diff -druN linux-2.6.35.13-libre3/arch/alpha/kernel/osf_sys.c linux-2.6.35.14-libre3/arch/alpha/kernel/osf_sys.c
--- linux-2.6.35.13-libre3/arch/alpha/kernel/osf_sys.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/alpha/kernel/osf_sys.c	2011-08-01 16:56:51.000000000 -0400
@@ -432,7 +432,7 @@
 		return -EFAULT;
 
 	len = namelen;
-	if (namelen > 32)
+	if (len > 32)
 		len = 32;
 
 	down_read(&uts_sem);
@@ -619,7 +619,7 @@
 	down_read(&uts_sem);
 	res = sysinfo_table[offset];
 	len = strlen(res)+1;
-	if (len > count)
+	if ((unsigned long)len > (unsigned long)count)
 		len = count;
 	if (copy_to_user(buf, res, len))
 		err = -EFAULT;
@@ -674,7 +674,7 @@
 		return 1;
 
 	case GSI_GET_HWRPB:
-		if (nbytes < sizeof(*hwrpb))
+		if (nbytes > sizeof(*hwrpb))
 			return -EINVAL;
 		if (copy_to_user(buffer, hwrpb, nbytes) != 0)
 			return -EFAULT;
@@ -1036,6 +1036,7 @@
 {
 	struct rusage r;
 	long ret, err;
+	unsigned int status = 0;
 	mm_segment_t old_fs;
 
 	if (!ur)
@@ -1044,13 +1045,15 @@
 	old_fs = get_fs();
 		
 	set_fs (KERNEL_DS);
-	ret = sys_wait4(pid, ustatus, options, (struct rusage __user *) &r);
+	ret = sys_wait4(pid, (unsigned int __user *) &status, options,
+			(struct rusage __user *) &r);
 	set_fs (old_fs);
 
 	if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
 		return -EFAULT;
 
 	err = 0;
+	err |= put_user(status, ustatus);
 	err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
 	err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
 	err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
diff -druN linux-2.6.35.13-libre3/arch/arm/kernel/perf_event.c linux-2.6.35.14-libre3/arch/arm/kernel/perf_event.c
--- linux-2.6.35.13-libre3/arch/arm/kernel/perf_event.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/arm/kernel/perf_event.c	2011-08-01 16:56:51.000000000 -0400
@@ -531,7 +531,7 @@
 hw_perf_enable(void)
 {
 	/* Enable all of the perf events on hardware. */
-	int idx;
+	int idx, enabled = 0;
 	struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
 
 	if (!armpmu)
@@ -544,9 +544,11 @@
 			continue;
 
 		armpmu->enable(&event->hw, idx);
+		enabled = 1;
 	}
 
-	armpmu->start();
+	if (enabled)
+		armpmu->start();
 }
 
 void
diff -druN linux-2.6.35.13-libre3/arch/arm/kernel/sys_oabi-compat.c linux-2.6.35.14-libre3/arch/arm/kernel/sys_oabi-compat.c
--- linux-2.6.35.13-libre3/arch/arm/kernel/sys_oabi-compat.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/arm/kernel/sys_oabi-compat.c	2011-08-01 16:56:51.000000000 -0400
@@ -311,7 +311,7 @@
 	long err;
 	int i;
 
-	if (nsops < 1)
+	if (nsops < 1 || nsops > SEMOPM)
 		return -EINVAL;
 	sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
 	if (!sops)
diff -druN linux-2.6.35.13-libre3/arch/arm/mach-davinci/board-dm365-evm.c linux-2.6.35.14-libre3/arch/arm/mach-davinci/board-dm365-evm.c
--- linux-2.6.35.13-libre3/arch/arm/mach-davinci/board-dm365-evm.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/arm/mach-davinci/board-dm365-evm.c	2011-08-01 16:56:51.000000000 -0400
@@ -520,7 +520,7 @@
 	 */
 	if (have_imager()) {
 		label = "HD imager";
-		mux |= 1;
+		mux |= 2;
 
 		/* externally mux MMC1/ENET/AIC33 to imager */
 		mux |= BIT(6) | BIT(5) | BIT(3);
@@ -541,7 +541,7 @@
 		resets &= ~BIT(1);
 
 		if (have_tvp7002()) {
-			mux |= 2;
+			mux |= 1;
 			resets &= ~BIT(2);
 			label = "tvp7002 HD";
 		} else {
diff -druN linux-2.6.35.13-libre3/arch/arm/mach-pxa/cm-x300.c linux-2.6.35.14-libre3/arch/arm/mach-pxa/cm-x300.c
--- linux-2.6.35.13-libre3/arch/arm/mach-pxa/cm-x300.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/arm/mach-pxa/cm-x300.c	2011-08-01 16:56:51.000000000 -0400
@@ -157,10 +157,10 @@
 	GPIO99_GPIO,			/* Ethernet IRQ */
 
 	/* RTC GPIOs */
-	GPIO95_GPIO,			/* RTC CS */
-	GPIO96_GPIO,			/* RTC WR */
-	GPIO97_GPIO,			/* RTC RD */
-	GPIO98_GPIO,			/* RTC IO */
+	GPIO95_GPIO | MFP_LPM_DRIVE_HIGH,	/* RTC CS */
+	GPIO96_GPIO | MFP_LPM_DRIVE_HIGH,	/* RTC WR */
+	GPIO97_GPIO | MFP_LPM_DRIVE_HIGH,	/* RTC RD */
+	GPIO98_GPIO,				/* RTC IO */
 
