--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -401,4 +401,5 @@ STAC9872
 Cirrus Logic CS4206/4207
 ========================
   mbp55         MacBook Pro 5,5
+  imac27        IMac 27 Inch
   auto          BIOS setup (default)
--- a/Documentation/usb/proc_usb_info.txt
+++ b/Documentation/usb/proc_usb_info.txt
@@ -1,12 +1,17 @@
 /proc/bus/usb filesystem output
 ===============================
-(version 2003.05.30)
+(version 2010.09.13)
 
 
 The usbfs filesystem for USB devices is traditionally mounted at
 /proc/bus/usb.  It provides the /proc/bus/usb/devices file, as well as
 the /proc/bus/usb/BBB/DDD files.
 
+In many modern systems the usbfs filsystem isn't used at all.  Instead
+USB device nodes are created under /dev/usb/ or someplace similar.  The
+"devices" file is available in debugfs, typically as
+/sys/kernel/debug/usb/devices.
+
 
 **NOTE**: If /proc/bus/usb appears empty, and a host controller
           driver has been linked, then you need to mount the
@@ -106,8 +111,8 @@ Legend:
 
 Topology info:
 
-T:  Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd
-|   |      |      |       |       |      |        |       |__MaxChildren
+T:  Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd
+|   |      |      |       |       |      |        |        |__MaxChildren
 |   |      |      |       |       |      |        |__Device Speed in Mbps
 |   |      |      |       |       |      |__DeviceNumber
 |   |      |      |       |       |__Count of devices at this level
@@ -120,8 +125,13 @@ T:  Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd
     Speed may be:
         1.5     Mbit/s for low speed USB
         12      Mbit/s for full speed USB
-        480     Mbit/s for high speed USB (added for USB 2.0)
-
+        480     Mbit/s for high speed USB (added for USB 2.0);
+                  also used for Wireless USB, which has no fixed speed
+        5000    Mbit/s for SuperSpeed USB (added for USB 3.0)
+
+    For reasons lost in the mists of time, the Port number is always
+    too low by 1.  For example, a device plugged into port 4 will
+    show up with "Port=03".
 
 Bandwidth info:
 B:  Alloc=ddd/ddd us (xx%), #Int=ddd, #Iso=ddd
@@ -291,7 +301,7 @@ Here's an example, from a system which h
 an external hub connected to the root hub, and a mouse and
 a serial converter connected to the external hub.
 
-T:  Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2
+T:  Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 2
 B:  Alloc= 28/900 us ( 3%), #Int=  2, #Iso=  0
 D:  Ver= 1.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
 P:  Vendor=0000 ProdID=0000 Rev= 0.00
@@ -301,21 +311,21 @@ C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr=  0mA
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
 E:  Ad=81(I) Atr=03(Int.) MxPS=   8 Ivl=255ms
 
-T:  Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12  MxCh= 4
+T:  Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 4
 D:  Ver= 1.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
 P:  Vendor=0451 ProdID=1446 Rev= 1.00
 C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=100mA
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
 E:  Ad=81(I) Atr=03(Int.) MxPS=   1 Ivl=255ms
 
-T:  Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=1.5 MxCh= 0
+T:  Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=1.5  MxCh= 0
 D:  Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
 P:  Vendor=04b4 ProdID=0001 Rev= 0.00
 C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=01 Prot=02 Driver=mouse
 E:  Ad=81(I) Atr=03(Int.) MxPS=   3 Ivl= 10ms
 
-T:  Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=  4 Spd=12  MxCh= 0
+T:  Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
 D:  Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
 P:  Vendor=0565 ProdID=0001 Rev= 1.08
 S:  Manufacturer=Peracom Networks, Inc.
@@ -330,12 +340,12 @@ E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=
 Selecting only the "T:" and "I:" lines from this (for example, by using
 "procusb ti"), we have:
 
-T:  Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2
-T:  Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12  MxCh= 4
+T:  Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 2
+T:  Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 4
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
-T:  Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=1.5 MxCh= 0
+T:  Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=1.5  MxCh= 0
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=01 Prot=02 Driver=mouse
-T:  Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=  4 Spd=12  MxCh= 0
+T:  Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
 I:  If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=serial
 
 
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 32
-EXTRAVERSION = .39-ck2
+EXTRAVERSION = .41-ck2
 NAME = Man-Eating Seals of Antiquity
 
 # *DOCUMENTATION*
@@ -183,7 +183,7 @@ SUBARCH := arm
 # Note: Some architectures assign CROSS_COMPILE in their arch/*/Makefile
 export KBUILD_BUILDHOST := $(SUBARCH)
 ARCH            ?= $(SUBARCH)
-CROSS_COMPILE   ?= arm-eabi-
+CROSS_COMPILE   ?= arm-linux-gnueabi-
 
 # Architecture as present in compile.h
 UTS_MACHINE     := $(ARCH)
@@ -325,13 +325,13 @@ CHECK              = sparse
 
 CHECKFLAGS     := -D__linux__ -Dlinux -D__STDC__ -Dunix -D__unix__ \
                   -Wbitwise -Wno-return-void $(CF)
-MODFLAGS        = -DMODULE
-CFLAGS_MODULE   = $(MODFLAGS)
-AFLAGS_MODULE   = $(MODFLAGS)
-LDFLAGS_MODULE  = -T $(srctree)/scripts/module-common.lds
-CFLAGS_KERNEL   =
-AFLAGS_KERNEL   =
-CFLAGS_GCOV     = -fprofile-arcs -ftest-coverage
+MODFLAGS        = -DMODULE -fgcse-lm -fgcse-sm -fsched-spec-load -fforce-addr -ffast-math -fsingle-precision-constant -mtune=cortex-a8 -march=armv7-a -mfpu=neon -ftree-vectorize -funswitch-loops
+CFLAGS_MODULE   = $(MODFLAGS)
+AFLAGS_MODULE   = $(MODFLAGS)
+LDFLAGS_MODULE  = -T $(srctree)/scripts/module-common.lds
+CFLAGS_KERNEL   = -fgcse-lm -fgcse-sm -fsched-spec-load -fforce-addr -ffast-math -fsingle-precision-constant -mtune=cortex-a8 -march=armv7-a -mfpu=neon -ftree-vectorize -funswitch-loops
+AFLAGS_KERNEL   = -fgcse -fsingle-precision-constant -mtune=cortex-a8 -march=armv7-a -mfpu=neon -ftree-vectorize
+CFLAGS_GCOV     = -fprofile-arcs -ftest-coverage
 
 
 # Use LINUXINCLUDE when you must reference the include/ directory.
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -118,10 +118,9 @@ config GENERIC_LOCKBREAK
 
 config RWSEM_GENERIC_SPINLOCK
         bool
-        default y
 
 config RWSEM_XCHGADD_ALGORITHM
-        bool
+        def_bool y
 
 config ARCH_HAS_ILOG2_U32
         bool
--- /dev/null
+++ b/arch/arm/include/asm/rwsem.h
@@ -0,0 +1,185 @@
+/* rwsem.h: R/W semaphores implemented using ARM atomic functions.
+ *
+ * Copyright (c) 2010, Code Aurora Forum. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#ifndef _ASM_ARM_RWSEM_H
+#define _ASM_ARM_RWSEM_H
+
+#ifndef _LINUX_RWSEM_H
+#error "please don't include asm/rwsem.h directly, use linux/rwsem.h instead"
+#endif
+
+#ifdef __KERNEL__
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <asm/atomic.h>
+#include <asm/system.h>
+
+/*
+ * the semaphore definition
+ */
+struct rw_semaphore {
+        long            count;
+#define RWSEM_UNLOCKED_VALUE            0x00000000
+#define RWSEM_ACTIVE_BIAS               0x00000001
+#define RWSEM_ACTIVE_MASK               0x0000ffff
+#define RWSEM_WAITING_BIAS              (-0x00010000)
+#define RWSEM_ACTIVE_READ_BIAS          RWSEM_ACTIVE_BIAS
+#define RWSEM_ACTIVE_WRITE_BIAS         (RWSEM_WAITING_BIAS + RWSEM_ACTIVE_BIAS)
+        spinlock_t              wait_lock;
+        struct list_head        wait_list;
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        struct lockdep_map      dep_map;
+#endif
+};
+
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
+#else
+# define __RWSEM_DEP_MAP_INIT(lockname)
+#endif
+
+#define __RWSEM_INITIALIZER(name) \
+        { RWSEM_UNLOCKED_VALUE, __SPIN_LOCK_UNLOCKED((name).wait_lock), \
+          LIST_HEAD_INIT((name).wait_list) \
+          __RWSEM_DEP_MAP_INIT(name) }
+
+#define DECLARE_RWSEM(name)             \
+        struct rw_semaphore name = __RWSEM_INITIALIZER(name)
+
+extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *sem);
+extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *sem);
+extern struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem);
+extern struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem);
+
+extern void __init_rwsem(struct rw_semaphore *sem, const char *name,
+                         struct lock_class_key *key);
+
+#define init_rwsem(sem)                         \
+do {                                            \
+        static struct lock_class_key __key;     \
+                                                \
+        __init_rwsem((sem), #sem, &__key);      \
+} while (0)
+
+/*
+ * lock for reading
+ */
+static inline void __down_read(struct rw_semaphore *sem)
+{
+        if (atomic_inc_return((atomic_t *)(&sem->count)) < 0)
+                rwsem_down_read_failed(sem);
+}
+
+static inline int __down_read_trylock(struct rw_semaphore *sem)
+{
+        int tmp;
+
+        while ((tmp = sem->count) >= 0) {
+                if (tmp == cmpxchg(&sem->count, tmp,
+                                   tmp + RWSEM_ACTIVE_READ_BIAS)) {
+                        return 1;
+                }
+        }
+        return 0;
+}
+
+/*
+ * lock for writing
+ */
+static inline void __down_write(struct rw_semaphore *sem)
+{
+        int tmp;
+
+        tmp = atomic_add_return(RWSEM_ACTIVE_WRITE_BIAS,
+                                (atomic_t *)(&sem->count));
+        if (tmp != RWSEM_ACTIVE_WRITE_BIAS)
+                rwsem_down_write_failed(sem);
+}
+
+static inline int __down_write_trylock(struct rw_semaphore *sem)
+{
+        int tmp;
+
+        tmp = cmpxchg(&sem->count, RWSEM_UNLOCKED_VALUE,
+                      RWSEM_ACTIVE_WRITE_BIAS);
+        return tmp == RWSEM_UNLOCKED_VALUE;
+}
+
+/*
+ * unlock after reading
+ */
+static inline void __up_read(struct rw_semaphore *sem)
+{
+        int tmp;
+
+        tmp = atomic_dec_return((atomic_t *)(&sem->count));
+        if (tmp < -1 && (tmp & RWSEM_ACTIVE_MASK) == 0)
+                rwsem_wake(sem);
+}
+
+/*
+ * unlock after writing
+ */
+static inline void __up_write(struct rw_semaphore *sem)
+{
+        if (atomic_sub_return(RWSEM_ACTIVE_WRITE_BIAS,
+                              (atomic_t *)(&sem->count)) < 0)
+                rwsem_wake(sem);
+}
+
+/*
+ * implement atomic add functionality
+ */
+static inline void rwsem_atomic_add(int delta, struct rw_semaphore *sem)
+{
+        atomic_add(delta, (atomic_t *)(&sem->count));
+}
+
+/*
+ * downgrade write lock to read lock
+ */
+static inline void __downgrade_write(struct rw_semaphore *sem)
+{
+        int tmp;
+
+        tmp = atomic_add_return(-RWSEM_WAITING_BIAS, (atomic_t *)(&sem->count));
+        if (tmp < 0)
+                rwsem_downgrade_wake(sem);
+}
+
+static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
+{
+        __down_write(sem);
+}
+
+/*
+ * implement exchange and add functionality
+ */
+static inline int rwsem_atomic_update(int delta, struct rw_semaphore *sem)
+{
+        return atomic_add_return(delta, (atomic_t *)(&sem->count));
+}
+
+static inline int rwsem_is_locked(struct rw_semaphore *sem)
+{
+        return (sem->count != 0);
+}
+
+#endif /* __KERNEL__ */
+#endif /* _ASM_ARM_RWSEM_H */
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int
         long err;
         int i;
 
-        if (nsops < 1)
+        if (nsops < 1 || nsops > SEMOPM)
                 return -EINVAL;
         sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
         if (!sops)
--- a/arch/m68k/mm/motorola.c
+++ b/arch/m68k/mm/motorola.c
@@ -299,6 +299,8 @@ void __init paging_init(void)
                 zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
                 free_area_init_node(i, zones_size,
                                     m68k_memory[i].addr >> PAGE_SHIFT, NULL);
+                if (node_present_pages(i))
+                        node_set_state(i, N_NORMAL_MEMORY);
         }
 }
 
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -43,27 +43,39 @@ static inline int cpu_is_noncoherent_r10
 
 static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
 {
+        gfp_t dma_flag;
+
         /* ignore region specifiers */
         gfp &= ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM);
 
-#ifdef CONFIG_ZONE_DMA
+#ifdef CONFIG_ISA
         if (dev == NULL)
-                gfp |= __GFP_DMA;
-        else if (dev->coherent_dma_mask < DMA_BIT_MASK(24))
-                gfp |= __GFP_DMA;
+                dma_flag = __GFP_DMA;
         else
 #endif
-#ifdef CONFIG_ZONE_DMA32
+#if defined(CONFIG_ZONE_DMA32) && defined(CONFIG_ZONE_DMA)
              if (dev->coherent_dma_mask < DMA_BIT_MASK(32))
-                gfp |= __GFP_DMA32;
+                        dma_flag = __GFP_DMA;
+        else if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                        dma_flag = __GFP_DMA32;
+        else
+#endif
+#if defined(CONFIG_ZONE_DMA32) && !defined(CONFIG_ZONE_DMA)
+             if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                dma_flag = __GFP_DMA32;
+        else
+#endif
+#if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
+             if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                dma_flag = __GFP_DMA;
         else
 #endif
-                ;
+                dma_flag = 0;
 
         /* Don't invoke OOM killer */
         gfp |= __GFP_NORETRY;
 
-        return gfp;
+        return gfp | dma_flag;
 }
 
 void *dma_alloc_noncoherent(struct device *dev, size_t size,
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -265,8 +265,10 @@ static void __init setup_bootmem(void)
         }
         memset(pfnnid_map, 0xff, sizeof(pfnnid_map));
 
-        for (i = 0; i < npmem_ranges; i++)
+        for (i = 0; i < npmem_ranges; i++) {
+                node_set_state(i, N_NORMAL_MEMORY);
                 node_set_online(i);
+        }
 #endif
 
         /*
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -364,7 +364,7 @@ INSTALL := install
 extra-installed         := $(patsubst $(obj)/%, $(DESTDIR)$(WRAPPER_OBJDIR)/%, $(extra-y))
 hostprogs-installed     := $(patsubst %, $(DESTDIR)$(WRAPPER_BINDIR)/%, $(hostprogs-y))
 wrapper-installed       := $(DESTDIR)$(WRAPPER_BINDIR)/wrapper
-dts-installed           := $(patsubst $(obj)/dts/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(obj)/dts/*.dts))
+dts-installed           := $(patsubst $(dtstree)/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(dtstree)/*.dts))
 
 all-installed           := $(extra-installed) $(hostprogs-installed) $(wrapper-installed) $(dts-installed)
 
--- a/arch/x86/include/asm/apicdef.h
+++ b/arch/x86/include/asm/apicdef.h
@@ -72,6 +72,7 @@
 #define         APIC_DEST_LOGICAL       0x00800
 #define         APIC_DEST_PHYSICAL      0x00000
 #define         APIC_DM_FIXED           0x00000
+#define         APIC_DM_FIXED_MASK      0x00700
 #define         APIC_DM_LOWEST          0x00100
 #define         APIC_DM_SMI             0x00200
 #define         APIC_DM_REMRD           0x00300
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -357,6 +357,9 @@ struct kvm_vcpu_arch {
         struct page *time_page;
 
         bool singlestep; /* guest is single stepped by KVM */
+        u64 last_guest_tsc;
+        u64 last_kernel_ns;
+
         bool nmi_pending;
         bool nmi_injected;
 
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -12,4 +12,42 @@ void pvclock_read_wallclock(struct pvclo
                             struct timespec *ts);
 void pvclock_resume(void);
 
+/*
+ * Scale a 64-bit delta by scaling and multiplying by a 32-bit fraction,
+ * yielding a 64-bit result.
+ */
+static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
+{
+        u64 product;
+#ifdef __i386__
+        u32 tmp1, tmp2;
+#endif
+
+        if (shift < 0)
+                delta >>= -shift;
+        else
+                delta <<= shift;
+
+#ifdef __i386__
+        __asm__ (
+                "mul  %5       ; "
+                "mov  %4,%%eax ; "
+                "mov  %%edx,%4 ; "
+                "mul  %5       ; "
+                "xor  %5,%5    ; "
+                "add  %4,%%eax ; "
+                "adc  %5,%%edx ; "
+                : "=A" (product), "=r" (tmp1), "=r" (tmp2)
+                : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
+#elif defined(__x86_64__)
+        __asm__ (
+                "mul %%rdx ; shrd $32,%%rdx,%%rax"
+                : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
+#else
+#error implement me!
+#endif
+
+        return product;
+}
+
 #endif /* _ASM_X86_PVCLOCK_H */
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -568,7 +568,7 @@ static void __cpuinit init_amd(struct cp
 #endif
 
         /* As a rule processors have APIC timer running in deep C states */
-        if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
+        if (c->x86 > 0xf && !cpu_has_amd_erratum(amd_erratum_400))
                 set_cpu_cap(c, X86_FEATURE_ARAT);
 
         /*
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -468,6 +468,7 @@ recurse:
 out_free:
         if (b) {
                 kobject_put(&b->kobj);
+                list_del(&b->miscj);
                 kfree(b);
         }
         return err;
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -286,18 +286,20 @@ void intel_init_thermal(struct cpuinfo_x
          */
         rdmsr(MSR_IA32_MISC_ENABLE, l, h);
 
+        h = lvtthmr_init;
         /*
          * The initial value of thermal LVT entries on all APs always reads
          * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
          * sequence to them and LVT registers are reset to 0s except for
          * the mask bits which are set to 1s when APs receive INIT IPI.
-         * Always restore the value that BIOS has programmed on AP based on
-         * BSP's info we saved since BIOS is always setting the same value
-         * for all threads/cores
+         * If BIOS takes over the thermal interrupt and sets its interrupt
+         * delivery mode to SMI (not fixed), it restores the value that the
+         * BIOS has programmed on AP based on BSP's info we saved since BIOS
+         * is always setting the same value for all threads/cores.
          */
-        apic_write(APIC_LVTTHMR, lvtthmr_init);
+        if ((h & APIC_DM_FIXED_MASK) != APIC_DM_FIXED)
+                apic_write(APIC_LVTTHMR, lvtthmr_init);
 
-        h = lvtthmr_init;
 
         if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) {
                 printk(KERN_DEBUG
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -74,7 +74,8 @@ static inline u64 scale_delta(u64 delta,
 static u64 pvclock_get_nsec_offset(struct pvclock_shadow_time *shadow)
 {
         u64 delta = native_read_tsc() - shadow->tsc_timestamp;
-        return scale_delta(delta, shadow->tsc_to_nsec_mul, shadow->tsc_shift);
+        return pvclock_scale_delta(delta, shadow->tsc_to_nsec_mul,
+                                   shadow->tsc_shift);
 }
 
 /*
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -47,6 +47,7 @@
 #include <asm/desc.h>
 #include <asm/mtrr.h>
 #include <asm/mce.h>
+#include <asm/pvclock.h>
 
 #define MAX_IO_MSRS 256
 #define CR0_RESERVED_BITS                                               \
@@ -633,6 +634,8 @@ static void kvm_write_guest_time(struct
         struct kvm_vcpu_arch *vcpu = &v->arch;
         void *shared_kaddr;
         unsigned long this_tsc_khz;
+        s64 kernel_ns, max_kernel_ns;
+        u64 tsc_timestamp;
 
         if ((!vcpu->time_page))
                 return;
@@ -646,15 +649,52 @@ static void kvm_write_guest_time(struct
 
         /* Keep irq disabled to prevent changes to the clock */
         local_irq_save(flags);
-        kvm_get_msr(v, MSR_IA32_TSC, &vcpu->hv_clock.tsc_timestamp);
+        kvm_get_msr(v, MSR_IA32_TSC, &tsc_timestamp);
         ktime_get_ts(&ts);
         monotonic_to_bootbased(&ts);
+        kernel_ns = timespec_to_ns(&ts);
         local_irq_restore(flags);
 
+        /*
+         * Time as measured by the TSC may go backwards when resetting the base
+         * tsc_timestamp.  The reason for this is that the TSC resolution is
+         * higher than the resolution of the other clock scales.  Thus, many
+         * possible measurments of the TSC correspond to one measurement of any
+         * other clock, and so a spread of values is possible.  This is not a
+         * problem for the computation of the nanosecond clock; with TSC rates
+         * around 1GHZ, there can only be a few cycles which correspond to one
+         * nanosecond value, and any path through this code will inevitably
+         * take longer than that.  However, with the kernel_ns value itself,
+         * the precision may be much lower, down to HZ granularity.  If the
+         * first sampling of TSC against kernel_ns ends in the low part of the
+         * range, and the second in the high end of the range, we can get:
+         *
+         * (TSC - offset_low) * S + kns_old > (TSC - offset_high) * S + kns_new
+         *
+         * As the sampling errors potentially range in the thousands of cycles,
+         * it is possible such a time value has already been observed by the
+         * guest.  To protect against this, we must compute the system time as
+         * observed by the guest and ensure the new system time is greater.
+         */
+        max_kernel_ns = 0;
+        if (vcpu->hv_clock.tsc_timestamp && vcpu->last_guest_tsc) {
+                max_kernel_ns = vcpu->last_guest_tsc -
+                        vcpu->hv_clock.tsc_timestamp;
+                max_kernel_ns = pvclock_scale_delta(max_kernel_ns,
+                                vcpu->hv_clock.tsc_to_system_mul,
+                                vcpu->hv_clock.tsc_shift);
+                max_kernel_ns += vcpu->last_kernel_ns;
+        }
+
+        if (max_kernel_ns > kernel_ns)
+                kernel_ns = max_kernel_ns;
+
         /* With all the info we got, fill in the values */
 
-        vcpu->hv_clock.system_time = ts.tv_nsec +
-                                     (NSEC_PER_SEC * (u64)ts.tv_sec) + v->kvm->arch.kvmclock_offset;
+        vcpu->hv_clock.tsc_timestamp = tsc_timestamp;
+        vcpu->hv_clock.system_time = kernel_ns + v->kvm->arch.kvmclock_offset;
+        vcpu->last_kernel_ns = kernel_ns;
+        vcpu->last_guest_tsc = tsc_timestamp;
 
         /*
          * The interface expects us to write an even number signaling that the
@@ -3695,6 +3735,8 @@ static int vcpu_enter_guest(struct kvm_v
         kvm_x86_ops->prepare_guest_switch(vcpu);
         kvm_load_guest_fpu(vcpu);
 
+        kvm_get_msr(vcpu, MSR_IA32_TSC, &vcpu->arch.last_guest_tsc);
+
         local_irq_disable();
 
         clear_bit(KVM_REQ_KICK, &vcpu->requests);
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -440,8 +440,10 @@ int blk_register_queue(struct gendisk *d
                 return ret;
 
         ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
-        if (ret < 0)
+        if (ret < 0) {
+                blk_trace_remove_sysfs(dev);
                 return ret;
+        }
 
         kobject_uevent(&q->kobj, KOBJ_ADD);
 
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1099,13 +1099,13 @@ static int ata_scsi_dev_config(struct sc
         /* configure max sectors */
         blk_queue_max_sectors(sdev->request_queue, dev->max_sectors);
 
+        sdev->sector_size = ATA_SECT_SIZE;
+
         if (dev->class == ATA_DEV_ATAPI) {
                 struct request_queue *q = sdev->request_queue;
                 void *buf;
 
-                /* set the min alignment and padding */
-                blk_queue_update_dma_alignment(sdev->request_queue,
-                                               ATA_DMA_PAD_SZ - 1);
+                /* set DMA padding */
                 blk_queue_update_dma_pad(sdev->request_queue,
                                          ATA_DMA_PAD_SZ - 1);
 
@@ -1119,12 +1119,24 @@ static int ata_scsi_dev_config(struct sc
 
                 blk_queue_dma_drain(q, atapi_drain_needed, buf, ATAPI_MAX_DRAIN);
         } else {
-                /* ATA devices must be sector aligned */
-                blk_queue_update_dma_alignment(sdev->request_queue,
-                                               ATA_SECT_SIZE - 1);
                 sdev->manage_start_stop = 1;
         }
 
