New upstream release candidate 2.6.36-rc4

Remove patches merged upstream.
Rewrite debian/scripts-kconfig-reportoldconfig.patch
Rewrite bugfix/mips/disable-werror.patch as debian/mips-disable-werror.patch
Refresh some other patches.

svn path=/dists/trunk/linux-2.6/; revision=16272

36 files changed, 94 insertions, 11589 deletions

diff --git a/debian/changelog b/debian/changelog
index 05cb1b2aa..7f368961d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+linux-2.6 (2.6.36~rc4-1~experimental.1) UNRELEASED; urgency=low
+
+  * New upstream release candidate
+
+ -- Ben Hutchings <ben@decadent.org.uk>  Mon, 13 Sep 2010 01:25:14 +0100
+
 linux-2.6 (2.6.35-1~experimental.3) experimental; urgency=low
 
   [ Ritesh Raj Sarraf ]
diff --git a/debian/patches/bugfix/all/3c59x-Fix-call-to-mdio_sync-with-the-wrong-argument.patch b/debian/patches/bugfix/all/3c59x-Fix-call-to-mdio_sync-with-the-wrong-argument.patch
deleted file mode 100644
index 73dd4f7cb..000000000
--- a/debian/patches/bugfix/all/3c59x-Fix-call-to-mdio_sync-with-the-wrong-argument.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From d3928b11844fededd058aaa4ebcbbfedfc42e22b Mon Sep 17 00:00:00 2001
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Fri, 23 Jul 2010 00:56:59 +0100
-Subject: [PATCH] 3c59x: Fix call to mdio_sync() with the wrong argument
-
-commit a095cfc40ec7ebe63e9532383c5b5c2a27b14075
-"3c59x: Specify window explicitly for access to windowed registers"
-changed the first parameter to mdio_sync(), from a pointer to the
-register mapping, to a pointer to the vortex_private structure,
-and changed all but one of the call sites.  Fix that last one.
-
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
----
- drivers/net/3c59x.c |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
-index 3c85600..53a8ca5 100644
---- a/drivers/net/3c59x.c
-+++ b/drivers/net/3c59x.c
-@@ -1387,7 +1387,7 @@ static int __devinit vortex_probe1(struct device *gendev,
- 		mii_preamble_required++;
- 		if (vp->drv_flags & EXTRA_PREAMBLE)
- 			mii_preamble_required++;
--		mdio_sync(ioaddr, 32);
-+		mdio_sync(vp, 32);
- 		mdio_read(dev, 24, MII_BMSR);
- 		for (phy = 0; phy < 32 && phy_idx < 1; phy++) {
- 			int mii_status, phyx;
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/3c59x-Specify-window-for-access-to-windowed-regs.patch b/debian/patches/bugfix/all/3c59x-Specify-window-for-access-to-windowed-regs.patch
deleted file mode 100644
index 128cb46b3..000000000
--- a/debian/patches/bugfix/all/3c59x-Specify-window-for-access-to-windowed-regs.patch
+++ /dev/null
@@ -1,706 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Wed, 23 Jun 2010 13:54:31 +0000
-Subject: [PATCH 1/2] 3c59x: Specify window explicitly for access to windowed registers
-
-commit a095cfc40ec7ebe63e9532383c5b5c2a27b14075 upstream.
-
-Currently much of the code assumes that a specific window has been
-selected, while a few functions save and restore the window.  This
-makes it impossible to introduce fine-grained locking.
-
-Make those assumptions explicit by introducing wrapper functions
-to set the window and read/write a register.  Use these everywhere
-except vortex_interrupt(), vortex_start_xmit() and vortex_rx().
-These set the window just once, or not at all in the case of
-vortex_rx() as it should always be called from vortex_interrupt().
-
-Cache the current window in struct vortex_private to avoid
-unnecessary hardware writes.
-
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
-Tested-by: Arne Nordmark <nordmark@mech.kth.se> [against 2.6.32]
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/3c59x.c |  288 +++++++++++++++++++++++++--------------------------
- 1 files changed, 140 insertions(+), 148 deletions(-)
-
-diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
-index d75803e..beddef9 100644
---- a/drivers/net/3c59x.c
-+++ b/drivers/net/3c59x.c
-@@ -435,7 +435,6 @@ MODULE_DEVICE_TABLE(pci, vortex_pci_tbl);
-    First the windows.  There are eight register windows, with the command
-    and status registers available in each.
-    */
--#define EL3WINDOW(win_num) iowrite16(SelectWindow + (win_num), ioaddr + EL3_CMD)
- #define EL3_CMD 0x0e
- #define EL3_STATUS 0x0e
- 
-@@ -647,8 +646,35 @@ struct vortex_private {
- 	u16 io_size;						/* Size of PCI region (for release_region) */
- 	spinlock_t lock;					/* Serialise access to device & its vortex_private */
- 	struct mii_if_info mii;				/* MII lib hooks/info */
-+	int window;					/* Register window */
- };
- 
-+static void window_set(struct vortex_private *vp, int window)
-+{
-+	if (window != vp->window) {
-+		iowrite16(SelectWindow + window, vp->ioaddr + EL3_CMD);
-+		vp->window = window;
-+	}
-+}
-+
-+#define DEFINE_WINDOW_IO(size)						\
-+static u ## size							\
-+window_read ## size(struct vortex_private *vp, int window, int addr)	\
-+{									\
-+	window_set(vp, window);						\
-+	return ioread ## size(vp->ioaddr + addr);			\
-+}									\
-+static void								\
-+window_write ## size(struct vortex_private *vp, u ## size value,	\
-+		     int window, int addr)				\
-+{									\
-+	window_set(vp, window);						\
-+	iowrite ## size(value, vp->ioaddr + addr);			\
-+}
-+DEFINE_WINDOW_IO(8)
-+DEFINE_WINDOW_IO(16)
-+DEFINE_WINDOW_IO(32)
-+
- #ifdef CONFIG_PCI
- #define DEVICE_PCI(dev) (((dev)->bus == &pci_bus_type) ? to_pci_dev((dev)) : NULL)
- #else
-@@ -711,7 +737,7 @@ static int vortex_probe1(struct device *gendev, void __iomem *ioaddr, int irq,
- static int vortex_up(struct net_device *dev);
- static void vortex_down(struct net_device *dev, int final);
- static int vortex_open(struct net_device *dev);
--static void mdio_sync(void __iomem *ioaddr, int bits);
-+static void mdio_sync(struct vortex_private *vp, int bits);
- static int mdio_read(struct net_device *dev, int phy_id, int location);
- static void mdio_write(struct net_device *vp, int phy_id, int location, int value);
- static void vortex_timer(unsigned long arg);
-@@ -1119,6 +1145,7 @@ static int __devinit vortex_probe1(struct device *gendev,
- 	vp->has_nway = (vci->drv_flags & HAS_NWAY) ? 1 : 0;
- 	vp->io_size = vci->io_size;
- 	vp->card_idx = card_idx;
-+	vp->window = -1;
- 
- 	/* module list only for Compaq device */
- 	if (gendev == NULL) {
-@@ -1205,7 +1232,6 @@ static int __devinit vortex_probe1(struct device *gendev,
- 	vp->mii.force_media = vp->full_duplex;
- 	vp->options = option;
- 	/* Read the station address from the EEPROM. */
--	EL3WINDOW(0);
- 	{
- 		int base;
- 
-@@ -1218,14 +1244,15 @@ static int __devinit vortex_probe1(struct device *gendev,
- 
- 		for (i = 0; i < 0x40; i++) {
- 			int timer;
--			iowrite16(base + i, ioaddr + Wn0EepromCmd);
-+			window_write16(vp, base + i, 0, Wn0EepromCmd);
- 			/* Pause for at least 162 us. for the read to take place. */
- 			for (timer = 10; timer >= 0; timer--) {
- 				udelay(162);
--				if ((ioread16(ioaddr + Wn0EepromCmd) & 0x8000) == 0)
-+				if ((window_read16(vp, 0, Wn0EepromCmd) &
-+				     0x8000) == 0)
- 					break;
- 			}
--			eeprom[i] = ioread16(ioaddr + Wn0EepromData);
-+			eeprom[i] = window_read16(vp, 0, Wn0EepromData);
- 		}
- 	}
- 	for (i = 0; i < 0x18; i++)
-@@ -1250,9 +1277,8 @@ static int __devinit vortex_probe1(struct device *gendev,
- 		pr_err("*** EEPROM MAC address is invalid.\n");
- 		goto free_ring;	/* With every pack */
- 	}
--	EL3WINDOW(2);
- 	for (i = 0; i < 6; i++)
--		iowrite8(dev->dev_addr[i], ioaddr + i);
-+		window_write8(vp, dev->dev_addr[i], 2, i);
- 
- 	if (print_info)
- 		pr_cont(", IRQ %d\n", dev->irq);
-@@ -1261,8 +1287,7 @@ static int __devinit vortex_probe1(struct device *gendev,
- 		pr_warning(" *** Warning: IRQ %d is unlikely to work! ***\n",
- 			   dev->irq);
- 
--	EL3WINDOW(4);
--	step = (ioread8(ioaddr + Wn4_NetDiag) & 0x1e) >> 1;
-+	step = (window_read8(vp, 4, Wn4_NetDiag) & 0x1e) >> 1;
- 	if (print_info) {
- 		pr_info("  product code %02x%02x rev %02x.%d date %02d-%02d-%02d\n",
- 			eeprom[6]&0xff, eeprom[6]>>8, eeprom[0x14],
-@@ -1285,17 +1310,15 @@ static int __devinit vortex_probe1(struct device *gendev,
- 				(unsigned long long)pci_resource_start(pdev, 2),
- 				vp->cb_fn_base);
- 		}
--		EL3WINDOW(2);
- 
--		n = ioread16(ioaddr + Wn2_ResetOptions) & ~0x4010;
-+		n = window_read16(vp, 2, Wn2_ResetOptions) & ~0x4010;
- 		if (vp->drv_flags & INVERT_LED_PWR)
- 			n |= 0x10;
- 		if (vp->drv_flags & INVERT_MII_PWR)
- 			n |= 0x4000;
--		iowrite16(n, ioaddr + Wn2_ResetOptions);
-+		window_write16(vp, n, 2, Wn2_ResetOptions);
- 		if (vp->drv_flags & WNO_XCVR_PWR) {
--			EL3WINDOW(0);
--			iowrite16(0x0800, ioaddr);
-+			window_write16(vp, 0x0800, 0, 0);
- 		}
- 	}
- 
-@@ -1313,14 +1336,13 @@ static int __devinit vortex_probe1(struct device *gendev,
- 	{
- 		static const char * const ram_split[] = {"5:3", "3:1", "1:1", "3:5"};
- 		unsigned int config;
--		EL3WINDOW(3);
--		vp->available_media = ioread16(ioaddr + Wn3_Options);
-+		vp->available_media = window_read16(vp, 3, Wn3_Options);
- 		if ((vp->available_media & 0xff) == 0)		/* Broken 3c916 */
- 			vp->available_media = 0x40;
--		config = ioread32(ioaddr + Wn3_Config);
-+		config = window_read32(vp, 3, Wn3_Config);
- 		if (print_info) {
- 			pr_debug("  Internal config register is %4.4x, transceivers %#x.\n",
--				config, ioread16(ioaddr + Wn3_Options));
-+				config, window_read16(vp, 3, Wn3_Options));
- 			pr_info("  %dK %s-wide RAM %s Rx:Tx split, %s%s interface.\n",
- 				   8 << RAM_SIZE(config),
- 				   RAM_WIDTH(config) ? "word" : "byte",
-@@ -1346,7 +1368,6 @@ static int __devinit vortex_probe1(struct device *gendev,
- 	if ((vp->available_media & 0x40) || (vci->drv_flags & HAS_NWAY) ||
- 		dev->if_port == XCVR_MII || dev->if_port == XCVR_NWAY) {
- 		int phy, phy_idx = 0;
--		EL3WINDOW(4);
- 		mii_preamble_required++;
- 		if (vp->drv_flags & EXTRA_PREAMBLE)
- 			mii_preamble_required++;
-@@ -1478,18 +1499,17 @@ static void
- vortex_set_duplex(struct net_device *dev)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	void __iomem *ioaddr = vp->ioaddr;
- 
- 	pr_info("%s:  setting %s-duplex.\n",
- 		dev->name, (vp->full_duplex) ? "full" : "half");
- 
--	EL3WINDOW(3);
- 	/* Set the full-duplex bit. */
--	iowrite16(((vp->info1 & 0x8000) || vp->full_duplex ? 0x20 : 0) |
--		 	(vp->large_frames ? 0x40 : 0) |
--			((vp->full_duplex && vp->flow_ctrl && vp->partner_flow_ctrl) ?
--					0x100 : 0),
--			ioaddr + Wn3_MAC_Ctrl);
-+	window_write16(vp,
-+		       ((vp->info1 & 0x8000) || vp->full_duplex ? 0x20 : 0) |
-+		       (vp->large_frames ? 0x40 : 0) |
-+		       ((vp->full_duplex && vp->flow_ctrl && vp->partner_flow_ctrl) ?
-+			0x100 : 0),
-+		       3, Wn3_MAC_Ctrl);
- }
- 
- static void vortex_check_media(struct net_device *dev, unsigned int init)
-@@ -1529,8 +1549,7 @@ vortex_up(struct net_device *dev)
- 	}
- 
- 	/* Before initializing select the active media port. */
--	EL3WINDOW(3);
--	config = ioread32(ioaddr + Wn3_Config);
-+	config = window_read32(vp, 3, Wn3_Config);
- 
- 	if (vp->media_override != 7) {
- 		pr_info("%s: Media override to transceiver %d (%s).\n",
-@@ -1577,10 +1596,9 @@ vortex_up(struct net_device *dev)
- 	config = BFINS(config, dev->if_port, 20, 4);
- 	if (vortex_debug > 6)
- 		pr_debug("vortex_up(): writing 0x%x to InternalConfig\n", config);
--	iowrite32(config, ioaddr + Wn3_Config);
-+	window_write32(vp, config, 3, Wn3_Config);
- 
- 	if (dev->if_port == XCVR_MII || dev->if_port == XCVR_NWAY) {
--		EL3WINDOW(4);
- 		mii_reg1 = mdio_read(dev, vp->phys[0], MII_BMSR);
- 		mii_reg5 = mdio_read(dev, vp->phys[0], MII_LPA);
- 		vp->partner_flow_ctrl = ((mii_reg5 & 0x0400) != 0);
-@@ -1601,51 +1619,46 @@ vortex_up(struct net_device *dev)
- 	iowrite16(SetStatusEnb | 0x00, ioaddr + EL3_CMD);
- 
- 	if (vortex_debug > 1) {
--		EL3WINDOW(4);
- 		pr_debug("%s: vortex_up() irq %d media status %4.4x.\n",
--			   dev->name, dev->irq, ioread16(ioaddr + Wn4_Media));
-+			   dev->name, dev->irq, window_read16(vp, 4, Wn4_Media));
- 	}
- 
- 	/* Set the station address and mask in window 2 each time opened. */
--	EL3WINDOW(2);
- 	for (i = 0; i < 6; i++)
--		iowrite8(dev->dev_addr[i], ioaddr + i);
-+		window_write8(vp, dev->dev_addr[i], 2, i);
- 	for (; i < 12; i+=2)
--		iowrite16(0, ioaddr + i);
-+		window_write16(vp, 0, 2, i);
- 
- 	if (vp->cb_fn_base) {
--		unsigned short n = ioread16(ioaddr + Wn2_ResetOptions) & ~0x4010;
-+		unsigned short n = window_read16(vp, 2, Wn2_ResetOptions) & ~0x4010;
- 		if (vp->drv_flags & INVERT_LED_PWR)
- 			n |= 0x10;
- 		if (vp->drv_flags & INVERT_MII_PWR)
- 			n |= 0x4000;
--		iowrite16(n, ioaddr + Wn2_ResetOptions);
-+		window_write16(vp, n, 2, Wn2_ResetOptions);
- 	}
- 
- 	if (dev->if_port == XCVR_10base2)
- 		/* Start the thinnet transceiver. We should really wait 50ms...*/
- 		iowrite16(StartCoax, ioaddr + EL3_CMD);
- 	if (dev->if_port != XCVR_NWAY) {
--		EL3WINDOW(4);
--		iowrite16((ioread16(ioaddr + Wn4_Media) & ~(Media_10TP|Media_SQE)) |
--			 media_tbl[dev->if_port].media_bits, ioaddr + Wn4_Media);
-+		window_write16(vp,
-+			       (window_read16(vp, 4, Wn4_Media) &
-+				~(Media_10TP|Media_SQE)) |
-+			       media_tbl[dev->if_port].media_bits,
-+			       4, Wn4_Media);
- 	}
- 
- 	/* Switch to the stats window, and clear all stats by reading. */
- 	iowrite16(StatsDisable, ioaddr + EL3_CMD);
--	EL3WINDOW(6);
- 	for (i = 0; i < 10; i++)
--		ioread8(ioaddr + i);
--	ioread16(ioaddr + 10);
--	ioread16(ioaddr + 12);
-+		window_read8(vp, 6, i);
-+	window_read16(vp, 6, 10);
-+	window_read16(vp, 6, 12);
- 	/* New: On the Vortex we must also clear the BadSSD counter. */
--	EL3WINDOW(4);
--	ioread8(ioaddr + 12);
-+	window_read8(vp, 4, 12);
- 	/* ..and on the Boomerang we enable the extra statistics bits. */
--	iowrite16(0x0040, ioaddr + Wn4_NetDiag);
--
--	/* Switch to register set 7 for normal use. */
--	EL3WINDOW(7);
-+	window_write16(vp, 0x0040, 4, Wn4_NetDiag);
- 
- 	if (vp->full_bus_master_rx) { /* Boomerang bus master. */
- 		vp->cur_rx = vp->dirty_rx = 0;
-@@ -1763,7 +1776,7 @@ vortex_timer(unsigned long data)
- 	void __iomem *ioaddr = vp->ioaddr;
- 	int next_tick = 60*HZ;
- 	int ok = 0;
--	int media_status, old_window;
-+	int media_status;
- 
- 	if (vortex_debug > 2) {
- 		pr_debug("%s: Media selection timer tick happened, %s.\n",
-@@ -1772,9 +1785,7 @@ vortex_timer(unsigned long data)
- 	}
- 
- 	disable_irq_lockdep(dev->irq);
--	old_window = ioread16(ioaddr + EL3_CMD) >> 13;
--	EL3WINDOW(4);
--	media_status = ioread16(ioaddr + Wn4_Media);
-+	media_status = window_read16(vp, 4, Wn4_Media);
- 	switch (dev->if_port) {
- 	case XCVR_10baseT:  case XCVR_100baseTx:  case XCVR_100baseFx:
- 		if (media_status & Media_LnkBeat) {
-@@ -1830,13 +1841,14 @@ vortex_timer(unsigned long data)
- 					   dev->name, media_tbl[dev->if_port].name);
- 			next_tick = media_tbl[dev->if_port].wait;
- 		}
--		iowrite16((media_status & ~(Media_10TP|Media_SQE)) |
--			 media_tbl[dev->if_port].media_bits, ioaddr + Wn4_Media);
-+		window_write16(vp,
-+			       (media_status & ~(Media_10TP|Media_SQE)) |
-+			       media_tbl[dev->if_port].media_bits,
-+			       4, Wn4_Media);
- 
--		EL3WINDOW(3);
--		config = ioread32(ioaddr + Wn3_Config);
-+		config = window_read32(vp, 3, Wn3_Config);
- 		config = BFINS(config, dev->if_port, 20, 4);
--		iowrite32(config, ioaddr + Wn3_Config);
-+		window_write32(vp, config, 3, Wn3_Config);
- 
- 		iowrite16(dev->if_port == XCVR_10base2 ? StartCoax : StopCoax,
- 			 ioaddr + EL3_CMD);
-@@ -1850,7 +1862,6 @@ leave_media_alone:
- 	  pr_debug("%s: Media selection timer finished, %s.\n",
- 			 dev->name, media_tbl[dev->if_port].name);
- 
--	EL3WINDOW(old_window);
- 	enable_irq_lockdep(dev->irq);
- 	mod_timer(&vp->timer, RUN_AT(next_tick));
- 	if (vp->deferred)
-@@ -1865,12 +1876,11 @@ static void vortex_tx_timeout(struct net_device *dev)
- 	pr_err("%s: transmit timed out, tx_status %2.2x status %4.4x.\n",
- 		   dev->name, ioread8(ioaddr + TxStatus),
- 		   ioread16(ioaddr + EL3_STATUS));
--	EL3WINDOW(4);
- 	pr_err("  diagnostics: net %04x media %04x dma %08x fifo %04x\n",
--			ioread16(ioaddr + Wn4_NetDiag),
--			ioread16(ioaddr + Wn4_Media),
-+			window_read16(vp, 4, Wn4_NetDiag),
-+			window_read16(vp, 4, Wn4_Media),
- 			ioread32(ioaddr + PktStatus),
--			ioread16(ioaddr + Wn4_FIFODiag));
-+			window_read16(vp, 4, Wn4_FIFODiag));
- 	/* Slight code bloat to be user friendly. */
- 	if ((ioread8(ioaddr + TxStatus) & 0x88) == 0x88)
- 		pr_err("%s: Transmitter encountered 16 collisions --"
-@@ -1917,9 +1927,6 @@ static void vortex_tx_timeout(struct net_device *dev)
- 	/* Issue Tx Enable */
- 	iowrite16(TxEnable, ioaddr + EL3_CMD);
- 	dev->trans_start = jiffies; /* prevent tx timeout */
--
--	/* Switch to register set 7 for normal use. */
--	EL3WINDOW(7);
- }
- 
- /*
-@@ -1980,10 +1987,10 @@ vortex_error(struct net_device *dev, int status)
- 			ioread16(ioaddr + EL3_STATUS) & StatsFull) {
- 			pr_warning("%s: Updating statistics failed, disabling "
- 				   "stats as an interrupt source.\n", dev->name);
--			EL3WINDOW(5);
--			iowrite16(SetIntrEnb | (ioread16(ioaddr + 10) & ~StatsFull), ioaddr + EL3_CMD);
-+			iowrite16(SetIntrEnb |
-+				  (window_read16(vp, 5, 10) & ~StatsFull),
-+				  ioaddr + EL3_CMD);
- 			vp->intr_enable &= ~StatsFull;
--			EL3WINDOW(7);
- 			DoneDidThat++;
- 		}
- 	}
-@@ -1993,8 +2000,7 @@ vortex_error(struct net_device *dev, int status)
- 	}
- 	if (status & HostError) {
- 		u16 fifo_diag;
--		EL3WINDOW(4);
--		fifo_diag = ioread16(ioaddr + Wn4_FIFODiag);
-+		fifo_diag = window_read16(vp, 4, Wn4_FIFODiag);
- 		pr_err("%s: Host error, FIFO diagnostic register %4.4x.\n",
- 			   dev->name, fifo_diag);
- 		/* Adapter failure requires Tx/Rx reset and reinit. */
-@@ -2043,8 +2049,10 @@ vortex_start_xmit(struct sk_buff *skb, struct net_device *dev)
- 	if (vp->bus_master) {
- 		/* Set the bus-master controller to transfer the packet. */
- 		int len = (skb->len + 3) & ~3;
--		iowrite32(vp->tx_skb_dma = pci_map_single(VORTEX_PCI(vp), skb->data, len, PCI_DMA_TODEVICE),
--				ioaddr + Wn7_MasterAddr);
-+		vp->tx_skb_dma = pci_map_single(VORTEX_PCI(vp), skb->data, len,
-+						PCI_DMA_TODEVICE);
-+		window_set(vp, 7);
-+		iowrite32(vp->tx_skb_dma, ioaddr + Wn7_MasterAddr);
- 		iowrite16(len, ioaddr + Wn7_MasterLen);
- 		vp->tx_skb = skb;
- 		iowrite16(StartDMADown, ioaddr + EL3_CMD);
-@@ -2217,6 +2225,8 @@ vortex_interrupt(int irq, void *dev_id)
- 		pr_debug("%s: interrupt, status %4.4x, latency %d ticks.\n",
- 			   dev->name, status, ioread8(ioaddr + Timer));
- 
-+	window_set(vp, 7);
-+
- 	do {
- 		if (vortex_debug > 5)
- 				pr_debug("%s: In interrupt loop, status %4.4x.\n",
-@@ -2760,54 +2770,46 @@ static struct net_device_stats *vortex_get_stats(struct net_device *dev)
- static void update_stats(void __iomem *ioaddr, struct net_device *dev)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	int old_window = ioread16(ioaddr + EL3_CMD);
- 
--	if (old_window == 0xffff)	/* Chip suspended or ejected. */
--		return;
- 	/* Unlike the 3c5x9 we need not turn off stats updates while reading. */
- 	/* Switch to the stats window, and read everything. */
--	EL3WINDOW(6);
--	dev->stats.tx_carrier_errors		+= ioread8(ioaddr + 0);
--	dev->stats.tx_heartbeat_errors		+= ioread8(ioaddr + 1);
--	dev->stats.tx_window_errors		+= ioread8(ioaddr + 4);
--	dev->stats.rx_fifo_errors		+= ioread8(ioaddr + 5);
--	dev->stats.tx_packets			+= ioread8(ioaddr + 6);
--	dev->stats.tx_packets			+= (ioread8(ioaddr + 9)&0x30) << 4;
--	/* Rx packets	*/			ioread8(ioaddr + 7);   /* Must read to clear */
-+	dev->stats.tx_carrier_errors		+= window_read8(vp, 6, 0);
-+	dev->stats.tx_heartbeat_errors		+= window_read8(vp, 6, 1);
-+	dev->stats.tx_window_errors		+= window_read8(vp, 6, 4);
-+	dev->stats.rx_fifo_errors		+= window_read8(vp, 6, 5);
-+	dev->stats.tx_packets			+= window_read8(vp, 6, 6);
-+	dev->stats.tx_packets			+= (window_read8(vp, 6, 9) &
-+						    0x30) << 4;
-+	/* Rx packets	*/			window_read8(vp, 6, 7);   /* Must read to clear */
- 	/* Don't bother with register 9, an extension of registers 6&7.
- 	   If we do use the 6&7 values the atomic update assumption above
- 	   is invalid. */
--	dev->stats.rx_bytes 			+= ioread16(ioaddr + 10);
--	dev->stats.tx_bytes 			+= ioread16(ioaddr + 12);
-+	dev->stats.rx_bytes 			+= window_read16(vp, 6, 10);
-+	dev->stats.tx_bytes 			+= window_read16(vp, 6, 12);
- 	/* Extra stats for get_ethtool_stats() */
--	vp->xstats.tx_multiple_collisions	+= ioread8(ioaddr + 2);
--	vp->xstats.tx_single_collisions         += ioread8(ioaddr + 3);
--	vp->xstats.tx_deferred			+= ioread8(ioaddr + 8);
--	EL3WINDOW(4);
--	vp->xstats.rx_bad_ssd			+= ioread8(ioaddr + 12);
-+	vp->xstats.tx_multiple_collisions	+= window_read8(vp, 6, 2);
-+	vp->xstats.tx_single_collisions         += window_read8(vp, 6, 3);
-+	vp->xstats.tx_deferred			+= window_read8(vp, 6, 8);
-+	vp->xstats.rx_bad_ssd			+= window_read8(vp, 4, 12);
- 
- 	dev->stats.collisions = vp->xstats.tx_multiple_collisions
- 		+ vp->xstats.tx_single_collisions
- 		+ vp->xstats.tx_max_collisions;
- 
- 	{
--		u8 up = ioread8(ioaddr + 13);
-+		u8 up = window_read8(vp, 4, 13);
- 		dev->stats.rx_bytes += (up & 0x0f) << 16;
- 		dev->stats.tx_bytes += (up & 0xf0) << 12;
- 	}
--
--	EL3WINDOW(old_window >> 13);
- }
- 
- static int vortex_nway_reset(struct net_device *dev)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	void __iomem *ioaddr = vp->ioaddr;
- 	unsigned long flags;
- 	int rc;
- 
- 	spin_lock_irqsave(&vp->lock, flags);
--	EL3WINDOW(4);
- 	rc = mii_nway_restart(&vp->mii);
- 	spin_unlock_irqrestore(&vp->lock, flags);
- 	return rc;
-@@ -2816,12 +2818,10 @@ static int vortex_nway_reset(struct net_device *dev)
- static int vortex_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	void __iomem *ioaddr = vp->ioaddr;
- 	unsigned long flags;
- 	int rc;
- 
- 	spin_lock_irqsave(&vp->lock, flags);
--	EL3WINDOW(4);
- 	rc = mii_ethtool_gset(&vp->mii, cmd);
- 	spin_unlock_irqrestore(&vp->lock, flags);
- 	return rc;
-@@ -2830,12 +2830,10 @@ static int vortex_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
- static int vortex_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	void __iomem *ioaddr = vp->ioaddr;
- 	unsigned long flags;
- 	int rc;
- 
- 	spin_lock_irqsave(&vp->lock, flags);
--	EL3WINDOW(4);
- 	rc = mii_ethtool_sset(&vp->mii, cmd);
- 	spin_unlock_irqrestore(&vp->lock, flags);
- 	return rc;
-@@ -2930,7 +2928,6 @@ static int vortex_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- {
- 	int err;
- 	struct vortex_private *vp = netdev_priv(dev);
--	void __iomem *ioaddr = vp->ioaddr;
- 	unsigned long flags;
- 	pci_power_t state = 0;
- 
-@@ -2942,7 +2939,6 @@ static int vortex_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- 	if(state != 0)
- 		pci_set_power_state(VORTEX_PCI(vp), PCI_D0);
- 	spin_lock_irqsave(&vp->lock, flags);
--	EL3WINDOW(4);
- 	err = generic_mii_ioctl(&vp->mii, if_mii(rq), cmd, NULL);
- 	spin_unlock_irqrestore(&vp->lock, flags);
- 	if(state != 0)
-@@ -2985,8 +2981,6 @@ static void set_rx_mode(struct net_device *dev)
- static void set_8021q_mode(struct net_device *dev, int enable)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	void __iomem *ioaddr = vp->ioaddr;
--	int old_window = ioread16(ioaddr + EL3_CMD);
- 	int mac_ctrl;
- 
- 	if ((vp->drv_flags&IS_CYCLONE) || (vp->drv_flags&IS_TORNADO)) {
-@@ -2997,28 +2991,23 @@ static void set_8021q_mode(struct net_device *dev, int enable)
- 		if (enable)
- 			max_pkt_size += 4;	/* 802.1Q VLAN tag */
- 
--		EL3WINDOW(3);
--		iowrite16(max_pkt_size, ioaddr+Wn3_MaxPktSize);
-+		window_write16(vp, max_pkt_size, 3, Wn3_MaxPktSize);
- 
- 		/* set VlanEtherType to let the hardware checksumming
- 		   treat tagged frames correctly */
--		EL3WINDOW(7);
--		iowrite16(VLAN_ETHER_TYPE, ioaddr+Wn7_VlanEtherType);
-+		window_write16(vp, VLAN_ETHER_TYPE, 7, Wn7_VlanEtherType);
- 	} else {
- 		/* on older cards we have to enable large frames */
- 
- 		vp->large_frames = dev->mtu > 1500 || enable;
- 
--		EL3WINDOW(3);
--		mac_ctrl = ioread16(ioaddr+Wn3_MAC_Ctrl);
-+		mac_ctrl = window_read16(vp, 3, Wn3_MAC_Ctrl);
- 		if (vp->large_frames)
- 			mac_ctrl |= 0x40;
- 		else
- 			mac_ctrl &= ~0x40;
--		iowrite16(mac_ctrl, ioaddr+Wn3_MAC_Ctrl);
-+		window_write16(vp, mac_ctrl, 3, Wn3_MAC_Ctrl);
- 	}
--
--	EL3WINDOW(old_window);
- }
- #else
- 
-@@ -3037,7 +3026,10 @@ static void set_8021q_mode(struct net_device *dev, int enable)
- /* The maximum data clock rate is 2.5 Mhz.  The minimum timing is usually
-    met by back-to-back PCI I/O cycles, but we insert a delay to avoid
-    "overclocking" issues. */
--#define mdio_delay() ioread32(mdio_addr)
-+static void mdio_delay(struct vortex_private *vp)
-+{
-+	window_read32(vp, 4, Wn4_PhysicalMgmt);
-+}
- 
- #define MDIO_SHIFT_CLK	0x01
- #define MDIO_DIR_WRITE	0x04
-@@ -3048,16 +3040,15 @@ static void set_8021q_mode(struct net_device *dev, int enable)
- 
- /* Generate the preamble required for initial synchronization and
-    a few older transceivers. */
--static void mdio_sync(void __iomem *ioaddr, int bits)
-+static void mdio_sync(struct vortex_private *vp, int bits)
- {
--	void __iomem *mdio_addr = ioaddr + Wn4_PhysicalMgmt;
--
- 	/* Establish sync by sending at least 32 logic ones. */
- 	while (-- bits >= 0) {
--		iowrite16(MDIO_DATA_WRITE1, mdio_addr);
--		mdio_delay();
--		iowrite16(MDIO_DATA_WRITE1 | MDIO_SHIFT_CLK, mdio_addr);
--		mdio_delay();
-+		window_write16(vp, MDIO_DATA_WRITE1, 4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
-+		window_write16(vp, MDIO_DATA_WRITE1 | MDIO_SHIFT_CLK,
-+			       4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
- 	}
- }
- 
-@@ -3065,29 +3056,31 @@ static int mdio_read(struct net_device *dev, int phy_id, int location)
- {
- 	int i;
- 	struct vortex_private *vp = netdev_priv(dev);
--	void __iomem *ioaddr = vp->ioaddr;
- 	int read_cmd = (0xf6 << 10) | (phy_id << 5) | location;
- 	unsigned int retval = 0;
--	void __iomem *mdio_addr = ioaddr + Wn4_PhysicalMgmt;
- 
- 	if (mii_preamble_required)
--		mdio_sync(ioaddr, 32);
-+		mdio_sync(vp, 32);
- 
- 	/* Shift the read command bits out. */
- 	for (i = 14; i >= 0; i--) {
- 		int dataval = (read_cmd&(1<<i)) ? MDIO_DATA_WRITE1 : MDIO_DATA_WRITE0;
--		iowrite16(dataval, mdio_addr);
--		mdio_delay();
--		iowrite16(dataval | MDIO_SHIFT_CLK, mdio_addr);
--		mdio_delay();
-+		window_write16(vp, dataval, 4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
-+		window_write16(vp, dataval | MDIO_SHIFT_CLK,
-+			       4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
- 	}
- 	/* Read the two transition, 16 data, and wire-idle bits. */
- 	for (i = 19; i > 0; i--) {
--		iowrite16(MDIO_ENB_IN, mdio_addr);
--		mdio_delay();
--		retval = (retval << 1) | ((ioread16(mdio_addr) & MDIO_DATA_READ) ? 1 : 0);
--		iowrite16(MDIO_ENB_IN | MDIO_SHIFT_CLK, mdio_addr);
--		mdio_delay();
-+		window_write16(vp, MDIO_ENB_IN, 4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
-+		retval = (retval << 1) |
-+			((window_read16(vp, 4, Wn4_PhysicalMgmt) &
-+			  MDIO_DATA_READ) ? 1 : 0);
-+		window_write16(vp, MDIO_ENB_IN | MDIO_SHIFT_CLK,
-+			       4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
- 	}
- 	return retval & 0x20000 ? 0xffff : retval>>1 & 0xffff;
- }
-@@ -3095,28 +3088,28 @@ static int mdio_read(struct net_device *dev, int phy_id, int location)
- static void mdio_write(struct net_device *dev, int phy_id, int location, int value)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	void __iomem *ioaddr = vp->ioaddr;
- 	int write_cmd = 0x50020000 | (phy_id << 23) | (location << 18) | value;
--	void __iomem *mdio_addr = ioaddr + Wn4_PhysicalMgmt;
- 	int i;
- 
- 	if (mii_preamble_required)
--		mdio_sync(ioaddr, 32);
-+		mdio_sync(vp, 32);
- 
- 	/* Shift the command bits out. */
- 	for (i = 31; i >= 0; i--) {
- 		int dataval = (write_cmd&(1<<i)) ? MDIO_DATA_WRITE1 : MDIO_DATA_WRITE0;
--		iowrite16(dataval, mdio_addr);
--		mdio_delay();
--		iowrite16(dataval | MDIO_SHIFT_CLK, mdio_addr);
--		mdio_delay();
-+		window_write16(vp, dataval, 4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
-+		window_write16(vp, dataval | MDIO_SHIFT_CLK,
-+			       4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
- 	}
- 	/* Leave the interface idle. */
- 	for (i = 1; i >= 0; i--) {
--		iowrite16(MDIO_ENB_IN, mdio_addr);
--		mdio_delay();
--		iowrite16(MDIO_ENB_IN | MDIO_SHIFT_CLK, mdio_addr);
--		mdio_delay();
-+		window_write16(vp, MDIO_ENB_IN, 4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
-+		window_write16(vp, MDIO_ENB_IN | MDIO_SHIFT_CLK,
-+			       4, Wn4_PhysicalMgmt);
-+		mdio_delay(vp);
- 	}
- }
- 
-@@ -3131,8 +3124,7 @@ static void acpi_set_WOL(struct net_device *dev)
- 
- 	if (vp->enable_wol) {
- 		/* Power up on: 1==Downloaded Filter, 2==Magic Packets, 4==Link Status. */
--		EL3WINDOW(7);
--		iowrite16(2, ioaddr + 0x0c);
-+		window_write16(vp, 2, 7, 0x0c);
- 		/* The RxFilter must accept the WOL frames. */
- 		iowrite16(SetRxFilter|RxStation|RxMulticast|RxBroadcast, ioaddr + EL3_CMD);
- 		iowrite16(RxEnable, ioaddr + EL3_CMD);
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/3c59x-Use-fine-grained-locks-for-MII-and-windowed-regs.patch b/debian/patches/bugfix/all/3c59x-Use-fine-grained-locks-for-MII-and-windowed-regs.patch
deleted file mode 100644
index 1419079c7..000000000
--- a/debian/patches/bugfix/all/3c59x-Use-fine-grained-locks-for-MII-and-windowed-regs.patch
+++ /dev/null
@@ -1,231 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Tue, 29 Jun 2010 15:26:56 +0000
-Subject: [PATCH 2/2] 3c59x: Use fine-grained locks for MII and windowed register access
-
-commit de847272149365363a6043a963a6f42fb91566e2 upstream.
-
-This avoids scheduling in atomic context and also means that IRQs
-will only be deferred for relatively short periods of time.
-
-Previously discussed in:
-http://article.gmane.org/gmane.linux.network/155024
-
-Reported-by: Arne Nordmark <nordmark@mech.kth.se>
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/3c59x.c |   68 ++++++++++++++++++++++++++++++--------------------
- 1 files changed, 41 insertions(+), 27 deletions(-)
-
-diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
-index beddef9..069a03f 100644
---- a/drivers/net/3c59x.c
-+++ b/drivers/net/3c59x.c
-@@ -644,9 +644,15 @@ struct vortex_private {
- 	u16 deferred;						/* Resend these interrupts when we
- 										 * bale from the ISR */
- 	u16 io_size;						/* Size of PCI region (for release_region) */
--	spinlock_t lock;					/* Serialise access to device & its vortex_private */
--	struct mii_if_info mii;				/* MII lib hooks/info */
--	int window;					/* Register window */
-+
-+	/* Serialises access to hardware other than MII and variables below.
-+	 * The lock hierarchy is rtnl_lock > lock > mii_lock > window_lock. */
-+	spinlock_t lock;
-+
-+	spinlock_t mii_lock;		/* Serialises access to MII */
-+	struct mii_if_info mii;		/* MII lib hooks/info */
-+	spinlock_t window_lock;		/* Serialises access to windowed regs */
-+	int window;			/* Register window */
- };
- 
- static void window_set(struct vortex_private *vp, int window)
-@@ -661,15 +667,23 @@ static void window_set(struct vortex_private *vp, int window)
- static u ## size							\
- window_read ## size(struct vortex_private *vp, int window, int addr)	\
- {									\
-+	unsigned long flags;						\
-+	u ## size ret;							\
-+	spin_lock_irqsave(&vp->window_lock, flags);			\
- 	window_set(vp, window);						\
--	return ioread ## size(vp->ioaddr + addr);			\
-+	ret = ioread ## size(vp->ioaddr + addr);			\
-+	spin_unlock_irqrestore(&vp->window_lock, flags);		\
-+	return ret;							\
- }									\
- static void								\
- window_write ## size(struct vortex_private *vp, u ## size value,	\
- 		     int window, int addr)				\
- {									\
-+	unsigned long flags;						\
-+	spin_lock_irqsave(&vp->window_lock, flags);			\
- 	window_set(vp, window);						\
- 	iowrite ## size(value, vp->ioaddr + addr);			\
-+	spin_unlock_irqrestore(&vp->window_lock, flags);		\
- }
- DEFINE_WINDOW_IO(8)
- DEFINE_WINDOW_IO(16)
-@@ -1181,6 +1195,8 @@ static int __devinit vortex_probe1(struct device *gendev,
- 	}
- 
- 	spin_lock_init(&vp->lock);
-+	spin_lock_init(&vp->mii_lock);
-+	spin_lock_init(&vp->window_lock);
- 	vp->gendev = gendev;
- 	vp->mii.dev = dev;
- 	vp->mii.mdio_read = mdio_read;
-@@ -1784,7 +1800,6 @@ vortex_timer(unsigned long data)
- 		pr_debug("dev->watchdog_timeo=%d\n", dev->watchdog_timeo);
- 	}
- 
--	disable_irq_lockdep(dev->irq);
- 	media_status = window_read16(vp, 4, Wn4_Media);
- 	switch (dev->if_port) {
- 	case XCVR_10baseT:  case XCVR_100baseTx:  case XCVR_100baseFx:
-@@ -1805,10 +1820,7 @@ vortex_timer(unsigned long data)
- 	case XCVR_MII: case XCVR_NWAY:
- 		{
- 			ok = 1;
--			/* Interrupts are already disabled */
--			spin_lock(&vp->lock);
- 			vortex_check_media(dev, 0);
--			spin_unlock(&vp->lock);
- 		}
- 		break;
- 	  default:					/* Other media types handled by Tx timeouts. */
-@@ -1827,6 +1839,8 @@ vortex_timer(unsigned long data)
- 	if (!ok) {
- 		unsigned int config;
- 
-+		spin_lock_irq(&vp->lock);
-+
- 		do {
- 			dev->if_port = media_tbl[dev->if_port].next;
- 		} while ( ! (vp->available_media & media_tbl[dev->if_port].mask));
-@@ -1855,6 +1869,8 @@ vortex_timer(unsigned long data)
- 		if (vortex_debug > 1)
- 			pr_debug("wrote 0x%08x to Wn3_Config\n", config);
- 		/* AKPM: FIXME: Should reset Rx & Tx here.  P60 of 3c90xc.pdf */
-+
-+		spin_unlock_irq(&vp->lock);
- 	}
- 
- leave_media_alone:
-@@ -1862,7 +1878,6 @@ leave_media_alone:
- 	  pr_debug("%s: Media selection timer finished, %s.\n",
- 			 dev->name, media_tbl[dev->if_port].name);
- 
--	enable_irq_lockdep(dev->irq);
- 	mod_timer(&vp->timer, RUN_AT(next_tick));
- 	if (vp->deferred)
- 		iowrite16(FakeIntr, ioaddr + EL3_CMD);
-@@ -2051,9 +2066,11 @@ vortex_start_xmit(struct sk_buff *skb, struct net_device *dev)
- 		int len = (skb->len + 3) & ~3;
- 		vp->tx_skb_dma = pci_map_single(VORTEX_PCI(vp), skb->data, len,
- 						PCI_DMA_TODEVICE);
-+		spin_lock_irq(&vp->window_lock);
- 		window_set(vp, 7);
- 		iowrite32(vp->tx_skb_dma, ioaddr + Wn7_MasterAddr);
- 		iowrite16(len, ioaddr + Wn7_MasterLen);
-+		spin_unlock_irq(&vp->window_lock);
- 		vp->tx_skb = skb;
- 		iowrite16(StartDMADown, ioaddr + EL3_CMD);
- 		/* netif_wake_queue() will be called at the DMADone interrupt. */
-@@ -2225,6 +2242,7 @@ vortex_interrupt(int irq, void *dev_id)
- 		pr_debug("%s: interrupt, status %4.4x, latency %d ticks.\n",
- 			   dev->name, status, ioread8(ioaddr + Timer));
- 
-+	spin_lock(&vp->window_lock);
- 	window_set(vp, 7);
- 
- 	do {
-@@ -2285,6 +2303,8 @@ vortex_interrupt(int irq, void *dev_id)
- 		iowrite16(AckIntr | IntReq | IntLatch, ioaddr + EL3_CMD);
- 	} while ((status = ioread16(ioaddr + EL3_STATUS)) & (IntLatch | RxComplete));
- 
-+	spin_unlock(&vp->window_lock);
-+
- 	if (vortex_debug > 4)
- 		pr_debug("%s: exiting interrupt, status %4.4x.\n",
- 			   dev->name, status);
-@@ -2806,37 +2826,22 @@ static void update_stats(void __iomem *ioaddr, struct net_device *dev)
- static int vortex_nway_reset(struct net_device *dev)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	unsigned long flags;
--	int rc;
- 
--	spin_lock_irqsave(&vp->lock, flags);
--	rc = mii_nway_restart(&vp->mii);
--	spin_unlock_irqrestore(&vp->lock, flags);
--	return rc;
-+	return mii_nway_restart(&vp->mii);
- }
- 
- static int vortex_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	unsigned long flags;
--	int rc;
- 
--	spin_lock_irqsave(&vp->lock, flags);
--	rc = mii_ethtool_gset(&vp->mii, cmd);
--	spin_unlock_irqrestore(&vp->lock, flags);
--	return rc;
-+	return mii_ethtool_gset(&vp->mii, cmd);
- }
- 
- static int vortex_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
- {
- 	struct vortex_private *vp = netdev_priv(dev);
--	unsigned long flags;
--	int rc;
- 
--	spin_lock_irqsave(&vp->lock, flags);
--	rc = mii_ethtool_sset(&vp->mii, cmd);
--	spin_unlock_irqrestore(&vp->lock, flags);
--	return rc;
-+	return mii_ethtool_sset(&vp->mii, cmd);
- }
- 
- static u32 vortex_get_msglevel(struct net_device *dev)
-@@ -3059,6 +3064,8 @@ static int mdio_read(struct net_device *dev, int phy_id, int location)
- 	int read_cmd = (0xf6 << 10) | (phy_id << 5) | location;
- 	unsigned int retval = 0;
- 
-+	spin_lock_bh(&vp->mii_lock);
-+
- 	if (mii_preamble_required)
- 		mdio_sync(vp, 32);
- 
-@@ -3082,6 +3089,9 @@ static int mdio_read(struct net_device *dev, int phy_id, int location)
- 			       4, Wn4_PhysicalMgmt);
- 		mdio_delay(vp);
- 	}
-+
-+	spin_unlock_bh(&vp->mii_lock);
-+
- 	return retval & 0x20000 ? 0xffff : retval>>1 & 0xffff;
- }
- 
-@@ -3091,6 +3101,8 @@ static void mdio_write(struct net_device *dev, int phy_id, int location, int val
- 	int write_cmd = 0x50020000 | (phy_id << 23) | (location << 18) | value;
- 	int i;
- 
-+	spin_lock_bh(&vp->mii_lock);
-+
- 	if (mii_preamble_required)
- 		mdio_sync(vp, 32);
- 
-@@ -3111,6 +3123,8 @@ static void mdio_write(struct net_device *dev, int phy_id, int location, int val
- 			       4, Wn4_PhysicalMgmt);
- 		mdio_delay(vp);
- 	}
-+
-+	spin_unlock_bh(&vp->mii_lock);
- }
- 
- /* ACPI: Advanced Configuration and Power Interface. */
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/ipr-add-writeq-definition-if-needed.patch b/debian/patches/bugfix/all/ipr-add-writeq-definition-if-needed.patch
deleted file mode 100644
index 14f4118c4..000000000
--- a/debian/patches/bugfix/all/ipr-add-writeq-definition-if-needed.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From: Brian King <brking@linux.vnet.ibm.com>
-Subject: [PATCH 1/1] ipr: add writeq definition if needed
-Date: Wed, 09 Jun 2010 08:24:55 -0700
-
-Compiling the driver will fail on 32 bit powerpc and other
-architectures where writeq is not defined.  This patch adds a
-definition for writeq.
-
-Signed-off-by: Wayne Boyer <wayneb@linux.vnet.ibm.com>
-Acked-by: Brian King <brking@linux.vnet.ibm.com>
----
-
- drivers/scsi/ipr.h |    8 ++++++++
- 1 file changed, 8 insertions(+)
-
-Index: b/drivers/scsi/ipr.h
-===================================================================
---- a/drivers/scsi/ipr.h	2010-06-08 10:06:48.000000000 -0700
-+++ b/drivers/scsi/ipr.h	2010-06-08 15:14:42.000000000 -0700
-@@ -1860,4 +1860,12 @@ static inline int ipr_sdt_is_fmt2(u32 sd
- 	return 0;
- }
-
-+#ifndef writeq
-+static inline void writeq(u64 val, void __iomem *addr)
-+{
-+	writel(((u32) (val >> 32)), addr);
-+	writel(((u32) (val)), (addr + 4));
-+}
- #endif
-+
-+#endif /* _IPR_H */
-
-
diff --git a/debian/patches/bugfix/all/ipv6-Clamp-reported-valid_lft-to-a-minimum-of-0.patch b/debian/patches/bugfix/all/ipv6-Clamp-reported-valid_lft-to-a-minimum-of-0.patch
deleted file mode 100644
index 44a02ad98..000000000
--- a/debian/patches/bugfix/all/ipv6-Clamp-reported-valid_lft-to-a-minimum-of-0.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-Subject: [PATCH 1/2] ipv6: Clamp reported valid_lft to a minimum of 0
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Sat, 26 Jun 2010 22:37:47 +0100
-
-commit f56619fc72407561b00c52244a2caa53d730bc4a upstream.
-
-Since addresses are only revalidated every 2 minutes, the reported
-valid_lft can underflow shortly before the address is deleted.
-Clamp it to a minimum of 0, as for prefered_lft.
-
-Reported-by: Piotr Lewandowski <piotr.lewandowski@gmail.com>
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- net/ipv6/addrconf.c |    8 ++++++--
- 1 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index b97bb1f..1459eed 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -3492,8 +3492,12 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
- 				preferred -= tval;
- 			else
- 				preferred = 0;
--			if (valid != INFINITY_LIFE_TIME)
--				valid -= tval;
-+			if (valid != INFINITY_LIFE_TIME) {
-+				if (valid > tval)
-+					valid -= tval;
-+				else
-+					valid = 0;
-+			}
- 		}
- 	} else {
- 		preferred = INFINITY_LIFE_TIME;
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/ipv6-Use-interface-max_desync_factor.patch b/debian/patches/bugfix/all/ipv6-Use-interface-max_desync_factor.patch
deleted file mode 100644
index bce83387d..000000000
--- a/debian/patches/bugfix/all/ipv6-Use-interface-max_desync_factor.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-Subject: [PATCH 2/2] ipv6: Use interface max_desync_factor instead of static default
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Sat, 26 Jun 2010 22:42:56 +0100
-
-commit 784e2710ce3588d8316dc8efac9ecbebaeaf7c35 upstream.
-
-max_desync_factor can be configured per-interface, but nothing is
-using the value.
-
-Reported-by: Piotr Lewandowski <piotr.lewandowski@gmail.com>
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- net/ipv6/addrconf.c |    8 ++++----
- 1 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 1459eed..ec8c92f 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -121,8 +121,6 @@ static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
- static int __ipv6_regen_rndid(struct inet6_dev *idev);
- static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
- static void ipv6_regen_rndid(unsigned long data);
--
--static int desync_factor = MAX_DESYNC_FACTOR * HZ;
- #endif
- 
- static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);
-@@ -890,7 +888,8 @@ retry:
- 			      idev->cnf.temp_valid_lft);
- 	tmp_prefered_lft = min_t(__u32,
- 				 ifp->prefered_lft,
--				 idev->cnf.temp_prefered_lft - desync_factor / HZ);
-+				 idev->cnf.temp_prefered_lft -
-+				 idev->cnf.max_desync_factor);
- 	tmp_plen = ifp->prefix_len;
- 	max_addresses = idev->cnf.max_addresses;
- 	tmp_cstamp = ifp->cstamp;
-@@ -1650,7 +1649,8 @@ static void ipv6_regen_rndid(unsigned long data)
- 
- 	expires = jiffies +
- 		idev->cnf.temp_prefered_lft * HZ -
--		idev->cnf.regen_max_retry * idev->cnf.dad_transmits * idev->nd_parms->retrans_time - desync_factor;
-+		idev->cnf.regen_max_retry * idev->cnf.dad_transmits * idev->nd_parms->retrans_time -
-+		idev->cnf.max_desync_factor * HZ;
- 	if (time_before(expires, jiffies)) {
- 		printk(KERN_WARNING
- 			"ipv6_regen_rndid(): too short regeneration interval; timer disabled for %s.\n",
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/mantis-Select-correct-frontends.patch b/debian/patches/bugfix/all/mantis-Select-correct-frontends.patch
deleted file mode 100644
index 8db4a8056..000000000
--- a/debian/patches/bugfix/all/mantis-Select-correct-frontends.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 95387e011a365a5309f6a6d621a215ab776b087a Mon Sep 17 00:00:00 2001
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Thu, 3 Jun 2010 01:42:13 +0100
-Subject: [PATCH] V4L/DVB: mantis: Select correct frontends
-
-Update the Kconfig selections to match the code.
-Add the usual condition of !DVB_FE_CUSTOMISE.
-
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
----
- drivers/media/dvb/mantis/Kconfig |   14 ++++++++++----
- 1 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/media/dvb/mantis/Kconfig b/drivers/media/dvb/mantis/Kconfig
-index f7b72a3..decdeda 100644
---- a/drivers/media/dvb/mantis/Kconfig
-+++ b/drivers/media/dvb/mantis/Kconfig
-@@ -10,9 +10,15 @@ config MANTIS_CORE
- config DVB_MANTIS
- 	tristate "MANTIS based cards"
- 	depends on MANTIS_CORE && DVB_CORE && PCI && I2C
--	select DVB_MB86A16
--	select DVB_ZL10353
--	select DVB_STV0299
-+	select DVB_MB86A16 if !DVB_FE_CUSTOMISE
-+	select DVB_ZL10353 if !DVB_FE_CUSTOMISE
-+	select DVB_STV0299 if !DVB_FE_CUSTOMISE
-+	select DVB_LNBP21 if !DVB_FE_CUSTOMISE
-+	select DVB_STB0899 if !DVB_FE_CUSTOMISE
-+	select DVB_STB6100 if !DVB_FE_CUSTOMISE
-+	select DVB_TDA665x if !DVB_FE_CUSTOMISE
-+	select DVB_TDA10021 if !DVB_FE_CUSTOMISE
-+	select DVB_TDA10023 if !DVB_FE_CUSTOMISE
- 	select DVB_PLL
- 	help
- 	  Support for PCI cards based on the Mantis PCI bridge.
-@@ -23,7 +29,7 @@ config DVB_MANTIS
- config DVB_HOPPER
- 	tristate "HOPPER based cards"
- 	depends on MANTIS_CORE && DVB_CORE && PCI && I2C
--	select DVB_ZL10353
-+	select DVB_ZL10353 if !DVB_FE_CUSTOMISE
- 	select DVB_PLL
- 	help
- 	  Support for PCI cards based on the Hopper  PCI bridge.
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/mm-fix-page-table-unmap-for-stack-guard-page-properl.patch b/debian/patches/bugfix/all/mm-fix-page-table-unmap-for-stack-guard-page-properl.patch
deleted file mode 100644
index fe9fcf270..000000000
--- a/debian/patches/bugfix/all/mm-fix-page-table-unmap-for-stack-guard-page-properl.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 11ac552477e32835cb6970bf0a70c210807f5673 Mon Sep 17 00:00:00 2001
-From: Linus Torvalds <torvalds@linux-foundation.org>
-Date: Sat, 14 Aug 2010 11:44:56 -0700
-Subject: [PATCH] mm: fix page table unmap for stack guard page properly
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-We do in fact need to unmap the page table _before_ doing the whole
-stack guard page logic, because if it is needed (mainly 32-bit x86 with
-PAE and CONFIG_HIGHPTE, but other architectures may use it too) then it
-will do a kmap_atomic/kunmap_atomic.
-
-And those kmaps will create an atomic region that we cannot do
-allocations in.  However, the whole stack expand code will need to do
-anon_vma_prepare() and vma_lock_anon_vma() and they cannot do that in an
-atomic region.
-
-Now, a better model might actually be to do the anon_vma_prepare() when
-_creating_ a VM_GROWSDOWN segment, and not have to worry about any of
-this at page fault time.  But in the meantime, this is the
-straightforward fix for the issue.
-
-See https://bugzilla.kernel.org/show_bug.cgi?id=16588 for details.
-
-Reported-by: Wylda <wylda@volny.cz>
-Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
-Reported-by: Mike Pagano <mpagano@gentoo.org>
-Reported-by: François Valenduc <francois.valenduc@tvcablenet.be>
-Tested-by: Ed Tomlinson <edt@aei.ca>
-Cc: Pekka Enberg <penberg@kernel.org>
-Cc: Greg KH <gregkh@suse.de>
-Cc: stable@kernel.org
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- mm/memory.c |   13 ++++++-------
- 1 files changed, 6 insertions(+), 7 deletions(-)
-
-diff --git a/mm/memory.c b/mm/memory.c
-index 9b3b73f..b6e5fd2 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -2792,24 +2792,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
- 	spinlock_t *ptl;
- 	pte_t entry;
- 
--	if (check_stack_guard_page(vma, address) < 0) {
--		pte_unmap(page_table);
-+	pte_unmap(page_table);
-+
-+	/* Check if we need to add a guard page to the stack */
-+	if (check_stack_guard_page(vma, address) < 0)
- 		return VM_FAULT_SIGBUS;
--	}
- 
-+	/* Use the zero-page for reads */
- 	if (!(flags & FAULT_FLAG_WRITE)) {
- 		entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
- 						vma->vm_page_prot));
--		ptl = pte_lockptr(mm, pmd);
--		spin_lock(ptl);
-+		page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
- 		if (!pte_none(*page_table))
- 			goto unlock;
- 		goto setpte;
- 	}
- 
- 	/* Allocate our own private page. */
--	pte_unmap(page_table);
--
- 	if (unlikely(anon_vma_prepare(vma)))
- 		goto oom;
- 	page = alloc_zeroed_user_highpage_movable(vma, address);
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/mm-fix-up-some-user-visible-effects-of-the-stack-gua.patch b/debian/patches/bugfix/all/mm-fix-up-some-user-visible-effects-of-the-stack-gua.patch
deleted file mode 100644
index a354ae362..000000000
--- a/debian/patches/bugfix/all/mm-fix-up-some-user-visible-effects-of-the-stack-gua.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From d7824370e26325c881b665350ce64fb0a4fde24a Mon Sep 17 00:00:00 2001
-From: Linus Torvalds <torvalds@linux-foundation.org>
-Date: Sun, 15 Aug 2010 11:35:52 -0700
-Subject: [PATCH] mm: fix up some user-visible effects of the stack guard page
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This commit makes the stack guard page somewhat less visible to user
-space. It does this by:
-
- - not showing the guard page in /proc/<pid>/maps
-
-   It looks like lvm-tools will actually read /proc/self/maps to figure
-   out where all its mappings are, and effectively do a specialized
-   "mlockall()" in user space.  By not showing the guard page as part of
-   the mapping (by just adding PAGE_SIZE to the start for grows-up
-   pages), lvm-tools ends up not being aware of it.
-
- - by also teaching the _real_ mlock() functionality not to try to lock
-   the guard page.
-
-   That would just expand the mapping down to create a new guard page,
-   so there really is no point in trying to lock it in place.
-
-It would perhaps be nice to show the guard page specially in
-/proc/<pid>/maps (or at least mark grow-down segments some way), but
-let's not open ourselves up to more breakage by user space from programs
-that depends on the exact deails of the 'maps' file.
-
-Special thanks to Henrique de Moraes Holschuh for diving into lvm-tools
-source code to see what was going on with the whole new warning.
-
-Reported-and-tested-by: François Valenduc <francois.valenduc@tvcablenet.be
-Reported-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
-Cc: stable@kernel.org
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- fs/proc/task_mmu.c |    8 +++++++-
- mm/mlock.c         |    8 ++++++++
- 2 files changed, 15 insertions(+), 1 deletions(-)
-
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index aea1d3f..439fc1f 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -210,6 +210,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- 	int flags = vma->vm_flags;
- 	unsigned long ino = 0;
- 	unsigned long long pgoff = 0;
-+	unsigned long start;
- 	dev_t dev = 0;
- 	int len;
- 
-@@ -220,8 +221,13 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- 		pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
- 	}
- 
-+	/* We don't show the stack guard page in /proc/maps */
-+	start = vma->vm_start;
-+	if (vma->vm_flags & VM_GROWSDOWN)
-+		start += PAGE_SIZE;
-+
- 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
--			vma->vm_start,
-+			start,
- 			vma->vm_end,
- 			flags & VM_READ ? 'r' : '-',
- 			flags & VM_WRITE ? 'w' : '-',
-diff --git a/mm/mlock.c b/mm/mlock.c
-index 3f82720..49e5e4c 100644
---- a/mm/mlock.c
-+++ b/mm/mlock.c
-@@ -167,6 +167,14 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
- 	if (vma->vm_flags & VM_WRITE)
- 		gup_flags |= FOLL_WRITE;
- 
-+	/* We don't try to access the guard page of a stack vma */
-+	if (vma->vm_flags & VM_GROWSDOWN) {
-+		if (start == vma->vm_start) {
-+			start += PAGE_SIZE;
-+			nr_pages--;
-+		}
-+	}
-+
- 	while (nr_pages > 0) {
- 		int i;
- 
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/netfilter-fix-CONFIG_COMPAT-support.patch b/debian/patches/bugfix/all/netfilter-fix-CONFIG_COMPAT-support.patch
deleted file mode 100644
index 29e195bc7..000000000
--- a/debian/patches/bugfix/all/netfilter-fix-CONFIG_COMPAT-support.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-commit cca77b7c81876d819a5806f408b3c29b5b61a815
-Author: Florian Westphal <fw@strlen.de>
-Date:   Mon Aug 23 14:41:22 2010 -0700
-
-    netfilter: fix CONFIG_COMPAT support
-    
-    commit f3c5c1bfd430858d3a05436f82c51e53104feb6b
-    (netfilter: xtables: make ip_tables reentrant) forgot to
-    also compute the jumpstack size in the compat handlers.
-    
-    Result is that "iptables -I INPUT -j userchain" turns into -j DROP.
-    
-    Reported by Sebastian Roesner on #netfilter, closes
-    http://bugzilla.netfilter.org/show_bug.cgi?id=669.
-    
-    Note: arptables change is compile-tested only.
-    
-    Signed-off-by: Florian Westphal <fw@strlen.de>
-    Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
-    Tested-by: Mikael Pettersson <mikpe@it.uu.se>
-    Signed-off-by: David S. Miller <davem@davemloft.net>
-
-diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
-index 51d6c31..e8f4f9a 100644
---- a/net/ipv4/netfilter/arp_tables.c
-+++ b/net/ipv4/netfilter/arp_tables.c
-@@ -1420,6 +1420,9 @@ static int translate_compat_table(const char *name,
- 		if (ret != 0)
- 			break;
- 		++i;
-+		if (strcmp(arpt_get_target(iter1)->u.user.name,
-+		    XT_ERROR_TARGET) == 0)
-+			++newinfo->stacksize;
- 	}
- 	if (ret) {
- 		/*
-diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
-index 97b64b2..d163f2e 100644
---- a/net/ipv4/netfilter/ip_tables.c
-+++ b/net/ipv4/netfilter/ip_tables.c
-@@ -1751,6 +1751,9 @@ translate_compat_table(struct net *net,
- 		if (ret != 0)
- 			break;
- 		++i;
-+		if (strcmp(ipt_get_target(iter1)->u.user.name,
-+		    XT_ERROR_TARGET) == 0)
-+			++newinfo->stacksize;
- 	}
- 	if (ret) {
- 		/*
-diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
-index 29a7bca..8e754be 100644
---- a/net/ipv6/netfilter/ip6_tables.c
-+++ b/net/ipv6/netfilter/ip6_tables.c
-@@ -1766,6 +1766,9 @@ translate_compat_table(struct net *net,
- 		if (ret != 0)
- 			break;
- 		++i;
-+		if (strcmp(ip6t_get_target(iter1)->u.user.name,
-+		    XT_ERROR_TARGET) == 0)
-+			++newinfo->stacksize;
- 	}
- 	if (ret) {
- 		/*
diff --git a/debian/patches/bugfix/all/rtl8192su-Clean-up-in-case-of-an-error-in-mo.patch b/debian/patches/bugfix/all/rtl8192su-Clean-up-in-case-of-an-error-in-mo.patch
deleted file mode 100644
index 395ed836b..000000000
--- a/debian/patches/bugfix/all/rtl8192su-Clean-up-in-case-of-an-error-in-mo.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Tue, 25 May 2010 04:20:30 +0100
-Subject: [PATCH] Staging: rtl8192su: Clean up in case of an error in module initialisation
-
-commit 9a3dfa0555130952517b9a9c3918729495aa709a upstream.
-
-Currently various resources may be leaked in case of an error.
-
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
----
- drivers/staging/rtl8192su/r8192U_core.c |   43 ++++++++++++++++++++++++++-----
- 1 files changed, 36 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
-index 447d647..1b4ff90 100644
---- a/drivers/staging/rtl8192su/r8192U_core.c
-+++ b/drivers/staging/rtl8192su/r8192U_core.c
-@@ -990,10 +990,11 @@ static int proc_get_stats_rx(char *page, char **start,
- 	return len;
- }
- 
--void rtl8192_proc_module_init(void)
-+int rtl8192_proc_module_init(void)
- {
- 	RT_TRACE(COMP_INIT, "Initializing proc filesystem");
- 	rtl8192_proc=create_proc_entry(RTL819xU_MODULE_NAME, S_IFDIR, init_net.proc_net);
-+	return rtl8192_proc ? 0 : -ENOMEM;
- }
- 
- 
-@@ -7473,35 +7474,63 @@ static int __init rtl8192_usb_module_init(void)
- 	ret = ieee80211_crypto_init();
- 	if (ret) {
- 		printk(KERN_ERR "ieee80211_crypto_init() failed %d\n", ret);
--		return ret;
-+		goto fail_crypto;
- 	}
- 
- 	ret = ieee80211_crypto_tkip_init();
- 	if (ret) {
- 		printk(KERN_ERR "ieee80211_crypto_tkip_init() failed %d\n",
- 			ret);
--		return ret;
-+		goto fail_crypto_tkip;
- 	}
- 
- 	ret = ieee80211_crypto_ccmp_init();
- 	if (ret) {
- 		printk(KERN_ERR "ieee80211_crypto_ccmp_init() failed %d\n",
- 			ret);
--		return ret;
-+		goto fail_crypto_ccmp;
- 	}
- 
- 	ret = ieee80211_crypto_wep_init();
- 	if (ret) {
- 		printk(KERN_ERR "ieee80211_crypto_wep_init() failed %d\n", ret);
--		return ret;
-+		goto fail_crypto_wep;
- 	}
- 
- 	printk(KERN_INFO "\nLinux kernel driver for RTL8192 based WLAN cards\n");
- 	printk(KERN_INFO "Copyright (c) 2007-2008, Realsil Wlan\n");
- 	RT_TRACE(COMP_INIT, "Initializing module");
- 	RT_TRACE(COMP_INIT, "Wireless extensions version %d", WIRELESS_EXT);
--	rtl8192_proc_module_init();
--	return usb_register(&rtl8192_usb_driver);
-+
-+	ret = rtl8192_proc_module_init();
-+	if (ret) {
-+		pr_err("rtl8192_proc_module_init() failed %d\n", ret);
-+		goto fail_proc;
-+	}
-+
-+	ret = usb_register(&rtl8192_usb_driver);
-+	if (ret) {
-+		pr_err("usb_register() failed %d\n", ret);
-+		goto fail_usb;
-+	}
-+
-+	return 0;
-+
-+fail_usb:
-+	rtl8192_proc_module_remove();
-+fail_proc:
-+	ieee80211_crypto_wep_exit();
-+fail_crypto_wep:
-+	ieee80211_crypto_ccmp_exit();
-+fail_crypto_ccmp:
-+	ieee80211_crypto_tkip_exit();
-+fail_crypto_tkip:
-+	ieee80211_crypto_deinit();
-+fail_crypto:
-+#ifdef CONFIG_IEEE80211_DEBUG
-+	ieee80211_debug_exit();
-+#endif
-+	return ret;
- }
- 
- 
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/rtl8192su-Fix-procfs-code-for-interfaces-not.patch b/debian/patches/bugfix/all/rtl8192su-Fix-procfs-code-for-interfaces-not.patch
deleted file mode 100644
index 614200fc2..000000000
--- a/debian/patches/bugfix/all/rtl8192su-Fix-procfs-code-for-interfaces-not.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Tue, 25 May 2010 04:25:57 +0100
-Subject: [PATCH] Staging: rtl8192su: Fix procfs code for interfaces not named wlan0
-
-commit 41a38d9e632f7c9ec5ad8fc627567d97f4302c4a upstream.
-
-The current code creates directories in procfs named after interfaces,
-but doesn't handle renaming.  This can result in name collisions and
-consequent WARNINGs.  It also means that the interface name cannot
-reliably be used to remove the directory - in fact the current code
-doesn't even try, and always uses "wlan0"!
-
-Since the name of a proc_dir_entry is embedded in it, use that when
-removing it.
-
-Add a netdev notifier to catch interface renaming, and remove and
-re-add the directory at this point.
-
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
----
- drivers/staging/rtl8192su/r8192U_core.c |   35 ++++++++++++++++++++++++++++--
- 1 files changed, 32 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
-index 1b4ff90..a076f56 100644
---- a/drivers/staging/rtl8192su/r8192U_core.c
-+++ b/drivers/staging/rtl8192su/r8192U_core.c
-@@ -27,6 +27,7 @@
- #include <linux/vmalloc.h>
- #include <linux/slab.h>
- #include <linux/eeprom_93cx6.h>
-+#include <linux/notifier.h>
- 
- #undef LOOP_TEST
- #undef DUMP_RX
-@@ -161,6 +162,8 @@ MODULE_PARM_DESC(channels," Channel bitmask for specific locales. NYI");
- static int __devinit rtl8192_usb_probe(struct usb_interface *intf,
- 			 const struct usb_device_id *id);
- static void __devexit rtl8192_usb_disconnect(struct usb_interface *intf);
-+static const struct net_device_ops rtl8192_netdev_ops;
-+static struct notifier_block proc_netdev_notifier;
- 
- static struct usb_driver rtl8192_usb_driver = {
- 	.name		= RTL819xU_MODULE_NAME,	          /* Driver name   */
-@@ -992,14 +995,22 @@ static int proc_get_stats_rx(char *page, char **start,
- 
- int rtl8192_proc_module_init(void)
- {
-+	int ret;
-+
- 	RT_TRACE(COMP_INIT, "Initializing proc filesystem");
- 	rtl8192_proc=create_proc_entry(RTL819xU_MODULE_NAME, S_IFDIR, init_net.proc_net);
--	return rtl8192_proc ? 0 : -ENOMEM;
-+	if (!rtl8192_proc)
-+		return -ENOMEM;
-+	ret = register_netdevice_notifier(&proc_netdev_notifier);
-+	if (ret)
-+		remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net);
-+	return ret;
- }
- 
- 
- void rtl8192_proc_module_remove(void)
- {
-+	unregister_netdevice_notifier(&proc_netdev_notifier);
- 	remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net);
- }
- 
-@@ -1027,8 +1038,7 @@ void rtl8192_proc_remove_one(struct net_device *dev)
- 		remove_proc_entry("registers-e", priv->dir_dev);
- 	//	remove_proc_entry("cck-registers",priv->dir_dev);
- 	//	remove_proc_entry("ofdm-registers",priv->dir_dev);
--		//remove_proc_entry(dev->name, rtl8192_proc);
--		remove_proc_entry("wlan0", rtl8192_proc);
-+		remove_proc_entry(priv->dir_dev->name, rtl8192_proc);
- 		priv->dir_dev = NULL;
- 	}
- }
-@@ -1145,6 +1155,25 @@ void rtl8192_proc_init_one(struct net_device *dev)
- 		      dev->name);
- 	}
- }
-+
-+static int proc_netdev_event(struct notifier_block *this,
-+			     unsigned long event, void *ptr)
-+{
-+	struct net_device *net_dev = ptr;
-+
-+	if (net_dev->netdev_ops == &rtl8192_netdev_ops &&
-+	    event == NETDEV_CHANGENAME) {
-+		rtl8192_proc_remove_one(net_dev);
-+		rtl8192_proc_init_one(net_dev);
-+	}
-+
-+	return NOTIFY_DONE;
-+}
-+
-+static struct notifier_block proc_netdev_notifier = {
-+	.notifier_call = proc_netdev_event,
-+};
-+
- /****************************************************************************
-    -----------------------------MISC STUFF-------------------------
- *****************************************************************************/
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/all/stable/2.6.35.1.patch b/debian/patches/bugfix/all/stable/2.6.35.1.patch
deleted file mode 100644
index fbe76b15d..000000000
--- a/debian/patches/bugfix/all/stable/2.6.35.1.patch
+++ /dev/null
@@ -1,1617 +0,0 @@
-diff --git a/arch/arm/plat-mxc/gpio.c b/arch/arm/plat-mxc/gpio.c
-index 71437c6..9ebbd31 100644
---- a/arch/arm/plat-mxc/gpio.c
-+++ b/arch/arm/plat-mxc/gpio.c
-@@ -214,13 +214,16 @@ static void _set_gpio_direction(struct gpio_chip *chip, unsigned offset,
- 	struct mxc_gpio_port *port =
- 		container_of(chip, struct mxc_gpio_port, chip);
- 	u32 l;
-+	unsigned long flags;
- 
-+	spin_lock_irqsave(&port->lock, flags);
- 	l = __raw_readl(port->base + GPIO_GDIR);
- 	if (dir)
- 		l |= 1 << offset;
- 	else
- 		l &= ~(1 << offset);
- 	__raw_writel(l, port->base + GPIO_GDIR);
-+	spin_unlock_irqrestore(&port->lock, flags);
- }
- 
- static void mxc_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
-@@ -229,9 +232,12 @@ static void mxc_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
- 		container_of(chip, struct mxc_gpio_port, chip);
- 	void __iomem *reg = port->base + GPIO_DR;
- 	u32 l;
-+	unsigned long flags;
- 
-+	spin_lock_irqsave(&port->lock, flags);
- 	l = (__raw_readl(reg) & (~(1 << offset))) | (value << offset);
- 	__raw_writel(l, reg);
-+	spin_unlock_irqrestore(&port->lock, flags);
- }
- 
- static int mxc_gpio_get(struct gpio_chip *chip, unsigned offset)
