ { "SPKL", "Input Switch", "MIXINL" },
+ { "SPKL", "IN1LP Switch", "IN1LP" },
+- { "SPKL", "Output Switch", "Left Output Mixer" },
++ { "SPKL", "Output Switch", "Left Output PGA" },
+ { "SPKL", NULL, "TOCLK" },
+
+ { "SPKR", "Input Switch", "MIXINR" },
+ { "SPKR", "IN1RP Switch", "IN1RP" },
+- { "SPKR", "Output Switch", "Right Output Mixer" },
++ { "SPKR", "Output Switch", "Right Output PGA" },
+ { "SPKR", NULL, "TOCLK" },
+
+ { "SPKL Boost", "Direct Voice Switch", "Direct Voice" },
+@@ -620,8 +620,8 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
+ { "SPKOUTRP", NULL, "SPKR Driver" },
+ { "SPKOUTRN", NULL, "SPKR Driver" },
+
+- { "Left Headphone Mux", "Mixer", "Left Output Mixer" },
+- { "Right Headphone Mux", "Mixer", "Right Output Mixer" },
++ { "Left Headphone Mux", "Mixer", "Left Output PGA" },
++ { "Right Headphone Mux", "Mixer", "Right Output PGA" },
+
+ { "Headphone PGA", NULL, "Left Headphone Mux" },
+ { "Headphone PGA", NULL, "Right Headphone Mux" },
+diff --git a/sound/synth/emux/emux_hwdep.c b/sound/synth/emux/emux_hwdep.c
+index ff0b2a8..5ae1eae 100644
+--- a/sound/synth/emux/emux_hwdep.c
++++ b/sound/synth/emux/emux_hwdep.c
+@@ -128,6 +128,9 @@ snd_emux_init_hwdep(struct snd_emux *emu)
+ strcpy(hw->name, SNDRV_EMUX_HWDEP_NAME);
+ hw->iface = SNDRV_HWDEP_IFACE_EMUX_WAVETABLE;
+ hw->ops.ioctl = snd_emux_hwdep_ioctl;
++ /* The ioctl parameter types are compatible between 32- and
++ * 64-bit architectures, so use the same function. */
++ hw->ops.ioctl_compat = snd_emux_hwdep_ioctl;
+ hw->exclusive = 1;
+ hw->private_data = emu;
+ if ((err = snd_card_register(emu->card)) < 0)
+diff --git a/tools/perf/Makefile b/tools/perf/Makefile
+index 719d028..e5c942b 100644
+--- a/tools/perf/Makefile
++++ b/tools/perf/Makefile
+@@ -2,6 +2,7 @@
+ all::
+
+ # Define V=1 to have a more verbose compile.
++# Define V=2 to have an even more verbose compile.
+ #
+ # Define SNPRINTF_RETURNS_BOGUS if your are on a system which snprintf()
+ # or vsnprintf() return -1 instead of number of characters which would
+@@ -145,6 +146,10 @@ all::
+ # Define NO_EXTERNAL_GREP if you don't want "perf grep" to ever call
+ # your external grep (e.g., if your system lacks grep, if its grep is
+ # broken, or spawning external process is slower than built-in grep perf has).
++#
++# Define LDFLAGS=-static to build a static binary.
++#
++# Define EXTRA_CFLAGS=-m64 or EXTRA_CFLAGS=-m32 as appropriate for cross-builds.
+
+ PERF-VERSION-FILE: .FORCE-PERF-VERSION-FILE
+ @$(SHELL_PATH) util/PERF-VERSION-GEN
+@@ -157,20 +162,6 @@ uname_R := $(shell sh -c 'uname -r 2>/dev/null || echo not')
+ uname_P := $(shell sh -c 'uname -p 2>/dev/null || echo not')
+ uname_V := $(shell sh -c 'uname -v 2>/dev/null || echo not')
+
+-#
+-# Add -m32 for cross-builds:
+-#
+-ifdef NO_64BIT
+- MBITS := -m32
+-else
+- #
+- # If we're on a 64-bit kernel, use -m64:
+- #
+- ifneq ($(patsubst %64,%,$(uname_M)),$(uname_M))
+- MBITS := -m64
+- endif
+-endif
+-
+ # CFLAGS and LDFLAGS are for the users to override from the command line.