+        /*
+         * ata_pio_sectors() expects buffer for each sector to not cross
+         * page boundary.  Enforce it by requiring buffers to be sector
+         * aligned, which works iff sector_size is not larger than
+         * PAGE_SIZE.  ATAPI devices also need the alignment as
+         * IDENTIFY_PACKET is executed as ATA_PROT_PIO.
+         */
+        if (sdev->sector_size > PAGE_SIZE)
+                ata_dev_printk(dev, KERN_WARNING,
+                        "sector_size=%u > PAGE_SIZE, PIO may malfunction\n",
+                        sdev->sector_size);
+
+        blk_queue_update_dma_alignment(sdev->request_queue,
+                                       sdev->sector_size - 1);
+
         if (dev->flags & ATA_DFLAG_AN)
                 set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events);
 
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -40,6 +40,8 @@
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/device.h>
+#include <scsi/scsi.h>
+#include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_host.h>
 #include <linux/libata.h>
 
@@ -80,6 +82,7 @@ static int vt8251_scr_write(struct ata_l
 static void svia_tf_load(struct ata_port *ap, const struct ata_taskfile *tf);
 static void svia_noop_freeze(struct ata_port *ap);
 static int vt6420_prereset(struct ata_link *link, unsigned long deadline);
+static void vt6420_bmdma_start(struct ata_queued_cmd *qc);
 static int vt6421_pata_cable_detect(struct ata_port *ap);
 static void vt6421_set_pio_mode(struct ata_port *ap, struct ata_device *adev);
 static void vt6421_set_dma_mode(struct ata_port *ap, struct ata_device *adev);
@@ -121,6 +124,7 @@ static struct ata_port_operations vt6420
         .inherits               = &svia_base_ops,
         .freeze                 = svia_noop_freeze,
         .prereset               = vt6420_prereset,
+        .bmdma_start            = vt6420_bmdma_start,
 };
 
 static struct ata_port_operations vt6421_pata_ops = {
@@ -377,6 +381,17 @@ static int vt6420_prereset(struct ata_li
         return 0;
 }
 
+static void vt6420_bmdma_start(struct ata_queued_cmd *qc)
+{
+        struct ata_port *ap = qc->ap;
+        if ((qc->tf.command == ATA_CMD_PACKET) &&
+            (qc->scsicmd->sc_data_direction == DMA_TO_DEVICE)) {
+                /* Prevents corruption on some ATAPI burners */
+                ata_sff_pause(ap);
+        }
+        ata_bmdma_start(qc);
+}
+
 static int vt6421_pata_cable_detect(struct ata_port *ap)
 {
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -59,9 +59,18 @@ static struct usb_device_id btusb_table[
         /* Generic Bluetooth USB device */
         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
 
+        /* Apple MacBookPro 7,1 */
+        { USB_DEVICE(0x05ac, 0x8213) },
+
         /* Apple iMac11,1 */
         { USB_DEVICE(0x05ac, 0x8215) },
 
+        /* Apple MacBookPro6,2 */
+        { USB_DEVICE(0x05ac, 0x8218) },
+
+        /* Apple MacBookAir3,1, MacBookAir3,2 */
+        { USB_DEVICE(0x05ac, 0x821b) },
+
         /* Apple MacBookPro8,2 */
         { USB_DEVICE(0x05ac, 0x821a) },
 
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -123,6 +123,9 @@ static struct agp_memory *agp_create_use
         struct agp_memory *new;
         unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
 
+        if (INT_MAX/sizeof(struct page *) < num_agp_pages)
+                return NULL;
+
         new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
         if (new == NULL)
                 return NULL;
@@ -242,11 +245,14 @@ struct agp_memory *agp_allocate_memory(s
         int scratch_pages;
         struct agp_memory *new;
         size_t i;
+        int cur_memory;
 
         if (!bridge)
                 return NULL;
 
-        if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
+        cur_memory = atomic_read(&bridge->current_memory_agp);
+        if ((cur_memory + page_count > bridge->max_memory_agp) ||
+            (cur_memory + page_count < page_count))
                 return NULL;
 
         if (type >= AGP_USER_TYPES) {
@@ -1123,8 +1129,8 @@ int agp_generic_insert_memory(struct agp
                 return -EINVAL;
         }
 
-        /* AK: could wrap */
-        if ((pg_start + mem->page_count) > num_entries)
+        if (((pg_start + mem->page_count) > num_entries) ||
+            ((pg_start + mem->page_count) < pg_start))
                 return -EINVAL;
 
         j = pg_start;
@@ -1158,7 +1164,7 @@ int agp_generic_remove_memory(struct agp
 {
         size_t i;
         struct agp_bridge_data *bridge;
-        int mask_type;
+        int mask_type, num_entries;
 
         bridge = mem->bridge;
         if (!bridge)
@@ -1170,6 +1176,11 @@ int agp_generic_remove_memory(struct agp
         if (type != mem->type)
                 return -EINVAL;
 
+        num_entries = agp_num_entries();
+        if (((pg_start + mem->page_count) > num_entries) ||
+            ((pg_start + mem->page_count) < pg_start))
+                return -EINVAL;
+
         mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
         if (mask_type != 0) {
                 /* The generic routines know nothing of memory types */
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -119,7 +119,7 @@ static int i8k_smm(struct smm_regs *regs
         int eax = regs->eax;
 
 #if defined(CONFIG_X86_64)
-        asm("pushq %%rax\n\t"
+        asm volatile("pushq %%rax\n\t"
                 "movl 0(%%rax),%%edx\n\t"
                 "pushq %%rdx\n\t"
                 "movl 4(%%rax),%%ebx\n\t"
@@ -145,7 +145,7 @@ static int i8k_smm(struct smm_regs *regs
                 :    "a"(regs)
                 :    "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
 #else
-        asm("pushl %%eax\n\t"
+        asm volatile("pushl %%eax\n\t"
             "movl 0(%%eax),%%edx\n\t"
             "push %%edx\n\t"
             "movl 4(%%eax),%%ebx\n\t"
@@ -166,7 +166,8 @@ static int i8k_smm(struct smm_regs *regs
             "movl %%edx,0(%%eax)\n\t"
             "lahf\n\t"
             "shrl $8,%%eax\n\t"
-            "andl $1,%%eax\n":"=a"(rc)
+            "andl $1,%%eax\n"
+            :"=a"(rc)
             :    "a"(regs)
             :    "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
 #endif
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -126,7 +126,7 @@ static uint32_t atom_iio_execute(struct
                 case ATOM_IIO_MOVE_INDEX:
                         temp &=
                             ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
-                              CU8(base + 2));
+                              CU8(base + 3));
                         temp |=
                             ((index >> CU8(base + 2)) &
                              (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -136,7 +136,7 @@ static uint32_t atom_iio_execute(struct
                 case ATOM_IIO_MOVE_DATA:
                         temp &=
                             ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
-                              CU8(base + 2));
+                              CU8(base + 3));
                         temp |=
                             ((data >> CU8(base + 2)) &
                              (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -146,7 +146,7 @@ static uint32_t atom_iio_execute(struct
                 case ATOM_IIO_MOVE_ATTR:
                         temp &=
                             ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
-                              CU8(base + 2));
+                              CU8(base + 3));
                         temp |=
                             ((ctx->
                               io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 -
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -53,6 +53,27 @@ struct apple_key_translation {
         u8 flags;
 };
 
+static const struct apple_key_translation macbookair_fn_keys[] = {
+        { KEY_BACKSPACE, KEY_DELETE },
+        { KEY_ENTER,    KEY_INSERT },
+        { KEY_F1,       KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY },
+        { KEY_F2,       KEY_BRIGHTNESSUP,   APPLE_FLAG_FKEY },
+        { KEY_F3,       KEY_SCALE,          APPLE_FLAG_FKEY },
+        { KEY_F4,       KEY_DASHBOARD,      APPLE_FLAG_FKEY },
+        { KEY_F6,       KEY_PREVIOUSSONG,   APPLE_FLAG_FKEY },
+        { KEY_F7,       KEY_PLAYPAUSE,      APPLE_FLAG_FKEY },
+        { KEY_F8,       KEY_NEXTSONG,       APPLE_FLAG_FKEY },
+        { KEY_F9,       KEY_MUTE,           APPLE_FLAG_FKEY },
+        { KEY_F10,      KEY_VOLUMEDOWN,     APPLE_FLAG_FKEY },
+        { KEY_F11,      KEY_VOLUMEUP,       APPLE_FLAG_FKEY },
+        { KEY_F12,      KEY_EJECTCD,        APPLE_FLAG_FKEY },
+        { KEY_UP,       KEY_PAGEUP },
+        { KEY_DOWN,     KEY_PAGEDOWN },
+        { KEY_LEFT,     KEY_HOME },
+        { KEY_RIGHT,    KEY_END },
+        { }
+};
+
 static const struct apple_key_translation apple_fn_keys[] = {
         { KEY_BACKSPACE, KEY_DELETE },
         { KEY_ENTER,    KEY_INSERT },
@@ -151,10 +172,15 @@ static int hidinput_apple_event(struct h
         if (fnmode) {
                 int do_translate;
 
-                trans = apple_find_translation((hid->product < 0x21d ||
-                                        hid->product >= 0x300) ?
-                                        powerbook_fn_keys : apple_fn_keys,
-                                        usage->code);
+                if(hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
+                                hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) {
+                        trans = apple_find_translation(macbookair_fn_keys, usage->code);
+                } else if (hid->product < 0x21d || hid->product >= 0x300) {
+                        trans = apple_find_translation(powerbook_fn_keys, usage->code);
+                } else {
+                        trans = apple_find_translation(apple_fn_keys, usage->code);
+                }
+
                 if (trans) {
                         if (test_bit(usage->code, asc->pressed_fn))
                                 do_translate = 1;
@@ -431,6 +457,18 @@ static const struct hid_device_id apple_
                 .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
                 .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO),
+                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS),
+                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO),
+                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS),
+                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1287,6 +1287,12 @@ static const struct hid_device_id hid_bl
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
@@ -1705,6 +1711,12 @@ static const struct hid_device_id hid_mo
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
         { }
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -88,6 +88,12 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI    0x0236
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO     0x0237
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS     0x0238
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI    0x023f
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO     0x0240
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS     0x0241
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI   0x0242
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO    0x0243
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS    0x0244
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI  0x0239
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO   0x023a
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -142,6 +142,30 @@ static const char *temperature_sensors_s
           "TM1S", "TM2P", "TM2S", "TM3S", "TM8P", "TM8S", "TM9P", "TM9S",
           "TN0C", "TN0D", "TN0H", "TS0C", "Tp0C", "Tp1C", "Tv0S", "Tv1S",
           NULL },
+/* Set 17: iMac 9,1 */
+        { "TA0P", "TC0D", "TC0H", "TC0P", "TG0D", "TG0H", "TH0P", "TL0P",
+          "TN0D", "TN0H", "TN0P", "TO0P", "Tm0P", "Tp0P", NULL },
+/* Set 18: MacBook Pro 2,2 */
+        { "TB0T", "TC0D", "TC0P", "TG0H", "TG0P", "TG0T", "TM0P", "TTF0",
+          "Th0H", "Th1H", "Tm0P", "Ts0P", NULL },
+/* Set 19: Macbook Pro 5,3 */
+        { "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TG0D",
+          "TG0F", "TG0H", "TG0P", "TG0T", "TN0D", "TN0P", "TTF0", "Th2H",
+          "Tm0P", "Ts0P", "Ts0S", NULL },
+/* Set 20: MacBook Pro 5,4 */
+        { "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TN0D",
+          "TN0P", "TTF0", "Th2H", "Ts0P", "Ts0S", NULL },
+/* Set 21: MacBook Pro 6,2 */
+        { "TB0T", "TB1T", "TB2T", "TC0C", "TC0D", "TC0P", "TC1C", "TG0D",
+          "TG0P", "TG0T", "TMCD", "TP0P", "TPCD", "Th1H", "Th2H", "Tm0P",
+          "Ts0P", "Ts0S", NULL },
+/* Set 22: MacBook Pro 7,1 */
+        { "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S",
+          "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL },
+/* Set 23: MacBook Air 3,1 */
+        { "TB0T", "TB1T", "TB2T", "TC0D", "TC0E", "TC0P", "TC1E", "TCZ3",
+          "TCZ4", "TCZ5", "TG0E", "TG1E", "TG2E", "TGZ3", "TGZ4", "TGZ5",
+          "TH0F", "TH0O", "TM0P" },
 };
 
 /* List of keys used to read/write fan speeds */
@@ -1350,11 +1374,29 @@ static __initdata struct dmi_match_data
         { .accelerometer = 1, .light = 1, .temperature_set = 15 },
 /* MacPro3,1: temperature set 16 */
         { .accelerometer = 0, .light = 0, .temperature_set = 16 },
+/* iMac 9,1: light sensor only, temperature set 17 */
+        { .accelerometer = 0, .light = 0, .temperature_set = 17 },
+/* MacBook Pro 2,2: accelerometer, backlight and temperature set 18 */
+        { .accelerometer = 1, .light = 1, .temperature_set = 18 },
+/* MacBook Pro 5,3: accelerometer, backlight and temperature set 19 */
+        { .accelerometer = 1, .light = 1, .temperature_set = 19 },
+/* MacBook Pro 5,4: accelerometer, backlight and temperature set 20 */
+        { .accelerometer = 1, .light = 1, .temperature_set = 20 },
+/* MacBook Pro 6,2: accelerometer, backlight and temperature set 21 */
+        { .accelerometer = 1, .light = 1, .temperature_set = 21 },
+/* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */
+        { .accelerometer = 1, .light = 1, .temperature_set = 22 },
+/* MacBook Air 3,1: accelerometer, backlight and temperature set 23 */
+        { .accelerometer = 0, .light = 0, .temperature_set = 23 },
 };
 
 /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
  * So we need to put "Apple MacBook Pro" before "Apple MacBook". */
 static __initdata struct dmi_system_id applesmc_whitelist[] = {
+        { applesmc_dmi_match, "Apple MacBook Air 3", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3") },
+                &applesmc_dmi_data[23]},
         { applesmc_dmi_match, "Apple MacBook Air 2", {
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir2") },
@@ -1363,6 +1405,22 @@ static __initdata struct dmi_system_id a
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir") },
                 &applesmc_dmi_data[7]},
+        { applesmc_dmi_match, "Apple MacBook Pro 7", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro7") },
+                &applesmc_dmi_data[22]},
+        { applesmc_dmi_match, "Apple MacBook Pro 5,4", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,4") },
+                &applesmc_dmi_data[20]},
+        { applesmc_dmi_match, "Apple MacBook Pro 5,3", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,3") },
+                &applesmc_dmi_data[19]},
+        { applesmc_dmi_match, "Apple MacBook Pro 6", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro6") },
+                &applesmc_dmi_data[21]},
         { applesmc_dmi_match, "Apple MacBook Pro 5", {
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5") },
@@ -1375,6 +1433,10 @@ static __initdata struct dmi_system_id a
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro3") },
                 &applesmc_dmi_data[9]},
+        { applesmc_dmi_match, "Apple MacBook Pro 2,2", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple Computer, Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro2,2") },
+                &applesmc_dmi_data[18]},
         { applesmc_dmi_match, "Apple MacBook Pro", {
           DMI_MATCH(DMI_BOARD_VENDOR,"Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME,"MacBookPro") },
@@ -1415,6 +1477,10 @@ static __initdata struct dmi_system_id a
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "MacPro") },
                 &applesmc_dmi_data[4]},
+        { applesmc_dmi_match, "Apple iMac 9,1", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1") },
+                &applesmc_dmi_data[17]},
         { applesmc_dmi_match, "Apple iMac 8", {
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "iMac8") },
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -24,6 +24,10 @@
                         printk(KERN_DEBUG format, ##arg);       \
         } while (0)
 
+static bool force_elantech;
+module_param_named(force_elantech, force_elantech, bool, 0644);
+MODULE_PARM_DESC(force_elantech, "Force the Elantech PS/2 protocol extension to be used, 1 = enabled, 0 = disabled (default).");
+
 /*
  * Send a Synaptics style sliced query command
  */
@@ -178,36 +182,44 @@ static void elantech_report_absolute_v1(
         struct elantech_data *etd = psmouse->private;
         unsigned char *packet = psmouse->packet;
         int fingers;
-        static int old_fingers;
 
-        if (etd->fw_version_maj == 0x01) {
-                /* byte 0:  D   U  p1  p2   1  p3   R   L
-                   byte 1:  f   0  th  tw  x9  x8  y9  y8 */
+        if (etd->fw_version < 0x020000) {
+                /*
+                 * byte 0:  D   U  p1  p2   1  p3   R   L
+                 * byte 1:  f   0  th  tw  x9  x8  y9  y8
+                 */
                 fingers = ((packet[1] & 0x80) >> 7) +
                                 ((packet[1] & 0x30) >> 4);
         } else {
-                /* byte 0: n1  n0  p2  p1   1  p3   R   L
-                   byte 1:  0   0   0   0  x9  x8  y9  y8 */
+                /*
+                 * byte 0: n1  n0  p2  p1   1  p3   R   L
+                 * byte 1:  0   0   0   0  x9  x8  y9  y8
+                 */
                 fingers = (packet[0] & 0xc0) >> 6;
         }
 
         if (etd->jumpy_cursor) {
-                /* Discard packets that are likely to have bogus coordinates */
-                if (fingers > old_fingers) {
+                if (fingers != 1) {
+                        etd->single_finger_reports = 0;
+                } else if (etd->single_finger_reports < 2) {
+                        /* Discard first 2 reports of one finger, bogus */
+                        etd->single_finger_reports++;
                         elantech_debug("elantech.c: discarding packet\n");
-                        goto discard_packet_v1;
+                        return;
                 }
         }
 
         input_report_key(dev, BTN_TOUCH, fingers != 0);
 
-        /* byte 2: x7  x6  x5  x4  x3  x2  x1  x0
-           byte 3: y7  y6  y5  y4  y3  y2  y1  y0 */
+        /*
+         * byte 2: x7  x6  x5  x4  x3  x2  x1  x0
+         * byte 3: y7  y6  y5  y4  y3  y2  y1  y0
+         */
         if (fingers) {
                 input_report_abs(dev, ABS_X,
                         ((packet[1] & 0x0c) << 6) | packet[2]);
-                input_report_abs(dev, ABS_Y, ETP_YMAX_V1 -
-                        (((packet[1] & 0x03) << 8) | packet[3]));
+                input_report_abs(dev, ABS_Y,
+                        ETP_YMAX_V1 - (((packet[1] & 0x03) << 8) | packet[3]));
         }
 
         input_report_key(dev, BTN_TOOL_FINGER, fingers == 1);
@@ -216,7 +228,7 @@ static void elantech_report_absolute_v1(
         input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
         input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
 
-        if ((etd->fw_version_maj == 0x01) &&
+        if (etd->fw_version < 0x020000 &&
             (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                 /* rocker up */
                 input_report_key(dev, BTN_FORWARD, packet[0] & 0x40);
@@ -225,9 +237,6 @@ static void elantech_report_absolute_v1(
         }
 
         input_sync(dev);
-
- discard_packet_v1:
-        old_fingers = fingers;
 }
 
 /*
@@ -246,34 +255,47 @@ static void elantech_report_absolute_v2(
 
         switch (fingers) {
         case 1:
-                /* byte 1: x15 x14 x13 x12 x11 x10 x9  x8
-                   byte 2: x7  x6  x5  x4  x4  x2  x1  x0 */
-                input_report_abs(dev, ABS_X, (packet[1] << 8) | packet[2]);
-                /* byte 4: y15 y14 y13 y12 y11 y10 y8  y8
-                   byte 5: y7  y6  y5  y4  y3  y2  y1  y0 */
-                input_report_abs(dev, ABS_Y, ETP_YMAX_V2 -
-                        ((packet[4] << 8) | packet[5]));
+                /*
+                 * byte 1:  .   .   .   .   .  x10 x9  x8
+                 * byte 2: x7  x6  x5  x4  x4  x2  x1  x0
+                 */
+                input_report_abs(dev, ABS_X,
+                        ((packet[1] & 0x07) << 8) | packet[2]);
+                /*
+                 * byte 4:  .   .   .   .   .   .  y9  y8
+                 * byte 5: y7  y6  y5  y4  y3  y2  y1  y0
+                 */
+                input_report_abs(dev, ABS_Y,
+                        ETP_YMAX_V2 - (((packet[4] & 0x03) << 8) | packet[5]));
                 break;
 
         case 2:
-                /* The coordinate of each finger is reported separately with
-                   a lower resolution for two finger touches */
-                /* byte 0:  .   .  ay8 ax8  .   .   .   .
-                   byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0 */
+                /*
+                 * The coordinate of each finger is reported separately
+                 * with a lower resolution for two finger touches:
+                 * byte 0:  .   .  ay8 ax8  .   .   .   .
+                 * byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0
+                 */
                 x1 = ((packet[0] & 0x10) << 4) | packet[1];
                 /* byte 2: ay7 ay6 ay5 ay4 ay3 ay2 ay1 ay0 */
                 y1 = ETP_2FT_YMAX - (((packet[0] & 0x20) << 3) | packet[2]);
-                /* byte 3:  .   .  by8 bx8  .   .   .   .
-                   byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0 */
+                /*
+                 * byte 3:  .   .  by8 bx8  .   .   .   .
+                 * byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0
+                 */
                 x2 = ((packet[3] & 0x10) << 4) | packet[4];
                 /* byte 5: by7 by8 by5 by4 by3 by2 by1 by0 */
                 y2 = ETP_2FT_YMAX - (((packet[3] & 0x20) << 3) | packet[5]);
-                /* For compatibility with the X Synaptics driver scale up one
-                   coordinate and report as ordinary mouse movent */
+                /*
+                 * For compatibility with the X Synaptics driver scale up
+                 * one coordinate and report as ordinary mouse movent
+                 */
                 input_report_abs(dev, ABS_X, x1 << 2);
                 input_report_abs(dev, ABS_Y, y1 << 2);
-                /* For compatibility with the proprietary X Elantech driver
-                   report both coordinates as hat coordinates */
+                /*
+                 * For compatibility with the proprietary X Elantech driver
+                 * report both coordinates as hat coordinates
+                 */
                 input_report_abs(dev, ABS_HAT0X, x1);
                 input_report_abs(dev, ABS_HAT0Y, y1);
                 input_report_abs(dev, ABS_HAT1X, x2);
@@ -297,7 +319,7 @@ static int elantech_check_parity_v1(stru
         unsigned char p1, p2, p3;
 
         /* Parity bits are placed differently */
-        if (etd->fw_version_maj == 0x01) {
+        if (etd->fw_version < 0x020000) {
                 /* byte 0:  D   U  p1  p2   1  p3   R   L */
                 p1 = (packet[0] & 0x20) >> 5;
                 p2 = (packet[0] & 0x10) >> 4;
@@ -420,6 +442,7 @@ static void elantech_set_input_params(st
 
         __set_bit(EV_KEY, dev->evbit);
         __set_bit(EV_ABS, dev->evbit);
+        __clear_bit(EV_REL, dev->evbit);
 
         __set_bit(BTN_LEFT, dev->keybit);
         __set_bit(BTN_RIGHT, dev->keybit);
@@ -432,7 +455,7 @@ static void elantech_set_input_params(st
         switch (etd->hw_version) {
         case 1:
                 /* Rocker button */
-                if ((etd->fw_version_maj == 0x01) &&
+                if (etd->fw_version < 0x020000 &&
                     (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                         __set_bit(BTN_FORWARD, dev->keybit);
                         __set_bit(BTN_BACK, dev->keybit);
@@ -550,6 +573,24 @@ static struct attribute_group elantech_a
         .attrs = elantech_attrs,
 };
 
+static bool elantech_is_signature_valid(const unsigned char *param)
+{
+        static const unsigned char rates[] = { 200, 100, 80, 60, 40, 20, 10 };
+        int i;
+
+        if (param[0] == 0)
+                return false;
+
+        if (param[1] == 0)
+                return true;
+
+        for (i = 0; i < ARRAY_SIZE(rates); i++)
+                if (param[2] == rates[i])
+                        return false;
+
+        return true;
+}
+
 /*
  * Use magic knock to detect Elantech touchpad
  */
@@ -593,9 +634,13 @@ int elantech_detect(struct psmouse *psmo
         pr_debug("elantech.c: Elantech version query result 0x%02x, 0x%02x, 0x%02x.\n",
                  param[0], param[1], param[2]);
 