-@@ -285,6 +291,8 @@ int __init mxc_gpio_init(struct mxc_gpio_port *port, int cnt)
- 		port[i].chip.base = i * 32;
- 		port[i].chip.ngpio = 32;
- 
-+		spin_lock_init(&port[i].lock);
-+
- 		/* its a serious configuration bug when it fails */
- 		BUG_ON( gpiochip_add(&port[i].chip) < 0 );
- 
-diff --git a/arch/arm/plat-mxc/include/mach/gpio.h b/arch/arm/plat-mxc/include/mach/gpio.h
-index 894d2f8..6bd932c 100644
---- a/arch/arm/plat-mxc/include/mach/gpio.h
-+++ b/arch/arm/plat-mxc/include/mach/gpio.h
-@@ -36,6 +36,7 @@ struct mxc_gpio_port {
- 	int virtual_irq_start;
- 	struct gpio_chip chip;
- 	u32 both_edges;
-+	spinlock_t lock;
- };
- 
- int mxc_gpio_init(struct mxc_gpio_port*, int);
-diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
-index 4c247e0..df971fa 100644
---- a/arch/parisc/kernel/firmware.c
-+++ b/arch/parisc/kernel/firmware.c
-@@ -1123,7 +1123,6 @@ static char __attribute__((aligned(64))) iodc_dbuf[4096];
-  */
- int pdc_iodc_print(const unsigned char *str, unsigned count)
- {
--	static int posx;        /* for simple TAB-Simulation... */
- 	unsigned int i;
- 	unsigned long flags;
- 
-@@ -1133,19 +1132,12 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
- 			iodc_dbuf[i+0] = '\r';
- 			iodc_dbuf[i+1] = '\n';
- 			i += 2;
--			posx = 0;
- 			goto print;
--		case '\t':
--			while (posx & 7) {
--				iodc_dbuf[i] = ' ';
--				i++, posx++;
--			}
--			break;
- 		case '\b':	/* BS */
--			posx -= 2;
-+			i--; /* overwrite last */
- 		default:
- 			iodc_dbuf[i] = str[i];
--			i++, posx++;
-+			i++;
- 			break;
- 		}
- 	}
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 65d8d79..27dff06 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -927,7 +927,7 @@ static const struct pv_init_ops xen_init_ops __initdata = {
- };
- 
- static const struct pv_time_ops xen_time_ops __initdata = {
--	.sched_clock = xen_sched_clock,
-+	.sched_clock = xen_clocksource_read,
- };
- 
- static const struct pv_cpu_ops xen_cpu_ops __initdata = {
-diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
-index b3c6c59..a86df42 100644
---- a/arch/x86/xen/time.c
-+++ b/arch/x86/xen/time.c
-@@ -155,45 +155,6 @@ static void do_stolen_accounting(void)
- 	account_idle_ticks(ticks);
- }
- 
--/*
-- * Xen sched_clock implementation.  Returns the number of unstolen
-- * nanoseconds, which is nanoseconds the VCPU spent in RUNNING+BLOCKED
-- * states.
-- */
--unsigned long long xen_sched_clock(void)
--{
--	struct vcpu_runstate_info state;
--	cycle_t now;
--	u64 ret;
--	s64 offset;
--
--	/*
--	 * Ideally sched_clock should be called on a per-cpu basis
--	 * anyway, so preempt should already be disabled, but that's
--	 * not current practice at the moment.
--	 */
--	preempt_disable();
--
--	now = xen_clocksource_read();
--
--	get_runstate_snapshot(&state);
--
--	WARN_ON(state.state != RUNSTATE_running);
--
--	offset = now - state.state_entry_time;
--	if (offset < 0)
--		offset = 0;
--
--	ret = state.time[RUNSTATE_blocked] +
--		state.time[RUNSTATE_running] +
--		offset;
--
--	preempt_enable();
--
--	return ret;
--}
--
--
- /* Get the TSC speed from Xen */
- unsigned long xen_tsc_khz(void)
- {
-diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
-index ac9f798..c20a6c9 100644
---- a/drivers/edac/amd64_edac.c
-+++ b/drivers/edac/amd64_edac.c
-@@ -178,7 +178,7 @@ static int amd64_set_scrub_rate(struct mem_ctl_info *mci, u32 *bandwidth)
- 
- 	default:
- 		amd64_printk(KERN_ERR, "Unsupported family!\n");
--		break;
-+		return -EINVAL;
- 	}
- 	return amd64_search_set_scrub_rate(pvt->misc_f3_ctl, *bandwidth,
- 			min_scrubrate);
-@@ -1430,7 +1430,7 @@ static inline u64 f10_get_base_addr_offset(u64 sys_addr, int hi_range_sel,
- 	u64 chan_off;
- 
- 	if (hi_range_sel) {
--		if (!(dct_sel_base_addr & 0xFFFFF800) &&
-+		if (!(dct_sel_base_addr & 0xFFFF0000) &&
- 		   hole_valid && (sys_addr >= 0x100000000ULL))
- 			chan_off = hole_off << 16;
- 		else
-@@ -1679,7 +1679,7 @@ static void f10_map_sysaddr_to_csrow(struct mem_ctl_info *mci,
- 	 * ganged. Otherwise @chan should already contain the channel at
- 	 * this point.
- 	 */
--	if (dct_ganging_enabled(pvt) && pvt->nbcfg & K8_NBCFG_CHIPKILL)
-+	if (dct_ganging_enabled(pvt) && (pvt->nbcfg & K8_NBCFG_CHIPKILL))
- 		chan = get_channel_from_ecc_syndrome(mci, syndrome);
- 
- 	if (chan >= 0)
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 5e21b31..8a84306 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -42,6 +42,7 @@
- bool intel_pipe_has_type (struct drm_crtc *crtc, int type);
- static void intel_update_watermarks(struct drm_device *dev);
- static void intel_increase_pllclock(struct drm_crtc *crtc, bool schedule);
-+static void intel_crtc_update_cursor(struct drm_crtc *crtc);
- 
- typedef struct {
-     /* given values */
-@@ -3403,6 +3404,9 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 		return -EINVAL;
- 	}
- 
-+	/* Ensure that the cursor is valid for the new mode before changing... */
-+	intel_crtc_update_cursor(crtc);
-+
- 	if (is_lvds && dev_priv->lvds_downclock_avail) {
- 		has_reduced_clock = limit->find_pll(limit, crtc,
- 							    dev_priv->lvds_downclock,
-@@ -3939,6 +3943,85 @@ void intel_crtc_load_lut(struct drm_crtc *crtc)
- 	}
- }
- 
-+/* If no-part of the cursor is visible on the framebuffer, then the GPU may hang... */
-+static void intel_crtc_update_cursor(struct drm_crtc *crtc)
-+{
-+	struct drm_device *dev = crtc->dev;
-+	struct drm_i915_private *dev_priv = dev->dev_private;
-+	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-+	int pipe = intel_crtc->pipe;
-+	int x = intel_crtc->cursor_x;
-+	int y = intel_crtc->cursor_y;
-+	uint32_t base, pos;
-+	bool visible;
-+
-+	pos = 0;
-+
-+	if (crtc->fb) {
-+		base = intel_crtc->cursor_addr;
-+		if (x > (int) crtc->fb->width)
-+			base = 0;
-+
-+		if (y > (int) crtc->fb->height)
-+			base = 0;
-+	} else
-+		base = 0;
-+
-+	if (x < 0) {
-+		if (x + intel_crtc->cursor_width < 0)
-+			base = 0;
-+
-+		pos |= CURSOR_POS_SIGN << CURSOR_X_SHIFT;
-+		x = -x;
-+	}
-+	pos |= x << CURSOR_X_SHIFT;
-+
-+	if (y < 0) {
-+		if (y + intel_crtc->cursor_height < 0)
-+			base = 0;
-+
-+		pos |= CURSOR_POS_SIGN << CURSOR_Y_SHIFT;
-+		y = -y;
-+	}
-+	pos |= y << CURSOR_Y_SHIFT;
-+
-+	visible = base != 0;
-+	if (!visible && !intel_crtc->cursor_visble)
-+		return;
-+
-+	I915_WRITE(pipe == 0 ? CURAPOS : CURBPOS, pos);
-+	if (intel_crtc->cursor_visble != visible) {
-+		uint32_t cntl = I915_READ(pipe == 0 ? CURACNTR : CURBCNTR);
-+		if (base) {
-+			/* Hooray for CUR*CNTR differences */
-+			if (IS_MOBILE(dev) || IS_I9XX(dev)) {
-+				cntl &= ~(CURSOR_MODE | MCURSOR_PIPE_SELECT);
-+				cntl |= CURSOR_MODE_64_ARGB_AX | MCURSOR_GAMMA_ENABLE;
-+				cntl |= pipe << 28; /* Connect to correct pipe */
-+			} else {
-+				cntl &= ~(CURSOR_FORMAT_MASK);
-+				cntl |= CURSOR_ENABLE;
-+				cntl |= CURSOR_FORMAT_ARGB | CURSOR_GAMMA_ENABLE;
-+			}
-+		} else {
-+			if (IS_MOBILE(dev) || IS_I9XX(dev)) {
-+				cntl &= ~(CURSOR_MODE | MCURSOR_GAMMA_ENABLE);
-+				cntl |= CURSOR_MODE_DISABLE;
-+			} else {
-+				cntl &= ~(CURSOR_ENABLE | CURSOR_GAMMA_ENABLE);
-+			}
-+		}
-+		I915_WRITE(pipe == 0 ? CURACNTR : CURBCNTR, cntl);
-+
-+		intel_crtc->cursor_visble = visible;
-+	}
-+	/* and commit changes on next vblank */
-+	I915_WRITE(pipe == 0 ? CURABASE : CURBBASE, base);
-+
-+	if (visible)
-+		intel_mark_busy(dev, to_intel_framebuffer(crtc->fb)->obj);
-+}
-+
- static int intel_crtc_cursor_set(struct drm_crtc *crtc,
- 				 struct drm_file *file_priv,
- 				 uint32_t handle,
-@@ -3949,11 +4032,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
- 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
- 	struct drm_gem_object *bo;
- 	struct drm_i915_gem_object *obj_priv;
--	int pipe = intel_crtc->pipe;
--	uint32_t control = (pipe == 0) ? CURACNTR : CURBCNTR;
--	uint32_t base = (pipe == 0) ? CURABASE : CURBBASE;
--	uint32_t temp = I915_READ(control);
--	size_t addr;
-+	uint32_t addr;
- 	int ret;
- 
- 	DRM_DEBUG_KMS("\n");
-@@ -3961,12 +4040,6 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
- 	/* if we want to turn off the cursor ignore width and height */
- 	if (!handle) {
- 		DRM_DEBUG_KMS("cursor off\n");
--		if (IS_MOBILE(dev) || IS_I9XX(dev)) {
--			temp &= ~(CURSOR_MODE | MCURSOR_GAMMA_ENABLE);
--			temp |= CURSOR_MODE_DISABLE;
--		} else {
--			temp &= ~(CURSOR_ENABLE | CURSOR_GAMMA_ENABLE);
--		}
- 		addr = 0;
- 		bo = NULL;
- 		mutex_lock(&dev->struct_mutex);
-@@ -4008,7 +4081,8 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
- 
- 		addr = obj_priv->gtt_offset;
- 	} else {
--		ret = i915_gem_attach_phys_object(dev, bo, (pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1);
-+		ret = i915_gem_attach_phys_object(dev, bo,
-+						  (intel_crtc->pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1);
- 		if (ret) {
- 			DRM_ERROR("failed to attach phys object\n");
- 			goto fail_locked;
-@@ -4019,21 +4093,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
- 	if (!IS_I9XX(dev))
- 		I915_WRITE(CURSIZE, (height << 12) | width);
- 
--	/* Hooray for CUR*CNTR differences */
--	if (IS_MOBILE(dev) || IS_I9XX(dev)) {
--		temp &= ~(CURSOR_MODE | MCURSOR_PIPE_SELECT);
--		temp |= CURSOR_MODE_64_ARGB_AX | MCURSOR_GAMMA_ENABLE;
--		temp |= (pipe << 28); /* Connect to correct pipe */
--	} else {
--		temp &= ~(CURSOR_FORMAT_MASK);
--		temp |= CURSOR_ENABLE;
--		temp |= CURSOR_FORMAT_ARGB | CURSOR_GAMMA_ENABLE;
--	}
--
-  finish:
--	I915_WRITE(control, temp);
--	I915_WRITE(base, addr);
--
- 	if (intel_crtc->cursor_bo) {
- 		if (dev_priv->info->cursor_needs_physical) {
- 			if (intel_crtc->cursor_bo != bo)
-@@ -4047,6 +4107,10 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
- 
- 	intel_crtc->cursor_addr = addr;
- 	intel_crtc->cursor_bo = bo;
-+	intel_crtc->cursor_width = width;
-+	intel_crtc->cursor_height = height;
-+
-+	intel_crtc_update_cursor(crtc);
- 
- 	return 0;
- fail_unpin:
-@@ -4060,34 +4124,12 @@ fail:
- 
- static int intel_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
- {
--	struct drm_device *dev = crtc->dev;
--	struct drm_i915_private *dev_priv = dev->dev_private;
- 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
--	struct intel_framebuffer *intel_fb;
--	int pipe = intel_crtc->pipe;
--	uint32_t temp = 0;
--	uint32_t adder;
--
--	if (crtc->fb) {
--		intel_fb = to_intel_framebuffer(crtc->fb);
--		intel_mark_busy(dev, intel_fb->obj);
--	}
--
--	if (x < 0) {
--		temp |= CURSOR_POS_SIGN << CURSOR_X_SHIFT;
--		x = -x;
--	}
--	if (y < 0) {
--		temp |= CURSOR_POS_SIGN << CURSOR_Y_SHIFT;
--		y = -y;
--	}
- 
--	temp |= x << CURSOR_X_SHIFT;
--	temp |= y << CURSOR_Y_SHIFT;
-+	intel_crtc->cursor_x = x;
-+	intel_crtc->cursor_y = y;
- 
--	adder = intel_crtc->cursor_addr;
--	I915_WRITE((pipe == 0) ? CURAPOS : CURBPOS, temp);
--	I915_WRITE((pipe == 0) ? CURABASE : CURBBASE, adder);
-+	intel_crtc_update_cursor(crtc);
- 
- 	return 0;
- }
-diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
-index 2f7970b..2702652 100644
---- a/drivers/gpu/drm/i915/intel_drv.h
-+++ b/drivers/gpu/drm/i915/intel_drv.h
-@@ -143,8 +143,6 @@ struct intel_crtc {
- 	struct drm_crtc base;
- 	enum pipe pipe;
- 	enum plane plane;
--	struct drm_gem_object *cursor_bo;
--	uint32_t cursor_addr;
- 	u8 lut_r[256], lut_g[256], lut_b[256];
- 	int dpms_mode;
- 	bool busy; /* is scanout buffer being updated frequently? */
-@@ -153,6 +151,12 @@ struct intel_crtc {
- 	struct intel_overlay *overlay;
- 	struct intel_unpin_work *unpin_work;
- 	int fdi_lanes;
-+
-+	struct drm_gem_object *cursor_bo;
-+	uint32_t cursor_addr;
-+	int16_t cursor_x, cursor_y;
-+	int16_t cursor_width, cursor_height;
-+	bool cursor_visble;
- };
- 
- #define to_intel_crtc(x) container_of(x, struct intel_crtc, base)
-diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
-index d7ad513..fe05ba2 100644
---- a/drivers/gpu/drm/i915/intel_overlay.c
-+++ b/drivers/gpu/drm/i915/intel_overlay.c
-@@ -958,7 +958,7 @@ static int check_overlay_src(struct drm_device *dev,
- 	    || rec->src_width < N_HORIZ_Y_TAPS*4)
- 		return -EINVAL;
- 
--	/* check alingment constrains */
-+	/* check alignment constraints */
- 	switch (rec->flags & I915_OVERLAY_TYPE_MASK) {
- 		case I915_OVERLAY_RGB:
- 			/* not implemented */
-@@ -990,7 +990,10 @@ static int check_overlay_src(struct drm_device *dev,
- 		return -EINVAL;
- 
- 	/* stride checking */
--	stride_mask = 63;
-+	if (IS_I830(dev) || IS_845G(dev))
-+		stride_mask = 255;
-+	else
-+		stride_mask = 63;
- 
- 	if (rec->stride_Y & stride_mask || rec->stride_UV & stride_mask)
- 		return -EINVAL;
-diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index e100f69..bb3de01 100644
---- a/drivers/gpu/drm/radeon/r600.c
-+++ b/drivers/gpu/drm/radeon/r600.c
-@@ -869,7 +869,17 @@ void r600_pcie_gart_tlb_flush(struct radeon_device *rdev)
- 	u32 tmp;
- 
- 	/* flush hdp cache so updates hit vram */
--	WREG32(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0x1);
-+	if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740)) {
-+		void __iomem *ptr = (void *)rdev->gart.table.vram.ptr;
-+		u32 tmp;
-+
-+		/* r7xx hw bug.  write to HDP_DEBUG1 followed by fb read
-+		 * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
-+		 */
-+		WREG32(HDP_DEBUG1, 0);
-+		tmp = readl((void __iomem *)ptr);
-+	} else
-+		WREG32(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0x1);
- 
- 	WREG32(VM_CONTEXT0_INVALIDATION_LOW_ADDR, rdev->mc.gtt_start >> 12);
- 	WREG32(VM_CONTEXT0_INVALIDATION_HIGH_ADDR, (rdev->mc.gtt_end - 1) >> 12);
-@@ -3512,5 +3522,15 @@ int r600_debugfs_mc_info_init(struct radeon_device *rdev)
-  */
- void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
- {
--	WREG32(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0x1);
-+	/* r7xx hw bug.  write to HDP_DEBUG1 followed by fb read
-+	 * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
-+	 */
-+	if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740)) {
-+		void __iomem *ptr = (void *)rdev->gart.table.vram.ptr;
-+		u32 tmp;
-+
-+		WREG32(HDP_DEBUG1, 0);
-+		tmp = readl((void __iomem *)ptr);
-+	} else
-+		WREG32(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0x1);
- }
-diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
-index 59c1f87..84bc28e 100644
---- a/drivers/gpu/drm/radeon/r600d.h
-+++ b/drivers/gpu/drm/radeon/r600d.h
-@@ -245,6 +245,7 @@
- #define	HDP_NONSURFACE_SIZE				0x2C0C
- #define HDP_REG_COHERENCY_FLUSH_CNTL			0x54A0
- #define	HDP_TILING_CONFIG				0x2F3C
-+#define HDP_DEBUG1                                      0x2F34
- 
- #define MC_VM_AGP_TOP					0x2184
- #define MC_VM_AGP_BOT					0x2188
-diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
-index d5b9373..d33b6c9 100644
---- a/drivers/gpu/drm/radeon/radeon_object.c
-+++ b/drivers/gpu/drm/radeon/radeon_object.c
-@@ -110,6 +110,7 @@ int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj,
- 	bo->surface_reg = -1;
- 	INIT_LIST_HEAD(&bo->list);
- 
-+retry:
- 	radeon_ttm_placement_from_domain(bo, domain);
- 	/* Kernel allocation are uninterruptible */
- 	mutex_lock(&rdev->vram_mutex);
-@@ -118,10 +119,15 @@ int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj,
- 			&radeon_ttm_bo_destroy);
- 	mutex_unlock(&rdev->vram_mutex);
- 	if (unlikely(r != 0)) {
--		if (r != -ERESTARTSYS)
-+		if (r != -ERESTARTSYS) {
-+			if (domain == RADEON_GEM_DOMAIN_VRAM) {
-+				domain |= RADEON_GEM_DOMAIN_GTT;
-+				goto retry;
-+			}
- 			dev_err(rdev->dev,
- 				"object_init failed for (%lu, 0x%08X)\n",
- 				size, domain);
-+		}
- 		return r;
- 	}
- 	*bo_ptr = bo;
-@@ -321,6 +327,7 @@ int radeon_bo_list_validate(struct list_head *head)
- {
- 	struct radeon_bo_list *lobj;
- 	struct radeon_bo *bo;
-+	u32 domain;
- 	int r;
- 
- 	list_for_each_entry(lobj, head, list) {
-@@ -333,17 +340,19 @@ int radeon_bo_list_validate(struct list_head *head)
- 	list_for_each_entry(lobj, head, list) {
- 		bo = lobj->bo;
- 		if (!bo->pin_count) {
--			if (lobj->wdomain) {
--				radeon_ttm_placement_from_domain(bo,
--								lobj->wdomain);
--			} else {
--				radeon_ttm_placement_from_domain(bo,
--								lobj->rdomain);
--			}
-+			domain = lobj->wdomain ? lobj->wdomain : lobj->rdomain;
-+
-+		retry:
-+			radeon_ttm_placement_from_domain(bo, domain);
- 			r = ttm_bo_validate(&bo->tbo, &bo->placement,
- 						true, false, false);
--			if (unlikely(r))
-+			if (unlikely(r)) {
-+				if (r != -ERESTARTSYS && domain == RADEON_GEM_DOMAIN_VRAM) {
-+					domain |= RADEON_GEM_DOMAIN_GTT;
-+					goto retry;
-+				}
- 				return r;
-+			}
- 		}
- 		lobj->gpu_offset = radeon_bo_gpu_offset(bo);
- 		lobj->tiling_flags = bo->tiling_flags;
-diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
-index ce4ecbe..76c768b 100644
---- a/drivers/gpu/drm/radeon/rs690.c
-+++ b/drivers/gpu/drm/radeon/rs690.c
-@@ -398,7 +398,9 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
- 	struct drm_display_mode *mode1 = NULL;
- 	struct rs690_watermark wm0;
- 	struct rs690_watermark wm1;
--	u32 tmp, d1mode_priority_a_cnt, d2mode_priority_a_cnt;
-+	u32 tmp;
-+	u32 d1mode_priority_a_cnt = S_006548_D1MODE_PRIORITY_A_OFF(1);
-+	u32 d2mode_priority_a_cnt = S_006548_D1MODE_PRIORITY_A_OFF(1);
- 	fixed20_12 priority_mark02, priority_mark12, fill_rate;
- 	fixed20_12 a, b;
- 
-@@ -495,10 +497,6 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
- 			d1mode_priority_a_cnt |= S_006548_D1MODE_PRIORITY_A_ALWAYS_ON(1);
- 			d2mode_priority_a_cnt |= S_006D48_D2MODE_PRIORITY_A_ALWAYS_ON(1);
- 		}
--		WREG32(R_006548_D1MODE_PRIORITY_A_CNT, d1mode_priority_a_cnt);
--		WREG32(R_00654C_D1MODE_PRIORITY_B_CNT, d1mode_priority_a_cnt);
--		WREG32(R_006D48_D2MODE_PRIORITY_A_CNT, d2mode_priority_a_cnt);
--		WREG32(R_006D4C_D2MODE_PRIORITY_B_CNT, d2mode_priority_a_cnt);
- 	} else if (mode0) {
- 		if (dfixed_trunc(wm0.dbpp) > 64)
- 			a.full = dfixed_mul(wm0.dbpp, wm0.num_line_pair);
-@@ -528,13 +526,7 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
- 		d1mode_priority_a_cnt = dfixed_trunc(priority_mark02);
- 		if (rdev->disp_priority == 2)
- 			d1mode_priority_a_cnt |= S_006548_D1MODE_PRIORITY_A_ALWAYS_ON(1);
--		WREG32(R_006548_D1MODE_PRIORITY_A_CNT, d1mode_priority_a_cnt);
--		WREG32(R_00654C_D1MODE_PRIORITY_B_CNT, d1mode_priority_a_cnt);
--		WREG32(R_006D48_D2MODE_PRIORITY_A_CNT,
--			S_006D48_D2MODE_PRIORITY_A_OFF(1));
--		WREG32(R_006D4C_D2MODE_PRIORITY_B_CNT,
--			S_006D4C_D2MODE_PRIORITY_B_OFF(1));
--	} else {
-+	} else if (mode1) {
- 		if (dfixed_trunc(wm1.dbpp) > 64)
- 			a.full = dfixed_mul(wm1.dbpp, wm1.num_line_pair);
- 		else
-@@ -563,13 +555,12 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
- 		d2mode_priority_a_cnt = dfixed_trunc(priority_mark12);
- 		if (rdev->disp_priority == 2)
- 			d2mode_priority_a_cnt |= S_006D48_D2MODE_PRIORITY_A_ALWAYS_ON(1);
--		WREG32(R_006548_D1MODE_PRIORITY_A_CNT,
--			S_006548_D1MODE_PRIORITY_A_OFF(1));
--		WREG32(R_00654C_D1MODE_PRIORITY_B_CNT,
--			S_00654C_D1MODE_PRIORITY_B_OFF(1));
--		WREG32(R_006D48_D2MODE_PRIORITY_A_CNT, d2mode_priority_a_cnt);
--		WREG32(R_006D4C_D2MODE_PRIORITY_B_CNT, d2mode_priority_a_cnt);
- 	}
-+
-+	WREG32(R_006548_D1MODE_PRIORITY_A_CNT, d1mode_priority_a_cnt);
-+	WREG32(R_00654C_D1MODE_PRIORITY_B_CNT, d1mode_priority_a_cnt);
-+	WREG32(R_006D48_D2MODE_PRIORITY_A_CNT, d2mode_priority_a_cnt);
-+	WREG32(R_006D4C_D2MODE_PRIORITY_B_CNT, d2mode_priority_a_cnt);
- }
- 
- uint32_t rs690_mc_rreg(struct radeon_device *rdev, uint32_t reg)
-diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
-index 0c9c169..7e4fbdb 100644
---- a/drivers/gpu/drm/radeon/rv515.c
-+++ b/drivers/gpu/drm/radeon/rv515.c
-@@ -925,7 +925,9 @@ void rv515_bandwidth_avivo_update(struct radeon_device *rdev)
- 	struct drm_display_mode *mode1 = NULL;
- 	struct rv515_watermark wm0;
- 	struct rv515_watermark wm1;
--	u32 tmp, d1mode_priority_a_cnt, d2mode_priority_a_cnt;
-+	u32 tmp;
-+	u32 d1mode_priority_a_cnt = MODE_PRIORITY_OFF;
-+	u32 d2mode_priority_a_cnt = MODE_PRIORITY_OFF;
- 	fixed20_12 priority_mark02, priority_mark12, fill_rate;
- 	fixed20_12 a, b;
- 
-@@ -999,10 +1001,6 @@ void rv515_bandwidth_avivo_update(struct radeon_device *rdev)
- 			d1mode_priority_a_cnt |= MODE_PRIORITY_ALWAYS_ON;
- 			d2mode_priority_a_cnt |= MODE_PRIORITY_ALWAYS_ON;
- 		}
--		WREG32(D1MODE_PRIORITY_A_CNT, d1mode_priority_a_cnt);
--		WREG32(D1MODE_PRIORITY_B_CNT, d1mode_priority_a_cnt);
--		WREG32(D2MODE_PRIORITY_A_CNT, d2mode_priority_a_cnt);
--		WREG32(D2MODE_PRIORITY_B_CNT, d2mode_priority_a_cnt);
- 	} else if (mode0) {
- 		if (dfixed_trunc(wm0.dbpp) > 64)
- 			a.full = dfixed_div(wm0.dbpp, wm0.num_line_pair);
-@@ -1032,11 +1030,7 @@ void rv515_bandwidth_avivo_update(struct radeon_device *rdev)
- 		d1mode_priority_a_cnt = dfixed_trunc(priority_mark02);
- 		if (rdev->disp_priority == 2)
- 			d1mode_priority_a_cnt |= MODE_PRIORITY_ALWAYS_ON;
--		WREG32(D1MODE_PRIORITY_A_CNT, d1mode_priority_a_cnt);
--		WREG32(D1MODE_PRIORITY_B_CNT, d1mode_priority_a_cnt);
--		WREG32(D2MODE_PRIORITY_A_CNT, MODE_PRIORITY_OFF);
--		WREG32(D2MODE_PRIORITY_B_CNT, MODE_PRIORITY_OFF);
--	} else {
-+	} else if (mode1) {
- 		if (dfixed_trunc(wm1.dbpp) > 64)
- 			a.full = dfixed_div(wm1.dbpp, wm1.num_line_pair);
- 		else
-@@ -1065,11 +1059,12 @@ void rv515_bandwidth_avivo_update(struct radeon_device *rdev)
- 		d2mode_priority_a_cnt = dfixed_trunc(priority_mark12);
- 		if (rdev->disp_priority == 2)
- 			d2mode_priority_a_cnt |= MODE_PRIORITY_ALWAYS_ON;
--		WREG32(D1MODE_PRIORITY_A_CNT, MODE_PRIORITY_OFF);
--		WREG32(D1MODE_PRIORITY_B_CNT, MODE_PRIORITY_OFF);
--		WREG32(D2MODE_PRIORITY_A_CNT, d2mode_priority_a_cnt);
--		WREG32(D2MODE_PRIORITY_B_CNT, d2mode_priority_a_cnt);
- 	}
-+
-+	WREG32(D1MODE_PRIORITY_A_CNT, d1mode_priority_a_cnt);
-+	WREG32(D1MODE_PRIORITY_B_CNT, d1mode_priority_a_cnt);
-+	WREG32(D2MODE_PRIORITY_A_CNT, d2mode_priority_a_cnt);
-+	WREG32(D2MODE_PRIORITY_B_CNT, d2mode_priority_a_cnt);
- }
- 
- void rv515_bandwidth_update(struct radeon_device *rdev)
-diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
-index b7fd820..1d6fb79 100644
---- a/drivers/gpu/drm/radeon/rv770.c
-+++ b/drivers/gpu/drm/radeon/rv770.c
-@@ -189,7 +189,10 @@ static void rv770_mc_program(struct radeon_device *rdev)
- 		WREG32((0x2c20 + j), 0x00000000);
- 		WREG32((0x2c24 + j), 0x00000000);
- 	}
--	WREG32(HDP_REG_COHERENCY_FLUSH_CNTL, 0);
-+	/* r7xx hw bug.  Read from HDP_DEBUG1 rather
-+	 * than writing to HDP_REG_COHERENCY_FLUSH_CNTL
-+	 */
-+	tmp = RREG32(HDP_DEBUG1);
- 
- 	rv515_mc_stop(rdev, &save);
- 	if (r600_mc_wait_for_idle(rdev)) {
-diff --git a/drivers/gpu/drm/radeon/rv770d.h b/drivers/gpu/drm/radeon/rv770d.h
-index 9506f8c..6111a02 100644
---- a/drivers/gpu/drm/radeon/rv770d.h
-+++ b/drivers/gpu/drm/radeon/rv770d.h
-@@ -128,6 +128,7 @@
- #define	HDP_NONSURFACE_SIZE				0x2C0C
- #define HDP_REG_COHERENCY_FLUSH_CNTL			0x54A0
- #define	HDP_TILING_CONFIG				0x2F3C
-+#define HDP_DEBUG1                                      0x2F34
- 
- #define MC_SHARED_CHMAP						0x2004
- #define		NOOFCHAN_SHIFT					12
-diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
-index 48c84a5..00e5fcac8 100644
---- a/drivers/misc/enclosure.c
-+++ b/drivers/misc/enclosure.c
-@@ -285,8 +285,11 @@ enclosure_component_register(struct enclosure_device *edev,
- 	cdev->groups = enclosure_groups;
- 
- 	err = device_register(cdev);
--	if (err)
--		ERR_PTR(err);
-+	if (err) {
-+		ecomp->number = -1;
-+		put_device(cdev);
-+		return ERR_PTR(err);
-+	}
- 
- 	return ecomp;
- }
-diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
-index 5d1220d..664ed58 100644
---- a/drivers/net/e1000e/hw.h
-+++ b/drivers/net/e1000e/hw.h
-@@ -308,7 +308,7 @@ enum e1e_registers {
- #define E1000_KMRNCTRLSTA_INBAND_PARAM	0x9    /* Kumeran InBand Parameters */
- #define E1000_KMRNCTRLSTA_DIAG_NELPBK	0x1000 /* Nearend Loopback mode */
- #define E1000_KMRNCTRLSTA_K1_CONFIG	0x7
--#define E1000_KMRNCTRLSTA_K1_ENABLE	0x140E
-+#define E1000_KMRNCTRLSTA_K1_ENABLE	0x0002
- #define E1000_KMRNCTRLSTA_K1_DISABLE	0x1400
- 
- #define IFE_PHY_EXTENDED_STATUS_CONTROL	0x10
-diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
-index 57a7e41..79e38dc 100644
---- a/drivers/net/e1000e/netdev.c
-+++ b/drivers/net/e1000e/netdev.c
-@@ -3419,13 +3419,18 @@ static int e1000_test_msi(struct e1000_adapter *adapter)
- 
- 	/* disable SERR in case the MSI write causes a master abort */
- 	pci_read_config_word(adapter->pdev, PCI_COMMAND, &pci_cmd);
--	pci_write_config_word(adapter->pdev, PCI_COMMAND,
--			      pci_cmd & ~PCI_COMMAND_SERR);
-+	if (pci_cmd & PCI_COMMAND_SERR)
-+		pci_write_config_word(adapter->pdev, PCI_COMMAND,
-+				      pci_cmd & ~PCI_COMMAND_SERR);
- 
- 	err = e1000_test_msi_interrupt(adapter);
- 
--	/* restore previous setting of command word */
--	pci_write_config_word(adapter->pdev, PCI_COMMAND, pci_cmd);
-+	/* re-enable SERR */
-+	if (pci_cmd & PCI_COMMAND_SERR) {
-+		pci_read_config_word(adapter->pdev, PCI_COMMAND, &pci_cmd);
-+		pci_cmd |= PCI_COMMAND_SERR;
-+		pci_write_config_word(adapter->pdev, PCI_COMMAND, pci_cmd);
-+	}
- 
- 	/* success ! */
- 	if (!err)
-diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
-index cea37e0..df2a6d7 100644
---- a/drivers/net/igb/igb_main.c
-+++ b/drivers/net/igb/igb_main.c
-@@ -630,9 +630,6 @@ static void igb_cache_ring_register(struct igb_adapter *adapter)
- 			for (; i < adapter->rss_queues; i++)
- 				adapter->rx_ring[i]->reg_idx = rbase_offset +
- 				                               Q_IDX_82576(i);
--			for (; j < adapter->rss_queues; j++)
--				adapter->tx_ring[j]->reg_idx = rbase_offset +
--				                               Q_IDX_82576(j);
- 		}
- 	case e1000_82575:
- 	case e1000_82580:
-@@ -996,7 +993,10 @@ static void igb_set_interrupt_capability(struct igb_adapter *adapter)
- 
- 	/* Number of supported queues. */
- 	adapter->num_rx_queues = adapter->rss_queues;
--	adapter->num_tx_queues = adapter->rss_queues;
-+	if (adapter->vfs_allocated_count)
-+		adapter->num_tx_queues = 1;
-+	else
-+		adapter->num_tx_queues = adapter->rss_queues;
- 
- 	/* start with one vector for every rx queue */
- 	numvecs = adapter->num_rx_queues;
-diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
-index 5fdbb53..dabafb8 100644
---- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
-@@ -239,7 +239,7 @@ static void ar9002_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
- 			if (qCoff > 15)
- 				qCoff = 15;
- 			else if (qCoff <= -16)
--				qCoff = 16;
-+				qCoff = -16;
- 
- 			ath_print(common, ATH_DBG_CALIBRATE,
- 				  "Chn %d : iCoff = 0x%x  qCoff = 0x%x\n",
-diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-index 23eb60e..cb4e7da 100644
---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-@@ -944,7 +944,7 @@ static u8 ath9k_hw_ar9300_get_num_ant_config(struct ath_hw *ah,
- 	return 1;
- }
- 
--static u16 ath9k_hw_ar9300_get_eeprom_antenna_cfg(struct ath_hw *ah,
-+static u32 ath9k_hw_ar9300_get_eeprom_antenna_cfg(struct ath_hw *ah,
- 						  struct ath9k_channel *chan)
- {
- 	return -EINVAL;
-diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
-index 21354c1..5f01a0f 100644
---- a/drivers/net/wireless/ath/ath9k/eeprom.h
-+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
-@@ -669,7 +669,7 @@ struct eeprom_ops {
- 	int (*get_eeprom_ver)(struct ath_hw *hw);
- 	int (*get_eeprom_rev)(struct ath_hw *hw);
- 	u8 (*get_num_ant_config)(struct ath_hw *hw, enum ieee80211_band band);
--	u16 (*get_eeprom_antenna_cfg)(struct ath_hw *hw,
-+	u32 (*get_eeprom_antenna_cfg)(struct ath_hw *hw,
- 				      struct ath9k_channel *chan);
- 	void (*set_board_values)(struct ath_hw *hw, struct ath9k_channel *chan);
- 	void (*set_addac)(struct ath_hw *hw, struct ath9k_channel *chan);
-diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
-index 41a77d1..1576bbb 100644
---- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
-+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
-@@ -1149,13 +1149,13 @@ static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
- 	}
- }
- 
--static u16 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah,
-+static u32 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah,
- 					      struct ath9k_channel *chan)
- {
- 	struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
- 	struct modal_eep_4k_header *pModal = &eep->modalHeader;
- 
--	return pModal->antCtrlCommon & 0xFFFF;
-+	return pModal->antCtrlCommon;
- }
- 
- static u8 ath9k_hw_4k_get_num_ant_config(struct ath_hw *ah,
-diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
-index b471db5..2705eb0 100644
---- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
-+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
-@@ -1131,13 +1131,13 @@ static u8 ath9k_hw_AR9287_get_num_ant_config(struct ath_hw *ah,
- 	return 1;
- }
- 
--static u16 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah,
-+static u32 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah,
- 						  struct ath9k_channel *chan)
- {
- 	struct ar9287_eeprom *eep = &ah->eeprom.map9287;
- 	struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
- 
--	return pModal->antCtrlCommon & 0xFFFF;
-+	return pModal->antCtrlCommon;
- }
- 
- static u16 ath9k_hw_AR9287_get_spur_channel(struct ath_hw *ah,
-diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
-index 7e1ed78..54ce34e 100644
---- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
-+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
-@@ -729,7 +729,7 @@ static void ath9k_hw_get_def_gain_boundaries_pdadcs(struct ath_hw *ah,
- 				    vpdTableI[i][sizeCurrVpdTable - 2]);
- 		vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
- 
--		if (tgtIndex > maxIndex) {
-+		if (tgtIndex >= maxIndex) {
- 			while ((ss <= tgtIndex) &&
- 			       (k < (AR5416_NUM_PDADC_VALUES - 1))) {
- 				tmpVal = (int16_t)((vpdTableI[i][sizeCurrVpdTable - 1] +
-@@ -1437,14 +1437,14 @@ static u8 ath9k_hw_def_get_num_ant_config(struct ath_hw *ah,
- 	return num_ant_config;
- }
- 
--static u16 ath9k_hw_def_get_eeprom_antenna_cfg(struct ath_hw *ah,
-+static u32 ath9k_hw_def_get_eeprom_antenna_cfg(struct ath_hw *ah,
- 					       struct ath9k_channel *chan)
- {
- 	struct ar5416_eeprom_def *eep = &ah->eeprom.def;
- 	struct modal_eep_header *pModal =
- 		&(eep->modalHeader[IS_CHAN_2GHZ(chan)]);
- 
--	return pModal->antCtrlCommon & 0xFFFF;
-+	return pModal->antCtrlCommon;
- }
- 
- static u16 ath9k_hw_def_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
-diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
-index c33f17d..2feee1d 100644
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -537,7 +537,8 @@ static int __ath9k_hw_init(struct ath_hw *ah)
- 
- 	if (ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
- 		if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
--		    (AR_SREV_9280(ah) && !ah->is_pciexpress)) {
-+		    ((AR_SREV_9160(ah) || AR_SREV_9280(ah)) &&
-+		     !ah->is_pciexpress)) {
- 			ah->config.serialize_regmode =
- 				SER_REG_MODE_ON;
- 		} else {
-@@ -1232,9 +1233,11 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
- 
- 	if (!ah->chip_fullsleep) {
- 		ath9k_hw_abortpcurecv(ah);
--		if (!ath9k_hw_stopdmarecv(ah))
-+		if (!ath9k_hw_stopdmarecv(ah)) {
- 			ath_print(common, ATH_DBG_XMIT,
- 				"Failed to stop receive dma\n");
-+			bChannelChange = false;
-+		}
- 	}
- 
- 	if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
-@@ -1265,7 +1268,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
- 	macStaId1 = REG_READ(ah, AR_STA_ID1) & AR_STA_ID1_BASE_RATE_11B;
- 
- 	/* For chips on which RTC reset is done, save TSF before it gets cleared */
--	if (AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL))
-+	if (AR_SREV_9100(ah) ||
-+	    (AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL)))
- 		tsf = ath9k_hw_gettsf64(ah);
- 
- 	saveLedState = REG_READ(ah, AR_CFG_LED) &
-@@ -1297,7 +1301,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
- 	}
- 
- 	/* Restore TSF */
--	if (tsf && AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL))
-+	if (tsf)
- 		ath9k_hw_settsf64(ah, tsf);
- 
- 	if (AR_SREV_9280_10_OR_LATER(ah))
-@@ -1307,6 +1311,17 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
- 	if (r)
- 		return r;
- 
-+	/*
-+	 * Some AR91xx SoC devices frequently fail to accept TSF writes
-+	 * right after the chip reset. When that happens, write a new
-+	 * value after the initvals have been applied, with an offset
-+	 * based on measured time difference
-+	 */
-+	if (AR_SREV_9100(ah) && (ath9k_hw_gettsf64(ah) < tsf)) {
-+		tsf += 1500;
-+		ath9k_hw_settsf64(ah, tsf);
-+	}
-+
- 	/* Setup MFP options for CCMP */
- 	if (AR_SREV_9280_20_OR_LATER(ah)) {
- 		/* Mask Retry(b11), PwrMgt(b12), MoreData(b13) to 0 in mgmt
-diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
-index 859aa4a..d8dd503 100644
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -328,6 +328,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
- 	u32 ba[WME_BA_BMP_SIZE >> 5];
- 	int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
- 	bool rc_update = true;
-+	struct ieee80211_tx_rate rates[4];
- 
- 	skb = bf->bf_mpdu;
- 	hdr = (struct ieee80211_hdr *)skb->data;
-@@ -335,12 +336,30 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
- 	tx_info = IEEE80211_SKB_CB(skb);
- 	hw = bf->aphy->hw;
- 
-+	memcpy(rates, tx_info->control.rates, sizeof(rates));
-+
- 	rcu_read_lock();
- 
- 	/* XXX: use ieee80211_find_sta! */
- 	sta = ieee80211_find_sta_by_hw(hw, hdr->addr1);
- 	if (!sta) {
- 		rcu_read_unlock();
-+
-+		INIT_LIST_HEAD(&bf_head);
-+		while (bf) {
-+			bf_next = bf->bf_next;
-+
-+			bf->bf_state.bf_type |= BUF_XRETRY;
-+			if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) ||
-+			    !bf->bf_stale || bf_next != NULL)
-+				list_move_tail(&bf->list, &bf_head);
-+
-+			ath_tx_rc_status(bf, ts, 0, 0, false);
-+			ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
-+				0, 0);
-+
-+			bf = bf_next;
-+		}
- 		return;
- 	}
- 
-@@ -375,6 +394,9 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
- 		txfail = txpending = 0;
- 		bf_next = bf->bf_next;
- 
-+		skb = bf->bf_mpdu;
-+		tx_info = IEEE80211_SKB_CB(skb);
-+
- 		if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, bf->bf_seqno))) {
- 			/* transmit completion, subframe is
- 			 * acked by block ack */
-@@ -428,6 +450,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
- 			spin_unlock_bh(&txq->axq_lock);
- 
- 			if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
-+				memcpy(tx_info->control.rates, rates, sizeof(rates));
- 				ath_tx_rc_status(bf, ts, nbad, txok, true);
- 				rc_update = false;
- 			} else {
-@@ -487,6 +510,14 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
- 		bf = bf_next;
- 	}
- 
-+	/* prepend un-acked frames to the beginning of the pending frame queue */
-+	if (!list_empty(&bf_pending)) {
-+		spin_lock_bh(&txq->axq_lock);
-+		list_splice(&bf_pending, &tid->buf_q);
-+		ath_tx_queue_tid(txq, tid);
-+		spin_unlock_bh(&txq->axq_lock);
-+	}
-+
- 	if (tid->state & AGGR_CLEANUP) {
- 		if (tid->baw_head == tid->baw_tail) {
- 			tid->state &= ~AGGR_ADDBA_COMPLETE;
-@@ -499,14 +530,6 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
- 		return;
- 	}
- 
--	/* prepend un-acked frames to the beginning of the pending frame queue */
--	if (!list_empty(&bf_pending)) {
--		spin_lock_bh(&txq->axq_lock);
--		list_splice(&bf_pending, &tid->buf_q);
--		ath_tx_queue_tid(txq, tid);
--		spin_unlock_bh(&txq->axq_lock);
--	}
--
- 	rcu_read_unlock();
- 
- 	if (needreset)
-@@ -2050,7 +2073,7 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
- 		tx_info->status.rates[i].idx = -1;
- 	}
- 
--	tx_info->status.rates[tx_rateindex].count = bf->bf_retries + 1;
-+	tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1;
- }
- 
- static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq)
-@@ -2161,7 +2184,6 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
- 			 * This frame is sent out as a single frame.
- 			 * Use hardware retry status for this frame.
- 			 */
--			bf->bf_retries = ts.ts_longretry;
- 			if (ts.ts_status & ATH9K_TXERR_XRETRY)
- 				bf->bf_state.bf_type |= BUF_XRETRY;
- 			ath_tx_rc_status(bf, &ts, 0, txok, true);
-@@ -2280,7 +2302,6 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
- 		txok = !(txs.ts_status & ATH9K_TXERR_MASK);
- 
- 		if (!bf_isampdu(bf)) {
--			bf->bf_retries = txs.ts_longretry;
- 			if (txs.ts_status & ATH9K_TXERR_XRETRY)
- 				bf->bf_state.bf_type |= BUF_XRETRY;
- 			ath_tx_rc_status(bf, &txs, 0, txok, true);
-@@ -2449,37 +2470,37 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
- 
- void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
- {
--	int i;
--	struct ath_atx_ac *ac, *ac_tmp;
--	struct ath_atx_tid *tid, *tid_tmp;
-+	struct ath_atx_ac *ac;
-+	struct ath_atx_tid *tid;
- 	struct ath_txq *txq;
-+	int i, tidno;
- 
--	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
--		if (ATH_TXQ_SETUP(sc, i)) {
--			txq = &sc->tx.txq[i];
-+	for (tidno = 0, tid = &an->tid[tidno];
-+	     tidno < WME_NUM_TID; tidno++, tid++) {
-+		i = tid->ac->qnum;
- 
--			spin_lock_bh(&txq->axq_lock);
-+		if (!ATH_TXQ_SETUP(sc, i))
-+			continue;
- 
--			list_for_each_entry_safe(ac,
--					ac_tmp, &txq->axq_acq, list) {
--				tid = list_first_entry(&ac->tid_q,
--						struct ath_atx_tid, list);
--				if (tid && tid->an != an)
--					continue;
--				list_del(&ac->list);
--				ac->sched = false;
--
--				list_for_each_entry_safe(tid,
--						tid_tmp, &ac->tid_q, list) {
--					list_del(&tid->list);
--					tid->sched = false;
--					ath_tid_drain(sc, txq, tid);
--					tid->state &= ~AGGR_ADDBA_COMPLETE;
--					tid->state &= ~AGGR_CLEANUP;
--				}
--			}
-+		txq = &sc->tx.txq[i];
-+		ac = tid->ac;
- 
--			spin_unlock_bh(&txq->axq_lock);
-+		spin_lock_bh(&txq->axq_lock);
-+
-+		if (tid->sched) {
-+			list_del(&tid->list);
-+			tid->sched = false;
-+		}
-+
-+		if (ac->sched) {
-+			list_del(&ac->list);
-+			tid->ac->sched = false;
- 		}
-+
-+		ath_tid_drain(sc, txq, tid);
-+		tid->state &= ~AGGR_ADDBA_COMPLETE;
-+		tid->state &= ~AGGR_CLEANUP;
-+
-+		spin_unlock_bh(&txq->axq_lock);
- 	}
- }
-diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
-index 386c5f9..e1af9fd 100644
---- a/drivers/net/wireless/iwlwifi/iwl-scan.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
-@@ -420,11 +420,10 @@ void iwl_bg_scan_check(struct work_struct *data)
- 		return;
- 
- 	mutex_lock(&priv->mutex);
--	if (test_bit(STATUS_SCANNING, &priv->status) ||
--	    test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
--		IWL_DEBUG_SCAN(priv, "Scan completion watchdog resetting "
--			"adapter (%dms)\n",
--			jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
-+	if (test_bit(STATUS_SCANNING, &priv->status) &&
-+	    !test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-+		IWL_DEBUG_SCAN(priv, "Scan completion watchdog (%dms)\n",
-+			       jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
- 
- 		if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
- 			iwl_send_scan_abort(priv);
-@@ -489,12 +488,11 @@ void iwl_bg_abort_scan(struct work_struct *work)
- 	    !test_bit(STATUS_GEO_CONFIGURED, &priv->status))
- 		return;
- 
--	mutex_lock(&priv->mutex);
--
--	cancel_delayed_work_sync(&priv->scan_check);
--	set_bit(STATUS_SCAN_ABORTING, &priv->status);
--	iwl_send_scan_abort(priv);
-+	cancel_delayed_work(&priv->scan_check);
- 
-+	mutex_lock(&priv->mutex);
-+	if (test_bit(STATUS_SCAN_ABORTING, &priv->status))
-+		iwl_send_scan_abort(priv);
- 	mutex_unlock(&priv->mutex);
- }
- EXPORT_SYMBOL(iwl_bg_abort_scan);
-diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
-index d504e2b..b50fedc 100644
---- a/drivers/net/xen-netfront.c
-+++ b/drivers/net/xen-netfront.c
-@@ -1621,6 +1621,7 @@ static void backend_changed(struct xenbus_device *dev,
- 		if (xennet_connect(netdev) != 0)
- 			break;
- 		xenbus_switch_state(dev, XenbusStateConnected);
-+		netif_notify_peers(netdev);
- 		break;
- 
- 	case XenbusStateClosing:
-diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
-index 188bc84..d02be78 100644
---- a/drivers/parisc/led.c
-+++ b/drivers/parisc/led.c
-@@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct file *file, const char *buf,
- 	size_t count, loff_t *pos)
- {
- 	void *data = PDE(file->f_path.dentry->d_inode)->data;
--	char *cur, lbuf[count + 1];
-+	char *cur, lbuf[32];
- 	int d;
- 
- 	if (!capable(CAP_SYS_ADMIN))
- 		return -EACCES;
- 
--	memset(lbuf, 0, count + 1);
-+	if (count >= sizeof(lbuf))
-+		count = sizeof(lbuf)-1;
- 
- 	if (copy_from_user(lbuf, buf, count))
- 		return -EFAULT;
-+	lbuf[count] = 0;
- 
- 	cur = lbuf;
- 
-diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
-index 59ae76b..d9c7e54 100644
---- a/drivers/ssb/driver_chipcommon.c
-+++ b/drivers/ssb/driver_chipcommon.c
-@@ -235,6 +235,7 @@ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
- 		return; /* We don't have a ChipCommon */
- 	if (cc->dev->id.revision >= 11)
- 		cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
-+	ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
- 	ssb_pmu_init(cc);
- 	chipco_powercontrol_init(cc);
- 	ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
-diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
-index 6dcda86..6e88d2b 100644
---- a/drivers/ssb/pci.c
-+++ b/drivers/ssb/pci.c
-@@ -626,11 +626,22 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
- 		return -ENODEV;
- 	}
- 	if (bus->chipco.dev) {	/* can be unavailible! */
--		bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
--			SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
-+		/*
-+		 * get SPROM offset: SSB_SPROM_BASE1 except for
-+		 * chipcommon rev >= 31 or chip ID is 0x4312 and
-+		 * chipcommon status & 3 == 2
-+		 */
-+		if (bus->chipco.dev->id.revision >= 31)
-+			bus->sprom_offset = SSB_SPROM_BASE31;
-+		else if (bus->chip_id == 0x4312 &&
-+			 (bus->chipco.status & 0x03) == 2)
-+			bus->sprom_offset = SSB_SPROM_BASE31;
-+		else
-+			bus->sprom_offset = SSB_SPROM_BASE1;
- 	} else {
- 		bus->sprom_offset = SSB_SPROM_BASE1;
- 	}
-+	ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset);
- 
- 	buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
- 	if (!buf)
-diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 99d6af8..b3171fb 100644
---- a/fs/block_dev.c
-+++ b/fs/block_dev.c
-@@ -681,8 +681,8 @@ retry:
- 	if (!bd_may_claim(bdev, whole, holder))
- 		return -EBUSY;
- 
--	/* if someone else is claiming, wait for it to finish */
--	if (whole->bd_claiming && whole->bd_claiming != holder) {
-+	/* if claiming is already in progress, wait for it to finish */
-+	if (whole->bd_claiming) {
- 		wait_queue_head_t *wq = bit_waitqueue(&whole->bd_claiming, 0);
- 		DEFINE_WAIT(wait);
- 
-diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
-index 2d428b0..3a9940e 100644
---- a/include/drm/drm_pciids.h
-+++ b/include/drm/drm_pciids.h
-@@ -146,6 +146,8 @@
- 	{0x1002, 0x6888, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6889, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x688A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x688C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x688D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6898, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6899, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x689c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HEMLOCK|RADEON_NEW_MEMMAP}, \
-@@ -161,6 +163,7 @@
- 	{0x1002, 0x68be, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68c0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68c1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x68c7, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68c8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68c9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68d8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_NEW_MEMMAP}, \
-@@ -174,6 +177,7 @@
- 	{0x1002, 0x68e8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CEDAR|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68e9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CEDAR|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68f1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CEDAR|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x68f2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CEDAR|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68f8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CEDAR|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68f9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CEDAR|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x68fe, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CEDAR|RADEON_NEW_MEMMAP}, \
-@@ -314,6 +318,7 @@
- 	{0x1002, 0x9456, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x945A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x945B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x945E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9460, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9462, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x946A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-@@ -324,6 +329,7 @@
- 	{0x1002, 0x9487, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9488, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9489, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x948A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x948F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9490, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9491, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-@@ -366,6 +372,7 @@
- 	{0x1002, 0x9553, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9555, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9557, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x955f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9580, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9581, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x9583, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index b21e405..142bf18 100644
---- a/include/linux/netdevice.h
-+++ b/include/linux/netdevice.h
-@@ -1775,6 +1775,8 @@ extern void netif_carrier_on(struct net_device *dev);
- 
- extern void netif_carrier_off(struct net_device *dev);
- 
-+extern void netif_notify_peers(struct net_device *dev);
-+
- /**
-  *	netif_dormant_on - mark device as dormant.
-  *	@dev: network device
-diff --git a/include/linux/notifier.h b/include/linux/notifier.h
-index 540703b..22c2abb 100644
---- a/include/linux/notifier.h
-+++ b/include/linux/notifier.h
-@@ -210,6 +210,7 @@ static inline int notifier_to_errno(int ret)
- #define NETDEV_POST_INIT	0x0010
- #define NETDEV_UNREGISTER_BATCH 0x0011
- #define NETDEV_BONDING_DESLAVE  0x0012
-+#define NETDEV_NOTIFY_PEERS	0x0012
- 
- #define SYS_DOWN	0x0001	/* Notify of system down */
- #define SYS_RESTART	SYS_DOWN
-diff --git a/kernel/signal.c b/kernel/signal.c
-index 906ae5a..bded651 100644
---- a/kernel/signal.c
-+++ b/kernel/signal.c
-@@ -637,7 +637,7 @@ static inline bool si_fromuser(const struct siginfo *info)
- 
- /*
-  * Bad permissions for sending the signal
-- * - the caller must hold at least the RCU read lock
-+ * - the caller must hold the RCU read lock
-  */
- static int check_kill_permission(int sig, struct siginfo *info,
- 				 struct task_struct *t)
-@@ -1127,11 +1127,14 @@ struct sighand_struct *lock_task_sighand(struct task_struct *tsk, unsigned long
- 
- /*
-  * send signal info to all the members of a group
-- * - the caller must hold the RCU read lock at least
-  */
- int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
- {
--	int ret = check_kill_permission(sig, info, p);
-+	int ret;
-+
-+	rcu_read_lock();
-+	ret = check_kill_permission(sig, info, p);
-+	rcu_read_unlock();
- 
- 	if (!ret && sig)
- 		ret = do_send_sig_info(sig, info, p, true);
-diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
-index 98ce9bc..c85109d 100644
---- a/net/9p/trans_fd.c
-+++ b/net/9p/trans_fd.c
-@@ -948,7 +948,7 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
- 
- 	csocket = NULL;
- 
--	if (strlen(addr) > UNIX_PATH_MAX) {
-+	if (strlen(addr) >= UNIX_PATH_MAX) {
- 		P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n",
- 			addr);
- 		return -ENAMETOOLONG;
-diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
-index 382bc76..da14c49 100644
---- a/net/ipv4/devinet.c
-+++ b/net/ipv4/devinet.c
-@@ -1081,6 +1081,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
- 		}
- 		ip_mc_up(in_dev);
- 		/* fall through */
-+	case NETDEV_NOTIFY_PEERS:
- 	case NETDEV_CHANGEADDR:
- 		/* Send gratuitous ARP to notify of link change */
- 		if (IN_DEV_ARP_NOTIFY(in_dev)) {
-diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
-index 3cd5f7b..ea13a80 100644
---- a/net/mac80211/mesh_plink.c
-+++ b/net/mac80211/mesh_plink.c
-@@ -65,7 +65,6 @@ void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
- {
- 	atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
- 	mesh_accept_plinks_update(sdata);
--	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
- }
- 
- static inline
-@@ -73,7 +72,6 @@ void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
- {
- 	atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
- 	mesh_accept_plinks_update(sdata);
--	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
- }
- 
- /**
-@@ -115,7 +113,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
- }
- 
- /**
-- * mesh_plink_deactivate - deactivate mesh peer link
-+ * __mesh_plink_deactivate - deactivate mesh peer link
-  *
-  * @sta: mesh peer link to deactivate
-  *
-@@ -123,18 +121,23 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
-  *
-  * Locking: the caller must hold sta->lock
-  */
--static void __mesh_plink_deactivate(struct sta_info *sta)
-+static bool __mesh_plink_deactivate(struct sta_info *sta)
- {
- 	struct ieee80211_sub_if_data *sdata = sta->sdata;
-+	bool deactivated = false;
- 
--	if (sta->plink_state == PLINK_ESTAB)
-+	if (sta->plink_state == PLINK_ESTAB) {
- 		mesh_plink_dec_estab_count(sdata);
-+		deactivated = true;
-+	}
- 	sta->plink_state = PLINK_BLOCKED;
- 	mesh_path_flush_by_nexthop(sta);
-+
-+	return deactivated;
- }
- 
- /**
-- * __mesh_plink_deactivate - deactivate mesh peer link
-+ * mesh_plink_deactivate - deactivate mesh peer link
-  *
-  * @sta: mesh peer link to deactivate
-  *
-@@ -142,9 +145,15 @@ static void __mesh_plink_deactivate(struct sta_info *sta)
-  */
- void mesh_plink_deactivate(struct sta_info *sta)
- {
-+	struct ieee80211_sub_if_data *sdata = sta->sdata;
-+	bool deactivated;
-+
- 	spin_lock_bh(&sta->lock);
--	__mesh_plink_deactivate(sta);
-+	deactivated = __mesh_plink_deactivate(sta);
- 	spin_unlock_bh(&sta->lock);
-+
-+	if (deactivated)
-+		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
- }
- 
- static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
-@@ -381,10 +390,16 @@ int mesh_plink_open(struct sta_info *sta)
- 
- void mesh_plink_block(struct sta_info *sta)
- {
-+	struct ieee80211_sub_if_data *sdata = sta->sdata;
-+	bool deactivated;
-+
- 	spin_lock_bh(&sta->lock);
--	__mesh_plink_deactivate(sta);
-+	deactivated = __mesh_plink_deactivate(sta);
- 	sta->plink_state = PLINK_BLOCKED;
- 	spin_unlock_bh(&sta->lock);
-+
-+	if (deactivated)
-+		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
- }
- 
- 
-@@ -397,6 +412,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
- 	enum plink_event event;
- 	enum plink_frame_type ftype;
- 	size_t baselen;
-+	bool deactivated;
- 	u8 ie_len;
- 	u8 *baseaddr;
- 	__le16 plid, llid, reason;
-@@ -651,8 +667,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
- 		case CNF_ACPT:
- 			del_timer(&sta->plink_timer);
- 			sta->plink_state = PLINK_ESTAB;
--			mesh_plink_inc_estab_count(sdata);
- 			spin_unlock_bh(&sta->lock);
-+			mesh_plink_inc_estab_count(sdata);
-+			ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
- 			mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
- 				sta->sta.addr);
- 			break;
-@@ -684,8 +701,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
- 		case OPN_ACPT:
- 			del_timer(&sta->plink_timer);
- 			sta->plink_state = PLINK_ESTAB;
--			mesh_plink_inc_estab_count(sdata);
- 			spin_unlock_bh(&sta->lock);
-+			mesh_plink_inc_estab_count(sdata);
-+			ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
- 			mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
- 				sta->sta.addr);
- 			mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
-@@ -702,11 +720,13 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
- 		case CLS_ACPT:
- 			reason = cpu_to_le16(MESH_CLOSE_RCVD);
- 			sta->reason = reason;
--			__mesh_plink_deactivate(sta);
-+			deactivated = __mesh_plink_deactivate(sta);
- 			sta->plink_state = PLINK_HOLDING;
- 			llid = sta->llid;
- 			mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
- 			spin_unlock_bh(&sta->lock);
-+			if (deactivated)
-+				ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
- 			mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
- 					    plid, reason);
- 			break;
-diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
-index a63029e..bd1892f 100644
---- a/net/sched/sch_generic.c
-+++ b/net/sched/sch_generic.c
-@@ -327,6 +327,24 @@ void netif_carrier_off(struct net_device *dev)
- }
- EXPORT_SYMBOL(netif_carrier_off);
- 
-+/**
-+ * 	netif_notify_peers - notify network peers about existence of @dev
-+ * 	@dev: network device
-+ *
-+ * Generate traffic such that interested network peers are aware of
-+ * @dev, such as by generating a gratuitous ARP. This may be used when
-+ * a device wants to inform the rest of the network about some sort of
-+ * reconfiguration such as a failover event or virtual machine
-+ * migration.
-+ */
-+void netif_notify_peers(struct net_device *dev)
-+{
-+	rtnl_lock();
-+	call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev);
-+	rtnl_unlock();
-+}
-+EXPORT_SYMBOL(netif_notify_peers);
-+
- /* "NOOP" scheduler: the best scheduler, recommended for all interfaces
-    under all circumstances. It is difficult to invent anything faster or
-    cheaper.
-diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
-index 48ead6f..ef17fcf 100644
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -44,10 +44,10 @@ void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
- 		}
- 	}
- 
--	WARN_ON(!done);
--
--	nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
--	cfg80211_sme_rx_auth(dev, buf, len);
-+	if (done) {
-+		nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
-+		cfg80211_sme_rx_auth(dev, buf, len);
-+	}
- 
- 	wdev_unlock(wdev);
- }
-diff --git a/net/wireless/scan.c b/net/wireless/scan.c
-index 58401d2..5ca8c71 100644
---- a/net/wireless/scan.c
-+++ b/net/wireless/scan.c
-@@ -275,6 +275,7 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
- {
- 	struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
- 	struct cfg80211_internal_bss *bss, *res = NULL;
-+	unsigned long now = jiffies;
- 
- 	spin_lock_bh(&dev->bss_lock);
- 
-@@ -283,6 +284,10 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
- 			continue;
- 		if (channel && bss->pub.channel != channel)
- 			continue;
-+		/* Don't get expired BSS structs */
-+		if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
-+		    !atomic_read(&bss->hold))
-+			continue;
- 		if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
- 			res = bss;
- 			kref_get(&res->ref);
diff --git a/debian/patches/bugfix/all/stable/2.6.35.2.patch b/debian/patches/bugfix/all/stable/2.6.35.2.patch
deleted file mode 100644
index 9693dc6db..000000000
--- a/debian/patches/bugfix/all/stable/2.6.35.2.patch
+++ /dev/null
@@ -1,2824 +0,0 @@
-diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index 98922f7..4824fb4 100644
---- a/arch/arm/Kconfig
-+++ b/arch/arm/Kconfig
-@@ -1027,6 +1027,18 @@ config PL310_ERRATA_588369
- 	   is not correctly implemented in PL310 as clean lines are not
- 	   invalidated as a result of these operations. Note that this errata
- 	   uses Texas Instrument's secure monitor api.
-+
-+config ARM_ERRATA_720789
-+	bool "ARM errata: TLBIASIDIS and TLBIMVAIS operations can broadcast a faulty ASID"
-+	depends on CPU_V7 && SMP
-+	help
-+	  This option enables the workaround for the 720789 Cortex-A9 (prior to
-+	  r2p0) erratum. A faulty ASID can be sent to the other CPUs for the
-+	  broadcasted CP15 TLB maintenance operations TLBIASIDIS and TLBIMVAIS.
-+	  As a consequence of this erratum, some TLB entries which should be
-+	  invalidated are not, resulting in an incoherency in the system page
-+	  tables. The workaround changes the TLB flushing routines to invalidate
-+	  entries regardless of the ASID.
- endmenu
- 
- source "arch/arm/common/Kconfig"
-diff --git a/arch/arm/include/asm/tlbflush.h b/arch/arm/include/asm/tlbflush.h
-index bd863d8..33b546a 100644
---- a/arch/arm/include/asm/tlbflush.h
-+++ b/arch/arm/include/asm/tlbflush.h
-@@ -378,7 +378,11 @@ static inline void local_flush_tlb_mm(struct mm_struct *mm)
- 	if (tlb_flag(TLB_V6_I_ASID))
- 		asm("mcr p15, 0, %0, c8, c5, 2" : : "r" (asid) : "cc");
- 	if (tlb_flag(TLB_V7_UIS_ASID))
-+#ifdef CONFIG_ARM_ERRATA_720789
-+		asm("mcr p15, 0, %0, c8, c3, 0" : : "r" (zero) : "cc");
-+#else
- 		asm("mcr p15, 0, %0, c8, c3, 2" : : "r" (asid) : "cc");
-+#endif
- 
- 	if (tlb_flag(TLB_BTB)) {
- 		/* flush the branch target cache */
-@@ -424,7 +428,11 @@ local_flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
- 	if (tlb_flag(TLB_V6_I_PAGE))
- 		asm("mcr p15, 0, %0, c8, c5, 1" : : "r" (uaddr) : "cc");
- 	if (tlb_flag(TLB_V7_UIS_PAGE))
-+#ifdef CONFIG_ARM_ERRATA_720789
-+		asm("mcr p15, 0, %0, c8, c3, 3" : : "r" (uaddr & PAGE_MASK) : "cc");
-+#else
- 		asm("mcr p15, 0, %0, c8, c3, 1" : : "r" (uaddr) : "cc");
-+#endif
- 
- 	if (tlb_flag(TLB_BTB)) {
- 		/* flush the branch target cache */
-diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
-index fdda6be..d717b49 100644
---- a/arch/arm/mach-pxa/cm-x300.c
-+++ b/arch/arm/mach-pxa/cm-x300.c
-@@ -745,9 +745,10 @@ static void __init cm_x300_init(void)
- {
- 	cm_x300_init_mfp();
- 
--	pxa_set_ffuart_info(NULL);
- 	pxa_set_btuart_info(NULL);
- 	pxa_set_stuart_info(NULL);
-+	if (cpu_is_pxa300())
-+		pxa_set_ffuart_info(NULL);
- 
- 	cm_x300_init_da9030();
- 	cm_x300_init_dm9000();
-diff --git a/arch/arm/plat-mxc/include/mach/gpio.h b/arch/arm/plat-mxc/include/mach/gpio.h
-index 6bd932c..7a0dc5a 100644
---- a/arch/arm/plat-mxc/include/mach/gpio.h
-+++ b/arch/arm/plat-mxc/include/mach/gpio.h
-@@ -19,6 +19,7 @@
- #ifndef __ASM_ARCH_MXC_GPIO_H__
- #define __ASM_ARCH_MXC_GPIO_H__
- 
-+#include <linux/spinlock.h>
- #include <mach/hardware.h>
- #include <asm-generic/gpio.h>
- 
-diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
-index 77cfe7a..5d2f17d 100644
---- a/arch/powerpc/Makefile
-+++ b/arch/powerpc/Makefile
-@@ -163,9 +163,11 @@ drivers-$(CONFIG_OPROFILE)	+= arch/powerpc/oprofile/
- # Default to zImage, override when needed
- all: zImage
- 
--BOOT_TARGETS = zImage zImage.initrd uImage zImage% dtbImage% treeImage.% cuImage.% simpleImage.%
-+# With make 3.82 we cannot mix normal and wildcard targets
-+BOOT_TARGETS1 := zImage zImage.initrd uImaged
-+BOOT_TARGETS2 := zImage% dtbImage% treeImage.% cuImage.% simpleImage.%
- 
--PHONY += $(BOOT_TARGETS)
-+PHONY += $(BOOT_TARGETS1) $(BOOT_TARGETS2)
- 
- boot := arch/$(ARCH)/boot
- 
-@@ -180,10 +182,16 @@ relocs_check: arch/powerpc/relocs_check.pl vmlinux
- zImage: relocs_check
- endif
- 
--$(BOOT_TARGETS): vmlinux
-+$(BOOT_TARGETS1): vmlinux
-+	$(Q)$(MAKE) ARCH=ppc64 $(build)=$(boot) $(patsubst %,$(boot)/%,$@)
-+$(BOOT_TARGETS2): vmlinux
-+	$(Q)$(MAKE) ARCH=ppc64 $(build)=$(boot) $(patsubst %,$(boot)/%,$@)
-+
-+
-+bootwrapper_install:
- 	$(Q)$(MAKE) ARCH=ppc64 $(build)=$(boot) $(patsubst %,$(boot)/%,$@)
- 
--bootwrapper_install %.dtb:
-+%.dtb:
- 	$(Q)$(MAKE) ARCH=ppc64 $(build)=$(boot) $(patsubst %,$(boot)/%,$@)
- 
- define archhelp
-diff --git a/arch/powerpc/kernel/perf_event_fsl_emb.c b/arch/powerpc/kernel/perf_event_fsl_emb.c
-index babccee..4339d20 100644
---- a/arch/powerpc/kernel/perf_event_fsl_emb.c
-+++ b/arch/powerpc/kernel/perf_event_fsl_emb.c
-@@ -569,6 +569,7 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
- 		struct perf_sample_data data;
- 
- 		perf_sample_data_init(&data, 0);
-+		data.period = event->hw.last_period;
- 
- 		if (perf_event_overflow(event, nmi, &data, regs)) {
- 			/*
-diff --git a/arch/x86/include/asm/cmpxchg_32.h b/arch/x86/include/asm/cmpxchg_32.h
-index 8859e12..c1cf59d 100644
---- a/arch/x86/include/asm/cmpxchg_32.h
-+++ b/arch/x86/include/asm/cmpxchg_32.h
-@@ -27,20 +27,20 @@ struct __xchg_dummy {
- 	switch (size) {							\
- 	case 1:								\
- 		asm volatile("xchgb %b0,%1"				\
--			     : "=q" (__x)				\
--			     : "m" (*__xg(ptr)), "0" (__x)		\
-+			     : "=q" (__x), "+m" (*__xg(ptr))		\
-+			     : "0" (__x)				\
- 			     : "memory");				\
- 		break;							\
- 	case 2:								\
- 		asm volatile("xchgw %w0,%1"				\
--			     : "=r" (__x)				\
--			     : "m" (*__xg(ptr)), "0" (__x)		\
-+			     : "=r" (__x), "+m" (*__xg(ptr))		\
-+			     : "0" (__x)				\
- 			     : "memory");				\
- 		break;							\
- 	case 4:								\
- 		asm volatile("xchgl %0,%1"				\
--			     : "=r" (__x)				\
--			     : "m" (*__xg(ptr)), "0" (__x)		\
-+			     : "=r" (__x), "+m" (*__xg(ptr))		\
-+			     : "0" (__x)				\
- 			     : "memory");				\
- 		break;							\
- 	default:							\
-@@ -70,14 +70,14 @@ static inline void __set_64bit(unsigned long long *ptr,
- 			       unsigned int low, unsigned int high)
- {
- 	asm volatile("\n1:\t"
--		     "movl (%0), %%eax\n\t"