 	/* Standard I2C */
 	GPIO21_I2C_SCL,
diff -druN linux-2.6.35.13-libre3/arch/arm/mach-pxa/mfp-pxa2xx.c linux-2.6.35.14-libre3/arch/arm/mach-pxa/mfp-pxa2xx.c
--- linux-2.6.35.13-libre3/arch/arm/mach-pxa/mfp-pxa2xx.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/arm/mach-pxa/mfp-pxa2xx.c	2011-08-01 16:56:51.000000000 -0400
@@ -347,9 +347,9 @@
 		if ((gpio_desc[i].config & MFP_LPM_KEEP_OUTPUT) &&
 		    (GPDR(i) & GPIO_bit(i))) {
 			if (GPLR(i) & GPIO_bit(i))
-				PGSR(i) |= GPIO_bit(i);
+				PGSR(gpio_to_bank(i)) |= GPIO_bit(i);
 			else
-				PGSR(i) &= ~GPIO_bit(i);
+				PGSR(gpio_to_bank(i)) &= ~GPIO_bit(i);
 		}
 	}
 
diff -druN linux-2.6.35.13-libre3/arch/m68k/mm/motorola.c linux-2.6.35.14-libre3/arch/m68k/mm/motorola.c
--- linux-2.6.35.13-libre3/arch/m68k/mm/motorola.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/m68k/mm/motorola.c	2011-08-01 16:56:51.000000000 -0400
@@ -300,6 +300,8 @@
 		zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
 		free_area_init_node(i, zones_size,
 				    m68k_memory[i].addr >> PAGE_SHIFT, NULL);
+		if (node_present_pages(i))
+			node_set_state(i, N_NORMAL_MEMORY);
 	}
 }
 
diff -druN linux-2.6.35.13-libre3/arch/mips/mm/dma-default.c linux-2.6.35.14-libre3/arch/mips/mm/dma-default.c
--- linux-2.6.35.13-libre3/arch/mips/mm/dma-default.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/mips/mm/dma-default.c	2011-08-01 16:56:51.000000000 -0400
@@ -44,27 +44,39 @@
 
 static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
 {
+	gfp_t dma_flag;
+
 	/* ignore region specifiers */
 	gfp &= ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM);
 
-#ifdef CONFIG_ZONE_DMA
+#ifdef CONFIG_ISA
 	if (dev == NULL)
-		gfp |= __GFP_DMA;
-	else if (dev->coherent_dma_mask < DMA_BIT_MASK(24))
-		gfp |= __GFP_DMA;
+		dma_flag = __GFP_DMA;
 	else
 #endif
-#ifdef CONFIG_ZONE_DMA32
+#if defined(CONFIG_ZONE_DMA32) && defined(CONFIG_ZONE_DMA)
 	     if (dev->coherent_dma_mask < DMA_BIT_MASK(32))
-		gfp |= __GFP_DMA32;
+			dma_flag = __GFP_DMA;
+	else if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+			dma_flag = __GFP_DMA32;
 	else
 #endif
-		;
+#if defined(CONFIG_ZONE_DMA32) && !defined(CONFIG_ZONE_DMA)
+	     if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+		dma_flag = __GFP_DMA32;
+	else
+#endif
+#if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
+	     if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+		dma_flag = __GFP_DMA;
+	else
+#endif
+		dma_flag = 0;
 
 	/* Don't invoke OOM killer */
 	gfp |= __GFP_NORETRY;
 
-	return gfp;
+	return gfp | dma_flag;
 }
 
 void *dma_alloc_noncoherent(struct device *dev, size_t size,
diff -druN linux-2.6.35.13-libre3/arch/parisc/mm/init.c linux-2.6.35.14-libre3/arch/parisc/mm/init.c
--- linux-2.6.35.13-libre3/arch/parisc/mm/init.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/parisc/mm/init.c	2011-08-01 16:56:51.000000000 -0400
@@ -266,8 +266,10 @@
 	}
 	memset(pfnnid_map, 0xff, sizeof(pfnnid_map));
 
-	for (i = 0; i < npmem_ranges; i++)
+	for (i = 0; i < npmem_ranges; i++) {
+		node_set_state(i, N_NORMAL_MEMORY);
 		node_set_online(i);
+	}
 #endif
 
 	/*
diff -druN linux-2.6.35.13-libre3/arch/powerpc/boot/Makefile linux-2.6.35.14-libre3/arch/powerpc/boot/Makefile
--- linux-2.6.35.13-libre3/arch/powerpc/boot/Makefile	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/powerpc/boot/Makefile	2011-08-01 16:56:51.000000000 -0400
@@ -370,7 +370,7 @@
 extra-installed		:= $(patsubst $(obj)/%, $(DESTDIR)$(WRAPPER_OBJDIR)/%, $(extra-y))
 hostprogs-installed	:= $(patsubst %, $(DESTDIR)$(WRAPPER_BINDIR)/%, $(hostprogs-y))
 wrapper-installed	:= $(DESTDIR)$(WRAPPER_BINDIR)/wrapper
-dts-installed		:= $(patsubst $(obj)/dts/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(obj)/dts/*.dts))
+dts-installed		:= $(patsubst $(dtstree)/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(dtstree)/*.dts))
 
 all-installed		:= $(extra-installed) $(hostprogs-installed) $(wrapper-installed) $(dts-installed)
 
diff -druN linux-2.6.35.13-libre3/arch/powerpc/kernel/crash.c linux-2.6.35.14-libre3/arch/powerpc/kernel/crash.c
--- linux-2.6.35.13-libre3/arch/powerpc/kernel/crash.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/powerpc/kernel/crash.c	2011-08-01 16:56:51.000000000 -0400
@@ -176,12 +176,8 @@
 
 		while (paca[i].kexec_state < KEXEC_STATE_REAL_MODE) {
 			barrier();
-			if (!cpu_possible(i)) {
-				break;
-			}
-			if (!cpu_online(i)) {
+			if (!cpu_possible(i) || !cpu_online(i) || (msecs <= 0))
 				break;
-			}
 			msecs--;
 			mdelay(1);
 		}
diff -druN linux-2.6.35.13-libre3/arch/powerpc/kernel/misc_64.S linux-2.6.35.14-libre3/arch/powerpc/kernel/misc_64.S
--- linux-2.6.35.13-libre3/arch/powerpc/kernel/misc_64.S	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/powerpc/kernel/misc_64.S	2011-08-01 16:56:51.000000000 -0400
@@ -461,7 +461,8 @@
  * wait for the flag to change, indicating this kernel is going away but
  * the slave code for the next one is at addresses 0 to 100.
  *
- * This is used by all slaves.
+ * This is used by all slaves, even those that did not find a matching
+ * paca in the secondary startup code.
  *
  * Physical (hardware) cpu id should be in r3.
  */
@@ -470,10 +471,6 @@
 1:	mflr	r5
 	addi	r5,r5,kexec_flag-1b
 