-        if (param[0] == 0 || param[1] != 0) {
-                pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
-                return -1;
+        if (!elantech_is_signature_valid(param)) {
+                if (!force_elantech) {
+                        pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
+                        return -1;
+                }
+
+                pr_debug("elantech.c: Probably not a real Elantech touchpad. Enabling anyway due to force_elantech.\n");
         }
 
         if (set_properties) {
@@ -657,14 +702,14 @@ int elantech_init(struct psmouse *psmous
                 pr_err("elantech.c: failed to query firmware version.\n");
                 goto init_fail;
         }
-        etd->fw_version_maj = param[0];
-        etd->fw_version_min = param[2];
+
+        etd->fw_version = (param[0] << 16) | (param[1] << 8) | param[2];
 
         /*
          * Assume every version greater than this is new EeePC style
          * hardware with 6 byte packets
          */
-        if (etd->fw_version_maj >= 0x02 && etd->fw_version_min >= 0x30) {
+        if (etd->fw_version >= 0x020030) {
                 etd->hw_version = 2;
                 /* For now show extra debug information */
                 etd->debug = 1;
@@ -674,8 +719,9 @@ int elantech_init(struct psmouse *psmous
                 etd->hw_version = 1;
                 etd->paritycheck = 1;
         }
-        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d\n",
-                etd->hw_version, etd->fw_version_maj, etd->fw_version_min);
+
+        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d.%d\n",
+                etd->hw_version, param[0], param[1], param[2]);
 
         if (synaptics_send_cmd(psmouse, ETP_CAPABILITIES_QUERY, param)) {
                 pr_err("elantech.c: failed to query capabilities.\n");
@@ -686,14 +732,14 @@ int elantech_init(struct psmouse *psmous
         etd->capabilities = param[0];
 
         /*
-         * This firmware seems to suffer from misreporting coordinates when
+         * This firmware suffers from misreporting coordinates when
          * a touch action starts causing the mouse cursor or scrolled page
          * to jump. Enable a workaround.
          */
-        if (etd->fw_version_maj == 0x02 && etd->fw_version_min == 0x22) {
-                pr_info("elantech.c: firmware version 2.34 detected, "
+        if (etd->fw_version == 0x020022 || etd->fw_version == 0x020600) {
+                pr_info("elantech.c: firmware version 2.0.34/2.6.0 detected, "
                         "enabling jumpy cursor workaround\n");
-                etd->jumpy_cursor = 1;
+                etd->jumpy_cursor = true;
         }
 
         if (elantech_set_absolute_mode(psmouse)) {
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -100,11 +100,11 @@ struct elantech_data {
         unsigned char reg_26;
         unsigned char debug;
         unsigned char capabilities;
-        unsigned char fw_version_maj;
-        unsigned char fw_version_min;
+        bool paritycheck;
+        bool jumpy_cursor;
         unsigned char hw_version;
-        unsigned char paritycheck;
-        unsigned char jumpy_cursor;
+        unsigned int fw_version;
+        unsigned int single_finger_reports;
         unsigned char parity[256];
 };
 
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -135,7 +135,8 @@ static int synaptics_capability(struct p
         if (synaptics_send_cmd(psmouse, SYN_QUE_CAPABILITIES, cap))
                 return -1;
         priv->capabilities = (cap[0] << 16) | (cap[1] << 8) | cap[2];
-        priv->ext_cap = 0;
+        priv->ext_cap = priv->ext_cap_0c = 0;
+
         if (!SYN_CAP_VALID(priv->capabilities))
                 return -1;
 
@@ -148,7 +149,7 @@ static int synaptics_capability(struct p
         if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 1) {
                 if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB, cap)) {
                         printk(KERN_ERR "Synaptics claims to have extended capabilities,"
-                               " but I'm not able to read them.");
+                               " but I'm not able to read them.\n");
                 } else {
                         priv->ext_cap = (cap[0] << 16) | (cap[1] << 8) | cap[2];
 
@@ -160,6 +161,16 @@ static int synaptics_capability(struct p
                                 priv->ext_cap &= 0xff0fff;
                 }
         }
+
+        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 4) {
+                if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB_0C, cap)) {
+                        printk(KERN_ERR "Synaptics claims to have extended capability 0x0c,"
+                               " but I'm not able to read it.\n");
+                } else {
+                        priv->ext_cap_0c = (cap[0] << 16) | (cap[1] << 8) | cap[2];
+                }
+        }
+
         return 0;
 }
 
@@ -346,7 +357,15 @@ static void synaptics_parse_hw_state(uns
                 hw->left  = (buf[0] & 0x01) ? 1 : 0;
                 hw->right = (buf[0] & 0x02) ? 1 : 0;
 
-                if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
+                if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+                        /*
+                         * Clickpad's button is transmitted as middle button,
+                         * however, since it is primary button, we will report
+                         * it as BTN_LEFT.
+                         */
+                        hw->left = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
+
+                } else if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
                         hw->middle = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
                         if (hw->w == 2)
                                 hw->scroll = (signed char)(buf[1]);
@@ -591,6 +610,12 @@ static void set_input_params(struct inpu
 
         dev->absres[ABS_X] = priv->x_res;
         dev->absres[ABS_Y] = priv->y_res;
+
+        if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+                /* Clickpads report only left button */
+                __clear_bit(BTN_RIGHT, dev->keybit);
+                __clear_bit(BTN_MIDDLE, dev->keybit);
+        }
 }
 
 static void synaptics_disconnect(struct psmouse *psmouse)
@@ -689,10 +714,10 @@ int synaptics_init(struct psmouse *psmou
 
         priv->pkt_type = SYN_MODEL_NEWABS(priv->model_id) ? SYN_NEWABS : SYN_OLDABS;
 
-        printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx\n",
+        printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx/%#lx\n",
                 SYN_ID_MODEL(priv->identity),
                 SYN_ID_MAJOR(priv->identity), SYN_ID_MINOR(priv->identity),
-                priv->model_id, priv->capabilities, priv->ext_cap);
+                priv->model_id, priv->capabilities, priv->ext_cap, priv->ext_cap_0c);
 
         set_input_params(psmouse->dev, priv);
 
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -18,6 +18,7 @@
 #define SYN_QUE_SERIAL_NUMBER_SUFFIX    0x07
 #define SYN_QUE_RESOLUTION              0x08
 #define SYN_QUE_EXT_CAPAB               0x09
+#define SYN_QUE_EXT_CAPAB_0C            0x0c
 
 /* synatics modes */
 #define SYN_BIT_ABSOLUTE_MODE           (1 << 7)
@@ -48,6 +49,8 @@
 #define SYN_CAP_VALID(c)                ((((c) & 0x00ff00) >> 8) == 0x47)
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
+#define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+#define SYN_CAP_CLICKPAD(ex0c)          ((ex0c) & 0x100100)
 
 /* synaptics modes query bits */
 #define SYN_MODE_ABSOLUTE(m)            ((m) & (1 << 7))
@@ -96,6 +99,7 @@ struct synaptics_data {
         unsigned long int model_id;             /* Model-ID */
         unsigned long int capabilities;         /* Capabilities */
         unsigned long int ext_cap;              /* Extended Capabilities */
+        unsigned long int ext_cap_0c;           /* Ext Caps from 0x0c query */
         unsigned long int identity;             /* Identification */
         int x_res;                              /* X resolution in units/mm */
         int y_res;                              /* Y resolution in units/mm */
--- a/drivers/input/xen-kbdfront.c
+++ b/drivers/input/xen-kbdfront.c
@@ -281,7 +281,7 @@ static void xenkbd_backend_changed(struc
                                    enum xenbus_state backend_state)
 {
         struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
-        int val;
+        int ret, val;
 
         switch (backend_state) {
         case XenbusStateInitialising:
@@ -292,6 +292,16 @@ static void xenkbd_backend_changed(struc
 
         case XenbusStateInitWait:
 InitWait:
+                ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+                                   "feature-abs-pointer", "%d", &val);
+                if (ret < 0)
+                        val = 0;
+                if (val) {
+                        ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
+                                            "request-abs-pointer", "1");
+                        if (ret)
+                                pr_warning("can't request abs-pointer\n");
+                }
                 xenbus_switch_state(dev, XenbusStateConnected);
                 break;
 
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
         DEBSTATUS);
 
 #define DRIVER_VERSION "0.1"
-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
+#define DRIVER_NAME "flexcop-pci"
 #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
 
 struct flexcop_pci {
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -874,6 +874,43 @@ static struct dvb_usb_rc_key dib0700_rc_
         { 0x1d37, KEY_RECORD },
         { 0x1d3b, KEY_GOTO },
         { 0x1d3d, KEY_POWER },
+
+        /* Key codes for the Elgato EyeTV Diversity silver remote,
+           set dvb_usb_dib0700_ir_proto=0 */
+        { 0x4501, KEY_POWER },
+        { 0x4502, KEY_MUTE },
+        { 0x4503, KEY_1 },
+        { 0x4504, KEY_2 },
+        { 0x4505, KEY_3 },
+        { 0x4506, KEY_4 },
+        { 0x4507, KEY_5 },
+        { 0x4508, KEY_6 },
+        { 0x4509, KEY_7 },
+        { 0x450a, KEY_8 },
+        { 0x450b, KEY_9 },
+        { 0x450c, KEY_LAST },
+        { 0x450d, KEY_0 },
+        { 0x450e, KEY_ENTER },
+        { 0x450f, KEY_RED },
+        { 0x4510, KEY_CHANNELUP },
+        { 0x4511, KEY_GREEN },
+        { 0x4512, KEY_VOLUMEDOWN },
+        { 0x4513, KEY_OK },
+        { 0x4514, KEY_VOLUMEUP },
+        { 0x4515, KEY_YELLOW },
+        { 0x4516, KEY_CHANNELDOWN },
+        { 0x4517, KEY_BLUE },
+        { 0x4518, KEY_LEFT }, /* Skip backwards */
+        { 0x4519, KEY_PLAYPAUSE },
+        { 0x451a, KEY_RIGHT }, /* Skip forward */
+        { 0x451b, KEY_REWIND },
+        { 0x451c, KEY_L }, /* Live */
+        { 0x451d, KEY_FASTFORWARD },
+        { 0x451e, KEY_STOP }, /* 'Reveal' for Teletext */
+        { 0x451f, KEY_MENU }, /* KEY_TEXT for Teletext */
+        { 0x4540, KEY_RECORD }, /* Font 'Size' for Teletext */
+        { 0x4541, KEY_SCREEN }, /*  Full screen toggle, 'Hold' for Teletext */
+        { 0x4542, KEY_SELECT }, /* Select video input, 'Select' for Teletext */
 };
 
 /* STK7700P: Hauppauge Nova-T Stick, AVerMedia Volar */
@@ -1861,6 +1898,7 @@ struct usb_device_id dib0700_usb_id_tabl
         { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XPVR) },
         { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XP) },
         { USB_DEVICE(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD) },
+        { USB_DEVICE(USB_VID_ELGATO,    USB_PID_ELGATO_EYETV_DIVERSITY) },
         { 0 }           /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
@@ -2173,7 +2211,7 @@ struct dvb_usb_device_properties dib0700
                         }
                 },
 
-                .num_device_descs = 6,
+                .num_device_descs = 7,
                 .devices = {
                         {   "DiBcom STK7070PD reference design",
                                 { &dib0700_usb_id_table[17], NULL },
@@ -2199,7 +2237,11 @@ struct dvb_usb_device_properties dib0700
                         {  "Sony PlayTV",
                                 { &dib0700_usb_id_table[44], NULL },
                                 { NULL },
-                        }
+                        },
+                        {   "Elgato EyeTV Diversity",
+                                { &dib0700_usb_id_table[64], NULL },
+                                { NULL },
+                        },
                 },
                 .rc_interval      = DEFAULT_RC_INTERVAL,
                 .rc_key_map       = dib0700_rc_keys,
--- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
@@ -271,6 +271,7 @@
 #define USB_PID_TELESTAR_STARSTICK_2                    0x8000
 #define USB_PID_MSI_DIGI_VOX_MINI_III                   0x8807
 #define USB_PID_SONY_PLAYTV                             0x0003
+#define USB_PID_ELGATO_EYETV_DIVERSITY                  0x0011
 #define USB_PID_ELGATO_EYETV_DTT                        0x0021
 #define USB_PID_ELGATO_EYETV_DTT_Dlx                    0x0020
 #define USB_PID_DVB_T_USB_STICK_HIGH_SPEED_COLD         0x5000
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -445,6 +445,17 @@ static int mmc_host_do_disable(struct mm
 int mmc_host_disable(struct mmc_host *host)
 {
         int err;
+        unsigned long flags;
+
+        spin_lock_irqsave(&host->lock, flags);
+
+        if (host->rescan_disable) {
+                spin_unlock_irqrestore(&host->lock, flags);
+                return;
+        }
+
+        spin_unlock_irqrestore(&host->lock, flags);
+
 
         if (!(host->caps & MMC_CAP_DISABLE))
                 return 0;
@@ -1352,18 +1363,6 @@ int mmc_suspend_host(struct mmc_host *ho
         if (host->bus_ops && !host->bus_dead) {
                 if (host->bus_ops->suspend)
                         err = host->bus_ops->suspend(host);
-                if (err == -ENOSYS || !host->bus_ops->resume) {
-                        /*
-                         * We simply "remove" the card in this case.
-                         * It will be redetected on resume.
-                         */
-                        if (host->bus_ops->remove)
-                                host->bus_ops->remove(host);
-                        mmc_claim_host(host);
-                        mmc_detach_bus(host);
-                        mmc_release_host(host);
-                        err = 0;
-                }
         }
         mmc_bus_put(host);
 
@@ -1399,28 +1398,60 @@ int mmc_resume_host(struct mmc_host *hos
                         printk(KERN_WARNING "%s: error %d during resume "
                                             "(card was removed?)\n",
                                             mmc_hostname(host), err);
-                        if (host->bus_ops->remove)
-                                host->bus_ops->remove(host);
-                        mmc_claim_host(host);
-                        mmc_detach_bus(host);
-                        mmc_release_host(host);
-                        /* no need to bother upper layers */
                         err = 0;
                 }
         }
         mmc_bus_put(host);
 
-        /*
-         * We add a slight delay here so that resume can progress
-         * in parallel.
-         */
-        mmc_detect_change(host, 1);
-
         return err;
 }
-
 EXPORT_SYMBOL(mmc_resume_host);
 
+/* Do the card removal on suspend if card is assumed removeable
+ * Do that in pm notifier while userspace isn't yet frozen, so we will be able
+   to sync the card.
+*/
+int mmc_pm_notify(struct notifier_block *notify_block,
+                                        unsigned long mode, void *unused)
+{
+        struct mmc_host *host = container_of(
+                notify_block, struct mmc_host, pm_notify);
+        unsigned long flags;
+
+
+        switch (mode) {
+        case PM_HIBERNATION_PREPARE:
+        case PM_SUSPEND_PREPARE:
+
+                spin_lock_irqsave(&host->lock, flags);
+                host->rescan_disable = 1;
+                spin_unlock_irqrestore(&host->lock, flags);
+                cancel_delayed_work_sync(&host->detect);
+
+                if (!host->bus_ops || host->bus_ops->suspend)
+                        break;
+
+                mmc_claim_host(host);
+
+                if (host->bus_ops->remove)
+                        host->bus_ops->remove(host);
+
+                mmc_detach_bus(host);
+                mmc_release_host(host);
+                break;
+
+        case PM_POST_SUSPEND:
+        case PM_POST_HIBERNATION:
+
+                spin_lock_irqsave(&host->lock, flags);
+                host->rescan_disable = 0;
+                spin_unlock_irqrestore(&host->lock, flags);
+                mmc_detect_change(host, 0);
+
+        }
+
+        return 0;
+}
 #endif
 
 #ifdef CONFIG_MMC_EMBEDDED_SDIO
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -16,6 +16,7 @@
 #include <linux/idr.h>
 #include <linux/pagemap.h>
 #include <linux/leds.h>
+#include <linux/suspend.h>
 
 #include <linux/mmc/host.h>
 
@@ -85,6 +86,9 @@ struct mmc_host *mmc_alloc_host(int extr
         INIT_DELAYED_WORK(&host->detect, mmc_rescan);
         INIT_DELAYED_WORK(&host->remove, mmc_remove_sd_card);
         INIT_DELAYED_WORK_DEFERRABLE(&host->disable, mmc_host_deeper_disable);
+#ifdef CONFIG_PM
+        host->pm_notify.notifier_call = mmc_pm_notify;
+#endif
 
         /*
          * By default, hosts do not support SGIO or large requests.
@@ -133,6 +137,7 @@ int mmc_add_host(struct mmc_host *host)
 #endif
 
         mmc_start_host(host);
+        register_pm_notifier(&host->pm_notify);
 
         return 0;
 }
@@ -149,6 +154,7 @@ EXPORT_SYMBOL(mmc_add_host);
  */
 void mmc_remove_host(struct mmc_host *host)
 {
+        unregister_pm_notifier(&host->pm_notify);
         mmc_stop_host(host);
 
 #ifdef CONFIG_DEBUG_FS
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -569,6 +569,7 @@ static struct sdhci_pci_slot * __devinit
         host->ioaddr = pci_ioremap_bar(pdev, bar);
         if (!host->ioaddr) {
                 dev_err(&pdev->dev, "failed to remap registers\n");
+                ret = -ENOMEM;
                 goto release;
         }
 
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1266,6 +1266,13 @@ static void sdhci_tasklet_finish(unsigne
 
         host = (struct sdhci_host*)param;
 
+        /*
+         * If this tasklet gets rescheduled while running, it will
+         * be run again afterwards but without any active request.
+         */
+        if (!host->mrq)
+                return;
+
         spin_lock_irqsave(&host->lock, flags);
 
         del_timer(&host->timer);
@@ -1277,7 +1284,7 @@ static void sdhci_tasklet_finish(unsigne
          * upon error conditions.
          */
         if (!(host->flags & SDHCI_DEVICE_DEAD) &&
-                (mrq->cmd->error ||
+            ((mrq->cmd && mrq->cmd->error) ||
                  (mrq->data && (mrq->data->error ||
                   (mrq->data->stop && mrq->data->stop->error))) ||
                    (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -139,7 +139,7 @@ obj-$(CONFIG_NE3210) += ne3210.o 8390.o
 obj-$(CONFIG_SB1250_MAC) += sb1250-mac.o
 obj-$(CONFIG_B44) += b44.o
 obj-$(CONFIG_FORCEDETH) += forcedeth.o
-obj-$(CONFIG_NE_H8300) += ne-h8300.o 8390.o
+obj-$(CONFIG_NE_H8300) += ne-h8300.o
 obj-$(CONFIG_AX88796) += ax88796.o
 obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
 
@@ -211,7 +211,7 @@ obj-$(CONFIG_SC92031) += sc92031.o
 obj-$(CONFIG_LP486E) += lp486e.o
 
 obj-$(CONFIG_ETH16I) += eth16i.o
-obj-$(CONFIG_ZORRO8390) += zorro8390.o 8390.o
+obj-$(CONFIG_ZORRO8390) += zorro8390.o
 obj-$(CONFIG_HPLANCE) += hplance.o 7990.o
 obj-$(CONFIG_MVME147_NET) += mvme147.o 7990.o
 obj-$(CONFIG_EQUALIZER) += eql.o
@@ -223,7 +223,7 @@ obj-$(CONFIG_SGI_IOC3_ETH) += ioc3-eth.o
 obj-$(CONFIG_DECLANCE) += declance.o
 obj-$(CONFIG_ATARILANCE) += atarilance.o
 obj-$(CONFIG_A2065) += a2065.o
-obj-$(CONFIG_HYDRA) += hydra.o 8390.o
+obj-$(CONFIG_HYDRA) += hydra.o
 obj-$(CONFIG_ARIADNE) += ariadne.o
 obj-$(CONFIG_CS89x0) += cs89x0.o
 obj-$(CONFIG_MACSONIC) += macsonic.o
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -1976,8 +1976,6 @@ static void atl1c_tx_map(struct atl1c_ad
                 else {
                         use_tpd = atl1c_get_tpd(adapter, type);
                         memcpy(use_tpd, tpd, sizeof(struct atl1c_tpd_desc));
-                        use_tpd = atl1c_get_tpd(adapter, type);
-                        memcpy(use_tpd, tpd, sizeof(struct atl1c_tpd_desc));
                 }
                 buffer_info = atl1c_get_tx_buffer(adapter, use_tpd);
                 buffer_info->length = buf_len - mapped_len;
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -49,6 +49,7 @@
 #include <linux/prefetch.h>
 #include <linux/zlib.h>
 #include <linux/io.h>
+#include <linux/stringify.h>
 
 
 #include "bnx2x.h"
@@ -63,8 +64,13 @@
 #include <linux/firmware.h>
 #include "bnx2x_fw_file_hdr.h"
 /* FW files */
-#define FW_FILE_PREFIX_E1       "bnx2x-e1-"
-#define FW_FILE_PREFIX_E1H      "bnx2x-e1h-"
+#define FW_FILE_VERSION                                 \
+        __stringify(BCM_5710_FW_MAJOR_VERSION) "."      \
+        __stringify(BCM_5710_FW_MINOR_VERSION) "."      \
+        __stringify(BCM_5710_FW_REVISION_VERSION) "."   \
+        __stringify(BCM_5710_FW_ENGINEERING_VERSION)
+#define FW_FILE_NAME_E1         "bnx2x-e1-" FW_FILE_VERSION ".fw"
+#define FW_FILE_NAME_E1H        "bnx2x-e1h-" FW_FILE_VERSION ".fw"
 
 /* Time in jiffies before concluding the transmitter is hung */
 #define TX_TIMEOUT              (5*HZ)
@@ -77,6 +83,8 @@ MODULE_AUTHOR("Eliezer Tamir");
 MODULE_DESCRIPTION("Broadcom NetXtreme II BCM57710/57711/57711E Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_MODULE_VERSION);
+MODULE_FIRMWARE(FW_FILE_NAME_E1);
+MODULE_FIRMWARE(FW_FILE_NAME_E1H);
 
 static int multi_mode = 1;
 module_param(multi_mode, int, 0);
@@ -11830,21 +11838,14 @@ static inline void be16_to_cpu_n(const u
 
 static int __devinit bnx2x_init_firmware(struct bnx2x *bp, struct device *dev)
 {
-        char fw_file_name[40] = {0};
+        const char *fw_file_name;
         struct bnx2x_fw_file_hdr *fw_hdr;
-        int rc, offset;
+        int rc;
 
-        /* Create a FW file name */
         if (CHIP_IS_E1(bp))
-                offset = sprintf(fw_file_name, FW_FILE_PREFIX_E1);
+                fw_file_name = FW_FILE_NAME_E1;
         else
-                offset = sprintf(fw_file_name, FW_FILE_PREFIX_E1H);
-
-        sprintf(fw_file_name + offset, "%d.%d.%d.%d.fw",
-                BCM_5710_FW_MAJOR_VERSION,
-                BCM_5710_FW_MINOR_VERSION,
-                BCM_5710_FW_REVISION_VERSION,
-                BCM_5710_FW_ENGINEERING_VERSION);
+                fw_file_name = FW_FILE_NAME_E1H;
 
         printk(KERN_INFO PFX "Loading %s\n", fw_file_name);
 
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2451,6 +2451,10 @@ int bond_3ad_lacpdu_recv(struct sk_buff
         if (!(dev->flags & IFF_MASTER))
                 goto out;
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out;
+
         if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
                 goto out;
 
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -370,6 +370,10 @@ static int rlb_arp_recv(struct sk_buff *
                 goto out;
         }
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out;
+
         if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
                 goto out;
 
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2692,6 +2692,10 @@ static int bond_arp_rcv(struct sk_buff *
         if (!slave || !slave_do_arp_validate(bond, slave))
                 goto out_unlock;
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out_unlock;
+
         if (!pskb_may_pull(skb, arp_hdr_len(dev)))
                 goto out_unlock;
 
--- a/drivers/net/cxgb3/common.h
+++ b/drivers/net/cxgb3/common.h
@@ -125,11 +125,9 @@ enum {                              /* adapter interrupt-maintaine
         IRQ_NUM_STATS           /* keep last */
 };
 
-enum {
-        TP_VERSION_MAJOR        = 1,
-        TP_VERSION_MINOR        = 1,
-        TP_VERSION_MICRO        = 0
-};
+#define TP_VERSION_MAJOR        1
+#define TP_VERSION_MINOR        1
+#define TP_VERSION_MICRO        0
 
 #define S_TP_VERSION_MAJOR              16
 #define M_TP_VERSION_MAJOR              0xFF
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -44,6 +44,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/firmware.h>
 #include <linux/log2.h>
+#include <linux/stringify.h>
 #include <asm/uaccess.h>
 