--		     "movl 4(%0), %%edx\n\t"
--		     LOCK_PREFIX "cmpxchg8b (%0)\n\t"
-+		     "movl (%1), %%eax\n\t"
-+		     "movl 4(%1), %%edx\n\t"
-+		     LOCK_PREFIX "cmpxchg8b (%1)\n\t"
- 		     "jnz 1b"
--		     : /* no outputs */
--		     : "D"(ptr),
--		       "b"(low),
--		       "c"(high)
-+		     : "=m" (*ptr)
-+		     : "D" (ptr),
-+		       "b" (low),
-+		       "c" (high)
- 		     : "ax", "dx", "memory");
- }
- 
-@@ -121,21 +121,21 @@ extern void __cmpxchg_wrong_size(void);
- 	__typeof__(*(ptr)) __new = (new);				\
- 	switch (size) {							\
- 	case 1:								\
--		asm volatile(lock "cmpxchgb %b1,%2"			\
--			     : "=a"(__ret)				\
--			     : "q"(__new), "m"(*__xg(ptr)), "0"(__old)	\
-+		asm volatile(lock "cmpxchgb %b2,%1"			\
-+			     : "=a" (__ret), "+m" (*__xg(ptr))		\
-+			     : "q" (__new), "0" (__old)			\
- 			     : "memory");				\
- 		break;							\
- 	case 2:								\
--		asm volatile(lock "cmpxchgw %w1,%2"			\
--			     : "=a"(__ret)				\
--			     : "r"(__new), "m"(*__xg(ptr)), "0"(__old)	\
-+		asm volatile(lock "cmpxchgw %w2,%1"			\
-+			     : "=a" (__ret), "+m" (*__xg(ptr))		\
-+			     : "r" (__new), "0" (__old)			\
- 			     : "memory");				\
- 		break;							\
- 	case 4:								\
--		asm volatile(lock "cmpxchgl %1,%2"			\
--			     : "=a"(__ret)				\
--			     : "r"(__new), "m"(*__xg(ptr)), "0"(__old)	\
-+		asm volatile(lock "cmpxchgl %2,%1"			\
-+			     : "=a" (__ret), "+m" (*__xg(ptr))		\
-+			     : "r" (__new), "0" (__old)			\
- 			     : "memory");				\
- 		break;							\
- 	default:							\
-@@ -180,12 +180,12 @@ static inline unsigned long long __cmpxchg64(volatile void *ptr,
- 					     unsigned long long new)
- {
- 	unsigned long long prev;
--	asm volatile(LOCK_PREFIX "cmpxchg8b %3"
--		     : "=A"(prev)
--		     : "b"((unsigned long)new),
--		       "c"((unsigned long)(new >> 32)),
--		       "m"(*__xg(ptr)),
--		       "0"(old)
-+	asm volatile(LOCK_PREFIX "cmpxchg8b %1"
-+		     : "=A" (prev),
-+		       "+m" (*__xg(ptr))
-+		     : "b" ((unsigned long)new),
-+		       "c" ((unsigned long)(new >> 32)),
-+		       "0" (old)
- 		     : "memory");
- 	return prev;
- }
-@@ -195,12 +195,12 @@ static inline unsigned long long __cmpxchg64_local(volatile void *ptr,
- 						   unsigned long long new)
- {
- 	unsigned long long prev;
--	asm volatile("cmpxchg8b %3"
--		     : "=A"(prev)
--		     : "b"((unsigned long)new),
--		       "c"((unsigned long)(new >> 32)),
--		       "m"(*__xg(ptr)),
--		       "0"(old)
-+	asm volatile("cmpxchg8b %1"
-+		     : "=A" (prev),
-+		       "+m" (*__xg(ptr))
-+		     : "b" ((unsigned long)new),
-+		       "c" ((unsigned long)(new >> 32)),
-+		       "0" (old)
- 		     : "memory");
- 	return prev;
- }
-diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h
-index 485ae41..b92f147 100644
---- a/arch/x86/include/asm/cmpxchg_64.h
-+++ b/arch/x86/include/asm/cmpxchg_64.h
-@@ -26,26 +26,26 @@ extern void __cmpxchg_wrong_size(void);
- 	switch (size) {							\
- 	case 1:								\
- 		asm volatile("xchgb %b0,%1"				\
--			     : "=q" (__x)				\
--			     : "m" (*__xg(ptr)), "0" (__x)		\
-+			     : "=q" (__x), "+m" (*__xg(ptr))		\
-+			     : "0" (__x)				\
- 			     : "memory");				\
- 		break;							\
- 	case 2:								\
- 		asm volatile("xchgw %w0,%1"				\
--			     : "=r" (__x)				\
--			     : "m" (*__xg(ptr)), "0" (__x)		\
-+			     : "=r" (__x), "+m" (*__xg(ptr))		\
-+			     : "0" (__x)				\
- 			     : "memory");				\
- 		break;							\
- 	case 4:								\
- 		asm volatile("xchgl %k0,%1"				\
--			     : "=r" (__x)				\
--			     : "m" (*__xg(ptr)), "0" (__x)		\
-+			     : "=r" (__x), "+m" (*__xg(ptr))		\
-+			     : "0" (__x)				\
- 			     : "memory");				\
- 		break;							\
- 	case 8:								\
- 		asm volatile("xchgq %0,%1"				\
--			     : "=r" (__x)				\
--			     : "m" (*__xg(ptr)), "0" (__x)		\
-+			     : "=r" (__x), "+m" (*__xg(ptr))		\
-+			     : "0" (__x)				\
- 			     : "memory");				\
- 		break;							\
- 	default:							\
-@@ -71,27 +71,27 @@ extern void __cmpxchg_wrong_size(void);
- 	__typeof__(*(ptr)) __new = (new);				\
- 	switch (size) {							\
- 	case 1:								\
--		asm volatile(lock "cmpxchgb %b1,%2"			\
--			     : "=a"(__ret)				\
--			     : "q"(__new), "m"(*__xg(ptr)), "0"(__old)	\
-+		asm volatile(lock "cmpxchgb %b2,%1"			\
-+			     : "=a" (__ret), "+m" (*__xg(ptr))		\
-+			     : "q" (__new), "0" (__old)			\
- 			     : "memory");				\
- 		break;							\
- 	case 2:								\
--		asm volatile(lock "cmpxchgw %w1,%2"			\
--			     : "=a"(__ret)				\
--			     : "r"(__new), "m"(*__xg(ptr)), "0"(__old)	\
-+		asm volatile(lock "cmpxchgw %w2,%1"			\
-+			     : "=a" (__ret), "+m" (*__xg(ptr))		\
-+			     : "r" (__new), "0" (__old)			\
- 			     : "memory");				\
- 		break;							\
- 	case 4:								\
--		asm volatile(lock "cmpxchgl %k1,%2"			\
--			     : "=a"(__ret)				\
--			     : "r"(__new), "m"(*__xg(ptr)), "0"(__old)	\
-+		asm volatile(lock "cmpxchgl %k2,%1"			\
-+			     : "=a" (__ret), "+m" (*__xg(ptr))		\
-+			     : "r" (__new), "0" (__old)			\
- 			     : "memory");				\
- 		break;							\
- 	case 8:								\
--		asm volatile(lock "cmpxchgq %1,%2"			\
--			     : "=a"(__ret)				\
--			     : "r"(__new), "m"(*__xg(ptr)), "0"(__old)	\
-+		asm volatile(lock "cmpxchgq %2,%1"			\
-+			     : "=a" (__ret), "+m" (*__xg(ptr))		\
-+			     : "r" (__new), "0" (__old)			\
- 			     : "memory");				\
- 		break;							\
- 	default:							\
-diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
-index 79556bd..01c0f3e 100644
---- a/arch/x86/kernel/cpu/mtrr/main.c
-+++ b/arch/x86/kernel/cpu/mtrr/main.c
-@@ -35,6 +35,7 @@
- 
- #include <linux/types.h> /* FIXME: kvm_para.h needs this */
- 
-+#include <linux/stop_machine.h>
- #include <linux/kvm_para.h>
- #include <linux/uaccess.h>
- #include <linux/module.h>
-@@ -143,22 +144,28 @@ struct set_mtrr_data {
- 	mtrr_type	smp_type;
- };
- 
-+static DEFINE_PER_CPU(struct cpu_stop_work, mtrr_work);
-+
- /**
-- * ipi_handler - Synchronisation handler. Executed by "other" CPUs.
-+ * mtrr_work_handler - Synchronisation handler. Executed by "other" CPUs.
-  * @info: pointer to mtrr configuration data
-  *
-  * Returns nothing.
-  */
--static void ipi_handler(void *info)
-+static int mtrr_work_handler(void *info)
- {
- #ifdef CONFIG_SMP
- 	struct set_mtrr_data *data = info;
- 	unsigned long flags;
- 
-+	atomic_dec(&data->count);
-+	while (!atomic_read(&data->gate))
-+		cpu_relax();
-+
- 	local_irq_save(flags);
- 
- 	atomic_dec(&data->count);
--	while (!atomic_read(&data->gate))
-+	while (atomic_read(&data->gate))
- 		cpu_relax();
- 
- 	/*  The master has cleared me to execute  */
-@@ -173,12 +180,13 @@ static void ipi_handler(void *info)
- 	}
- 
- 	atomic_dec(&data->count);
--	while (atomic_read(&data->gate))
-+	while (!atomic_read(&data->gate))
- 		cpu_relax();
- 
- 	atomic_dec(&data->count);
- 	local_irq_restore(flags);
- #endif
-+	return 0;
- }
- 
- static inline int types_compatible(mtrr_type type1, mtrr_type type2)
-@@ -198,7 +206,7 @@ static inline int types_compatible(mtrr_type type1, mtrr_type type2)
-  *
-  * This is kinda tricky, but fortunately, Intel spelled it out for us cleanly:
-  *
-- * 1. Send IPI to do the following:
-+ * 1. Queue work to do the following on all processors:
-  * 2. Disable Interrupts
-  * 3. Wait for all procs to do so
-  * 4. Enter no-fill cache mode
-@@ -215,14 +223,17 @@ static inline int types_compatible(mtrr_type type1, mtrr_type type2)
-  * 15. Enable interrupts.
-  *
-  * What does that mean for us? Well, first we set data.count to the number
-- * of CPUs. As each CPU disables interrupts, it'll decrement it once. We wait
-- * until it hits 0 and proceed. We set the data.gate flag and reset data.count.
-- * Meanwhile, they are waiting for that flag to be set. Once it's set, each
-+ * of CPUs. As each CPU announces that it started the rendezvous handler by
-+ * decrementing the count, We reset data.count and set the data.gate flag
-+ * allowing all the cpu's to proceed with the work. As each cpu disables
-+ * interrupts, it'll decrement data.count once. We wait until it hits 0 and
-+ * proceed. We clear the data.gate flag and reset data.count. Meanwhile, they
-+ * are waiting for that flag to be cleared. Once it's cleared, each
-  * CPU goes through the transition of updating MTRRs.
-  * The CPU vendors may each do it differently,
-  * so we call mtrr_if->set() callback and let them take care of it.
-  * When they're done, they again decrement data->count and wait for data.gate
-- * to be reset.
-+ * to be set.
-  * When we finish, we wait for data.count to hit 0 and toggle the data.gate flag
-  * Everyone then enables interrupts and we all continue on.
-  *
-@@ -234,6 +245,9 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
- {
- 	struct set_mtrr_data data;
- 	unsigned long flags;
-+	int cpu;
-+
-+	preempt_disable();
- 
- 	data.smp_reg = reg;
- 	data.smp_base = base;
-@@ -246,10 +260,15 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
- 	atomic_set(&data.gate, 0);
- 
- 	/* Start the ball rolling on other CPUs */
--	if (smp_call_function(ipi_handler, &data, 0) != 0)
--		panic("mtrr: timed out waiting for other CPUs\n");
-+	for_each_online_cpu(cpu) {
-+		struct cpu_stop_work *work = &per_cpu(mtrr_work, cpu);
-+
-+		if (cpu == smp_processor_id())
-+			continue;
-+
-+		stop_one_cpu_nowait(cpu, mtrr_work_handler, &data, work);
-+	}
- 
--	local_irq_save(flags);
- 
- 	while (atomic_read(&data.count))
- 		cpu_relax();
-@@ -259,6 +278,16 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
- 	smp_wmb();
- 	atomic_set(&data.gate, 1);
- 
-+	local_irq_save(flags);
-+
-+	while (atomic_read(&data.count))
-+		cpu_relax();
-+
-+	/* Ok, reset count and toggle gate */
-+	atomic_set(&data.count, num_booting_cpus() - 1);
-+	smp_wmb();
-+	atomic_set(&data.gate, 0);
-+
- 	/* Do our MTRR business */
- 
- 	/*
-@@ -279,7 +308,7 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
- 
- 	atomic_set(&data.count, num_booting_cpus() - 1);
- 	smp_wmb();
--	atomic_set(&data.gate, 0);
-+	atomic_set(&data.gate, 1);
- 
- 	/*
- 	 * Wait here for everyone to have seen the gate change
-@@ -289,6 +318,7 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
- 		cpu_relax();
- 
- 	local_irq_restore(flags);
-+	preempt_enable();
- }
- 
- /**
-diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
-index b9d1ff5..227b044 100644
---- a/arch/x86/kernel/cpu/vmware.c
-+++ b/arch/x86/kernel/cpu/vmware.c
-@@ -51,7 +51,7 @@ static inline int __vmware_platform(void)
- 
- static unsigned long vmware_get_tsc_khz(void)
- {
--	uint64_t tsc_hz;
-+	uint64_t tsc_hz, lpj;
- 	uint32_t eax, ebx, ecx, edx;
- 
- 	VMWARE_PORT(GETHZ, eax, ebx, ecx, edx);
-@@ -62,6 +62,13 @@ static unsigned long vmware_get_tsc_khz(void)
- 	printk(KERN_INFO "TSC freq read from hypervisor : %lu.%03lu MHz\n",
- 			 (unsigned long) tsc_hz / 1000,
- 			 (unsigned long) tsc_hz % 1000);
-+
-+	if (!preset_lpj) {
-+		lpj = ((u64)tsc_hz * 1000);
-+		do_div(lpj, HZ);
-+		preset_lpj = lpj;
-+	}
-+
- 	return tsc_hz;
- }
- 
-diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index c4f33b2..11015fd 100644
---- a/arch/x86/kernel/smpboot.c
-+++ b/arch/x86/kernel/smpboot.c
-@@ -816,6 +816,13 @@ do_rest:
- 			if (cpumask_test_cpu(cpu, cpu_callin_mask))
- 				break;	/* It has booted */
- 			udelay(100);
-+			/*
-+			 * Allow other tasks to run while we wait for the
-+			 * AP to come online. This also gives a chance
-+			 * for the MTRR work(triggered by the AP coming online)
-+			 * to be completed in the stop machine context.
-+			 */
-+			schedule();
- 		}
- 
- 		if (cpumask_test_cpu(cpu, cpu_callin_mask))
-diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index f627779..4c4508e 100644
---- a/arch/x86/mm/fault.c
-+++ b/arch/x86/mm/fault.c
-@@ -802,8 +802,10 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
- 	up_read(&mm->mmap_sem);
- 
- 	/* Kernel mode? Handle exceptions or die: */
--	if (!(error_code & PF_USER))
-+	if (!(error_code & PF_USER)) {
- 		no_context(regs, error_code, address);
-+		return;
-+	}
- 
- 	/* User-space => ok to do another page fault: */
- 	if (is_prefetch(regs, error_code, address))
-diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
-index 5d0e67f..e5d5e2c 100644
---- a/arch/x86/mm/kmmio.c
-+++ b/arch/x86/mm/kmmio.c
-@@ -45,6 +45,8 @@ struct kmmio_fault_page {
- 	 * Protected by kmmio_lock, when linked into kmmio_page_table.
- 	 */
- 	int count;
-+
-+	bool scheduled_for_release;
- };
- 
- struct kmmio_delayed_release {
-@@ -398,8 +400,11 @@ static void release_kmmio_fault_page(unsigned long page,
- 	BUG_ON(f->count < 0);
- 	if (!f->count) {
- 		disarm_kmmio_fault_page(f);
--		f->release_next = *release_list;
--		*release_list = f;
-+		if (!f->scheduled_for_release) {
-+			f->release_next = *release_list;
-+			*release_list = f;
-+			f->scheduled_for_release = true;
-+		}
- 	}
- }
- 
-@@ -471,8 +476,10 @@ static void remove_kmmio_fault_pages(struct rcu_head *head)
- 			prevp = &f->release_next;
- 		} else {
- 			*prevp = f->release_next;
-+			f->release_next = NULL;
-+			f->scheduled_for_release = false;
- 		}
--		f = f->release_next;
-+		f = *prevp;
- 	}
- 	spin_unlock_irqrestore(&kmmio_lock, flags);
- 
-@@ -510,6 +517,9 @@ void unregister_kmmio_probe(struct kmmio_probe *p)
- 	kmmio_count--;
- 	spin_unlock_irqrestore(&kmmio_lock, flags);
- 
-+	if (!release_list)
-+		return;
-+
- 	drelease = kmalloc(sizeof(*drelease), GFP_ATOMIC);
- 	if (!drelease) {
- 		pr_crit("leaking kmmio_fault_page objects.\n");
-diff --git a/arch/x86/mm/testmmiotrace.c b/arch/x86/mm/testmmiotrace.c
-index 8565d94..38868ad 100644
---- a/arch/x86/mm/testmmiotrace.c
-+++ b/arch/x86/mm/testmmiotrace.c
-@@ -90,6 +90,27 @@ static void do_test(unsigned long size)
- 	iounmap(p);
- }
- 
-+/*
-+ * Tests how mmiotrace behaves in face of multiple ioremap / iounmaps in
-+ * a short time. We had a bug in deferred freeing procedure which tried
-+ * to free this region multiple times (ioremap can reuse the same address
-+ * for many mappings).
-+ */
-+static void do_test_bulk_ioremapping(void)
-+{
-+	void __iomem *p;
-+	int i;
-+
-+	for (i = 0; i < 10; ++i) {
-+		p = ioremap_nocache(mmio_address, PAGE_SIZE);
-+		if (p)
-+			iounmap(p);
-+	}
-+
-+	/* Force freeing. If it will crash we will know why. */
-+	synchronize_rcu();
-+}
-+
- static int __init init(void)
- {
- 	unsigned long size = (read_far) ? (8 << 20) : (16 << 10);
-@@ -104,6 +125,7 @@ static int __init init(void)
- 		   "and writing 16 kB of rubbish in there.\n",
- 		   size >> 10, mmio_address);
- 	do_test(size);
-+	do_test_bulk_ioremapping();
- 	pr_info("All done.\n");
- 	return 0;
- }
-diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
-index 2ec04c4..15466c0 100644
---- a/arch/x86/pci/acpi.c
-+++ b/arch/x86/pci/acpi.c
-@@ -34,6 +34,15 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = {
- 			DMI_MATCH(DMI_PRODUCT_NAME, "x3800"),
- 		},
- 	},
-+	/* https://bugzilla.kernel.org/show_bug.cgi?id=16007 */
-+	/* 2006 AMD HT/VIA system with two host bridges */
-+        {
-+		.callback = set_use_crs,
-+		.ident = "ASRock ALiveSATA2-GLAN",
-+		.matches = {
-+			DMI_MATCH(DMI_PRODUCT_NAME, "ALiveSATA2-GLAN"),
-+                },
-+        },
- 	{}
- };
- 
-diff --git a/crypto/Kconfig b/crypto/Kconfig
-index 9d9434f..df332c1 100644
---- a/crypto/Kconfig
-+++ b/crypto/Kconfig
-@@ -96,6 +96,14 @@ config CRYPTO_MANAGER2
- 	select CRYPTO_BLKCIPHER2
- 	select CRYPTO_PCOMP
- 
-+config CRYPTO_MANAGER_TESTS
-+	bool "Run algolithms' self-tests"
-+	default y
-+	depends on CRYPTO_MANAGER2
-+	help
-+	  Run cryptomanager's tests for the new crypto algorithms being
-+	  registered.
-+
- config CRYPTO_GF128MUL
- 	tristate "GF(2^128) multiplication functions (EXPERIMENTAL)"
- 	depends on EXPERIMENTAL
-diff --git a/crypto/algboss.c b/crypto/algboss.c
-index c3c196b..40bd391 100644
---- a/crypto/algboss.c
-+++ b/crypto/algboss.c
-@@ -206,6 +206,7 @@ err:
- 	return NOTIFY_OK;
- }
- 
-+#ifdef CONFIG_CRYPTO_MANAGER_TESTS
- static int cryptomgr_test(void *data)
- {
- 	struct crypto_test_param *param = data;
-@@ -266,6 +267,7 @@ err_put_module:
- err:
- 	return NOTIFY_OK;
- }
-+#endif /* CONFIG_CRYPTO_MANAGER_TESTS */
- 
- static int cryptomgr_notify(struct notifier_block *this, unsigned long msg,
- 			    void *data)
-@@ -273,8 +275,10 @@ static int cryptomgr_notify(struct notifier_block *this, unsigned long msg,
- 	switch (msg) {
- 	case CRYPTO_MSG_ALG_REQUEST:
- 		return cryptomgr_schedule_probe(data);
-+#ifdef CONFIG_CRYPTO_MANAGER_TESTS
- 	case CRYPTO_MSG_ALG_REGISTER:
- 		return cryptomgr_schedule_test(data);
-+#endif
- 	}
- 
- 	return NOTIFY_DONE;
-diff --git a/crypto/testmgr.c b/crypto/testmgr.c
-index 5c8aaa0..abd980c 100644
---- a/crypto/testmgr.c
-+++ b/crypto/testmgr.c
-@@ -22,6 +22,17 @@
- #include <crypto/rng.h>
- 
- #include "internal.h"
-+
-+#ifndef CONFIG_CRYPTO_MANAGER_TESTS
-+
-+/* a perfect nop */
-+int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
-+{
-+	return 0;
-+}
-+
-+#else
-+
- #include "testmgr.h"
- 
- /*
-@@ -2530,4 +2541,7 @@ notest:
- non_fips_alg:
- 	return -EINVAL;
- }
-+
-+#endif /* CONFIG_CRYPTO_MANAGER_TESTS */
-+
- EXPORT_SYMBOL_GPL(alg_test);
-diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
-index 7409f98..3971bc0 100644
---- a/drivers/ata/ata_piix.c
-+++ b/drivers/ata/ata_piix.c
-@@ -158,6 +158,7 @@ struct piix_map_db {
- struct piix_host_priv {
- 	const int *map;
- 	u32 saved_iocfg;
-+	spinlock_t sidpr_lock;	/* FIXME: remove once locking in EH is fixed */
- 	void __iomem *sidpr;
- };
- 
-@@ -951,12 +952,15 @@ static int piix_sidpr_scr_read(struct ata_link *link,
- 			       unsigned int reg, u32 *val)
- {
- 	struct piix_host_priv *hpriv = link->ap->host->private_data;
-+	unsigned long flags;
- 
- 	if (reg >= ARRAY_SIZE(piix_sidx_map))
- 		return -EINVAL;
- 
-+	spin_lock_irqsave(&hpriv->sidpr_lock, flags);
- 	piix_sidpr_sel(link, reg);
- 	*val = ioread32(hpriv->sidpr + PIIX_SIDPR_DATA);
-+	spin_unlock_irqrestore(&hpriv->sidpr_lock, flags);
- 	return 0;
- }
- 
-@@ -964,12 +968,15 @@ static int piix_sidpr_scr_write(struct ata_link *link,
- 				unsigned int reg, u32 val)
- {
- 	struct piix_host_priv *hpriv = link->ap->host->private_data;
-+	unsigned long flags;
- 
- 	if (reg >= ARRAY_SIZE(piix_sidx_map))
- 		return -EINVAL;
- 
-+	spin_lock_irqsave(&hpriv->sidpr_lock, flags);
- 	piix_sidpr_sel(link, reg);
- 	iowrite32(val, hpriv->sidpr + PIIX_SIDPR_DATA);
-+	spin_unlock_irqrestore(&hpriv->sidpr_lock, flags);
- 	return 0;
- }
- 
-@@ -1566,6 +1573,7 @@ static int __devinit piix_init_one(struct pci_dev *pdev,
- 	hpriv = devm_kzalloc(dev, sizeof(*hpriv), GFP_KERNEL);
- 	if (!hpriv)
- 		return -ENOMEM;
-+	spin_lock_init(&hpriv->sidpr_lock);
- 
- 	/* Save IOCFG, this will be used for cable detection, quirk
- 	 * detection and restoration on detach.  This is necessary
-diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
-index ded76c4..3613422 100644
---- a/drivers/atm/solos-pci.c
-+++ b/drivers/atm/solos-pci.c
-@@ -781,7 +781,8 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)
- 	sk_for_each(s, node, head) {
- 		vcc = atm_sk(s);
- 		if (vcc->dev == dev && vcc->vci == vci &&
--		    vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE)
-+		    vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE &&
-+		    test_bit(ATM_VF_READY, &vcc->flags))
- 			goto out;
- 	}
- 	vcc = NULL;
-@@ -907,6 +908,10 @@ static void pclose(struct atm_vcc *vcc)
- 	clear_bit(ATM_VF_ADDR, &vcc->flags);
- 	clear_bit(ATM_VF_READY, &vcc->flags);
- 
-+	/* Hold up vcc_destroy_socket() (our caller) until solos_bh() in the
-+	   tasklet has finished processing any incoming packets (and, more to
-+	   the point, using the vcc pointer). */
-+	tasklet_unlock_wait(&card->tlet);
- 	return;
- }
- 
-diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
-index 7258c95..60bbfcf 100644
---- a/drivers/block/drbd/drbd_main.c
-+++ b/drivers/block/drbd/drbd_main.c
-@@ -2371,11 +2371,7 @@ static int _drbd_send_zc_ee(struct drbd_conf *mdev, struct drbd_epoch_entry *e)
- 
- static void consider_delay_probes(struct drbd_conf *mdev)
- {
--	if (mdev->state.conn != C_SYNC_SOURCE || mdev->agreed_pro_version < 93)
--		return;
--
--	if (mdev->dp_volume_last + mdev->sync_conf.dp_volume * 2 < mdev->send_cnt)
--		drbd_send_delay_probes(mdev);
-+	return;
- }
- 
- static int w_delay_probes(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
-@@ -2660,9 +2656,24 @@ static void drbd_unplug_fn(struct request_queue *q)
- 
- static void drbd_set_defaults(struct drbd_conf *mdev)
- {
--	mdev->sync_conf.after      = DRBD_AFTER_DEF;
--	mdev->sync_conf.rate       = DRBD_RATE_DEF;
--	mdev->sync_conf.al_extents = DRBD_AL_EXTENTS_DEF;
-+	/* This way we get a compile error when sync_conf grows,
-+	   and we forgot to initialize it here */
-+	mdev->sync_conf = (struct syncer_conf) {
-+		/* .rate = */		DRBD_RATE_DEF,
-+		/* .after = */		DRBD_AFTER_DEF,
-+		/* .al_extents = */	DRBD_AL_EXTENTS_DEF,
-+		/* .dp_volume = */	DRBD_DP_VOLUME_DEF,
-+		/* .dp_interval = */	DRBD_DP_INTERVAL_DEF,
-+		/* .throttle_th = */	DRBD_RS_THROTTLE_TH_DEF,
-+		/* .hold_off_th = */	DRBD_RS_HOLD_OFF_TH_DEF,
-+		/* .verify_alg = */	{}, 0,
-+		/* .cpu_mask = */	{}, 0,
-+		/* .csums_alg = */	{}, 0,
-+		/* .use_rle = */	0
-+	};
-+
-+	/* Have to use that way, because the layout differs between
-+	   big endian and little endian */
- 	mdev->state = (union drbd_state) {
- 		{ .role = R_SECONDARY,
- 		  .peer = R_UNKNOWN,
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 5d9cc53..6fcb971 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -59,6 +59,9 @@ static struct usb_device_id btusb_table[] = {
- 	/* Generic Bluetooth USB device */
- 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
- 
-+	/* Apple iMac11,1 */
-+	{ USB_DEVICE(0x05ac, 0x8215) },
-+
- 	/* AVM BlueFRITZ! USB v2.0 */
- 	{ USB_DEVICE(0x057c, 0x3800) },
- 
-diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
-index 094bdc3..ff68e7c 100644
---- a/drivers/char/ipmi/ipmi_si_intf.c
-+++ b/drivers/char/ipmi/ipmi_si_intf.c
-@@ -2176,6 +2176,14 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
- 	info->io.addr_data = res->start;
- 
- 	info->io.regspacing = DEFAULT_REGSPACING;
-+	res = pnp_get_resource(dev,
-+			       (info->io.addr_type == IPMI_IO_ADDR_SPACE) ?
-+					IORESOURCE_IO : IORESOURCE_MEM,
-+			       1);
-+	if (res) {
-+		if (res->start > info->io.addr_data)
-+			info->io.regspacing = res->start - info->io.addr_data;
-+	}
- 	info->io.regsize = DEFAULT_REGSPACING;
- 	info->io.regshift = 0;
- 
-diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
-index a663800..18af923 100644
---- a/drivers/char/nozomi.c
-+++ b/drivers/char/nozomi.c
-@@ -1611,6 +1611,8 @@ static int ntty_install(struct tty_driver *driver, struct tty_struct *tty)
- 	ret = tty_init_termios(tty);
- 	if (ret == 0) {
- 		tty_driver_kref_get(driver);
-+		tty->count++;
-+		tty->driver_data = port;
- 		driver->ttys[tty->index] = tty;
- 	}
- 	return ret;
-@@ -1639,7 +1641,7 @@ static int ntty_activate(struct tty_port *tport, struct tty_struct *tty)
- 
- static int ntty_open(struct tty_struct *tty, struct file *filp)
- {
--	struct port *port = get_port_by_tty(tty);
-+	struct port *port = tty->driver_data;
- 	return tty_port_open(&port->port, tty, filp);
- }
- 
-diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
-index 6d3a73b..5216c8a 100644
---- a/drivers/dma/ioat/dma.h
-+++ b/drivers/dma/ioat/dma.h
-@@ -97,6 +97,7 @@ struct ioat_chan_common {
- 	#define IOAT_RESET_PENDING 2
- 	#define IOAT_KOBJ_INIT_FAIL 3
- 	#define IOAT_RESHAPE_PENDING 4
-+	#define IOAT_RUN 5
- 	struct timer_list timer;
- 	#define COMPLETION_TIMEOUT msecs_to_jiffies(100)
- 	#define IDLE_TIMEOUT msecs_to_jiffies(2000)
-diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
-index 3c8b32a..216f9d3 100644
---- a/drivers/dma/ioat/dma_v2.c
-+++ b/drivers/dma/ioat/dma_v2.c
-@@ -287,7 +287,10 @@ void ioat2_timer_event(unsigned long data)
- 			chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
- 			dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
- 				__func__, chanerr);
--			BUG_ON(is_ioat_bug(chanerr));
-+			if (test_bit(IOAT_RUN, &chan->state))
-+				BUG_ON(is_ioat_bug(chanerr));
-+			else /* we never got off the ground */
-+				return;
- 		}
- 
- 		/* if we haven't made progress and we have already
-@@ -492,6 +495,8 @@ static struct ioat_ring_ent **ioat2_alloc_ring(struct dma_chan *c, int order, gf
- 	return ring;
- }
- 
-+void ioat2_free_chan_resources(struct dma_chan *c);
-+
- /* ioat2_alloc_chan_resources - allocate/initialize ioat2 descriptor ring
-  * @chan: channel to be initialized
-  */
-@@ -500,6 +505,7 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
- 	struct ioat2_dma_chan *ioat = to_ioat2_chan(c);
- 	struct ioat_chan_common *chan = &ioat->base;
- 	struct ioat_ring_ent **ring;
-+	u64 status;
- 	int order;
- 
- 	/* have we already been set up? */
-@@ -540,7 +546,20 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
- 	tasklet_enable(&chan->cleanup_task);
- 	ioat2_start_null_desc(ioat);
- 
--	return 1 << ioat->alloc_order;
-+	/* check that we got off the ground */
-+	udelay(5);
-+	status = ioat_chansts(chan);
-+	if (is_ioat_active(status) || is_ioat_idle(status)) {
-+		set_bit(IOAT_RUN, &chan->state);
-+		return 1 << ioat->alloc_order;
-+	} else {
-+		u32 chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
-+
-+		dev_WARN(to_dev(chan),
-+			"failed to start channel chanerr: %#x\n", chanerr);
-+		ioat2_free_chan_resources(c);
-+		return -EFAULT;
-+	}
- }
- 
- bool reshape_ring(struct ioat2_dma_chan *ioat, int order)
-@@ -778,6 +797,7 @@ void ioat2_free_chan_resources(struct dma_chan *c)
- 	del_timer_sync(&chan->timer);
- 	device->cleanup_fn((unsigned long) c);
- 	device->reset_hw(chan);
-+	clear_bit(IOAT_RUN, &chan->state);
- 
- 	spin_lock_bh(&chan->cleanup_lock);
- 	spin_lock_bh(&ioat->prep_lock);
-diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
-index 1cdd22e..d0f4990 100644
---- a/drivers/dma/ioat/dma_v3.c
-+++ b/drivers/dma/ioat/dma_v3.c
-@@ -361,7 +361,10 @@ static void ioat3_timer_event(unsigned long data)
- 			chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
- 			dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
- 				__func__, chanerr);
--			BUG_ON(is_ioat_bug(chanerr));
-+			if (test_bit(IOAT_RUN, &chan->state))
-+				BUG_ON(is_ioat_bug(chanerr));
-+			else /* we never got off the ground */
-+				return;
- 		}
- 
- 		/* if we haven't made progress and we have already
-diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
-index 64207df..2de76cc 100644
---- a/drivers/ide/ide-cd.c
-+++ b/drivers/ide/ide-cd.c
-@@ -506,15 +506,22 @@ int ide_cd_queue_pc(ide_drive_t *drive, const unsigned char *cmd,
- 	return (flags & REQ_FAILED) ? -EIO : 0;
- }
- 
--static void ide_cd_error_cmd(ide_drive_t *drive, struct ide_cmd *cmd)
-+/*
-+ * returns true if rq has been completed
-+ */
-+static bool ide_cd_error_cmd(ide_drive_t *drive, struct ide_cmd *cmd)
- {
- 	unsigned int nr_bytes = cmd->nbytes - cmd->nleft;
- 
- 	if (cmd->tf_flags & IDE_TFLAG_WRITE)
- 		nr_bytes -= cmd->last_xfer_len;
- 
--	if (nr_bytes > 0)
-+	if (nr_bytes > 0) {
- 		ide_complete_rq(drive, 0, nr_bytes);
-+		return true;
-+	}
-+
-+	return false;
- }
- 
- static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
-@@ -679,7 +686,8 @@ out_end:
- 		}
- 
- 		if (uptodate == 0 && rq->bio)
--			ide_cd_error_cmd(drive, cmd);
-+			if (ide_cd_error_cmd(drive, cmd))
-+				return ide_stopped;
- 
- 		/* make sure it's fully ended */
- 		if (blk_fs_request(rq) == 0) {
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index cb20d0b..7476d95 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -532,13 +532,17 @@ static void mddev_unlock(mddev_t * mddev)
- 		 * an access to the files will try to take reconfig_mutex
- 		 * while holding the file unremovable, which leads to
- 		 * a deadlock.
--		 * So hold open_mutex instead - we are allowed to take
--		 * it while holding reconfig_mutex, and md_run can
--		 * use it to wait for the remove to complete.
-+		 * So hold set sysfs_active while the remove in happeing,
-+		 * and anything else which might set ->to_remove or my
-+		 * otherwise change the sysfs namespace will fail with
-+		 * -EBUSY if sysfs_active is still set.
-+		 * We set sysfs_active under reconfig_mutex and elsewhere
-+		 * test it under the same mutex to ensure its correct value
-+		 * is seen.
- 		 */
- 		struct attribute_group *to_remove = mddev->to_remove;
- 		mddev->to_remove = NULL;
--		mutex_lock(&mddev->open_mutex);
-+		mddev->sysfs_active = 1;
- 		mutex_unlock(&mddev->reconfig_mutex);
- 
- 		if (to_remove != &md_redundancy_group)
-@@ -550,7 +554,7 @@ static void mddev_unlock(mddev_t * mddev)
- 				sysfs_put(mddev->sysfs_action);
- 			mddev->sysfs_action = NULL;
- 		}
--		mutex_unlock(&mddev->open_mutex);
-+		mddev->sysfs_active = 0;
- 	} else
- 		mutex_unlock(&mddev->reconfig_mutex);
- 
-@@ -2960,7 +2964,9 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
- 	 *  - new personality will access other array.
- 	 */
- 
--	if (mddev->sync_thread || mddev->reshape_position != MaxSector)
-+	if (mddev->sync_thread ||
-+	    mddev->reshape_position != MaxSector ||
-+	    mddev->sysfs_active)
- 		return -EBUSY;
- 
- 	if (!mddev->pers->quiesce) {
-@@ -4344,13 +4350,9 @@ static int md_run(mddev_t *mddev)
- 
- 	if (mddev->pers)
- 		return -EBUSY;
--
--	/* These two calls synchronise us with the
--	 * sysfs_remove_group calls in mddev_unlock,
--	 * so they must have completed.
--	 */
--	mutex_lock(&mddev->open_mutex);
--	mutex_unlock(&mddev->open_mutex);
-+	/* Cannot run until previous stop completes properly */
-+	if (mddev->sysfs_active)
-+		return -EBUSY;
- 
- 	/*
- 	 * Analyze all RAID superblock(s)
-@@ -4711,12 +4713,13 @@ out:
-  */
- static int do_md_stop(mddev_t * mddev, int mode, int is_open)
- {
--	int err = 0;
-+	int err = 0, revalidate = 0;
- 	struct gendisk *disk = mddev->gendisk;
- 	mdk_rdev_t *rdev;
- 
- 	mutex_lock(&mddev->open_mutex);
--	if (atomic_read(&mddev->openers) > is_open) {
-+	if (atomic_read(&mddev->openers) > is_open ||
-+	    mddev->sysfs_active) {
- 		printk("md: %s still in use.\n",mdname(mddev));
- 		err = -EBUSY;
- 	} else if (mddev->pers) {
-@@ -4740,7 +4743,7 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
- 			}
- 
- 		set_capacity(disk, 0);
--		revalidate_disk(disk);
-+		revalidate = 1;
- 
- 		if (mddev->ro)
- 			mddev->ro = 0;
-@@ -4748,6 +4751,8 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
- 		err = 0;
- 	}
- 	mutex_unlock(&mddev->open_mutex);
-+	if (revalidate)
-+		revalidate_disk(disk);
- 	if (err)
- 		return err;
- 	/*
-diff --git a/drivers/md/md.h b/drivers/md/md.h
-index 10597bf..9ec208e 100644
---- a/drivers/md/md.h
-+++ b/drivers/md/md.h
-@@ -125,6 +125,10 @@ struct mddev_s
- 	int				suspended;
- 	atomic_t			active_io;
- 	int				ro;
-+	int				sysfs_active; /* set when sysfs deletes
-+						       * are happening, so run/
-+						       * takeover/stop are not safe
-+						       */
- 
- 	struct gendisk			*gendisk;
- 
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 42e64e4..d1d6891 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -825,11 +825,29 @@ static int make_request(mddev_t *mddev, struct bio * bio)
- 		 */
- 		bp = bio_split(bio,
- 			       chunk_sects - (bio->bi_sector & (chunk_sects - 1)) );
-+
-+		/* Each of these 'make_request' calls will call 'wait_barrier'.
-+		 * If the first succeeds but the second blocks due to the resync
-+		 * thread raising the barrier, we will deadlock because the
-+		 * IO to the underlying device will be queued in generic_make_request
-+		 * and will never complete, so will never reduce nr_pending.
-+		 * So increment nr_waiting here so no new raise_barriers will
-+		 * succeed, and so the second wait_barrier cannot block.
-+		 */
-+		spin_lock_irq(&conf->resync_lock);
-+		conf->nr_waiting++;
-+		spin_unlock_irq(&conf->resync_lock);
-+
- 		if (make_request(mddev, &bp->bio1))
- 			generic_make_request(&bp->bio1);
- 		if (make_request(mddev, &bp->bio2))
- 			generic_make_request(&bp->bio2);
- 
-+		spin_lock_irq(&conf->resync_lock);
-+		conf->nr_waiting--;
-+		wake_up(&conf->wait_barrier);
-+		spin_unlock_irq(&conf->resync_lock);
-+
- 		bio_pair_release(bp);
- 		return 0;
- 	bad_map:
-diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
-index 82e9438..8878503 100644
---- a/drivers/mtd/nand/mxc_nand.c
-+++ b/drivers/mtd/nand/mxc_nand.c
-@@ -604,8 +604,8 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
- 	/* Command pre-processing step */
- 	switch (command) {
- 	case NAND_CMD_RESET:
--		send_cmd(host, command, false);
- 		preset(mtd);
-+		send_cmd(host, command, false);
- 		break;
- 
- 	case NAND_CMD_STATUS:
-diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c
-index 8d46731..90e143e 100644
---- a/drivers/mtd/nand/plat_nand.c
-+++ b/drivers/mtd/nand/plat_nand.c
-@@ -91,7 +91,7 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
- 	}
- 
- 	/* Scan to find existance of the device */
--	if (nand_scan(&data->mtd, 1)) {
-+	if (nand_scan(&data->mtd, pdata->chip.nr_chips)) {
- 		err = -ENXIO;
- 		goto out;
- 	}
-diff --git a/drivers/net/e100.c b/drivers/net/e100.c
-index b194bad..8e2eab4 100644
---- a/drivers/net/e100.c
-+++ b/drivers/net/e100.c
-@@ -1779,6 +1779,7 @@ static int e100_tx_clean(struct nic *nic)
- 	for (cb = nic->cb_to_clean;
- 	    cb->status & cpu_to_le16(cb_complete);
- 	    cb = nic->cb_to_clean = cb->next) {
-+		rmb(); /* read skb after status */
- 		netif_printk(nic, tx_done, KERN_DEBUG, nic->netdev,
- 			     "cb[%d]->status = 0x%04X\n",
- 			     (int)(((void*)cb - (void*)nic->cbs)/sizeof(struct cb)),
-@@ -1927,6 +1928,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
- 
- 	netif_printk(nic, rx_status, KERN_DEBUG, nic->netdev,
- 		     "status=0x%04X\n", rfd_status);
-+	rmb(); /* read size after status bit */
- 
- 	/* If data isn't ready, nothing to indicate */
- 	if (unlikely(!(rfd_status & cb_complete))) {
-diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
-index 68a8089..a2680bf 100644
---- a/drivers/net/e1000/e1000_main.c
-+++ b/drivers/net/e1000/e1000_main.c
-@@ -3448,6 +3448,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
- 	while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
- 	       (count < tx_ring->count)) {
- 		bool cleaned = false;
-+		rmb();	/* read buffer_info after eop_desc */
- 		for ( ; !cleaned; count++) {
- 			tx_desc = E1000_TX_DESC(*tx_ring, i);
- 			buffer_info = &tx_ring->buffer_info[i];
-@@ -3637,6 +3638,7 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
- 		if (*work_done >= work_to_do)
- 			break;
- 		(*work_done)++;
-+		rmb(); /* read descriptor and rx_buffer_info after status DD */
- 
- 		status = rx_desc->status;
- 		skb = buffer_info->skb;
-@@ -3843,6 +3845,7 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
- 		if (*work_done >= work_to_do)
- 			break;
- 		(*work_done)++;
-+		rmb(); /* read descriptor and rx_buffer_info after status DD */
- 
- 		status = rx_desc->status;
- 		skb = buffer_info->skb;
-diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
-index 79e38dc..ba24679 100644
---- a/drivers/net/e1000e/netdev.c
-+++ b/drivers/net/e1000e/netdev.c
-@@ -774,6 +774,7 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
- 		if (*work_done >= work_to_do)
- 			break;
- 		(*work_done)++;
-+		rmb();	/* read descriptor and rx_buffer_info after status DD */
- 
- 		status = rx_desc->status;
- 		skb = buffer_info->skb;
-@@ -984,6 +985,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
- 	while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
- 	       (count < tx_ring->count)) {
- 		bool cleaned = false;
-+		rmb(); /* read buffer_info after eop_desc */
- 		for (; !cleaned; count++) {
- 			tx_desc = E1000_TX_DESC(*tx_ring, i);
- 			buffer_info = &tx_ring->buffer_info[i];
-@@ -1080,6 +1082,7 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
- 			break;
- 		(*work_done)++;
- 		skb = buffer_info->skb;
-+		rmb();	/* read descriptor and rx_buffer_info after status DD */
- 
- 		/* in the packet split case this is header only */
- 		prefetch(skb->data - NET_IP_ALIGN);
-@@ -1279,6 +1282,7 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
- 		if (*work_done >= work_to_do)
- 			break;
- 		(*work_done)++;
-+		rmb();	/* read descriptor and rx_buffer_info after status DD */
- 
- 		status = rx_desc->status;
- 		skb = buffer_info->skb;
-diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
-index df2a6d7..c9cb9c4 100644
---- a/drivers/net/igb/igb_main.c
-+++ b/drivers/net/igb/igb_main.c
-@@ -5344,6 +5344,7 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector)
- 
- 	while ((eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)) &&
- 	       (count < tx_ring->count)) {
-+		rmb();	/* read buffer_info after eop_desc status */
- 		for (cleaned = false; !cleaned; count++) {
- 			tx_desc = E1000_TX_DESC_ADV(*tx_ring, i);
- 			buffer_info = &tx_ring->buffer_info[i];
-@@ -5549,6 +5550,7 @@ static bool igb_clean_rx_irq_adv(struct igb_q_vector *q_vector,
- 		if (*work_done >= budget)
- 			break;
- 		(*work_done)++;
-+		rmb(); /* read descriptor and rx_buffer_info after status DD */
- 
- 		skb = buffer_info->skb;
- 		prefetch(skb->data - NET_IP_ALIGN);
-diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
-index 5e2b2a8..57b5fee 100644
---- a/drivers/net/igbvf/netdev.c
-+++ b/drivers/net/igbvf/netdev.c
-@@ -248,6 +248,7 @@ static bool igbvf_clean_rx_irq(struct igbvf_adapter *adapter,
- 		if (*work_done >= work_to_do)
- 			break;
- 		(*work_done)++;
-+		rmb(); /* read descriptor and rx_buffer_info after status DD */
- 
- 		buffer_info = &rx_ring->buffer_info[i];
- 
-@@ -780,6 +781,7 @@ static bool igbvf_clean_tx_irq(struct igbvf_ring *tx_ring)
- 
- 	while ((eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)) &&
- 	       (count < tx_ring->count)) {
-+		rmb();	/* read buffer_info after eop_desc status */
- 		for (cleaned = false; !cleaned; count++) {
- 			tx_desc = IGBVF_TX_DESC_ADV(*tx_ring, i);
- 			buffer_info = &tx_ring->buffer_info[i];
-diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
-index c6b75c8..45fc89b 100644
---- a/drivers/net/ixgb/ixgb_main.c
-+++ b/drivers/net/ixgb/ixgb_main.c
-@@ -1816,6 +1816,7 @@ ixgb_clean_tx_irq(struct ixgb_adapter *adapter)
- 
- 	while (eop_desc->status & IXGB_TX_DESC_STATUS_DD) {
- 
-+		rmb(); /* read buffer_info after eop_desc */
- 		for (cleaned = false; !cleaned; ) {
- 			tx_desc = IXGB_TX_DESC(*tx_ring, i);
- 			buffer_info = &tx_ring->buffer_info[i];
-@@ -1976,6 +1977,7 @@ ixgb_clean_rx_irq(struct ixgb_adapter *adapter, int *work_done, int work_to_do)
- 			break;
- 
- 		(*work_done)++;
-+		rmb();	/* read descriptor and rx_buffer_info after status DD */
- 		status = rx_desc->status;
- 		skb = buffer_info->skb;
- 		buffer_info->skb = NULL;
-diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
-index 74d9b6d..649c867 100644
---- a/drivers/net/ixgbe/ixgbe_main.c
-+++ b/drivers/net/ixgbe/ixgbe_main.c
-@@ -748,6 +748,7 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
- 	while ((eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)) &&
- 	       (count < tx_ring->work_limit)) {
- 		bool cleaned = false;
-+		rmb(); /* read buffer_info after eop_desc */
- 		for ( ; !cleaned; count++) {
- 			struct sk_buff *skb;
- 			tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
-diff --git a/drivers/net/ixgbevf/ixgbevf_main.c b/drivers/net/ixgbevf/ixgbevf_main.c
-index a16cff7..3ea59f1 100644
---- a/drivers/net/ixgbevf/ixgbevf_main.c
-+++ b/drivers/net/ixgbevf/ixgbevf_main.c
-@@ -231,6 +231,7 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_adapter *adapter,
- 	while ((eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)) &&
- 	       (count < tx_ring->work_limit)) {
- 		bool cleaned = false;
-+		rmb(); /* read buffer_info after eop_desc */
- 		for ( ; !cleaned; count++) {
- 			struct sk_buff *skb;
- 			tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
-@@ -518,6 +519,7 @@ static bool ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector,
- 			break;
- 		(*work_done)++;
- 
-+		rmb(); /* read descriptor and rx_buffer_info after status DD */
- 		if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
- 			hdr_info = le16_to_cpu(ixgbevf_get_hdr_info(rx_desc));
- 			len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
-diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
-index cc55974..7a7b01a 100644
---- a/drivers/net/smsc911x.c
-+++ b/drivers/net/smsc911x.c
-@@ -84,8 +84,7 @@ struct smsc911x_data {
- 	 */
- 	spinlock_t mac_lock;
- 
--	/* spinlock to ensure 16-bit accesses are serialised.
--	 * unused with a 32-bit bus */
-+	/* spinlock to ensure register accesses are serialised */
- 	spinlock_t dev_lock;
- 
- 	struct phy_device *phy_dev;
-@@ -118,37 +117,33 @@ struct smsc911x_data {
- 	unsigned int hashlo;
- };
- 
--/* The 16-bit access functions are significantly slower, due to the locking
-- * necessary.  If your bus hardware can be configured to do this for you
-- * (in response to a single 32-bit operation from software), you should use
-- * the 32-bit access functions instead. */
--
--static inline u32 smsc911x_reg_read(struct smsc911x_data *pdata, u32 reg)
-+static inline u32 __smsc911x_reg_read(struct smsc911x_data *pdata, u32 reg)
- {
- 	if (pdata->config.flags & SMSC911X_USE_32BIT)
- 		return readl(pdata->ioaddr + reg);
- 
--	if (pdata->config.flags & SMSC911X_USE_16BIT) {
--		u32 data;
--		unsigned long flags;
--
--		/* these two 16-bit reads must be performed consecutively, so
--		 * must not be interrupted by our own ISR (which would start
--		 * another read operation) */
--		spin_lock_irqsave(&pdata->dev_lock, flags);
--		data = ((readw(pdata->ioaddr + reg) & 0xFFFF) |
-+	if (pdata->config.flags & SMSC911X_USE_16BIT)
-+		return ((readw(pdata->ioaddr + reg) & 0xFFFF) |
- 			((readw(pdata->ioaddr + reg + 2) & 0xFFFF) << 16));
--		spin_unlock_irqrestore(&pdata->dev_lock, flags);
--
--		return data;
--	}
- 
- 	BUG();
- 	return 0;
- }
- 
--static inline void smsc911x_reg_write(struct smsc911x_data *pdata, u32 reg,
--				      u32 val)
-+static inline u32 smsc911x_reg_read(struct smsc911x_data *pdata, u32 reg)
-+{
-+	u32 data;
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&pdata->dev_lock, flags);
-+	data = __smsc911x_reg_read(pdata, reg);
-+	spin_unlock_irqrestore(&pdata->dev_lock, flags);
-+
-+	return data;
-+}
-+
-+static inline void __smsc911x_reg_write(struct smsc911x_data *pdata, u32 reg,
-+					u32 val)
- {
- 	if (pdata->config.flags & SMSC911X_USE_32BIT) {
- 		writel(val, pdata->ioaddr + reg);
-@@ -156,44 +151,54 @@ static inline void smsc911x_reg_write(struct smsc911x_data *pdata, u32 reg,
- 	}
- 
- 	if (pdata->config.flags & SMSC911X_USE_16BIT) {
--		unsigned long flags;
--
--		/* these two 16-bit writes must be performed consecutively, so
--		 * must not be interrupted by our own ISR (which would start
--		 * another read operation) */
--		spin_lock_irqsave(&pdata->dev_lock, flags);
- 		writew(val & 0xFFFF, pdata->ioaddr + reg);
- 		writew((val >> 16) & 0xFFFF, pdata->ioaddr + reg + 2);
--		spin_unlock_irqrestore(&pdata->dev_lock, flags);
- 		return;
- 	}
- 
- 	BUG();
- }
- 
-+static inline void smsc911x_reg_write(struct smsc911x_data *pdata, u32 reg,
-+				      u32 val)
-+{
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&pdata->dev_lock, flags);
-+	__smsc911x_reg_write(pdata, reg, val);
-+	spin_unlock_irqrestore(&pdata->dev_lock, flags);
-+}
-+
- /* Writes a packet to the TX_DATA_FIFO */
- static inline void
- smsc911x_tx_writefifo(struct smsc911x_data *pdata, unsigned int *buf,
- 		      unsigned int wordcount)
- {
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&pdata->dev_lock, flags);
-+
- 	if (pdata->config.flags & SMSC911X_SWAP_FIFO) {
- 		while (wordcount--)
--			smsc911x_reg_write(pdata, TX_DATA_FIFO, swab32(*buf++));
--		return;
-+			__smsc911x_reg_write(pdata, TX_DATA_FIFO,
-+					     swab32(*buf++));
-+		goto out;
- 	}
- 
- 	if (pdata->config.flags & SMSC911X_USE_32BIT) {
- 		writesl(pdata->ioaddr + TX_DATA_FIFO, buf, wordcount);
--		return;
-+		goto out;
- 	}
- 
- 	if (pdata->config.flags & SMSC911X_USE_16BIT) {
- 		while (wordcount--)
--			smsc911x_reg_write(pdata, TX_DATA_FIFO, *buf++);
--		return;
-+			__smsc911x_reg_write(pdata, TX_DATA_FIFO, *buf++);
-+		goto out;
- 	}
- 
- 	BUG();
-+out:
-+	spin_unlock_irqrestore(&pdata->dev_lock, flags);
- }
- 
- /* Reads a packet out of the RX_DATA_FIFO */
-@@ -201,24 +206,31 @@ static inline void
- smsc911x_rx_readfifo(struct smsc911x_data *pdata, unsigned int *buf,
- 		     unsigned int wordcount)
- {
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&pdata->dev_lock, flags);
-+
- 	if (pdata->config.flags & SMSC911X_SWAP_FIFO) {
- 		while (wordcount--)
--			*buf++ = swab32(smsc911x_reg_read(pdata, RX_DATA_FIFO));
--		return;
-+			*buf++ = swab32(__smsc911x_reg_read(pdata,
-+							    RX_DATA_FIFO));
-+		goto out;
- 	}
- 
- 	if (pdata->config.flags & SMSC911X_USE_32BIT) {
- 		readsl(pdata->ioaddr + RX_DATA_FIFO, buf, wordcount);
--		return;
-+		goto out;
- 	}
- 
- 	if (pdata->config.flags & SMSC911X_USE_16BIT) {
- 		while (wordcount--)
--			*buf++ = smsc911x_reg_read(pdata, RX_DATA_FIFO);
--		return;
-+			*buf++ = __smsc911x_reg_read(pdata, RX_DATA_FIFO);
-+		goto out;
- 	}
- 
- 	BUG();
-+out:
-+	spin_unlock_irqrestore(&pdata->dev_lock, flags);
- }
- 
- /* waits for MAC not busy, with timeout.  Only called by smsc911x_mac_read
-diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
-index ae7319b..4cf864c 100644
---- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
-+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
-@@ -193,7 +193,7 @@ TRACE_EVENT(iwlwifi_dev_tx,
- 		__entry->framelen = buf0_len + buf1_len;
- 		memcpy(__get_dynamic_array(tfd), tfd, tfdlen);
- 		memcpy(__get_dynamic_array(buf0), buf0, buf0_len);
--		memcpy(__get_dynamic_array(buf1), buf1, buf0_len);
-+		memcpy(__get_dynamic_array(buf1), buf1, buf1_len);
- 	),
- 	TP_printk("[%p] TX %.2x (%zu bytes)",
- 		  __entry->priv,
-diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
-index 515817d..15f09e8 100644
---- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
-+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
-@@ -688,6 +688,8 @@ void rtl8180_beacon_work(struct work_struct *work)
- 
- 	/* grab a fresh beacon */
- 	skb = ieee80211_beacon_get(dev, vif);
-+	if (!skb)
-+		goto resched;
- 
- 	/*
- 	 * update beacon timestamp w/ TSF value
-diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
-index c9171be..435fbbc 100644
---- a/drivers/pci/intel-iommu.c
-+++ b/drivers/pci/intel-iommu.c
-@@ -3030,6 +3030,34 @@ static void __init iommu_exit_mempool(void)
- 
- }
- 
-+static void quirk_ioat_snb_local_iommu(struct pci_dev *pdev)
-+{
-+	struct dmar_drhd_unit *drhd;
-+	u32 vtbar;
-+	int rc;
-+
-+	/* We know that this device on this chipset has its own IOMMU.
-+	 * If we find it under a different IOMMU, then the BIOS is lying
-+	 * to us. Hope that the IOMMU for this device is actually
-+	 * disabled, and it needs no translation...
-+	 */
-+	rc = pci_bus_read_config_dword(pdev->bus, PCI_DEVFN(0, 0), 0xb0, &vtbar);
-+	if (rc) {
-+		/* "can't" happen */
-+		dev_info(&pdev->dev, "failed to run vt-d quirk\n");
-+		return;
-+	}
-+	vtbar &= 0xffff0000;
-+
-+	/* we know that the this iommu should be at offset 0xa000 from vtbar */
-+	drhd = dmar_find_matched_drhd_unit(pdev);
-+	if (WARN_TAINT_ONCE(!drhd || drhd->reg_base_addr - vtbar != 0xa000,
-+			    TAINT_FIRMWARE_WORKAROUND,
-+			    "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n"))
-+		pdev->dev.archdata.iommu = DUMMY_DEVICE_DOMAIN_INFO;
-+}
-+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_SNB, quirk_ioat_snb_local_iommu);
-+
- static void __init init_no_remapping_devices(void)
- {
- 	struct dmar_drhd_unit *drhd;
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 477345d..e28524e 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -2115,6 +2115,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS480, quirk_disabl
- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3336, quirk_disable_all_msi);
- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3351, quirk_disable_all_msi);
- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3364, quirk_disable_all_msi);
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8380_0, quirk_disable_all_msi);
- 
- /* Disable MSI on chipsets that are known to not support it */
- static void __devinit quirk_disable_msi(struct pci_dev *dev)
-@@ -2390,6 +2391,9 @@ static void __devinit __nv_msi_ht_cap_quirk(struct pci_dev *dev, int all)
- 	int pos;
- 	int found;
- 
-+	if (!pci_msi_enabled())
-+		return;
-+
- 	/* check if there is HT MSI cap or enabled on this device */
- 	found = ht_check_msi_mapping(dev);
- 
-diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
-index a4cd9ad..015e274 100644
---- a/drivers/pcmcia/pcmcia_resource.c
-+++ b/drivers/pcmcia/pcmcia_resource.c
-@@ -651,7 +651,7 @@ EXPORT_SYMBOL(__pcmcia_request_exclusive_irq);
- #ifdef CONFIG_PCMCIA_PROBE
- 
- /* mask of IRQs already reserved by other cards, we should avoid using them */
--static u8 pcmcia_used_irq[NR_IRQS];
-+static u8 pcmcia_used_irq[32];
- 
- static irqreturn_t test_action(int cpl, void *dev_id)
- {
-@@ -674,6 +674,9 @@ static int pcmcia_setup_isa_irq(struct pcmcia_device *p_dev, int type)
- 	for (try = 0; try < 64; try++) {
- 		irq = try % 32;
- 
-+		if (irq > NR_IRQS)
-+			continue;
-+
- 		/* marked as available by driver, not blocked by userspace? */
- 		if (!((mask >> irq) & 1))
- 			continue;
-diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
-index 746a446..53be4d3 100644
---- a/drivers/serial/8250_pci.c
-+++ b/drivers/serial/8250_pci.c
-@@ -994,6 +994,7 @@ static int skip_tx_en_setup(struct serial_private *priv,
- #define PCI_DEVICE_ID_TITAN_800E	0xA014
- #define PCI_DEVICE_ID_TITAN_200EI	0xA016
- #define PCI_DEVICE_ID_TITAN_200EISI	0xA017
-+#define PCI_DEVICE_ID_OXSEMI_16PCI958	0x9538
- 
- /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
- #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584	0x1584
-@@ -1542,6 +1543,8 @@ enum pci_board_num_t {
- 	pbn_b2_4_921600,
- 	pbn_b2_8_921600,
- 
-+	pbn_b2_8_1152000,
-+
- 	pbn_b2_bt_1_115200,
- 	pbn_b2_bt_2_115200,
- 	pbn_b2_bt_4_115200,
-@@ -1960,6 +1963,13 @@ static struct pciserial_board pci_boards[] __devinitdata = {
- 		.uart_offset	= 8,
- 	},
- 
-+	[pbn_b2_8_1152000] = {
-+		.flags		= FL_BASE2,
-+		.num_ports	= 8,
-+		.base_baud	= 1152000,
-+		.uart_offset	= 8,
-+	},
-+
- 	[pbn_b2_bt_1_115200] = {
- 		.flags		= FL_BASE2|FL_BASE_BARS,
- 		.num_ports	= 1,
-@@ -2875,6 +2885,9 @@ static struct pci_device_id serial_pci_tbl[] = {
- 	{	PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI952,
- 		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- 		pbn_b0_bt_2_921600 },
-+	{	PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI958,
-+		PCI_ANY_ID , PCI_ANY_ID, 0, 0,
-+		pbn_b2_8_1152000 },
- 
- 	/*
- 	 * Oxford Semiconductor Inc. Tornado PCI express device range.
-diff --git a/drivers/staging/hv/Kconfig b/drivers/staging/hv/Kconfig
-index 97480f5..7455c80 100644
---- a/drivers/staging/hv/Kconfig
-+++ b/drivers/staging/hv/Kconfig
-@@ -17,7 +17,7 @@ config HYPERV_STORAGE
- 
- config HYPERV_BLOCK
- 	tristate "Microsoft Hyper-V virtual block driver"
--	depends on BLOCK && SCSI && LBDAF
-+	depends on BLOCK && SCSI && (LBDAF || 64BIT)
- 	default HYPERV
- 	help
- 	  Select this option to enable the Hyper-V virtual block driver.
-diff --git a/drivers/staging/line6/Kconfig b/drivers/staging/line6/Kconfig
-index 7852d4a..bc1ffbe 100644
---- a/drivers/staging/line6/Kconfig
-+++ b/drivers/staging/line6/Kconfig
-@@ -2,6 +2,7 @@ config LINE6_USB
- 	tristate "Line6 USB support"
- 	depends on USB && SND
- 	select SND_RAWMIDI
-+	select SND_PCM
- 	help
- 	  This is a driver for the guitar amp, cab, and effects modeller
- 	  PODxt Pro by Line6 (and similar devices), supporting the
-diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
-index 9ca0e9e..6474c3a 100644
---- a/drivers/staging/panel/panel.c
-+++ b/drivers/staging/panel/panel.c
-@@ -2179,6 +2179,7 @@ int panel_init(void)
- 		if (pprt) {
- 			parport_release(pprt);
- 			parport_unregister_device(pprt);
-+			pprt = NULL;
- 		}
- 		parport_unregister_driver(&panel_driver);
- 		printk(KERN_ERR "Panel driver version " PANEL_VERSION
-@@ -2228,6 +2229,7 @@ static void __exit panel_cleanup_module(void)
- 		/* TODO: free all input signals */
- 		parport_release(pprt);
- 		parport_unregister_device(pprt);
-+		pprt = NULL;
- 	}
- 	parport_unregister_driver(&panel_driver);
- }
-diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
-index 674769d..c48e85d 100644
---- a/drivers/staging/rt2860/usb_main_dev.c
-+++ b/drivers/staging/rt2860/usb_main_dev.c
-@@ -64,6 +64,7 @@ struct usb_device_id rtusb_usb_id[] = {
- 	{USB_DEVICE(0x14B2, 0x3C07)},	/* AL */
- 	{USB_DEVICE(0x050D, 0x8053)},	/* Belkin */
- 	{USB_DEVICE(0x050D, 0x825B)},	/* Belkin */
-+	{USB_DEVICE(0x050D, 0x935B)},	/* Belkin F6D4050 v2 */
- 	{USB_DEVICE(0x14B2, 0x3C23)},	/* Airlink */
- 	{USB_DEVICE(0x14B2, 0x3C27)},	/* Airlink */
- 	{USB_DEVICE(0x07AA, 0x002F)},	/* Corega */
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 70cccc7..ffc80e3 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -20,6 +20,7 @@
- #include <linux/usb.h>
- #include <linux/usbdevice_fs.h>
- #include <linux/usb/hcd.h>
-+#include <linux/usb/quirks.h>
- #include <linux/kthread.h>
- #include <linux/mutex.h>
- #include <linux/freezer.h>
-@@ -1801,7 +1802,6 @@ int usb_new_device(struct usb_device *udev)
- 	pm_runtime_set_active(&udev->dev);
- 	pm_runtime_enable(&udev->dev);
- 
--	usb_detect_quirks(udev);
- 	err = usb_enumerate_device(udev);	/* Read descriptors */
- 	if (err < 0)
- 		goto fail;
-@@ -3111,6 +3111,10 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
- 		if (status < 0)
- 			goto loop;
- 
-+		usb_detect_quirks(udev);
-+		if (udev->quirks & USB_QUIRK_DELAY_INIT)
-+			msleep(1000);
-+
- 		/* consecutive bus-powered hubs aren't reliable; they can
- 		 * violate the voltage drop budget.  if the new child has
- 		 * a "powered" LED, users should notice we didn't enable it
-diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
-index db99c08..25719da 100644
---- a/drivers/usb/core/quirks.c
-+++ b/drivers/usb/core/quirks.c
-@@ -38,6 +38,9 @@ static const struct usb_device_id usb_quirk_list[] = {
- 	/* Creative SB Audigy 2 NX */
- 	{ USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
- 
-+	/* Logitech Harmony 700-series */
-+	{ USB_DEVICE(0x046d, 0xc122), .driver_info = USB_QUIRK_DELAY_INIT },
-+
- 	/* Philips PSC805 audio device */
- 	{ USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
- 
-diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
-index 7c05555..419e6b3 100644
---- a/drivers/usb/core/urb.c
-+++ b/drivers/usb/core/urb.c
-@@ -137,6 +137,16 @@ void usb_anchor_urb(struct urb *urb, struct usb_anchor *anchor)
- }
- EXPORT_SYMBOL_GPL(usb_anchor_urb);
- 
-+/* Callers must hold anchor->lock */
-+static void __usb_unanchor_urb(struct urb *urb, struct usb_anchor *anchor)
-+{
-+	urb->anchor = NULL;
-+	list_del(&urb->anchor_list);
-+	usb_put_urb(urb);
-+	if (list_empty(&anchor->urb_list))
-+		wake_up(&anchor->wait);
-+}
-+
- /**
-  * usb_unanchor_urb - unanchors an URB
-  * @urb: pointer to the urb to anchor
-@@ -156,17 +166,14 @@ void usb_unanchor_urb(struct urb *urb)
- 		return;
- 
- 	spin_lock_irqsave(&anchor->lock, flags);
--	if (unlikely(anchor != urb->anchor)) {
--		/* we've lost the race to another thread */
--		spin_unlock_irqrestore(&anchor->lock, flags);
--		return;
--	}
--	urb->anchor = NULL;
--	list_del(&urb->anchor_list);
-+	/*
-+	 * At this point, we could be competing with another thread which
-+	 * has the same intention. To protect the urb from being unanchored
-+	 * twice, only the winner of the race gets the job.
-+	 */
-+	if (likely(anchor == urb->anchor))
-+		__usb_unanchor_urb(urb, anchor);
- 	spin_unlock_irqrestore(&anchor->lock, flags);
--	usb_put_urb(urb);
--	if (list_empty(&anchor->urb_list))
--		wake_up(&anchor->wait);
- }
- EXPORT_SYMBOL_GPL(usb_unanchor_urb);
- 
-@@ -749,20 +756,11 @@ EXPORT_SYMBOL_GPL(usb_unpoison_anchored_urbs);
- void usb_unlink_anchored_urbs(struct usb_anchor *anchor)
- {
- 	struct urb *victim;
--	unsigned long flags;
- 
--	spin_lock_irqsave(&anchor->lock, flags);
--	while (!list_empty(&anchor->urb_list)) {
--		victim = list_entry(anchor->urb_list.prev, struct urb,
--				    anchor_list);
--		usb_get_urb(victim);
--		spin_unlock_irqrestore(&anchor->lock, flags);
--		/* this will unanchor the URB */
-+	while ((victim = usb_get_from_anchor(anchor)) != NULL) {
- 		usb_unlink_urb(victim);
- 		usb_put_urb(victim);
--		spin_lock_irqsave(&anchor->lock, flags);
- 	}
--	spin_unlock_irqrestore(&anchor->lock, flags);
- }
- EXPORT_SYMBOL_GPL(usb_unlink_anchored_urbs);
- 
-@@ -799,12 +797,11 @@ struct urb *usb_get_from_anchor(struct usb_anchor *anchor)
- 		victim = list_entry(anchor->urb_list.next, struct urb,
- 				    anchor_list);
- 		usb_get_urb(victim);
--		spin_unlock_irqrestore(&anchor->lock, flags);
--		usb_unanchor_urb(victim);
-+		__usb_unanchor_urb(victim, anchor);
- 	} else {
--		spin_unlock_irqrestore(&anchor->lock, flags);
- 		victim = NULL;
- 	}
-+	spin_unlock_irqrestore(&anchor->lock, flags);
- 
- 	return victim;
- }
-@@ -826,12 +823,7 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor)
- 	while (!list_empty(&anchor->urb_list)) {
- 		victim = list_entry(anchor->urb_list.prev, struct urb,
- 				    anchor_list);
--		usb_get_urb(victim);
--		spin_unlock_irqrestore(&anchor->lock, flags);
--		/* this may free the URB */
--		usb_unanchor_urb(victim);
--		usb_put_urb(victim);
--		spin_lock_irqsave(&anchor->lock, flags);
-+		__usb_unanchor_urb(victim, anchor);
- 	}
- 	spin_unlock_irqrestore(&anchor->lock, flags);
- }
-diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
-index d43d176..19f5070 100644
---- a/drivers/usb/host/ehci-pci.c
-+++ b/drivers/usb/host/ehci-pci.c
-@@ -114,6 +114,7 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
- 		break;
- 	case PCI_VENDOR_ID_INTEL:
- 		ehci->need_io_watchdog = 0;
-+		ehci->fs_i_thresh = 1;
- 		if (pdev->device == 0x27cc) {
- 			ehci->broken_periodic = 1;
- 			ehci_info(ehci, "using broken periodic workaround\n");
-diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
-index 805ec63..93f58e5 100644
---- a/drivers/usb/host/ehci-sched.c
-+++ b/drivers/usb/host/ehci-sched.c
-@@ -1400,7 +1400,6 @@ iso_stream_schedule (
- 	int			status;
- 	unsigned		mod = ehci->periodic_size << 3;
- 	struct ehci_iso_sched	*sched = urb->hcpriv;
--	struct pci_dev		*pdev;
- 
- 	if (sched->span > (mod - SCHEDULE_SLOP)) {
- 		ehci_dbg (ehci, "iso request %p too long\n", urb);
-@@ -1427,15 +1426,14 @@ iso_stream_schedule (
- 	 * slot in the schedule, implicitly assuming URB_ISO_ASAP.
- 	 */
- 	if (likely (!list_empty (&stream->td_list))) {
--		pdev = to_pci_dev(ehci_to_hcd(ehci)->self.controller);
- 		start = stream->next_uframe;
- 
- 		/* For high speed devices, allow scheduling within the
--		 * isochronous scheduling threshold.  For full speed devices,
--		 * don't. (Work around for Intel ICH9 bug.)
-+		 * isochronous scheduling threshold.  For full speed devices
-+		 * and Intel PCI-based controllers, don't (work around for
-+		 * Intel ICH9 bug).
- 		 */
--		if (!stream->highspeed &&
--				pdev->vendor == PCI_VENDOR_ID_INTEL)
-+		if (!stream->highspeed && ehci->fs_i_thresh)
- 			next = now + ehci->i_thresh;
- 		else
- 			next = now;
-diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
-index 650a687..8b3d9c8 100644
---- a/drivers/usb/host/ehci.h
-+++ b/drivers/usb/host/ehci.h
-@@ -130,6 +130,7 @@ struct ehci_hcd {			/* one per controller */
- 	unsigned		has_amcc_usb23:1;
- 	unsigned		need_io_watchdog:1;
- 	unsigned		broken_periodic:1;
-+	unsigned		fs_i_thresh:1;	/* Intel iso scheduling */
- 
- 	/* required for usb32 quirk */
- 	#define OHCI_CTRL_HCFS          (3 << 6)
-diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
-index 16dffe9..c3049c7 100644
---- a/drivers/usb/misc/usbtest.c
-+++ b/drivers/usb/misc/usbtest.c
-@@ -1378,7 +1378,6 @@ static void iso_callback (struct urb *urb)
- 			break;
- 		}
- 	}
--	simple_free_urb (urb);
- 
- 	ctx->pending--;
- 	if (ctx->pending == 0) {
-@@ -1495,6 +1494,7 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
- 			}
- 
- 			simple_free_urb (urbs [i]);
-+			urbs[i] = NULL;
- 			context.pending--;
- 			context.submit_error = 1;
- 			break;
-@@ -1504,6 +1504,10 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
- 
- 	wait_for_completion (&context.done);
- 
-+	for (i = 0; i < param->sglen; i++) {
-+		if (urbs[i])
-+			simple_free_urb(urbs[i]);
-+	}
- 	/*
- 	 * Isochronous transfers are expected to fail sometimes.  As an
- 	 * arbitrary limit, we will report an error if any submissions
-diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
-index 61c76b1..56c93ca 100644
---- a/drivers/usb/mon/mon_bin.c
-+++ b/drivers/usb/mon/mon_bin.c
-@@ -1009,7 +1009,7 @@ static int mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- 
- 		mutex_lock(&rp->fetch_lock);
- 		spin_lock_irqsave(&rp->b_lock, flags);
--		mon_free_buff(rp->b_vec, size/CHUNK_SIZE);
-+		mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE);