-	li	r4,KEXEC_STATE_REAL_MODE
-	stb	r4,PACAKEXECSTATE(r13)
-	SYNC
-
 99:	HMT_LOW
 #ifdef CONFIG_KEXEC		/* use no memory without kexec */
 	lwz	r4,0(r5)
@@ -498,11 +495,17 @@
  *
  * get phys id from paca
  * switch to real mode
+ * mark the paca as no longer used
  * join other cpus in kexec_wait(phys_id)
  */
 _GLOBAL(kexec_smp_wait)
 	lhz	r3,PACAHWCPUID(r13)
 	bl	real_mode
+
+	li	r4,KEXEC_STATE_REAL_MODE
+	stb	r4,PACAKEXECSTATE(r13)
+	SYNC
+
 	b	.kexec_wait
 
 /*
diff -druN linux-2.6.35.13-libre3/arch/powerpc/oprofile/op_model_power4.c linux-2.6.35.14-libre3/arch/powerpc/oprofile/op_model_power4.c
--- linux-2.6.35.13-libre3/arch/powerpc/oprofile/op_model_power4.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/powerpc/oprofile/op_model_power4.c	2011-08-01 16:56:51.000000000 -0400
@@ -261,6 +261,28 @@
 	return is_kernel;
 }
 
+static bool pmc_overflow(unsigned long val)
+{
+	if ((int)val < 0)
+		return true;
+
+	/*
+	 * Events on POWER7 can roll back if a speculative event doesn't
+	 * eventually complete. Unfortunately in some rare cases they will
+	 * raise a performance monitor exception. We need to catch this to
+	 * ensure we reset the PMC. In all cases the PMC will be 256 or less
+	 * cycles from overflow.
+	 *
+	 * We only do this if the first pass fails to find any overflowing
+	 * PMCs because a user might set a period of less than 256 and we
+	 * don't want to mistakenly reset them.
+	 */
+	if (__is_processor(PV_POWER7) && ((0x80000000 - val) <= 256))
+		return true;
+
+	return false;
+}
+
 static void power4_handle_interrupt(struct pt_regs *regs,
 				    struct op_counter_config *ctr)
 {
@@ -281,7 +303,7 @@
 
 	for (i = 0; i < cur_cpu_spec->num_pmcs; ++i) {
 		val = classic_ctr_read(i);
-		if (val < 0) {
+		if (pmc_overflow(val)) {
 			if (oprofile_running && ctr[i].enabled) {
 				oprofile_add_ext_sample(pc, regs, i, is_kernel);
 				classic_ctr_write(i, reset_value[i]);
diff -druN linux-2.6.35.13-libre3/arch/powerpc/platforms/pseries/hvconsole.c linux-2.6.35.14-libre3/arch/powerpc/platforms/pseries/hvconsole.c
--- linux-2.6.35.13-libre3/arch/powerpc/platforms/pseries/hvconsole.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/powerpc/platforms/pseries/hvconsole.c	2011-08-01 16:56:51.000000000 -0400
@@ -73,7 +73,7 @@
 	if (ret == H_SUCCESS)
 		return count;
 	if (ret == H_BUSY)
-		return 0;
+		return -EAGAIN;
 	return -EIO;
 }
 
diff -druN linux-2.6.35.13-libre3/arch/um/kernel/dyn.lds.S linux-2.6.35.14-libre3/arch/um/kernel/dyn.lds.S
--- linux-2.6.35.13-libre3/arch/um/kernel/dyn.lds.S	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/um/kernel/dyn.lds.S	2011-08-01 16:56:51.000000000 -0400
@@ -50,8 +50,18 @@
   .rela.got       : { *(.rela.got) }
   .rel.bss        : { *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*) }
   .rela.bss       : { *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*) }
-  .rel.plt        : { *(.rel.plt) }
-  .rela.plt       : { *(.rela.plt) }
+  .rel.plt : {
+	*(.rel.plt)
+	PROVIDE_HIDDEN(__rel_iplt_start = .);
+	*(.rel.iplt)
+	PROVIDE_HIDDEN(__rel_iplt_end = .);
+  }
+  .rela.plt : {
+	*(.rela.plt)
+	PROVIDE_HIDDEN(__rela_iplt_start = .);
+	*(.rela.iplt)
+	PROVIDE_HIDDEN(__rela_iplt_end = .);
+  }
   .init           : {
     KEEP (*(.init))
   } =0x90909090
diff -druN linux-2.6.35.13-libre3/arch/um/kernel/uml.lds.S linux-2.6.35.14-libre3/arch/um/kernel/uml.lds.S
--- linux-2.6.35.13-libre3/arch/um/kernel/uml.lds.S	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/um/kernel/uml.lds.S	2011-08-01 16:56:51.000000000 -0400
@@ -43,6 +43,23 @@
 	__syscall_stub_end = .;
   }
 
+  /*
+   * These are needed even in a static link, even if they wind up being empty.
+   * Newer glibc needs these __rel{,a}_iplt_{start,end} symbols.
+   */
+  .rel.plt : {
+	*(.rel.plt)
+	PROVIDE_HIDDEN(__rel_iplt_start = .);
+	*(.rel.iplt)
+	PROVIDE_HIDDEN(__rel_iplt_end = .);
+  }
+  .rela.plt : {
+	*(.rela.plt)
+	PROVIDE_HIDDEN(__rela_iplt_start = .);
+	*(.rela.iplt)
+	PROVIDE_HIDDEN(__rela_iplt_end = .);
+  }
+
   #include "asm/common.lds.S"
 