 #include "common.h"
@@ -989,11 +990,21 @@ static int bind_qsets(struct adapter *ad
         return err;
 }
 
-#define FW_FNAME "cxgb3/t3fw-%d.%d.%d.bin"
-#define TPSRAM_NAME "cxgb3/t3%c_psram-%d.%d.%d.bin"
+#define FW_VERSION __stringify(FW_VERSION_MAJOR) "."                    \
+        __stringify(FW_VERSION_MINOR) "." __stringify(FW_VERSION_MICRO)
+#define FW_FNAME "cxgb3/t3fw-" FW_VERSION ".bin"
+#define TPSRAM_VERSION __stringify(TP_VERSION_MAJOR) "."                \
+        __stringify(TP_VERSION_MINOR) "." __stringify(TP_VERSION_MICRO)
+#define TPSRAM_NAME "cxgb3/t3%c_psram-" TPSRAM_VERSION ".bin"
 #define AEL2005_OPT_EDC_NAME "cxgb3/ael2005_opt_edc.bin"
 #define AEL2005_TWX_EDC_NAME "cxgb3/ael2005_twx_edc.bin"
 #define AEL2020_TWX_EDC_NAME "cxgb3/ael2020_twx_edc.bin"
+MODULE_FIRMWARE(FW_FNAME);
+MODULE_FIRMWARE("cxgb3/t3b_psram-" TPSRAM_VERSION ".bin");
+MODULE_FIRMWARE("cxgb3/t3c_psram-" TPSRAM_VERSION ".bin");
+MODULE_FIRMWARE(AEL2005_OPT_EDC_NAME);
+MODULE_FIRMWARE(AEL2005_TWX_EDC_NAME);
+MODULE_FIRMWARE(AEL2020_TWX_EDC_NAME);
 
 static inline const char *get_edc_fw_name(int edc_idx)
 {
@@ -1064,16 +1075,13 @@ int t3_get_edc_fw(struct cphy *phy, int
 static int upgrade_fw(struct adapter *adap)
 {
         int ret;
-        char buf[64];
         const struct firmware *fw;
         struct device *dev = &adap->pdev->dev;
 
-        snprintf(buf, sizeof(buf), FW_FNAME, FW_VERSION_MAJOR,
-                 FW_VERSION_MINOR, FW_VERSION_MICRO);
-        ret = request_firmware(&fw, buf, dev);
+        ret = request_firmware(&fw, FW_FNAME, dev);
         if (ret < 0) {
                 dev_err(dev, "could not upgrade firmware: unable to load %s\n",
-                        buf);
+                        FW_FNAME);
                 return ret;
         }
         ret = t3_load_fw(adap, fw->data, fw->size);
@@ -1117,8 +1125,7 @@ static int update_tpsram(struct adapter
         if (!rev)
                 return 0;
 
-        snprintf(buf, sizeof(buf), TPSRAM_NAME, rev,
-                 TP_VERSION_MAJOR, TP_VERSION_MINOR, TP_VERSION_MICRO);
+        snprintf(buf, sizeof(buf), TPSRAM_NAME, rev);
 
         ret = request_firmware(&tpsram, buf, dev);
         if (ret < 0) {
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -790,6 +790,70 @@ static const struct net_device_ops e1000
 };
 
 /**
+ * e1000_init_hw_struct - initialize members of hw struct
+ * @adapter: board private struct
+ * @hw: structure used by e1000_hw.c
+ *
+ * Factors out initialization of the e1000_hw struct to its own function
+ * that can be called very early at init (just after struct allocation).
+ * Fields are initialized based on PCI device information and
+ * OS network device settings (MTU size).
+ * Returns negative error codes if MAC type setup fails.
+ */
+static int e1000_init_hw_struct(struct e1000_adapter *adapter,
+                                struct e1000_hw *hw)
+{
+        struct pci_dev *pdev = adapter->pdev;
+
+        /* PCI config space info */
+        hw->vendor_id = pdev->vendor;
+        hw->device_id = pdev->device;
+        hw->subsystem_vendor_id = pdev->subsystem_vendor;
+        hw->subsystem_id = pdev->subsystem_device;
+        hw->revision_id = pdev->revision;
+
+        pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
+
+        hw->max_frame_size = adapter->netdev->mtu +
+                             ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
+        hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE;
+
+        /* identify the MAC */
+        if (e1000_set_mac_type(hw)) {
+                DPRINTK(PROBE, ERR, "Unknown MAC Type\n");
+                return -EIO;
+        }
+
+        switch (hw->mac_type) {
+        default:
+                break;
+        case e1000_82541:
+        case e1000_82547:
+        case e1000_82541_rev_2:
+        case e1000_82547_rev_2:
+                hw->phy_init_script = 1;
+                break;
+        }
+
+        e1000_set_media_type(hw);
+        e1000_get_bus_info(hw);
+
+        hw->wait_autoneg_complete = false;
+        hw->tbi_compatibility_en = true;
+        hw->adaptive_ifs = true;
+
+        /* Copper options */
+
+        if (hw->media_type == e1000_media_type_copper) {
+                hw->mdix = AUTO_ALL_MODES;
+                hw->disable_polarity_correction = false;
+                hw->master_slave = E1000_MASTER_SLAVE;
+        }
+
+        return 0;
+}
+
+/**
  * e1000_probe - Device Initialization Routine
  * @pdev: PCI device information struct
  * @ent: entry in e1000_pci_tbl
@@ -826,22 +890,6 @@ static int __devinit e1000_probe(struct
         if (err)
                 return err;
 
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
-            !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
-                pci_using_dac = 1;
-        } else {
-                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
-                if (err) {
-                        err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
-                        if (err) {
-                                E1000_ERR("No usable DMA configuration, "
-                                          "aborting\n");
-                                goto err_dma;
-                        }
-                }
-                pci_using_dac = 0;
-        }
-
         err = pci_request_selected_regions(pdev, bars, e1000_driver_name);
         if (err)
                 goto err_pci_reg;
@@ -882,6 +930,32 @@ static int __devinit e1000_probe(struct
                 }
         }
 
+        /* make ready for any if (hw->...) below */
+        err = e1000_init_hw_struct(adapter, hw);
+        if (err)
+                goto err_sw_init;
+
+        /*
+         * there is a workaround being applied below that limits
+         * 64-bit DMA addresses to 64-bit hardware.  There are some
+         * 32-bit adapters that Tx hang when given 64-bit DMA addresses
+         */
+        pci_using_dac = 0;
+        if ((hw->bus_type == e1000_bus_type_pcix) &&
+            !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+                /*
+                 * according to DMA-API-HOWTO, coherent calls will always
+                 * succeed if the set call did
+                 */
+                pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
+                pci_using_dac = 1;
+        } else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) {
+                pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+        } else {
+                E1000_ERR("No usable DMA configuration, aborting\n");
+                goto err_dma;
+        }
+
         netdev->netdev_ops = &e1000_netdev_ops;
         e1000_set_ethtool_ops(netdev);
         netdev->watchdog_timeo = 5 * HZ;
@@ -956,8 +1030,6 @@ static int __devinit e1000_probe(struct
         if (!is_valid_ether_addr(netdev->perm_addr))
                 DPRINTK(PROBE, ERR, "Invalid MAC Address\n");
 
-        e1000_get_bus_info(hw);
-
         init_timer(&adapter->tx_fifo_stall_timer);
         adapter->tx_fifo_stall_timer.function = &e1000_82547_tx_fifo_stall;
         adapter->tx_fifo_stall_timer.data = (unsigned long)adapter;
@@ -1070,6 +1142,7 @@ err_eeprom:
                 iounmap(hw->flash_address);
         kfree(adapter->tx_ring);
         kfree(adapter->rx_ring);
+err_dma:
 err_sw_init:
         iounmap(hw->hw_addr);
 err_ioremap:
@@ -1077,7 +1150,6 @@ err_ioremap:
 err_alloc_etherdev:
         pci_release_selected_regions(pdev, bars);
 err_pci_reg:
-err_dma:
         pci_disable_device(pdev);
         return err;
 }
@@ -1129,62 +1201,12 @@ static void __devexit e1000_remove(struc
  * @adapter: board private structure to initialize
  *
  * e1000_sw_init initializes the Adapter private data structure.
- * Fields are initialized based on PCI device information and
- * OS network device settings (MTU size).
+ * e1000_init_hw_struct MUST be called before this function
  **/
 
 static int __devinit e1000_sw_init(struct e1000_adapter *adapter)
 {
-        struct e1000_hw *hw = &adapter->hw;
-        struct net_device *netdev = adapter->netdev;
-        struct pci_dev *pdev = adapter->pdev;
-
-        /* PCI config space info */
-
-        hw->vendor_id = pdev->vendor;
-        hw->device_id = pdev->device;
-        hw->subsystem_vendor_id = pdev->subsystem_vendor;
-        hw->subsystem_id = pdev->subsystem_device;
-        hw->revision_id = pdev->revision;
-
-        pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
-
         adapter->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE;
-        hw->max_frame_size = netdev->mtu +
-                             ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
-        hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE;
-
-        /* identify the MAC */
-
-        if (e1000_set_mac_type(hw)) {
-                DPRINTK(PROBE, ERR, "Unknown MAC Type\n");
-                return -EIO;
-        }
-
-        switch (hw->mac_type) {
-        default:
-                break;
-        case e1000_82541:
-        case e1000_82547:
-        case e1000_82541_rev_2:
-        case e1000_82547_rev_2:
-                hw->phy_init_script = 1;
-                break;
-        }
-
-        e1000_set_media_type(hw);
-
-        hw->wait_autoneg_complete = false;
-        hw->tbi_compatibility_en = true;
-        hw->adaptive_ifs = true;
-
-        /* Copper options */
-
-        if (hw->media_type == e1000_media_type_copper) {
-                hw->mdix = AUTO_ALL_MODES;
-                hw->disable_polarity_correction = false;
-                hw->master_slave = E1000_MASTER_SLAVE;
-        }
 
         adapter->num_tx_queues = 1;
         adapter->num_rx_queues = 1;
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -274,6 +274,16 @@ static s32 e1000_init_phy_params_pchlan(
         phy->ops.write_phy_reg_locked = e1000_write_phy_reg_hv_locked;
         phy->autoneg_mask             = AUTONEG_ADVERTISE_SPEED_DEFAULT;
 
+        /*
+         * Reset the PHY before any acccess to it.  Doing so, ensures that
+         * the PHY is in a known good state before we read/write PHY registers.
+         * The generic reset is sufficient here, because we haven't determined
+         * the PHY type yet.
+         */
+        ret_val = e1000e_phy_hw_reset_generic(hw);
+        if (ret_val)
+                goto out;
+
         phy->id = e1000_phy_unknown;
         e1000e_get_phy_id(hw);
         phy->type = e1000e_get_phy_type_from_id(phy->id);
@@ -287,6 +297,7 @@ static s32 e1000_init_phy_params_pchlan(
                 phy->ops.commit_phy = e1000e_phy_sw_reset;
         }
 
+ out:
         return ret_val;
 }
 
--- a/drivers/net/ehea/ehea_ethtool.c
+++ b/drivers/net/ehea/ehea_ethtool.c
@@ -53,15 +53,20 @@ static int ehea_get_settings(struct net_
                 cmd->duplex = -1;
         }
 
-        cmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_1000baseT_Full
-                       | SUPPORTED_100baseT_Full |  SUPPORTED_100baseT_Half
-                       | SUPPORTED_10baseT_Full | SUPPORTED_10baseT_Half
-                       | SUPPORTED_Autoneg | SUPPORTED_FIBRE);
-
-        cmd->advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_Autoneg
-                         | ADVERTISED_FIBRE);
+        if (cmd->speed == SPEED_10000) {
+                cmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
+                cmd->advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_FIBRE);
+                cmd->port = PORT_FIBRE;
+        } else {
+                cmd->supported = (SUPPORTED_1000baseT_Full | SUPPORTED_100baseT_Full
+                               | SUPPORTED_100baseT_Half | SUPPORTED_10baseT_Full
+                               | SUPPORTED_10baseT_Half | SUPPORTED_Autoneg
+                               | SUPPORTED_TP);
+                cmd->advertising = (ADVERTISED_1000baseT_Full | ADVERTISED_Autoneg
+                                 | ADVERTISED_TP);
+                cmd->port = PORT_TP;
+        }
 
-        cmd->port = PORT_FIBRE;
         cmd->autoneg = port->autoneg == 1 ? AUTONEG_ENABLE : AUTONEG_DISABLE;
 
         return 0;
--- a/drivers/net/hydra.c
+++ b/drivers/net/hydra.c
@@ -98,15 +98,15 @@ static const struct net_device_ops hydra
         .ndo_open               = hydra_open,
         .ndo_stop               = hydra_close,
 
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
@@ -125,7 +125,7 @@ static int __devinit hydra_init(struct z
         0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
     };
 
-    dev = alloc_ei_netdev();
+    dev = ____alloc_ei_netdev(0);
     if (!dev)
         return -ENOMEM;
 
--- a/drivers/net/igbvf/igbvf.h
+++ b/drivers/net/igbvf/igbvf.h
@@ -125,7 +125,6 @@ struct igbvf_buffer {
                         unsigned int page_offset;
                 };
         };
-        struct page *page;
 };
 
 union igbvf_desc {
--- a/drivers/net/ipg.c
+++ b/drivers/net/ipg.c
@@ -88,7 +88,6 @@ static const char *ipg_brand_name[] = {
         "Sundance Technology ST2021 based NIC",
         "Tamarack Microelectronics TC9020/9021 based NIC",
         "Tamarack Microelectronics TC9020/9021 based NIC",
-        "D-Link NIC",
         "D-Link NIC IP1000A"
 };
 
@@ -97,8 +96,7 @@ static struct pci_device_id ipg_pci_tbl[
         { PCI_VDEVICE(SUNDANCE, 0x2021), 1 },
         { PCI_VDEVICE(SUNDANCE, 0x1021), 2 },
         { PCI_VDEVICE(DLINK,    0x9021), 3 },
-        { PCI_VDEVICE(DLINK,    0x4000), 4 },
-        { PCI_VDEVICE(DLINK,    0x4020), 5 },
+        { PCI_VDEVICE(DLINK,    0x4020), 4 },
         { 0, }
 };
 
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -264,6 +264,10 @@ static char *myri10ge_fw_unaligned = "my
 static char *myri10ge_fw_aligned = "myri10ge_eth_z8e.dat";
 static char *myri10ge_fw_rss_unaligned = "myri10ge_rss_ethp_z8e.dat";
 static char *myri10ge_fw_rss_aligned = "myri10ge_rss_eth_z8e.dat";
+MODULE_FIRMWARE("myri10ge_ethp_z8e.dat");
+MODULE_FIRMWARE("myri10ge_eth_z8e.dat");
+MODULE_FIRMWARE("myri10ge_rss_ethp_z8e.dat");
+MODULE_FIRMWARE("myri10ge_rss_eth_z8e.dat");
 
 static char *myri10ge_fw_name = NULL;
 module_param(myri10ge_fw_name, charp, S_IRUGO | S_IWUSR);
--- a/drivers/net/ne-h8300.c
+++ b/drivers/net/ne-h8300.c
@@ -167,7 +167,7 @@ static void cleanup_card(struct net_devi
 #ifndef MODULE
 struct net_device * __init ne_probe(int unit)
 {
-        struct net_device *dev = alloc_ei_netdev();
+        struct net_device *dev = ____alloc_ei_netdev(0);
         int err;
 
         if (!dev)
@@ -197,15 +197,15 @@ static const struct net_device_ops ne_ne
         .ndo_open               = ne_open,
         .ndo_stop               = ne_close,
 
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
@@ -638,7 +638,7 @@ int init_module(void)
         int err;
 
         for (this_dev = 0; this_dev < MAX_NE_CARDS; this_dev++) {
-                struct net_device *dev = alloc_ei_netdev();
+                struct net_device *dev = ____alloc_ei_netdev(0);
                 if (!dev)
                         break;
                 if (io[this_dev]) {
--- a/drivers/net/netx-eth.c
+++ b/drivers/net/netx-eth.c
@@ -510,3 +510,6 @@ module_exit(netx_eth_cleanup);
 MODULE_AUTHOR("Sascha Hauer, Pengutronix");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" CARDNAME);
+MODULE_FIRMWARE("xc0.bin");
+MODULE_FIRMWARE("xc1.bin");
+MODULE_FIRMWARE("xc2.bin");
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -487,6 +487,11 @@ struct status_desc {
 #define NX_P3_MN_ROMIMAGE       2
 #define NX_FLASH_ROMIMAGE       3
 
+#define NX_P2_MN_ROMIMAGE_NAME          "nxromimg.bin"
+#define NX_P3_CT_ROMIMAGE_NAME          "nx3fwct.bin"
+#define NX_P3_MN_ROMIMAGE_NAME          "nx3fwmn.bin"
+#define NX_FLASH_ROMIMAGE_NAME          "flash"
+
 extern char netxen_nic_driver_name[];
 
 /* Number of status descriptors to handle per interrupt */
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -673,7 +673,10 @@ netxen_need_fw_reset(struct netxen_adapt
 }
 
 static char *fw_name[] = {
-        "nxromimg.bin", "nx3fwct.bin", "nx3fwmn.bin", "flash",
+        NX_P2_MN_ROMIMAGE_NAME,
+        NX_P3_CT_ROMIMAGE_NAME,
+        NX_P3_MN_ROMIMAGE_NAME,
+        NX_FLASH_ROMIMAGE_NAME,
 };
 
 int
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -38,6 +38,9 @@
 MODULE_DESCRIPTION("NetXen Multi port (1/10) Gigabit Network Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(NETXEN_NIC_LINUX_VERSIONID);
+MODULE_FIRMWARE(NX_P2_MN_ROMIMAGE_NAME);
+MODULE_FIRMWARE(NX_P3_CT_ROMIMAGE_NAME);
+MODULE_FIRMWARE(NX_P3_MN_ROMIMAGE_NAME);
 
 char netxen_nic_driver_name[] = "netxen_nic";
 static char netxen_nic_driver_string[] = "NetXen Network Driver version "
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -7315,33 +7315,28 @@ static int niu_get_ethtool_tcam_all(stru
         struct niu_parent *parent = np->parent;
         struct niu_tcam_entry *tp;
         int i, idx, cnt;
-        u16 n_entries;
         unsigned long flags;
-
+        int ret = 0;
 
         /* put the tcam size here */
         nfc->data = tcam_get_size(np);
 
         niu_lock_parent(np, flags);
-        n_entries = nfc->rule_cnt;
         for (cnt = 0, i = 0; i < nfc->data; i++) {
                 idx = tcam_get_index(np, i);
                 tp = &parent->tcam[idx];
                 if (!tp->valid)
                         continue;
+                if (cnt == nfc->rule_cnt) {
+                        ret = -EMSGSIZE;
+                        break;
+                }
                 rule_locs[cnt] = i;
                 cnt++;
         }
         niu_unlock_parent(np, flags);
 
-        if (n_entries != cnt) {
-                /* print warning, this should not happen */
-                pr_info(PFX "niu%d: %s In niu_get_ethtool_tcam_all, "
-                        "n_entries[%d] != cnt[%d]!!!\n\n",
-                        np->parent->index, np->dev->name, n_entries, cnt);
-        }
-
-        return 0;
+        return ret;
 }
 
 static int niu_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1768,6 +1768,13 @@ static struct pcmcia_device_id pcnet_ids
         PCMCIA_DEVICE_NULL
 };
 MODULE_DEVICE_TABLE(pcmcia, pcnet_ids);
+MODULE_FIRMWARE("cis/PCMLM28.cis");
+MODULE_FIRMWARE("cis/DP83903.cis");
+MODULE_FIRMWARE("cis/LA-PCM.cis");
+MODULE_FIRMWARE("PE520.cis");
+MODULE_FIRMWARE("cis/NE2K.cis");
+MODULE_FIRMWARE("cis/PE-200.cis");
+MODULE_FIRMWARE("cis/tamarack.cis");
 
 static struct pcmcia_driver pcnet_driver = {
         .drv            = {
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -756,6 +756,7 @@ static int pppol2tp_recv_core(struct soc
 
         /* Try to dequeue as many skbs from reorder_q as we can. */
         pppol2tp_recv_dequeue(session);
+        sock_put(sock);
 
         return 0;
 
@@ -772,6 +773,7 @@ discard_bad_csum:
         UDP_INC_STATS_USER(&init_net, UDP_MIB_INERRORS, 0);
         tunnel->stats.rx_errors++;
         kfree_skb(skb);
+        sock_put(sock);
 
         return 0;
 
@@ -1658,6 +1660,7 @@ static int pppol2tp_connect(struct socke
                 if (tunnel_sock == NULL)
                         goto end;
 
+                sock_hold(tunnel_sock);
                 tunnel = tunnel_sock->sk_user_data;
         } else {
                 tunnel = pppol2tp_tunnel_find(sock_net(sk), sp->pppol2tp.s_tunnel);
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -850,7 +850,9 @@ static int slip_open(struct tty_struct *
         /* Done.  We have linked the TTY line to a channel. */
         rtnl_unlock();
         tty->receive_room = 65536;      /* We don't flow control */
-        return sl->dev->base_addr;
+
+        /* TTY layer expects 0 on success */
+        return 0;
 
 err_free_bufs:
         sl_free_bufs(sl);
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -57,6 +57,7 @@ MODULE_AUTHOR("Utz Bacher <utz.bacher@de
 MODULE_DESCRIPTION("Spider Southbridge Gigabit Ethernet driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(VERSION);
+MODULE_FIRMWARE(SPIDER_NET_FIRMWARE_NAME);
 
 static int rx_descriptors = SPIDER_NET_RX_DESCRIPTORS_DEFAULT;
 static int tx_descriptors = SPIDER_NET_TX_DESCRIPTORS_DEFAULT;
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -324,7 +324,7 @@ static int bdx_fw_load(struct bdx_priv *
         ENTER;
         master = READ_REG(priv, regINIT_SEMAPHORE);
         if (!READ_REG(priv, regINIT_STATUS) && master) {
-                rc = request_firmware(&fw, "tehuti/firmware.bin", &priv->pdev->dev);
+                rc = request_firmware(&fw, "tehuti/bdx.bin", &priv->pdev->dev);
                 if (rc)
                         goto out;
                 bdx_tx_push_desc_safe(priv, (char *)fw->data, fw->size);
@@ -2524,4 +2524,4 @@ module_exit(bdx_module_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(BDX_DRV_DESC);
-MODULE_FIRMWARE("tehuti/firmware.bin");
+MODULE_FIRMWARE("tehuti/bdx.bin");
--- a/drivers/net/tokenring/tms380tr.c
+++ b/drivers/net/tokenring/tms380tr.c
@@ -1364,6 +1364,8 @@ static int tms380tr_reset_adapter(struct
         return (-1);
 }
 
+MODULE_FIRMWARE("tms380tr.bin");
+
 /*
  * Starts bring up diagnostics of token ring adapter and evaluates
  * diagnostic results.
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -249,6 +249,7 @@ static struct pci_device_id tulip_pci_tb
         { 0x17B3, 0xAB08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
         { 0x10b7, 0x9300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* 3Com 3CSOHO100B-TX */
         { 0x14ea, 0xab08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Planex FNW-3602-TX */
+        { 0x1414, 0x0001, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Microsoft MN-120 */
         { 0x1414, 0x0002, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
         { } /* terminate list */
 };
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -391,6 +391,20 @@ static void skb_recv_done(struct virtque
         }
 }
 
+static void virtnet_napi_enable(struct virtnet_info *vi)
+{
+        napi_enable(&vi->napi);
+
+        /* If all buffers were filled by other side before we napi_enabled, we
+         * won't get another interrupt, so process any outstanding packets
+         * now.  virtnet_poll wants re-enable the queue, so we disable here.
+         * We synchronize against interrupts via NAPI_STATE_SCHED */
+        if (napi_schedule_prep(&vi->napi)) {
+                vi->rvq->vq_ops->disable_cb(vi->rvq);
+                __napi_schedule(&vi->napi);
+        }
+}
+
 static void refill_work(struct work_struct *work)
 {
         struct virtnet_info *vi;
@@ -399,7 +413,7 @@ static void refill_work(struct work_stru
         vi = container_of(work, struct virtnet_info, refill.work);
         napi_disable(&vi->napi);
         still_empty = !try_fill_recv(vi, GFP_KERNEL);
-        napi_enable(&vi->napi);
+        virtnet_napi_enable(vi);
 
         /* In theory, this can happen: if we don't get any buffers in
          * we will *never* try to fill again. */
@@ -511,7 +525,6 @@ static netdev_tx_t start_xmit(struct sk_
         struct virtnet_info *vi = netdev_priv(dev);
         int capacity;
 