+
+ #
+@@ -200,8 +191,15 @@ EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wold-style-definition
+ EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wstrict-prototypes
+ EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wdeclaration-after-statement
+
+-CFLAGS = $(MBITS) -ggdb3 -Wall -Wextra -std=gnu99 -Werror -O6 -fstack-protector-all -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS)
+-LDFLAGS = -lpthread -lrt -lelf -lm
++ifeq ("$(origin DEBUG)", "command line")
++ PERF_DEBUG = $(DEBUG)
++endif
++ifndef PERF_DEBUG
++ CFLAGS_OPTIMIZE = -O6
++endif
++
++CFLAGS = -ggdb3 -Wall -Wextra -std=gnu99 -Werror $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
++EXTLIBS = -lpthread -lrt -lelf -lm
+ ALL_CFLAGS = $(CFLAGS)
+ ALL_LDFLAGS = $(LDFLAGS)
+ STRIP ?= strip
+@@ -254,6 +252,21 @@ PTHREAD_LIBS = -lpthread
+ # explicitly what architecture to check for. Fix this up for yours..
+ SPARSE_FLAGS = -D__BIG_ENDIAN__ -D__powerpc__
+
++ifeq ($(V), 2)
++ QUIET_STDERR = ">/dev/null"
++else
++ QUIET_STDERR = ">/dev/null 2>&1"
++endif
++
++BITBUCKET = "/dev/null"
++
++ifneq ($(shell sh -c "(echo '\#include <stdio.h>'; echo 'int main(void) { return puts(\"hi\"); }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) "$(QUIET_STDERR)" && echo y"), y)
++ BITBUCKET = .perf.dev.null
++endif
++
++ifeq ($(shell sh -c "echo 'int foo(void) {char X[2]; return 3;}' | $(CC) -x c -c -Werror -fstack-protector-all - -o $(BITBUCKET) "$(QUIET_STDERR)" && echo y"), y)
++ CFLAGS := $(CFLAGS) -fstack-protector-all
++endif
+
+
+ ### --- END CONFIGURATION SECTION ---
+@@ -423,36 +436,43 @@ ifeq ($(uname_S),Darwin)
+ PTHREAD_LIBS =
+ endif
+
+-ifeq ($(shell sh -c "(echo '\#include <libelf.h>'; echo 'int main(void) { Elf * elf = elf_begin(0, ELF_C_READ, 0); return (long)elf; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o /dev/null $(ALL_LDFLAGS) > /dev/null 2>&1 && echo y"), y)
+- ifneq ($(shell sh -c "(echo '\#include <libelf.h>'; echo 'int main(void) { Elf * elf = elf_begin(0, ELF_C_READ_MMAP, 0); return (long)elf; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o /dev/null $(ALL_LDFLAGS) > /dev/null 2>&1 && echo y"), y)
++ifneq ($(shell sh -c "(echo '\#include <gnu/libc-version.h>'; echo 'int main(void) { const char * version = gnu_get_libc_version(); return (long)version; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) "$(QUIET_STDERR)" && echo y"), y)
++ msg := $(error No gnu/libc-version.h found, please install glibc-dev[el]/glibc-static);
++endif
++
++ifeq ($(shell sh -c "(echo '\#include <libelf.h>'; echo 'int main(void) { Elf * elf = elf_begin(0, ELF_C_READ, 0); return (long)elf; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) "$(QUIET_STDERR)" && echo y"), y)
++ ifneq ($(shell sh -c "(echo '\#include <libelf.h>'; echo 'int main(void) { Elf * elf = elf_begin(0, ELF_C_READ_MMAP, 0); return (long)elf; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) "$(QUIET_STDERR)" && echo y"), y)
+ BASIC_CFLAGS += -DLIBELF_NO_MMAP
+ endif
+ else
+- msg := $(error No libelf.h/libelf found, please install libelf-dev/elfutils-libelf-devel and glibc-dev[el]);
++ msg := $(error No libelf.h/libelf found, please install libelf-dev/elfutils-libelf-devel);
+ endif
+
+ ifdef NO_DEMANGLE
+ BASIC_CFLAGS += -DNO_DEMANGLE
++else ifdef HAVE_CPLUS_DEMANGLE
++ EXTLIBS += -liberty
++ BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
+ else
+- has_bfd := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd > /dev/null 2>&1 && echo y")