   init.data : { INIT_DATA }
diff -druN linux-2.6.35.13-libre3/arch/x86/include/asm/apicdef.h linux-2.6.35.14-libre3/arch/x86/include/asm/apicdef.h
--- linux-2.6.35.13-libre3/arch/x86/include/asm/apicdef.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/include/asm/apicdef.h	2011-08-01 16:56:51.000000000 -0400
@@ -78,6 +78,7 @@
 #define		APIC_DEST_LOGICAL	0x00800
 #define		APIC_DEST_PHYSICAL	0x00000
 #define		APIC_DM_FIXED		0x00000
+#define		APIC_DM_FIXED_MASK	0x00700
 #define		APIC_DM_LOWEST		0x00100
 #define		APIC_DM_SMI		0x00200
 #define		APIC_DM_REMRD		0x00300
diff -druN linux-2.6.35.13-libre3/arch/x86/include/asm/cpufeature.h linux-2.6.35.14-libre3/arch/x86/include/asm/cpufeature.h
--- linux-2.6.35.13-libre3/arch/x86/include/asm/cpufeature.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/include/asm/cpufeature.h	2011-08-01 16:56:51.000000000 -0400
@@ -162,6 +162,7 @@
 #define X86_FEATURE_IDA		(7*32+ 0) /* Intel Dynamic Acceleration */
 #define X86_FEATURE_ARAT	(7*32+ 1) /* Always Running APIC Timer */
 #define X86_FEATURE_CPB		(7*32+ 2) /* AMD Core Performance Boost */
+#define X86_FEATURE_EPB		(7*32+ 3) /* IA32_ENERGY_PERF_BIAS support */
 
 /* Virtualization flags: Linux defined */
 #define X86_FEATURE_TPR_SHADOW  (8*32+ 0) /* Intel TPR Shadow */
diff -druN linux-2.6.35.13-libre3/arch/x86/include/asm/msr-index.h linux-2.6.35.14-libre3/arch/x86/include/asm/msr-index.h
--- linux-2.6.35.13-libre3/arch/x86/include/asm/msr-index.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/include/asm/msr-index.h	2011-08-01 16:56:51.000000000 -0400
@@ -231,6 +231,11 @@
 #define THERM_INT_LOW_ENABLE		(1 << 0)
 #define THERM_INT_HIGH_ENABLE		(1 << 1)
 
+#define MSR_IA32_ENERGY_PERF_BIAS	0x000001b0
+#define ENERGY_PERF_BIAS_PERFORMANCE	0
+#define ENERGY_PERF_BIAS_NORMAL		6
+#define ENERGY_PERF_BIAS_POWERSWAVE	15
+
 #define MSR_IA32_THERM_STATUS		0x0000019c
 
 #define THERM_STATUS_PROCHOT		(1 << 0)
@@ -243,6 +248,8 @@
 
 #define MSR_IA32_TEMPERATURE_TARGET	0x000001a2
 
+#define MSR_IA32_ENERGY_PERF_BIAS	0x000001b0
+
 /* MISC_ENABLE bits: architectural */
 #define MSR_IA32_MISC_ENABLE_FAST_STRING	(1ULL << 0)
 #define MSR_IA32_MISC_ENABLE_TCC		(1ULL << 1)
diff -druN linux-2.6.35.13-libre3/arch/x86/include/asm/uaccess.h linux-2.6.35.14-libre3/arch/x86/include/asm/uaccess.h
--- linux-2.6.35.13-libre3/arch/x86/include/asm/uaccess.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/include/asm/uaccess.h	2011-08-01 16:56:51.000000000 -0400
@@ -42,7 +42,7 @@
  * Returns 0 if the range is valid, nonzero otherwise.
  *
  * This is equivalent to the following test:
- * (u33)addr + (u33)size >= (u33)current->addr_limit.seg (u65 for x86_64)
+ * (u33)addr + (u33)size > (u33)current->addr_limit.seg (u65 for x86_64)
  *
  * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...
  */
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/amd_iommu.c linux-2.6.35.14-libre3/arch/x86/kernel/amd_iommu.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/amd_iommu.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/amd_iommu.c	2011-08-01 16:56:51.000000000 -0400
@@ -25,6 +25,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/iommu-helper.h>
 #include <linux/iommu.h>
+#include <asm/msidef.h>
 #include <asm/proto.h>
 #include <asm/iommu.h>
 #include <asm/gart.h>
@@ -1048,7 +1049,7 @@
 {
 	int index = dma_dom->aperture_size >> APERTURE_RANGE_SHIFT;
 	struct amd_iommu *iommu;
-	unsigned long i;
+	unsigned long i, old_size;
 
 #ifdef CONFIG_IOMMU_STRESS
 	populate = false;
@@ -1084,8 +1085,21 @@
 		}
 	}
 
+	old_size                = dma_dom->aperture_size;
 	dma_dom->aperture_size += APERTURE_RANGE_SIZE;
 
+	/* Reserve address range used for MSI messages */
+	if (old_size < MSI_ADDR_BASE_LO &&
+	    dma_dom->aperture_size > MSI_ADDR_BASE_LO) {
+		unsigned long spage;
+		int pages;
+
+		pages = iommu_num_pages(MSI_ADDR_BASE_LO, 0x10000, PAGE_SIZE);
+		spage = MSI_ADDR_BASE_LO >> PAGE_SHIFT;
+
+		dma_ops_reserve_addresses(dma_dom, spage, pages);
+	}
+
 	/* Intialize the exclusion range if necessary */
 	for_each_iommu(iommu) {
 		if (iommu->exclusion_start &&
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/amd_iommu_init.c linux-2.6.35.14-libre3/arch/x86/kernel/amd_iommu_init.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/amd_iommu_init.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/amd_iommu_init.c	2011-08-01 16:56:51.000000000 -0400
@@ -650,8 +650,8 @@
 {
 	u8 *p = (u8 *)h;
 	u8 *end = p, flags = 0;
-	u16 dev_i, devid = 0, devid_start = 0, devid_to = 0;
-	u32 ext_flags = 0;
+	u16 devid = 0, devid_start = 0, devid_to = 0;
+	u32 dev_i, ext_flags = 0;
 	bool alias = false;
 	struct ivhd_entry *e;
 