-again:
         /* Free up any pending old buffers before queueing new ones. */
         free_old_xmit_skbs(vi);
 
@@ -520,14 +533,20 @@ again:
 
         /* This can happen with OOM and indirect buffers. */
         if (unlikely(capacity < 0)) {
-                netif_stop_queue(dev);
-                dev_warn(&dev->dev, "Unexpected full queue\n");
-                if (unlikely(!vi->svq->vq_ops->enable_cb(vi->svq))) {
-                        vi->svq->vq_ops->disable_cb(vi->svq);
-                        netif_start_queue(dev);
-                        goto again;
+                if (net_ratelimit()) {
+                        if (likely(capacity == -ENOMEM)) {
+                                dev_warn(&dev->dev,
+                                         "TX queue failure: out of memory\n");
+                        } else {
+                                dev->stats.tx_fifo_errors++;
+                                dev_warn(&dev->dev,
+                                         "Unexpected TX queue failure: %d\n",
+                                         capacity);
+                        }
                 }
-                return NETDEV_TX_BUSY;
+                dev->stats.tx_dropped++;
+                kfree_skb(skb);
+                return NETDEV_TX_OK;
         }
         vi->svq->vq_ops->kick(vi->svq);
 
@@ -591,16 +610,7 @@ static int virtnet_open(struct net_devic
 {
         struct virtnet_info *vi = netdev_priv(dev);
 
-        napi_enable(&vi->napi);
-
-        /* If all buffers were filled by other side before we napi_enabled, we
-         * won't get another interrupt, so process any outstanding packets
-         * now.  virtnet_poll wants re-enable the queue, so we disable here.
-         * We synchronize against interrupts via NAPI_STATE_SCHED */
-        if (napi_schedule_prep(&vi->napi)) {
-                vi->rvq->vq_ops->disable_cb(vi->rvq);
-                __napi_schedule(&vi->napi);
-        }
+        virtnet_napi_enable(vi);
         return 0;
 }
 
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -288,6 +288,9 @@ vmxnet3_set_flags(struct net_device *net
                 /* toggle the LRO feature*/
                 netdev->features ^= NETIF_F_LRO;
 
+                /* Update private LRO flag */
+                adapter->lro = lro_requested;
+
                 /* update harware LRO capability accordingly */
                 if (lro_requested)
                         adapter->shared->devRead.misc.uptFeatures &= UPT1_F_LRO;
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDo
         {APL9_WORLD, CTL_ETSI, CTL_ETSI},
 
         {APL3_FCCA, CTL_FCC, CTL_FCC},
+        {APL7_FCCA, CTL_FCC, CTL_FCC},
         {APL1_ETSIC, CTL_FCC, CTL_ETSI},
         {APL2_ETSIC, CTL_FCC, CTL_ETSI},
         {APL2_APLD, CTL_FCC, NO_CTL},
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -162,6 +162,7 @@ static int b43_sdio_probe(struct sdio_fu
 err_free_ssb:
         kfree(sdio);
 err_disable_func:
+        sdio_claim_host(func);
         sdio_disable_func(func);
 err_release_host:
         sdio_release_host(func);
@@ -174,7 +175,9 @@ static void b43_sdio_remove(struct sdio_
         struct b43_sdio *sdio = sdio_get_drvdata(func);
 
         ssb_bus_unregister(&sdio->ssb);
+        sdio_claim_host(func);
         sdio_disable_func(func);
+        sdio_release_host(func);
         kfree(sdio);
         sdio_set_drvdata(func, NULL);
 }
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -47,7 +47,7 @@
 #include "iwl-6000-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 2
+#define IWL5000_UCODE_API_MAX 5
 #define IWL5150_UCODE_API_MAX 2
 
 /* Lowest firmware API version supported */
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -1088,11 +1088,15 @@ int iwl_tx_queue_reclaim(struct iwl_priv
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 tx_info = &txq->txb[txq->q.read_ptr];
-                ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]);
+
+                if (WARN_ON_ONCE(tx_info->skb == NULL))
+                        continue;
 
                 hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
-                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                if (ieee80211_is_data_qos(hdr->frame_control))
                         nfreed++;
+
+                ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]);
                 tx_info->skb[0] = NULL;
 
                 if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1758,8 +1758,8 @@ int lbs_execute_next_command(struct lbs_
                                     cpu_to_le16(CMD_SUBCMD_EXIT_PS)) {
                                         lbs_deb_host(
                                                "EXEC_NEXT_CMD: ignore ENTER_PS cmd\n");
-                                        list_del(&cmdnode->list);
                                         spin_lock_irqsave(&priv->driver_lock, flags);
+                                        list_del(&cmdnode->list);
                                         lbs_complete_command(priv, cmdnode, 0);
                                         spin_unlock_irqrestore(&priv->driver_lock, flags);
 
@@ -1771,8 +1771,8 @@ int lbs_execute_next_command(struct lbs_
                                     (priv->psstate == PS_STATE_PRE_SLEEP)) {
                                         lbs_deb_host(
                                                "EXEC_NEXT_CMD: ignore EXIT_PS cmd in sleep\n");
-                                        list_del(&cmdnode->list);
                                         spin_lock_irqsave(&priv->driver_lock, flags);
+                                        list_del(&cmdnode->list);
                                         lbs_complete_command(priv, cmdnode, 0);
                                         spin_unlock_irqrestore(&priv->driver_lock, flags);
                                         priv->needtowakeup = 1;
@@ -1785,7 +1785,9 @@ int lbs_execute_next_command(struct lbs_
                                        "EXEC_NEXT_CMD: sending EXIT_PS\n");
                         }
                 }
+                spin_lock_irqsave(&priv->driver_lock, flags);
                 list_del(&cmdnode->list);
+                spin_unlock_irqrestore(&priv->driver_lock, flags);
                 lbs_deb_host("EXEC_NEXT_CMD: sending command 0x%04x\n",
                             le16_to_cpu(cmd->command));
                 lbs_submit_command(priv, cmdnode);
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -703,7 +703,7 @@ int p54_tx_80211(struct ieee80211_hw *de
         struct p54_tx_info *p54info;
         struct p54_hdr *hdr;
         struct p54_tx_data *txhdr;
-        unsigned int padding, len, extra_len;
+        unsigned int padding, len, extra_len = 0;
         int i, j, ridx;
         u16 hdr_flags = 0, aid = 0;
         u8 rate, queue = 0, crypt_offset = 0;
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1431,7 +1431,6 @@ static int rt2400pci_probe_hw_mode(struc
                                IEEE80211_HW_SIGNAL_DBM |
                                IEEE80211_HW_SUPPORTS_PS |
                                IEEE80211_HW_PS_NULLFUNC_STACK;
-        rt2x00dev->hw->extra_tx_headroom = 0;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -1628,6 +1627,7 @@ static const struct rt2x00_ops rt2400pci
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
         .tx_queues      = NUM_TX_QUEUES,
+        .extra_tx_headroom = 0,
         .rx             = &rt2400pci_queue_rx,
         .tx             = &rt2400pci_queue_tx,
         .bcn            = &rt2400pci_queue_bcn,
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1732,8 +1732,6 @@ static int rt2500pci_probe_hw_mode(struc
                                IEEE80211_HW_SUPPORTS_PS |
                                IEEE80211_HW_PS_NULLFUNC_STACK;
 
-        rt2x00dev->hw->extra_tx_headroom = 0;
-
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
                                 rt2x00_eeprom_addr(rt2x00dev,
@@ -1927,6 +1925,7 @@ static const struct rt2x00_ops rt2500pci
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
         .tx_queues      = NUM_TX_QUEUES,
+        .extra_tx_headroom = 0,
         .rx             = &rt2500pci_queue_rx,
         .tx             = &rt2500pci_queue_tx,
         .bcn            = &rt2500pci_queue_bcn,
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -347,6 +347,7 @@ static int rt2500usb_config_key(struct r
         int timeout;
         u32 mask;
         u16 reg;
+        enum cipher curr_cipher;
 
         if (crypto->cmd == SET_KEY) {
                 /*
@@ -357,6 +358,7 @@ static int rt2500usb_config_key(struct r
                 mask = TXRX_CSR0_KEY_ID.bit_mask;
 
                 rt2500usb_register_read(rt2x00dev, TXRX_CSR0, ®);
+                curr_cipher = rt2x00_get_field16(reg, TXRX_CSR0_ALGORITHM);
                 reg &= mask;
 
                 if (reg && reg == mask)
@@ -365,6 +367,14 @@ static int rt2500usb_config_key(struct r
                 reg = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID);
 
                 key->hw_key_idx += reg ? ffz(reg) : 0;
+                /*
+                 * Hardware requires that all keys use the same cipher
+                 * (e.g. TKIP-only, AES-only, but not TKIP+AES).
+                 * If this is not the first key, compare the cipher with the
+                 * first one and fall back to SW crypto if not the same.
+                 */
+                if (key->hw_key_idx > 0 && crypto->cipher != curr_cipher)
+                        return -EOPNOTSUPP;
 
                 /*
                  * The encryption key doesn't fit within the CSR cache,
@@ -1788,8 +1798,6 @@ static int rt2500usb_probe_hw_mode(struc
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
 
-        rt2x00dev->hw->extra_tx_headroom = TXD_DESC_SIZE;
-
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
                                 rt2x00_eeprom_addr(rt2x00dev,
@@ -1962,6 +1970,7 @@ static const struct rt2x00_ops rt2500usb
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
         .tx_queues      = NUM_TX_QUEUES,
+        .extra_tx_headroom = TXD_DESC_SIZE,
         .rx             = &rt2500usb_queue_rx,
         .tx             = &rt2500usb_queue_tx,
         .bcn            = &rt2500usb_queue_bcn,
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -2509,7 +2509,6 @@ static int rt2800usb_probe_hw_mode(struc
             IEEE80211_HW_SIGNAL_DBM |
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
-        rt2x00dev->hw->extra_tx_headroom = TXINFO_DESC_SIZE + TXWI_DESC_SIZE;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -2858,6 +2857,7 @@ static const struct rt2x00_ops rt2800usb
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
         .tx_queues      = NUM_TX_QUEUES,
+        .extra_tx_headroom = TXINFO_DESC_SIZE + TXWI_DESC_SIZE,
         .rx             = &rt2800usb_queue_rx,
         .tx             = &rt2800usb_queue_tx,
         .bcn            = &rt2800usb_queue_bcn,
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -112,6 +112,12 @@
         (  ((unsigned long)((__skb)->data + (__header))) & 3 )
 
 /*
+ * Constants for extra TX headroom for alignment purposes.
+ */
+#define RT2X00_ALIGN_SIZE       4 /* Only whole frame needs alignment */
+#define RT2X00_L2PAD_SIZE       8 /* Both header & payload need alignment */
+
+/*
  * Standard timing and size defines.
  * These values should follow the ieee80211 specifications.
  */
@@ -579,6 +585,7 @@ struct rt2x00_ops {
         const unsigned int eeprom_size;
         const unsigned int rf_size;
         const unsigned int tx_queues;
+        const unsigned int extra_tx_headroom;
         const struct data_queue_desc *rx;
         const struct data_queue_desc *tx;
         const struct data_queue_desc *bcn;
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -684,6 +684,21 @@ static int rt2x00lib_probe_hw(struct rt2
         rt2x00dev->hw->queues = rt2x00dev->ops->tx_queues;
 
         /*
+         * Initialize extra TX headroom required.
+         */
+        rt2x00dev->hw->extra_tx_headroom =
+                max_t(unsigned int, IEEE80211_TX_STATUS_HEADROOM,
+                      rt2x00dev->ops->extra_tx_headroom);
+
+        /*
+         * Take TX headroom required for alignment into account.
+         */
+        if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
+        else if (test_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
+
+        /*
          * Register HW.
          */
         status = ieee80211_register_hw(rt2x00dev->hw);
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -103,7 +103,7 @@ void rt2x00queue_map_txskb(struct rt2x00
          * is also mapped to the DMA so it can be used for transfering
          * additional descriptor information to the hardware.
          */
-        skb_push(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_push(skb, rt2x00dev->ops->extra_tx_headroom);
 
         skbdesc->skb_dma =
             dma_map_single(rt2x00dev->dev, skb->data, skb->len, DMA_TO_DEVICE);
@@ -111,7 +111,7 @@ void rt2x00queue_map_txskb(struct rt2x00
         /*
          * Restore data pointer to original location again.
          */
-        skb_pull(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_pull(skb, rt2x00dev->ops->extra_tx_headroom);
 
         skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
 }
@@ -133,7 +133,7 @@ void rt2x00queue_unmap_skb(struct rt2x00
                  * by the driver, but it was actually mapped to DMA.
                  */
                 dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma,
-                                 skb->len + rt2x00dev->hw->extra_tx_headroom,
+                                 skb->len + rt2x00dev->ops->extra_tx_headroom,
                                  DMA_TO_DEVICE);
                 skbdesc->flags &= ~SKBDESC_DMA_MAPPED_TX;
         }
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2550,7 +2550,6 @@ static int rt61pci_probe_hw_mode(struct
             IEEE80211_HW_SIGNAL_DBM |
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
-        rt2x00dev->hw->extra_tx_headroom = 0;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -2798,6 +2797,7 @@ static const struct rt2x00_ops rt61pci_o
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
         .tx_queues      = NUM_TX_QUEUES,
+        .extra_tx_headroom = 0,
         .rx             = &rt61pci_queue_rx,
         .tx             = &rt61pci_queue_tx,
         .bcn            = &rt61pci_queue_bcn,
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2068,7 +2068,6 @@ static int rt73usb_probe_hw_mode(struct
             IEEE80211_HW_SIGNAL_DBM |
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
-        rt2x00dev->hw->extra_tx_headroom = TXD_DESC_SIZE;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -2311,6 +2310,7 @@ static const struct rt2x00_ops rt73usb_o
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
         .tx_queues      = NUM_TX_QUEUES,
+        .extra_tx_headroom = TXD_DESC_SIZE,
         .rx             = &rt73usb_queue_rx,
         .tx             = &rt73usb_queue_tx,
         .bcn            = &rt73usb_queue_bcn,
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -125,7 +125,7 @@ static int __devinit zorro8390_init_one(
 
     board = z->resource.start;
     ioaddr = board+cards[i].offset;
-    dev = alloc_ei_netdev();
+    dev = ____alloc_ei_netdev(0);
     if (!dev)
         return -ENOMEM;
     if (!request_mem_region(ioaddr, NE_IO_EXTENT*2, DRV_NAME)) {
@@ -145,15 +145,15 @@ static int __devinit zorro8390_init_one(
 static const struct net_device_ops zorro8390_netdev_ops = {
         .ndo_open               = zorro8390_open,
         .ndo_stop               = zorro8390_close,
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -382,7 +382,7 @@ int dmar_disabled = 0;
 int dmar_disabled = 1;
 #endif /*CONFIG_DMAR_DEFAULT_ON*/
 
-static int __initdata dmar_map_gfx = 1;
+static int dmar_map_gfx = 1;
 static int dmar_forcedac;
 static int intel_iommu_strict;
 
@@ -1858,7 +1858,7 @@ static struct dmar_domain *get_domain_fo
 
         ret = iommu_attach_domain(domain, iommu);
         if (ret) {
-                domain_exit(domain);
+                free_domain_mem(domain);
                 goto error;
         }
 
@@ -3244,9 +3244,15 @@ static int device_notifier(struct notifi
         if (!domain)
                 return 0;
 
-        if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through)
+        if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) {
                 domain_remove_one_dev_info(domain, pdev);
 
+                if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
+                    !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
+                    list_empty(&domain->devices))
+                        domain_exit(domain);
+        }
+
         return 0;
 }
 
@@ -3393,6 +3399,11 @@ static void domain_remove_one_dev_info(s
                 domain->iommu_count--;
                 domain_update_iommu_cap(domain);
                 spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
+
+                spin_lock_irqsave(&iommu->lock, tmp_flags);
+                clear_bit(domain->id, iommu->domain_ids);
+                iommu->domains[domain->id] = NULL;
+                spin_unlock_irqrestore(&iommu->lock, tmp_flags);
         }
 
         spin_unlock_irqrestore(&device_domain_lock, flags);
@@ -3730,6 +3741,12 @@ static void __devinit quirk_iommu_rwbf(s
          */
         printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
         rwbf_quirk = 1;
+
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */
+        if (dev->revision == 0x07) {
+                printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
+                dmar_map_gfx = 0;
+        }
 }
 
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -71,6 +71,19 @@ static const struct dmi_system_id __init
                         DMI_MATCH(DMI_CHASSIS_TYPE, "8"),
                 },
         },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_CHASSIS_TYPE, "9"), /*Laptop*/
+                },
+        },
+        {
+                .ident = "Dell Computer Corporation",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
+                        DMI_MATCH(DMI_CHASSIS_TYPE, "8"),
+                },
+        },
         { }
 };
 
@@ -397,3 +410,5 @@ MODULE_AUTHOR("Matthew Garrett <mjg@redh
 MODULE_DESCRIPTION("Dell laptop driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("dmi:*svnDellInc.:*:ct8:*");
+MODULE_ALIAS("dmi:*svnDellInc.:*:ct9:*");
+MODULE_ALIAS("dmi:*svnDellComputerCorporation.:*:ct8:*");
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -63,7 +63,7 @@ static struct dasd_discipline dasd_eckd_
 static struct ccw_device_id dasd_eckd_ids[] = {
         { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3390, 0), .driver_info = 0x1},
         { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3390, 0), .driver_info = 0x2},
-        { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3390, 0), .driver_info = 0x3},
+        { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3380, 0), .driver_info = 0x3},
         { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3380, 0), .driver_info = 0x4},
         { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3380, 0), .driver_info = 0x5},
         { CCW_DEVICE_DEVTYPE (0x9343, 0, 0x9345, 0), .driver_info = 0x6},
--- a/drivers/scsi/device_handler/scsi_dh_emc.c
+++ b/drivers/scsi/device_handler/scsi_dh_emc.c
@@ -272,7 +272,7 @@ static struct request *get_req(struct sc
         int len = 0;
 
         rq = blk_get_request(sdev->request_queue,
-                        (cmd == MODE_SELECT) ? WRITE : READ, GFP_NOIO);
+                        (cmd != INQUIRY) ? WRITE : READ, GFP_NOIO);
         if (!rq) {
                 sdev_printk(KERN_INFO, sdev, "get_req: blk_get_request failed");
                 return NULL;
@@ -284,16 +284,17 @@ static struct request *get_req(struct sc
         switch (cmd) {
         case MODE_SELECT:
                 len = sizeof(short_trespass);
-                rq->cmd_flags |= REQ_RW;
                 rq->cmd[1] = 0x10;
+                rq->cmd[4] = len;
                 break;
         case MODE_SELECT_10:
                 len = sizeof(long_trespass);
-                rq->cmd_flags |= REQ_RW;
                 rq->cmd[1] = 0x10;
+                rq->cmd[8] = len;
                 break;
         case INQUIRY:
                 len = CLARIION_BUFFER_SIZE;
+                rq->cmd[4] = len;
                 memset(buffer, 0, len);
                 break;
         default:
@@ -301,7 +302,6 @@ static struct request *get_req(struct sc
                 break;
         }
 
-        rq->cmd[4] = len;
         rq->cmd_type = REQ_TYPE_BLOCK_PC;
         rq->cmd_flags |= REQ_FAILFAST_DEV | REQ_FAILFAST_TRANSPORT |
                          REQ_FAILFAST_DRIVER;
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -3072,6 +3072,9 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
          * For each user buffer, create a mirror buffer and copy in
          */
         for (i = 0; i < ioc->sge_count; i++) {
+                if (!ioc->sgl[i].iov_len)
+                        continue;
+
                 kbuff_arr[i] = dma_alloc_coherent(&instance->pdev->dev,
                                                     ioc->sgl[i].iov_len,
                                                     &buf_handle, GFP_KERNEL);
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -636,6 +636,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPT
         data_out_sz = karg.data_out_size;
         data_in_sz = karg.data_in_size;
 
+        /* Check for overflow and wraparound */
+        if (karg.data_sge_offset * 4 > ioc->request_sz ||
+            karg.data_sge_offset > (UINT_MAX / 4)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         /* copy in request message frame from user */
         if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
                 printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
@@ -1809,7 +1816,7 @@ _ctl_diag_read_buffer(void __user *arg,
         Mpi2DiagBufferPostReply_t *mpi_reply;
         int rc, i;
         u8 buffer_type;
-        unsigned long timeleft;
+        unsigned long timeleft, request_size, copy_size;
         u16 smid;
         u16 ioc_status;
         u8 issue_reset = 0;
@@ -1845,6 +1852,8 @@ _ctl_diag_read_buffer(void __user *arg,
                 return -ENOMEM;
         }
 
+        request_size = ioc->diag_buffer_sz[buffer_type];
+
         if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
                 printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
                     "or bytes_to_read are not 4 byte aligned\n", ioc->name,
@@ -1852,13 +1861,23 @@ _ctl_diag_read_buffer(void __user *arg,
                 return -EINVAL;
         }
 
+        if (karg.starting_offset > request_size)
+                return -EINVAL;
+
         diag_data = (void *)(request_data + karg.starting_offset);
         dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "
             "offset(%d), sz(%d)\n", ioc->name, __func__,
             diag_data, karg.starting_offset, karg.bytes_to_read));
 
+        /* Truncate data on requests that are too large */
+        if ((diag_data + karg.bytes_to_read < diag_data) ||
+            (diag_data + karg.bytes_to_read > request_data + request_size))
+                copy_size = request_size - karg.starting_offset;
+        else
+                copy_size = karg.bytes_to_read;
+
         if (copy_to_user((void __user *)uarg->diagnostic_data,
-            diag_data, karg.bytes_to_read)) {
+            diag_data, copy_size)) {
                 printk(MPT2SAS_ERR_FMT "%s: Unable to write "
                     "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
                     __func__, diag_data);
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -945,7 +945,7 @@ _scsih_build_scatter_gather(struct MPT2S
         u32 chain_offset;
         u32 chain_length;
         u32 chain_flags;
-        u32 sges_left;
+        int sges_left;
         u32 sges_in_segment;
         u32 sgl_flags;
         u32 sgl_flags_last_element;
@@ -966,7 +966,7 @@ _scsih_build_scatter_gather(struct MPT2S
 
         sg_scmd = scsi_sglist(scmd);
         sges_left = scsi_dma_map(scmd);
-        if (!sges_left) {
+        if (sges_left < 0) {
                 sdev_printk(KERN_ERR, scmd->device, "pci_map_sg"
                 " failed: request for %d bytes!\n", scsi_bufflen(scmd));
                 return -ENOMEM;
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3508,6 +3508,9 @@ static long pmcraid_ioctl_passthrough(
                         rc = -EFAULT;
                         goto out_free_buffer;
                 }
+        } else if (request_size < 0) {
+                rc = -EINVAL;
+                goto out_free_buffer;
         }
 
         /* check if we have any additional command parameters */
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -400,10 +400,15 @@ static inline int scsi_host_is_busy(stru
 static void scsi_run_queue(struct request_queue *q)
 {
         struct scsi_device *sdev = q->queuedata;
-        struct Scsi_Host *shost = sdev->host;
+        struct Scsi_Host *shost;
         LIST_HEAD(starved_list);
         unsigned long flags;
 
+        /* if the device is dead, sdev will be NULL, so no queue to run */
+        if (!sdev)
+                return;
+
+        shost = sdev->host;
         if (scsi_target(sdev)->single_lun)
                 scsi_single_lun_run(sdev);
 
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -318,14 +318,8 @@ static void scsi_device_dev_release_user
                 kfree(evt);
         }
 
-        if (sdev->request_queue) {
-                sdev->request_queue->queuedata = NULL;
-                /* user context needed to free queue */
-                scsi_free_queue(sdev->request_queue);
-                /* temporary expedient, try to catch use of queue lock
-                 * after free of sdev */
-                sdev->request_queue = NULL;
-        }
+        /* NULL queue means the device can't be used */
+        sdev->request_queue = NULL;
 
         scsi_target_reap(scsi_target(sdev));
 
@@ -925,6 +919,12 @@ void __scsi_remove_device(struct scsi_de
         if (sdev->host->hostt->slave_destroy)
                 sdev->host->hostt->slave_destroy(sdev);
         transport_destroy_device(dev);
+
+        /* cause the request function to reject all I/O requests */
+        sdev->request_queue->queuedata = NULL;
+
+        /* Freeing the queue signals to block that we're done */
+        scsi_free_queue(sdev->request_queue);
         put_device(dev);
 }
 