++ has_bfd := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd "$(QUIET_STDERR)" && echo y")
+
+ ifeq ($(has_bfd),y)
+ EXTLIBS += -lbfd
+ else
+- has_bfd_iberty := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd -liberty > /dev/null 2>&1 && echo y")
++ has_bfd_iberty := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd -liberty "$(QUIET_STDERR)" && echo y")
+ ifeq ($(has_bfd_iberty),y)
+ EXTLIBS += -lbfd -liberty
+ else
+- has_bfd_iberty_z := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd -liberty -lz > /dev/null 2>&1 && echo y")
++ has_bfd_iberty_z := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd -liberty -lz "$(QUIET_STDERR)" && echo y")
+ ifeq ($(has_bfd_iberty_z),y)
+ EXTLIBS += -lbfd -liberty -lz
+ else
+- has_cplus_demangle := $(shell sh -c "(echo 'extern char *cplus_demangle(const char *, int);'; echo 'int main(void) { cplus_demangle(0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -liberty > /dev/null 2>&1 && echo y")
++ has_cplus_demangle := $(shell sh -c "(echo 'extern char *cplus_demangle(const char *, int);'; echo 'int main(void) { cplus_demangle(0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -liberty "$(QUIET_STDERR)" && echo y")
+ ifeq ($(has_cplus_demangle),y)
+ EXTLIBS += -liberty
+ BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
+ else
+- msg := $(warning No bfd.h/libbfd found, install binutils-dev[el] to gain symbol demangling)
++ msg := $(warning No bfd.h/libbfd found, install binutils-dev[el]/zlib-static to gain symbol demangling)
+ BASIC_CFLAGS += -DNO_DEMANGLE
+ endif
+ endif
+@@ -695,7 +715,7 @@ export TAR INSTALL DESTDIR SHELL_PATH
+
+ SHELL = $(SHELL_PATH)
+
+-all:: shell_compatibility_test $(ALL_PROGRAMS) $(BUILT_INS) $(OTHER_PROGRAMS) PERF-BUILD-OPTIONS
++all:: .perf.dev.null shell_compatibility_test $(ALL_PROGRAMS) $(BUILT_INS) $(OTHER_PROGRAMS) PERF-BUILD-OPTIONS
+ ifneq (,$X)
+ $(foreach p,$(patsubst %$X,%,$(filter %$X,$(ALL_PROGRAMS) $(BUILT_INS) perf$X)), test '$p' -ef '$p$X' || $(RM) '$p';)
+ endif
+@@ -998,6 +1018,11 @@ clean:
+ .PHONY: .FORCE-PERF-VERSION-FILE TAGS tags cscope .FORCE-PERF-CFLAGS
+ .PHONY: .FORCE-PERF-BUILD-OPTIONS
+
++.perf.dev.null:
++ touch .perf.dev.null
++
++.INTERMEDIATE: .perf.dev.null
++
+ ### Make sure built-ins do not have dups and listed in perf.c
+ #
+ check-builtins::
Copied and modified: dists/squeeze/linux-2.6/debian/patches/debian/mmc-Avoid-ABI-change-from-suspend-fix-2.patch (from r17294, dists/squeeze/linux-2.6/debian/patches/debian/mmc-Avoid-ABI-change-from-suspend-fix.patch)
==============================================================================
--- dists/squeeze/linux-2.6/debian/patches/debian/mmc-Avoid-ABI-change-from-suspend-fix.patch Tue May 3 15:28:33 2011 (r17294, copy source)
+++ dists/squeeze/linux-2.6/debian/patches/debian/mmc-Avoid-ABI-change-from-suspend-fix-2.patch Mon May 16 00:28:03 2011 (r17398)
@@ -68,14 +68,14 @@
spin_lock(&mmc_host_lock);
err = idr_get_new(&mmc_host_idr, host, &host->index);
@@ -85,7 +89,7 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
- init_waitqueue_head(&host->wq);
INIT_DELAYED_WORK(&host->detect, mmc_rescan);
INIT_DELAYED_WORK_DEFERRABLE(&host->disable, mmc_host_deeper_disable);
+ #ifdef CONFIG_PM
- host->pm_notify.notifier_call = mmc_pm_notify;
+ host_plus->pm_notify.notifier_call = mmc_pm_notify;
+ #endif
/*
- * By default, hosts do not support SGIO or large requests.