@@ -806,7 +806,7 @@
 /* Initializes the device->iommu mapping for the driver */
 static int __init init_iommu_devices(struct amd_iommu *iommu)
 {
-	u16 i;
+	u32 i;
 
 	for (i = iommu->first_device; i <= iommu->last_device; ++i)
 		set_iommu_for_device(iommu, i);
@@ -1095,7 +1095,7 @@
  */
 static void init_device_table(void)
 {
-	u16 devid;
+	u32 devid;
 
 	for (devid = 0; devid <= amd_iommu_last_bdf; ++devid) {
 		set_dev_entry_bit(devid, DEV_ENTRY_VALID);
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/cpu/addon_cpuid_features.c linux-2.6.35.14-libre3/arch/x86/kernel/cpu/addon_cpuid_features.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/cpu/addon_cpuid_features.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/cpu/addon_cpuid_features.c	2011-08-01 16:56:51.000000000 -0400
@@ -33,6 +33,7 @@
 		{ X86_FEATURE_IDA,   		CR_EAX, 1, 0x00000006 },
 		{ X86_FEATURE_ARAT,  		CR_EAX, 2, 0x00000006 },
 		{ X86_FEATURE_APERFMPERF,	CR_ECX, 0, 0x00000006 },
+		{ X86_FEATURE_EPB,		CR_ECX, 3, 0x00000006 },
 		{ X86_FEATURE_CPB,   		CR_EDX, 9, 0x80000007 },
 		{ X86_FEATURE_NPT,   		CR_EDX, 0, 0x8000000a },
 		{ X86_FEATURE_LBRV,  		CR_EDX, 1, 0x8000000a },
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/cpu/amd.c linux-2.6.35.14-libre3/arch/x86/kernel/cpu/amd.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/cpu/amd.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/cpu/amd.c	2011-08-01 16:56:51.000000000 -0400
@@ -565,8 +565,11 @@
 	}
 #endif
 
-	/* As a rule processors have APIC timer running in deep C states */
-	if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
+	/*
+	 * Family 0x12 and above processors have APIC timer
+	 * running in deep C states.
+	 */
+	if (c->x86 > 0x11)
 		set_cpu_cap(c, X86_FEATURE_ARAT);
 
 	/*
@@ -582,10 +585,13 @@
 		 * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012
 		 */
 		u64 mask;
+		int err;
 
-		rdmsrl(MSR_AMD64_MCx_MASK(4), mask);
-		mask |= (1 << 10);
-		wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
+		err = rdmsrl_safe(MSR_AMD64_MCx_MASK(4), &mask);
+		if (err == 0) {
+			mask |= (1 << 10);
+			checking_wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
+		}
 	}
 }
 
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/cpu/intel.c linux-2.6.35.14-libre3/arch/x86/kernel/cpu/intel.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/cpu/intel.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/cpu/intel.c	2011-08-01 16:56:51.000000000 -0400
@@ -450,6 +450,24 @@
 
 	if (cpu_has(c, X86_FEATURE_VMX))
 		detect_vmx_virtcap(c);
+
+	/*
+	 * Initialize MSR_IA32_ENERGY_PERF_BIAS if BIOS did not.
+	 * x86_energy_perf_policy(8) is available to change it at run-time
+	 */
+	if (cpu_has(c, X86_FEATURE_EPB)) {
+		u64 epb;
+
+		rdmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
+		if ((epb & 0xF) == 0) {
+			printk_once(KERN_WARNING, "x86: updated energy_perf_bias"
+				" to 'normal' from 'performance'\n"
+				"You can view and update epb via utility,"
+				" such as x86_energy_perf_policy(8)\n");
+			epb = (epb & ~0xF) | ENERGY_PERF_BIAS_NORMAL;
+			wrmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
+		}
+	}
 }
 
 #ifdef CONFIG_X86_32
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.35.14-libre3/arch/x86/kernel/cpu/mcheck/mce_amd.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/cpu/mcheck/mce_amd.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/cpu/mcheck/mce_amd.c	2011-08-01 16:56:51.000000000 -0400
@@ -469,6 +469,7 @@
 out_free:
 	if (b) {
 		kobject_put(&b->kobj);
+		list_del(&b->miscj);
 		kfree(b);
 	}
 	return err;
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/cpu/mcheck/therm_throt.c linux-2.6.35.14-libre3/arch/x86/kernel/cpu/mcheck/therm_throt.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/cpu/mcheck/therm_throt.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/cpu/mcheck/therm_throt.c	2011-08-01 16:56:51.000000000 -0400
@@ -293,18 +293,20 @@
 	 */
 	rdmsr(MSR_IA32_MISC_ENABLE, l, h);
 
+	h = lvtthmr_init;
 	/*
 	 * The initial value of thermal LVT entries on all APs always reads
 	 * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
 	 * sequence to them and LVT registers are reset to 0s except for
 	 * the mask bits which are set to 1s when APs receive INIT IPI.
-	 * Always restore the value that BIOS has programmed on AP based on
-	 * BSP's info we saved since BIOS is always setting the same value
-	 * for all threads/cores
+	 * If BIOS takes over the thermal interrupt and sets its interrupt
+	 * delivery mode to SMI (not fixed), it restores the value that the
+	 * BIOS has programmed on AP based on BSP's info we saved since BIOS
+	 * is always setting the same value for all threads/cores.
 	 */
-	apic_write(APIC_LVTTHMR, lvtthmr_init);
+	if ((h & APIC_DM_FIXED_MASK) != APIC_DM_FIXED)
+		apic_write(APIC_LVTTHMR, lvtthmr_init);
 
-	h = lvtthmr_init;
 
 	if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) {
 		printk(KERN_DEBUG
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.35.14-libre3/arch/x86/kernel/cpu/mtrr/main.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/cpu/mtrr/main.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/cpu/mtrr/main.c	2011-08-01 16:56:51.000000000 -0400
@@ -247,6 +247,25 @@
 	unsigned long flags;
 	int cpu;
 
+#ifdef CONFIG_SMP
+	/*
+	 * If this cpu is not yet active, we are in the cpu online path. There
+	 * can be no stop_machine() in parallel, as stop machine ensures this
+	 * by using get_online_cpus(). We can skip taking the stop_cpus_mutex,
+	 * as we don't need it and also we can't afford to block while waiting
+	 * for the mutex.
+	 *
+	 * If this cpu is active, we need to prevent stop_machine() happening
+	 * in parallel by taking the stop cpus mutex.
+	 *
+	 * Also, this is called in the context of cpu online path or in the
+	 * context where cpu hotplug is prevented. So checking the active status
+	 * of the raw_smp_processor_id() is safe.
+	 */
+	if (cpu_active(raw_smp_processor_id()))
+		mutex_lock(&stop_cpus_mutex);
+#endif
+
 	preempt_disable();
 
 	data.smp_reg = reg;
@@ -329,6 +348,10 @@
 
 	local_irq_restore(flags);
 	preempt_enable();
+#ifdef CONFIG_SMP
+	if (cpu_active(raw_smp_processor_id()))
+		mutex_unlock(&stop_cpus_mutex);
+#endif
 }
 