- 		kfree(rp->b_vec);
- 		rp->b_vec  = vec;
- 		rp->b_size = size;
-diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
-index bba76af..c79a5e3 100644
---- a/drivers/usb/musb/musb_debugfs.c
-+++ b/drivers/usb/musb/musb_debugfs.c
-@@ -92,29 +92,29 @@ static const struct musb_register_map musb_regmap[] = {
- 	{ "LS_EOF1",		0x7E,	8 },
- 	{ "SOFT_RST",		0x7F,	8 },
- 	{ "DMA_CNTLch0",	0x204,	16 },
--	{ "DMA_ADDRch0",	0x208,	16 },
--	{ "DMA_COUNTch0",	0x20C,	16 },
-+	{ "DMA_ADDRch0",	0x208,	32 },
-+	{ "DMA_COUNTch0",	0x20C,	32 },
- 	{ "DMA_CNTLch1",	0x214,	16 },
--	{ "DMA_ADDRch1",	0x218,	16 },
--	{ "DMA_COUNTch1",	0x21C,	16 },
-+	{ "DMA_ADDRch1",	0x218,	32 },
-+	{ "DMA_COUNTch1",	0x21C,	32 },
- 	{ "DMA_CNTLch2",	0x224,	16 },
--	{ "DMA_ADDRch2",	0x228,	16 },
--	{ "DMA_COUNTch2",	0x22C,	16 },
-+	{ "DMA_ADDRch2",	0x228,	32 },
-+	{ "DMA_COUNTch2",	0x22C,	32 },
- 	{ "DMA_CNTLch3",	0x234,	16 },
--	{ "DMA_ADDRch3",	0x238,	16 },
--	{ "DMA_COUNTch3",	0x23C,	16 },
-+	{ "DMA_ADDRch3",	0x238,	32 },
-+	{ "DMA_COUNTch3",	0x23C,	32 },
- 	{ "DMA_CNTLch4",	0x244,	16 },
--	{ "DMA_ADDRch4",	0x248,	16 },
--	{ "DMA_COUNTch4",	0x24C,	16 },
-+	{ "DMA_ADDRch4",	0x248,	32 },
-+	{ "DMA_COUNTch4",	0x24C,	32 },
- 	{ "DMA_CNTLch5",	0x254,	16 },
--	{ "DMA_ADDRch5",	0x258,	16 },
--	{ "DMA_COUNTch5",	0x25C,	16 },
-+	{ "DMA_ADDRch5",	0x258,	32 },
-+	{ "DMA_COUNTch5",	0x25C,	32 },
- 	{ "DMA_CNTLch6",	0x264,	16 },
--	{ "DMA_ADDRch6",	0x268,	16 },
--	{ "DMA_COUNTch6",	0x26C,	16 },
-+	{ "DMA_ADDRch6",	0x268,	32 },
-+	{ "DMA_COUNTch6",	0x26C,	32 },
- 	{ "DMA_CNTLch7",	0x274,	16 },
--	{ "DMA_ADDRch7",	0x278,	16 },
--	{ "DMA_COUNTch7",	0x27C,	16 },
-+	{ "DMA_ADDRch7",	0x278,	32 },
-+	{ "DMA_COUNTch7",	0x27C,	32 },
- 	{  }	/* Terminating Entry */
- };
- 
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 8b8c797..2bef441 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -126,6 +126,10 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
- 	{ USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
- 	{ USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
-+	{ USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
-+	{ USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
-+	{ USB_DEVICE(0x16DC, 0x0012) }, /* W-IE-NE-R Plein & Baus GmbH MPOD Multi Channel Power Supply */
-+	{ USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */
- 	{ } /* Terminating Entry */
- };
- 
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index e298dc4..eb12d9b 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -157,6 +157,9 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_5_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_6_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_7_PID) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_USINT_CAT_PID) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_USINT_WKEY_PID) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_USINT_RS232_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_ACTZWAVE_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
-@@ -746,6 +749,7 @@ static struct usb_device_id id_table_combined [] = {
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+	{ USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) },
- 	{ },					/* Optional parameter entry */
- 	{ }					/* Terminating entry */
- };
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index d01946d..6e612c5 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -40,6 +40,11 @@
- 
- #define FTDI_NXTCAM_PID		0xABB8 /* NXTCam for Mindstorms NXT */
- 
-+/* US Interface Navigator (http://www.usinterface.com/) */
-+#define FTDI_USINT_CAT_PID	0xb810	/* Navigator CAT and 2nd PTT lines */
-+#define FTDI_USINT_WKEY_PID	0xb811	/* Navigator WKEY and FSK lines */
-+#define FTDI_USINT_RS232_PID	0xb812	/* Navigator RS232 and CONFIG lines */
-+
- /* OOCDlink by Joern Kaipf <joernk@web.de>
-  * (http://www.joernonline.de/dw/doku.php?id=start&idx=projects:oocdlink) */
- #define FTDI_OOCDLINK_PID	0xbaf8	/* Amontec JTAGkey */
-@@ -1032,3 +1037,8 @@
- #define XVERVE_SIGNALYZER_SH2_PID	0xBCA2
- #define XVERVE_SIGNALYZER_SH4_PID	0xBCA4
- 
-+/*
-+ * Segway Robotic Mobility Platform USB interface (using VID 0x0403)
-+ * Submitted by John G. Rogers
-+ */
-+#define SEGWAY_RMP200_PID	0xe729
-diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
-index a817ced..ca92f67 100644
---- a/drivers/usb/serial/generic.c
-+++ b/drivers/usb/serial/generic.c
-@@ -208,18 +208,23 @@ retry:
- 	urb->transfer_buffer_length = count;
- 	usb_serial_debug_data(debug, &port->dev, __func__, count,
- 						urb->transfer_buffer);
-+	spin_lock_irqsave(&port->lock, flags);
-+	port->tx_bytes += count;
-+	spin_unlock_irqrestore(&port->lock, flags);
-+
-+	clear_bit(i, &port->write_urbs_free);
- 	result = usb_submit_urb(urb, GFP_ATOMIC);
- 	if (result) {
- 		dev_err(&port->dev, "%s - error submitting urb: %d\n",
- 						__func__, result);
-+		set_bit(i, &port->write_urbs_free);
-+		spin_lock_irqsave(&port->lock, flags);
-+		port->tx_bytes -= count;
-+		spin_unlock_irqrestore(&port->lock, flags);
-+
- 		clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
- 		return result;
- 	}
--	clear_bit(i, &port->write_urbs_free);
--
--	spin_lock_irqsave(&port->lock, flags);
--	port->tx_bytes += count;
--	spin_unlock_irqrestore(&port->lock, flags);
- 
- 	/* Try sending off another urb, unless in irq context (in which case
- 	 * there will be no free urb). */
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 5cd30e4..5c35b3a 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -145,7 +145,10 @@ static void option_instat_callback(struct urb *urb);
- #define HUAWEI_PRODUCT_E143D			0x143D
- #define HUAWEI_PRODUCT_E143E			0x143E
- #define HUAWEI_PRODUCT_E143F			0x143F
-+#define HUAWEI_PRODUCT_K4505			0x1464
-+#define HUAWEI_PRODUCT_K3765			0x1465
- #define HUAWEI_PRODUCT_E14AC			0x14AC
-+#define HUAWEI_PRODUCT_ETS1220			0x1803
- 
- #define QUANTA_VENDOR_ID			0x0408
- #define QUANTA_PRODUCT_Q101			0xEA02
-@@ -482,6 +485,9 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
- 	{ USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC) },
- 	{ USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_9508) },
- 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, /* Novatel Merlin V640/XV620 */
-@@ -1017,6 +1023,13 @@ static int option_probe(struct usb_serial *serial,
- 		serial->interface->cur_altsetting->desc.bInterfaceClass != 0xff)
- 		return -ENODEV;
- 
-+	/* Don't bind network interfaces on Huawei K3765 & K4505 */
-+	if (serial->dev->descriptor.idVendor == HUAWEI_VENDOR_ID &&
-+		(serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K3765 ||
-+			serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K4505) &&
-+		serial->interface->cur_altsetting->desc.bInterfaceNumber == 1)
-+		return -ENODEV;
-+
- 	data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private), GFP_KERNEL);
- 
- 	if (!data)
-diff --git a/drivers/video/w100fb.c b/drivers/video/w100fb.c
-index e66b8b1..d8b12c3 100644
---- a/drivers/video/w100fb.c
-+++ b/drivers/video/w100fb.c
-@@ -858,9 +858,9 @@ unsigned long w100fb_gpio_read(int port)
- void w100fb_gpio_write(int port, unsigned long value)
- {
- 	if (port==W100_GPIO_PORT_A)
--		value = writel(value, remapped_regs + mmGPIO_DATA);
-+		writel(value, remapped_regs + mmGPIO_DATA);
- 	else
--		value = writel(value, remapped_regs + mmGPIO_DATA2);
-+		writel(value, remapped_regs + mmGPIO_DATA2);
- }
- EXPORT_SYMBOL(w100fb_gpio_read);
- EXPORT_SYMBOL(w100fb_gpio_write);
-diff --git a/drivers/xen/events.c b/drivers/xen/events.c
-index db8f506..28f133a 100644
---- a/drivers/xen/events.c
-+++ b/drivers/xen/events.c
-@@ -536,6 +536,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
- 	if (irq < 0)
- 		return irq;
- 
-+	irqflags |= IRQF_NO_SUSPEND;
- 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
- 	if (retval != 0) {
- 		unbind_from_irq(irq);
-diff --git a/fs/block_dev.c b/fs/block_dev.c
-index b3171fb..4c54c86 100644
---- a/fs/block_dev.c
-+++ b/fs/block_dev.c
-@@ -1339,10 +1339,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
- 	/*
- 	 * hooks: /n/, see "layering violations".
- 	 */
--	ret = devcgroup_inode_permission(bdev->bd_inode, perm);
--	if (ret != 0) {
--		bdput(bdev);
--		return ret;
-+	if (!for_part) {
-+		ret = devcgroup_inode_permission(bdev->bd_inode, perm);
-+		if (ret != 0) {
-+			bdput(bdev);
-+			return ret;
-+		}
- 	}
- 
- 	lock_kernel();
-diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
-index e8fcf4e..622c9514 100644
---- a/fs/ecryptfs/file.c
-+++ b/fs/ecryptfs/file.c
-@@ -199,7 +199,7 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
- 			       "the persistent file for the dentry with name "
- 			       "[%s]; rc = [%d]\n", __func__,
- 			       ecryptfs_dentry->d_name.name, rc);
--			goto out;
-+			goto out_free;
- 		}
- 	}
- 	if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_RDONLY)
-@@ -207,7 +207,7 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
- 		rc = -EPERM;
- 		printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs "
- 		       "file must hence be opened RO\n", __func__);
--		goto out;
-+		goto out_free;
- 	}
- 	ecryptfs_set_file_lower(
- 		file, ecryptfs_inode_to_private(inode)->lower_file);
-@@ -292,12 +292,40 @@ static int ecryptfs_fasync(int fd, struct file *file, int flag)
- 	return rc;
- }
- 
--static int ecryptfs_ioctl(struct inode *inode, struct file *file,
--			  unsigned int cmd, unsigned long arg);
-+static long
-+ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-+{
-+	struct file *lower_file = NULL;
-+	long rc = -ENOTTY;
-+
-+	if (ecryptfs_file_to_private(file))
-+		lower_file = ecryptfs_file_to_lower(file);
-+	if (lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl)
-+		rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
-+	return rc;
-+}
-+
-+#ifdef CONFIG_COMPAT
-+static long
-+ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-+{
-+	struct file *lower_file = NULL;
-+	long rc = -ENOIOCTLCMD;
-+
-+	if (ecryptfs_file_to_private(file))
-+		lower_file = ecryptfs_file_to_lower(file);
-+	if (lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl)
-+		rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
-+	return rc;
-+}
-+#endif
- 
- const struct file_operations ecryptfs_dir_fops = {
- 	.readdir = ecryptfs_readdir,
--	.ioctl = ecryptfs_ioctl,
-+	.unlocked_ioctl = ecryptfs_unlocked_ioctl,
-+#ifdef CONFIG_COMPAT
-+	.compat_ioctl = ecryptfs_compat_ioctl,
-+#endif
- 	.open = ecryptfs_open,
- 	.flush = ecryptfs_flush,
- 	.release = ecryptfs_release,
-@@ -313,7 +341,10 @@ const struct file_operations ecryptfs_main_fops = {
- 	.write = do_sync_write,
- 	.aio_write = generic_file_aio_write,
- 	.readdir = ecryptfs_readdir,
--	.ioctl = ecryptfs_ioctl,
-+	.unlocked_ioctl = ecryptfs_unlocked_ioctl,
-+#ifdef CONFIG_COMPAT
-+	.compat_ioctl = ecryptfs_compat_ioctl,
-+#endif
- 	.mmap = generic_file_mmap,
- 	.open = ecryptfs_open,
- 	.flush = ecryptfs_flush,
-@@ -322,20 +353,3 @@ const struct file_operations ecryptfs_main_fops = {
- 	.fasync = ecryptfs_fasync,
- 	.splice_read = generic_file_splice_read,
- };
--
--static int
--ecryptfs_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
--	       unsigned long arg)
--{
--	int rc = 0;
--	struct file *lower_file = NULL;
--
--	if (ecryptfs_file_to_private(file))
--		lower_file = ecryptfs_file_to_lower(file);
--	if (lower_file && lower_file->f_op && lower_file->f_op->ioctl)
--		rc = lower_file->f_op->ioctl(ecryptfs_inode_to_lower(inode),
--					     lower_file, cmd, arg);
--	else
--		rc = -ENOTTY;
--	return rc;
--}
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index 31ef525..8cd617b 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -264,7 +264,7 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
- 		printk(KERN_ERR "%s: Out of memory whilst attempting "
- 		       "to allocate ecryptfs_dentry_info struct\n",
- 			__func__);
--		goto out_dput;
-+		goto out_put;
- 	}
- 	ecryptfs_set_dentry_lower(ecryptfs_dentry, lower_dentry);
- 	ecryptfs_set_dentry_lower_mnt(ecryptfs_dentry, lower_mnt);
-@@ -339,8 +339,9 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
- out_free_kmem:
- 	kmem_cache_free(ecryptfs_header_cache_2, page_virt);
- 	goto out;
--out_dput:
-+out_put:
- 	dput(lower_dentry);
-+	mntput(lower_mnt);
- 	d_drop(ecryptfs_dentry);
- out:
- 	return rc;
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 4e8983a..a45ced9 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -241,7 +241,7 @@ handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
- 	if (sb->s_flags & MS_RDONLY)
- 		return ERR_PTR(-EROFS);
- 
--	vfs_check_frozen(sb, SB_FREEZE_WRITE);
-+	vfs_check_frozen(sb, SB_FREEZE_TRANS);
- 	/* Special case here: if the journal has aborted behind our
- 	 * backs (eg. EIO in the commit thread), then we still need to
- 	 * take the FS itself readonly cleanly. */
-@@ -3491,7 +3491,7 @@ int ext4_force_commit(struct super_block *sb)
- 
- 	journal = EXT4_SB(sb)->s_journal;
- 	if (journal) {
--		vfs_check_frozen(sb, SB_FREEZE_WRITE);
-+		vfs_check_frozen(sb, SB_FREEZE_TRANS);
- 		ret = ext4_journal_force_commit(journal);
- 	}
- 
-diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c
-index fa96bbb..2d7f165 100644
---- a/fs/jfs/xattr.c
-+++ b/fs/jfs/xattr.c
-@@ -86,46 +86,25 @@ struct ea_buffer {
- #define EA_MALLOC	0x0008
- 
- 
-+static int is_known_namespace(const char *name)
-+{
-+	if (strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) &&
-+	    strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
-+	    strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) &&
-+	    strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
-+		return false;
-+
-+	return true;
-+}
-+
- /*
-  * These three routines are used to recognize on-disk extended attributes
-  * that are in a recognized namespace.  If the attribute is not recognized,
-  * "os2." is prepended to the name
-  */
--static inline int is_os2_xattr(struct jfs_ea *ea)
-+static int is_os2_xattr(struct jfs_ea *ea)
- {
--	/*
--	 * Check for "system."
--	 */
--	if ((ea->namelen >= XATTR_SYSTEM_PREFIX_LEN) &&
--	    !strncmp(ea->name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
--		return false;
--	/*
--	 * Check for "user."
--	 */
--	if ((ea->namelen >= XATTR_USER_PREFIX_LEN) &&
--	    !strncmp(ea->name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
--		return false;
--	/*
--	 * Check for "security."
--	 */
--	if ((ea->namelen >= XATTR_SECURITY_PREFIX_LEN) &&
--	    !strncmp(ea->name, XATTR_SECURITY_PREFIX,
--		     XATTR_SECURITY_PREFIX_LEN))
--		return false;
--	/*
--	 * Check for "trusted."
--	 */
--	if ((ea->namelen >= XATTR_TRUSTED_PREFIX_LEN) &&
--	    !strncmp(ea->name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
--		return false;
--	/*
--	 * Add any other valid namespace prefixes here
--	 */
--
--	/*
--	 * We assume it's OS/2's flat namespace
--	 */
--	return true;
-+	return !is_known_namespace(ea->name);
- }
- 
- static inline int name_size(struct jfs_ea *ea)
-@@ -764,13 +743,23 @@ static int can_set_xattr(struct inode *inode, const char *name,
- 	if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
- 		return can_set_system_xattr(inode, name, value, value_len);
- 
-+	if (!strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN)) {
-+		/*
-+		 * This makes sure that we aren't trying to set an
-+		 * attribute in a different namespace by prefixing it
-+		 * with "os2."
-+		 */
-+		if (is_known_namespace(name + XATTR_OS2_PREFIX_LEN))
-+				return -EOPNOTSUPP;
-+		return 0;
-+	}
-+
- 	/*
- 	 * Don't allow setting an attribute in an unknown namespace.
- 	 */
- 	if (strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) &&
- 	    strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) &&
--	    strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
--	    strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN))
-+	    strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
- 		return -EOPNOTSUPP;
- 
- 	return 0;
-@@ -952,19 +941,8 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data,
- 	int xattr_size;
- 	ssize_t size;
- 	int namelen = strlen(name);
--	char *os2name = NULL;
- 	char *value;
- 
--	if (strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) == 0) {
--		os2name = kmalloc(namelen - XATTR_OS2_PREFIX_LEN + 1,
--				  GFP_KERNEL);
--		if (!os2name)
--			return -ENOMEM;
--		strcpy(os2name, name + XATTR_OS2_PREFIX_LEN);
--		name = os2name;
--		namelen -= XATTR_OS2_PREFIX_LEN;
--	}
--
- 	down_read(&JFS_IP(inode)->xattr_sem);
- 
- 	xattr_size = ea_get(inode, &ea_buf, 0);
-@@ -1002,8 +980,6 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data,
-       out:
- 	up_read(&JFS_IP(inode)->xattr_sem);
- 
--	kfree(os2name);
--
- 	return size;
- }
- 
-@@ -1012,6 +988,19 @@ ssize_t jfs_getxattr(struct dentry *dentry, const char *name, void *data,
- {
- 	int err;
- 
-+	if (strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) == 0) {
-+		/*
-+		 * skip past "os2." prefix
-+		 */
-+		name += XATTR_OS2_PREFIX_LEN;
-+		/*
-+		 * Don't allow retrieving properly prefixed attributes
-+		 * by prepending them with "os2."
-+		 */
-+		if (is_known_namespace(name))
-+			return -EOPNOTSUPP;
-+	}
-+
- 	err = __jfs_getxattr(dentry->d_inode, name, data, buf_size);
- 
- 	return err;
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 88058de..32dcd24 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -1984,7 +1984,7 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
- 	if (flags & MS_RDONLY)
- 		mnt_flags |= MNT_READONLY;
- 
--	flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE |
-+	flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
- 		   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
- 		   MS_STRICTATIME);
- 
-diff --git a/fs/signalfd.c b/fs/signalfd.c
-index f329849c..1c5a6ad 100644
---- a/fs/signalfd.c
-+++ b/fs/signalfd.c
-@@ -88,6 +88,7 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
- 		 err |= __put_user(kinfo->si_tid, &uinfo->ssi_tid);
- 		 err |= __put_user(kinfo->si_overrun, &uinfo->ssi_overrun);
- 		 err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
-+		 err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
- 		break;
- 	case __SI_POLL:
- 		err |= __put_user(kinfo->si_band, &uinfo->ssi_band);
-@@ -111,6 +112,7 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
- 		err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
- 		err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
- 		err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
-+		err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
- 		break;
- 	default:
- 		/*
-diff --git a/fs/super.c b/fs/super.c
-index 938119a..c7765bd 100644
---- a/fs/super.c
-+++ b/fs/super.c
-@@ -305,8 +305,13 @@ retry:
- 			if (s) {
- 				up_write(&s->s_umount);
- 				destroy_super(s);
-+				s = NULL;
- 			}
- 			down_write(&old->s_umount);
-+			if (unlikely(!(old->s_flags & MS_BORN))) {
-+				deactivate_locked_super(old);
-+				goto retry;
-+			}
- 			return old;
- 		}
- 	}
-@@ -909,6 +914,7 @@ vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void
- 		goto out_free_secdata;
- 	BUG_ON(!mnt->mnt_sb);
- 	WARN_ON(!mnt->mnt_sb->s_bdi);
-+	mnt->mnt_sb->s_flags |= MS_BORN;
- 
- 	error = security_sb_kern_mount(mnt->mnt_sb, flags, secdata);
- 	if (error)
-diff --git a/include/linux/Kbuild b/include/linux/Kbuild
-index 2fc8e14..9aa9bca 100644
---- a/include/linux/Kbuild
-+++ b/include/linux/Kbuild
-@@ -276,6 +276,7 @@ ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/include/asm/kvm_para.h \
- 		  $(srctree)/include/asm-$(SRCARCH)/kvm_para.h),)
- unifdef-y += kvm_para.h
- endif
-+unifdef-y += l2tp.h
- unifdef-y += llc.h
- unifdef-y += loop.h
- unifdef-y += lp.h
-diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 68ca1b0..f0f447a 100644
---- a/include/linux/fs.h
-+++ b/include/linux/fs.h
-@@ -145,11 +145,11 @@ struct inodes_stat_t {
-  *
-  */
- #define RW_MASK		1
--#define RWA_MASK	2
-+#define RWA_MASK		16
- #define READ 0
- #define WRITE 1
--#define READA 2		/* read-ahead  - don't block if no resources */
--#define SWRITE 3	/* for ll_rw_block() - wait for buffer lock */
-+#define READA			16 /* readahead - don't block if no resources */
-+#define SWRITE			17 /* for ll_rw_block(), wait for buffer lock */
- #define READ_SYNC	(READ | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG))
- #define READ_META	(READ | (1 << BIO_RW_META))
- #define WRITE_SYNC_PLUG	(WRITE | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_NOIDLE))
-@@ -209,6 +209,7 @@ struct inodes_stat_t {
- #define MS_KERNMOUNT	(1<<22) /* this is a kern_mount call */
- #define MS_I_VERSION	(1<<23) /* Update inode I_version field */
- #define MS_STRICTATIME	(1<<24) /* Always perform atime updates */
-+#define MS_BORN		(1<<29)
- #define MS_ACTIVE	(1<<30)
- #define MS_NOUSER	(1<<31)
- 
-diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
-index c233113..a0384a4 100644
---- a/include/linux/interrupt.h
-+++ b/include/linux/interrupt.h
-@@ -53,16 +53,21 @@
-  * IRQF_ONESHOT - Interrupt is not reenabled after the hardirq handler finished.
-  *                Used by threaded interrupts which need to keep the
-  *                irq line disabled until the threaded handler has been run.
-+ * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend
-+ *
-  */
- #define IRQF_DISABLED		0x00000020
- #define IRQF_SAMPLE_RANDOM	0x00000040
- #define IRQF_SHARED		0x00000080
- #define IRQF_PROBE_SHARED	0x00000100
--#define IRQF_TIMER		0x00000200
-+#define __IRQF_TIMER		0x00000200
- #define IRQF_PERCPU		0x00000400
- #define IRQF_NOBALANCING	0x00000800
- #define IRQF_IRQPOLL		0x00001000
- #define IRQF_ONESHOT		0x00002000
-+#define IRQF_NO_SUSPEND		0x00004000
-+
-+#define IRQF_TIMER		(__IRQF_TIMER | IRQF_NO_SUSPEND)
- 
- /*
-  * Bits used by threaded handlers:
-diff --git a/include/linux/notifier.h b/include/linux/notifier.h
-index 22c2abb..b2f1a4d 100644
---- a/include/linux/notifier.h
-+++ b/include/linux/notifier.h
-@@ -210,7 +210,7 @@ static inline int notifier_to_errno(int ret)
- #define NETDEV_POST_INIT	0x0010
- #define NETDEV_UNREGISTER_BATCH 0x0011
- #define NETDEV_BONDING_DESLAVE  0x0012
--#define NETDEV_NOTIFY_PEERS	0x0012
-+#define NETDEV_NOTIFY_PEERS	0x0013
- 
- #define SYS_DOWN	0x0001	/* Notify of system down */
- #define SYS_RESTART	SYS_DOWN
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 0478888..5ee397e 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -274,17 +274,11 @@ extern cpumask_var_t nohz_cpu_mask;
- #if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ)
- extern int select_nohz_load_balancer(int cpu);
- extern int get_nohz_load_balancer(void);
--extern int nohz_ratelimit(int cpu);
- #else
- static inline int select_nohz_load_balancer(int cpu)
- {
- 	return 0;
- }
--
--static inline int nohz_ratelimit(int cpu)
--{
--	return 0;
--}
- #endif
- 
- /*
-diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
-index 16b7f33..3e93de7 100644
---- a/include/linux/usb/quirks.h
-+++ b/include/linux/usb/quirks.h
-@@ -26,4 +26,8 @@
-    and can't handle talking to these interfaces */
- #define USB_QUIRK_HONOR_BNUMINTERFACES	0x00000020
- 
-+/* device needs a pause during initialization, after we read the device
-+   descriptor */
-+#define USB_QUIRK_DELAY_INIT		0x00000040
-+
- #endif /* __LINUX_USB_QUIRKS_H */
-diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
-index e149748..c3003e9 100644
---- a/kernel/irq/manage.c
-+++ b/kernel/irq/manage.c
-@@ -216,7 +216,7 @@ static inline int setup_affinity(unsigned int irq, struct irq_desc *desc)
- void __disable_irq(struct irq_desc *desc, unsigned int irq, bool suspend)
- {
- 	if (suspend) {
--		if (!desc->action || (desc->action->flags & IRQF_TIMER))
-+		if (!desc->action || (desc->action->flags & IRQF_NO_SUSPEND))
- 			return;
- 		desc->status |= IRQ_SUSPENDED;
- 	}
-diff --git a/kernel/sched.c b/kernel/sched.c
-index f52a880..63b4a14 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -1232,16 +1232,6 @@ void wake_up_idle_cpu(int cpu)
- 		smp_send_reschedule(cpu);
- }
- 
--int nohz_ratelimit(int cpu)
--{
--	struct rq *rq = cpu_rq(cpu);
--	u64 diff = rq->clock - rq->nohz_stamp;
--
--	rq->nohz_stamp = rq->clock;
--
--	return diff < (NSEC_PER_SEC / HZ) >> 1;
--}
--
- #endif /* CONFIG_NO_HZ */
- 
- static u64 sched_avg_period(void)
-diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
-index 813993b..f898af6 100644
---- a/kernel/time/tick-sched.c
-+++ b/kernel/time/tick-sched.c
-@@ -325,7 +325,7 @@ void tick_nohz_stop_sched_tick(int inidle)
- 	} while (read_seqretry(&xtime_lock, seq));
- 
- 	if (rcu_needs_cpu(cpu) || printk_needs_cpu(cpu) ||
--	    arch_needs_cpu(cpu) || nohz_ratelimit(cpu)) {
-+	    arch_needs_cpu(cpu)) {
- 		next_jiffies = last_jiffies + 1;
- 		delta_jiffies = 1;
- 	} else {
-diff --git a/mm/memory.c b/mm/memory.c
-index bde42c6..aaaedbd 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -2760,6 +2760,26 @@ out_release:
- }
- 
- /*
-+ * This is like a special single-page "expand_downwards()",
-+ * except we must first make sure that 'address-PAGE_SIZE'
-+ * doesn't hit another vma.
-+ *
-+ * The "find_vma()" will do the right thing even if we wrap
-+ */
-+static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
-+{
-+	address &= PAGE_MASK;
-+	if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-+		address -= PAGE_SIZE;
-+		if (find_vma(vma->vm_mm, address) != vma)
-+			return -ENOMEM;
-+
-+		expand_stack(vma, address);
-+	}
-+	return 0;
-+}
-+
-+/*
-  * We enter with non-exclusive mmap_sem (to exclude vma changes,
-  * but allow concurrent faults), and pte mapped but not yet locked.
-  * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -2772,6 +2792,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
- 	spinlock_t *ptl;
- 	pte_t entry;
- 
-+	if (check_stack_guard_page(vma, address) < 0) {
-+		pte_unmap(page_table);
-+		return VM_FAULT_SIGBUS;
-+	}
-+
- 	if (!(flags & FAULT_FLAG_WRITE)) {
- 		entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
- 						vma->vm_page_prot));
-diff --git a/mm/swapfile.c b/mm/swapfile.c
-index 03aa2d5..f08d165 100644
---- a/mm/swapfile.c
-+++ b/mm/swapfile.c
-@@ -318,8 +318,10 @@ checks:
- 	if (offset > si->highest_bit)
- 		scan_base = offset = si->lowest_bit;
- 
--	/* reuse swap entry of cache-only swap if not busy. */
--	if (vm_swap_full() && si->swap_map[offset] == SWAP_HAS_CACHE) {
-+	/* reuse swap entry of cache-only swap if not hibernation. */
-+	if (vm_swap_full()
-+		&& usage == SWAP_HAS_CACHE
-+		&& si->swap_map[offset] == SWAP_HAS_CACHE) {
- 		int swap_was_freed;
- 		spin_unlock(&swap_lock);
- 		swap_was_freed = __try_to_reclaim_swap(si, offset);
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 596ea2f..aa7cc51 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -5183,6 +5183,7 @@ static void fillup_priv_adc_nids(struct hda_codec *codec, hda_nid_t *nids,
- 
- static struct snd_pci_quirk beep_white_list[] = {
- 	SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1),
-+	SND_PCI_QUIRK(0x8086, 0xd613, "Intel", 1),
- 	{}
- };
- 
diff --git a/debian/patches/bugfix/all/stable/2.6.35.3.patch b/debian/patches/bugfix/all/stable/2.6.35.3.patch
deleted file mode 100644
index e9d48c0d3..000000000
--- a/debian/patches/bugfix/all/stable/2.6.35.3.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
-index 227b044..ce9c6c2 100644
---- a/arch/x86/kernel/cpu/vmware.c
-+++ b/arch/x86/kernel/cpu/vmware.c
-@@ -23,6 +23,7 @@
- 
- #include <linux/dmi.h>
- #include <linux/module.h>
-+#include <linux/jiffies.h>
- #include <asm/div64.h>
- #include <asm/x86_init.h>
- #include <asm/hypervisor.h>
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index aea1d3f..439fc1f 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -210,6 +210,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- 	int flags = vma->vm_flags;
- 	unsigned long ino = 0;
- 	unsigned long long pgoff = 0;
-+	unsigned long start;
- 	dev_t dev = 0;
- 	int len;
- 
-@@ -220,8 +221,13 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- 		pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
- 	}
- 
-+	/* We don't show the stack guard page in /proc/maps */
-+	start = vma->vm_start;
-+	if (vma->vm_flags & VM_GROWSDOWN)
-+		start += PAGE_SIZE;
-+
- 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
--			vma->vm_start,
-+			start,
- 			vma->vm_end,
- 			flags & VM_READ ? 'r' : '-',
- 			flags & VM_WRITE ? 'w' : '-',
-diff --git a/mm/memory.c b/mm/memory.c
-index aaaedbd..307bf77 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -2792,24 +2792,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
- 	spinlock_t *ptl;
- 	pte_t entry;
- 
--	if (check_stack_guard_page(vma, address) < 0) {
--		pte_unmap(page_table);
-+	pte_unmap(page_table);
-+
-+	/* Check if we need to add a guard page to the stack */
-+	if (check_stack_guard_page(vma, address) < 0)
- 		return VM_FAULT_SIGBUS;
--	}
- 
-+	/* Use the zero-page for reads */
- 	if (!(flags & FAULT_FLAG_WRITE)) {
- 		entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
- 						vma->vm_page_prot));
--		ptl = pte_lockptr(mm, pmd);
--		spin_lock(ptl);
-+		page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
- 		if (!pte_none(*page_table))
- 			goto unlock;
- 		goto setpte;
- 	}
- 
- 	/* Allocate our own private page. */
--	pte_unmap(page_table);
--
- 	if (unlikely(anon_vma_prepare(vma)))
- 		goto oom;
- 	page = alloc_zeroed_user_highpage_movable(vma, address);
-diff --git a/mm/mlock.c b/mm/mlock.c
-index 3f82720..49e5e4c 100644
---- a/mm/mlock.c
-+++ b/mm/mlock.c
-@@ -167,6 +167,14 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
- 	if (vma->vm_flags & VM_WRITE)
- 		gup_flags |= FOLL_WRITE;
- 
-+	/* We don't try to access the guard page of a stack vma */
-+	if (vma->vm_flags & VM_GROWSDOWN) {
-+		if (start == vma->vm_start) {
-+			start += PAGE_SIZE;
-+			nr_pages--;
-+		}
-+	}
-+
- 	while (nr_pages > 0) {
- 		int i;
- 
diff --git a/debian/patches/bugfix/all/stable/2.6.35.4.patch b/debian/patches/bugfix/all/stable/2.6.35.4.patch
deleted file mode 100644
index 1ae50927a..000000000
--- a/debian/patches/bugfix/all/stable/2.6.35.4.patch
+++ /dev/null
@@ -1,4732 +0,0 @@
-diff --git a/arch/arm/include/asm/ptrace.h b/arch/arm/include/asm/ptrace.h
-index 9dcb11e..bf62c44 100644
---- a/arch/arm/include/asm/ptrace.h
-+++ b/arch/arm/include/asm/ptrace.h
-@@ -158,15 +158,24 @@ struct pt_regs {
-  */
- static inline int valid_user_regs(struct pt_regs *regs)
- {
--	if (user_mode(regs) && (regs->ARM_cpsr & PSR_I_BIT) == 0) {
--		regs->ARM_cpsr &= ~(PSR_F_BIT | PSR_A_BIT);
--		return 1;
-+	unsigned long mode = regs->ARM_cpsr & MODE_MASK;
-+
-+	/*
-+	 * Always clear the F (FIQ) and A (delayed abort) bits
-+	 */
-+	regs->ARM_cpsr &= ~(PSR_F_BIT | PSR_A_BIT);
-+
-+	if ((regs->ARM_cpsr & PSR_I_BIT) == 0) {
-+		if (mode == USR_MODE)
-+			return 1;
-+		if (elf_hwcap & HWCAP_26BIT && mode == USR26_MODE)
-+			return 1;
- 	}
- 
- 	/*
- 	 * Force CPSR to something logical...
- 	 */
--	regs->ARM_cpsr &= PSR_f | PSR_s | (PSR_x & ~PSR_A_BIT) | PSR_T_BIT | MODE32_BIT;
-+	regs->ARM_cpsr &= PSR_f | PSR_s | PSR_x | PSR_T_BIT | MODE32_BIT;
- 	if (!(elf_hwcap & HWCAP_26BIT))
- 		regs->ARM_cpsr |= USR_MODE;
- 
-diff --git a/arch/arm/mach-ixp4xx/ixdp425-setup.c b/arch/arm/mach-ixp4xx/ixdp425-setup.c
-index 827cbc4..ea9ee4e 100644
---- a/arch/arm/mach-ixp4xx/ixdp425-setup.c
-+++ b/arch/arm/mach-ixp4xx/ixdp425-setup.c
-@@ -100,6 +100,7 @@ ixdp425_flash_nand_cmd_ctrl(struct mtd_info *mtd, int cmd, unsigned int ctrl)
- 
- static struct platform_nand_data ixdp425_flash_nand_data = {
- 	.chip = {
-+		.nr_chips		= 1,
- 		.chip_delay		= 30,
- 		.options		= NAND_NO_AUTOINCR,
- #ifdef CONFIG_MTD_PARTITIONS
-diff --git a/arch/arm/mach-mx3/mach-qong.c b/arch/arm/mach-mx3/mach-qong.c
-index e5b5b83..1f9363f 100644
---- a/arch/arm/mach-mx3/mach-qong.c
-+++ b/arch/arm/mach-mx3/mach-qong.c
-@@ -169,6 +169,7 @@ static void qong_nand_select_chip(struct mtd_info *mtd, int chip)
- 
- static struct platform_nand_data qong_nand_data = {
- 	.chip = {
-+		.nr_chips		= 1,
- 		.chip_delay		= 20,
- 		.options		= 0,
- 	},
-diff --git a/arch/arm/mach-orion5x/ts78xx-setup.c b/arch/arm/mach-orion5x/ts78xx-setup.c
-index 5041d1b..696b1a9 100644
---- a/arch/arm/mach-orion5x/ts78xx-setup.c
-+++ b/arch/arm/mach-orion5x/ts78xx-setup.c
-@@ -216,6 +216,7 @@ static struct mtd_partition ts78xx_ts_nand_parts[] = {
- 
- static struct platform_nand_data ts78xx_ts_nand_data = {
- 	.chip	= {
-+		.nr_chips		= 1,
- 		.part_probe_types	= ts_nand_part_probes,
- 		.partitions		= ts78xx_ts_nand_parts,
- 		.nr_partitions		= ARRAY_SIZE(ts78xx_ts_nand_parts),
-diff --git a/arch/blackfin/mach-bf537/boards/stamp.c b/arch/blackfin/mach-bf537/boards/stamp.c
-index 9eaf5b0..68a27bc 100644
---- a/arch/blackfin/mach-bf537/boards/stamp.c
-+++ b/arch/blackfin/mach-bf537/boards/stamp.c
-@@ -400,6 +400,7 @@ static int bfin_plat_nand_dev_ready(struct mtd_info *mtd)
- 
- static struct platform_nand_data bfin_plat_nand_data = {
- 	.chip = {
-+		.nr_chips = 1,
- 		.chip_delay = 30,
- #ifdef CONFIG_MTD_PARTITIONS
- 		.part_probe_types = part_probes,
-diff --git a/arch/blackfin/mach-bf561/boards/acvilon.c b/arch/blackfin/mach-bf561/boards/acvilon.c
-index bfcfa86..35b6d12 100644
---- a/arch/blackfin/mach-bf561/boards/acvilon.c
-+++ b/arch/blackfin/mach-bf561/boards/acvilon.c
-@@ -284,6 +284,7 @@ static int bfin_plat_nand_dev_ready(struct mtd_info *mtd)
- 
- static struct platform_nand_data bfin_plat_nand_data = {
- 	.chip = {
-+		 .nr_chips = 1,
- 		 .chip_delay = 30,
- #ifdef CONFIG_MTD_PARTITIONS
- 		 .part_probe_types = part_probes,
-diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
-index 5d2f17d..b2e3635 100644
---- a/arch/powerpc/Makefile
-+++ b/arch/powerpc/Makefile
-@@ -164,7 +164,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/powerpc/oprofile/
- all: zImage
- 
- # With make 3.82 we cannot mix normal and wildcard targets
--BOOT_TARGETS1 := zImage zImage.initrd uImaged
-+BOOT_TARGETS1 := zImage zImage.initrd uImage
- BOOT_TARGETS2 := zImage% dtbImage% treeImage.% cuImage.% simpleImage.%
- 
- PHONY += $(BOOT_TARGETS1) $(BOOT_TARGETS2)
-diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
-index 2050ca0..bdb2ff8 100644
---- a/arch/sparc/include/asm/atomic_64.h
-+++ b/arch/sparc/include/asm/atomic_64.h
-@@ -20,14 +20,14 @@
- #define atomic64_set(v, i)	(((v)->counter) = i)
- 
- extern void atomic_add(int, atomic_t *);
--extern void atomic64_add(int, atomic64_t *);
-+extern void atomic64_add(long, atomic64_t *);
- extern void atomic_sub(int, atomic_t *);
--extern void atomic64_sub(int, atomic64_t *);
-+extern void atomic64_sub(long, atomic64_t *);
- 
- extern int atomic_add_ret(int, atomic_t *);
--extern int atomic64_add_ret(int, atomic64_t *);
-+extern long atomic64_add_ret(long, atomic64_t *);
- extern int atomic_sub_ret(int, atomic_t *);
--extern int atomic64_sub_ret(int, atomic64_t *);
-+extern long atomic64_sub_ret(long, atomic64_t *);
- 
- #define atomic_dec_return(v) atomic_sub_ret(1, v)
- #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
-@@ -91,7 +91,7 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
- 	((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
- #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
- 
--static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
-+static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
- {
- 	long c, old;
- 	c = atomic64_read(v);
-diff --git a/arch/sparc/include/asm/fb.h b/arch/sparc/include/asm/fb.h
-index e834880..2173432 100644
---- a/arch/sparc/include/asm/fb.h
-+++ b/arch/sparc/include/asm/fb.h
-@@ -1,5 +1,6 @@
- #ifndef _SPARC_FB_H_
- #define _SPARC_FB_H_
-+#include <linux/console.h>
- #include <linux/fb.h>
- #include <linux/fs.h>
- #include <asm/page.h>
-@@ -18,6 +19,9 @@ static inline int fb_is_primary_device(struct fb_info *info)
- 	struct device *dev = info->device;
- 	struct device_node *node;
- 
-+	if (console_set_on_cmdline)
-+		return 0;
-+
- 	node = dev->of_node;
- 	if (node &&
- 	    node == of_console_device)
-diff --git a/arch/sparc/include/asm/parport.h b/arch/sparc/include/asm/parport.h
-index c333b8d..d21ad50 100644
---- a/arch/sparc/include/asm/parport.h
-+++ b/arch/sparc/include/asm/parport.h
-@@ -228,6 +228,10 @@ static const struct of_device_id ecpp_match[] = {
- 		.name = "parallel",
- 		.compatible = "ns87317-ecpp",
- 	},
-+	{
-+		.name = "parallel",
-+		.compatible = "pnpALI,1533,3",
-+	},
- 	{},
- };
- 
-diff --git a/arch/sparc/include/asm/rwsem-const.h b/arch/sparc/include/asm/rwsem-const.h
-index a303c9d..e4c61a1 100644
---- a/arch/sparc/include/asm/rwsem-const.h
-+++ b/arch/sparc/include/asm/rwsem-const.h
-@@ -5,7 +5,7 @@
- #define RWSEM_UNLOCKED_VALUE		0x00000000
- #define RWSEM_ACTIVE_BIAS		0x00000001
- #define RWSEM_ACTIVE_MASK		0x0000ffff
--#define RWSEM_WAITING_BIAS		0xffff0000
-+#define RWSEM_WAITING_BIAS		(-0x00010000)
- #define RWSEM_ACTIVE_READ_BIAS		RWSEM_ACTIVE_BIAS
- #define RWSEM_ACTIVE_WRITE_BIAS		(RWSEM_WAITING_BIAS + RWSEM_ACTIVE_BIAS)
- 
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index dcb0593..f942bb7 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -247,6 +247,11 @@ config ARCH_HWEIGHT_CFLAGS
- 
- config KTIME_SCALAR
- 	def_bool X86_32
-+
-+config ARCH_CPU_PROBE_RELEASE
-+	def_bool y
-+	depends on HOTPLUG_CPU
-+
- source "init/Kconfig"
- source "kernel/Kconfig.freezer"
- 
-diff --git a/arch/x86/include/asm/cmpxchg_32.h b/arch/x86/include/asm/cmpxchg_32.h
-index c1cf59d..20955ea 100644
---- a/arch/x86/include/asm/cmpxchg_32.h
-+++ b/arch/x86/include/asm/cmpxchg_32.h
-@@ -53,60 +53,33 @@ struct __xchg_dummy {
- 	__xchg((v), (ptr), sizeof(*ptr))
- 
- /*
-- * The semantics of XCHGCMP8B are a bit strange, this is why
-- * there is a loop and the loading of %%eax and %%edx has to
-- * be inside. This inlines well in most cases, the cached
-- * cost is around ~38 cycles. (in the future we might want
-- * to do an SIMD/3DNOW!/MMX/FPU 64-bit store here, but that
-- * might have an implicit FPU-save as a cost, so it's not
-- * clear which path to go.)
-+ * CMPXCHG8B only writes to the target if we had the previous
-+ * value in registers, otherwise it acts as a read and gives us the
-+ * "new previous" value.  That is why there is a loop.  Preloading
-+ * EDX:EAX is a performance optimization: in the common case it means
-+ * we need only one locked operation.
-  *
-- * cmpxchg8b must be used with the lock prefix here to allow
-- * the instruction to be executed atomically, see page 3-102
-- * of the instruction set reference 24319102.pdf. We need
-- * the reader side to see the coherent 64bit value.
-+ * A SIMD/3DNOW!/MMX/FPU 64-bit store here would require at the very
-+ * least an FPU save and/or %cr0.ts manipulation.
-+ *
-+ * cmpxchg8b must be used with the lock prefix here to allow the
-+ * instruction to be executed atomically.  We need to have the reader
-+ * side to see the coherent 64bit value.
-  */
--static inline void __set_64bit(unsigned long long *ptr,
--			       unsigned int low, unsigned int high)
-+static inline void set_64bit(volatile u64 *ptr, u64 value)
- {
-+	u32 low  = value;
-+	u32 high = value >> 32;
-+	u64 prev = *ptr;
-+
- 	asm volatile("\n1:\t"
--		     "movl (%1), %%eax\n\t"
--		     "movl 4(%1), %%edx\n\t"
--		     LOCK_PREFIX "cmpxchg8b (%1)\n\t"
-+		     LOCK_PREFIX "cmpxchg8b %0\n\t"
- 		     "jnz 1b"
--		     : "=m" (*ptr)
--		     : "D" (ptr),
--		       "b" (low),
--		       "c" (high)
--		     : "ax", "dx", "memory");
--}
--
--static inline void __set_64bit_constant(unsigned long long *ptr,
--					unsigned long long value)
--{
--	__set_64bit(ptr, (unsigned int)value, (unsigned int)(value >> 32));
--}
--
--#define ll_low(x)	*(((unsigned int *)&(x)) + 0)
--#define ll_high(x)	*(((unsigned int *)&(x)) + 1)
--
--static inline void __set_64bit_var(unsigned long long *ptr,
--				   unsigned long long value)
--{
--	__set_64bit(ptr, ll_low(value), ll_high(value));
-+		     : "=m" (*ptr), "+A" (prev)
-+		     : "b" (low), "c" (high)
-+		     : "memory");
- }
- 
--#define set_64bit(ptr, value)			\
--	(__builtin_constant_p((value))		\
--	 ? __set_64bit_constant((ptr), (value))	\
--	 : __set_64bit_var((ptr), (value)))
--
--#define _set_64bit(ptr, value)						\
--	(__builtin_constant_p(value)					\
--	 ? __set_64bit(ptr, (unsigned int)(value),			\
--		       (unsigned int)((value) >> 32))			\
--	 : __set_64bit(ptr, ll_low((value)), ll_high((value))))
--
- extern void __cmpxchg_wrong_size(void);
- 
- /*
-diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h
-index b92f147..9596e7c 100644
---- a/arch/x86/include/asm/cmpxchg_64.h
-+++ b/arch/x86/include/asm/cmpxchg_64.h
-@@ -5,13 +5,11 @@
- 
- #define __xg(x) ((volatile long *)(x))
- 
--static inline void set_64bit(volatile unsigned long *ptr, unsigned long val)
-+static inline void set_64bit(volatile u64 *ptr, u64 val)
- {
- 	*ptr = val;
- }
- 
--#define _set_64bit set_64bit
--
- extern void __xchg_wrong_size(void);
- extern void __cmpxchg_wrong_size(void);
- 
-diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index a96489e..c07e513 100644
---- a/arch/x86/kernel/apic/apic.c
-+++ b/arch/x86/kernel/apic/apic.c
-@@ -1606,7 +1606,7 @@ void __init init_apic_mappings(void)
- 		 * acpi lapic path already maps that address in
- 		 * acpi_register_lapic_address()
- 		 */
--		if (!acpi_lapic)
-+		if (!acpi_lapic && !smp_found_config)
- 			set_fixmap_nocache(FIX_APIC_BASE, apic_phys);
- 
- 		apic_printk(APIC_VERBOSE, "mapped APIC to %08lx (%08lx)\n",
-diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index e41ed24..2b18af1 100644
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -1728,6 +1728,8 @@ __apicdebuginit(void) print_IO_APIC(void)
- 		struct irq_pin_list *entry;
- 
- 		cfg = desc->chip_data;
-+		if (!cfg)
-+			continue;
- 		entry = cfg->irq_2_pin;
- 		if (!entry)
- 			continue;
-diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
-index 214ac86..d8d86d0 100644
---- a/arch/x86/kernel/cpu/perf_event_intel.c
-+++ b/arch/x86/kernel/cpu/perf_event_intel.c
-@@ -491,33 +491,78 @@ static void intel_pmu_enable_all(int added)
-  *   Intel Errata AAP53  (model 30)
-  *   Intel Errata BD53   (model 44)
-  *
-- * These chips need to be 'reset' when adding counters by programming
-- * the magic three (non counting) events 0x4300D2, 0x4300B1 and 0x4300B5
-- * either in sequence on the same PMC or on different PMCs.
-+ * The official story:
-+ *   These chips need to be 'reset' when adding counters by programming the
-+ *   magic three (non-counting) events 0x4300B5, 0x4300D2, and 0x4300B1 either
-+ *   in sequence on the same PMC or on different PMCs.
-+ *
-+ * In practise it appears some of these events do in fact count, and
-+ * we need to programm all 4 events.
-  */
--static void intel_pmu_nhm_enable_all(int added)
-+static void intel_pmu_nhm_workaround(void)
- {
--	if (added) {
--		struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
--		int i;
-+	struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
-+	static const unsigned long nhm_magic[4] = {
-+		0x4300B5,
-+		0x4300D2,
-+		0x4300B1,
-+		0x4300B1
-+	};
-+	struct perf_event *event;
-+	int i;
-+
-+	/*
-+	 * The Errata requires below steps:
-+	 * 1) Clear MSR_IA32_PEBS_ENABLE and MSR_CORE_PERF_GLOBAL_CTRL;
-+	 * 2) Configure 4 PERFEVTSELx with the magic events and clear
-+	 *    the corresponding PMCx;
-+	 * 3) set bit0~bit3 of MSR_CORE_PERF_GLOBAL_CTRL;
-+	 * 4) Clear MSR_CORE_PERF_GLOBAL_CTRL;
-+	 * 5) Clear 4 pairs of ERFEVTSELx and PMCx;
-+	 */
-+
-+	/*
-+	 * The real steps we choose are a little different from above.
-+	 * A) To reduce MSR operations, we don't run step 1) as they
-+	 *    are already cleared before this function is called;
-+	 * B) Call x86_perf_event_update to save PMCx before configuring
-+	 *    PERFEVTSELx with magic number;
-+	 * C) With step 5), we do clear only when the PERFEVTSELx is
-+	 *    not used currently.
-+	 * D) Call x86_perf_event_set_period to restore PMCx;
-+	 */
- 
--		wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + 0, 0x4300D2);
--		wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + 1, 0x4300B1);
--		wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + 2, 0x4300B5);
-+	/* We always operate 4 pairs of PERF Counters */
-+	for (i = 0; i < 4; i++) {
-+		event = cpuc->events[i];
-+		if (event)
-+			x86_perf_event_update(event);
-+	}
- 
--		wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0x3);
--		wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0x0);
-+	for (i = 0; i < 4; i++) {
-+		wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + i, nhm_magic[i]);
-+		wrmsrl(MSR_ARCH_PERFMON_PERFCTR0 + i, 0x0);
-+	}
- 
--		for (i = 0; i < 3; i++) {
--			struct perf_event *event = cpuc->events[i];
-+	wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0xf);
-+	wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0x0);
- 
--			if (!event)
--				continue;
-+	for (i = 0; i < 4; i++) {
-+		event = cpuc->events[i];
- 
-+		if (event) {
-+			x86_perf_event_set_period(event);
- 			__x86_pmu_enable_event(&event->hw,
--					       ARCH_PERFMON_EVENTSEL_ENABLE);
--		}
-+					ARCH_PERFMON_EVENTSEL_ENABLE);
-+		} else
-+			wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + i, 0x0);
- 	}
-+}
-+
-+static void intel_pmu_nhm_enable_all(int added)
-+{
-+	if (added)
-+		intel_pmu_nhm_workaround();
- 	intel_pmu_enable_all(added);
- }
- 
-diff --git a/arch/x86/kernel/cpu/perf_event_p4.c b/arch/x86/kernel/cpu/perf_event_p4.c
-index ae85d69..0ffe19e 100644
---- a/arch/x86/kernel/cpu/perf_event_p4.c
-+++ b/arch/x86/kernel/cpu/perf_event_p4.c
-@@ -581,6 +581,7 @@ static int p4_pmu_handle_irq(struct pt_regs *regs)
- 	cpuc = &__get_cpu_var(cpu_hw_events);
- 
- 	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
-+		int overflow;
- 
- 		if (!test_bit(idx, cpuc->active_mask))
- 			continue;
-@@ -591,12 +592,14 @@ static int p4_pmu_handle_irq(struct pt_regs *regs)
- 		WARN_ON_ONCE(hwc->idx != idx);
- 
- 		/* it might be unflagged overflow */
--		handled = p4_pmu_clear_cccr_ovf(hwc);
-+		overflow = p4_pmu_clear_cccr_ovf(hwc);
- 
- 		val = x86_perf_event_update(event);
--		if (!handled && (val & (1ULL << (x86_pmu.cntval_bits - 1))))
-+		if (!overflow && (val & (1ULL << (x86_pmu.cntval_bits - 1))))
- 			continue;
- 
-+		handled += overflow;
-+
- 		/* event overflow for sure */
- 		data.period = event->hw.last_period;
- 
-@@ -612,7 +615,7 @@ static int p4_pmu_handle_irq(struct pt_regs *regs)
- 		inc_irq_stat(apic_perf_irqs);
- 	}
- 
--	return handled;
-+	return handled > 0;
- }
- 
- /*
-diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
-index d86dbf7..d7b6f7f 100644
---- a/arch/x86/kernel/mpparse.c
-+++ b/arch/x86/kernel/mpparse.c
-@@ -274,6 +274,18 @@ static void __init smp_dump_mptable(struct mpc_table *mpc, unsigned char *mpt)
- 
- void __init default_smp_read_mpc_oem(struct mpc_table *mpc) { }
- 
-+static void __init smp_register_lapic_address(unsigned long address)
-+{
-+	mp_lapic_addr = address;
-+
-+	set_fixmap_nocache(FIX_APIC_BASE, address);
-+	if (boot_cpu_physical_apicid == -1U) {
-+		boot_cpu_physical_apicid  = read_apic_id();
-+		apic_version[boot_cpu_physical_apicid] =
-+			 GET_APIC_VERSION(apic_read(APIC_LVR));
-+	}
-+}
-+
- static int __init smp_read_mpc(struct mpc_table *mpc, unsigned early)
- {
- 	char str[16];
-@@ -295,6 +307,10 @@ static int __init smp_read_mpc(struct mpc_table *mpc, unsigned early)
- 	if (early)
- 		return 1;
- 
-+	/* Initialize the lapic mapping */
-+	if (!acpi_lapic)
-+		smp_register_lapic_address(mpc->lapic);
-+
- 	if (mpc->oemptr)
- 		x86_init.mpparse.smp_read_mpc_oem(mpc);
- 
-diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 11015fd..0bf2ece 100644
---- a/arch/x86/kernel/smpboot.c
-+++ b/arch/x86/kernel/smpboot.c
-@@ -91,6 +91,25 @@ DEFINE_PER_CPU(int, cpu_state) = { 0 };
- static DEFINE_PER_CPU(struct task_struct *, idle_thread_array);
- #define get_idle_for_cpu(x)      (per_cpu(idle_thread_array, x))
- #define set_idle_for_cpu(x, p)   (per_cpu(idle_thread_array, x) = (p))
-+
-+/*
-+ * We need this for trampoline_base protection from concurrent accesses when
-+ * off- and onlining cores wildly.
-+ */
-+static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
-+
-+void cpu_hotplug_driver_lock()
-+{
-+        mutex_lock(&x86_cpu_hotplug_driver_mutex);
-+}
-+
-+void cpu_hotplug_driver_unlock()
-+{
-+        mutex_unlock(&x86_cpu_hotplug_driver_mutex);
-+}
-+
-+ssize_t arch_cpu_probe(const char *buf, size_t count) { return -1; }
-+ssize_t arch_cpu_release(const char *buf, size_t count) { return -1; }
- #else
- static struct task_struct *idle_thread_array[NR_CPUS] __cpuinitdata ;
- #define get_idle_for_cpu(x)      (idle_thread_array[(x)])
-diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
-index 4a5979a..78ee8e0 100644
---- a/arch/x86/lib/atomic64_386_32.S
-+++ b/arch/x86/lib/atomic64_386_32.S
-@@ -25,150 +25,170 @@
- 	CFI_ADJUST_CFA_OFFSET -4
- .endm
- 
--.macro BEGIN func reg
--$v = \reg
--
--ENTRY(atomic64_\func\()_386)
--	CFI_STARTPROC
--	LOCK $v
--
--.macro RETURN
--	UNLOCK $v
-+#define BEGIN(op) \
-+.macro END; \
-+	CFI_ENDPROC; \
-+ENDPROC(atomic64_##op##_386); \
-+.purgem END; \
-+.endm; \
-+ENTRY(atomic64_##op##_386); \
-+	CFI_STARTPROC; \
-+	LOCK v;
-+
-+#define RET \
-+	UNLOCK v; \
- 	ret
--.endm
--
--.macro END_
--	CFI_ENDPROC
--ENDPROC(atomic64_\func\()_386)
--.purgem RETURN
--.purgem END_
--.purgem END
--.endm
--
--.macro END
--RETURN
--END_
--.endm
--.endm
--
--BEGIN read %ecx
--	movl  ($v), %eax
--	movl 4($v), %edx
--END
--
--BEGIN set %esi
--	movl %ebx,  ($v)
--	movl %ecx, 4($v)
--END
--
--BEGIN xchg %esi
--	movl  ($v), %eax
--	movl 4($v), %edx
--	movl %ebx,  ($v)
--	movl %ecx, 4($v)
--END
--
--BEGIN add %ecx
--	addl %eax,  ($v)
--	adcl %edx, 4($v)
--END
- 
--BEGIN add_return %ecx
--	addl  ($v), %eax
--	adcl 4($v), %edx
--	movl %eax,  ($v)
--	movl %edx, 4($v)
--END
--
--BEGIN sub %ecx
--	subl %eax,  ($v)
--	sbbl %edx, 4($v)
--END
--
--BEGIN sub_return %ecx
-+#define RET_END \
-+	RET; \
-+	END
-+
-+#define v %ecx
-+BEGIN(read)
-+	movl  (v), %eax
-+	movl 4(v), %edx
-+RET_END
-+#undef v
-+
-+#define v %esi
-+BEGIN(set)
-+	movl %ebx,  (v)
-+	movl %ecx, 4(v)
-+RET_END
-+#undef v
-+
-+#define v  %esi
-+BEGIN(xchg)
-+	movl  (v), %eax
-+	movl 4(v), %edx
-+	movl %ebx,  (v)
-+	movl %ecx, 4(v)
-+RET_END
-+#undef v
-+
-+#define v %ecx
-+BEGIN(add)
-+	addl %eax,  (v)
-+	adcl %edx, 4(v)
-+RET_END
-+#undef v
-+
-+#define v %ecx
-+BEGIN(add_return)
-+	addl  (v), %eax
-+	adcl 4(v), %edx
-+	movl %eax,  (v)
-+	movl %edx, 4(v)
-+RET_END
-+#undef v
-+
-+#define v %ecx
-+BEGIN(sub)
-+	subl %eax,  (v)
-+	sbbl %edx, 4(v)
-+RET_END
-+#undef v
-+
-+#define v %ecx
-+BEGIN(sub_return)
- 	negl %edx
- 	negl %eax
- 	sbbl $0, %edx
--	addl  ($v), %eax
--	adcl 4($v), %edx
--	movl %eax,  ($v)
--	movl %edx, 4($v)
--END
--
--BEGIN inc %esi
--	addl $1,  ($v)
--	adcl $0, 4($v)
--END
--
--BEGIN inc_return %esi
--	movl  ($v), %eax
--	movl 4($v), %edx
-+	addl  (v), %eax
-+	adcl 4(v), %edx
-+	movl %eax,  (v)
-+	movl %edx, 4(v)
-+RET_END
-+#undef v
-+
-+#define v %esi
-+BEGIN(inc)
-+	addl $1,  (v)
-+	adcl $0, 4(v)
-+RET_END
-+#undef v
-+
-+#define v %esi
-+BEGIN(inc_return)
-+	movl  (v), %eax
-+	movl 4(v), %edx
- 	addl $1, %eax
- 	adcl $0, %edx
--	movl %eax,  ($v)
--	movl %edx, 4($v)
--END
--
--BEGIN dec %esi
--	subl $1,  ($v)
--	sbbl $0, 4($v)
--END
--
--BEGIN dec_return %esi
--	movl  ($v), %eax
--	movl 4($v), %edx
-+	movl %eax,  (v)
-+	movl %edx, 4(v)
-+RET_END
-+#undef v
-+
-+#define v %esi
-+BEGIN(dec)
-+	subl $1,  (v)
-+	sbbl $0, 4(v)
-+RET_END
-+#undef v
-+
-+#define v %esi
-+BEGIN(dec_return)
-+	movl  (v), %eax
-+	movl 4(v), %edx
- 	subl $1, %eax
- 	sbbl $0, %edx
--	movl %eax,  ($v)
--	movl %edx, 4($v)
--END
-+	movl %eax,  (v)
-+	movl %edx, 4(v)
-+RET_END
-+#undef v
- 
--BEGIN add_unless %ecx
-+#define v %ecx
-+BEGIN(add_unless)
- 	addl %eax, %esi
- 	adcl %edx, %edi
--	addl  ($v), %eax
--	adcl 4($v), %edx
-+	addl  (v), %eax
-+	adcl 4(v), %edx
- 	cmpl %eax, %esi
- 	je 3f
- 1:
--	movl %eax,  ($v)
--	movl %edx, 4($v)
-+	movl %eax,  (v)
-+	movl %edx, 4(v)
- 	movl $1, %eax
- 2:
--RETURN
-+	RET
- 3:
- 	cmpl %edx, %edi
- 	jne 1b
- 	xorl %eax, %eax
- 	jmp 2b
--END_
-+END
-+#undef v
- 
--BEGIN inc_not_zero %esi
--	movl  ($v), %eax
--	movl 4($v), %edx
-+#define v %esi
-+BEGIN(inc_not_zero)
-+	movl  (v), %eax
-+	movl 4(v), %edx
- 	testl %eax, %eax
- 	je 3f
- 1:
- 	addl $1, %eax
- 	adcl $0, %edx
--	movl %eax,  ($v)
--	movl %edx, 4($v)
-+	movl %eax,  (v)
-+	movl %edx, 4(v)
- 	movl $1, %eax
- 2:
--RETURN
-+	RET
- 3:
- 	testl %edx, %edx
- 	jne 1b
- 	jmp 2b
--END_
-+END
-+#undef v
- 
--BEGIN dec_if_positive %esi
--	movl  ($v), %eax
--	movl 4($v), %edx
-+#define v %esi
-+BEGIN(dec_if_positive)
-+	movl  (v), %eax
-+	movl 4(v), %edx
- 	subl $1, %eax
- 	sbbl $0, %edx
- 	js 1f
--	movl %eax,  ($v)
--	movl %edx, 4($v)
-+	movl %eax,  (v)
-+	movl %edx, 4(v)
- 1:
--END
-+RET_END
-+#undef v
-diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
-index b28d2f1..f6b48f6 100644
---- a/arch/x86/oprofile/nmi_int.c
-+++ b/arch/x86/oprofile/nmi_int.c
-@@ -634,6 +634,18 @@ static int __init ppro_init(char **cpu_type)
- 	if (force_arch_perfmon && cpu_has_arch_perfmon)
- 		return 0;
- 
-+	/*
-+	 * Documentation on identifying Intel processors by CPU family
-+	 * and model can be found in the Intel Software Developer's
-+	 * Manuals (SDM):
-+	 *
-+	 *  http://www.intel.com/products/processor/manuals/
-+	 *
-+	 * As of May 2010 the documentation for this was in the:
-+	 * "Intel 64 and IA-32 Architectures Software Developer's
-+	 * Manual Volume 3B: System Programming Guide", "Table B-1
-+	 * CPUID Signature Values of DisplayFamily_DisplayModel".
-+	 */
- 	switch (cpu_model) {
- 	case 0 ... 2:
- 		*cpu_type = "i386/ppro";
-@@ -655,12 +667,13 @@ static int __init ppro_init(char **cpu_type)
- 	case 15: case 23:
- 		*cpu_type = "i386/core_2";
- 		break;
-+	case 0x1a:
-+	case 0x1e:
- 	case 0x2e:
--	case 26:
- 		spec = &op_arch_perfmon_spec;
- 		*cpu_type = "i386/core_i7";
- 		break;
--	case 28:
-+	case 0x1c:
- 		*cpu_type = "i386/atom";
- 		break;
- 	default:
-diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
-index 864dd46..18645f4 100644
---- a/drivers/acpi/apei/erst.c
-+++ b/drivers/acpi/apei/erst.c
-@@ -33,6 +33,7 @@
- #include <linux/uaccess.h>
- #include <linux/cper.h>
- #include <linux/nmi.h>
-+#include <linux/hardirq.h>
- #include <acpi/apei.h>
- 
- #include "apei-internal.h"
-diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
-index a754715..d84af6c 100644
---- a/drivers/char/agp/intel-gtt.c
-+++ b/drivers/char/agp/intel-gtt.c
-@@ -25,6 +25,10 @@
- #define USE_PCI_DMA_API 1
- #endif
- 
-+/* Max amount of stolen space, anything above will be returned to Linux */
-+int intel_max_stolen = 32 * 1024 * 1024;
-+EXPORT_SYMBOL(intel_max_stolen);
-+
- static const struct aper_size_info_fixed intel_i810_sizes[] =
- {
- 	{64, 16384, 4},
-@@ -710,7 +714,12 @@ static void intel_i830_init_gtt_entries(void)
- 			break;
- 		}
- 	}
--	if (gtt_entries > 0) {
-+	if (!local && gtt_entries > intel_max_stolen) {
-+		dev_info(&agp_bridge->dev->dev,
-+			 "detected %dK stolen memory, trimming to %dK\n",
-+			 gtt_entries / KB(1), intel_max_stolen / KB(1));
-+		gtt_entries = intel_max_stolen / KB(4);
-+	} else if (gtt_entries > 0) {
- 		dev_info(&agp_bridge->dev->dev, "detected %dK %s memory\n",
- 		       gtt_entries / KB(1), local ? "local" : "stolen");
- 		gtt_entries /= KB(4);
-diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index f54dab8..a398ecd 100644
---- a/drivers/char/mem.c
-+++ b/drivers/char/mem.c
-@@ -916,7 +916,7 @@ static int __init chr_dev_init(void)
- 			      NULL, devlist[minor].name);
- 	}
- 
--	return 0;
-+	return tty_init();
- }
- 
- fs_initcall(chr_dev_init);
-diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
-index d71f0fc..507441a 100644
---- a/drivers/char/tty_io.c
-+++ b/drivers/char/tty_io.c
-@@ -3128,7 +3128,7 @@ static struct cdev tty_cdev, console_cdev;
-  * Ok, now we can initialize the rest of the tty devices and can count
-  * on memory allocations, interrupts etc..
-  */
--static int __init tty_init(void)
-+int __init tty_init(void)
- {
- 	cdev_init(&tty_cdev, &tty_fops);
- 	if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
-@@ -3149,4 +3149,4 @@ static int __init tty_init(void)
- #endif
- 	return 0;
- }
--module_init(tty_init);
-+
-diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
-index 4a66201..c9736ed 100644
---- a/drivers/gpu/drm/drm_drv.c
-+++ b/drivers/gpu/drm/drm_drv.c
-@@ -502,7 +502,9 @@ long drm_ioctl(struct file *filp,
- 				retcode = -EFAULT;
- 				goto err_i1;
- 			}
--		}
-+		} else
-+			memset(kdata, 0, _IOC_SIZE(cmd));
-+
- 		if (ioctl->flags & DRM_UNLOCKED)
- 			retcode = func(dev, kdata, file_priv);
- 		else {
-diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
-index 2305a12..013a0ae 100644
---- a/drivers/gpu/drm/i915/i915_dma.c
-+++ b/drivers/gpu/drm/i915/i915_dma.c
-@@ -40,6 +40,8 @@
- #include <linux/vga_switcheroo.h>
- #include <linux/slab.h>
- 
-+extern int intel_max_stolen; /* from AGP driver */
-+
- /**
-  * Sets up the hardware status page for devices that need a physical address
-  * in the register.
-@@ -2104,6 +2106,12 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
- 	if (ret)
- 		goto out_iomapfree;
- 
-+	if (prealloc_size > intel_max_stolen) {
-+		DRM_INFO("detected %dM stolen memory, trimming to %dM\n",
-+			 prealloc_size >> 20, intel_max_stolen >> 20);
-+		prealloc_size = intel_max_stolen;
-+	}
-+
- 	dev_priv->wq = create_singlethread_workqueue("i915");
- 	if (dev_priv->wq == NULL) {
- 		DRM_ERROR("Failed to create our workqueue.\n");
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 8a84306..e9a4b12 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -1502,6 +1502,7 @@ static void ironlake_enable_pll_edp (struct drm_crtc *crtc)
- 	dpa_ctl = I915_READ(DP_A);
- 	dpa_ctl |= DP_PLL_ENABLE;
- 	I915_WRITE(DP_A, dpa_ctl);
-+	POSTING_READ(DP_A);
- 	udelay(200);
- }
- 
-@@ -4816,14 +4817,16 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
- 	work->pending_flip_obj = obj;
- 
- 	if (intel_crtc->plane)
--		flip_mask = I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
-+		flip_mask = MI_WAIT_FOR_PLANE_B_FLIP;
- 	else
--		flip_mask = I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT;
-+		flip_mask = MI_WAIT_FOR_PLANE_A_FLIP;
- 
--	/* Wait for any previous flip to finish */
--	if (IS_GEN3(dev))
--		while (I915_READ(ISR) & flip_mask)
--			;
-+	if (IS_GEN3(dev) || IS_GEN2(dev)) {
-+		BEGIN_LP_RING(2);
-+		OUT_RING(MI_WAIT_FOR_EVENT | flip_mask);
-+		OUT_RING(0);
-+		ADVANCE_LP_RING();
-+	}
- 
- 	/* Offset into the new buffer for cases of shared fbs between CRTCs */
- 	offset = obj_priv->gtt_offset;
-@@ -4837,12 +4840,18 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
- 		OUT_RING(offset | obj_priv->tiling_mode);
- 		pipesrc = I915_READ(pipesrc_reg); 
- 		OUT_RING(pipesrc & 0x0fff0fff);
--	} else {
-+	} else if (IS_GEN3(dev)) {
- 		OUT_RING(MI_DISPLAY_FLIP_I915 |
- 			 MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
- 		OUT_RING(fb->pitch);
- 		OUT_RING(offset);
- 		OUT_RING(MI_NOOP);
-+	} else {
-+		OUT_RING(MI_DISPLAY_FLIP |
-+			 MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
-+		OUT_RING(fb->pitch);
-+		OUT_RING(offset);
-+		OUT_RING(MI_NOOP);
- 	}
- 	ADVANCE_LP_RING();
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
-index 10673ae..6bfef51 100644
---- a/drivers/gpu/drm/radeon/radeon_atombios.c
-+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
-@@ -206,6 +206,7 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
- 				     uint16_t *line_mux,
- 				     struct radeon_hpd *hpd)
- {
-+	struct radeon_device *rdev = dev->dev_private;
- 
- 	/* Asus M2A-VM HDMI board lists the DVI port as HDMI */
- 	if ((dev->pdev->device == 0x791e) &&
-@@ -308,13 +309,22 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
- 		}
- 	}
- 
--	/* Acer laptop reports DVI-D as DVI-I */
-+	/* Acer laptop reports DVI-D as DVI-I and hpd pins reversed */
- 	if ((dev->pdev->device == 0x95c4) &&
- 	    (dev->pdev->subsystem_vendor == 0x1025) &&
- 	    (dev->pdev->subsystem_device == 0x013c)) {
-+		struct radeon_gpio_rec gpio;
-+
- 		if ((*connector_type == DRM_MODE_CONNECTOR_DVII) &&
--		    (supported_device == ATOM_DEVICE_DFP1_SUPPORT))
-+		    (supported_device == ATOM_DEVICE_DFP1_SUPPORT)) {
-+			gpio = radeon_lookup_gpio(rdev, 6);
-+			*hpd = radeon_atom_get_hpd_info_from_gpio(rdev, &gpio);
- 			*connector_type = DRM_MODE_CONNECTOR_DVID;
-+		} else if ((*connector_type == DRM_MODE_CONNECTOR_HDMIA) &&
-+			   (supported_device == ATOM_DEVICE_DFP1_SUPPORT)) {
-+			gpio = radeon_lookup_gpio(rdev, 7);
-+			*hpd = radeon_atom_get_hpd_info_from_gpio(rdev, &gpio);
-+		}
- 	}
- 
- 	/* XFX Pine Group device rv730 reports no VGA DDC lines
-@@ -1049,7 +1059,7 @@ bool radeon_atombios_sideport_present(struct radeon_device *rdev)
- 			}
- 			break;
- 		case 2:
--			if (igp_info->info_2.ucMemoryType & 0x0f)
-+			if (igp_info->info_2.ulBootUpSidePortClock)
- 				return true;
- 			break;
- 		default:
-diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index dd279da..a718463 100644
---- a/drivers/gpu/drm/radeon/radeon_device.c
-+++ b/drivers/gpu/drm/radeon/radeon_device.c
-@@ -199,7 +199,7 @@ void radeon_vram_location(struct radeon_device *rdev, struct radeon_mc *mc, u64