@@ -102,7 +106,7 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
return host;
Modified: dists/squeeze/linux-2.6/debian/patches/series/35
==============================================================================
--- dists/squeeze/linux-2.6/debian/patches/series/35 Sun May 15 14:04:58 2011 (r17397)
+++ dists/squeeze/linux-2.6/debian/patches/series/35 Mon May 16 00:28:03 2011 (r17398)
@@ -132,3 +132,121 @@
# Xen
+ bugfix/all/vmalloc-eagerly-clear-ptes-on-vunmap.patch
+
+# Revert temporarily to avoid conflicts
+- debian/af_unix-Avoid-ABI-change-from-introduction-of-recursion-limit.patch
+- features/x86/backlight-mbp_nvidia_bl-add-support-for-MacBookPro7-1.patch
+- bugfix/all/mmc-build-fix-mmc_pm_notify.patch
+- debian/mmc-Avoid-ABI-change-from-suspend-fix.patch
+- features/all/netxen-unified-fw-image.patch
+# Restore changes that caused regressions but are fixed in 2.6.32.40
+- debian/revert-amd-deep-c-changes-in-2.6.32.39.patch
+- bugfix/all/revert-USB-prevent-buggy-hubs-from-crashing-the-USB.patch
+# Revert changes included in 2.6.32.40
+- bugfix/all/agp-fix-OOM-and-buffer-overflow.patch
+- bugfix/all/agp-fix-arbitrary-kernel-memory-writes.patch
+- bugfix/all/can-add-missing-socket-check-in-can+raw-release.patch
+- bugfix/all/can-add-missing-socket-check-in-can+bcm-release.patch
+- bugfix/all/mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch
+- bugfix/all/partitions-ldm-fix-oops-caused-by-corrupted-partition-table.patch
+- bugfix/all/atl1c-duplicate-atl1c_get_tpd.patch
+- bugfix/all/nfsd-Open-with-O_CREAT-flag-set-fails-to-open-existing.patch
+- features/x86/Bluetooth-Add-MacBookAir3-1-2-support-2.patch
+- features/x86/Bluetooth-Add-support-for-MacbookPro-7-1.patch
+- features/x86/Bluetooth-Add-support-for-MacbookPro-6-2-2.patch
+- bugfix/all/nfs4-ensure-that-acl-pages-sent-over-nfs-were-not-allocated-from-the-slab-compilation-warning.patch
+- bugfix/all/nfs4-ensure-that-acl-pages-sent-over-nfs-were-not-allocated-from-the-slab.patch
+- bugfix/all/increase-osf-partition-limit-from-8-to-18.patch
+- bugfix/all/fix-corrupted-osf-partition-parsing.patch
+- features/all/tulip-add-support-for-Microsoft-MN-120-PCMCIA.patch
+- bugfix/all/0009-Input-elantech-discard-the-first-2-positions-on-some.patch
+- bugfix/all/0008-Input-elantech-relax-signature-checks.patch
+- bugfix/all/0006-Input-elantech-use-all-3-bytes-when-checking-version.patch
+- bugfix/all/0005-Input-elantech-ignore-high-bits-in-the-position-coor.patch
+- bugfix/all/0004-Input-elantech-allow-forcing-Elantech-protocol.patch
+- bugfix/all/0003-Input-elantech-fix-firmware-version-check.patch
+- bugfix/all/0001-Input-elantech-do-not-advertise-relative-events.patch
+- bugfix/all/usb_superspeed_devices_spd.patch
+- bugfix/all/ipv6-Silence-privacy-extensions-initialization.patch