 /**
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/process_32.c linux-2.6.35.14-libre3/arch/x86/kernel/process_32.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/process_32.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/process_32.c	2011-08-01 16:56:51.000000000 -0400
@@ -245,7 +245,6 @@
 {
 	set_user_gs(regs, 0);
 	regs->fs		= 0;
-	set_fs(USER_DS);
 	regs->ds		= __USER_DS;
 	regs->es		= __USER_DS;
 	regs->ss		= __USER_DS;
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/process_64.c linux-2.6.35.14-libre3/arch/x86/kernel/process_64.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/process_64.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/process_64.c	2011-08-01 16:56:51.000000000 -0400
@@ -337,7 +337,6 @@
 	regs->cs		= _cs;
 	regs->ss		= _ss;
 	regs->flags		= X86_EFLAGS_IF;
-	set_fs(USER_DS);
 	/*
 	 * Free the old FP and other extended state
 	 */
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/reboot.c linux-2.6.35.14-libre3/arch/x86/kernel/reboot.c
--- linux-2.6.35.13-libre3/arch/x86/kernel/reboot.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/reboot.c	2011-08-01 16:56:51.000000000 -0400
@@ -477,6 +477,22 @@
 			DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"),
 		},
 	},
+	{	/* Handle problems with rebooting on the Latitude E5420. */
+		.callback = set_pci_reboot,
+		.ident = "Dell Latitude E5420",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E5420"),
+		},
+	},
+	{	/* Handle problems with rebooting on the Latitude E6420. */
+		.callback = set_pci_reboot,
+		.ident = "Dell Latitude E6420",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6420"),
+		},
+	},
 	{ }
 };
 
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/relocate_kernel_32.S linux-2.6.35.14-libre3/arch/x86/kernel/relocate_kernel_32.S
--- linux-2.6.35.13-libre3/arch/x86/kernel/relocate_kernel_32.S	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/relocate_kernel_32.S	2011-08-01 16:56:51.000000000 -0400
@@ -97,6 +97,8 @@
 	ret
 
 identity_mapped:
+	/* set return address to 0 if not preserving context */
+	pushl	$0
 	/* store the start address on the stack */
 	pushl   %edx
 
diff -druN linux-2.6.35.13-libre3/arch/x86/kernel/relocate_kernel_64.S linux-2.6.35.14-libre3/arch/x86/kernel/relocate_kernel_64.S
--- linux-2.6.35.13-libre3/arch/x86/kernel/relocate_kernel_64.S	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/kernel/relocate_kernel_64.S	2011-08-01 16:56:51.000000000 -0400
@@ -100,6 +100,8 @@
 	ret
 
 identity_mapped:
+	/* set return address to 0 if not preserving context */
+	pushq	$0
 	/* store the start address on the stack */
 	pushq   %rdx
 
diff -druN linux-2.6.35.13-libre3/arch/x86/lib/copy_user_64.S linux-2.6.35.14-libre3/arch/x86/lib/copy_user_64.S
--- linux-2.6.35.13-libre3/arch/x86/lib/copy_user_64.S	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/lib/copy_user_64.S	2011-08-01 16:56:51.000000000 -0400
@@ -72,7 +72,7 @@
 	addq %rdx,%rcx
 	jc bad_to_user
 	cmpq TI_addr_limit(%rax),%rcx
-	jae bad_to_user
+	ja bad_to_user
 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
 	CFI_ENDPROC
 ENDPROC(_copy_to_user)
@@ -85,7 +85,7 @@
 	addq %rdx,%rcx
 	jc bad_from_user
 	cmpq TI_addr_limit(%rax),%rcx
-	jae bad_from_user
+	ja bad_from_user
 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
 	CFI_ENDPROC
 ENDPROC(_copy_from_user)
diff -druN linux-2.6.35.13-libre3/arch/x86/xen/mmu.c linux-2.6.35.14-libre3/arch/x86/xen/mmu.c
--- linux-2.6.35.13-libre3/arch/x86/xen/mmu.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/xen/mmu.c	2011-08-01 16:56:51.000000000 -0400
@@ -1142,7 +1142,7 @@
 
 	active_mm = percpu_read(cpu_tlbstate.active_mm);
 
-	if (active_mm == mm)
+	if (active_mm == mm && percpu_read(cpu_tlbstate.state) != TLBSTATE_OK)
 		leave_mm(smp_processor_id());
 
 	/* If this cpu still has a stale cr3 reference, then make sure
@@ -1641,6 +1641,11 @@
 		for (pteidx = 0; pteidx < PTRS_PER_PTE; pteidx++, pfn++) {
 			pte_t pte;
 
+#ifdef CONFIG_X86_32
+			if (pfn > max_pfn_mapped)
+				max_pfn_mapped = pfn;
+#endif
+
 			if (!pte_none(pte_page[pteidx]))
 				continue;
 
@@ -1753,7 +1758,9 @@
 {
 	pmd_t *kernel_pmd;
 
-	max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->mfn_list));
+	max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->pt_base) +
+				  xen_start_info->nr_pt_frames * PAGE_SIZE +
+				  512*1024);
 
 	kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
 	memcpy(level2_kernel_pgt, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
diff -druN linux-2.6.35.13-libre3/arch/x86/xen/multicalls.c linux-2.6.35.14-libre3/arch/x86/xen/multicalls.c
--- linux-2.6.35.13-libre3/arch/x86/xen/multicalls.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/x86/xen/multicalls.c	2011-08-01 16:56:51.000000000 -0400
@@ -189,10 +189,10 @@
 	unsigned argidx = roundup(b->argidx, sizeof(u64));
 
 	BUG_ON(preemptible());
-	BUG_ON(b->argidx > MC_ARGS);
+	BUG_ON(b->argidx >= MC_ARGS);
 
 	if (b->mcidx == MC_BATCH ||
-	    (argidx + args) > MC_ARGS) {
+	    (argidx + args) >= MC_ARGS) {
 		mc_stats_flush(b->mcidx == MC_BATCH ? FL_SLOTS : FL_ARGS);
 		xen_mc_flush();
 		argidx = roundup(b->argidx, sizeof(u64));
@@ -206,7 +206,7 @@
 	ret.args = &b->args[argidx];
 	b->argidx = argidx + args;
 