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -382,12 +382,13 @@ static void imx_start_tx(struct uart_por
 static irqreturn_t imx_rtsint(int irq, void *dev_id)
 {
         struct imx_port *sport = dev_id;
-        unsigned int val = readl(sport->port.membase + USR1) & USR1_RTSS;
+        unsigned int val;
         unsigned long flags;
 
         spin_lock_irqsave(&sport->port.lock, flags);
 
         writel(USR1_RTSD, sport->port.membase + USR1);
+        val = readl(sport->port.membase + USR1) & USR1_RTSS;
         uart_handle_cts_change(&sport->port, !!val);
         wake_up_interruptible(&sport->port.state->port.delta_msr_wait);
 
--- a/drivers/staging/rtl8192su/r8192S_firmware.c
+++ b/drivers/staging/rtl8192su/r8192S_firmware.c
@@ -68,6 +68,11 @@ bool FirmwareDownloadCode(struct net_dev
 
                 /* Allocate skb buffer to contain firmware info and tx descriptor info. */
                 skb  = dev_alloc_skb(frag_length);
+                if (skb == NULL) {
+                        RT_TRACE(COMP_ERR, "(%s): unable to alloc skb buffer\n",
+                                                                __func__);
+                        goto cmdsend_downloadcode_fail;
+                }
                 memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
 
                 tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -25,6 +25,7 @@
  */
 
 #include <linux/vmalloc.h>
+#include <linux/notifier.h>
 
 #undef LOOP_TEST
 #undef DUMP_RX
@@ -111,28 +112,30 @@ u32 rt_global_debug_component = \
 #define CAM_CONTENT_COUNT 8
 
 static struct usb_device_id rtl8192_usb_id_tbl[] = {
-        /* Realtek */
-        {USB_DEVICE(0x0bda, 0x8171)},
-        {USB_DEVICE(0x0bda, 0x8192)},
-        {USB_DEVICE(0x0bda, 0x8709)},
-        /* Corega */
-        {USB_DEVICE(0x07aa, 0x0043)},
-        /* Belkin */
-        {USB_DEVICE(0x050d, 0x805E)},
-        {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
-        /* Sitecom */
-        {USB_DEVICE(0x0df6, 0x0031)},
-        {USB_DEVICE(0x0df6, 0x004b)},   /* WL-349 */
-        /* EnGenius */
-        {USB_DEVICE(0x1740, 0x9201)},
-        /* Dlink */
-        {USB_DEVICE(0x2001, 0x3301)},
-        /* Zinwell */
-        {USB_DEVICE(0x5a57, 0x0290)},
-        /* Guillemot */
-        {USB_DEVICE(0x06f8, 0xe031)},
-        //92SU
+        {USB_DEVICE(0x0bda, 0x8171)}, /* Realtek */
         {USB_DEVICE(0x0bda, 0x8172)},
+        {USB_DEVICE(0x0bda, 0x8173)},
+        {USB_DEVICE(0x0bda, 0x8174)},
+        {USB_DEVICE(0x0bda, 0x8712)},
+        {USB_DEVICE(0x0bda, 0x8713)},
+        {USB_DEVICE(0x07aa, 0x0047)},
+        {USB_DEVICE(0x07d1, 0x3303)},
+        {USB_DEVICE(0x07d1, 0x3302)},
+        {USB_DEVICE(0x07d1, 0x3300)},
+        {USB_DEVICE(0x1740, 0x9603)},
+        {USB_DEVICE(0x1740, 0x9605)},
+        {USB_DEVICE(0x050d, 0x815F)},
+        {USB_DEVICE(0x06f8, 0xe031)},
+        {USB_DEVICE(0x7392, 0x7611)},
+        {USB_DEVICE(0x7392, 0x7612)},
+        {USB_DEVICE(0x7392, 0x7622)},
+        {USB_DEVICE(0x0DF6, 0x0045)},
+        {USB_DEVICE(0x0E66, 0x0015)},
+        {USB_DEVICE(0x0E66, 0x0016)},
+        {USB_DEVICE(0x0b05, 0x1786)},
+        /* these are not in the official list */
+        {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
+        {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */
         {}
 };
 
@@ -160,6 +163,8 @@ MODULE_PARM_DESC(channels," Channel bitm
 static int __devinit rtl8192_usb_probe(struct usb_interface *intf,
                          const struct usb_device_id *id);
 static void __devexit rtl8192_usb_disconnect(struct usb_interface *intf);
+static const struct net_device_ops rtl8192_netdev_ops;
+static struct notifier_block proc_netdev_notifier;
 
 static struct usb_driver rtl8192_usb_driver = {
         .name           = RTL819xU_MODULE_NAME,           /* Driver name   */
@@ -959,15 +964,24 @@ static int proc_get_stats_rx(char *page,
         return len;
 }
 
-void rtl8192_proc_module_init(void)
+int rtl8192_proc_module_init(void)
 {
+        int ret;
+
         RT_TRACE(COMP_INIT, "Initializing proc filesystem");
         rtl8192_proc=create_proc_entry(RTL819xU_MODULE_NAME, S_IFDIR, init_net.proc_net);
+        if (!rtl8192_proc)
+                return -ENOMEM;
+        ret = register_netdevice_notifier(&proc_netdev_notifier);
+        if (ret)
+                remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net);
+        return ret;
 }
 
 
 void rtl8192_proc_module_remove(void)
 {
+        unregister_netdevice_notifier(&proc_netdev_notifier);
         remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net);
 }
 
@@ -995,8 +1009,7 @@ void rtl8192_proc_remove_one(struct net_
                 remove_proc_entry("registers-e", priv->dir_dev);
         //      remove_proc_entry("cck-registers",priv->dir_dev);
         //      remove_proc_entry("ofdm-registers",priv->dir_dev);
-                //remove_proc_entry(dev->name, rtl8192_proc);
-                remove_proc_entry("wlan0", rtl8192_proc);
+                remove_proc_entry(priv->dir_dev->name, rtl8192_proc);
                 priv->dir_dev = NULL;
         }
 }
@@ -1113,6 +1126,25 @@ void rtl8192_proc_init_one(struct net_de
                       dev->name);
         }
 }
+
+static int proc_netdev_event(struct notifier_block *this,
+                             unsigned long event, void *ptr)
+{
+        struct net_device *net_dev = ptr;
+
+        if (net_dev->netdev_ops == &rtl8192_netdev_ops &&
+            event == NETDEV_CHANGENAME) {
+                rtl8192_proc_remove_one(net_dev);
+                rtl8192_proc_init_one(net_dev);
+        }
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block proc_netdev_notifier = {
+        .notifier_call = proc_netdev_event,
+};
+
 /****************************************************************************
    -----------------------------MISC STUFF-------------------------
 *****************************************************************************/
@@ -7564,35 +7596,63 @@ static int __init rtl8192_usb_module_ini
         ret = ieee80211_crypto_init();
         if (ret) {
                 printk(KERN_ERR "ieee80211_crypto_init() failed %d\n", ret);
-                return ret;
+                goto fail_crypto;
         }
 
         ret = ieee80211_crypto_tkip_init();
         if (ret) {
                 printk(KERN_ERR "ieee80211_crypto_tkip_init() failed %d\n",
                         ret);
-                return ret;
+                goto fail_crypto_tkip;
         }
 
         ret = ieee80211_crypto_ccmp_init();
         if (ret) {
                 printk(KERN_ERR "ieee80211_crypto_ccmp_init() failed %d\n",
                         ret);
-                return ret;
+                goto fail_crypto_ccmp;
         }
 
         ret = ieee80211_crypto_wep_init();
         if (ret) {
                 printk(KERN_ERR "ieee80211_crypto_wep_init() failed %d\n", ret);
-                return ret;
+                goto fail_crypto_wep;
         }
 
         printk(KERN_INFO "\nLinux kernel driver for RTL8192 based WLAN cards\n");
         printk(KERN_INFO "Copyright (c) 2007-2008, Realsil Wlan\n");
         RT_TRACE(COMP_INIT, "Initializing module");
         RT_TRACE(COMP_INIT, "Wireless extensions version %d", WIRELESS_EXT);
-        rtl8192_proc_module_init();
-        return usb_register(&rtl8192_usb_driver);
+
+        ret = rtl8192_proc_module_init();
+        if (ret) {
+                pr_err("rtl8192_proc_module_init() failed %d\n", ret);
+                goto fail_proc;
+        }
+
+        ret = usb_register(&rtl8192_usb_driver);
+        if (ret) {
+                pr_err("usb_register() failed %d\n", ret);
+                goto fail_usb;
+        }
+
+        return 0;
+
+fail_usb:
+        rtl8192_proc_module_remove();
+fail_proc:
+        ieee80211_crypto_wep_exit();
+fail_crypto_wep:
+        ieee80211_crypto_ccmp_exit();
+fail_crypto_ccmp:
+        ieee80211_crypto_tkip_exit();
+fail_crypto_tkip:
+        ieee80211_crypto_deinit();
+fail_crypto:
+#ifdef CONFIG_IEEE80211_DEBUG
+        ieee80211_debug_exit();
+#endif
+        return ret;
 }
 
 
--- a/drivers/staging/rtl8192su/r819xU_cmdpkt.c
+++ b/drivers/staging/rtl8192su/r819xU_cmdpkt.c
@@ -56,6 +56,12 @@ SendTxCommandPacket(
 
         //Get TCB and local buffer from common pool. (It is shared by CmdQ, MgntQ, and USB coalesce DataQ)
         skb  = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4);
+        if (skb == NULL) {
+                RT_TRACE(COMP_ERR, "(%s): unable to alloc skb buffer\n",
+                                                                __func__);
+                rtStatus = false;
+                return rtStatus;
+        }
         memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
         tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);
         tcb_desc->queue_index = TXCMD_QUEUE;
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -1134,7 +1134,7 @@ static int vhci_hcd_probe(struct platfor
                 usbip_uerr("create hcd failed\n");
                 return -ENOMEM;
         }
-
+        hcd->has_tt = 1;
 
         /* this is private data for vhci_hcd */
         the_controller = hcd_to_vhci(hcd);
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -65,8 +65,8 @@
 #define ALLOW_SERIAL_NUMBER
 
 static const char *format_topo =
-/* T:  Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd */
-"\nT:  Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%3s MxCh=%2d\n";
+/* T:  Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd */
+"\nT:  Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%-4s MxCh=%2d\n";
 
 static const char *format_string_manufacturer =
 /* S:  Manufacturer=xxxx */
@@ -510,11 +510,13 @@ static ssize_t usb_device_dump(char __us
                 speed = "1.5"; break;
         case USB_SPEED_UNKNOWN:         /* usb 1.1 root hub code */
         case USB_SPEED_FULL:
-                speed = "12 "; break;
+                speed = "12"; break;
         case USB_SPEED_HIGH:
                 speed = "480"; break;
+        case USB_SPEED_SUPER:
+                speed = "5000"; break;
         default:
-                speed = "?? ";
+                speed = "??";
         }
         data_end = pages_start + sprintf(pages_start, format_topo,
                         bus->busnum, level, parent_devnum,
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1424,11 +1424,11 @@ void usb_set_device_state(struct usb_dev
                                         || new_state == USB_STATE_SUSPENDED)
                                 ;       /* No change to wakeup settings */
                         else if (new_state == USB_STATE_CONFIGURED)
-                                device_init_wakeup(&udev->dev,
+                                device_set_wakeup_capable(&udev->dev,
                                         (udev->actconfig->desc.bmAttributes
                                          & USB_CONFIG_ATT_WAKEUP));
                         else
-                                device_init_wakeup(&udev->dev, 0);
+                                device_set_wakeup_capable(&udev->dev, 0);
                 }
                 if (udev->state == USB_STATE_SUSPENDED &&
                         new_state != USB_STATE_SUSPENDED)
@@ -1786,10 +1786,17 @@ int usb_new_device(struct usb_device *ud
 {
         int err;
 
-        /* Increment the parent's count of unsuspended children */
-        if (udev->parent)
+        if (udev->parent) {
+                /* Increment the parent's count of unsuspended children */
                 usb_autoresume_device(udev->parent);
 
+                /* Initialize non-root-hub device wakeup to disabled;
+                 * device (un)configuration controls wakeup capable
+                 * sysfs power/wakeup controls wakeup enabled/disabled
+                 */
+                device_init_wakeup(&udev->dev, 0);
+        }
+
         err = usb_enumerate_device(udev);       /* Read descriptors */
         if (err < 0)
                 goto fail;
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1792,6 +1792,7 @@ allocate_instance(struct device *dev,
         INIT_LIST_HEAD(&musb->out_bulk);
 
         hcd->uses_new_polling = 1;
+        hcd->has_tt = 1;
 
         musb->vbuserr_retry = VBUSERR_RETRY_COUNT;
         musb->a_wait_bcon = OTG_TIME_A_WAIT_BCON;
--- a/drivers/video/backlight/mbp_nvidia_bl.c
+++ b/drivers/video/backlight/mbp_nvidia_bl.c
@@ -272,6 +272,24 @@ static const struct dmi_system_id __init
                 },
                 .driver_data    = (void *)&nvidia_chipset_data,
         },
+        {
+                .callback       = mbp_dmi_match,
+                .ident          = "MacBookAir 3,1",
+                .matches        = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,1"),
+                },
+                .driver_data    = (void *)&nvidia_chipset_data,
+        },
+        {
+                .callback       = mbp_dmi_match,
+                .ident          = "MacBookAir 3,2",
+                .matches        = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,2"),
+                },
+                .driver_data    = (void *)&nvidia_chipset_data,
+        },
         { }
 };
 
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -21,6 +21,7 @@
 #include <linux/blkdev.h>
 #include <linux/random.h>
 #include <linux/iocontext.h>
+#include <linux/capability.h>
 #include <asm/div64.h>
 #include "compat.h"
 #include "ctree.h"
@@ -1900,6 +1901,9 @@ int btrfs_balance(struct btrfs_root *dev
         if (dev_root->fs_info->sb->s_flags & MS_RDONLY)
                 return -EROFS;
 
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
         mutex_lock(&dev_root->fs_info->volume_mutex);
         dev_root = dev_root->fs_info->dev_root;
 
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -799,8 +799,7 @@ static int
 cifs_parse_mount_options(char *options, const char *devname,
                          struct smb_vol *vol)
 {
-        char *value;
-        char *data;
+        char *value, *data, *end;
         unsigned int  temp_len, i, j;
         char separator[2];
         short int override_uid = -1;
@@ -843,6 +842,7 @@ cifs_parse_mount_options(char *options,
         if (!options)
                 return 1;
 
+        end = options + strlen(options);
         if (strncmp(options, "sep=", 4) == 0) {
                 if (options[4] != 0) {
                         separator[0] = options[4];
@@ -907,6 +907,7 @@ cifs_parse_mount_options(char *options,
                         the only illegal character in a password is null */
 
                         if ((value[temp_len] == 0) &&
+                            (value + temp_len < end) &&
                             (value[temp_len+1] == separator[0])) {
                                 /* reinsert comma */
                                 value[temp_len] = separator[0];
@@ -2230,6 +2231,11 @@ is_path_accessible(int xid, struct cifsT
                               0 /* not legacy */, cifs_sb->local_nls,
                               cifs_sb->mnt_cifs_flags &
                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
+
+        if (rc == -EOPNOTSUPP || rc == -EINVAL)
+                rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
+                                cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+                                  CIFS_MOUNT_MAP_SPECIAL_CHR);
         kfree(pfile_info);
         return rc;
 }
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -688,8 +688,10 @@ struct inode *cifs_root_iget(struct supe
                 rc = cifs_get_inode_info(&inode, full_path, NULL, sb,
                                                 xid, NULL);
 
-        if (!inode)
-                return ERR_PTR(-ENOMEM);
+        if (!inode) {
+                inode = ERR_PTR(rc);
+                goto out;
+        }
 
         if (rc && cifs_sb->tcon->ipc) {
                 cFYI(1, ("ipc connection - fake read inode"));
@@ -700,13 +702,11 @@ struct inode *cifs_root_iget(struct supe
                 inode->i_uid = cifs_sb->mnt_uid;
                 inode->i_gid = cifs_sb->mnt_gid;
         } else if (rc) {
-                kfree(full_path);
-                _FreeXid(xid);
                 iget_failed(inode);
-                return ERR_PTR(rc);
+                inode = ERR_PTR(rc);
         }
 
-
+out:
         kfree(full_path);
         /* can not call macro FreeXid here since in a void func
          * TODO: This is no longer true
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -906,7 +906,9 @@ ssetup_ntlmssp_authenticate:
         }
 
         /* BB check if Unicode and decode strings */
-        if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
+        if (bytes_remaining == 0) {
+                /* no string area to decode, do nothing */
+        } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
                 /* unicode string area must be word-aligned */
                 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
                         ++bcc_ptr;
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -15,7 +15,7 @@
  * fuzziness in the current usage value of IDs that are being used on different
  * nodes in the cluster simultaneously.  So, it is possible for a user on
  * multiple nodes to overrun their quota, but that overrun is controlable.
- * Since quota tags are part of transactions, there is no need to a quota check
+ * Since quota tags are part of transactions, there is no need for a quota check
  * program to be run on node crashes or anything like that.
  *
  * There are couple of knobs that let the administrator manage the quota
@@ -65,13 +65,6 @@
 #define QUOTA_USER 1
 #define QUOTA_GROUP 0
 
-struct gfs2_quota_host {
-        u64 qu_limit;
-        u64 qu_warn;
-        s64 qu_value;
-        u32 qu_ll_next;
-};
-
 struct gfs2_quota_change_host {
         u64 qc_change;
         u32 qc_flags; /* GFS2_QCF_... */
@@ -617,33 +610,19 @@ static void do_qc(struct gfs2_quota_data
         mutex_unlock(&sdp->sd_quota_mutex);
 }
 
-static void gfs2_quota_in(struct gfs2_quota_host *qu, const void *buf)
-{
-        const struct gfs2_quota *str = buf;
-
-        qu->qu_limit = be64_to_cpu(str->qu_limit);
-        qu->qu_warn = be64_to_cpu(str->qu_warn);
-        qu->qu_value = be64_to_cpu(str->qu_value);
-        qu->qu_ll_next = be32_to_cpu(str->qu_ll_next);
-}
-
-static void gfs2_quota_out(const struct gfs2_quota_host *qu, void *buf)
-{
-        struct gfs2_quota *str = buf;
-
-        str->qu_limit = cpu_to_be64(qu->qu_limit);
-        str->qu_warn = cpu_to_be64(qu->qu_warn);
-        str->qu_value = cpu_to_be64(qu->qu_value);
-        str->qu_ll_next = cpu_to_be32(qu->qu_ll_next);
-        memset(&str->qu_reserved, 0, sizeof(str->qu_reserved));
-}
-
 /**
- * gfs2_adjust_quota
+ * gfs2_adjust_quota - adjust record of current block usage
+ * @ip: The quota inode
+ * @loc: Offset of the entry in the quota file
+ * @change: The amount of change to record
+ * @qd: The quota data
  *
  * This function was mostly borrowed from gfs2_block_truncate_page which was
  * in turn mostly borrowed from ext3
+ *
+ * Returns: 0 or -ve on error
  */
+
 static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
                              s64 change, struct gfs2_quota_data *qd)
 {
@@ -654,15 +633,29 @@ static int gfs2_adjust_quota(struct gfs2
         unsigned blocksize, iblock, pos;
         struct buffer_head *bh;
         struct page *page;
-        void *kaddr;
-        char *ptr;
-        struct gfs2_quota_host qp;
-        s64 value;
-        int err = -EIO;
+        void *kaddr, *ptr;
+        struct gfs2_quota q, *qp;
+        int err, nbytes;
 
         if (gfs2_is_stuffed(ip))
                 gfs2_unstuff_dinode(ip, NULL);
-        
+
+        memset(&q, 0, sizeof(struct gfs2_quota));
+        err = gfs2_internal_read(ip, NULL, (char *)&q, &loc, sizeof(q));
+        if (err < 0)
+                return err;
+
+        err = -EIO;
+        qp = &q;
+        qp->qu_value = be64_to_cpu(qp->qu_value);
+        qp->qu_value += change;
+        qp->qu_value = cpu_to_be64(qp->qu_value);
+        qd->qd_qb.qb_value = qp->qu_value;
+
+        /* Write the quota into the quota file on disk */
+        ptr = qp;
+        nbytes = sizeof(struct gfs2_quota);
+get_a_page:
         page = grab_cache_page(mapping, index);
         if (!page)
                 return -ENOMEM;
@@ -684,7 +677,10 @@ static int gfs2_adjust_quota(struct gfs2
         if (!buffer_mapped(bh)) {
                 gfs2_block_map(inode, iblock, bh, 1);
                 if (!buffer_mapped(bh))
-                        goto unlock;
+                        goto unlock_out;
+                /* If it's a newly allocated disk block for quota, zero it */
+                if (buffer_new(bh))
+                        zero_user(page, pos - blocksize, bh->b_size);
         }
 
         if (PageUptodate(page))
@@ -694,25 +690,32 @@ static int gfs2_adjust_quota(struct gfs2
                 ll_rw_block(READ_META, 1, &bh);
                 wait_on_buffer(bh);
                 if (!buffer_uptodate(bh))
-                        goto unlock;
+                        goto unlock_out;
         }
 
         gfs2_trans_add_bh(ip->i_gl, bh, 0);
 
         kaddr = kmap_atomic(page, KM_USER0);
-        ptr = kaddr + offset;
-        gfs2_quota_in(&qp, ptr);
-        qp.qu_value += change;
-        value = qp.qu_value;
-        gfs2_quota_out(&qp, ptr);
+        if (offset + sizeof(struct gfs2_quota) > PAGE_CACHE_SIZE)
+                nbytes = PAGE_CACHE_SIZE - offset;
+        memcpy(kaddr + offset, ptr, nbytes);
         flush_dcache_page(page);
         kunmap_atomic(kaddr, KM_USER0);
+        unlock_page(page);
+        page_cache_release(page);
+
+        /* If quota straddles page boundary, we need to update the rest of the
+         * quota at the beginning of the next page */
+        if ((offset + sizeof(struct gfs2_quota)) > PAGE_CACHE_SIZE) {
+                ptr = ptr + nbytes;
+                nbytes = sizeof(struct gfs2_quota) - nbytes;
+                offset = 0;
+                index++;
+                goto get_a_page;
+        }
         err = 0;
-        qd->qd_qb.qb_magic = cpu_to_be32(GFS2_MAGIC);
-        qd->qd_qb.qb_value = cpu_to_be64(value);
-        ((struct gfs2_quota_lvb*)(qd->qd_gl->gl_lvb))->qb_magic = cpu_to_be32(GFS2_MAGIC);
-        ((struct gfs2_quota_lvb*)(qd->qd_gl->gl_lvb))->qb_value = cpu_to_be64(value);
-unlock:
+        return err;
+unlock_out:
         unlock_page(page);
         page_cache_release(page);
         return err;
@@ -740,8 +743,7 @@ static int do_sync(unsigned int num_qd,
 
         sort(qda, num_qd, sizeof(struct gfs2_quota_data *), sort_qd, NULL);
         for (qx = 0; qx < num_qd; qx++) {
-                error = gfs2_glock_nq_init(qda[qx]->qd_gl,
-                                           LM_ST_EXCLUSIVE,
+                error = gfs2_glock_nq_init(qda[qx]->qd_gl, LM_ST_EXCLUSIVE,
                                            GL_NOCACHE, &ghs[qx]);
                 if (error)
                         goto out;
@@ -776,8 +778,10 @@ static int do_sync(unsigned int num_qd,
          * rgrp since it won't be allocated during the transaction
          */
         al->al_requested = 1;
-        /* +1 in the end for block requested above for unstuffing */
-        blocks = num_qd * data_blocks + RES_DINODE + num_qd + 1;
+        /* +3 in the end for unstuffing block, inode size update block
+         * and another block in case quota straddles page boundary and
+         * two blocks need to be updated instead of 1 */
+        blocks = num_qd * data_blocks + RES_DINODE + num_qd + 3;
 
         if (nalloc)
                 al->al_requested += nalloc * (data_blocks + ind_blocks);                
@@ -796,8 +800,7 @@ static int do_sync(unsigned int num_qd,
                 qd = qda[x];
                 offset = qd2offset(qd);
                 error = gfs2_adjust_quota(ip, offset, qd->qd_change_sync,
-                                          (struct gfs2_quota_data *)
-                                          qd);
+                                          (struct gfs2_quota_data *)qd);
                 if (error)
                         goto out_end_trans;
 