- 		mc->mc_vram_size = mc->aper_size;
- 	}
- 	mc->vram_end = mc->vram_start + mc->mc_vram_size - 1;
--	if (rdev->flags & RADEON_IS_AGP && mc->vram_end > mc->gtt_start && mc->vram_end <= mc->gtt_end) {
-+	if (rdev->flags & RADEON_IS_AGP && mc->vram_end > mc->gtt_start && mc->vram_start <= mc->gtt_end) {
- 		dev_warn(rdev->dev, "limiting VRAM to PCI aperture size\n");
- 		mc->real_vram_size = mc->aper_size;
- 		mc->mc_vram_size = mc->aper_size;
-diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
-index 5def6f5..0cd2704 100644
---- a/drivers/gpu/drm/radeon/radeon_i2c.c
-+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
-@@ -95,6 +95,13 @@ static void radeon_i2c_do_lock(struct radeon_i2c_chan *i2c, int lock_state)
- 		}
- 	}
- 
-+	/* switch the pads to ddc mode */
-+	if (ASIC_IS_DCE3(rdev) && rec->hw_capable) {
-+		temp = RREG32(rec->mask_clk_reg);
-+		temp &= ~(1 << 16);
-+		WREG32(rec->mask_clk_reg, temp);
-+	}
-+
- 	/* clear the output pin values */
- 	temp = RREG32(rec->a_clk_reg) & ~rec->a_clk_mask;
- 	WREG32(rec->a_clk_reg, temp);
-diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-index 059bfa4..a108c7e 100644
---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -121,11 +121,12 @@ int radeon_irq_kms_init(struct radeon_device *rdev)
- 	 * chips.  Disable MSI on them for now.
- 	 */
- 	if ((rdev->family >= CHIP_RV380) &&
--	    (!(rdev->flags & RADEON_IS_IGP))) {
-+	    (!(rdev->flags & RADEON_IS_IGP)) &&
-+	    (!(rdev->flags & RADEON_IS_AGP))) {
- 		int ret = pci_enable_msi(rdev->pdev);
- 		if (!ret) {
- 			rdev->msi_enabled = 1;
--			DRM_INFO("radeon: using MSI.\n");
-+			dev_info(rdev->dev, "radeon: using MSI.\n");
- 		}
- 	}
- 	rdev->irq.installed = true;
-diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
-index ab389f8..b20379e 100644
---- a/drivers/gpu/drm/radeon/radeon_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_kms.c
-@@ -106,7 +106,9 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
- 
- 	info = data;
- 	value_ptr = (uint32_t *)((unsigned long)info->value);
--	value = *value_ptr;
-+	if (DRM_COPY_FROM_USER(&value, value_ptr, sizeof(value)))
-+		return -EFAULT;
-+
- 	switch (info->request) {
- 	case RADEON_INFO_DEVICE_ID:
- 		value = dev->pci_device;
-diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
-index e1e5255..cf3a51f 100644
---- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
-+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
-@@ -272,7 +272,7 @@ static uint8_t radeon_compute_pll_gain(uint16_t ref_freq, uint16_t ref_div,
- 	if (!ref_div)
- 		return 1;
- 
--	vcoFreq = ((unsigned)ref_freq & fb_div) / ref_div;
-+	vcoFreq = ((unsigned)ref_freq * fb_div) / ref_div;
- 
- 	/*
- 	 * This is horribly crude: the VCO frequency range is divided into
-diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
-index 3fa6984..c91b741 100644
---- a/drivers/gpu/drm/radeon/radeon_pm.c
-+++ b/drivers/gpu/drm/radeon/radeon_pm.c
-@@ -224,6 +224,11 @@ static void radeon_pm_set_clocks(struct radeon_device *rdev)
- {
- 	int i;
- 
-+	/* no need to take locks, etc. if nothing's going to change */
-+	if ((rdev->pm.requested_clock_mode_index == rdev->pm.current_clock_mode_index) &&
-+	    (rdev->pm.requested_power_state_index == rdev->pm.current_power_state_index))
-+		return;
-+
- 	mutex_lock(&rdev->ddev->struct_mutex);
- 	mutex_lock(&rdev->vram_mutex);
- 	mutex_lock(&rdev->cp.mutex);
-diff --git a/drivers/hwmon/pc87360.c b/drivers/hwmon/pc87360.c
-index 4a64b85..68e69a4 100644
---- a/drivers/hwmon/pc87360.c
-+++ b/drivers/hwmon/pc87360.c
-@@ -1610,11 +1610,8 @@ static struct pc87360_data *pc87360_update_device(struct device *dev)
- 
- static int __init pc87360_device_add(unsigned short address)
- {
--	struct resource res = {
--		.name	= "pc87360",
--		.flags	= IORESOURCE_IO,
--	};
--	int err, i;
-+	struct resource res[3];
-+	int err, i, res_count;
- 
- 	pdev = platform_device_alloc("pc87360", address);
- 	if (!pdev) {
-@@ -1623,22 +1620,28 @@ static int __init pc87360_device_add(unsigned short address)
- 		goto exit;
- 	}
- 
-+	memset(res, 0, 3 * sizeof(struct resource));
-+	res_count = 0;
- 	for (i = 0; i < 3; i++) {
- 		if (!extra_isa[i])
- 			continue;
--		res.start = extra_isa[i];
--		res.end = extra_isa[i] + PC87360_EXTENT - 1;
-+		res[res_count].start = extra_isa[i];
-+		res[res_count].end = extra_isa[i] + PC87360_EXTENT - 1;
-+		res[res_count].name = "pc87360",
-+		res[res_count].flags = IORESOURCE_IO,
- 
--		err = acpi_check_resource_conflict(&res);
-+		err = acpi_check_resource_conflict(&res[res_count]);
- 		if (err)
- 			goto exit_device_put;
- 
--		err = platform_device_add_resources(pdev, &res, 1);
--		if (err) {
--			printk(KERN_ERR "pc87360: Device resource[%d] "
--			       "addition failed (%d)\n", i, err);
--			goto exit_device_put;
--		}
-+		res_count++;
-+	}
-+
-+	err = platform_device_add_resources(pdev, res, res_count);
-+	if (err) {
-+		printk(KERN_ERR "pc87360: Device resources addition failed "
-+		       "(%d)\n", err);
-+		goto exit_device_put;
- 	}
- 
- 	err = platform_device_add(pdev);
-diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
-index 6fbe899..05b15ed 100644
---- a/drivers/isdn/gigaset/capi.c
-+++ b/drivers/isdn/gigaset/capi.c
-@@ -378,13 +378,13 @@ void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *dskb)
- 	++bcs->trans_up;
- 
- 	if (!ap) {
--		dev_err(cs->dev, "%s: no application\n", __func__);
-+		gig_dbg(DEBUG_MCMD, "%s: application gone", __func__);
- 		return;
- 	}
- 
- 	/* don't send further B3 messages if disconnected */
- 	if (bcs->apconnstate < APCONN_ACTIVE) {
--		gig_dbg(DEBUG_LLDATA, "disconnected, discarding ack");
-+		gig_dbg(DEBUG_MCMD, "%s: disconnected", __func__);
- 		return;
- 	}
- 
-@@ -422,13 +422,14 @@ void gigaset_skb_rcvd(struct bc_state *bcs, struct sk_buff *skb)
- 	bcs->trans_down++;
- 
- 	if (!ap) {
--		dev_err(cs->dev, "%s: no application\n", __func__);
-+		gig_dbg(DEBUG_MCMD, "%s: application gone", __func__);
-+		dev_kfree_skb_any(skb);
- 		return;
- 	}
- 
- 	/* don't send further B3 messages if disconnected */
- 	if (bcs->apconnstate < APCONN_ACTIVE) {
--		gig_dbg(DEBUG_LLDATA, "disconnected, discarding data");
-+		gig_dbg(DEBUG_MCMD, "%s: disconnected", __func__);
- 		dev_kfree_skb_any(skb);
- 		return;
- 	}
-@@ -747,7 +748,7 @@ void gigaset_isdn_connD(struct bc_state *bcs)
- 	ap = bcs->ap;
- 	if (!ap) {
- 		spin_unlock_irqrestore(&bcs->aplock, flags);
--		dev_err(cs->dev, "%s: no application\n", __func__);
-+		gig_dbg(DEBUG_CMD, "%s: application gone", __func__);
- 		return;
- 	}
- 	if (bcs->apconnstate == APCONN_NONE) {
-@@ -843,7 +844,7 @@ void gigaset_isdn_connB(struct bc_state *bcs)
- 	ap = bcs->ap;
- 	if (!ap) {
- 		spin_unlock_irqrestore(&bcs->aplock, flags);
--		dev_err(cs->dev, "%s: no application\n", __func__);
-+		gig_dbg(DEBUG_CMD, "%s: application gone", __func__);
- 		return;
- 	}
- 	if (!bcs->apconnstate) {
-@@ -901,13 +902,12 @@ void gigaset_isdn_connB(struct bc_state *bcs)
-  */
- void gigaset_isdn_hupB(struct bc_state *bcs)
- {
--	struct cardstate *cs = bcs->cs;
- 	struct gigaset_capi_appl *ap = bcs->ap;
- 
- 	/* ToDo: assure order of DISCONNECT_B3_IND and DISCONNECT_IND ? */
- 
- 	if (!ap) {
--		dev_err(cs->dev, "%s: no application\n", __func__);
-+		gig_dbg(DEBUG_CMD, "%s: application gone", __func__);
- 		return;
- 	}
- 
-@@ -1044,6 +1044,7 @@ static inline void remove_appl_from_channel(struct bc_state *bcs,
- 	do {
- 		if (bcap->bcnext == ap) {
- 			bcap->bcnext = bcap->bcnext->bcnext;
-+			spin_unlock_irqrestore(&bcs->aplock, flags);
- 			return;
- 		}
- 		bcap = bcap->bcnext;
-diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c
-index 1081091..2655e3a 100644
---- a/drivers/isdn/sc/ioctl.c
-+++ b/drivers/isdn/sc/ioctl.c
-@@ -174,7 +174,7 @@ int sc_ioctl(int card, scs_ioctl *data)
- 		pr_debug("%s: SCIOGETSPID: ioctl received\n",
- 				sc_adapter[card]->devicename);
- 
--		spid = kmalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
-+		spid = kzalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
- 		if (!spid) {
- 			kfree(rcvmsg);
- 			return -ENOMEM;
-@@ -194,7 +194,7 @@ int sc_ioctl(int card, scs_ioctl *data)
- 			kfree(rcvmsg);
- 			return status;
- 		}
--		strcpy(spid, rcvmsg->msg_data.byte_array);
-+		strlcpy(spid, rcvmsg->msg_data.byte_array, SCIOC_SPIDSIZE);
- 
- 		/*
- 		 * Package the switch type and send to user space
-@@ -272,12 +272,12 @@ int sc_ioctl(int card, scs_ioctl *data)
- 			return status;
- 		}
- 
--		dn = kmalloc(SCIOC_DNSIZE, GFP_KERNEL);
-+		dn = kzalloc(SCIOC_DNSIZE, GFP_KERNEL);
- 		if (!dn) {
- 			kfree(rcvmsg);
- 			return -ENOMEM;
- 		}
--		strcpy(dn, rcvmsg->msg_data.byte_array);
-+		strlcpy(dn, rcvmsg->msg_data.byte_array, SCIOC_DNSIZE);
- 		kfree(rcvmsg);
- 
- 		/*
-@@ -348,7 +348,7 @@ int sc_ioctl(int card, scs_ioctl *data)
- 		pr_debug("%s: SCIOSTAT: ioctl received\n",
- 				sc_adapter[card]->devicename);
- 
--		bi = kmalloc (sizeof(boardInfo), GFP_KERNEL);
-+		bi = kzalloc(sizeof(boardInfo), GFP_KERNEL);
- 		if (!bi) {
- 			kfree(rcvmsg);
- 			return -ENOMEM;
-diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
-index 2b7907b..0bdb201 100644
---- a/drivers/md/dm-exception-store.c
-+++ b/drivers/md/dm-exception-store.c
-@@ -173,7 +173,9 @@ int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
- 
- 	/* Validate the chunk size against the device block size */
- 	if (chunk_size %
--	    (bdev_logical_block_size(dm_snap_cow(store->snap)->bdev) >> 9)) {
-+	    (bdev_logical_block_size(dm_snap_cow(store->snap)->bdev) >> 9) ||
-+	    chunk_size %
-+	    (bdev_logical_block_size(dm_snap_origin(store->snap)->bdev) >> 9)) {
- 		*error = "Chunk size is not a multiple of device blocksize";
- 		return -EINVAL;
- 	}
-diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
-index e8dfa06..0b25362 100644
---- a/drivers/md/dm-exception-store.h
-+++ b/drivers/md/dm-exception-store.h
-@@ -126,8 +126,9 @@ struct dm_exception_store {
- };
- 
- /*
-- * Obtain the cow device used by a given snapshot.
-+ * Obtain the origin or cow device used by a given snapshot.
-  */
-+struct dm_dev *dm_snap_origin(struct dm_snapshot *snap);
- struct dm_dev *dm_snap_cow(struct dm_snapshot *snap);
- 
- /*
-diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
-index d7500e1..bb6bdc8 100644
---- a/drivers/md/dm-ioctl.c
-+++ b/drivers/md/dm-ioctl.c
-@@ -249,40 +249,50 @@ static void __hash_remove(struct hash_cell *hc)
- 
- static void dm_hash_remove_all(int keep_open_devices)
- {
--	int i, dev_skipped, dev_removed;
-+	int i, dev_skipped;
- 	struct hash_cell *hc;
--	struct list_head *tmp, *n;
-+	struct mapped_device *md;
-+
-+retry:
-+	dev_skipped = 0;
- 
- 	down_write(&_hash_lock);
- 
--retry:
--	dev_skipped = dev_removed = 0;
- 	for (i = 0; i < NUM_BUCKETS; i++) {
--		list_for_each_safe (tmp, n, _name_buckets + i) {
--			hc = list_entry(tmp, struct hash_cell, name_list);
-+		list_for_each_entry(hc, _name_buckets + i, name_list) {
-+			md = hc->md;
-+			dm_get(md);
- 
--			if (keep_open_devices &&
--			    dm_lock_for_deletion(hc->md)) {
-+			if (keep_open_devices && dm_lock_for_deletion(md)) {
-+				dm_put(md);
- 				dev_skipped++;
- 				continue;
- 			}
-+
- 			__hash_remove(hc);
--			dev_removed = 1;
--		}
--	}
- 
--	/*
--	 * Some mapped devices may be using other mapped devices, so if any
--	 * still exist, repeat until we make no further progress.
--	 */
--	if (dev_skipped) {
--		if (dev_removed)
--			goto retry;
-+			up_write(&_hash_lock);
- 
--		DMWARN("remove_all left %d open device(s)", dev_skipped);
-+			dm_put(md);
-+			if (likely(keep_open_devices))
-+				dm_destroy(md);
-+			else
-+				dm_destroy_immediate(md);
-+
-+			/*
-+			 * Some mapped devices may be using other mapped
-+			 * devices, so repeat until we make no further
-+			 * progress.  If a new mapped device is created
-+			 * here it will also get removed.
-+			 */
-+			goto retry;
-+		}
- 	}
- 
- 	up_write(&_hash_lock);
-+
-+	if (dev_skipped)
-+		DMWARN("remove_all left %d open device(s)", dev_skipped);
- }
- 
- static int dm_hash_rename(uint32_t cookie, uint32_t *flags, const char *old,
-@@ -640,6 +650,7 @@ static int dev_create(struct dm_ioctl *param, size_t param_size)
- 	r = dm_hash_insert(param->name, *param->uuid ? param->uuid : NULL, md);
- 	if (r) {
- 		dm_put(md);
-+		dm_destroy(md);
- 		return r;
- 	}
- 
-@@ -742,6 +753,7 @@ static int dev_remove(struct dm_ioctl *param, size_t param_size)
- 		param->flags |= DM_UEVENT_GENERATED_FLAG;
- 
- 	dm_put(md);
-+	dm_destroy(md);
- 	return 0;
- }
- 
-diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
-index 5485377..a1f2ab5 100644
---- a/drivers/md/dm-snap.c
-+++ b/drivers/md/dm-snap.c
-@@ -148,6 +148,12 @@ struct dm_snapshot {
- #define RUNNING_MERGE          0
- #define SHUTDOWN_MERGE         1
- 
-+struct dm_dev *dm_snap_origin(struct dm_snapshot *s)
-+{
-+	return s->origin;
-+}
-+EXPORT_SYMBOL(dm_snap_origin);
-+
- struct dm_dev *dm_snap_cow(struct dm_snapshot *s)
- {
- 	return s->cow;
-@@ -1065,10 +1071,6 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
- 		origin_mode = FMODE_WRITE;
- 	}
- 
--	origin_path = argv[0];
--	argv++;
--	argc--;
--
- 	s = kmalloc(sizeof(*s), GFP_KERNEL);
- 	if (!s) {
- 		ti->error = "Cannot allocate snapshot context private "
-@@ -1077,6 +1079,16 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
- 		goto bad;
- 	}
- 
-+	origin_path = argv[0];
-+	argv++;
-+	argc--;
-+
-+	r = dm_get_device(ti, origin_path, origin_mode, &s->origin);
-+	if (r) {
-+		ti->error = "Cannot get origin device";
-+		goto bad_origin;
-+	}
-+
- 	cow_path = argv[0];
- 	argv++;
- 	argc--;
-@@ -1097,12 +1109,6 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
- 	argv += args_used;
- 	argc -= args_used;
- 
--	r = dm_get_device(ti, origin_path, origin_mode, &s->origin);
--	if (r) {
--		ti->error = "Cannot get origin device";
--		goto bad_origin;
--	}
--
- 	s->ti = ti;
- 	s->valid = 1;
- 	s->active = 0;
-@@ -1212,15 +1218,15 @@ bad_kcopyd:
- 	dm_exception_table_exit(&s->complete, exception_cache);
- 
- bad_hash_tables:
--	dm_put_device(ti, s->origin);
--
--bad_origin:
- 	dm_exception_store_destroy(s->store);
- 
- bad_store:
- 	dm_put_device(ti, s->cow);
- 
- bad_cow:
-+	dm_put_device(ti, s->origin);
-+
-+bad_origin:
- 	kfree(s);
- 
- bad:
-@@ -1314,12 +1320,12 @@ static void snapshot_dtr(struct dm_target *ti)
- 
- 	mempool_destroy(s->pending_pool);
- 
--	dm_put_device(ti, s->origin);
--
- 	dm_exception_store_destroy(s->store);
- 
- 	dm_put_device(ti, s->cow);
- 
-+	dm_put_device(ti, s->origin);
-+
- 	kfree(s);
- }
- 
-@@ -1899,8 +1905,14 @@ static int snapshot_iterate_devices(struct dm_target *ti,
- 				    iterate_devices_callout_fn fn, void *data)
- {
- 	struct dm_snapshot *snap = ti->private;
-+	int r;
-+
-+	r = fn(ti, snap->origin, 0, ti->len, data);
- 
--	return fn(ti, snap->origin, 0, ti->len, data);
-+	if (!r)
-+		r = fn(ti, snap->cow, 0, get_dev_size(snap->cow->bdev), data);
-+
-+	return r;
- }
- 
- 
-diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index d21e128..e3a512d 100644
---- a/drivers/md/dm.c
-+++ b/drivers/md/dm.c
-@@ -19,6 +19,7 @@
- #include <linux/slab.h>
- #include <linux/idr.h>
- #include <linux/hdreg.h>
-+#include <linux/delay.h>
- 
- #include <trace/events/block.h>
- 
-@@ -2141,6 +2142,7 @@ static struct mapped_device *dm_find_md(dev_t dev)
- 	md = idr_find(&_minor_idr, minor);
- 	if (md && (md == MINOR_ALLOCED ||
- 		   (MINOR(disk_devt(dm_disk(md))) != minor) ||
-+		   dm_deleting_md(md) ||
- 		   test_bit(DMF_FREEING, &md->flags))) {
- 		md = NULL;
- 		goto out;
-@@ -2175,6 +2177,7 @@ void dm_set_mdptr(struct mapped_device *md, void *ptr)
- void dm_get(struct mapped_device *md)
- {
- 	atomic_inc(&md->holders);
-+	BUG_ON(test_bit(DMF_FREEING, &md->flags));
- }
- 
- const char *dm_device_name(struct mapped_device *md)
-@@ -2183,27 +2186,55 @@ const char *dm_device_name(struct mapped_device *md)
- }
- EXPORT_SYMBOL_GPL(dm_device_name);
- 
--void dm_put(struct mapped_device *md)
-+static void __dm_destroy(struct mapped_device *md, bool wait)
- {
- 	struct dm_table *map;
- 
--	BUG_ON(test_bit(DMF_FREEING, &md->flags));
-+	might_sleep();
- 
--	if (atomic_dec_and_lock(&md->holders, &_minor_lock)) {
--		map = dm_get_live_table(md);
--		idr_replace(&_minor_idr, MINOR_ALLOCED,
--			    MINOR(disk_devt(dm_disk(md))));
--		set_bit(DMF_FREEING, &md->flags);
--		spin_unlock(&_minor_lock);
--		if (!dm_suspended_md(md)) {
--			dm_table_presuspend_targets(map);
--			dm_table_postsuspend_targets(map);
--		}
--		dm_sysfs_exit(md);
--		dm_table_put(map);
--		dm_table_destroy(__unbind(md));
--		free_dev(md);
-+	spin_lock(&_minor_lock);
-+	map = dm_get_live_table(md);
-+	idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));
-+	set_bit(DMF_FREEING, &md->flags);
-+	spin_unlock(&_minor_lock);
-+
-+	if (!dm_suspended_md(md)) {
-+		dm_table_presuspend_targets(map);
-+		dm_table_postsuspend_targets(map);
- 	}
-+
-+	/*
-+	 * Rare, but there may be I/O requests still going to complete,
-+	 * for example.  Wait for all references to disappear.
-+	 * No one should increment the reference count of the mapped_device,
-+	 * after the mapped_device state becomes DMF_FREEING.
-+	 */
-+	if (wait)
-+		while (atomic_read(&md->holders))
-+			msleep(1);
-+	else if (atomic_read(&md->holders))
-+		DMWARN("%s: Forcibly removing mapped_device still in use! (%d users)",
-+		       dm_device_name(md), atomic_read(&md->holders));
-+
-+	dm_sysfs_exit(md);
-+	dm_table_put(map);
-+	dm_table_destroy(__unbind(md));
-+	free_dev(md);
-+}
-+
-+void dm_destroy(struct mapped_device *md)
-+{
-+	__dm_destroy(md, true);
-+}
-+
-+void dm_destroy_immediate(struct mapped_device *md)
-+{
-+	__dm_destroy(md, false);
-+}
-+
-+void dm_put(struct mapped_device *md)
-+{
-+	atomic_dec(&md->holders);
- }
- EXPORT_SYMBOL_GPL(dm_put);
- 
-diff --git a/drivers/md/dm.h b/drivers/md/dm.h
-index bad1724..8223671 100644
---- a/drivers/md/dm.h
-+++ b/drivers/md/dm.h
-@@ -122,6 +122,11 @@ void dm_linear_exit(void);
- int dm_stripe_init(void);
- void dm_stripe_exit(void);
- 
-+/*
-+ * mapped_device operations
-+ */
-+void dm_destroy(struct mapped_device *md);
-+void dm_destroy_immediate(struct mapped_device *md);
- int dm_open_count(struct mapped_device *md);
- int dm_lock_for_deletion(struct mapped_device *md);
- 
-diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
-index 8327e24..300ec15 100644
---- a/drivers/memstick/core/mspro_block.c
-+++ b/drivers/memstick/core/mspro_block.c
-@@ -1040,6 +1040,7 @@ static int mspro_block_read_attributes(struct memstick_dev *card)
- 			snprintf(s_attr->name, sizeof(s_attr->name),
- 				 "attr_x%02x", attr->entries[cnt].id);
- 
-+		sysfs_attr_init(&s_attr->dev_attr.attr);
- 		s_attr->dev_attr.attr.name = s_attr->name;
- 		s_attr->dev_attr.attr.mode = S_IRUGO;
- 		s_attr->dev_attr.show = mspro_block_attr_show(s_attr->id);
-@@ -1330,13 +1331,14 @@ static void mspro_block_remove(struct memstick_dev *card)
- 	struct mspro_block_data *msb = memstick_get_drvdata(card);
- 	unsigned long flags;
- 
--	del_gendisk(msb->disk);
--	dev_dbg(&card->dev, "mspro block remove\n");
- 	spin_lock_irqsave(&msb->q_lock, flags);
- 	msb->eject = 1;
- 	blk_start_queue(msb->queue);
- 	spin_unlock_irqrestore(&msb->q_lock, flags);
- 
-+	del_gendisk(msb->disk);
-+	dev_dbg(&card->dev, "mspro block remove\n");
-+
- 	blk_cleanup_queue(msb->queue);
- 	msb->queue = NULL;
- 
-diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
-index 62f3ea9..3364061 100644
---- a/drivers/mtd/chips/cfi_cmdset_0001.c
-+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
-@@ -717,7 +717,7 @@ static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
- 		chip = &newcfi->chips[0];
- 		for (i = 0; i < cfi->numchips; i++) {
- 			shared[i].writing = shared[i].erasing = NULL;
--			spin_lock_init(&shared[i].lock);
-+			mutex_init(&shared[i].lock);
- 			for (j = 0; j < numparts; j++) {
- 				*chip = cfi->chips[i];
- 				chip->start += j << partshift;
-@@ -886,7 +886,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
- 		 */
- 		struct flchip_shared *shared = chip->priv;
- 		struct flchip *contender;
--		spin_lock(&shared->lock);
-+		mutex_lock(&shared->lock);
- 		contender = shared->writing;
- 		if (contender && contender != chip) {
- 			/*
-@@ -899,7 +899,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
- 			 * get_chip returns success we're clear to go ahead.
- 			 */
- 			ret = mutex_trylock(&contender->mutex);
--			spin_unlock(&shared->lock);
-+			mutex_unlock(&shared->lock);
- 			if (!ret)
- 				goto retry;
- 			mutex_unlock(&chip->mutex);
-@@ -914,7 +914,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
- 				mutex_unlock(&contender->mutex);
- 				return ret;
- 			}
--			spin_lock(&shared->lock);
-+			mutex_lock(&shared->lock);
- 
- 			/* We should not own chip if it is already
- 			 * in FL_SYNCING state. Put contender and retry. */
-@@ -930,7 +930,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
- 		 * on this chip. Sleep. */
- 		if (mode == FL_ERASING && shared->erasing
- 		    && shared->erasing->oldstate == FL_ERASING) {
--			spin_unlock(&shared->lock);
-+			mutex_unlock(&shared->lock);
- 			set_current_state(TASK_UNINTERRUPTIBLE);
- 			add_wait_queue(&chip->wq, &wait);
- 			mutex_unlock(&chip->mutex);
-@@ -944,7 +944,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
- 		shared->writing = chip;
- 		if (mode == FL_ERASING)
- 			shared->erasing = chip;
--		spin_unlock(&shared->lock);
-+		mutex_unlock(&shared->lock);
- 	}
- 	ret = chip_ready(map, chip, adr, mode);
- 	if (ret == -EAGAIN)
-@@ -959,7 +959,7 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
- 
- 	if (chip->priv) {
- 		struct flchip_shared *shared = chip->priv;
--		spin_lock(&shared->lock);
-+		mutex_lock(&shared->lock);
- 		if (shared->writing == chip && chip->oldstate == FL_READY) {
- 			/* We own the ability to write, but we're done */
- 			shared->writing = shared->erasing;
-@@ -967,7 +967,7 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
- 				/* give back ownership to who we loaned it from */
- 				struct flchip *loaner = shared->writing;
- 				mutex_lock(&loaner->mutex);
--				spin_unlock(&shared->lock);
-+				mutex_unlock(&shared->lock);
- 				mutex_unlock(&chip->mutex);
- 				put_chip(map, loaner, loaner->start);
- 				mutex_lock(&chip->mutex);
-@@ -985,11 +985,11 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
- 			 * Don't let the switch below mess things up since
- 			 * we don't have ownership to resume anything.
- 			 */
--			spin_unlock(&shared->lock);
-+			mutex_unlock(&shared->lock);
- 			wake_up(&chip->wq);
- 			return;
- 		}
--		spin_unlock(&shared->lock);
-+		mutex_unlock(&shared->lock);
- 	}
- 
- 	switch(chip->oldstate) {
-diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c
-index fece5be..04fdfcc 100644
---- a/drivers/mtd/lpddr/lpddr_cmds.c
-+++ b/drivers/mtd/lpddr/lpddr_cmds.c
-@@ -98,7 +98,7 @@ struct mtd_info *lpddr_cmdset(struct map_info *map)
- 	numchips = lpddr->numchips / lpddr->qinfo->HWPartsNum;
- 	for (i = 0; i < numchips; i++) {
- 		shared[i].writing = shared[i].erasing = NULL;
--		spin_lock_init(&shared[i].lock);
-+		mutex_init(&shared[i].lock);
- 		for (j = 0; j < lpddr->qinfo->HWPartsNum; j++) {
- 			*chip = lpddr->chips[i];
- 			chip->start += j << lpddr->chipshift;
-@@ -217,7 +217,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
- 		 */
- 		struct flchip_shared *shared = chip->priv;
- 		struct flchip *contender;
--		spin_lock(&shared->lock);
-+		mutex_lock(&shared->lock);
- 		contender = shared->writing;
- 		if (contender && contender != chip) {
- 			/*
-@@ -230,7 +230,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
- 			 * get_chip returns success we're clear to go ahead.
- 			 */
- 			ret = mutex_trylock(&contender->mutex);
--			spin_unlock(&shared->lock);
-+			mutex_unlock(&shared->lock);
- 			if (!ret)
- 				goto retry;
- 			mutex_unlock(&chip->mutex);
-@@ -245,7 +245,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
- 				mutex_unlock(&contender->mutex);
- 				return ret;
- 			}
--			spin_lock(&shared->lock);
-+			mutex_lock(&shared->lock);
- 
- 			/* We should not own chip if it is already in FL_SYNCING
- 			 * state. Put contender and retry. */
-@@ -261,7 +261,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
- 		   Must sleep in such a case. */
- 		if (mode == FL_ERASING && shared->erasing
- 		    && shared->erasing->oldstate == FL_ERASING) {
--			spin_unlock(&shared->lock);
-+			mutex_unlock(&shared->lock);
- 			set_current_state(TASK_UNINTERRUPTIBLE);
- 			add_wait_queue(&chip->wq, &wait);
- 			mutex_unlock(&chip->mutex);
-@@ -275,7 +275,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
- 		shared->writing = chip;
- 		if (mode == FL_ERASING)
- 			shared->erasing = chip;
--		spin_unlock(&shared->lock);
-+		mutex_unlock(&shared->lock);
- 	}
- 
- 	ret = chip_ready(map, chip, mode);
-@@ -348,7 +348,7 @@ static void put_chip(struct map_info *map, struct flchip *chip)
- {
- 	if (chip->priv) {
- 		struct flchip_shared *shared = chip->priv;
--		spin_lock(&shared->lock);
-+		mutex_lock(&shared->lock);
- 		if (shared->writing == chip && chip->oldstate == FL_READY) {
- 			/* We own the ability to write, but we're done */
- 			shared->writing = shared->erasing;
-@@ -356,7 +356,7 @@ static void put_chip(struct map_info *map, struct flchip *chip)
- 				/* give back the ownership */
- 				struct flchip *loaner = shared->writing;
- 				mutex_lock(&loaner->mutex);
--				spin_unlock(&shared->lock);
-+				mutex_unlock(&shared->lock);
- 				mutex_unlock(&chip->mutex);
- 				put_chip(map, loaner);
- 				mutex_lock(&chip->mutex);
-@@ -374,11 +374,11 @@ static void put_chip(struct map_info *map, struct flchip *chip)
- 			 * Don't let the switch below mess things up since
- 			 * we don't have ownership to resume anything.
- 			 */
--			spin_unlock(&shared->lock);
-+			mutex_unlock(&shared->lock);
- 			wake_up(&chip->wq);
- 			return;
- 		}
--		spin_unlock(&shared->lock);
-+		mutex_unlock(&shared->lock);
- 	}
- 
- 	switch (chip->oldstate) {
-diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
-index 4a7b864..5bcc34a 100644
---- a/drivers/mtd/nand/nand_base.c
-+++ b/drivers/mtd/nand/nand_base.c
-@@ -2852,6 +2852,7 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
- 		 */
- 		if (id_data[0] == id_data[6] && id_data[1] == id_data[7] &&
- 				id_data[0] == NAND_MFR_SAMSUNG &&
-+				(chip->cellinfo & NAND_CI_CELLTYPE_MSK) &&
- 				id_data[5] != 0x00) {
- 			/* Calc pagesize */
- 			mtd->writesize = 2048 << (extid & 0x03);
-diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c
-index 90e143e..317aff4 100644
---- a/drivers/mtd/nand/plat_nand.c
-+++ b/drivers/mtd/nand/plat_nand.c
-@@ -37,6 +37,11 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
- 	struct resource *res;
- 	int err = 0;
- 
-+	if (pdata->chip.nr_chips < 1) {
-+		dev_err(&pdev->dev, "invalid number of chips specified\n");
-+		return -EINVAL;
-+	}
-+
- 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- 	if (!res)
- 		return -ENXIO;
-diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
-index e02fa4f..4d89f37 100644
---- a/drivers/mtd/nand/pxa3xx_nand.c
-+++ b/drivers/mtd/nand/pxa3xx_nand.c
-@@ -363,7 +363,7 @@ static struct pxa3xx_nand_flash *builtin_flash_types[] = {
- #define tAR_NDTR1(r)	(((r) >> 0) & 0xf)
- 
- /* convert nano-seconds to nand flash controller clock cycles */
--#define ns2cycle(ns, clk)	(int)(((ns) * (clk / 1000000) / 1000) - 1)
-+#define ns2cycle(ns, clk)	(int)((ns) * (clk / 1000000) / 1000)
- 
- /* convert nand flash controller clock cycles to nano-seconds */
- #define cycle2ns(c, clk)	((((c) + 1) * 1000000 + clk / 500) / (clk / 1000))
-diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
-index f654db9..d206f21 100644
---- a/drivers/net/e1000e/82571.c
-+++ b/drivers/net/e1000e/82571.c
-@@ -936,12 +936,14 @@ static s32 e1000_reset_hw_82571(struct e1000_hw *hw)
- 	ew32(IMC, 0xffffffff);
- 	icr = er32(ICR);
- 
--	/* Install any alternate MAC address into RAR0 */
--	ret_val = e1000_check_alt_mac_addr_generic(hw);
--	if (ret_val)
--		return ret_val;
-+	if (hw->mac.type == e1000_82571) {
-+		/* Install any alternate MAC address into RAR0 */
-+		ret_val = e1000_check_alt_mac_addr_generic(hw);
-+		if (ret_val)
-+			return ret_val;
- 
--	e1000e_set_laa_state_82571(hw, true);
-+		e1000e_set_laa_state_82571(hw, true);
-+	}
- 
- 	/* Reinitialize the 82571 serdes link state machine */
- 	if (hw->phy.media_type == e1000_media_type_internal_serdes)
-@@ -1618,14 +1620,16 @@ static s32 e1000_read_mac_addr_82571(struct e1000_hw *hw)
- {
- 	s32 ret_val = 0;
- 
--	/*
--	 * If there's an alternate MAC address place it in RAR0
--	 * so that it will override the Si installed default perm
--	 * address.
--	 */
--	ret_val = e1000_check_alt_mac_addr_generic(hw);
--	if (ret_val)
--		goto out;
-+	if (hw->mac.type == e1000_82571) {
-+		/*
-+		 * If there's an alternate MAC address place it in RAR0
-+		 * so that it will override the Si installed default perm
-+		 * address.
-+		 */
-+		ret_val = e1000_check_alt_mac_addr_generic(hw);
-+		if (ret_val)
-+			goto out;
-+	}
- 
- 	ret_val = e1000_read_mac_addr_generic(hw);
- 
-@@ -1833,6 +1837,7 @@ struct e1000_info e1000_82573_info = {
- 				  | FLAG_HAS_SMART_POWER_DOWN
- 				  | FLAG_HAS_AMT
- 				  | FLAG_HAS_SWSM_ON_LOAD,
-+	.flags2			= FLAG2_DISABLE_ASPM_L1,
- 	.pba			= 20,
- 	.max_hw_frame_size	= ETH_FRAME_LEN + ETH_FCS_LEN,
- 	.get_variants		= e1000_get_variants_82571,
-diff --git a/drivers/net/e1000e/defines.h b/drivers/net/e1000e/defines.h
-index 4dc02c7..75289ca 100644
---- a/drivers/net/e1000e/defines.h
-+++ b/drivers/net/e1000e/defines.h
-@@ -620,6 +620,7 @@
- #define E1000_FLASH_UPDATES  2000
- 
- /* NVM Word Offsets */
-+#define NVM_COMPAT                 0x0003
- #define NVM_ID_LED_SETTINGS        0x0004
- #define NVM_INIT_CONTROL2_REG      0x000F
- #define NVM_INIT_CONTROL3_PORT_B   0x0014
-@@ -642,6 +643,9 @@
- /* Mask bits for fields in Word 0x1a of the NVM */
- #define NVM_WORD1A_ASPM_MASK  0x000C
- 
-+/* Mask bits for fields in Word 0x03 of the EEPROM */
-+#define NVM_COMPAT_LOM    0x0800
-+
- /* For checksumming, the sum of all words in the NVM should equal 0xBABA. */
- #define NVM_SUM                    0xBABA
- 
-diff --git a/drivers/net/e1000e/lib.c b/drivers/net/e1000e/lib.c
-index a968e3a..768c105 100644
---- a/drivers/net/e1000e/lib.c
-+++ b/drivers/net/e1000e/lib.c
-@@ -183,6 +183,16 @@ s32 e1000_check_alt_mac_addr_generic(struct e1000_hw *hw)
- 	u16 offset, nvm_alt_mac_addr_offset, nvm_data;
- 	u8 alt_mac_addr[ETH_ALEN];
- 
-+	ret_val = e1000_read_nvm(hw, NVM_COMPAT, 1, &nvm_data);
-+	if (ret_val)
-+		goto out;
-+
-+	/* Check for LOM (vs. NIC) or one of two valid mezzanine cards */
-+	if (!((nvm_data & NVM_COMPAT_LOM) ||
-+	      (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_DUAL) ||
-+	      (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD)))
-+		goto out;
-+
- 	ret_val = e1000_read_nvm(hw, NVM_ALT_MAC_ADDR_PTR, 1,
- 	                         &nvm_alt_mac_addr_offset);
- 	if (ret_val) {
-diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
-index 648972d..ab9fe22 100644
---- a/drivers/net/wireless/ath/ath5k/base.c
-+++ b/drivers/net/wireless/ath/ath5k/base.c
-@@ -48,6 +48,7 @@
- #include <linux/netdevice.h>
- #include <linux/cache.h>
- #include <linux/pci.h>
-+#include <linux/pci-aspm.h>
- #include <linux/ethtool.h>
- #include <linux/uaccess.h>
- #include <linux/slab.h>
-@@ -472,6 +473,26 @@ ath5k_pci_probe(struct pci_dev *pdev,
- 	int ret;
- 	u8 csz;
- 
-+	/*
-+	 * L0s needs to be disabled on all ath5k cards.
-+	 *
-+	 * For distributions shipping with CONFIG_PCIEASPM (this will be enabled
-+	 * by default in the future in 2.6.36) this will also mean both L1 and
-+	 * L0s will be disabled when a pre 1.1 PCIe device is detected. We do
-+	 * know L1 works correctly even for all ath5k pre 1.1 PCIe devices
-+	 * though but cannot currently undue the effect of a blacklist, for
-+	 * details you can read pcie_aspm_sanity_check() and see how it adjusts
-+	 * the device link capability.
-+	 *
-+	 * It may be possible in the future to implement some PCI API to allow
-+	 * drivers to override blacklists for pre 1.1 PCIe but for now it is
-+	 * best to accept that both L0s and L1 will be disabled completely for
-+	 * distributions shipping with CONFIG_PCIEASPM rather than having this
-+	 * issue present. Motivation for adding this new API will be to help
-+	 * with power consumption for some of these devices.
-+	 */
-+	pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S);
-+
- 	ret = pci_enable_device(pdev);
- 	if (ret) {
- 		dev_err(&pdev->dev, "can't enable device\n");
-diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
-index 2571b44..5fcbc2f 100644
---- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
-+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
-@@ -68,18 +68,23 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
- 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_sta *sta = tx_info->control.sta;
- 	struct ath9k_htc_sta *ista;
--	struct ath9k_htc_vif *avp;
- 	struct ath9k_htc_tx_ctl tx_ctl;
- 	enum htc_endpoint_id epid;
- 	u16 qnum, hw_qnum;
- 	__le16 fc;
- 	u8 *tx_fhdr;
--	u8 sta_idx;
-+	u8 sta_idx, vif_idx;
- 
- 	hdr = (struct ieee80211_hdr *) skb->data;
- 	fc = hdr->frame_control;
- 
--	avp = (struct ath9k_htc_vif *) tx_info->control.vif->drv_priv;
-+	if (tx_info->control.vif &&
-+			(struct ath9k_htc_vif *) tx_info->control.vif->drv_priv)
-+		vif_idx = ((struct ath9k_htc_vif *)
-+				tx_info->control.vif->drv_priv)->index;
-+	else
-+		vif_idx = priv->nvifs;
-+
- 	if (sta) {
- 		ista = (struct ath9k_htc_sta *) sta->drv_priv;
- 		sta_idx = ista->index;
-@@ -96,7 +101,7 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
- 		memset(&tx_hdr, 0, sizeof(struct tx_frame_hdr));
- 
- 		tx_hdr.node_idx = sta_idx;
--		tx_hdr.vif_idx = avp->index;
-+		tx_hdr.vif_idx = vif_idx;
- 
- 		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
- 			tx_ctl.type = ATH9K_HTC_AMPDU;
-@@ -156,7 +161,7 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
- 		tx_ctl.type = ATH9K_HTC_NORMAL;
- 
- 		mgmt_hdr.node_idx = sta_idx;
--		mgmt_hdr.vif_idx = avp->index;
-+		mgmt_hdr.vif_idx = vif_idx;
- 		mgmt_hdr.tidno = 0;
- 		mgmt_hdr.flags = 0;
- 
-diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
-index c44a303..2a9480d 100644
---- a/drivers/net/wireless/iwlwifi/iwl-3945.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
-@@ -915,22 +915,6 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
- 		rts_retry_limit = data_retry_limit;
- 	tx_cmd->rts_retry_limit = rts_retry_limit;
- 
--	if (ieee80211_is_mgmt(fc)) {
--		switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
--		case cpu_to_le16(IEEE80211_STYPE_AUTH):
--		case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
--		case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
--		case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
--			if (tx_flags & TX_CMD_FLG_RTS_MSK) {
--				tx_flags &= ~TX_CMD_FLG_RTS_MSK;
--				tx_flags |= TX_CMD_FLG_CTS_MSK;
--			}
--			break;
--		default:
--			break;
--		}
--	}
--
- 	tx_cmd->rate = rate;
- 	tx_cmd->tx_flags = tx_flags;
- 
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
-index 01658cf..2a30397 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
-@@ -209,10 +209,21 @@ static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
- 	}
- }
- 
--static void iwlagn_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
--			__le32 *tx_flags)
-+static void iwlagn_rts_tx_cmd_flag(struct iwl_priv *priv,
-+				     struct ieee80211_tx_info *info,
-+				     __le16 fc, __le32 *tx_flags)
- {
--	*tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
-+	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS ||
-+	    info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-+		*tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
-+		return;
-+	}
-+
-+	if (priv->cfg->use_rts_for_ht &&
-+	    info->flags & IEEE80211_TX_CTL_AMPDU) {
-+		*tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
-+		return;
-+	}
- }
- 
- /* Calc max signal level (dBm) among 3 possible receivers */
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-index cf4a95b..ca46831 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-@@ -325,18 +325,11 @@ static void rs_tl_turn_on_agg(struct iwl_priv *priv, u8 tid,
- 			      struct iwl_lq_sta *lq_data,
- 			      struct ieee80211_sta *sta)
- {
--	if ((tid < TID_MAX_LOAD_COUNT) &&
--	    !rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta)) {
--		if (priv->cfg->use_rts_for_ht) {
--			/*
--			 * switch to RTS/CTS if it is the prefer protection
--			 * method for HT traffic
--			 */
--			IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n");
--			priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
--			iwlcore_commit_rxon(priv);
--		}
--	}
-+	if (tid < TID_MAX_LOAD_COUNT)
-+		rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
-+	else
-+		IWL_ERR(priv, "tid exceeds max load count: %d/%d\n",
-+			tid, TID_MAX_LOAD_COUNT);
- }
- 
- static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
-index 7d614c4..3a3d27c 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
-@@ -376,10 +376,7 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
- 		tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
- 	}
- 
--	priv->cfg->ops->utils->rts_tx_cmd_flag(info, &tx_flags);
--
--	if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
--		tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
-+	priv->cfg->ops->utils->rts_tx_cmd_flag(priv, info, fc, &tx_flags);
- 
- 	tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
- 	if (ieee80211_is_mgmt(fc)) {
-@@ -453,21 +450,6 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
- 	if ((rate_idx >= IWL_FIRST_CCK_RATE) && (rate_idx <= IWL_LAST_CCK_RATE))
- 		rate_flags |= RATE_MCS_CCK_MSK;
- 
--	/* Set up RTS and CTS flags for certain packets */
--	switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
--	case cpu_to_le16(IEEE80211_STYPE_AUTH):
--	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
--	case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
--	case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
--		if (tx_cmd->tx_flags & TX_CMD_FLG_RTS_MSK) {
--			tx_cmd->tx_flags &= ~TX_CMD_FLG_RTS_MSK;
--			tx_cmd->tx_flags |= TX_CMD_FLG_CTS_MSK;
--		}
--		break;
--	default:
--		break;
--	}
--
- 	/* Set up antennas */
- 	priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant);
- 	rate_flags |= iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
-index 24aff65..c7f56b4 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
-@@ -200,13 +200,6 @@ int iwl_commit_rxon(struct iwl_priv *priv)
- 
- 	priv->start_calib = 0;
- 	if (new_assoc) {
--		/*
--		 * allow CTS-to-self if possible for new association.
--		 * this is relevant only for 5000 series and up,
--		 * but will not damage 4965
--		 */
--		priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
--
- 		/* Apply the new configuration
- 		 * RXON assoc doesn't clear the station table in uCode,
- 		 */
-@@ -3336,13 +3329,40 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
- 			IWL_DEBUG_HT(priv, "priv->_agn.agg_tids_count = %u\n",
- 				     priv->_agn.agg_tids_count);
- 		}
-+		if (priv->cfg->use_rts_for_ht) {
-+			struct iwl_station_priv *sta_priv =
-+				(void *) sta->drv_priv;
-+			/*
-+			 * switch off RTS/CTS if it was previously enabled
-+			 */
-+
-+			sta_priv->lq_sta.lq.general_params.flags &=
-+				~LINK_QUAL_FLAGS_SET_STA_TLC_RTS_MSK;
-+			iwl_send_lq_cmd(priv, &sta_priv->lq_sta.lq,
-+				CMD_ASYNC, false);
-+		}
-+ 		break;
- 		if (test_bit(STATUS_EXIT_PENDING, &priv->status))
- 			return 0;
- 		else
- 			return ret;
- 	case IEEE80211_AMPDU_TX_OPERATIONAL:
--		/* do nothing */
--		return -EOPNOTSUPP;
-+		if (priv->cfg->use_rts_for_ht) {
-+			struct iwl_station_priv *sta_priv =
-+				(void *) sta->drv_priv;
-+
-+			/*
-+			 * switch to RTS/CTS if it is the prefer protection
-+			 * method for HT traffic
-+			 */
-+
-+			sta_priv->lq_sta.lq.general_params.flags |=
-+				LINK_QUAL_FLAGS_SET_STA_TLC_RTS_MSK;
-+			iwl_send_lq_cmd(priv, &sta_priv->lq_sta.lq,
-+				CMD_ASYNC, false);
-+		}
-+		ret = 0;
-+		break;
- 	default:
- 		IWL_DEBUG_HT(priv, "unknown\n");
- 		return -EINVAL;
-@@ -3423,6 +3443,49 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
- 	return 0;
- }
- 
-+static void iwlagn_configure_filter(struct ieee80211_hw *hw,
-+				    unsigned int changed_flags,
-+				    unsigned int *total_flags,
-+				    u64 multicast)
-+{
-+	struct iwl_priv *priv = hw->priv;
-+	__le32 filter_or = 0, filter_nand = 0;
-+
-+#define CHK(test, flag)	do { \
-+	if (*total_flags & (test))		\
-+		filter_or |= (flag);		\
-+	else					\
-+		filter_nand |= (flag);		\
-+	} while (0)
-+
-+	IWL_DEBUG_MAC80211(priv, "Enter: changed: 0x%x, total: 0x%x\n",
-+			changed_flags, *total_flags);
-+
-+	CHK(FIF_OTHER_BSS | FIF_PROMISC_IN_BSS, RXON_FILTER_PROMISC_MSK);
-+	CHK(FIF_CONTROL, RXON_FILTER_CTL2HOST_MSK);
-+	CHK(FIF_BCN_PRBRESP_PROMISC, RXON_FILTER_BCON_AWARE_MSK);
-+
-+#undef CHK
-+
-+	mutex_lock(&priv->mutex);
-+
-+	priv->staging_rxon.filter_flags &= ~filter_nand;
-+	priv->staging_rxon.filter_flags |= filter_or;
-+
-+	iwlcore_commit_rxon(priv);
-+
-+	mutex_unlock(&priv->mutex);
-+
-+	/*
-+	 * Receiving all multicast frames is always enabled by the
-+	 * default flags setup in iwl_connection_init_rx_config()
-+	 * since we currently do not support programming multicast
-+	 * filters into the device.
-+	 */
-+	*total_flags &= FIF_OTHER_BSS | FIF_ALLMULTI | FIF_PROMISC_IN_BSS |
-+			FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
-+}
-+
- /*****************************************************************************
-  *
-  * driver setup and teardown
-@@ -3583,7 +3646,7 @@ static struct ieee80211_ops iwl_hw_ops = {
- 	.add_interface = iwl_mac_add_interface,
- 	.remove_interface = iwl_mac_remove_interface,
- 	.config = iwl_mac_config,
--	.configure_filter = iwl_configure_filter,
-+	.configure_filter = iwlagn_configure_filter,
- 	.set_key = iwl_mac_set_key,
- 	.update_tkip_key = iwl_mac_update_tkip_key,
- 	.conf_tx = iwl_mac_conf_tx,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
-index 5bbc529..cd5b664 100644
---- a/drivers/net/wireless/iwlwifi/iwl-core.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
-@@ -403,19 +403,36 @@ EXPORT_SYMBOL(iwlcore_free_geos);
-  *  iwlcore_rts_tx_cmd_flag: Set rts/cts. 3945 and 4965 only share this
-  *  function.
-  */
--void iwlcore_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
--				__le32 *tx_flags)
-+void iwlcore_rts_tx_cmd_flag(struct iwl_priv *priv,
-+			       struct ieee80211_tx_info *info,
-+			       __le16 fc, __le32 *tx_flags)
- {
- 	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
- 		*tx_flags |= TX_CMD_FLG_RTS_MSK;
- 		*tx_flags &= ~TX_CMD_FLG_CTS_MSK;
-+		*tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
-+
-+		if (!ieee80211_is_mgmt(fc))
-+			return;
-+
-+		switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
-+		case cpu_to_le16(IEEE80211_STYPE_AUTH):
-+		case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
-+		case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
-+		case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
-+			*tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-+			*tx_flags |= TX_CMD_FLG_CTS_MSK;
-+			break;
-+		}
- 	} else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
- 		*tx_flags &= ~TX_CMD_FLG_RTS_MSK;
- 		*tx_flags |= TX_CMD_FLG_CTS_MSK;
-+		*tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
- 	}
- }
- EXPORT_SYMBOL(iwlcore_rts_tx_cmd_flag);
- 
-+
- static bool is_single_rx_stream(struct iwl_priv *priv)
- {
- 	return priv->current_ht_config.smps == IEEE80211_SMPS_STATIC ||
-@@ -1294,51 +1311,6 @@ out:
- EXPORT_SYMBOL(iwl_apm_init);
- 
- 
--
--void iwl_configure_filter(struct ieee80211_hw *hw,
--			  unsigned int changed_flags,
--			  unsigned int *total_flags,
--			  u64 multicast)
--{
--	struct iwl_priv *priv = hw->priv;
--	__le32 filter_or = 0, filter_nand = 0;
--
--#define CHK(test, flag)	do { \
--	if (*total_flags & (test))		\
--		filter_or |= (flag);		\
--	else					\
--		filter_nand |= (flag);		\
--	} while (0)
--
--	IWL_DEBUG_MAC80211(priv, "Enter: changed: 0x%x, total: 0x%x\n",
--			changed_flags, *total_flags);
--
--	CHK(FIF_OTHER_BSS | FIF_PROMISC_IN_BSS, RXON_FILTER_PROMISC_MSK);
--	CHK(FIF_CONTROL, RXON_FILTER_CTL2HOST_MSK);
--	CHK(FIF_BCN_PRBRESP_PROMISC, RXON_FILTER_BCON_AWARE_MSK);
--
--#undef CHK
--
--	mutex_lock(&priv->mutex);
--
--	priv->staging_rxon.filter_flags &= ~filter_nand;
--	priv->staging_rxon.filter_flags |= filter_or;
--
--	iwlcore_commit_rxon(priv);
--
--	mutex_unlock(&priv->mutex);
--
--	/*
--	 * Receiving all multicast frames is always enabled by the
--	 * default flags setup in iwl_connection_init_rx_config()
--	 * since we currently do not support programming multicast
--	 * filters into the device.
--	 */
--	*total_flags &= FIF_OTHER_BSS | FIF_ALLMULTI | FIF_PROMISC_IN_BSS |
--			FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
--}
--EXPORT_SYMBOL(iwl_configure_filter);
--
- int iwl_set_hw_params(struct iwl_priv *priv)
- {
- 	priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
-@@ -1936,6 +1908,10 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
- 			priv->staging_rxon.flags |= RXON_FLG_TGG_PROTECT_MSK;
- 		else
- 			priv->staging_rxon.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
-+		if (bss_conf->use_cts_prot)
-+			priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
-+		else
-+			priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
- 	}
- 
- 	if (changes & BSS_CHANGED_BASIC_RATES) {
-diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
-index 31775bd..e8ef317 100644
---- a/drivers/net/wireless/iwlwifi/iwl-core.h
-+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
-@@ -102,8 +102,9 @@ struct iwl_hcmd_utils_ops {
- 			u32 min_average_noise,
- 			u8 default_chain);
- 	void (*chain_noise_reset)(struct iwl_priv *priv);
--	void (*rts_tx_cmd_flag)(struct ieee80211_tx_info *info,
--			__le32 *tx_flags);
-+	void (*rts_tx_cmd_flag)(struct iwl_priv *priv,
-+				  struct ieee80211_tx_info *info,
-+				  __le16 fc, __le32 *tx_flags);
- 	int  (*calc_rssi)(struct iwl_priv *priv,
- 			  struct iwl_rx_phy_res *rx_resp);
- 	void (*request_scan)(struct iwl_priv *priv, struct ieee80211_vif *vif);
-@@ -355,9 +356,6 @@ int iwl_set_decrypted_flag(struct iwl_priv *priv,
- 			   u32 decrypt_res,
- 			   struct ieee80211_rx_status *stats);
- void iwl_irq_handle_error(struct iwl_priv *priv);
--void iwl_configure_filter(struct ieee80211_hw *hw,
--			  unsigned int changed_flags,
--			  unsigned int *total_flags, u64 multicast);
- int iwl_set_hw_params(struct iwl_priv *priv);
- void iwl_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif);
- void iwl_bss_info_changed(struct ieee80211_hw *hw,
-@@ -375,8 +373,9 @@ void iwl_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif);
- void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
- int iwl_alloc_txq_mem(struct iwl_priv *priv);
- void iwl_free_txq_mem(struct iwl_priv *priv);
--void iwlcore_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
--				__le32 *tx_flags);
-+void iwlcore_rts_tx_cmd_flag(struct iwl_priv *priv,
-+			       struct ieee80211_tx_info *info,
-+			       __le16 fc, __le32 *tx_flags);
- #ifdef CONFIG_IWLWIFI_DEBUGFS
- int iwl_alloc_traffic_mem(struct iwl_priv *priv);
- void iwl_free_traffic_mem(struct iwl_priv *priv);
-diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
-index a27872d..39c0d2d 100644
---- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
-+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
-@@ -434,10 +434,7 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
- 		tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
- 	}
- 
--	priv->cfg->ops->utils->rts_tx_cmd_flag(info, &tx_flags);
--
--	if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
--		tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
-+	priv->cfg->ops->utils->rts_tx_cmd_flag(priv, info, fc, &tx_flags);
- 
- 	tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
- 	if (ieee80211_is_mgmt(fc)) {
-@@ -3465,6 +3462,55 @@ static int iwl3945_mac_sta_add(struct ieee80211_hw *hw,
- 
- 	return 0;
- }
-+
-+static void iwl3945_configure_filter(struct ieee80211_hw *hw,
-+				     unsigned int changed_flags,
-+				     unsigned int *total_flags,
-+				     u64 multicast)
-+{
-+	struct iwl_priv *priv = hw->priv;
-+	__le32 filter_or = 0, filter_nand = 0;
-+
-+#define CHK(test, flag)	do { \
-+	if (*total_flags & (test))		\
-+		filter_or |= (flag);		\
-+	else					\
-+		filter_nand |= (flag);		\
-+	} while (0)
-+
-+	IWL_DEBUG_MAC80211(priv, "Enter: changed: 0x%x, total: 0x%x\n",
-+			changed_flags, *total_flags);
-+
-+	CHK(FIF_OTHER_BSS | FIF_PROMISC_IN_BSS, RXON_FILTER_PROMISC_MSK);
-+	CHK(FIF_CONTROL, RXON_FILTER_CTL2HOST_MSK);
-+	CHK(FIF_BCN_PRBRESP_PROMISC, RXON_FILTER_BCON_AWARE_MSK);
-+
-+#undef CHK
-+
-+	mutex_lock(&priv->mutex);
-+
-+	priv->staging_rxon.filter_flags &= ~filter_nand;
-+	priv->staging_rxon.filter_flags |= filter_or;
-+
-+	/*
-+	 * Committing directly here breaks for some reason,
-+	 * but we'll eventually commit the filter flags
-+	 * change anyway.
-+	 */
-+
-+	mutex_unlock(&priv->mutex);
-+
-+	/*
-+	 * Receiving all multicast frames is always enabled by the
-+	 * default flags setup in iwl_connection_init_rx_config()
-+	 * since we currently do not support programming multicast
-+	 * filters into the device.
-+	 */
-+	*total_flags &= FIF_OTHER_BSS | FIF_ALLMULTI | FIF_PROMISC_IN_BSS |
-+			FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
-+}
-+
-+
- /*****************************************************************************
-  *
-  * sysfs attributes
-@@ -3870,7 +3916,7 @@ static struct ieee80211_ops iwl3945_hw_ops = {
- 	.add_interface = iwl_mac_add_interface,
- 	.remove_interface = iwl_mac_remove_interface,
- 	.config = iwl_mac_config,
--	.configure_filter = iwl_configure_filter,
-+	.configure_filter = iwl3945_configure_filter,
- 	.set_key = iwl3945_mac_set_key,
- 	.conf_tx = iwl_mac_conf_tx,
- 	.reset_tsf = iwl_mac_reset_tsf,
-diff --git a/drivers/net/wireless/wl12xx/wl1251_cmd.c b/drivers/net/wireless/wl12xx/wl1251_cmd.c
-index a37b30c..ce3722f 100644
---- a/drivers/net/wireless/wl12xx/wl1251_cmd.c
-+++ b/drivers/net/wireless/wl12xx/wl1251_cmd.c
-@@ -484,7 +484,7 @@ int wl1251_cmd_trigger_scan_to(struct wl1251 *wl, u32 timeout)
- 
- 	cmd->timeout = timeout;
- 
--	ret = wl1251_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd));
-+	ret = wl1251_cmd_send(wl, CMD_TRIGGER_SCAN_TO, cmd, sizeof(*cmd));
- 	if (ret < 0) {
- 		wl1251_error("cmd trigger scan to failed: %d", ret);
- 		goto out;
-diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
-index 71ff154..90111d7 100644
---- a/drivers/platform/x86/compal-laptop.c
-+++ b/drivers/platform/x86/compal-laptop.c
-@@ -259,6 +259,14 @@ static struct dmi_system_id __initdata compal_dmi_table[] = {
- 		.callback = dmi_check_cb
- 	},
- 	{
-+		.ident = "Dell Mini 1012",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1012"),
-+		},
-+		.callback = dmi_check_cb
-+	},
-+	{
- 		.ident = "Dell Inspiron 11z",
- 		.matches = {
- 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-@@ -375,5 +383,6 @@ MODULE_ALIAS("dmi:*:rnIFT00:rvrIFT00:*");
- MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron910:*");
- MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron1010:*");
- MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron1011:*");
-+MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron1012:*");
- MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron1110:*");
- MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron1210:*");
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index 661e3ac..6110601 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -116,6 +116,13 @@ static struct dmi_system_id __devinitdata dell_blacklist[] = {
- 		},
- 	},
- 	{
-+		.ident = "Dell Mini 1012",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1012"),
-+		},
-+	},
-+	{
- 		.ident = "Dell Inspiron 11z",
- 		.matches = {
- 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-diff --git a/drivers/regulator/wm8994-regulator.c b/drivers/regulator/wm8994-regulator.c
-index 5a1dc8a..03713bc 100644
---- a/drivers/regulator/wm8994-regulator.c
-+++ b/drivers/regulator/wm8994-regulator.c
-@@ -219,8 +219,6 @@ static __devinit int wm8994_ldo_probe(struct platform_device *pdev)
- 
- 	ldo->wm8994 = wm8994;
- 
--	ldo->is_enabled = true;
--
- 	if (pdata->ldo[id].enable && gpio_is_valid(pdata->ldo[id].enable)) {
- 		ldo->enable = pdata->ldo[id].enable;
- 
-@@ -237,7 +235,8 @@ static __devinit int wm8994_ldo_probe(struct platform_device *pdev)
- 				ret);
- 			goto err_gpio;
- 		}
--	}
-+	} else
-+		ldo->is_enabled = true;
- 
- 	ldo->regulator = regulator_register(&wm8994_ldo_desc[id], &pdev->dev,
- 					     pdata->ldo[id].init_data, ldo);
-diff --git a/drivers/serial/suncore.c b/drivers/serial/suncore.c
-index 544f2e2..6381a02 100644
---- a/drivers/serial/suncore.c
-+++ b/drivers/serial/suncore.c
-@@ -55,7 +55,12 @@ EXPORT_SYMBOL(sunserial_unregister_minors);
- int sunserial_console_match(struct console *con, struct device_node *dp,
- 			    struct uart_driver *drv, int line, bool ignore_line)
- {
--	if (!con || of_console_device != dp)
-+	if (!con)
-+		return 0;
-+
-+	drv->cons = con;
-+
-+	if (of_console_device != dp)
- 		return 0;
- 
- 	if (!ignore_line) {
-@@ -69,12 +74,10 @@ int sunserial_console_match(struct console *con, struct device_node *dp,
- 			return 0;
- 	}
- 
--	con->index = line;
--	drv->cons = con;
--
--	if (!console_set_on_cmdline)
-+	if (!console_set_on_cmdline) {
-+		con->index = line;
- 		add_preferred_console(con->name, line, NULL);
--
-+	}
- 	return 1;
- }
- EXPORT_SYMBOL(sunserial_console_match);
-diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
-index 7a582e8..ce1d251 100644
---- a/drivers/staging/batman-adv/hard-interface.c
-+++ b/drivers/staging/batman-adv/hard-interface.c
-@@ -128,6 +128,9 @@ static bool hardif_is_iface_up(struct batman_if *batman_if)
- 
- static void update_mac_addresses(struct batman_if *batman_if)
- {
-+	if (!batman_if || !batman_if->packet_buff)
-+		return;
-+
- 	addr_to_string(batman_if->addr_str, batman_if->net_dev->dev_addr);
- 
- 	memcpy(((struct batman_packet *)(batman_if->packet_buff))->orig,
-@@ -194,8 +197,6 @@ static void hardif_activate_interface(struct bat_priv *bat_priv,
- 	if (batman_if->if_status != IF_INACTIVE)
- 		return;
- 
--	dev_hold(batman_if->net_dev);
--
- 	update_mac_addresses(batman_if);
- 	batman_if->if_status = IF_TO_BE_ACTIVATED;
- 
-@@ -222,8 +223,6 @@ static void hardif_deactivate_interface(struct batman_if *batman_if)
- 	   (batman_if->if_status != IF_TO_BE_ACTIVATED))
- 		return;
- 
--	dev_put(batman_if->net_dev);
--
- 	batman_if->if_status = IF_INACTIVE;
- 
- 	printk(KERN_INFO "batman-adv:Interface deactivated: %s\n",
-@@ -321,12 +320,14 @@ static struct batman_if *hardif_add_interface(struct net_device *net_dev)
- 	if (ret != 1)
- 		goto out;
- 
-+	dev_hold(net_dev);
-+
- 	batman_if = kmalloc(sizeof(struct batman_if), GFP_ATOMIC);
- 	if (!batman_if) {
- 		printk(KERN_ERR "batman-adv:"
- 		       "Can't add interface (%s): out of memory\n",
- 		       net_dev->name);
--		goto out;
-+		goto release_dev;
- 	}
- 
- 	batman_if->dev = kstrdup(net_dev->name, GFP_ATOMIC);
-@@ -340,6 +341,7 @@ static struct batman_if *hardif_add_interface(struct net_device *net_dev)
- 	batman_if->if_num = -1;
- 	batman_if->net_dev = net_dev;
- 	batman_if->if_status = IF_NOT_IN_USE;
-+	batman_if->packet_buff = NULL;
- 	INIT_LIST_HEAD(&batman_if->list);
- 
- 	check_known_mac_addr(batman_if->net_dev->dev_addr);
-@@ -350,6 +352,8 @@ free_dev:
- 	kfree(batman_if->dev);
- free_if:
- 	kfree(batman_if);
-+release_dev:
-+	dev_put(net_dev);
- out:
- 	return NULL;
- }
-@@ -378,6 +382,7 @@ static void hardif_remove_interface(struct batman_if *batman_if)
- 	batman_if->if_status = IF_TO_BE_REMOVED;
- 	list_del_rcu(&batman_if->list);
- 	sysfs_del_hardif(&batman_if->hardif_obj);
-+	dev_put(batman_if->net_dev);
- 	call_rcu(&batman_if->rcu, hardif_free_interface);
- }
- 
-@@ -397,15 +402,13 @@ static int hard_if_event(struct notifier_block *this,
- 	/* FIXME: each batman_if will be attached to a softif */
- 	struct bat_priv *bat_priv = netdev_priv(soft_device);
- 
--	if (!batman_if)
--		batman_if = hardif_add_interface(net_dev);
-+	if (!batman_if && event == NETDEV_REGISTER)
-+			batman_if = hardif_add_interface(net_dev);
- 
- 	if (!batman_if)
- 		goto out;
- 
- 	switch (event) {
--	case NETDEV_REGISTER:
--		break;
- 	case NETDEV_UP:
- 		hardif_activate_interface(bat_priv, batman_if);
- 		break;
-diff --git a/drivers/staging/batman-adv/originator.c b/drivers/staging/batman-adv/originator.c
-index 568aef8..2177c50 100644
---- a/drivers/staging/batman-adv/originator.c
-+++ b/drivers/staging/batman-adv/originator.c
-@@ -401,11 +401,12 @@ static int orig_node_add_if(struct orig_node *orig_node, int max_if_num)
- int orig_hash_add_if(struct batman_if *batman_if, int max_if_num)
- {
- 	struct orig_node *orig_node;
-+	unsigned long flags;
- 	HASHIT(hashit);
- 
- 	/* resize all orig nodes because orig_node->bcast_own(_sum) depend on
- 	 * if_num */
--	spin_lock(&orig_hash_lock);
-+	spin_lock_irqsave(&orig_hash_lock, flags);
- 
- 	while (hash_iterate(orig_hash, &hashit)) {
- 		orig_node = hashit.bucket->data;
-@@ -414,11 +415,11 @@ int orig_hash_add_if(struct batman_if *batman_if, int max_if_num)
- 			goto err;
- 	}
- 
--	spin_unlock(&orig_hash_lock);
-+	spin_unlock_irqrestore(&orig_hash_lock, flags);
- 	return 0;
- 
- err:
--	spin_unlock(&orig_hash_lock);
-+	spin_unlock_irqrestore(&orig_hash_lock, flags);
- 	return -ENOMEM;
- }
- 
-@@ -480,12 +481,13 @@ int orig_hash_del_if(struct batman_if *batman_if, int max_if_num)
- {
- 	struct batman_if *batman_if_tmp;
- 	struct orig_node *orig_node;
-+	unsigned long flags;
- 	HASHIT(hashit);
- 	int ret;
- 
- 	/* resize all orig nodes because orig_node->bcast_own(_sum) depend on
- 	 * if_num */
--	spin_lock(&orig_hash_lock);
-+	spin_lock_irqsave(&orig_hash_lock, flags);
- 
- 	while (hash_iterate(orig_hash, &hashit)) {
- 		orig_node = hashit.bucket->data;
-@@ -512,10 +514,10 @@ int orig_hash_del_if(struct batman_if *batman_if, int max_if_num)
- 	rcu_read_unlock();
- 
- 	batman_if->if_num = -1;
--	spin_unlock(&orig_hash_lock);
-+	spin_unlock_irqrestore(&orig_hash_lock, flags);
- 	return 0;
- 
- err:
--	spin_unlock(&orig_hash_lock);
-+	spin_unlock_irqrestore(&orig_hash_lock, flags);
- 	return -ENOMEM;
- }
-diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index bfc99a9..221f999 100644
---- a/drivers/usb/host/xhci-ring.c
-+++ b/drivers/usb/host/xhci-ring.c
-@@ -131,7 +131,7 @@ static void next_trb(struct xhci_hcd *xhci,
- 		*seg = (*seg)->next;
- 		*trb = ((*seg)->trbs);
- 	} else {
--		*trb = (*trb)++;
-+		(*trb)++;
- 	}
- }
- 
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 2bef441..80bf833 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -222,8 +222,8 @@ static struct usb_serial_driver cp210x_device = {
- #define BITS_STOP_2		0x0002
- 
- /* CP210X_SET_BREAK */
--#define BREAK_ON		0x0000
--#define BREAK_OFF		0x0001
-+#define BREAK_ON		0x0001
-+#define BREAK_OFF		0x0000
- 
- /* CP210X_(SET_MHS|GET_MDMSTS) */
- #define CONTROL_DTR		0x0001
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index eb12d9b..63ddb2f 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -180,6 +180,7 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
- 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_LENZ_LIUSB_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_XF_632_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_XF_634_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_XF_547_PID) },
-@@ -750,6 +751,8 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) },
-+	{ USB_DEVICE(IONICS_VID, IONICS_PLUGCOMPUTER_PID),
-+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ },					/* Optional parameter entry */
- 	{ }					/* Terminating entry */
- };
-@@ -1376,7 +1379,7 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port)
- 	}
- 
- 	/* set max packet size based on descriptor */
--	priv->max_packet_size = ep_desc->wMaxPacketSize;
-+	priv->max_packet_size = le16_to_cpu(ep_desc->wMaxPacketSize);
- 
- 	dev_info(&udev->dev, "Setting MaxPacketSize %d\n", priv->max_packet_size);
- }
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index 6e612c5..2e95857 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -110,6 +110,9 @@
- /* Propox devices */
- #define FTDI_PROPOX_JTAGCABLEII_PID	0xD738
- 
-+/* Lenz LI-USB Computer Interface. */
-+#define FTDI_LENZ_LIUSB_PID	0xD780
-+
- /*
-  * Xsens Technologies BV products (http://www.xsens.com).
-  */
-@@ -989,6 +992,12 @@
- #define ALTI2_N3_PID	0x6001	/* Neptune 3 */
- 
- /*
-+ * Ionics PlugComputer
-+ */
-+#define IONICS_VID			0x1c0c
-+#define IONICS_PLUGCOMPUTER_PID		0x0102
-+
-+/*
-  * Dresden Elektronik Sensor Terminal Board
-  */
- #define DE_VID			0x1cf1 /* Vendor ID */
-diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
-index 0fca265..9991063 100644
---- a/drivers/usb/serial/io_ti.c
-+++ b/drivers/usb/serial/io_ti.c