-	BUG_ON(b->argidx > MC_ARGS);
+	BUG_ON(b->argidx >= MC_ARGS);
 	return ret;
 }
 
@@ -216,7 +216,7 @@
 	struct multicall_space ret = { NULL, NULL };
 
 	BUG_ON(preemptible());
-	BUG_ON(b->argidx > MC_ARGS);
+	BUG_ON(b->argidx >= MC_ARGS);
 
 	if (b->mcidx == 0)
 		return ret;
@@ -224,14 +224,14 @@
 	if (b->entries[b->mcidx - 1].op != op)
 		return ret;
 
-	if ((b->argidx + size) > MC_ARGS)
+	if ((b->argidx + size) >= MC_ARGS)
 		return ret;
 
 	ret.mc = &b->entries[b->mcidx - 1];
 	ret.args = &b->args[b->argidx];
 	b->argidx += size;
 
-	BUG_ON(b->argidx > MC_ARGS);
+	BUG_ON(b->argidx >= MC_ARGS);
 	return ret;
 }
 
diff -druN linux-2.6.35.13-libre3/arch/xtensa/kernel/ptrace.c linux-2.6.35.14-libre3/arch/xtensa/kernel/ptrace.c
--- linux-2.6.35.13-libre3/arch/xtensa/kernel/ptrace.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/arch/xtensa/kernel/ptrace.c	2011-08-01 16:56:51.000000000 -0400
@@ -147,6 +147,9 @@
 	elf_xtregs_t *xtregs = uregs;
 	int ret = 0;
 
+	if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t)))
+		return -EFAULT;
+
 #if XTENSA_HAVE_COPROCESSORS
 	/* Flush all coprocessors before we overwrite them. */
 	coprocessor_flush_all(ti);
diff -druN linux-2.6.35.13-libre3/block/blk-core.c linux-2.6.35.14-libre3/block/blk-core.c
--- linux-2.6.35.13-libre3/block/blk-core.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/block/blk-core.c	2011-08-01 16:56:51.000000000 -0400
@@ -311,6 +311,7 @@
 	trace_block_unplug_timer(q);
 	kblockd_schedule_work(q, &q->unplug_work);
 }
+EXPORT_SYMBOL(blk_put_queue);
 
 void blk_unplug(struct request_queue *q)
 {
@@ -640,6 +641,7 @@
 
 	return 1;
 }
+EXPORT_SYMBOL(blk_get_queue);
 
 static inline void blk_free_request(struct request_queue *q, struct request *rq)
 {
@@ -891,6 +893,9 @@
 {
 	struct request *rq;
 
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return NULL;
+
 	BUG_ON(rw != READ && rw != WRITE);
 
 	spin_lock_irq(q->queue_lock);
diff -druN linux-2.6.35.13-libre3/block/blk-exec.c linux-2.6.35.14-libre3/block/blk-exec.c
--- linux-2.6.35.13-libre3/block/blk-exec.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/block/blk-exec.c	2011-08-01 16:56:51.000000000 -0400
@@ -50,6 +50,13 @@
 {
 	int where = at_head ? ELEVATOR_INSERT_FRONT : ELEVATOR_INSERT_BACK;
 
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) {
+		rq->errors = -ENXIO;
+		if (rq->end_io)
+			rq->end_io(rq, rq->errors);
+		return;
+	}
+
 	rq->rq_disk = bd_disk;
 	rq->end_io = done;
 	WARN_ON(irqs_disabled());
diff -druN linux-2.6.35.13-libre3/block/blk.h linux-2.6.35.14-libre3/block/blk.h
--- linux-2.6.35.13-libre3/block/blk.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/block/blk.h	2011-08-01 16:56:51.000000000 -0400
@@ -62,7 +62,8 @@
 				return rq;
 		}
 
-		if (!q->elevator->ops->elevator_dispatch_fn(q, 0))
+		if (test_bit(QUEUE_FLAG_DEAD, &q->queue_flags) ||
+		    !q->elevator->ops->elevator_dispatch_fn(q, 0))
 			return NULL;
 	}
 }
diff -druN linux-2.6.35.13-libre3/block/cfq-iosched.c linux-2.6.35.14-libre3/block/cfq-iosched.c
--- linux-2.6.35.13-libre3/block/cfq-iosched.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/block/cfq-iosched.c	2011-08-01 16:56:51.000000000 -0400
@@ -2615,8 +2615,14 @@
 	smp_wmb();
 	cic->key = cfqd_dead_key(cfqd);
 
-	if (ioc->ioc_data == cic)
+	rcu_read_lock();
+	if (rcu_dereference(ioc->ioc_data) == cic) {
+		rcu_read_unlock();
+		spin_lock(&ioc->lock);
 		rcu_assign_pointer(ioc->ioc_data, NULL);
+		spin_unlock(&ioc->lock);
+	} else
+		rcu_read_unlock();
 
 	if (cic->cfqq[BLK_RW_ASYNC]) {
 		cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
diff -druN linux-2.6.35.13-libre3/Documentation/kbuild/makefiles.txt linux-2.6.35.14-libre3/Documentation/kbuild/makefiles.txt
--- linux-2.6.35.13-libre3/Documentation/kbuild/makefiles.txt	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/Documentation/kbuild/makefiles.txt	2011-08-01 16:56:51.000000000 -0400
@@ -502,6 +502,18 @@
 	gcc >= 3.00. For gcc < 3.00, -malign-functions=4 is used.
 	Note: cc-option-align uses KBUILD_CFLAGS for $(CC) options
 