+- bugfix/all/af_unix-limit-recursion-level.patch
+- bugfix/all/virtio_net-Add-schedule-check-to-napi_enable-call.patch
+- bugfix/all/virtio_net-fix-oom-handling-on-tx.patch
+- bugfix/all/rt2500usb-fallback-to-SW-encryption-for-TKIP-AES.patch
+- bugfix/all/init-sched-Fix-race-between-init-and-kthreadd.patch
+- bugfix/all/bonding-Ensure-that-we-unshare-skbs-prior-to-calling.patch
+- bugfix/powerpc/powerpc-boot-dts-Install-dts-from-the-right-directory.patch
+- bugfix/all/af_unix-limit-unix_tot_inflight.patch
+- features/x86/dell-laptop-Add-Dell-Inc-type-9-to-DMI-whitelist.patch
+- features/x86/dell-laptop-Add-Dell-Computer-type-8-to-DMI-whitelist.patch
+- bugfix/all/btrfs-Require-CAP_SYS_ADMIN-for-filesystem-rebalance.patch
+- bugfix/all/wireless-b43-fix-error-path-in-sdio.patch
+- bugfix/all/b43-fix-warning-at-drivers-mmc-core-core.c-237-in-mmc_wait_for_cmd.patch
+- bugfix/all/cifs-fix-another-memleak-in-cifs_root_iget.patch
+- bugfix/all/tehuti-Firmware-filename-is-tehuti-bdx.bin.patch
+- bugfix/x86/intel-iommu-Force-disable-IOMMU-for-iGFX-on-broken-C.patch
+- bugfix/all/SCSI-mpt2sas-fix-incorrect-scsi_dma_map-error-check.patch
+- bugfix/all/perf-symbols-allow-forcing-use-of-cplus_demangle.patch
+- bugfix/all/USB-don-t-enable-remote-wakeup-by-default.patch
+- bugfix/all/USB-retain-power-wakeup-setting-across-reconfig.patch
+- bugfix/all/l2tp-Fix-UDP-socket-reference-count-bugs-in-pppol2tp.patch
+- bugfix/all/econet-coalesced-iovec.patch
+- bugfix/all/econet-fix-redeclaration-of-symbol-len.patch
+- features/x86/hwmon-applesmc-Add-MacBookAir3-1-3-2-support.patch
+- features/x86/HID-add-MacBookAir-3-1-and-3-2-support.patch
+- features/x86/backlight-MacBookAir3-1-3-2-mbp-nvidia-bl-support.patch
+- features/x86/ALSA-hda-MacBookAir3-1-3-2-alsa-support.patch
+- features/x86/hwmon-applesmc-Add-generic-support-for-MacBook-Pro-7.patch
+- features/x86/hwmon-applesmc-Add-generic-support-for-MacBook-Pro-6.patch
+- features/x86/hwmon-applesmc-Add-support-for-MacBook-Pro-5-3-and-5.patch
+- features/x86/hwmon-applesmc-Add-iMac9-1-and-MacBookPro2-2-support.patch
+- features/x86/ALSA-hda-Add-model-mbp55-entry-for-MacBookPro-7-1.patch
+- features/x86/ALSA-hda-MacBookPro-5-3-line-in-support.patch
+- features/x86/ALSA-hda-Add-support-for-the-new-27-inch-IMacs.patch
+- bugfix/powerpc/ALSA-powermac-Lineout-detection-on-G4-DA.patch
+- bugfix/powerpc/ALSA-powermac-Reverse-HP-detection-on-G4-DA.patch
+- bugfix/all/sunrpc-fix-NFS-client-over-TCP-hangs-due-to-packet-loss.patch
+- bugfix/all/phonet-device-notifier-only-runs-on-initial-namespace.patch
+- bugfix/all/e1000e-Reset-82577+82578-PHY-before-first-PHY-register-read.patch
+- bugfix/all/sata_via-Delay-on-vt6420-when-starting-ATAPI-DMA-write.patch
+- bugfix/all/niu-fix-kernel-buffer-overflow-for-ETHTOOL_GRXCLSRLALL.patch