-@@ -1151,7 +1151,7 @@ static int download_fw(struct edgeport_serial *serial)
- 
- 			/* Check if we have an old version in the I2C and
- 			   update if necessary */
--			if (download_cur_ver != download_new_ver) {
-+			if (download_cur_ver < download_new_ver) {
- 				dbg("%s - Update I2C dld from %d.%d to %d.%d",
- 				    __func__,
- 				    firmware_version->Ver_Major,
-diff --git a/drivers/usb/serial/navman.c b/drivers/usb/serial/navman.c
-index a6b207c..1f00f24 100644
---- a/drivers/usb/serial/navman.c
-+++ b/drivers/usb/serial/navman.c
-@@ -25,6 +25,7 @@ static int debug;
- 
- static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(0x0a99, 0x0001) },	/* Talon Technology device */
-+	{ USB_DEVICE(0x0df7, 0x0900) },	/* Mobile Action i-gotU */
- 	{ },
- };
- MODULE_DEVICE_TABLE(usb, id_table);
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 5c35b3a..80c74d4 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -368,6 +368,10 @@ static void option_instat_callback(struct urb *urb);
- #define OLIVETTI_VENDOR_ID			0x0b3c
- #define OLIVETTI_PRODUCT_OLICARD100		0xc000
- 
-+/* Celot products */
-+#define CELOT_VENDOR_ID				0x211f
-+#define CELOT_PRODUCT_CT680M			0x6801
-+
- /* some devices interfaces need special handling due to a number of reasons */
- enum option_blacklist_reason {
- 		OPTION_BLACKLIST_NONE = 0,
-@@ -891,10 +895,9 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) },
- 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
- 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
--
- 	{ USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
--
- 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
-+	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
- 	{ } /* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, option_ids);
-diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
-index 6b60018..c98f0fb 100644
---- a/drivers/usb/serial/pl2303.c
-+++ b/drivers/usb/serial/pl2303.c
-@@ -86,6 +86,7 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
- 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
- 	{ USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
-+	{ USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
- 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
- 	{ USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
- 	{ USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
-diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
-index a871645..43eb9bd 100644
---- a/drivers/usb/serial/pl2303.h
-+++ b/drivers/usb/serial/pl2303.h
-@@ -128,6 +128,10 @@
- #define CRESSI_VENDOR_ID	0x04b8
- #define CRESSI_EDY_PRODUCT_ID	0x0521
- 
-+/* Zeagle dive computer interface */
-+#define ZEAGLE_VENDOR_ID	0x04b8
-+#define ZEAGLE_N2ITION3_PRODUCT_ID	0x0522
-+
- /* Sony, USB data cable for CMD-Jxx mobile phones */
- #define SONY_VENDOR_ID		0x054c
- #define SONY_QN3USB_PRODUCT_ID	0x0437
-diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h
-index f3a4e15..f96a471 100644
---- a/drivers/video/matrox/matroxfb_base.h
-+++ b/drivers/video/matrox/matroxfb_base.h
-@@ -151,13 +151,13 @@ static inline void mga_writel(vaddr_t va, unsigned int offs, u_int32_t value) {
- static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len) {
- #if defined(__alpha__) || defined(__i386__) || defined(__x86_64__)
- 	/*
--	 * memcpy_toio works for us if:
-+	 * iowrite32_rep works for us if:
- 	 *  (1) Copies data as 32bit quantities, not byte after byte,
- 	 *  (2) Performs LE ordered stores, and
- 	 *  (3) It copes with unaligned source (destination is guaranteed to be page
- 	 *      aligned and length is guaranteed to be multiple of 4).
- 	 */
--	memcpy_toio(va.vaddr, src, len);
-+	iowrite32_rep(va.vaddr, src, len >> 2);
- #else
-         u_int32_t __iomem* addr = va.vaddr;
- 
-diff --git a/firmware/Makefile b/firmware/Makefile
-index 020e629..99955ed 100644
---- a/firmware/Makefile
-+++ b/firmware/Makefile
-@@ -142,7 +142,7 @@ fw-shipped-$(CONFIG_YAM) += yam/1200.bin yam/9600.bin
- fw-shipped-all := $(fw-shipped-y) $(fw-shipped-m) $(fw-shipped-)
- 
- # Directories which we _might_ need to create, so we have a rule for them.
--firmware-dirs := $(sort $(patsubst %,$(objtree)/$(obj)/%/,$(dir $(fw-external-y) $(fw-shipped-all))))
-+firmware-dirs := $(sort $(addprefix $(objtree)/$(obj)/,$(dir $(fw-external-y) $(fw-shipped-all))))
- 
- quiet_cmd_mkdir = MKDIR   $(patsubst $(objtree)/%,%,$@)
-       cmd_mkdir = mkdir -p $@
-diff --git a/fs/char_dev.c b/fs/char_dev.c
-index d6db933..f80a4f2 100644
---- a/fs/char_dev.c
-+++ b/fs/char_dev.c
-@@ -20,6 +20,7 @@
- #include <linux/cdev.h>
- #include <linux/mutex.h>
- #include <linux/backing-dev.h>
-+#include <linux/tty.h>
- 
- #include "internal.h"
- 
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index e60416d..d69551e 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -1103,7 +1103,7 @@ static int nfs_open_revalidate(struct dentry *dentry, struct nameidata *nd)
- 	if ((openflags & (O_CREAT|O_EXCL)) == (O_CREAT|O_EXCL))
- 		goto no_open_dput;
- 	/* We can't create new files, or truncate existing ones here */
--	openflags &= ~(O_CREAT|O_TRUNC);
-+	openflags &= ~(O_CREAT|O_EXCL|O_TRUNC);
- 
- 	/*
- 	 * Note: we're not holding inode->i_mutex and so may be racing with
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 70015dd..330a3c9 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -2023,7 +2023,8 @@ nfs4_atomic_open(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
- 	struct rpc_cred *cred;
- 	struct nfs4_state *state;
- 	struct dentry *res;
--	fmode_t fmode = nd->intent.open.flags & (FMODE_READ | FMODE_WRITE | FMODE_EXEC);
-+	int open_flags = nd->intent.open.flags;
-+	fmode_t fmode = open_flags & (FMODE_READ | FMODE_WRITE | FMODE_EXEC);
- 
- 	if (nd->flags & LOOKUP_CREATE) {
- 		attr.ia_mode = nd->intent.open.create_mode;
-@@ -2031,8 +2032,9 @@ nfs4_atomic_open(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
- 		if (!IS_POSIXACL(dir))
- 			attr.ia_mode &= ~current_umask();
- 	} else {
-+		open_flags &= ~O_EXCL;
- 		attr.ia_valid = 0;
--		BUG_ON(nd->intent.open.flags & O_CREAT);
-+		BUG_ON(open_flags & O_CREAT);
- 	}
- 
- 	cred = rpc_lookup_cred();
-@@ -2041,7 +2043,7 @@ nfs4_atomic_open(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
- 	parent = dentry->d_parent;
- 	/* Protect against concurrent sillydeletes */
- 	nfs_block_sillyrename(parent);
--	state = nfs4_do_open(dir, &path, fmode, nd->intent.open.flags, &attr, cred);
-+	state = nfs4_do_open(dir, &path, fmode, open_flags, &attr, cred);
- 	put_rpccred(cred);
- 	if (IS_ERR(state)) {
- 		if (PTR_ERR(state) == -ENOENT) {
-diff --git a/fs/nfs/super.c b/fs/nfs/super.c
-index f9df16d..6bf11d7 100644
---- a/fs/nfs/super.c
-+++ b/fs/nfs/super.c
-@@ -652,6 +652,13 @@ static void nfs_show_mount_options(struct seq_file *m, struct nfs_server *nfss,
- 
- 	if (nfss->options & NFS_OPTION_FSCACHE)
- 		seq_printf(m, ",fsc");
-+
-+	if (nfss->flags & NFS_MOUNT_LOOKUP_CACHE_NONEG) {
-+		if (nfss->flags & NFS_MOUNT_LOOKUP_CACHE_NONE)
-+			seq_printf(m, ",lookupcache=none");
-+		else
-+			seq_printf(m, ",lookupcache=pos");
-+	}
- }
- 
- /*
-diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
-index 414ef68..fbb354c 100644
---- a/fs/nilfs2/super.c
-+++ b/fs/nilfs2/super.c
-@@ -336,9 +336,10 @@ int nilfs_attach_checkpoint(struct nilfs_sb_info *sbi, __u64 cno)
- 	list_add(&sbi->s_list, &nilfs->ns_supers);
- 	up_write(&nilfs->ns_super_sem);
- 
-+	err = -ENOMEM;
- 	sbi->s_ifile = nilfs_ifile_new(sbi, nilfs->ns_inode_size);
- 	if (!sbi->s_ifile)
--		return -ENOMEM;
-+		goto delist;
- 
- 	down_read(&nilfs->ns_segctor_sem);
- 	err = nilfs_cpfile_get_checkpoint(nilfs->ns_cpfile, cno, 0, &raw_cp,
-@@ -369,6 +370,7 @@ int nilfs_attach_checkpoint(struct nilfs_sb_info *sbi, __u64 cno)
- 	nilfs_mdt_destroy(sbi->s_ifile);
- 	sbi->s_ifile = NULL;
- 
-+ delist:
- 	down_write(&nilfs->ns_super_sem);
- 	list_del_init(&sbi->s_list);
- 	up_write(&nilfs->ns_super_sem);
-diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
-index da70229..a76e0aa 100644
---- a/fs/ocfs2/acl.c
-+++ b/fs/ocfs2/acl.c
-@@ -290,12 +290,30 @@ static int ocfs2_set_acl(handle_t *handle,
- 
- int ocfs2_check_acl(struct inode *inode, int mask)
- {
--	struct posix_acl *acl = ocfs2_get_acl(inode, ACL_TYPE_ACCESS);
-+	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
-+	struct buffer_head *di_bh = NULL;
-+	struct posix_acl *acl;
-+	int ret = -EAGAIN;
- 
--	if (IS_ERR(acl))
-+	if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL))
-+		return ret;
-+
-+	ret = ocfs2_read_inode_block(inode, &di_bh);
-+	if (ret < 0) {
-+		mlog_errno(ret);
-+		return ret;
-+	}
-+
-+	acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, di_bh);
-+
-+	brelse(di_bh);
-+
-+	if (IS_ERR(acl)) {
-+		mlog_errno(PTR_ERR(acl));
- 		return PTR_ERR(acl);
-+	}
- 	if (acl) {
--		int ret = posix_acl_permission(inode, acl, mask);
-+		ret = posix_acl_permission(inode, acl, mask);
- 		posix_acl_release(acl);
- 		return ret;
- 	}
-@@ -344,7 +362,7 @@ int ocfs2_init_acl(handle_t *handle,
- {
- 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
- 	struct posix_acl *acl = NULL;
--	int ret = 0;
-+	int ret = 0, ret2;
- 	mode_t mode;
- 
- 	if (!S_ISLNK(inode->i_mode)) {
-@@ -381,7 +399,12 @@ int ocfs2_init_acl(handle_t *handle,
- 		mode = inode->i_mode;
- 		ret = posix_acl_create_masq(clone, &mode);
- 		if (ret >= 0) {
--			ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode);
-+			ret2 = ocfs2_acl_set_mode(inode, di_bh, handle, mode);
-+			if (ret2) {
-+				mlog_errno(ret2);
-+				ret = ret2;
-+				goto cleanup;
-+			}
- 			if (ret > 0) {
- 				ret = ocfs2_set_acl(handle, inode,
- 						    di_bh, ACL_TYPE_ACCESS,
-diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
-index 94b97fc..ffb4c68 100644
---- a/fs/ocfs2/dlm/dlmmaster.c
-+++ b/fs/ocfs2/dlm/dlmmaster.c
-@@ -511,8 +511,6 @@ static void dlm_lockres_release(struct kref *kref)
- 
- 	atomic_dec(&dlm->res_cur_count);
- 
--	dlm_put(dlm);
--
- 	if (!hlist_unhashed(&res->hash_node) ||
- 	    !list_empty(&res->granted) ||
- 	    !list_empty(&res->converting) ||
-@@ -585,8 +583,6 @@ static void dlm_init_lockres(struct dlm_ctxt *dlm,
- 	res->migration_pending = 0;
- 	res->inflight_locks = 0;
- 
--	/* put in dlm_lockres_release */
--	dlm_grab(dlm);
- 	res->dlm = dlm;
- 
- 	kref_init(&res->refs);
-@@ -3050,8 +3046,6 @@ int dlm_migrate_request_handler(struct o2net_msg *msg, u32 len, void *data,
- 	/* check for pre-existing lock */
- 	spin_lock(&dlm->spinlock);
- 	res = __dlm_lookup_lockres(dlm, name, namelen, hash);
--	spin_lock(&dlm->master_lock);
--
- 	if (res) {
- 		spin_lock(&res->spinlock);
- 		if (res->state & DLM_LOCK_RES_RECOVERING) {
-@@ -3069,14 +3063,15 @@ int dlm_migrate_request_handler(struct o2net_msg *msg, u32 len, void *data,
- 		spin_unlock(&res->spinlock);
- 	}
- 
-+	spin_lock(&dlm->master_lock);
- 	/* ignore status.  only nonzero status would BUG. */
- 	ret = dlm_add_migration_mle(dlm, res, mle, &oldmle,
- 				    name, namelen,
- 				    migrate->new_master,
- 				    migrate->master);
- 
--unlock:
- 	spin_unlock(&dlm->master_lock);
-+unlock:
- 	spin_unlock(&dlm->spinlock);
- 
- 	if (oldmle) {
-diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
-index 9dfaac7..aaaffbc 100644
---- a/fs/ocfs2/dlm/dlmrecovery.c
-+++ b/fs/ocfs2/dlm/dlmrecovery.c
-@@ -1997,6 +1997,8 @@ void dlm_move_lockres_to_recovery_list(struct dlm_ctxt *dlm,
- 	struct list_head *queue;
- 	struct dlm_lock *lock, *next;
- 
-+	assert_spin_locked(&dlm->spinlock);
-+	assert_spin_locked(&res->spinlock);
- 	res->state |= DLM_LOCK_RES_RECOVERING;
- 	if (!list_empty(&res->recovering)) {
- 		mlog(0,
-@@ -2326,19 +2328,15 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
- 			/* zero the lvb if necessary */
- 			dlm_revalidate_lvb(dlm, res, dead_node);
- 			if (res->owner == dead_node) {
--				if (res->state & DLM_LOCK_RES_DROPPING_REF)
--					mlog(0, "%s:%.*s: owned by "
--					     "dead node %u, this node was "
--					     "dropping its ref when it died. "
--					     "continue, dropping the flag.\n",
--					     dlm->name, res->lockname.len,
--					     res->lockname.name, dead_node);
--
--				/* the wake_up for this will happen when the
--				 * RECOVERING flag is dropped later */
--				res->state &= ~DLM_LOCK_RES_DROPPING_REF;
-+				if (res->state & DLM_LOCK_RES_DROPPING_REF) {
-+					mlog(ML_NOTICE, "Ignore %.*s for "
-+					     "recovery as it is being freed\n",
-+					     res->lockname.len,
-+					     res->lockname.name);
-+				} else
-+					dlm_move_lockres_to_recovery_list(dlm,
-+									  res);
- 
--				dlm_move_lockres_to_recovery_list(dlm, res);
- 			} else if (res->owner == dlm->node_num) {
- 				dlm_free_dead_locks(dlm, res, dead_node);
- 				__dlm_lockres_calc_usage(dlm, res);
-diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
-index d4f73ca..2211acf 100644
---- a/fs/ocfs2/dlm/dlmthread.c
-+++ b/fs/ocfs2/dlm/dlmthread.c
-@@ -92,19 +92,27 @@ int __dlm_lockres_has_locks(struct dlm_lock_resource *res)
-  * truly ready to be freed. */
- int __dlm_lockres_unused(struct dlm_lock_resource *res)
- {
--	if (!__dlm_lockres_has_locks(res) &&
--	    (list_empty(&res->dirty) && !(res->state & DLM_LOCK_RES_DIRTY))) {
--		/* try not to scan the bitmap unless the first two
--		 * conditions are already true */
--		int bit = find_next_bit(res->refmap, O2NM_MAX_NODES, 0);
--		if (bit >= O2NM_MAX_NODES) {
--			/* since the bit for dlm->node_num is not
--			 * set, inflight_locks better be zero */
--			BUG_ON(res->inflight_locks != 0);
--			return 1;
--		}
--	}
--	return 0;
-+	int bit;
-+
-+	if (__dlm_lockres_has_locks(res))
-+		return 0;
-+
-+	if (!list_empty(&res->dirty) || res->state & DLM_LOCK_RES_DIRTY)
-+		return 0;
-+
-+	if (res->state & DLM_LOCK_RES_RECOVERING)
-+		return 0;
-+
-+	bit = find_next_bit(res->refmap, O2NM_MAX_NODES, 0);
-+	if (bit < O2NM_MAX_NODES)
-+		return 0;
-+
-+	/*
-+	 * since the bit for dlm->node_num is not set, inflight_locks better
-+	 * be zero
-+	 */
-+	BUG_ON(res->inflight_locks != 0);
-+	return 1;
- }
- 
- 
-@@ -152,45 +160,25 @@ void dlm_lockres_calc_usage(struct dlm_ctxt *dlm,
- 	spin_unlock(&dlm->spinlock);
- }
- 
--static int dlm_purge_lockres(struct dlm_ctxt *dlm,
-+static void dlm_purge_lockres(struct dlm_ctxt *dlm,
- 			     struct dlm_lock_resource *res)
- {
- 	int master;
- 	int ret = 0;
- 
--	spin_lock(&res->spinlock);
--	if (!__dlm_lockres_unused(res)) {
--		mlog(0, "%s:%.*s: tried to purge but not unused\n",
--		     dlm->name, res->lockname.len, res->lockname.name);
--		__dlm_print_one_lock_resource(res);
--		spin_unlock(&res->spinlock);
--		BUG();
--	}
--
--	if (res->state & DLM_LOCK_RES_MIGRATING) {
--		mlog(0, "%s:%.*s: Delay dropref as this lockres is "
--		     "being remastered\n", dlm->name, res->lockname.len,
--		     res->lockname.name);
--		/* Re-add the lockres to the end of the purge list */
--		if (!list_empty(&res->purge)) {
--			list_del_init(&res->purge);
--			list_add_tail(&res->purge, &dlm->purge_list);
--		}
--		spin_unlock(&res->spinlock);
--		return 0;
--	}
-+	assert_spin_locked(&dlm->spinlock);
-+	assert_spin_locked(&res->spinlock);
- 
- 	master = (res->owner == dlm->node_num);
- 
--	if (!master)
--		res->state |= DLM_LOCK_RES_DROPPING_REF;
--	spin_unlock(&res->spinlock);
- 
- 	mlog(0, "purging lockres %.*s, master = %d\n", res->lockname.len,
- 	     res->lockname.name, master);
- 
- 	if (!master) {
-+		res->state |= DLM_LOCK_RES_DROPPING_REF;
- 		/* drop spinlock...  retake below */
-+		spin_unlock(&res->spinlock);
- 		spin_unlock(&dlm->spinlock);
- 
- 		spin_lock(&res->spinlock);
-@@ -208,31 +196,35 @@ static int dlm_purge_lockres(struct dlm_ctxt *dlm,
- 		mlog(0, "%s:%.*s: dlm_deref_lockres returned %d\n",
- 		     dlm->name, res->lockname.len, res->lockname.name, ret);
- 		spin_lock(&dlm->spinlock);
-+		spin_lock(&res->spinlock);
- 	}
- 
--	spin_lock(&res->spinlock);
- 	if (!list_empty(&res->purge)) {
- 		mlog(0, "removing lockres %.*s:%p from purgelist, "
- 		     "master = %d\n", res->lockname.len, res->lockname.name,
- 		     res, master);
- 		list_del_init(&res->purge);
--		spin_unlock(&res->spinlock);
- 		dlm_lockres_put(res);
- 		dlm->purge_count--;
--	} else
--		spin_unlock(&res->spinlock);
-+	}
-+
-+	if (!__dlm_lockres_unused(res)) {
-+		mlog(ML_ERROR, "found lockres %s:%.*s: in use after deref\n",
-+		     dlm->name, res->lockname.len, res->lockname.name);
-+		__dlm_print_one_lock_resource(res);
-+		BUG();
-+	}
- 
- 	__dlm_unhash_lockres(res);
- 
- 	/* lockres is not in the hash now.  drop the flag and wake up
- 	 * any processes waiting in dlm_get_lock_resource. */
- 	if (!master) {
--		spin_lock(&res->spinlock);
- 		res->state &= ~DLM_LOCK_RES_DROPPING_REF;
- 		spin_unlock(&res->spinlock);
- 		wake_up(&res->wq);
--	}
--	return 0;
-+	} else
-+		spin_unlock(&res->spinlock);
- }
- 
- static void dlm_run_purge_list(struct dlm_ctxt *dlm,
-@@ -251,17 +243,7 @@ static void dlm_run_purge_list(struct dlm_ctxt *dlm,
- 		lockres = list_entry(dlm->purge_list.next,
- 				     struct dlm_lock_resource, purge);
- 
--		/* Status of the lockres *might* change so double
--		 * check. If the lockres is unused, holding the dlm
--		 * spinlock will prevent people from getting and more
--		 * refs on it -- there's no need to keep the lockres
--		 * spinlock. */
- 		spin_lock(&lockres->spinlock);
--		unused = __dlm_lockres_unused(lockres);
--		spin_unlock(&lockres->spinlock);
--
--		if (!unused)
--			continue;
- 
- 		purge_jiffies = lockres->last_used +
- 			msecs_to_jiffies(DLM_PURGE_INTERVAL_MS);
-@@ -273,15 +255,29 @@ static void dlm_run_purge_list(struct dlm_ctxt *dlm,
- 			 * in tail order, we can stop at the first
- 			 * unpurgable resource -- anyone added after
- 			 * him will have a greater last_used value */
-+			spin_unlock(&lockres->spinlock);
- 			break;
- 		}
- 
-+		/* Status of the lockres *might* change so double
-+		 * check. If the lockres is unused, holding the dlm
-+		 * spinlock will prevent people from getting and more
-+		 * refs on it. */
-+		unused = __dlm_lockres_unused(lockres);
-+		if (!unused ||
-+		    (lockres->state & DLM_LOCK_RES_MIGRATING)) {
-+			mlog(0, "lockres %s:%.*s: is in use or "
-+			     "being remastered, used %d, state %d\n",
-+			     dlm->name, lockres->lockname.len,
-+			     lockres->lockname.name, !unused, lockres->state);
-+			list_move_tail(&dlm->purge_list, &lockres->purge);
-+			spin_unlock(&lockres->spinlock);
-+			continue;
-+		}
-+
- 		dlm_lockres_get(lockres);
- 
--		/* This may drop and reacquire the dlm spinlock if it
--		 * has to do migration. */
--		if (dlm_purge_lockres(dlm, lockres))
--			BUG();
-+		dlm_purge_lockres(dlm, lockres);
- 
- 		dlm_lockres_put(lockres);
- 
-diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
-index 3ac5aa7..73a11cc 100644
---- a/fs/ocfs2/refcounttree.c
-+++ b/fs/ocfs2/refcounttree.c
-@@ -2436,16 +2436,26 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
- 		len = min((u64)cpos + clusters, le64_to_cpu(rec.r_cpos) +
- 			  le32_to_cpu(rec.r_clusters)) - cpos;
- 		/*
--		 * If the refcount rec already exist, cool. We just need
--		 * to check whether there is a split. Otherwise we just need
--		 * to increase the refcount.
--		 * If we will insert one, increases recs_add.
--		 *
- 		 * We record all the records which will be inserted to the
- 		 * same refcount block, so that we can tell exactly whether
- 		 * we need a new refcount block or not.
-+		 *
-+		 * If we will insert a new one, this is easy and only happens
-+		 * during adding refcounted flag to the extent, so we don't
-+		 * have a chance of spliting. We just need one record.
-+		 *
-+		 * If the refcount rec already exists, that would be a little
-+		 * complicated. we may have to:
-+		 * 1) split at the beginning if the start pos isn't aligned.
-+		 *    we need 1 more record in this case.
-+		 * 2) split int the end if the end pos isn't aligned.
-+		 *    we need 1 more record in this case.
-+		 * 3) split in the middle because of file system fragmentation.
-+		 *    we need 2 more records in this case(we can't detect this
-+		 *    beforehand, so always think of the worst case).
- 		 */
- 		if (rec.r_refcount) {
-+			recs_add += 2;
- 			/* Check whether we need a split at the beginning. */
- 			if (cpos == start_cpos &&
- 			    cpos != le64_to_cpu(rec.r_cpos))
-diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h
-index e5039a2..103f08a 100644
---- a/include/acpi/platform/aclinux.h
-+++ b/include/acpi/platform/aclinux.h
-@@ -148,13 +148,17 @@ static inline void *acpi_os_acquire_object(acpi_cache_t * cache)
- #define ACPI_ALLOCATE_ZEROED(a) acpi_os_allocate_zeroed(a)
- #define ACPI_FREE(a)            kfree(a)
- 
--/* Used within ACPICA to show where it is safe to preempt execution */
--#include <linux/hardirq.h>
-+#ifndef CONFIG_PREEMPT
-+/*
-+ * Used within ACPICA to show where it is safe to preempt execution
-+ * when CONFIG_PREEMPT=n
-+ */
- #define ACPI_PREEMPTION_POINT() \
- 	do { \
--		if (!in_atomic_preempt_off() && !irqs_disabled()) \
-+		if (!irqs_disabled()) \
- 			cond_resched(); \
- 	} while (0)
-+#endif
- 
- #endif /* __KERNEL__ */
- 
-diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
-index b8bb9a6..ee7e258 100644
---- a/include/linux/mm_types.h
-+++ b/include/linux/mm_types.h
-@@ -134,7 +134,7 @@ struct vm_area_struct {
- 					   within vm_mm. */
- 
- 	/* linked list of VM areas per task, sorted by address */
--	struct vm_area_struct *vm_next;
-+	struct vm_area_struct *vm_next, *vm_prev;
- 
- 	pgprot_t vm_page_prot;		/* Access permissions of this VMA. */
- 	unsigned long vm_flags;		/* Flags, see mm.h. */
-diff --git a/include/linux/mtd/flashchip.h b/include/linux/mtd/flashchip.h
-index f43e9b4..23cc10f 100644
---- a/include/linux/mtd/flashchip.h
-+++ b/include/linux/mtd/flashchip.h
-@@ -92,7 +92,7 @@ struct flchip {
- /* This is used to handle contention on write/erase operations
-    between partitions of the same physical chip. */
- struct flchip_shared {
--	spinlock_t lock;
-+	struct mutex lock;
- 	struct flchip *writing;
- 	struct flchip *erasing;
- };
-diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index f89e7fd..eb674b7 100644
---- a/include/linux/skbuff.h
-+++ b/include/linux/skbuff.h
-@@ -169,6 +169,7 @@ struct skb_shared_hwtstamps {
-  * @software:		generate software time stamp
-  * @in_progress:	device driver is going to provide
-  *			hardware time stamp
-+ * @prevent_sk_orphan:	make sk reference available on driver level
-  * @flags:		all shared_tx flags
-  *
-  * These flags are attached to packets as part of the
-@@ -178,7 +179,8 @@ union skb_shared_tx {
- 	struct {
- 		__u8	hardware:1,
- 			software:1,
--			in_progress:1;
-+			in_progress:1,
-+			prevent_sk_orphan:1;
- 	};
- 	__u8 flags;
- };
-diff --git a/include/linux/tty.h b/include/linux/tty.h
-index 931078b..7802a24 100644
---- a/include/linux/tty.h
-+++ b/include/linux/tty.h
-@@ -552,6 +552,9 @@ static inline void tty_audit_push_task(struct task_struct *tsk,
- }
- #endif
- 
-+/* tty_io.c */
-+extern int __init tty_init(void);
-+
- /* tty_ioctl.c */
- extern int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
- 		       unsigned int cmd, unsigned long arg);
-diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
-index 6a664c3..7dc97d1 100644
---- a/include/sound/emu10k1.h
-+++ b/include/sound/emu10k1.h
-@@ -1707,6 +1707,7 @@ struct snd_emu10k1 {
- 	unsigned int card_type;			/* EMU10K1_CARD_* */
- 	unsigned int ecard_ctrl;		/* ecard control bits */
- 	unsigned long dma_mask;			/* PCI DMA mask */
-+	unsigned int delay_pcm_irq;		/* in samples */
- 	int max_cache_pages;			/* max memory size / PAGE_SIZE */
- 	struct snd_dma_buffer silent_page;	/* silent page */
- 	struct snd_dma_buffer ptb_pages;	/* page table pages */
-diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
-index 9496b96..fa8223a 100644
---- a/include/trace/events/timer.h
-+++ b/include/trace/events/timer.h
-@@ -74,14 +74,16 @@ TRACE_EVENT(timer_expire_entry,
- 	TP_STRUCT__entry(
- 		__field( void *,	timer	)
- 		__field( unsigned long,	now	)
-+		__field( void *,	function)
- 	),
- 
- 	TP_fast_assign(
- 		__entry->timer		= timer;
- 		__entry->now		= jiffies;
-+		__entry->function	= timer->function;
- 	),
- 
--	TP_printk("timer=%p now=%lu", __entry->timer, __entry->now)
-+	TP_printk("timer=%p function=%pf now=%lu", __entry->timer, __entry->function,__entry->now)
- );
- 
- /**
-@@ -213,14 +215,16 @@ TRACE_EVENT(hrtimer_expire_entry,
- 	TP_STRUCT__entry(
- 		__field( void *,	hrtimer	)
- 		__field( s64,		now	)
-+		__field( void *,	function)
- 	),
- 
- 	TP_fast_assign(
- 		__entry->hrtimer	= hrtimer;
- 		__entry->now		= now->tv64;
-+		__entry->function	= hrtimer->function;
- 	),
- 
--	TP_printk("hrtimer=%p now=%llu", __entry->hrtimer,
-+	TP_printk("hrtimer=%p function=%pf now=%llu", __entry->hrtimer, __entry->function,
- 		  (unsigned long long)ktime_to_ns((ktime_t) { .tv64 = __entry->now }))
-  );
- 
-diff --git a/kernel/fork.c b/kernel/fork.c
-index b6cce14..e96c0cd 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -300,7 +300,7 @@ out:
- #ifdef CONFIG_MMU
- static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- {
--	struct vm_area_struct *mpnt, *tmp, **pprev;
-+	struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
- 	struct rb_node **rb_link, *rb_parent;
- 	int retval;
- 	unsigned long charge;
-@@ -328,6 +328,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- 	if (retval)
- 		goto out;
- 
-+	prev = NULL;
- 	for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
- 		struct file *file;
- 
-@@ -359,7 +360,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- 			goto fail_nomem_anon_vma_fork;
- 		tmp->vm_flags &= ~VM_LOCKED;
- 		tmp->vm_mm = mm;
--		tmp->vm_next = NULL;
-+		tmp->vm_next = tmp->vm_prev = NULL;
- 		file = tmp->vm_file;
- 		if (file) {
- 			struct inode *inode = file->f_path.dentry->d_inode;
-@@ -392,6 +393,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- 		 */
- 		*pprev = tmp;
- 		pprev = &tmp->vm_next;
-+		tmp->vm_prev = prev;
-+		prev = tmp;
- 
- 		__vma_link_rb(mm, tmp, rb_link, rb_parent);
- 		rb_link = &tmp->vm_rb.rb_right;
-diff --git a/kernel/sched.c b/kernel/sched.c
-index 63b4a14..6d0dbeb 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -3694,8 +3694,16 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
- 		/*
- 		 * Owner changed, break to re-assess state.
- 		 */
--		if (lock->owner != owner)
-+		if (lock->owner != owner) {
-+			/*
-+			 * If the lock has switched to a different owner,
-+			 * we likely have heavy contention. Return 0 to quit
-+			 * optimistic spinning and not contend further:
-+			 */
-+			if (lock->owner)
-+				return 0;
- 			break;
-+		}
- 
- 		/*
- 		 * Is that owner really running on that cpu?
-diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index caf8d4d..b87c22f 100644
---- a/kernel/time/timekeeping.c
-+++ b/kernel/time/timekeeping.c
-@@ -736,6 +736,7 @@ static void timekeeping_adjust(s64 offset)
- static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
- {
- 	u64 nsecps = (u64)NSEC_PER_SEC << timekeeper.shift;
-+	u64 raw_nsecs;
- 
- 	/* If the offset is smaller then a shifted interval, do nothing */
- 	if (offset < timekeeper.cycle_interval<<shift)
-@@ -752,12 +753,15 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
- 		second_overflow();
- 	}
- 
--	/* Accumulate into raw time */
--	raw_time.tv_nsec += timekeeper.raw_interval << shift;;
--	while (raw_time.tv_nsec >= NSEC_PER_SEC) {
--		raw_time.tv_nsec -= NSEC_PER_SEC;
--		raw_time.tv_sec++;
-+	/* Accumulate raw time */
-+	raw_nsecs = timekeeper.raw_interval << shift;
-+	raw_nsecs += raw_time.tv_nsec;
-+	if (raw_nsecs >= NSEC_PER_SEC) {
-+		u64 raw_secs = raw_nsecs;
-+		raw_nsecs = do_div(raw_secs, NSEC_PER_SEC);
-+		raw_time.tv_sec += raw_secs;
- 	}
-+	raw_time.tv_nsec = raw_nsecs;
- 
- 	/* Accumulate error between NTP and clock interval */
- 	timekeeper.ntp_error += tick_length << shift;
-diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index 1da7b6e..5ec8f1d 100644
---- a/kernel/trace/ring_buffer.c
-+++ b/kernel/trace/ring_buffer.c
-@@ -3868,6 +3868,9 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
- 			rpos = reader->read;
- 			pos += size;
- 
-+			if (rpos >= commit)
-+				break;
-+
- 			event = rb_reader_event(cpu_buffer);
- 			size = rb_event_length(event);
- 		} while (len > size);
-diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
-index 79f4bac..b4c179a 100644
---- a/kernel/trace/trace_functions_graph.c
-+++ b/kernel/trace/trace_functions_graph.c
-@@ -507,7 +507,15 @@ get_return_for_leaf(struct trace_iterator *iter,
- 			 * if the output fails.
- 			 */
- 			data->ent = *curr;
--			data->ret = *next;
-+			/*
-+			 * If the next event is not a return type, then
-+			 * we only care about what type it is. Otherwise we can
-+			 * safely copy the entire event.
-+			 */
-+			if (next->ent.type == TRACE_GRAPH_RET)
-+				data->ret = *next;
-+			else
-+				data->ret.ent.type = next->ent.type;
- 		}
- 	}
- 
-diff --git a/mm/memory.c b/mm/memory.c
-index 307bf77..53cf85d 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -2770,11 +2770,18 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
- {
- 	address &= PAGE_MASK;
- 	if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
--		address -= PAGE_SIZE;
--		if (find_vma(vma->vm_mm, address) != vma)
--			return -ENOMEM;
-+		struct vm_area_struct *prev = vma->vm_prev;
-+
-+		/*
-+		 * Is there a mapping abutting this one below?
-+		 *
-+		 * That's only ok if it's the same stack mapping
-+		 * that has gotten split..
-+		 */
-+		if (prev && prev->vm_end == address)
-+			return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
- 
--		expand_stack(vma, address);
-+		expand_stack(vma, address - PAGE_SIZE);
- 	}
- 	return 0;
- }
-diff --git a/mm/mlock.c b/mm/mlock.c
-index 49e5e4c..cbae7c5 100644
---- a/mm/mlock.c
-+++ b/mm/mlock.c
-@@ -135,6 +135,19 @@ void munlock_vma_page(struct page *page)
- 	}
- }
- 
-+/* Is the vma a continuation of the stack vma above it? */
-+static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
-+{
-+	return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
-+}
-+
-+static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
-+{
-+	return (vma->vm_flags & VM_GROWSDOWN) &&
-+		(vma->vm_start == addr) &&
-+		!vma_stack_continue(vma->vm_prev, addr);
-+}
-+
- /**
-  * __mlock_vma_pages_range() -  mlock a range of pages in the vma.
-  * @vma:   target vma
-@@ -168,11 +181,9 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
- 		gup_flags |= FOLL_WRITE;
- 
- 	/* We don't try to access the guard page of a stack vma */
--	if (vma->vm_flags & VM_GROWSDOWN) {
--		if (start == vma->vm_start) {
--			start += PAGE_SIZE;
--			nr_pages--;
--		}
-+	if (stack_guard_page(vma, start)) {
-+		addr += PAGE_SIZE;
-+		nr_pages--;
- 	}
- 
- 	while (nr_pages > 0) {
-diff --git a/mm/mmap.c b/mm/mmap.c
-index 456ec6f..3867cfc 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -388,17 +388,23 @@ static inline void
- __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
- 		struct vm_area_struct *prev, struct rb_node *rb_parent)
- {
-+	struct vm_area_struct *next;
-+
-+	vma->vm_prev = prev;
- 	if (prev) {
--		vma->vm_next = prev->vm_next;
-+		next = prev->vm_next;
- 		prev->vm_next = vma;
- 	} else {
- 		mm->mmap = vma;
- 		if (rb_parent)
--			vma->vm_next = rb_entry(rb_parent,
-+			next = rb_entry(rb_parent,
- 					struct vm_area_struct, vm_rb);
- 		else
--			vma->vm_next = NULL;
-+			next = NULL;
- 	}
-+	vma->vm_next = next;
-+	if (next)
-+		next->vm_prev = vma;
- }
- 
- void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma,
-@@ -485,7 +491,11 @@ static inline void
- __vma_unlink(struct mm_struct *mm, struct vm_area_struct *vma,
- 		struct vm_area_struct *prev)
- {
--	prev->vm_next = vma->vm_next;
-+	struct vm_area_struct *next = vma->vm_next;
-+
-+	prev->vm_next = next;
-+	if (next)
-+		next->vm_prev = prev;
- 	rb_erase(&vma->vm_rb, &mm->mm_rb);
- 	if (mm->mmap_cache == vma)
- 		mm->mmap_cache = prev;
-@@ -1900,6 +1910,7 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
- 	unsigned long addr;
- 
- 	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
-+	vma->vm_prev = NULL;
- 	do {
- 		rb_erase(&vma->vm_rb, &mm->mm_rb);
- 		mm->map_count--;
-@@ -1907,6 +1918,8 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
- 		vma = vma->vm_next;
- 	} while (vma && vma->vm_start < end);
- 	*insertion_point = vma;
-+	if (vma)
-+		vma->vm_prev = prev;
- 	tail_vma->vm_next = NULL;
- 	if (mm->unmap_area == arch_unmap_area)
- 		addr = prev ? prev->vm_end : mm->mmap_base;
-diff --git a/mm/nommu.c b/mm/nommu.c
-index b76f3ee..e48b38c 100644
---- a/mm/nommu.c
-+++ b/mm/nommu.c
-@@ -609,7 +609,7 @@ static void protect_vma(struct vm_area_struct *vma, unsigned long flags)
-  */
- static void add_vma_to_mm(struct mm_struct *mm, struct vm_area_struct *vma)
- {
--	struct vm_area_struct *pvma, **pp;
-+	struct vm_area_struct *pvma, **pp, *next;
- 	struct address_space *mapping;
- 	struct rb_node **p, *parent;
- 
-@@ -669,8 +669,11 @@ static void add_vma_to_mm(struct mm_struct *mm, struct vm_area_struct *vma)
- 			break;
- 	}
- 
--	vma->vm_next = *pp;
-+	next = *pp;
- 	*pp = vma;
-+	vma->vm_next = next;
-+	if (next)
-+		next->vm_prev = vma;
- }
- 
- /*
-diff --git a/mm/slab.c b/mm/slab.c
-index e49f8f4..e4f747f 100644
---- a/mm/slab.c
-+++ b/mm/slab.c
-@@ -2331,8 +2331,8 @@ kmem_cache_create (const char *name, size_t size, size_t align,
- 	}
- #if FORCED_DEBUG && defined(CONFIG_DEBUG_PAGEALLOC)
- 	if (size >= malloc_sizes[INDEX_L3 + 1].cs_size
--	    && cachep->obj_size > cache_line_size() && size < PAGE_SIZE) {
--		cachep->obj_offset += PAGE_SIZE - size;
-+	    && cachep->obj_size > cache_line_size() && ALIGN(size, align) < PAGE_SIZE) {
-+		cachep->obj_offset += PAGE_SIZE - ALIGN(size, align);
- 		size = PAGE_SIZE;
- 	}
- #endif
-diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
-index 753fc42..f49bcd9 100644
---- a/net/bridge/br_device.c
-+++ b/net/bridge/br_device.c
-@@ -22,7 +22,7 @@
- #include <asm/uaccess.h>
- #include "br_private.h"
- 
--/* net device transmit always called with no BH (preempt_disabled) */
-+/* net device transmit always called with BH disabled */
- netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
- {
- 	struct net_bridge *br = netdev_priv(dev);
-@@ -46,9 +46,12 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
- 	skb_reset_mac_header(skb);
- 	skb_pull(skb, ETH_HLEN);
- 
-+	rcu_read_lock();
- 	if (is_multicast_ether_addr(dest)) {
--		if (br_multicast_rcv(br, NULL, skb))
-+		if (br_multicast_rcv(br, NULL, skb)) {
-+			kfree_skb(skb);
- 			goto out;
-+		}
- 
- 		mdst = br_mdb_get(br, skb);
- 		if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
-@@ -61,6 +64,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
- 		br_flood_deliver(br, skb);
- 
- out:
-+	rcu_read_unlock();
- 	return NETDEV_TX_OK;
- }
- 
-diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
-index b01dde3..7204ad3 100644
---- a/net/bridge/br_fdb.c
-+++ b/net/bridge/br_fdb.c
-@@ -214,7 +214,7 @@ void br_fdb_delete_by_port(struct net_bridge *br,
- 	spin_unlock_bh(&br->hash_lock);
- }
- 
--/* No locking or refcounting, assumes caller has no preempt (rcu_read_lock) */
-+/* No locking or refcounting, assumes caller has rcu_read_lock */
- struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
- 					  const unsigned char *addr)
- {
-diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
-index d36e700..114365c 100644
---- a/net/bridge/br_input.c
-+++ b/net/bridge/br_input.c
-@@ -37,7 +37,7 @@ static int br_pass_frame_up(struct sk_buff *skb)
- 		       netif_receive_skb);
- }
- 
--/* note: already called with rcu_read_lock (preempt_disabled) */
-+/* note: already called with rcu_read_lock */
- int br_handle_frame_finish(struct sk_buff *skb)
- {
- 	const unsigned char *dest = eth_hdr(skb)->h_dest;
-@@ -108,7 +108,7 @@ drop:
- 	goto out;
- }
- 
--/* note: already called with rcu_read_lock (preempt_disabled) */
-+/* note: already called with rcu_read_lock */
- static int br_handle_local_finish(struct sk_buff *skb)
- {
- 	struct net_bridge_port *p = rcu_dereference(skb->dev->br_port);
-@@ -133,7 +133,7 @@ static inline int is_link_local(const unsigned char *dest)
- /*
-  * Called via br_handle_frame_hook.
-  * Return NULL if skb is handled
-- * note: already called with rcu_read_lock (preempt_disabled)
-+ * note: already called with rcu_read_lock
-  */
- struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
- {
-diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
-index 217bd22..5854e82 100644
---- a/net/bridge/br_stp_bpdu.c
-+++ b/net/bridge/br_stp_bpdu.c
-@@ -131,7 +131,7 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
- /*
-  * Called from llc.
-  *
-- * NO locks, but rcu_read_lock (preempt_disabled)
-+ * NO locks, but rcu_read_lock
-  */
- void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
- 		struct net_device *dev)
-diff --git a/net/can/bcm.c b/net/can/bcm.c
-index 9c65e9d..08ffe9e 100644
---- a/net/can/bcm.c
-+++ b/net/can/bcm.c
-@@ -60,6 +60,13 @@
- #include <net/sock.h>
- #include <net/net_namespace.h>
- 
-+/*
-+ * To send multiple CAN frame content within TX_SETUP or to filter
-+ * CAN messages with multiplex index within RX_SETUP, the number of
-+ * different filters is limited to 256 due to the one byte index value.
-+ */
-+#define MAX_NFRAMES 256
-+
- /* use of last_frames[index].can_dlc */
- #define RX_RECV    0x40 /* received data for this element */
- #define RX_THR     0x80 /* element not been sent due to throttle feature */
-@@ -89,16 +96,16 @@ struct bcm_op {
- 	struct list_head list;
- 	int ifindex;
- 	canid_t can_id;
--	int flags;
-+	u32 flags;
- 	unsigned long frames_abs, frames_filtered;
- 	struct timeval ival1, ival2;
- 	struct hrtimer timer, thrtimer;
- 	struct tasklet_struct tsklet, thrtsklet;
- 	ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
- 	int rx_ifindex;
--	int count;
--	int nframes;
--	int currframe;
-+	u32 count;
-+	u32 nframes;
-+	u32 currframe;
- 	struct can_frame *frames;
- 	struct can_frame *last_frames;
- 	struct can_frame sframe;
-@@ -175,7 +182,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
- 
- 		seq_printf(m, "rx_op: %03X %-5s ",
- 				op->can_id, bcm_proc_getifname(ifname, op->ifindex));
--		seq_printf(m, "[%d]%c ", op->nframes,
-+		seq_printf(m, "[%u]%c ", op->nframes,
- 				(op->flags & RX_CHECK_DLC)?'d':' ');
- 		if (op->kt_ival1.tv64)
- 			seq_printf(m, "timeo=%lld ",
-@@ -198,7 +205,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
- 
- 	list_for_each_entry(op, &bo->tx_ops, list) {
- 
--		seq_printf(m, "tx_op: %03X %s [%d] ",
-+		seq_printf(m, "tx_op: %03X %s [%u] ",
- 				op->can_id,
- 				bcm_proc_getifname(ifname, op->ifindex),
- 				op->nframes);
-@@ -283,7 +290,7 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
- 	struct can_frame *firstframe;
- 	struct sockaddr_can *addr;
- 	struct sock *sk = op->sk;
--	int datalen = head->nframes * CFSIZ;
-+	unsigned int datalen = head->nframes * CFSIZ;
- 	int err;
- 
- 	skb = alloc_skb(sizeof(*head) + datalen, gfp_any());
-@@ -468,7 +475,7 @@ rx_changed_settime:
-  * bcm_rx_cmp_to_index - (bit)compares the currently received data to formerly
-  *                       received data stored in op->last_frames[]
-  */
--static void bcm_rx_cmp_to_index(struct bcm_op *op, int index,
-+static void bcm_rx_cmp_to_index(struct bcm_op *op, unsigned int index,
- 				const struct can_frame *rxdata)
- {
- 	/*
-@@ -554,7 +561,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
- /*
-  * bcm_rx_do_flush - helper for bcm_rx_thr_flush
-  */
--static inline int bcm_rx_do_flush(struct bcm_op *op, int update, int index)
-+static inline int bcm_rx_do_flush(struct bcm_op *op, int update,
-+				  unsigned int index)
- {
- 	if ((op->last_frames) && (op->last_frames[index].can_dlc & RX_THR)) {
- 		if (update)
-@@ -575,7 +583,7 @@ static int bcm_rx_thr_flush(struct bcm_op *op, int update)
- 	int updated = 0;
- 
- 	if (op->nframes > 1) {
--		int i;
-+		unsigned int i;
- 
- 		/* for MUX filter we start at index 1 */
- 		for (i = 1; i < op->nframes; i++)
-@@ -624,7 +632,7 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
- {
- 	struct bcm_op *op = (struct bcm_op *)data;
- 	const struct can_frame *rxframe = (struct can_frame *)skb->data;
--	int i;
-+	unsigned int i;
- 
- 	/* disable timeout */
- 	hrtimer_cancel(&op->timer);
-@@ -822,14 +830,15 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
- {
- 	struct bcm_sock *bo = bcm_sk(sk);
- 	struct bcm_op *op;
--	int i, err;
-+	unsigned int i;
-+	int err;
- 
- 	/* we need a real device to send frames */
- 	if (!ifindex)
- 		return -ENODEV;
- 
--	/* we need at least one can_frame */
--	if (msg_head->nframes < 1)
-+	/* check nframes boundaries - we need at least one can_frame */
-+	if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
- 		return -EINVAL;
- 
- 	/* check the given can_id */
-@@ -993,6 +1002,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
- 		msg_head->nframes = 0;
- 	}
- 
-+	/* the first element contains the mux-mask => MAX_NFRAMES + 1  */
-+	if (msg_head->nframes > MAX_NFRAMES + 1)
-+		return -EINVAL;
-+
- 	if ((msg_head->flags & RX_RTR_FRAME) &&
- 	    ((msg_head->nframes != 1) ||
- 	     (!(msg_head->can_id & CAN_RTR_FLAG))))
-diff --git a/net/can/raw.c b/net/can/raw.c
-index da99cf1..1650599 100644
---- a/net/can/raw.c
-+++ b/net/can/raw.c
-@@ -655,6 +655,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
- 	err = sock_tx_timestamp(msg, sk, skb_tx(skb));
- 	if (err < 0)
- 		goto free_skb;
-+
-+	/* to be able to check the received tx sock reference in raw_rcv() */
-+	skb_tx(skb)->prevent_sk_orphan = 1;
-+
- 	skb->dev = dev;
- 	skb->sk  = sk;
- 
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 1f466e8..95cc486 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -2504,6 +2504,7 @@ int netif_rx(struct sk_buff *skb)
- 		struct rps_dev_flow voidflow, *rflow = &voidflow;
- 		int cpu;
- 
-+		preempt_disable();
- 		rcu_read_lock();
- 
- 		cpu = get_rps_cpu(skb->dev, skb, &rflow);
-@@ -2513,6 +2514,7 @@ int netif_rx(struct sk_buff *skb)
- 		ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
- 
- 		rcu_read_unlock();
-+		preempt_enable();
- 	}
- #else
- 	{
-@@ -3064,7 +3066,7 @@ enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
- 	int mac_len;
- 	enum gro_result ret;
- 
--	if (!(skb->dev->features & NETIF_F_GRO))
-+	if (!(skb->dev->features & NETIF_F_GRO) || netpoll_rx_on(skb))
- 		goto normal;
- 
- 	if (skb_is_gso(skb) || skb_has_frags(skb))
-@@ -3133,7 +3135,7 @@ pull:
- 			put_page(skb_shinfo(skb)->frags[0].page);
- 			memmove(skb_shinfo(skb)->frags,
- 				skb_shinfo(skb)->frags + 1,
--				--skb_shinfo(skb)->nr_frags);
-+				--skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
- 		}
- 	}
- 
-@@ -3151,9 +3153,6 @@ __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
- {
- 	struct sk_buff *p;
- 
--	if (netpoll_rx_on(skb))
--		return GRO_NORMAL;
--
- 	for (p = napi->gro_list; p; p = p->next) {
- 		NAPI_GRO_CB(p)->same_flow =
- 			(p->dev == skb->dev) &&
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 65afeae..c259714 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -2176,6 +2176,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
- 				      GFP_KERNEL);
- 			if (cvp == NULL)
- 				return -ENOMEM;
-+
-+			kref_init(&cvp->kref);
- 		}
- 		lock_sock(sk);
- 		tp->rx_opt.cookie_in_always =
-@@ -2190,12 +2192,11 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
- 				 */
- 				kref_put(&tp->cookie_values->kref,
- 					 tcp_cookie_values_release);
--				kref_init(&cvp->kref);
--				tp->cookie_values = cvp;
- 			} else {
- 				cvp = tp->cookie_values;
- 			}
- 		}
-+
- 		if (cvp != NULL) {
- 			cvp->cookie_desired = ctd.tcpct_cookie_desired;
- 
-@@ -2209,6 +2210,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
- 				cvp->s_data_desired = ctd.tcpct_s_data_desired;
- 				cvp->s_data_constant = 0; /* false */
- 			}
-+
-+			tp->cookie_values = cvp;
- 		}
- 		release_sock(sk);
- 		return err;
-diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index a2eb965..54d7308 100644
---- a/net/netlink/af_netlink.c
-+++ b/net/netlink/af_netlink.c
-@@ -1400,7 +1400,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
- 	struct netlink_sock *nlk = nlk_sk(sk);
- 	int noblock = flags&MSG_DONTWAIT;
- 	size_t copied;
--	struct sk_buff *skb, *frag __maybe_unused = NULL;
-+	struct sk_buff *skb, *data_skb;
- 	int err;
- 
- 	if (flags&MSG_OOB)
-@@ -1412,45 +1412,35 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
- 	if (skb == NULL)
- 		goto out;
- 
-+	data_skb = skb;
-+
- #ifdef CONFIG_COMPAT_NETLINK_MESSAGES
- 	if (unlikely(skb_shinfo(skb)->frag_list)) {
--		bool need_compat = !!(flags & MSG_CMSG_COMPAT);
--
- 		/*
--		 * If this skb has a frag_list, then here that means that
--		 * we will have to use the frag_list skb for compat tasks
--		 * and the regular skb for non-compat tasks.
-+		 * If this skb has a frag_list, then here that means that we
-+		 * will have to use the frag_list skb's data for compat tasks
-+		 * and the regular skb's data for normal (non-compat) tasks.
- 		 *
--		 * The skb might (and likely will) be cloned, so we can't
--		 * just reset frag_list and go on with things -- we need to
--		 * keep that. For the compat case that's easy -- simply get
--		 * a reference to the compat skb and free the regular one
--		 * including the frag. For the non-compat case, we need to
--		 * avoid sending the frag to the user -- so assign NULL but
--		 * restore it below before freeing the skb.
-+		 * If we need to send the compat skb, assign it to the
-+		 * 'data_skb' variable so that it will be used below for data
-+		 * copying. We keep 'skb' for everything else, including
-+		 * freeing both later.
- 		 */
--		if (need_compat) {
--			struct sk_buff *compskb = skb_shinfo(skb)->frag_list;
--			skb_get(compskb);
--			kfree_skb(skb);
--			skb = compskb;
--		} else {
--			frag = skb_shinfo(skb)->frag_list;
--			skb_shinfo(skb)->frag_list = NULL;
--		}
-+		if (flags & MSG_CMSG_COMPAT)
-+			data_skb = skb_shinfo(skb)->frag_list;
- 	}
- #endif
- 
- 	msg->msg_namelen = 0;
- 
--	copied = skb->len;
-+	copied = data_skb->len;
- 	if (len < copied) {
- 		msg->msg_flags |= MSG_TRUNC;
- 		copied = len;
- 	}
- 
--	skb_reset_transport_header(skb);
--	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
-+	skb_reset_transport_header(data_skb);
-+	err = skb_copy_datagram_iovec(data_skb, 0, msg->msg_iov, copied);
- 
- 	if (msg->msg_name) {
- 		struct sockaddr_nl *addr = (struct sockaddr_nl *)msg->msg_name;
-@@ -1470,11 +1460,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
- 	}
- 	siocb->scm->creds = *NETLINK_CREDS(skb);
- 	if (flags & MSG_TRUNC)
--		copied = skb->len;
--
--#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
--	skb_shinfo(skb)->frag_list = frag;
--#endif
-+		copied = data_skb->len;
- 
- 	skb_free_datagram(sk, skb);
- 
-diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
-index 724553e..abbf4fa 100644
---- a/net/sched/act_nat.c
-+++ b/net/sched/act_nat.c
-@@ -218,6 +218,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
- 		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
- 			goto drop;
- 
-+		icmph = (void *)(skb_network_header(skb) + ihl);
- 		iph = (void *)(icmph + 1);
- 		if (egress)
- 			addr = iph->daddr;
-@@ -246,7 +247,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
- 			iph->saddr = new_addr;
- 
- 		inet_proto_csum_replace4(&icmph->checksum, skb, addr, new_addr,
--					 1);
-+					 0);
- 		break;
- 	}
- 	default:
-diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
-index c657628..a9be0ef 100644
---- a/net/sched/sch_sfq.c
-+++ b/net/sched/sch_sfq.c
-@@ -497,11 +497,22 @@ nla_put_failure:
- 	return -1;
- }
- 
-+static struct Qdisc *sfq_leaf(struct Qdisc *sch, unsigned long arg)
-+{
-+	return NULL;
-+}
-+
- static unsigned long sfq_get(struct Qdisc *sch, u32 classid)
- {
- 	return 0;
- }
- 
-+static unsigned long sfq_bind(struct Qdisc *sch, unsigned long parent,
-+			      u32 classid)
-+{
-+	return 0;
-+}
-+
- static struct tcf_proto **sfq_find_tcf(struct Qdisc *sch, unsigned long cl)
- {
- 	struct sfq_sched_data *q = qdisc_priv(sch);
-@@ -554,8 +565,10 @@ static void sfq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
- }
- 
- static const struct Qdisc_class_ops sfq_class_ops = {
-+	.leaf		=	sfq_leaf,
- 	.get		=	sfq_get,
- 	.tcf_chain	=	sfq_find_tcf,
-+	.bind_tcf	=	sfq_bind,
- 	.dump		=	sfq_dump_class,
- 	.dump_stats	=	sfq_dump_class_stats,
- 	.walk		=	sfq_walk,
-diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
-index ef17fcf..e4be688 100644
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -842,12 +842,18 @@ int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
- 		return -EINVAL;
- 	if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
- 		/* Verify that we are associated with the destination AP */
-+		wdev_lock(wdev);
-+
- 		if (!wdev->current_bss ||
- 		    memcmp(wdev->current_bss->pub.bssid, mgmt->bssid,
- 			   ETH_ALEN) != 0 ||
- 		    memcmp(wdev->current_bss->pub.bssid, mgmt->da,
--			   ETH_ALEN) != 0)
-+			    ETH_ALEN) != 0) {
-+			wdev_unlock(wdev);
- 			return -ENOTCONN;
-+		}
-+		wdev_unlock(wdev);
-+
- 	}
- 
- 	if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
-diff --git a/scripts/mkmakefile b/scripts/mkmakefile
-index 67d59c7..5325423 100644
---- a/scripts/mkmakefile
-+++ b/scripts/mkmakefile
-@@ -44,7 +44,9 @@ all:
- 
- Makefile:;
- 
--\$(all) %/: all
-+\$(all): all
- 	@:
- 
-+%/: all
-+	@:
- EOF
-diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index 303ac04..1990918 100644
---- a/sound/core/pcm_native.c
-+++ b/sound/core/pcm_native.c
-@@ -981,6 +981,10 @@ static int snd_pcm_do_pause(struct snd_pcm_substream *substream, int push)
- {
- 	if (substream->runtime->trigger_master != substream)
- 		return 0;
-+	/* some drivers might use hw_ptr to recover from the pause -
-+	   update the hw_ptr now */
-+	if (push)
-+		snd_pcm_update_hw_ptr(substream);
- 	/* The jiffies check in snd_pcm_update_hw_ptr*() is done by
- 	 * a delta betwen the current jiffies, this gives a large enough
- 	 * delta, effectively to skip the check once.
-diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
-index 4203782..aff8387 100644
---- a/sound/pci/emu10k1/emu10k1.c
-+++ b/sound/pci/emu10k1/emu10k1.c
-@@ -52,6 +52,7 @@ static int max_synth_voices[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 64};
- static int max_buffer_size[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 128};
- static int enable_ir[SNDRV_CARDS];
- static uint subsystem[SNDRV_CARDS]; /* Force card subsystem model */
-+static uint delay_pcm_irq[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 2};
- 
- module_param_array(index, int, NULL, 0444);
- MODULE_PARM_DESC(index, "Index value for the EMU10K1 soundcard.");
-@@ -73,6 +74,8 @@ module_param_array(enable_ir, bool, NULL, 0444);
- MODULE_PARM_DESC(enable_ir, "Enable IR.");
- module_param_array(subsystem, uint, NULL, 0444);
- MODULE_PARM_DESC(subsystem, "Force card subsystem model.");
-+module_param_array(delay_pcm_irq, uint, NULL, 0444);
-+MODULE_PARM_DESC(delay_pcm_irq, "Delay PCM interrupt by specified number of samples (default 0).");
- /*
-  * Class 0401: 1102:0008 (rev 00) Subsystem: 1102:1001 -> Audigy2 Value  Model:SB0400
-  */
-@@ -127,6 +130,7 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci,
- 				      &emu)) < 0)
- 		goto error;
- 	card->private_data = emu;
-+	emu->delay_pcm_irq = delay_pcm_irq[dev] & 0x1f;
- 	if ((err = snd_emu10k1_pcm(emu, 0, NULL)) < 0)
- 		goto error;
- 	if ((err = snd_emu10k1_pcm_mic(emu, 1, NULL)) < 0)
-diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
-index 55b83ef..622bace 100644
---- a/sound/pci/emu10k1/emupcm.c
-+++ b/sound/pci/emu10k1/emupcm.c
-@@ -332,7 +332,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,
- 		evoice->epcm->ccca_start_addr = start_addr + ccis;
- 		if (extra) {
- 			start_addr += ccis;
--			end_addr += ccis;
-+			end_addr += ccis + emu->delay_pcm_irq;
- 		}
- 		if (stereo && !extra) {
- 			snd_emu10k1_ptr_write(emu, CPF, voice, CPF_STEREO_MASK);
-@@ -360,7 +360,9 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,
- 	/* Assumption that PT is already 0 so no harm overwriting */
- 	snd_emu10k1_ptr_write(emu, PTRX, voice, (send_amount[0] << 8) | send_amount[1]);
- 	snd_emu10k1_ptr_write(emu, DSL, voice, end_addr | (send_amount[3] << 24));
--	snd_emu10k1_ptr_write(emu, PSST, voice, start_addr | (send_amount[2] << 24));
-+	snd_emu10k1_ptr_write(emu, PSST, voice,
-+			(start_addr + (extra ? emu->delay_pcm_irq : 0)) |
-+			(send_amount[2] << 24));
- 	if (emu->card_capabilities->emu_model)
- 		pitch_target = PITCH_48000; /* Disable interpolators on emu1010 card */
- 	else 
-@@ -732,6 +734,23 @@ static void snd_emu10k1_playback_stop_voice(struct snd_emu10k1 *emu, struct snd_
- 	snd_emu10k1_ptr_write(emu, IP, voice, 0);
- }
- 
-+static inline void snd_emu10k1_playback_mangle_extra(struct snd_emu10k1 *emu,
-+		struct snd_emu10k1_pcm *epcm,
-+		struct snd_pcm_substream *substream,
-+		struct snd_pcm_runtime *runtime)
-+{
-+	unsigned int ptr, period_pos;
-+
-+	/* try to sychronize the current position for the interrupt
-+	   source voice */
-+	period_pos = runtime->status->hw_ptr - runtime->hw_ptr_interrupt;
-+	period_pos %= runtime->period_size;
-+	ptr = snd_emu10k1_ptr_read(emu, CCCA, epcm->extra->number);
-+	ptr &= ~0x00ffffff;
-+	ptr |= epcm->ccca_start_addr + period_pos;
-+	snd_emu10k1_ptr_write(emu, CCCA, epcm->extra->number, ptr);
-+}
-+
- static int snd_emu10k1_playback_trigger(struct snd_pcm_substream *substream,
- 				        int cmd)
- {
-@@ -753,6 +772,8 @@ static int snd_emu10k1_playback_trigger(struct snd_pcm_substream *substream,
- 		/* follow thru */
- 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
- 	case SNDRV_PCM_TRIGGER_RESUME:
-+		if (cmd == SNDRV_PCM_TRIGGER_PAUSE_RELEASE)
-+			snd_emu10k1_playback_mangle_extra(emu, epcm, substream, runtime);
- 		mix = &emu->pcm_mixer[substream->number];
- 		snd_emu10k1_playback_prepare_voice(emu, epcm->voices[0], 1, 0, mix);
- 		snd_emu10k1_playback_prepare_voice(emu, epcm->voices[1], 0, 0, mix);
-@@ -869,8 +890,9 @@ static snd_pcm_uframes_t snd_emu10k1_playback_pointer(struct snd_pcm_substream *
- #endif
- 	/*
- 	printk(KERN_DEBUG
--	       "ptr = 0x%x, buffer_size = 0x%x, period_size = 0x%x\n",
--	       ptr, runtime->buffer_size, runtime->period_size);
-+	       "ptr = 0x%lx, buffer_size = 0x%lx, period_size = 0x%lx\n",
-+	       (long)ptr, (long)runtime->buffer_size,
-+	       (long)runtime->period_size);
- 	*/
- 	return ptr;
- }
-diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c
-index ffb1ddb..957a311 100644
---- a/sound/pci/emu10k1/memory.c
-+++ b/sound/pci/emu10k1/memory.c
-@@ -310,8 +310,10 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst
- 	if (snd_BUG_ON(!hdr))
- 		return NULL;
- 
-+	idx = runtime->period_size >= runtime->buffer_size ?
-+					(emu->delay_pcm_irq * 2) : 0;
- 	mutex_lock(&hdr->block_mutex);
--	blk = search_empty(emu, runtime->dma_bytes);
-+	blk = search_empty(emu, runtime->dma_bytes + idx);
- 	if (blk == NULL) {
- 		mutex_unlock(&hdr->block_mutex);
- 		return NULL;
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index 2bf2cb5..baadda4 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -2970,6 +2970,7 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
- 	SND_PCI_QUIRK(0x1028, 0x02f5, "Dell",
- 		      CXT5066_DELL_LAPTOP),
- 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT5066_OLPC_XO_1_5),
-+	SND_PCI_QUIRK(0x1028, 0x02d8, "Dell Vostro", CXT5066_DELL_VOSTO),
- 	SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTO),
- 	SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
- 	SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index aa7cc51..6d9a542 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -6864,6 +6864,7 @@ static int patch_alc260(struct hda_codec *codec)
- 
- 	spec->stream_analog_playback = &alc260_pcm_analog_playback;
- 	spec->stream_analog_capture = &alc260_pcm_analog_capture;
-+	spec->stream_analog_alt_capture = &alc260_pcm_analog_capture;
- 
- 	spec->stream_digital_playback = &alc260_pcm_digital_playback;
- 	spec->stream_digital_capture = &alc260_pcm_digital_capture;
-diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
-index 6433e65..4677492 100644
---- a/sound/pci/intel8x0.c
-+++ b/sound/pci/intel8x0.c
-@@ -1776,6 +1776,12 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
-         },
- 	{
- 		.subvendor = 0x1014,
-+		.subdevice = 0x0534,
-+		.name = "ThinkPad X31",
-+		.type = AC97_TUNE_INV_EAPD
-+	},
-+	{
-+		.subvendor = 0x1014,
- 		.subdevice = 0x1f00,
- 		.name = "MS-9128",
- 		.type = AC97_TUNE_ALC_JACK
-diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c
-index ad44626..c737287 100644
---- a/sound/pci/riptide/riptide.c
-+++ b/sound/pci/riptide/riptide.c
-@@ -1224,15 +1224,14 @@ static int try_to_load_firmware(struct cmdif *cif, struct snd_riptide *chip)
- 		    firmware.firmware.ASIC, firmware.firmware.CODEC,
- 		    firmware.firmware.AUXDSP, firmware.firmware.PROG);
- 
-+	if (!chip)
-+		return 1;
-+
- 	for (i = 0; i < FIRMWARE_VERSIONS; i++) {
- 		if (!memcmp(&firmware_versions[i], &firmware, sizeof(firmware)))
--			break;
--	}
--	if (i >= FIRMWARE_VERSIONS)
--		return 0; /* no match */
-+			return 1; /* OK */
- 
--	if (!chip)
--		return 1; /* OK */
-+	}
- 
- 	snd_printdd("Writing Firmware\n");
- 	if (!chip->fw_entry) {
-diff --git a/sound/soc/codecs/wm8580.c b/sound/soc/codecs/wm8580.c
-index c3571ee..72deeab 100644
---- a/sound/soc/codecs/wm8580.c
-+++ b/sound/soc/codecs/wm8580.c
-@@ -269,9 +269,9 @@ SOC_DOUBLE("DAC2 Invert Switch", WM8580_DAC_CONTROL4,  2, 3, 1, 0),
- SOC_DOUBLE("DAC3 Invert Switch", WM8580_DAC_CONTROL4,  4, 5, 1, 0),
- 
- SOC_SINGLE("DAC ZC Switch", WM8580_DAC_CONTROL5, 5, 1, 0),
--SOC_SINGLE("DAC1 Switch", WM8580_DAC_CONTROL5, 0, 1, 0),
--SOC_SINGLE("DAC2 Switch", WM8580_DAC_CONTROL5, 1, 1, 0),
--SOC_SINGLE("DAC3 Switch", WM8580_DAC_CONTROL5, 2, 1, 0),
-+SOC_SINGLE("DAC1 Switch", WM8580_DAC_CONTROL5, 0, 1, 1),
-+SOC_SINGLE("DAC2 Switch", WM8580_DAC_CONTROL5, 1, 1, 1),
-+SOC_SINGLE("DAC3 Switch", WM8580_DAC_CONTROL5, 2, 1, 1),
- 
- SOC_DOUBLE("ADC Mute Switch", WM8580_ADC_CONTROL1, 0, 1, 1, 0),
- SOC_SINGLE("ADC High-Pass Filter Switch", WM8580_ADC_CONTROL1, 4, 1, 0),
-diff --git a/sound/soc/codecs/wm8776.c b/sound/soc/codecs/wm8776.c
-index 4e212ed..f8154e6 100644
---- a/sound/soc/codecs/wm8776.c
-+++ b/sound/soc/codecs/wm8776.c
-@@ -178,13 +178,6 @@ static int wm8776_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
- 	case SND_SOC_DAIFMT_LEFT_J:
- 		iface |= 0x0001;
- 		break;
--		/* FIXME: CHECK A/B */
--	case SND_SOC_DAIFMT_DSP_A:
--		iface |= 0x0003;
--		break;
--	case SND_SOC_DAIFMT_DSP_B:
--		iface |= 0x0007;
--		break;
- 	default:
- 		return -EINVAL;
- 	}
-diff --git a/sound/soc/soc-cache.c b/sound/soc/soc-cache.c
-index 472af38..adbc68c 100644
---- a/sound/soc/soc-cache.c
-+++ b/sound/soc/soc-cache.c
-@@ -340,7 +340,7 @@ static unsigned int snd_soc_16_8_read_i2c(struct snd_soc_codec *codec,
- static unsigned int snd_soc_16_8_read(struct snd_soc_codec *codec,
- 				     unsigned int reg)
- {
--	u16 *cache = codec->reg_cache;
-+	u8 *cache = codec->reg_cache;
- 
- 	reg &= 0xff;
- 	if (reg >= codec->reg_cache_size)
-@@ -351,7 +351,7 @@ static unsigned int snd_soc_16_8_read(struct snd_soc_codec *codec,
- static int snd_soc_16_8_write(struct snd_soc_codec *codec, unsigned int reg,
- 			     unsigned int value)
- {
--	u16 *cache = codec->reg_cache;
-+	u8 *cache = codec->reg_cache;
- 	u8 data[3];
- 	int ret;
- 
diff --git a/debian/patches/bugfix/all/viafb-Depends-on-X86.patch b/debian/patches/bugfix/all/viafb-Depends-on-X86.patch
deleted file mode 100644
index fe2097b90..000000000
--- a/debian/patches/bugfix/all/viafb-Depends-on-X86.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From b994ef79fccdcf24182ea375e917ec124c3cfdfa Mon Sep 17 00:00:00 2001
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Tue, 20 Jul 2010 00:31:24 +0100
-Subject: [PATCH 1/2] viafb: Depends on X86
-
-VIA UniChrome and Chrome9 GPUs only exist as Integrated Graphics
-Processors in x86 chipsets.
----
- drivers/video/Kconfig |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
-index 3d94a14..162a0b7 100644
---- a/drivers/video/Kconfig
-+++ b/drivers/video/Kconfig
-@@ -1505,7 +1505,7 @@ config FB_SIS_315
- 
- config FB_VIA
-        tristate "VIA UniChrome (Pro) and Chrome9 display support"
--       depends on FB && PCI
-+       depends on FB && PCI && X86
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
--- 
-1.7.1
-
diff --git a/debian/patches/bugfix/ia64/hardcode-arch-script-output.patch b/debian/patches/bugfix/ia64/hardcode-arch-script-output.patch
index f11750b11..fe3076ba8 100644
--- a/debian/patches/bugfix/ia64/hardcode-arch-script-output.patch
+++ b/debian/patches/bugfix/ia64/hardcode-arch-script-output.patch
@@ -4,7 +4,7 @@ index e7cbaa0..c8af869 100644
 +++ b/arch/ia64/Makefile
 @@ -30,16 +30,7 @@ cflags-y	:= -pipe $(EXTRA) -ffixed-r13 -mfixed-range=f12-f15,f32-f127 \
  		   -falign-functions=32 -frename-registers -fno-optimize-sibling-calls
- CFLAGS_KERNEL	:= -mconstant-gp
+ KBUILD_CFLAGS_KERNEL := -mconstant-gp
  