@@ -828,8 +831,7 @@ static int do_glock(struct gfs2_quota_da
         struct gfs2_sbd *sdp = qd->qd_gl->gl_sbd;
         struct gfs2_inode *ip = GFS2_I(sdp->sd_quota_inode);
         struct gfs2_holder i_gh;
-        struct gfs2_quota_host q;
-        char buf[sizeof(struct gfs2_quota)];
+        struct gfs2_quota q;
         int error;
         struct gfs2_quota_lvb *qlvb;
 
@@ -853,22 +855,23 @@ restart:
                 if (error)
                         goto fail;
 
-                memset(buf, 0, sizeof(struct gfs2_quota));
+                memset(&q, 0, sizeof(struct gfs2_quota));
                 pos = qd2offset(qd);
-                error = gfs2_internal_read(ip, NULL, buf, &pos,
-                                           sizeof(struct gfs2_quota));
+                error = gfs2_internal_read(ip, NULL, (char *)&q, &pos, sizeof(q));
                 if (error < 0)
                         goto fail_gunlock;
-
+                if ((error < sizeof(q)) && force_refresh) {
+                        error = -ENOENT;
+                        goto fail_gunlock;
+                }
                 gfs2_glock_dq_uninit(&i_gh);
 
-                gfs2_quota_in(&q, buf);
                 qlvb = (struct gfs2_quota_lvb *)qd->qd_gl->gl_lvb;
                 qlvb->qb_magic = cpu_to_be32(GFS2_MAGIC);
                 qlvb->__pad = 0;
-                qlvb->qb_limit = cpu_to_be64(q.qu_limit);
-                qlvb->qb_warn = cpu_to_be64(q.qu_warn);
-                qlvb->qb_value = cpu_to_be64(q.qu_value);
+                qlvb->qb_limit = q.qu_limit;
+                qlvb->qb_warn = q.qu_warn;
+                qlvb->qb_value = q.qu_value;
                 qd->qd_qb = *qlvb;
 
                 if (gfs2_glock_is_blocking(qd->qd_gl)) {
@@ -1127,7 +1130,6 @@ int gfs2_quota_refresh(struct gfs2_sbd *
                 gfs2_glock_dq_uninit(&q_gh);
 
         qd_put(qd);
-
         return error;
 }
 
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -861,9 +861,10 @@ out:
         return ret;
 }
 
-static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
+        unsigned long ret = 0;
 
         if ((fattr->valid & NFS_ATTR_FATTR_PRECHANGE)
                         && (fattr->valid & NFS_ATTR_FATTR_CHANGE)
@@ -871,25 +872,32 @@ static void nfs_wcc_update_inode(struct
                 nfsi->change_attr = fattr->change_attr;
                 if (S_ISDIR(inode->i_mode))
                         nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                ret |= NFS_INO_INVALID_ATTR;
         }
         /* If we have atomic WCC data, we may update some attributes */
         if ((fattr->valid & NFS_ATTR_FATTR_PRECTIME)
                         && (fattr->valid & NFS_ATTR_FATTR_CTIME)
-                        && timespec_equal(&inode->i_ctime, &fattr->pre_ctime))
-                        memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+                        && timespec_equal(&inode->i_ctime, &fattr->pre_ctime)) {
+                memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+                ret |= NFS_INO_INVALID_ATTR;
+        }
 
         if ((fattr->valid & NFS_ATTR_FATTR_PREMTIME)
                         && (fattr->valid & NFS_ATTR_FATTR_MTIME)
                         && timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) {
-                        memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
-                        if (S_ISDIR(inode->i_mode))
-                                nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
+                if (S_ISDIR(inode->i_mode))
+                        nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                ret |= NFS_INO_INVALID_ATTR;
         }
         if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE)
                         && (fattr->valid & NFS_ATTR_FATTR_SIZE)
                         && i_size_read(inode) == nfs_size_to_loff_t(fattr->pre_size)
-                        && nfsi->npages == 0)
-                        i_size_write(inode, nfs_size_to_loff_t(fattr->size));
+                        && nfsi->npages == 0) {
+                i_size_write(inode, nfs_size_to_loff_t(fattr->size));
+                ret |= NFS_INO_INVALID_ATTR;
+        }
+        return ret;
 }
 
 /**
@@ -1183,7 +1191,7 @@ static int nfs_update_inode(struct inode
                         | NFS_INO_REVAL_PAGECACHE);
 
         /* Do atomic weak cache consistency updates */
-        nfs_wcc_update_inode(inode, fattr);
+        invalid |= nfs_wcc_update_inode(inode, fattr);
 
         /* More cache consistency checks */
         if (fattr->valid & NFS_ATTR_FATTR_CHANGE) {
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3133,6 +3133,35 @@ static void buf_to_pages(const void *buf
         }
 }
 
+static int buf_to_pages_noslab(const void *buf, size_t buflen,
+                struct page **pages, unsigned int *pgbase)
+{
+        struct page *newpage, **spages;
+        int rc = 0;
+        size_t len;
+        spages = pages;
+
+        do {
+                len = min_t(size_t, PAGE_CACHE_SIZE, buflen);
+                newpage = alloc_page(GFP_KERNEL);
+
+                if (newpage == NULL)
+                        goto unwind;
+                memcpy(page_address(newpage), buf, len);
+                buf += len;
+                buflen -= len;
+                *pages++ = newpage;
+                rc++;
+        } while (buflen != 0);
+
+        return rc;
+
+unwind:
+        for(; rc > 0; rc--)
+                __free_page(spages[rc-1]);
+        return -ENOMEM;
+}
+
 struct nfs4_cached_acl {
         int cached;
         size_t len;
@@ -3299,13 +3328,23 @@ static int __nfs4_proc_set_acl(struct in
                 .rpc_argp       = &arg,
                 .rpc_resp       = &res,
         };
-        int ret;
+        int ret, i;
 
         if (!nfs4_server_supports_acls(server))
                 return -EOPNOTSUPP;
+        i = buf_to_pages_noslab(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
+        if (i < 0)
+                return i;
         nfs_inode_return_delegation(inode);
-        buf_to_pages(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
         ret = nfs4_call_sync(server, &msg, &arg, &res, 1);
+
+        /*
+         * Free each page after tx, so the only ref left is
+         * held by the network stack
+         */
+        for (; i > 0; i--)
+                put_page(pages[i-1]);
+
         nfs_access_zap_cache(inode);
         nfs_zap_acl_cache(inode);
         return ret;
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1228,7 +1228,7 @@ static void nfs4_state_manager(struct nf
         int status = 0;
 
         /* Ensure exclusive access to NFSv4 state */
-        for(;;) {
+        do {
                 if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) {
                         /* We're going to have to re-establish a clientid */
                         status = nfs4_reclaim_lease(clp);
@@ -1304,7 +1304,7 @@ static void nfs4_state_manager(struct nf
                         break;
                 if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
                         break;
-        }
+        } while (atomic_read(&clp->cl_count) > 1);
         return;
 out_error:
         printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1925,6 +1925,15 @@ nfs_remount(struct super_block *sb, int
         if (error < 0)
                 goto out;
 
+        /*
+         * noac is a special case. It implies -o sync, but that's not
+         * necessarily reflected in the mtab options. do_remount_sb
+         * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the
+         * remount options, so we have to explicitly reset it.
+         */
+        if (data->flags & NFS_MOUNT_NOAC)
+                *flags |= MS_SYNCHRONOUS;
+
         /* compare new mount options with old ones */
         error = nfs_compare_remount_data(nfss, data);
 out:
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1379,7 +1379,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, s
                 goto out;
         if (!(iap->ia_valid & ATTR_MODE))
                 iap->ia_mode = 0;
-        err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
+        err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
         if (err)
                 goto out;
 
@@ -1401,6 +1401,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, s
         if (IS_ERR(dchild))
                 goto out_nfserr;
 
+        /* If file doesn't exist, check for permissions to create one */
+        if (!dchild->d_inode) {
+                err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
+                if (err)
+                        goto out;
+        }
+
         err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
         if (err)
                 goto out;
--- a/fs/partitions/efi.c
+++ b/fs/partitions/efi.c
@@ -349,6 +349,12 @@ is_gpt_valid(struct block_device *bdev,
                 goto fail;
         }
 
+        /* Check that sizeof_partition_entry has the correct value */
+        if (le32_to_cpu((*gpt)->sizeof_partition_entry) != sizeof(gpt_entry)) {
+                pr_debug("GUID Partitition Entry Size check failed.\n");
+                goto fail;
+        }
+
         if (!(*ptes = alloc_read_gpt_entries(bdev, *gpt)))
                 goto fail;
 
--- a/fs/partitions/ldm.c
+++ b/fs/partitions/ldm.c
@@ -1299,6 +1299,11 @@ static bool ldm_frag_add (const u8 *data
 
         BUG_ON (!data || !frags);
 
+        if (size < 2 * VBLK_SIZE_HEAD) {
+                ldm_error("Value of size is to small.");
+                return false;
+        }
+
         group = get_unaligned_be32(data + 0x08);
         rec   = get_unaligned_be16(data + 0x0C);
         num   = get_unaligned_be16(data + 0x0E);
@@ -1306,6 +1311,10 @@ static bool ldm_frag_add (const u8 *data
                 ldm_error ("A VBLK claims to have %d parts.", num);
                 return false;
         }
+        if (rec >= num) {
+                ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
+                return false;
+        }
 
         list_for_each (item, frags) {
                 f = list_entry (item, struct frag, list);
@@ -1334,10 +1343,9 @@ found:
 
         f->map |= (1 << rec);
 
-        if (num > 0) {
-                data += VBLK_SIZE_HEAD;
-                size -= VBLK_SIZE_HEAD;
-        }
+        data += VBLK_SIZE_HEAD;
+        size -= VBLK_SIZE_HEAD;
+
         memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
 
         return true;
--- a/fs/partitions/osf.c
+++ b/fs/partitions/osf.c
@@ -10,10 +10,13 @@
 #include "check.h"
 #include "osf.h"
 
+#define MAX_OSF_PARTITIONS 18
+
 int osf_partition(struct parsed_partitions *state, struct block_device *bdev)
 {
         int i;
         int slot = 1;
+        unsigned int npartitions;
         Sector sect;
         unsigned char *data;
         struct disklabel {
@@ -45,7 +48,7 @@ int osf_partition(struct parsed_partitio
                         u8  p_fstype;
                         u8  p_frag;
                         __le16 p_cpg;
-                } d_partitions[8];
+                } d_partitions[MAX_OSF_PARTITIONS];
         } * label;
         struct d_partition * partition;
 
@@ -63,7 +66,12 @@ int osf_partition(struct parsed_partitio
                 put_dev_sector(sect);
                 return 0;
         }
-        for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {
+        npartitions = le16_to_cpu(label->d_npartitions);
+        if (npartitions > MAX_OSF_PARTITIONS) {
+                put_dev_sector(sect);
+                return 0;
+        }
+        for (i = 0 ; i < npartitions; i++, partition++) {
                 if (slot == state->limit)
                         break;
                 if (le32_to_cpu(partition->p_size))
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -299,6 +299,32 @@ int ubifs_recover_master_node(struct ubi
                         goto out_free;
                 }
                 memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ);
+
+                /*
+                 * We had to recover the master node, which means there was an
+                 * unclean reboot. However, it is possible that the master node
+                 * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set.
+                 * E.g., consider the following chain of events:
+                 *
+                 * 1. UBIFS was cleanly unmounted, so the master node is clean
+                 * 2. UBIFS is being mounted R/W and starts changing the master
+                 *    node in the first (%UBIFS_MST_LNUM). A power cut happens,
+                 *    so this LEB ends up with some amount of garbage at the
+                 *    end.
+                 * 3. UBIFS is being mounted R/O. We reach this place and
+                 *    recover the master node from the second LEB
+                 *    (%UBIFS_MST_LNUM + 1). But we cannot update the media
+                 *    because we are being mounted R/O. We have to defer the
+                 *    operation.
+                 * 4. However, this master node (@c->mst_node) is marked as
+                 *    clean (since the step 1). And if we just return, the
+                 *    mount code will be confused and won't recover the master
+                 *    node when it is re-mounter R/W later.
+                 *
+                 *    Thus, to force the recovery by marking the master node as
+                 *    dirty.
+                 */
+                c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
         } else {
                 /* Write the recovered master node */
                 c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1;
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -120,6 +120,7 @@ struct mmc_host {
         unsigned int            f_min;
         unsigned int            f_max;
         u32                     ocr_avail;
+        struct notifier_block   pm_notify;
 
 #define MMC_VDD_165_195         0x00000080      /* VDD voltage 1.65 - 1.95 */
 #define MMC_VDD_20_21           0x00000100      /* VDD voltage 2.0 ~ 2.1 */
@@ -177,6 +178,7 @@ struct mmc_host {
 
         /* Only used with MMC_CAP_DISABLE */
         int                     enabled;        /* host is enabled */
+        int                     rescan_disable; /* disable card detection */
         int                     nesting_cnt;    /* "enable" nesting count */
         int                     en_dis_recurs;  /* detect recursion */
         unsigned int            disable_delay;  /* disable delay in msecs */
@@ -294,6 +296,7 @@ int mmc_card_can_sleep(struct mmc_host *
 int mmc_host_enable(struct mmc_host *host);
 int mmc_host_disable(struct mmc_host *host);
 int mmc_host_lazy_disable(struct mmc_host *host);
+int mmc_pm_notify(struct notifier_block *notify_block, unsigned long, void *);
 
 static inline void mmc_set_disable_delay(struct mmc_host *host,
                                          unsigned int disable_delay)
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -10,6 +10,7 @@ extern void unix_inflight(struct file *f
 extern void unix_notinflight(struct file *fp);
 extern void unix_gc(void);
 extern void wait_for_unix_gc(void);
+extern struct sock *unix_get_socket(struct file *filp);
 
 #define UNIX_HASH_SIZE  256
 
@@ -56,6 +57,7 @@ struct unix_sock {
         spinlock_t              lock;
         unsigned int            gc_candidate : 1;
         unsigned int            gc_maybe_cycle : 1;
+        unsigned char           recursion_level;
         wait_queue_head_t       peer_wait;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1700,6 +1700,12 @@ void ieee80211_rx(struct ieee80211_hw *h
  */
 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb);
 
+/*
+ * The TX headroom reserved by mac80211 for its own tx_status functions.
+ * This is enough for the radiotap header.
+ */
+#define IEEE80211_TX_STATUS_HEADROOM    13
+
 /**
  * ieee80211_tx_status - transmit status callback
  *
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1068,6 +1068,7 @@ config SLAB
           per cpu and per node queues.
 
 config SLUB
+        depends on BROKEN || NUMA || !DISCONTIGMEM
         bool "SLUB (Unqueued Allocator)"
         help
            SLUB is a slab allocator that minimizes cache line usage
--- a/init/main.c
+++ b/init/main.c
@@ -407,16 +407,24 @@ static void __init setup_command_line(ch
  * gcc-3.4 accidentally inlines this function, so use noinline.
  */
 
+static __initdata DECLARE_COMPLETION(kthreadd_done);
+
 static noinline void __init_refok rest_init(void)
         __releases(kernel_lock)
 {
         int pid;
 
         rcu_scheduler_starting();
+        /*
+         * We need to spawn init first so that it obtains pid-1, however
+         * the init task will end up wanting to create kthreads, which, if
+         * we schedule it before we create kthreadd, will OOPS.
+         */
         kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);
         numa_default_policy();
         pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES);
         kthreadd_task = find_task_by_pid_ns(pid, &init_pid_ns);
+        complete(&kthreadd_done);
         unlock_kernel();
 
         /*
@@ -843,6 +851,10 @@ static noinline int init_post(void)
 
 static int __init kernel_init(void * unused)
 {
+        /*
+         * Wait until kthreadd is all set-up.
+         */
+        wait_for_completion(&kthreadd_done);
         lock_kernel();
 
         /*
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -561,8 +561,8 @@ int clocksource_register(struct clocksou
 
         mutex_lock(&clocksource_mutex);
         clocksource_enqueue(cs);
-        clocksource_select();
         clocksource_enqueue_watchdog(cs);
+        clocksource_select();
         mutex_unlock(&clocksource_mutex);
         return 0;
 }
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -523,10 +523,11 @@ static void tick_broadcast_init_next_eve
  */
 void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
+        int cpu = smp_processor_id();
+
         /* Set it up only once ! */
         if (bc->event_handler != tick_handle_oneshot_broadcast) {
                 int was_periodic = bc->mode == CLOCK_EVT_MODE_PERIODIC;
-                int cpu = smp_processor_id();
 
                 bc->event_handler = tick_handle_oneshot_broadcast;
                 clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
@@ -552,6 +553,15 @@ void tick_broadcast_setup_oneshot(struct
                         tick_broadcast_set_event(tick_next_period, 1);
                 } else
                         bc->next_event.tv64 = KTIME_MAX;
+        } else {
+                /*
+                 * The first cpu which switches to oneshot mode sets
+                 * the bit for all other cpus which are in the general
+                 * (periodic) broadcast mask. So the bit is set and
+                 * would prevent the first broadcast enter after this
+                 * to program the bc device.
+                 */
+                tick_broadcast_clear_oneshot(cpu);
         }
 }
 
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -168,8 +168,15 @@ int __read_mostly timekeeping_suspended;
 static struct timespec xtime_cache __attribute__ ((aligned (16)));
 void update_xtime_cache(u64 nsec)
 {
-        xtime_cache = xtime;
-        timespec_add_ns(&xtime_cache, nsec);
+        /*
+         * Use temporary variable so get_seconds() cannot catch
+         * an intermediate xtime_cache.tv_sec value.
+         * The ACCESS_ONCE() keeps the compiler from optimizing
+         * out the intermediate value.
+         */
+        struct timespec ts = xtime;
+        timespec_add_ns(&ts, nsec);
+        ACCESS_ONCE(xtime_cache) = ts;
 }
 
 /* must hold xtime_lock */
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1425,9 +1425,14 @@ static int bcm_init(struct sock *sk)
 static int bcm_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
-        struct bcm_sock *bo = bcm_sk(sk);
+        struct bcm_sock *bo;
         struct bcm_op *op, *next;
 
+        if (sk == NULL)
+                return 0;
+
+        bo = bcm_sk(sk);
+
         /* remove bcm_ops, timer, rx_unregister(), etc. */
 
         unregister_netdevice_notifier(&bo->notifier);
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -280,7 +280,12 @@ static int raw_init(struct sock *sk)
 static int raw_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
-        struct raw_sock *ro = raw_sk(sk);
+        struct raw_sock *ro;
+
+        if (!sk)
+                return 0;
+
+        ro = raw_sk(sk);
 
         unregister_netdevice_notifier(&ro->notifier);
 
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -131,6 +131,8 @@ int dccp_parse_options(struct sock *sk,
                 case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:
                         if (pkt_type == DCCP_PKT_DATA)      /* RFC 4340, 6 */
                                 break;
+                        if (len == 0)
+                                goto out_invalid_option;
                         rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,
                                                     *value, value + 1, len - 1);
                         if (rc)
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -30,6 +30,7 @@
 #include <linux/wireless.h>
 #include <linux/skbuff.h>
 #include <linux/udp.h>
+#include <linux/vmalloc.h>
 #include <net/sock.h>
 #include <net/inet_common.h>
 #include <linux/stat.h>
@@ -275,12 +276,12 @@ static int econet_sendmsg(struct kiocb *
 #endif
 #ifdef CONFIG_ECONET_AUNUDP
         struct msghdr udpmsg;
-        struct iovec iov[msg->msg_iovlen+1];
+        struct iovec iov[2];
         struct aunhdr ah;
         struct sockaddr_in udpdest;
         __kernel_size_t size;
-        int i;
         mm_segment_t oldfs;
+        char *userbuf;
 #endif
 
         /*
@@ -318,17 +319,17 @@ static int econet_sendmsg(struct kiocb *
                 }
         }
 
-        if (len + 15 > dev->mtu) {
-                mutex_unlock(&econet_mutex);
-                return -EMSGSIZE;
-        }
-
         if (dev->type == ARPHRD_ECONET) {
                 /* Real hardware Econet.  We're not worthy etc. */
 #ifdef CONFIG_ECONET_NATIVE
                 unsigned short proto = 0;
                 int res;
 
+                if (len + 15 > dev->mtu) {
+                        mutex_unlock(&econet_mutex);
+                        return -EMSGSIZE;
+                }
+
                 dev_hold(dev);
 
                 skb = sock_alloc_send_skb(sk, len+LL_ALLOCATED_SPACE(dev),
@@ -404,6 +405,11 @@ static int econet_sendmsg(struct kiocb *
                 return -ENETDOWN;               /* No socket - can't send */
         }
 
+        if (len > 32768) {
+                err = -E2BIG;
+                goto error;
+        }
+
         /* Make up a UDP datagram and hand it off to some higher intellect. */
 
         memset(&udpdest, 0, sizeof(udpdest));
@@ -435,36 +441,26 @@ static int econet_sendmsg(struct kiocb *
 
         /* tack our header on the front of the iovec */
         size = sizeof(struct aunhdr);
-        /*
-         * XXX: that is b0rken.  We can't mix userland and kernel pointers
-         * in iovec, since on a lot of platforms copy_from_user() will
-         * *not* work with the kernel and userland ones at the same time,
-         * regardless of what we do with set_fs().  And we are talking about
-         * econet-over-ethernet here, so "it's only ARM anyway" doesn't
-         * apply.  Any suggestions on fixing that code?         -- AV
-         */
         iov[0].iov_base = (void *)&ah;
         iov[0].iov_len = size;
-        for (i = 0; i < msg->msg_iovlen; i++) {
-                void __user *base = msg->msg_iov[i].iov_base;
-                size_t len = msg->msg_iov[i].iov_len;
-                /* Check it now since we switch to KERNEL_DS later. */
-                if (!access_ok(VERIFY_READ, base, len)) {
-                        mutex_unlock(&econet_mutex);
-                        return -EFAULT;
-                }
-                iov[i+1].iov_base = base;
-                iov[i+1].iov_len = len;
-                size += len;
+
+        userbuf = vmalloc(len);
+        if (userbuf == NULL) {
+                err = -ENOMEM;
+                goto error;
         }
 
+        iov[1].iov_base = userbuf;
+        iov[1].iov_len = len;
+        err = memcpy_fromiovec(userbuf, msg->msg_iov, len);
+        if (err)
+                goto error_free_buf;
+
         /* Get a skbuff (no data, just holds our cb information) */
         if ((skb = sock_alloc_send_skb(sk, 0,
                                        msg->msg_flags & MSG_DONTWAIT,
-                                       &err)) == NULL) {
-                mutex_unlock(&econet_mutex);
-                return err;
-        }
+                                       &err)) == NULL)
+                goto error_free_buf;
 
         eb = (struct ec_cb *)&skb->cb;
 
@@ -480,7 +476,7 @@ static int econet_sendmsg(struct kiocb *
         udpmsg.msg_name = (void *)&udpdest;
         udpmsg.msg_namelen = sizeof(udpdest);
         udpmsg.msg_iov = &iov[0];
-        udpmsg.msg_iovlen = msg->msg_iovlen + 1;
+        udpmsg.msg_iovlen = 2;
         udpmsg.msg_control = NULL;
         udpmsg.msg_controllen = 0;
         udpmsg.msg_flags=0;
@@ -488,9 +484,13 @@ static int econet_sendmsg(struct kiocb *
         oldfs = get_fs(); set_fs(KERNEL_DS);    /* More privs :-) */
         err = sock_sendmsg(udpsock, &udpmsg, size);
         set_fs(oldfs);
+
+error_free_buf:
+        vfree(userbuf);
 #else
         err = -EPROTOTYPE;
 #endif
+        error:
         mutex_unlock(&econet_mutex);
 
         return err;
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -867,8 +867,10 @@ int ip_append_data(struct sock *sk,
             !exthdrlen)
                 csummode = CHECKSUM_PARTIAL;
 
+        skb = skb_peek_tail(&sk->sk_write_queue);
+
         inet->cork.length += length;
-        if (((length> mtu) || !skb_queue_empty(&sk->sk_write_queue)) &&
+        if (((length > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->u.dst.dev->features & NETIF_F_UFO)) {
                 err = ip_ufo_append_data(sk, getfrag, from, length, hh_len,
@@ -886,7 +888,7 @@ int ip_append_data(struct sock *sk,
          * adding appropriate IP header.
          */
 