+- bugfix/all/gfs2-BUG-in-gfs2_adjust_quota.patch
+- bugfix/all/gfs2-fix-writing-to-non-page-aligned-gfs2_quota-structures.patch
+- bugfix/all/gfs2-clean-up-gfs_adjust_quota-and_do_glock.patch
+- bugfix/all/rt2x00-Properly-request-tx-headroom-for-alignment-op.patch
+- bugfix/all/rt2x00-use-correct-headroom-for-transmission.patch
+- bugfix/all/rt2x00-Centralize-setting-of-extra-TX-headroom-reque.patch
+- features/all/mac80211-Add-define-for-TX-headroom-reserved-by-mac8.patch
+- bugfix/all/e1000-fix-Tx-hangs-by-disabling-64-bit-DMA.patch
+- bugfix/all/ipg-Remove-device-claimed-by-dl2k-from-pci-id-table.patch
+- bugfix/all/mmc-fix-mmc-sd-hangs-during-suspend-resume.patch
+- bugfix/all/SCSI-scsi_dh_emc-request-flag-cleanup.patch
+- bugfix/all/SCSI-scsi_dh_emc-fix-mode-select-request-setup.patch
+- bugfix/all/ALSA-emux-Add-trivial-compat-ioctl-handler.patch
+- bugfix/mips/mips-DMA-computation-fix.patch
+- features/all/V4L-DVB-Add-Elgato-EyeTV-Diversity-to-dibcom-driver.patch
+- bugfix/all/perf-tools-Check-if-dev-null-can-be-used-as-the-o-gc.patch
+- bugfix/all/perf-tools-Move-QUIET_STDERR-def-to-before-first-use.patch
+- bugfix/all/perf-Use-default-compiler-mode-by-default.patch
+- bugfix/all/perf-tools-Suggest-static-libraries-as-well.patch
+- bugfix/all/perf-tools-Add-V-2-option-to-help-debug-config-issue.patch
+- bugfix/all/perf-tools-Support-static-build.patch
+- bugfix/all/perf-tools-Test-fstack-protector-all-compiler-option.patch
+- bugfix/all/perf-tools-Add-make-DEBUG-1-to-remove-the-O6-cflag.patch
+- bugfix/all/perf-tools-Display-better-error-messages-on-missing-.patch
+- features/all/input-add-support-of-synaptics-clickpad-device.patch
+- features/all/module-firmware/0010-pcnet-cs-declare-MODULE_FIRMWARE.patch
+- features/all/module-firmware/0009-tms380tr-declare-MODULE_FIRMWARE.patch
+- features/all/module-firmware/0008-spider-net-declare-MODULE_FIRMWARE.patch
+- features/all/module-firmware/0007-myri10ge-declare-MODULE_FIRMWARE.patch
+- features/all/module-firmware/0006-cxgb3-declare-MODULE_FIRMWARE.patch
+- features/all/module-firmware/0005-bnx2x-declare-MODULE_FIRMWARE.patch
+- features/all/module-firmware/0002-netx-declare-MODULE_FIRMWARE.patch
+- features/all/module-firmware/0001-netxen-module-firmware-hints.patch
++ bugfix/all/stable/2.6.32.40.patch
+# 2.6.32.40 has wrong version of 'netxen: module firmware hints'
++ bugfix/all/netxen-Remove-references-to-unified-firmware-file.patch
+# Restore conflicting patches
++ features/all/netxen-unified-fw-image.patch
++ debian/mmc-Avoid-ABI-change-from-suspend-fix-2.patch
++ features/x86/backlight-mbp_nvidia_bl-add-support-for-MacBookPro7-1.patch
++ debian/af_unix-Avoid-ABI-change-from-introduction-of-recursion-limit.patch
More information about the Kernel-svn-changes
mailing list