 -GAS_STATUS	= $(shell $(srctree)/arch/ia64/scripts/check-gas "$(CC)" "$(OBJDUMP)")
 -KBUILD_CPPFLAGS += $(shell $(srctree)/arch/ia64/scripts/toolchain-flags "$(CC)" "$(OBJDUMP)" "$(READELF)")
diff --git a/debian/patches/bugfix/mips/disable-werror.patch b/debian/patches/bugfix/mips/disable-werror.patch
deleted file mode 100644
index efe0664ab..000000000
--- a/debian/patches/bugfix/mips/disable-werror.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-
-workaround this bug:
-
-cc1: warnings being treated as errors
-arch/mips/kernel/../../../fs/binfmt_elf.c: In function ‘vma_dump_size’:
-arch/mips/kernel/../../../fs/binfmt_elf.c:1202: warning: ‘word’ may be used uninitialized in this function
-
-
---- a/arch/mips/kernel/Makefile	2009-02-16 11:25:13.000000000 +0000
-+++ b/arch/mips/kernel/Makefile	2009-02-16 11:25:23.000000000 +0000
-@@ -100,6 +100,5 @@
- 
- obj-$(CONFIG_MIPS_CPUFREQ)	+= cpufreq/
- 
--EXTRA_CFLAGS += -Werror
- 
- CPPFLAGS_vmlinux.lds		:= $(KBUILD_CFLAGS)
diff --git a/debian/patches/bugfix/mips/octeon-gcc-4.4.patch b/debian/patches/bugfix/mips/octeon-gcc-4.4.patch
deleted file mode 100644
index ed04fbdce..000000000
--- a/debian/patches/bugfix/mips/octeon-gcc-4.4.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-commit 5c8974538afd97990d3730ef6fea731a34ef1f85
-Author: Florian Fainelli <florian@openwrt.org>
-Date:   Thu Jul 29 00:13:07 2010 +0200
-
-    MIPS: Octeon: Workaround link failures with gcc-4.4.x 32-bits toolchains
-    
-    When building with a gcc-4.4.x toolchain that is configured to produce
-    32-bits executables by default, we will produce __lshrti3 in sched_clock()
-    which is never resolved so the kernel fails to link. Unconditionally use
-    the inline assembly version as suggested by David Daney, which works around
-    the issue.
-    
-    Signed-off-by: Florian Fainelli <florian@openwrt.org>
-    To: linux-mips@linux-mips.org
-    Patchwork: https://patchwork.linux-mips.org/patch/1514/
-    Acked-by: David Daney <ddaney@caviumnetworks.com>
-    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-
-diff --git a/arch/mips/cavium-octeon/csrc-octeon.c b/arch/mips/cavium-octeon/csrc-octeon.c
-index 0bf4bbe..36400d2 100644
---- a/arch/mips/cavium-octeon/csrc-octeon.c
-+++ b/arch/mips/cavium-octeon/csrc-octeon.c
-@@ -53,7 +53,6 @@ static struct clocksource clocksource_mips = {
- unsigned long long notrace sched_clock(void)
- {
- 	/* 64-bit arithmatic can overflow, so use 128-bit.  */
--#if (__GNUC__ < 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ <= 3))
- 	u64 t1, t2, t3;
- 	unsigned long long rv;
- 	u64 mult = clocksource_mips.mult;
-@@ -73,13 +72,6 @@ unsigned long long notrace sched_clock(void)
- 		: [cnt] "r" (cnt), [mult] "r" (mult), [shift] "r" (shift)
- 		: "hi", "lo");
- 	return rv;
--#else
--	/* GCC > 4.3 do it the easy way.  */
--	unsigned int __attribute__((mode(TI))) t;
--	t = read_c0_cvmcount();
--	t = t * clocksource_mips.mult;
--	return (unsigned long long)(t >> clocksource_mips.shift);
--#endif
- }
- 
- void __init plat_time_init(void)
diff --git a/debian/patches/debian/dfsg/files-1 b/debian/patches/debian/dfsg/files-1
index fb132269e..be5b0d02b 100644
--- a/debian/patches/debian/dfsg/files-1
+++ b/debian/patches/debian/dfsg/files-1
@@ -37,8 +37,6 @@ rm arch/powerpc/sysdev/micropatch.c
 