-        if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
+        if (!skb)
                 goto alloc_new_skb;
 
         while (length > 0) {
@@ -1115,7 +1117,8 @@ ssize_t    ip_append_page(struct sock *sk,
                 return -EINVAL;
 
         inet->cork.length += size;
-        if ((sk->sk_protocol == IPPROTO_UDP) &&
+        if ((size + skb->len > mtu) &&
+            (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->u.dst.dev->features & NETIF_F_UFO)) {
                 skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -407,9 +407,6 @@ static struct inet6_dev * ipv6_add_dev(s
             dev->type == ARPHRD_TUNNEL6 ||
             dev->type == ARPHRD_SIT ||
             dev->type == ARPHRD_NONE) {
-                printk(KERN_INFO
-                       "%s: Disabled Privacy Extensions\n",
-                       dev->name);
                 ndev->cnf.use_tempaddr = -1;
         } else {
                 in6_dev_hold(ndev);
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -859,6 +859,8 @@ int ieee80211_register_hw(struct ieee802
          * and we need some headroom for passing the frame to monitor
          * interfaces, but never both at the same time.
          */
+        BUILD_BUG_ON(IEEE80211_TX_STATUS_HEADROOM !=
+                        sizeof(struct ieee80211_tx_status_rtap_hdr));
         local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
                                    sizeof(struct ieee80211_tx_status_rtap_hdr));
 
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -225,6 +225,9 @@ static int phonet_device_notify(struct n
 {
         struct net_device *dev = arg;
 
+        if (!net_eq(dev_net(dev), &init_net))
+                return 0;
+
         switch (what) {
         case NETDEV_REGISTER:
                 if (dev->type == ARPHRD_PHONET)
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1343,10 +1343,11 @@ static void xs_tcp_state_change(struct s
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
         dprintk("RPC:       xs_tcp_state_change client %p...\n", xprt);
-        dprintk("RPC:       state %x conn %d dead %d zapped %d\n",
+        dprintk("RPC:       state %x conn %d dead %d zapped %d sk_shutdown %d\n",
                         sk->sk_state, xprt_connected(xprt),
                         sock_flag(sk, SOCK_DEAD),
-                        sock_flag(sk, SOCK_ZAPPED));
+                        sock_flag(sk, SOCK_ZAPPED),
+                        sk->sk_shutdown);
 
         switch (sk->sk_state) {
         case TCP_ESTABLISHED:
@@ -1817,10 +1818,25 @@ static void xs_tcp_reuse_connection(stru
 {
         unsigned int state = transport->inet->sk_state;
 
-        if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED)
-                return;
-        if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT))
-                return;
+        if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED) {
+                /* we don't need to abort the connection if the socket
+                 * hasn't undergone a shutdown
+                 */
+                if (transport->inet->sk_shutdown == 0)
+                        return;
+                dprintk("RPC:       %s: TCP_CLOSEd and sk_shutdown set to %d\n",
+                                __func__, transport->inet->sk_shutdown);
+        }
+        if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT)) {
+                /* we don't need to abort the connection if the socket
+                 * hasn't undergone a shutdown
+                 */
+                if (transport->inet->sk_shutdown == 0)
+                        return;
+                dprintk("RPC:       %s: ESTABLISHED/SYN_SENT "
+                                "sk_shutdown set to %d\n",
+                                __func__, transport->inet->sk_shutdown);
+        }
         xs_abort_connection(xprt, transport);
 }
 
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -503,6 +503,8 @@ static int unix_dgram_connect(struct soc
                               int, int);
 static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
                                   struct msghdr *, size_t);
+static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
+                                  struct msghdr *, size_t, int);
 
 static const struct proto_ops unix_stream_ops = {
         .family =       PF_UNIX,
@@ -562,7 +564,7 @@ static const struct proto_ops unix_seqpa
         .setsockopt =   sock_no_setsockopt,
         .getsockopt =   sock_no_getsockopt,
         .sendmsg =      unix_seqpacket_sendmsg,
-        .recvmsg =      unix_dgram_recvmsg,
+        .recvmsg =      unix_seqpacket_recvmsg,
         .mmap =         sock_no_mmap,
         .sendpage =     sock_no_sendpage,
 };
@@ -1323,9 +1325,25 @@ static void unix_destruct_fds(struct sk_
         sock_wfree(skb);
 }
 
+#define MAX_RECURSION_LEVEL 4
+
 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 {
         int i;
+        unsigned char max_level = 0;
+        int unix_sock_count = 0;
+
+        for (i = scm->fp->count - 1; i >= 0; i--) {
+                struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+
+                if (sk) {
+                        unix_sock_count++;
+                        max_level = max(max_level,
+                                        unix_sk(sk)->recursion_level);
+                }
+        }
+        if (unlikely(max_level > MAX_RECURSION_LEVEL))
+                return -ETOOMANYREFS;
 
         /*
          * Need to duplicate file references for the sake of garbage
@@ -1336,10 +1354,12 @@ static int unix_attach_fds(struct scm_co
         if (!UNIXCB(skb).fp)
                 return -ENOMEM;
 
-        for (i = scm->fp->count-1; i >= 0; i--)
-                unix_inflight(scm->fp->fp[i]);
+        if (unix_sock_count) {
+                for (i = scm->fp->count - 1; i >= 0; i--)
+                        unix_inflight(scm->fp->fp[i]);
+        }
         skb->destructor = unix_destruct_fds;
-        return 0;
+        return max_level;
 }
 
 /*
@@ -1361,6 +1381,7 @@ static int unix_dgram_sendmsg(struct kio
         struct sk_buff *skb;
         long timeo;
         struct scm_cookie tmp_scm;
+        int max_level = 0;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1401,8 +1422,9 @@ static int unix_dgram_sendmsg(struct kio
         memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
         if (siocb->scm->fp) {
                 err = unix_attach_fds(siocb->scm, skb);
-                if (err)
+                if (err < 0)
                         goto out_free;
+                max_level = err + 1;
         }
         unix_get_secdata(siocb->scm, skb);
 
@@ -1483,6 +1505,8 @@ restart:
         }
 
         skb_queue_tail(&other->sk_receive_queue, skb);
+        if (max_level > unix_sk(other)->recursion_level)
+                unix_sk(other)->recursion_level = max_level;
         unix_state_unlock(other);
         other->sk_data_ready(other, len);
         sock_put(other);
@@ -1513,6 +1537,7 @@ static int unix_stream_sendmsg(struct ki
         int sent = 0;
         struct scm_cookie tmp_scm;
         bool fds_sent = false;
+        int max_level = 0;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1577,10 +1602,11 @@ static int unix_stream_sendmsg(struct ki
                 /* Only send the fds in the first buffer */
                 if (siocb->scm->fp && !fds_sent) {
                         err = unix_attach_fds(siocb->scm, skb);
-                        if (err) {
+                        if (err < 0) {
                                 kfree_skb(skb);
                                 goto out_err;
                         }
+                        max_level = err + 1;
                         fds_sent = true;
                 }
 
@@ -1597,6 +1623,8 @@ static int unix_stream_sendmsg(struct ki
                         goto pipe_err_free;
 
                 skb_queue_tail(&other->sk_receive_queue, skb);
+                if (max_level > unix_sk(other)->recursion_level)
+                        unix_sk(other)->recursion_level = max_level;
                 unix_state_unlock(other);
                 other->sk_data_ready(other, size);
                 sent += size;
@@ -1639,6 +1667,18 @@ static int unix_seqpacket_sendmsg(struct
         return unix_dgram_sendmsg(kiocb, sock, msg, len);
 }
 
+static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock,
+                              struct msghdr *msg, size_t size,
+                              int flags)
+{
+        struct sock *sk = sock->sk;
+
+        if (sk->sk_state != TCP_ESTABLISHED)
+                return -ENOTCONN;
+
+        return unix_dgram_recvmsg(iocb, sock, msg, size, flags);
+}
+
 static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
 {
         struct unix_sock *u = unix_sk(sk);
@@ -1813,6 +1853,7 @@ static int unix_stream_recvmsg(struct ki
                 unix_state_lock(sk);
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 if (skb == NULL) {
+                        unix_sk(sk)->recursion_level = 0;
                         if (copied >= target)
                                 goto unlock;
 
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -97,7 +97,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_w
 unsigned int unix_tot_inflight;
 
 
-static struct sock *unix_get_socket(struct file *filp)
+struct sock *unix_get_socket(struct file *filp)
 {
         struct sock *u_sock = NULL;
         struct inode *inode = filp->f_path.dentry->d_inode;
@@ -269,9 +269,16 @@ static void inc_inflight_move_tail(struc
 }
 
 static bool gc_in_progress = false;
+#define UNIX_INFLIGHT_TRIGGER_GC 16000
 
 void wait_for_unix_gc(void)
 {
+        /*
+         * If number of inflight sockets is insane,
+         * force a garbage collect right now.
+         */
+        if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
+                unix_gc();
         wait_event(unix_gc_wait, gc_in_progress == false);
 }
 
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -332,7 +332,7 @@ static int conf_choice(struct menu *menu
                 }
                 if (!child)
                         continue;
-                if (line[strlen(line) - 1] == '?') {
+                if (line[0] && line[strlen(line) - 1] == '?') {
                         print_help(child);
                         continue;
                 }
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -65,7 +65,9 @@ struct cs_spec {
 
 /* available models */
 enum {
+        CS420X_MBP53,
         CS420X_MBP55,
+        CS420X_IMAC27,
         CS420X_AUTO,
         CS420X_MODELS
 };
@@ -832,7 +834,9 @@ static void cs_automute(struct hda_codec
                                     AC_VERB_SET_PIN_WIDGET_CONTROL,
                                     hp_present ? 0 : PIN_OUT);
         }
-        if (spec->board_config == CS420X_MBP55) {
+        if (spec->board_config == CS420X_MBP53 ||
+            spec->board_config == CS420X_MBP55 ||
+            spec->board_config == CS420X_IMAC27) {
                 unsigned int gpio = hp_present ? 0x02 : 0x08;
                 snd_hda_codec_write(codec, 0x01, 0,
                                     AC_VERB_SET_GPIO_DATA, gpio);
@@ -1077,13 +1081,19 @@ static int cs_parse_auto_config(struct h
 }
 
 static const char *cs420x_models[CS420X_MODELS] = {
+        [CS420X_MBP53] = "mbp53",
         [CS420X_MBP55] = "mbp55",
+        [CS420X_IMAC27] = "imac27",
         [CS420X_AUTO] = "auto",
 };
 
 
 static struct snd_pci_quirk cs420x_cfg_tbl[] = {
+        SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53),
+        SND_PCI_QUIRK(0x10de, 0x0d94, "MacBookAir 3,1(2)", CS420X_MBP55),
         SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55),
+        SND_PCI_QUIRK(0x10de, 0xcb89, "MacBookPro 7,1", CS420X_MBP55),
+        SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),
         {} /* terminator */
 };
 
@@ -1092,6 +1102,20 @@ struct cs_pincfg {
         u32 val;
 };
 
+static struct cs_pincfg mbp53_pincfgs[] = {
+        { 0x09, 0x012b4050 },
+        { 0x0a, 0x90100141 },
+        { 0x0b, 0x90100140 },
+        { 0x0c, 0x018b3020 },
+        { 0x0d, 0x90a00110 },
+        { 0x0e, 0x400000f0 },
+        { 0x0f, 0x01cbe030 },
+        { 0x10, 0x014be060 },
+        { 0x12, 0x400000f0 },
+        { 0x15, 0x400000f0 },
+        {} /* terminator */
+};
+
 static struct cs_pincfg mbp55_pincfgs[] = {
         { 0x09, 0x012b4030 },
         { 0x0a, 0x90100121 },
@@ -1106,8 +1130,24 @@ static struct cs_pincfg mbp55_pincfgs[]
         {} /* terminator */
 };
 
+static struct cs_pincfg imac27_pincfgs[] = {
+        { 0x09, 0x012b4050 },
+        { 0x0a, 0x90100140 },
+        { 0x0b, 0x90100142 },
+        { 0x0c, 0x018b3020 },
+        { 0x0d, 0x90a00110 },
+        { 0x0e, 0x400000f0 },
+        { 0x0f, 0x01cbe030 },
+        { 0x10, 0x014be060 },
+        { 0x12, 0x01ab9070 },
+        { 0x15, 0x400000f0 },
+        {} /* terminator */
+};
+
 static struct cs_pincfg *cs_pincfgs[CS420X_MODELS] = {
+        [CS420X_MBP53] = mbp53_pincfgs,
         [CS420X_MBP55] = mbp55_pincfgs,
+        [CS420X_IMAC27] = imac27_pincfgs,
 };
 
 static void fix_pincfg(struct hda_codec *codec, int model)
@@ -1137,6 +1177,8 @@ static int patch_cs420x(struct hda_codec
                 fix_pincfg(codec, spec->board_config);
 
         switch (spec->board_config) {
+        case CS420X_IMAC27:
+        case CS420X_MBP53:
         case CS420X_MBP55:
                 /* GPIO1 = headphones */
                 /* GPIO3 = speakers */
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -30,6 +30,7 @@
 #include <linux/kmod.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
+#include <linux/string.h>
 #include <sound/core.h>
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -46,6 +47,8 @@
 #define DBG(fmt...)
 #endif
 
+#define IS_G4DA (machine_is_compatible("PowerMac3,4"))
+
 /* i2c address for tumbler */
 #define TAS_I2C_ADDR    0x34
 
@@ -1134,7 +1137,8 @@ static long tumbler_find_device(const ch
                 gp->inactive_val = (*base) ? 0x4 : 0x5;
         } else {
                 const u32 *prop = NULL;
-                gp->active_state = 0;
+                gp->active_state = IS_G4DA
+                                && !strncmp(device, "keywest-gpio1", 13);
                 gp->active_val = 0x4;
                 gp->inactive_val = 0x5;
                 /* Here are some crude hacks to extract the GPIO polarity and
@@ -1312,6 +1316,9 @@ static int __devinit tumbler_init(struct
         if (irq <= NO_IRQ)
                 irq = tumbler_find_device("line-output-detect",
                                           NULL, &mix->line_detect, 1);
+        if (IS_G4DA && irq <= NO_IRQ)
+                irq = tumbler_find_device("keywest-gpio16",
+                                          NULL, &mix->line_detect, 1);
         mix->lineout_irq = irq;
 
         tumbler_reset_audio(chip);
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -593,12 +593,12 @@ static const struct snd_soc_dapm_route a
 
         { "SPKL", "Input Switch", "MIXINL" },
         { "SPKL", "IN1LP Switch", "IN1LP" },
-        { "SPKL", "Output Switch", "Left Output Mixer" },
+        { "SPKL", "Output Switch", "Left Output PGA" },
         { "SPKL", NULL, "TOCLK" },
 
         { "SPKR", "Input Switch", "MIXINR" },
         { "SPKR", "IN1RP Switch", "IN1RP" },
-        { "SPKR", "Output Switch", "Right Output Mixer" },
+        { "SPKR", "Output Switch", "Right Output PGA" },
         { "SPKR", NULL, "TOCLK" },
 
         { "SPKL Boost", "Direct Voice Switch", "Direct Voice" },
@@ -620,8 +620,8 @@ static const struct snd_soc_dapm_route a
         { "SPKOUTRP", NULL, "SPKR Driver" },
         { "SPKOUTRN", NULL, "SPKR Driver" },
 
-        { "Left Headphone Mux", "Mixer", "Left Output Mixer" },
-        { "Right Headphone Mux", "Mixer", "Right Output Mixer" },
+        { "Left Headphone Mux", "Mixer", "Left Output PGA" },
+        { "Right Headphone Mux", "Mixer", "Right Output PGA" },
 
         { "Headphone PGA", NULL, "Left Headphone Mux" },
         { "Headphone PGA", NULL, "Right Headphone Mux" },
--- a/sound/synth/emux/emux_hwdep.c
+++ b/sound/synth/emux/emux_hwdep.c
@@ -128,6 +128,9 @@ snd_emux_init_hwdep(struct snd_emux *emu
         strcpy(hw->name, SNDRV_EMUX_HWDEP_NAME);
         hw->iface = SNDRV_HWDEP_IFACE_EMUX_WAVETABLE;
         hw->ops.ioctl = snd_emux_hwdep_ioctl;
+        /* The ioctl parameter types are compatible between 32- and
+         * 64-bit architectures, so use the same function. */
+        hw->ops.ioctl_compat = snd_emux_hwdep_ioctl;
         hw->exclusive = 1;
         hw->private_data = emu;
         if ((err = snd_card_register(emu->card)) < 0)
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -2,6 +2,7 @@
 all::
 
 # Define V=1 to have a more verbose compile.
+# Define V=2 to have an even more verbose compile.
 #
 # Define SNPRINTF_RETURNS_BOGUS if your are on a system which snprintf()
 # or vsnprintf() return -1 instead of number of characters which would
@@ -145,6 +146,10 @@ all::
 # Define NO_EXTERNAL_GREP if you don't want "perf grep" to ever call
 # your external grep (e.g., if your system lacks grep, if its grep is
 # broken, or spawning external process is slower than built-in grep perf has).
+#
+# Define LDFLAGS=-static to build a static binary.
+#
+# Define EXTRA_CFLAGS=-m64 or EXTRA_CFLAGS=-m32 as appropriate for cross-builds.
 
 PERF-VERSION-FILE: .FORCE-PERF-VERSION-FILE
         @$(SHELL_PATH) util/PERF-VERSION-GEN
@@ -157,20 +162,6 @@ uname_R := $(shell sh -c 'uname -r 2>/de
 uname_P := $(shell sh -c 'uname -p 2>/dev/null || echo not')
 uname_V := $(shell sh -c 'uname -v 2>/dev/null || echo not')
 
-#
-# Add -m32 for cross-builds:
-#
-ifdef NO_64BIT
-  MBITS := -m32
-else
-  #
-  # If we're on a 64-bit kernel, use -m64:
-  #
-  ifneq ($(patsubst %64,%,$(uname_M)),$(uname_M))
-    MBITS := -m64
-  endif
-endif
-
 # CFLAGS and LDFLAGS are for the users to override from the command line.
 
 #
@@ -200,8 +191,15 @@ EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wol
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wstrict-prototypes
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wdeclaration-after-statement
 
-CFLAGS = $(MBITS) -ggdb3 -Wall -Wextra -std=gnu99 -Werror -O6 -fstack-protector-all -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS)
-LDFLAGS = -lpthread -lrt -lelf -lm
+ifeq ("$(origin DEBUG)", "command line")
+  PERF_DEBUG = $(DEBUG)
+endif
+ifndef PERF_DEBUG
+  CFLAGS_OPTIMIZE = -O6
+endif
+
+CFLAGS = -ggdb3 -Wall -Wextra -std=gnu99 -Werror $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
+EXTLIBS = -lpthread -lrt -lelf -lm
 ALL_CFLAGS = $(CFLAGS)
 ALL_LDFLAGS = $(LDFLAGS)
 STRIP ?= strip
@@ -254,6 +252,21 @@ PTHREAD_LIBS = -lpthread
 # explicitly what architecture to check for. Fix this up for yours..
 SPARSE_FLAGS = -D__BIG_ENDIAN__ -D__powerpc__
 
+ifeq ($(V), 2)
+        QUIET_STDERR = ">/dev/null"
+else
+        QUIET_STDERR = ">/dev/null 2>&1"
+endif
+
+BITBUCKET = "/dev/null"
+
+ifneq ($(shell sh -c "(echo '\#include <stdio.h>'; echo 'int main(void) { return puts(\"hi\"); }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) "$(QUIET_STDERR)" && echo y"), y)
+        BITBUCKET = .perf.dev.null
+endif
+
+ifeq ($(shell sh -c "echo 'int foo(void) {char X[2]; return 3;}' | $(CC) -x c -c -Werror -fstack-protector-all - -o $(BITBUCKET) "$(QUIET_STDERR)" && echo y"), y)
+  CFLAGS := $(CFLAGS) -fstack-protector-all
+endif
 
 
 ### --- END CONFIGURATION SECTION ---
@@ -423,36 +436,43 @@ ifeq ($(uname_S),Darwin)
         PTHREAD_LIBS =
 endif
 
-ifeq ($(shell sh -c "(echo '\#include <libelf.h>'; echo 'int main(void) { Elf * elf = elf_begin(0, ELF_C_READ, 0); return (long)elf; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o /dev/null $(ALL_LDFLAGS) > /dev/null 2>&1 && echo y"), y)
-        ifneq ($(shell sh -c "(echo '\#include <libelf.h>'; echo 'int main(void) { Elf * elf = elf_begin(0, ELF_C_READ_MMAP, 0); return (long)elf; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o /dev/null $(ALL_LDFLAGS) > /dev/null 2>&1 && echo y"), y)
+ifneq ($(shell sh -c "(echo '\#include <gnu/libc-version.h>'; echo 'int main(void) { const char * version = gnu_get_libc_version(); return (long)version; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) "$(QUIET_STDERR)" && echo y"), y)
+        msg := $(error No gnu/libc-version.h found, please install glibc-dev[el]/glibc-static);
+endif
+
+ifeq ($(shell sh -c "(echo '\#include <libelf.h>'; echo 'int main(void) { Elf * elf = elf_begin(0, ELF_C_READ, 0); return (long)elf; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) "$(QUIET_STDERR)" && echo y"), y)
+        ifneq ($(shell sh -c "(echo '\#include <libelf.h>'; echo 'int main(void) { Elf * elf = elf_begin(0, ELF_C_READ_MMAP, 0); return (long)elf; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) "$(QUIET_STDERR)" && echo y"), y)
                 BASIC_CFLAGS += -DLIBELF_NO_MMAP
         endif
 else
-        msg := $(error No libelf.h/libelf found, please install libelf-dev/elfutils-libelf-devel and glibc-dev[el]);
+        msg := $(error No libelf.h/libelf found, please install libelf-dev/elfutils-libelf-devel);
 endif
 
 ifdef NO_DEMANGLE
         BASIC_CFLAGS += -DNO_DEMANGLE
+else ifdef HAVE_CPLUS_DEMANGLE
+        EXTLIBS += -liberty
+        BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
 else
-        has_bfd := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd > /dev/null 2>&1 && echo y")
+        has_bfd := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd "$(QUIET_STDERR)" && echo y")
 
         ifeq ($(has_bfd),y)
                 EXTLIBS += -lbfd
         else
-                has_bfd_iberty := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd -liberty > /dev/null 2>&1 && echo y")
+                has_bfd_iberty := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd -liberty "$(QUIET_STDERR)" && echo y")
                 ifeq ($(has_bfd_iberty),y)
                         EXTLIBS += -lbfd -liberty
                 else
-                        has_bfd_iberty_z := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd -liberty -lz > /dev/null 2>&1 && echo y")
+                        has_bfd_iberty_z := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd -liberty -lz "$(QUIET_STDERR)" && echo y")
                         ifeq ($(has_bfd_iberty_z),y)
                                 EXTLIBS += -lbfd -liberty -lz
                         else
-                                has_cplus_demangle := $(shell sh -c "(echo 'extern char *cplus_demangle(const char *, int);'; echo 'int main(void) { cplus_demangle(0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -liberty > /dev/null 2>&1 && echo y")
+                                has_cplus_demangle := $(shell sh -c "(echo 'extern char *cplus_demangle(const char *, int);'; echo 'int main(void) { cplus_demangle(0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -liberty "$(QUIET_STDERR)" && echo y")
                                 ifeq ($(has_cplus_demangle),y)
                                         EXTLIBS += -liberty
                                         BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
                                 else
-                                        msg := $(warning No bfd.h/libbfd found, install binutils-dev[el] to gain symbol demangling)
+                                        msg := $(warning No bfd.h/libbfd found, install binutils-dev[el]/zlib-static to gain symbol demangling)
                                         BASIC_CFLAGS += -DNO_DEMANGLE
                                 endif
                         endif
@@ -695,7 +715,7 @@ export TAR INSTALL DESTDIR SHELL_PATH
 
 SHELL = $(SHELL_PATH)
 
-all:: shell_compatibility_test $(ALL_PROGRAMS) $(BUILT_INS) $(OTHER_PROGRAMS) PERF-BUILD-OPTIONS
+all:: .perf.dev.null shell_compatibility_test $(ALL_PROGRAMS) $(BUILT_INS) $(OTHER_PROGRAMS) PERF-BUILD-OPTIONS
 ifneq (,$X)
         $(foreach p,$(patsubst %$X,%,$(filter %$X,$(ALL_PROGRAMS) $(BUILT_INS) perf$X)), test '$p' -ef '$p$X' || $(RM) '$p';)
 endif
@@ -998,6 +1018,11 @@ clean:
 .PHONY: .FORCE-PERF-VERSION-FILE TAGS tags cscope .FORCE-PERF-CFLAGS
 .PHONY: .FORCE-PERF-BUILD-OPTIONS
 
+.perf.dev.null:
+                touch .perf.dev.null
+
+.INTERMEDIATE:  .perf.dev.null
+
 ### Make sure built-ins do not have dups and listed in perf.c
 #
 check-builtins::