 rm drivers/media/dvb/dvb-usb/af9005-script.h
 
-unifdef drivers/media/dvb/frontends/lgs8gxx.c -UREMOVE_DFSG
-
 rm drivers/net/appletalk/cops.c
 rm drivers/net/appletalk/cops.h
 rm drivers/net/appletalk/cops_ffdrv.h
diff --git a/debian/patches/debian/dfsg/firmware-cleanup.patch b/debian/patches/debian/dfsg/firmware-cleanup.patch
index a435a1a28..e78f45677 100644
--- a/debian/patches/debian/dfsg/firmware-cleanup.patch
+++ b/debian/patches/debian/dfsg/firmware-cleanup.patch
@@ -28,7 +28,7 @@ index 1c00d05..3bf888d 100644
 -fw-shipped-$(CONFIG_COMPUTONE) += intelliport2.bin
 -fw-shipped-$(CONFIG_CHELSIO_T3) += cxgb3/t3b_psram-1.1.0.bin \
 -				   cxgb3/t3c_psram-1.1.0.bin \
--				   cxgb3/t3fw-7.4.0.bin \
+-				   cxgb3/t3fw-7.10.0.bin \
 -				   cxgb3/ael2005_opt_edc.bin \
 -				   cxgb3/ael2005_twx_edc.bin \
 -				   cxgb3/ael2020_twx_edc.bin
diff --git a/debian/patches/debian/dfsg/lgs8gxx-lgs8g75-disable.patch b/debian/patches/debian/dfsg/lgs8gxx-lgs8g75-disable.patch
deleted file mode 100644
index 639dcd609..000000000
--- a/debian/patches/debian/dfsg/lgs8gxx-lgs8g75-disable.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 15e2cca5411a60ec9d936b36be1bac937f1bfeaa Mon Sep 17 00:00:00 2001
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Tue, 3 Nov 2009 23:50:20 +0000
-Subject: [PATCH 18/24] lgs8gxx: mark lgs8g75 as broken and mark firmware for removal
-
----
- drivers/media/dvb/frontends/lgs8gxx.c |   11 +++++++++++
- 1 files changed, 11 insertions(+), 0 deletions(-)
-
-diff --git a/drivers/media/dvb/frontends/lgs8gxx.c b/drivers/media/dvb/frontends/lgs8gxx.c
-index eabcadc..a7446fd 100644
---- a/drivers/media/dvb/frontends/lgs8gxx.c
-+++ b/drivers/media/dvb/frontends/lgs8gxx.c
-@@ -46,6 +46,7 @@ module_param(fake_signal_str, int, 0644);
- MODULE_PARM_DESC(fake_signal_str, "fake signal strength for LGS8913."
- "Signal strength calculation is slow.(default:on).");
- 
-+#ifdef REMOVE_DFSG
- static const u8 lgs8g75_initdat[] = {
- 	0x01, 0x30, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-@@ -81,6 +82,7 @@ static const u8 lgs8g75_initdat[] = {
- 	0x65, 0xE0, 0x54, 0xFD, 0xF0, 0x22, 0x90, 0x80,
- 	0x65, 0xE0, 0x44, 0xC2, 0xF0, 0x22
- };
-+#endif
- 
- /* LGS8GXX internal helper functions */
- 
-@@ -625,6 +627,7 @@ static int lgs8913_init(struct lgs8gxx_state *priv)
- 	return 0;
- }
- 
-+#ifdef CONFIG_BROKEN
- static int lgs8g75_init_data(struct lgs8gxx_state *priv)
- {
- 	const u8 *p = lgs8g75_initdat;
-@@ -652,6 +655,7 @@ static int lgs8g75_init_data(struct lgs8gxx_state *priv)
- 
- 	return 0;
- }
-+#endif
- 
- static int lgs8gxx_init(struct dvb_frontend *fe)
- {
-@@ -1089,7 +1093,14 @@ struct dvb_frontend *lgs8gxx_attach(const struct lgs8gxx_config *config,
- 	priv->frontend.demodulator_priv = priv;
- 
- 	if (config->prod == LGS8GXX_PROD_LGS8G75)
-+#ifdef CONFIG_BROKEN
- 		lgs8g75_init_data(priv);
-+#else
-+	{
-+		dprintk("lgs8g75 firmware not available\n");
-+		goto error_out;
-+	}
-+#endif
- 
- 	return &priv->frontend;
- 
--- 
-1.6.5.2
-
diff --git a/debian/patches/debian/mips-disable-werror.patch b/debian/patches/debian/mips-disable-werror.patch
new file mode 100644
index 000000000..8133eb98a
--- /dev/null
+++ b/debian/patches/debian/mips-disable-werror.patch
@@ -0,0 +1,28 @@
+From 210ea66fdb876415c09d20497beed650ac65e9d2 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 13 Sep 2010 02:16:18 +0100
+Subject: [PATCH] Partially revert "MIPS: Add -Werror to arch/mips/Kbuild"
+
+This reverts commit 66f9ba101f54bda63ab1db97f9e9e94763d0651b.
+
+We really don't want to add -Werror anywhere.
+---
+ arch/mips/Kbuild |    5 -----
+ 1 files changed, 0 insertions(+), 5 deletions(-)
+
+diff --git a/arch/mips/Kbuild b/arch/mips/Kbuild
+index e322d65..2e6b28f 100644
+--- a/arch/mips/Kbuild
++++ b/arch/mips/Kbuild
+@@ -1,8 +1,3 @@
+-# Fail on warnings - also for files referenced in subdirs
+-# -Werror can be disabled for specific files using:
+-# CFLAGS_<file.o> := -Wno-error
+-subdir-ccflags-y := -Werror
+-
+ # platform specific definitions
+ include arch/mips/Kbuild.platforms
+ obj-y := $(platform-y)
+-- 
+1.7.1
+
diff --git a/debian/patches/debian/scripts-kconfig-reportoldconfig.patch b/debian/patches/debian/scripts-kconfig-reportoldconfig.patch
index b2d9fed35..15106eb6b 100644
--- a/debian/patches/debian/scripts-kconfig-reportoldconfig.patch
+++ b/debian/patches/debian/scripts-kconfig-reportoldconfig.patch
@@ -1,5 +1,5 @@
 diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
-index 999e8a7..3b5d4ba 100644
+index de934de..57e96aa 100644
 --- a/scripts/kconfig/Makefile
 +++ b/scripts/kconfig/Makefile
 @@ -3,7 +3,7 @@
@@ -11,105 +11,78 @@ index 999e8a7..3b5d4ba 100644
  
  ifdef KBUILD_KCONFIG
  Kconfig := $(KBUILD_KCONFIG)
-@@ -26,10 +26,16 @@ config: $(obj)/conf
+@@ -29,10 +29,16 @@ nconfig: $(obj)/nconf
  oldconfig: $(obj)/conf
- 	$< -o $(Kconfig)
+ 	$< --$@ $(Kconfig)
  
 +reportoldconfig: $(obj)/conf
-+	$< -R $(Kconfig)
++	$< --$@ $(Kconfig)
 +
  silentoldconfig: $(obj)/conf
  	$(Q)mkdir -p include/generated
- 	$< -s $(Kconfig)
+ 	$< --$@ $(Kconfig)
  
 +updateoldconfig: $(obj)/conf
-+	$< -U $(Kconfig)
++	$< --$@ $(Kconfig)
 +
  # if no path is given, then use src directory to find file
  ifdef LSMOD
  LSMOD_F := $(LSMOD)
 diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
-index 3e1057f..e526d00 100644
+index 5b7c86e..9c2171c 100644
 --- a/scripts/kconfig/conf.c
 +++ b/scripts/kconfig/conf.c
-@@ -5,6 +5,7 @@
+@@ -33,6 +33,8 @@ enum input_mode {
+ 	savedefconfig,
+ 	listnewconfig,
+ 	oldnoconfig,
++	reportoldconfig,
++	updateoldconfig,
+ } input_mode = oldaskconfig;
  
- #include <locale.h>
- #include <ctype.h>
-+#include <stdbool.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
-@@ -434,12 +435,13 @@ int main(int ac, char **av)
- 	int opt;
- 	const char *name;
- 	struct stat tmpstat;
-+	bool report = false, update = false;
+ char *defconfig_file;
+@@ -453,6 +455,8 @@ static struct option long_opts[] = {
+ 	{"randconfig",      no_argument,       NULL, randconfig},
+ 	{"listnewconfig",   no_argument,       NULL, listnewconfig},
+ 	{"oldnoconfig",     no_argument,       NULL, oldnoconfig},
++	{"reportoldconfig", no_argument,       NULL, reportoldconfig},
++	{"updateoldconfig", no_argument,       NULL, updateoldconfig},
+ 	{NULL, 0, NULL, 0}
+ };
  
- 	setlocale(LC_ALL, "");
- 	bindtextdomain(PACKAGE, LOCALEDIR);
- 	textdomain(PACKAGE);
- 
--	while ((opt = getopt(ac, av, "osdD:nmyrh")) != -1) {
-+	while ((opt = getopt(ac, av, "osdD:nmyrRUh")) != -1) {
- 		switch (opt) {
- 		case 'o':
- 			input_mode = ask_silent;
-@@ -481,6 +482,14 @@ int main(int ac, char **av)
- 			input_mode = set_random;
- 			break;
- 		}
-+		case 'R':
-+			input_mode = set_default;
-+			report = update = true;
-+			break;
-+		case 'U':
-+			input_mode = set_default;
-+			update = true;
-+			break;
- 		case 'h':
- 			printf(_("See README for usage info\n"));
- 			exit(0);
-@@ -512,13 +522,17 @@ int main(int ac, char **av)
- 
- 	switch (input_mode) {
- 	case set_default:
--		if (!defconfig_file)
--			defconfig_file = conf_get_default_confname();
--		if (conf_read(defconfig_file)) {
--			printf(_("***\n"
--				"*** Can't find default configuration \"%s\"!\n"
--				"***\n"), defconfig_file);
--			exit(1);
-+		if (update)
-+			conf_read(NULL);
-+		else {
-+			if (!defconfig_file)
-+				defconfig_file = conf_get_default_confname();
-+			if (conf_read(defconfig_file)) {
-+				printf("***\n"
-+					"*** Can't find default configuration \"%s\"!\n"
-+					"***\n", defconfig_file);
-+				exit(1);
-+			}
+@@ -530,6 +534,8 @@ int main(int ac, char **av)
  		}
  		break;
- 	case ask_silent:
-@@ -594,6 +608,9 @@ int main(int ac, char **av)
+ 	case savedefconfig:
++	case reportoldconfig:
++	case updateoldconfig:
+ 		conf_read(NULL);
+ 		break;
+ 	case silentoldconfig:
+@@ -595,6 +601,8 @@ int main(int ac, char **av)
+ 		conf_set_all_new_symbols(def_random);
+ 		break;
+ 	case defconfig:
++	case reportoldconfig:
++	case updateoldconfig:
+ 		conf_set_all_new_symbols(def_default);
+ 		break;
+ 	case savedefconfig:
+@@ -618,6 +626,9 @@ int main(int ac, char **av)
  		break;
  	}
  
-+	if (report)
++	if (input_mode == reportoldconfig)
 +		conf_write_changes();
 +
  	if (sync_kconfig) {
  		/* silentoldconfig is used during the build so we shall update autoconf.
  		 * All other commands are only used to generate a config.
 diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
-index 830d9ea..faf0b50 100644
+index 515253f..ee81b42 100644
 --- a/scripts/kconfig/confdata.c
 +++ b/scripts/kconfig/confdata.c
-@@ -786,6 +786,85 @@ int conf_write_autoconf(void)
+@@ -893,6 +893,85 @@ int conf_write_autoconf(void)
  	return 0;
  }
  
@@ -195,7 +168,7 @@ index 830d9ea..faf0b50 100644
  static int sym_change_count;
  static void (*conf_changed_callback)(void);
  
-@@ -824,6 +903,7 @@ void conf_set_all_new_symbols(enum conf_def_mode mode)
+@@ -991,6 +1070,7 @@ void conf_set_all_new_symbols(enum conf_def_mode mode)
  	for_all_symbols(i, sym) {
  		if (sym_has_value(sym))
  			continue;
@@ -204,23 +177,23 @@ index 830d9ea..faf0b50 100644
  		case S_BOOLEAN:
  		case S_TRISTATE:
 diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h
-index 6408fef..fd025e1 100644
+index 6ee2e4f..09a6a7c 100644
 --- a/scripts/kconfig/expr.h
 +++ b/scripts/kconfig/expr.h
-@@ -106,6 +106,7 @@ struct symbol {
+@@ -107,6 +107,7 @@ struct symbol {
  #define SYMBOL_DEF_AUTO   0x20000  /* symbol.def[S_DEF_AUTO] is valid */
  #define SYMBOL_DEF3       0x40000  /* symbol.def[S_DEF_3] is valid */
  #define SYMBOL_DEF4       0x80000  /* symbol.def[S_DEF_4] is valid */
 +#define SYMBOL_NEW        0x100000
  
  #define SYMBOL_MAXLENGTH	256
- #define SYMBOL_HASHSIZE		257
+ #define SYMBOL_HASHSIZE		9973
 diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
-index 8e69461..974acf0 100644
+index 9a948c9..d5aeb72 100644
 --- a/scripts/kconfig/lkc_proto.h
 +++ b/scripts/kconfig/lkc_proto.h
-@@ -5,6 +5,7 @@ P(conf_read,int,(const char *name));
- P(conf_read_simple,int,(const char *name, int));
+@@ -6,6 +6,7 @@ P(conf_read_simple,int,(const char *name, int));
+ P(conf_write_defconfig,int,(const char *name));
  P(conf_write,int,(const char *name));
  P(conf_write_autoconf,int,(void));
 +P(conf_write_changes,void,(void));
diff --git a/debian/patches/features/all/lgs8gxx-lgs8g75-request_firmware.patch b/debian/patches/features/all/lgs8gxx-lgs8g75-request_firmware.patch
deleted file mode 100644
index 6dd7892fb..000000000
--- a/debian/patches/features/all/lgs8gxx-lgs8g75-request_firmware.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 04a2710a7de7f20ceec7f30c9e56d01d20284b15 Mon Sep 17 00:00:00 2001
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Sun, 1 Nov 2009 02:12:10 +0000
-Subject: [PATCH 20/24] V4L/DVB: lgs8gxx: remove firmware for lgs8g75
-
-The recently added support for lgs8g75 included some 8051 machine code
-without accompanying source code.  Replace this with use of the
-firmware loader.
-
-Compile-tested only.
----
- drivers/media/dvb/frontends/Kconfig   |    1 +
- drivers/media/dvb/frontends/lgs8gxx.c |   23 ++++++++++-------------
- 2 files changed, 11 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
-index d7c4837..26b00ab 100644
---- a/drivers/media/dvb/frontends/Kconfig
-+++ b/drivers/media/dvb/frontends/Kconfig
-@@ -553,6 +553,7 @@ config DVB_LGS8GL5
- config DVB_LGS8GXX
- 	tristate "Legend Silicon LGS8913/LGS8GL5/LGS8GXX DMB-TH demodulator"
- 	depends on DVB_CORE && I2C
-+	select FW_LOADER
- 	default m if DVB_FE_CUSTOMISE
- 	help
- 	  A DMB-TH tuner module. Say Y when you want to support this frontend.
-diff --git a/drivers/media/dvb/frontends/lgs8gxx.c b/drivers/media/dvb/frontends/lgs8gxx.c
-index ba74df0..1bfcf85 100644
---- a/drivers/media/dvb/frontends/lgs8gxx.c
-+++ b/drivers/media/dvb/frontends/lgs8gxx.c
-@@ -24,6 +24,7 @@
-  */
- 
- #include <asm/div64.h>
-+#include <linux/firmware.h>
- 
- #include "dvb_frontend.h"
- 
-@@ -589,12 +590,16 @@ static int lgs8913_init(struct lgs8gxx_state *priv)
- 	return 0;
- }
- 
--#ifdef CONFIG_BROKEN
- static int lgs8g75_init_data(struct lgs8gxx_state *priv)
- {
--	const u8 *p = lgs8g75_initdat;
-+	const struct firmware *fw;
-+	int rc;
- 	int i;
- 
-+	rc = request_firmware(&fw, "lgs8g75.fw", &priv->i2c->dev);
-+	if (rc)
-+		return rc;
-+
- 	lgs8gxx_write_reg(priv, 0xC6, 0x40);
- 
- 	lgs8gxx_write_reg(priv, 0x3D, 0x04);
-@@ -605,19 +610,18 @@ static int lgs8g75_init_data(struct lgs8gxx_state *priv)
- 	lgs8gxx_write_reg(priv, 0x3B, 0x00);
- 	lgs8gxx_write_reg(priv, 0x38, 0x00);
- 
--	for (i = 0; i < sizeof(lgs8g75_initdat); i++) {
-+	for (i = 0; i < fw->size; i++) {
- 		lgs8gxx_write_reg(priv, 0x38, 0x00);
- 		lgs8gxx_write_reg(priv, 0x3A, (u8)(i&0xff));
- 		lgs8gxx_write_reg(priv, 0x3B, (u8)(i>>8));
--		lgs8gxx_write_reg(priv, 0x3C, *p);
--		p++;
-+		lgs8gxx_write_reg(priv, 0x3C, fw->data[i]);
- 	}
- 
- 	lgs8gxx_write_reg(priv, 0x38, 0x00);
- 
-+	release_firmware(fw);
- 	return 0;
- }
--#endif
- 
- static int lgs8gxx_init(struct dvb_frontend *fe)
- {
-@@ -1055,14 +1059,7 @@ struct dvb_frontend *lgs8gxx_attach(const struct lgs8gxx_config *config,
- 	priv->frontend.demodulator_priv = priv;
- 
- 	if (config->prod == LGS8GXX_PROD_LGS8G75)
--#ifdef CONFIG_BROKEN
- 		lgs8g75_init_data(priv);
--#else
--	{
--		dprintk("lgs8g75 firmware not available\n");
--		goto error_out;
--	}
--#endif
- 
- 	return &priv->frontend;
- 
--- 
-1.6.5.2
-
diff --git a/debian/patches/features/all/m25p80-add-support-mx25l8005.patch b/debian/patches/features/all/m25p80-add-support-mx25l8005.patch
deleted file mode 100644
index 0f7e0f970..000000000
--- a/debian/patches/features/all/m25p80-add-support-mx25l8005.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-mtd: m25p80: Add support for Macronix 25L8005
-
-Add support for Macronix 25L8005.  Tested on a HP t5325 Thin Client.
-
-Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
-[bwh: Adjust for 2.6.35]
-
---- a/drivers/mtd/devices/m25p80.c	2010-06-19 10:37:08.000000000 +0000
-+++ b/drivers/mtd/devices/m25p80.c	2010-06-19 10:37:54.000000000 +0000
-@@ -621,6 +621,7 @@
- 
- 	/* Macronix */
- 	{ "mx25l4005a",  INFO(0xc22013, 0, 64 * 1024,   8, SECT_4K) },
-+	{ "mx25l8005",   INFO(0xc22014, 0, 64 * 1024,  16, SECT_4K) },
- 	{ "mx25l3205d",  INFO(0xc22016, 0, 64 * 1024,  64, 0) },
- 	{ "mx25l6405d",  INFO(0xc22017, 0, 64 * 1024, 128, 0) },
- 	{ "mx25l12805d", INFO(0xc22018, 0, 64 * 1024, 256, 0) },
diff --git a/debian/patches/features/all/speakup/speakup-kbuild.patch b/debian/patches/features/all/speakup/speakup-kbuild.patch
index ed417f3d0..9e977a4aa 100644
--- a/debian/patches/features/all/speakup/speakup-kbuild.patch
+++ b/debian/patches/features/all/speakup/speakup-kbuild.patch
@@ -3,10 +3,10 @@ Subject: [PATCH] speakup: integrate into kbuild
 
 --- a/drivers/staging/Kconfig
 +++ b/drivers/staging/Kconfig
-@@ -146,6 +146,8 @@
- source "drivers/staging/mrst-touchscreen/Kconfig"
+@@ -152,6 +152,8 @@
+ source "drivers/staging/tidspbridge/Kconfig"
  
- source "drivers/staging/msm/Kconfig"
+ source "drivers/staging/quickstart/Kconfig"
 +
 +source "drivers/staging/speakup/Kconfig"
  
@@ -14,10 +14,10 @@ Subject: [PATCH] speakup: integrate into kbuild
  endif # STAGING
 --- a/drivers/staging/Makefile
 +++ b/drivers/staging/Makefile
-@@ -53,3 +53,4 @@
- obj-$(CONFIG_FB_XGI)		+= xgifb/
- obj-$(CONFIG_TOUCHSCREEN_MRSTOUCH)	+= mrst-touchscreen/
- obj-$(CONFIG_MSM_STAGING)	+= msm/
+@@ -57,3 +57,4 @@
+ obj-$(CONFIG_SOLO6X10)		+= solo6x10/
+ obj-$(CONFIG_TIDSPBRIDGE)	+= tidspbridge/
+ obj-$(CONFIG_ACPI_QUICKSTART)	+= quickstart/
 +obj-$(CONFIG_SPEAKUP)		+= speakup/
 --- a/drivers/staging/speakup/Kbuild
 +++ b/drivers/staging/speakup/Kbuild
diff --git a/debian/patches/features/arm/hp-t5325.patch b/debian/patches/features/arm/hp-t5325.patch
deleted file mode 100644
index f2bb2da3e..000000000
--- a/debian/patches/features/arm/hp-t5325.patch
+++ /dev/null
@@ -1,235 +0,0 @@
-Subject: [PATCH] Kirkwood: Add support for HP t5325 Thin Client
-
-Add support for the HP t5325 Thin Client.  This thin client is based
-on a Marvell Kirkwood chip at 1.2 GHz and features 512 MB RAM, 512 MB
-SATA-attached flash and an XGI Volari Z11 GPU.
-
-Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
-[bwh: Adjust context for 2.6.35]
-
-diff --git a/arch/arm/mach-kirkwood/Kconfig b/arch/arm/mach-kirkwood/Kconfig
-index 29b2163..4278271 100644
---- a/arch/arm/mach-kirkwood/Kconfig
-+++ b/arch/arm/mach-kirkwood/Kconfig
-@@ -81,6 +81,12 @@
- 	  Say 'Y' here if you want your kernel to support the
- 	  Marvell OpenRD Ultimate Board.
- 
-+config MACH_T5325
-+	bool "HP t5325 Thin Client"
-+	help
-+	  Say 'Y' here if you want your kernel to support the
-+	  HP t5325 Thin Client.
-+
- config MACH_NETSPACE_V2
- 	bool "LaCie Network Space v2 NAS Board"
- 	help
-diff --git a/arch/arm/mach-kirkwood/Makefile b/arch/arm/mach-kirkwood/Makefile
-index c0cd5d3..b7c5d5e 100644
---- a/arch/arm/mach-kirkwood/Makefile
-+++ b/arch/arm/mach-kirkwood/Makefile
-@@ -10,6 +10,7 @@
- obj-$(CONFIG_MACH_TS219)		+= ts219-setup.o tsx1x-common.o
- obj-$(CONFIG_MACH_TS41X)		+= ts41x-setup.o tsx1x-common.o
- obj-$(CONFIG_MACH_OPENRD)		+= openrd-setup.o
-+obj-$(CONFIG_MACH_T5325)		+= t5325-setup.o
- obj-$(CONFIG_MACH_NETSPACE_V2)		+= netspace_v2-setup.o
- obj-$(CONFIG_MACH_INETSPACE_V2)		+= netspace_v2-setup.o
- obj-$(CONFIG_MACH_NET2BIG_V2)		+= netxbig_v2-setup.o
---- /dev/null	2010-05-25 13:42:08.579681378 +0000
-+++ b/arch/arm/mach-kirkwood/t5325-setup.c	2010-05-24 14:48:44.000000000 +0000
-@@ -0,0 +1,194 @@
-+/*
-+ *
-+ * HP t5325 Thin Client setup
-+ *
-+ * Copyright (C) 2010  Martin Michlmayr <tbm@cyrius.com>
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License
-+ * as published by the Free Software Foundation; either version
-+ * 2 of the License, or (at your option) any later version.
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/init.h>
-+#include <linux/platform_device.h>
-+#include <linux/mtd/physmap.h>
-+#include <linux/spi/flash.h>
-+#include <linux/spi/spi.h>
-+#include <linux/spi/orion_spi.h>
-+#include <linux/i2c.h>
-+#include <linux/mv643xx_eth.h>
-+#include <linux/ata_platform.h>
-+#include <linux/gpio.h>
-+#include <linux/gpio_keys.h>
-+#include <linux/input.h>
-+#include <asm/mach-types.h>
-+#include <asm/mach/arch.h>
-+#include <mach/kirkwood.h>
-+#include "common.h"
-+#include "mpp.h"
-+
-+struct mtd_partition hp_t5325_partitions[] = {
-+	{
-+		.name		= "u-boot env",
-+		.size		= SZ_64K,
-+		.offset		= SZ_512K + SZ_256K,
-+	},
-+	{
-+		.name		= "permanent u-boot env",
-+		.size		= SZ_64K,
-+		.offset		= MTDPART_OFS_APPEND,
-+		.mask_flags	= MTD_WRITEABLE,
-+	},
-+	{
-+		.name		= "HP env",
-+		.size		= SZ_64K,
-+		.offset		= MTDPART_OFS_APPEND,
-+	},
-+	{
-+		.name		= "u-boot",
-+		.size		= SZ_512K,
-+		.offset		= 0,
-+		.mask_flags	= MTD_WRITEABLE,
-+	},
-+	{
-+		.name		= "SSD firmware",
-+		.size		= SZ_256K,
-+		.offset		= SZ_512K,
-+	},
-+};
-+
-+const struct flash_platform_data hp_t5325_flash = {
-+	.type		= "mx25l8005",
-+	.name		= "spi_flash",
-+	.parts		= hp_t5325_partitions,
-+	.nr_parts	= ARRAY_SIZE(hp_t5325_partitions),
-+};
-+
-+struct spi_board_info __initdata hp_t5325_spi_slave_info[] = {
-+	{
-+		.modalias	= "m25p80",
-+		.platform_data	= &hp_t5325_flash,
-+		.irq		= -1,
-+	},
-+};
-+
-+static struct mv643xx_eth_platform_data hp_t5325_ge00_data = {
-+	.phy_addr	= MV643XX_ETH_PHY_ADDR(8),
-+};
-+
-+static struct mv_sata_platform_data hp_t5325_sata_data = {
-+	.n_ports	= 2,
-+};
-+
-+static struct gpio_keys_button hp_t5325_buttons[] = {
-+	{
-+		.code		= KEY_POWER,
-+		.gpio		= 45,
-+		.desc		= "Power",
-+		.active_low	= 1,
-+	},
-+};
-+
-+static struct gpio_keys_platform_data hp_t5325_button_data = {
-+	.buttons	= hp_t5325_buttons,
-+	.nbuttons	= ARRAY_SIZE(hp_t5325_buttons),
-+};
-+
-+static struct platform_device hp_t5325_button_device = {
-+	.name		= "gpio-keys",
-+	.id		= -1,
-+	.num_resources	= 0,
-+	.dev		= {
-+		.platform_data	= &hp_t5325_button_data,
-+	}
-+};
-+
-+static unsigned int hp_t5325_mpp_config[] __initdata = {
-+	MPP0_NF_IO2,
-+	MPP1_SPI_MOSI,
-+	MPP2_SPI_SCK,
-+	MPP3_SPI_MISO,
-+	MPP4_NF_IO6,
-+	MPP5_NF_IO7,
-+	MPP6_SYSRST_OUTn,
-+	MPP7_SPI_SCn,
-+	MPP8_TW_SDA,
-+	MPP9_TW_SCK,
-+	MPP10_UART0_TXD,
-+	MPP11_UART0_RXD,
-+	MPP12_SD_CLK,
-+	MPP13_GPIO,
-+	MPP14_GPIO,
-+	MPP15_GPIO,
-+	MPP16_GPIO,
-+	MPP17_GPIO,
-+	MPP18_NF_IO0,
-+	MPP19_NF_IO1,
-+	MPP20_GPIO,
-+	MPP21_GPIO,
-+	MPP22_GPIO,
-+	MPP23_GPIO,
-+	MPP32_GPIO,
-+	MPP33_GE1_13,
-+	MPP39_AUDIO_I2SBCLK,
-+	MPP40_AUDIO_I2SDO,
-+	MPP41_AUDIO_I2SLRC,
-+	MPP42_AUDIO_I2SMCLK,
-+	MPP45_GPIO,		/* Power button */
-+	MPP48_GPIO,		/* Board power off */
-+	0
-+};
-+
-+#define HP_T5325_GPIO_POWER_OFF		48
-+
-+static void hp_t5325_power_off(void)
-+{
-+	gpio_set_value(HP_T5325_GPIO_POWER_OFF, 1);
-+}
-+
-+static void __init hp_t5325_init(void)
-+{
-+	/*
-+	 * Basic setup. Needs to be called early.
-+	 */
-+	kirkwood_init();
-+	kirkwood_mpp_conf(hp_t5325_mpp_config);
-+
-+	kirkwood_uart0_init();
-+	spi_register_board_info(hp_t5325_spi_slave_info,
-+				ARRAY_SIZE(hp_t5325_spi_slave_info));
-+	kirkwood_spi_init();
-+	kirkwood_i2c_init();
-+	kirkwood_ge00_init(&hp_t5325_ge00_data);
-+	kirkwood_sata_init(&hp_t5325_sata_data);
-+	kirkwood_ehci_init();
-+	platform_device_register(&hp_t5325_button_device);
-+
-+	if (gpio_request(HP_T5325_GPIO_POWER_OFF, "power-off") == 0 &&
-+	    gpio_direction_output(HP_T5325_GPIO_POWER_OFF, 0) == 0)
-+		pm_power_off = hp_t5325_power_off;
-+	else
-+		pr_err("t5325: failed to configure power-off GPIO\n");
-+}
-+
-+static int __init hp_t5325_pci_init(void)
-+{
-+	if (machine_is_t5325())
-+		kirkwood_pcie_init();
-+
-+	return 0;
-+}
-+subsys_initcall(hp_t5325_pci_init);
-+
-+MACHINE_START(T5325, "HP t5325 Thin Client")
-+	/* Maintainer: Martin Michlmayr <tbm@cyrius.com> */
-+	.phys_io	= KIRKWOOD_REGS_PHYS_BASE,
-+	.io_pg_offst	= ((KIRKWOOD_REGS_VIRT_BASE) >> 18) & 0xfffc,
-+	.boot_params	= 0x00000100,
-+	.init_machine	= hp_t5325_init,
-+	.map_io		= kirkwood_map_io,
-+	.init_irq	= kirkwood_init_irq,
-+	.timer		= &kirkwood_timer,
-+MACHINE_END
diff --git a/debian/patches/features/arm/openrd-ultimate.patch b/debian/patches/features/arm/openrd-ultimate.patch
deleted file mode 100644
index b52e091a7..000000000
--- a/debian/patches/features/arm/openrd-ultimate.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-Hi!
-This patch adds support for the OpenRD Ultimate machine(could be found at http://www.arm.linux.org.uk/developer/machines/list.php?id=2884)
-
-Besides adding machine description this patch adds correction for PHY address for Ultimate version.
-
-Differences from the previous attempt:
- - Correctly filled instances of mv643xx_eth_platform_data in case of ultimate version.
- - Do PCIE initialization for Ultimate version along with Base and Client
- - Init ge01 if (!openrd-base) to make the code cleaner
-
-Regards,
-
--- Dmytro Milinevskyy
-
-Signed-off-by: Dmytro Milinevskyy <milinevskyy@gmail.com>
-
-[bwh: adapted Kconfig]
-
----
-
- arch/arm/mach-kirkwood/Kconfig        |    7 +++++++
- arch/arm/mach-kirkwood/openrd-setup.c |   27 ++++++++++++++++++++++++---
- 2 files changed, 31 insertions(+), 3 deletions(-)
-
-diff --git a/arch/arm/mach-kirkwood/Kconfig b/arch/arm/mach-kirkwood/Kconfig
-index 29b2163..110a3b8 100644
---- a/arch/arm/mach-kirkwood/Kconfig
-+++ b/arch/arm/mach-kirkwood/Kconfig
-@@ -74,6 +74,13 @@
- 	  Say 'Y' here if you want your kernel to support the
- 	  Marvell OpenRD Client Board.
- 
-+config MACH_OPENRD_ULTIMATE
-+	bool "Marvell OpenRD Ultimate Board"
-+	select MACH_OPENRD
-+	help
-+	  Say 'Y' here if you want your kernel to support the
-+	  Marvell OpenRD Ultimate Board.
-+
- config MACH_NETSPACE_V2
- 	bool "LaCie Network Space v2 NAS Board"
- 	help
-diff --git a/arch/arm/mach-kirkwood/openrd-setup.c b/arch/arm/mach-kirkwood/openrd-setup.c
-index ad3f1ec..284b00f 100644
---- a/arch/arm/mach-kirkwood/openrd-setup.c
-+++ b/arch/arm/mach-kirkwood/openrd-setup.c
-@@ -1,7 +1,7 @@
- /*
-  * arch/arm/mach-kirkwood/openrd-setup.c
-  *
-- * Marvell OpenRD (Base|Client) Board Setup
-+ * Marvell OpenRD (Base|Client|Ultimate) Board Setup
-  *
-  * This file is licensed under the terms of the GNU General Public
-  * License version 2.  This program is licensed "as is" without any
-@@ -73,9 +73,15 @@ static void __init openrd_init(void)
- 
- 	kirkwood_ehci_init();
- 
-+	if (machine_is_openrd_ultimate()) {
-+		openrd_ge00_data.phy_addr = MV643XX_ETH_PHY_ADDR(0);
-+		openrd_ge01_data.phy_addr = MV643XX_ETH_PHY_ADDR(1);
-+	}
-+
- 	kirkwood_ge00_init(&openrd_ge00_data);
--	if (machine_is_openrd_client())
-+	if (!machine_is_openrd_base())
- 		kirkwood_ge01_init(&openrd_ge01_data);
-+
- 	kirkwood_sata_init(&openrd_sata_data);
- 	kirkwood_sdio_init(&openrd_mvsdio_data);
- 
-@@ -84,7 +90,9 @@ static void __init openrd_init(void)
- 
- static int __init openrd_pci_init(void)
- {
--	if (machine_is_openrd_base() || machine_is_openrd_client())
-+	if (machine_is_openrd_base() ||
-+		machine_is_openrd_client() ||
-+		machine_is_openrd_ultimate())
- 		kirkwood_pcie_init();
- 
- 	return 0;
-@@ -116,3 +124,16 @@ MACHINE_START(OPENRD_CLIENT, "Marvell OpenRD Client Board")
- 	.timer		= &kirkwood_timer,
- MACHINE_END
- #endif
-+
-+#ifdef CONFIG_MACH_OPENRD_ULTIMATE
-+MACHINE_START(OPENRD_ULTIMATE, "Marvell OpenRD Ultimate Board")
-+	/* Maintainer: Dhaval Vasa <dhaval.vasa@einfochips.com> */
-+	.phys_io	= KIRKWOOD_REGS_PHYS_BASE,
-+	.io_pg_offst	= ((KIRKWOOD_REGS_VIRT_BASE) >> 18) & 0xfffc,
-+	.boot_params	= 0x00000100,
-+	.init_machine	= openrd_init,
-+	.map_io		= kirkwood_map_io,
-+	.init_irq	= kirkwood_init_irq,
-+	.timer		= &kirkwood_timer,
-+MACHINE_END
-+#endif
--- 
-1.7.1
diff --git a/debian/patches/features/arm/ts219-mpp44.patch b/debian/patches/features/arm/ts219-mpp44.patch
deleted file mode 100644
index 88793f8fe..000000000
--- a/debian/patches/features/arm/ts219-mpp44.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-Subject: [PATCH] Kirkwood: Add MPP44 (board ID) for QNAP TS-11x/TS-21x
-
-MPP44 can be used to differentiate between one-bay (TS-11x) and
-two-bay (TS-21x) devices.
-
-According to an engineer from QNAP, the setting of MPP44 depends
-on the firmware rather than hardware.  Presumably, this means
-that you could fake the MPP44 value by changing the boot loader.
-
-Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
-
---- a/arch/arm/mach-kirkwood/ts219-setup.c	2010-06-13 18:31:20.000000000 +0000
-+++ b/arch/arm/mach-kirkwood/ts219-setup.c	2010-06-13 18:31:54.000000000 +0000
-@@ -153,6 +153,7 @@
- 	MPP15_GPIO,		/* USB Copy button */
- 	MPP16_GPIO,		/* Reset button */
- 	MPP36_GPIO,		/* RAM: 0: 256 MB, 1: 512 MB */
-+	MPP44_GPIO,		/* Board ID: 0: TS-11x, 1: TS-21x */
- 	0
- };
- 
diff --git a/debian/patches/series/1~experimental.2 b/debian/patches/series/1~experimental.2
deleted file mode 100644
index 16938ab88..000000000
--- a/debian/patches/series/1~experimental.2
+++ /dev/null
@@ -1,4 +0,0 @@
-+ bugfix/all/stable/2.6.35.1.patch
-+ bugfix/all/stable/2.6.35.2.patch
-+ bugfix/all/mm-fix-page-table-unmap-for-stack-guard-page-properl.patch
-+ bugfix/all/mm-fix-up-some-user-visible-effects-of-the-stack-gua.patch
diff --git a/debian/patches/series/1~experimental.3 b/debian/patches/series/1~experimental.3
deleted file mode 100644
index a05ec0b29..000000000
--- a/debian/patches/series/1~experimental.3
+++ /dev/null
@@ -1,6 +0,0 @@
-+ bugfix/all/netfilter-fix-CONFIG_COMPAT-support.patch
-- bugfix/all/mm-fix-page-table-unmap-for-stack-guard-page-properl.patch
-- bugfix/all/mm-fix-up-some-user-visible-effects-of-the-stack-gua.patch
-+ bugfix/all/stable/2.6.35.3.patch
-+ bugfix/all/stable/2.6.35.4.patch
-+ bugfix/mips/octeon-gcc-4.4.patch
diff --git a/debian/patches/series/base b/debian/patches/series/base
index 0c7daa6d2..cc68e5bd8 100644
--- a/debian/patches/series/base
+++ b/debian/patches/series/base
@@ -7,7 +7,6 @@
 
 + features/all/drivers-media-dvb-usb-af9005-request_firmware.patch
 
-+ features/all/lgs8gxx-lgs8g75-request_firmware.patch
 + features/all/r8169-rtl8168d-1-2-request_firmware-2.patch
 + features/all/sound-pci-cs46xx-request_firmware.patch
 
@@ -32,7 +31,7 @@
 + bugfix/ia64/hardcode-arch-script-output.patch
 + bugfix/mips/disable-advansys.patch
 + bugfix/arm/disable-scsi_acard.patch
-+ bugfix/mips/disable-werror.patch
++ debian/mips-disable-werror.patch
 + bugfix/powerpc/lpar-console.patch
 #+ bugfix/all/wireless-regulatory-default-EU.patch
 
@@ -45,16 +44,3 @@
 + bugfix/mips/mips-ide-flush-dcache.patch
 #+ bugfix/all/thinkpad-acpi-fix-backlight.patch
 + features/all/revert-ipv4-Make-INET_LRO-a-bool-instead-of-tristate.patch
-+ bugfix/all/ipr-add-writeq-definition-if-needed.patch
-+ bugfix/all/mantis-Select-correct-frontends.patch
-+ features/arm/openrd-ultimate.patch
-+ features/arm/ts219-mpp44.patch
-+ features/arm/hp-t5325.patch
-+ features/all/m25p80-add-support-mx25l8005.patch
-+ bugfix/all/3c59x-Specify-window-for-access-to-windowed-regs.patch
-+ bugfix/all/3c59x-Use-fine-grained-locks-for-MII-and-windowed-regs.patch
-+ bugfix/all/ipv6-Clamp-reported-valid_lft-to-a-minimum-of-0.patch
-+ bugfix/all/ipv6-Use-interface-max_desync_factor.patch
-+ bugfix/all/rtl8192su-Clean-up-in-case-of-an-error-in-mo.patch
-+ bugfix/all/rtl8192su-Fix-procfs-code-for-interfaces-not.patch
-+ bugfix/all/viafb-Depends-on-X86.patch
diff --git a/debian/patches/series/orig-0 b/debian/patches/series/orig-0
index 31419748a..4dd78ac51 100644
--- a/debian/patches/series/orig-0
+++ b/debian/patches/series/orig-0
@@ -6,7 +6,6 @@
 + debian/dfsg/drivers-staging-wlags49_h2-disable.patch
 + debian/dfsg/drivers-staging-wlags49_h25-disable.patch
 + debian/dfsg/firmware-cleanup.patch
-+ debian/dfsg/lgs8gxx-lgs8g75-disable.patch
 + debian/dfsg/r8169-rtl8168d-1-2-disable.patch
 + debian/dfsg/sound-pci.patch
 X debian/dfsg/files-1