+    cc-disable-warning
+	cc-disable-warning checks if gcc supports a given warning and returns
+	the commandline switch to disable it. This special function is needed,
+	because gcc 4.4 and later accept any unknown -Wno-* option and only
+	warn about it if there is another warning in the source file.
+
+	Example:
+		KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+
+	In the above example, -Wno-unused-but-set-variable will be added to
+	KBUILD_CFLAGS only if gcc really accepts it.
+
     cc-version
 	cc-version returns a numerical version of the $(CC) compiler version.
 	The format is <major><minor> where both are two digits. So for example
diff -druN linux-2.6.35.13-libre3/Documentation/Makefile linux-2.6.35.14-libre3/Documentation/Makefile
--- linux-2.6.35.13-libre3/Documentation/Makefile	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/Documentation/Makefile	2011-08-01 16:56:51.000000000 -0400
@@ -1,3 +1,3 @@
 obj-m := DocBook/ accounting/ auxdisplay/ connector/ \
 	filesystems/ filesystems/configfs/ ia64/ laptops/ networking/ \
-	pcmcia/ spi/ timers/ video4linux/ vm/ watchdog/src/
+	pcmcia/ spi/ timers/ vm/ watchdog/src/
diff -druN linux-2.6.35.13-libre3/Documentation/usb/proc_usb_info.txt linux-2.6.35.14-libre3/Documentation/usb/proc_usb_info.txt
--- linux-2.6.35.13-libre3/Documentation/usb/proc_usb_info.txt	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/Documentation/usb/proc_usb_info.txt	2011-08-01 16:56:51.000000000 -0400
@@ -1,12 +1,17 @@
 /proc/bus/usb filesystem output
 ===============================
-(version 2003.05.30)
+(version 2010.09.13)
 
 
 The usbfs filesystem for USB devices is traditionally mounted at
 /proc/bus/usb.  It provides the /proc/bus/usb/devices file, as well as
 the /proc/bus/usb/BBB/DDD files.
 
+In many modern systems the usbfs filsystem isn't used at all.  Instead
+USB device nodes are created under /dev/usb/ or someplace similar.  The
+"devices" file is available in debugfs, typically as
+/sys/kernel/debug/usb/devices.
+
 
 **NOTE**: If /proc/bus/usb appears empty, and a host controller
 	  driver has been linked, then you need to mount the
@@ -106,8 +111,8 @@
 
 Topology info:
 
-T:  Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd
-|   |      |      |       |       |      |        |       |__MaxChildren
+T:  Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd
+|   |      |      |       |       |      |        |        |__MaxChildren
 |   |      |      |       |       |      |        |__Device Speed in Mbps
 |   |      |      |       |       |      |__DeviceNumber
 |   |      |      |       |       |__Count of devices at this level
@@ -120,8 +125,13 @@
     Speed may be:
     	1.5	Mbit/s for low speed USB
 	12	Mbit/s for full speed USB
-	480	Mbit/s for high speed USB (added for USB 2.0)
+	480	Mbit/s for high speed USB (added for USB 2.0);
+		  also used for Wireless USB, which has no fixed speed
+	5000	Mbit/s for SuperSpeed USB (added for USB 3.0)
 
+    For reasons lost in the mists of time, the Port number is always
+    too low by 1.  For example, a device plugged into port 4 will
+    show up with "Port=03".
 
 Bandwidth info:
 B:  Alloc=ddd/ddd us (xx%), #Int=ddd, #Iso=ddd
@@ -291,7 +301,7 @@
 an external hub connected to the root hub, and a mouse and
 a serial converter connected to the external hub.
 
-T:  Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2
+T:  Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 2
 B:  Alloc= 28/900 us ( 3%), #Int=  2, #Iso=  0
 D:  Ver= 1.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
 P:  Vendor=0000 ProdID=0000 Rev= 0.00
@@ -301,21 +311,21 @@
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
 E:  Ad=81(I) Atr=03(Int.) MxPS=   8 Ivl=255ms
 
-T:  Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12  MxCh= 4
+T:  Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 4
 D:  Ver= 1.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
 P:  Vendor=0451 ProdID=1446 Rev= 1.00
 C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=100mA
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
 E:  Ad=81(I) Atr=03(Int.) MxPS=   1 Ivl=255ms
 
-T:  Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=1.5 MxCh= 0
+T:  Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=1.5  MxCh= 0
 D:  Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
 P:  Vendor=04b4 ProdID=0001 Rev= 0.00
 C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=01 Prot=02 Driver=mouse
 E:  Ad=81(I) Atr=03(Int.) MxPS=   3 Ivl= 10ms
 
-T:  Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=  4 Spd=12  MxCh= 0
+T:  Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
 D:  Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
 P:  Vendor=0565 ProdID=0001 Rev= 1.08
 S:  Manufacturer=Peracom Networks, Inc.
@@ -330,12 +340,12 @@
 Selecting only the "T:" and "I:" lines from this (for example, by using
 "procusb ti"), we have:
 
-T:  Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2
-T:  Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12  MxCh= 4
+T:  Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 2
+T:  Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 4
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
-T:  Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=1.5 MxCh= 0
+T:  Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=1.5  MxCh= 0
 I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=01 Prot=02 Driver=mouse
-T:  Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=  4 Spd=12  MxCh= 0
+T:  Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
 I:  If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=serial
 
 
diff -druN linux-2.6.35.13-libre3/Documentation/video4linux/Makefile linux-2.6.35.14-libre3/Documentation/video4linux/Makefile
--- linux-2.6.35.13-libre3/Documentation/video4linux/Makefile	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/Documentation/video4linux/Makefile	1969-12-31 19:00:00.000000000 -0500
@@ -1,8 +0,0 @@
-# kbuild trick to avoid linker error. Can be omitted if a module is built.
-obj- := dummy.o
-
-# List of programs to build
-hostprogs-y := v4lgrab
-
-# Tell kbuild to always build the programs
-always := $(hostprogs-y)
diff -druN linux-2.6.35.13-libre3/Documentation/video4linux/v4lgrab.c linux-2.6.35.14-libre3/Documentation/video4linux/v4lgrab.c
--- linux-2.6.35.13-libre3/Documentation/video4linux/v4lgrab.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/Documentation/video4linux/v4lgrab.c	1969-12-31 19:00:00.000000000 -0500
@@ -1,201 +0,0 @@
-/* Simple Video4Linux image grabber. */
-/*
- *	Video4Linux Driver Test/Example Framegrabbing Program
- *
- *	Compile with:
- *		gcc -s -Wall -Wstrict-prototypes v4lgrab.c -o v4lgrab
- *	Use as:
- *		v4lgrab >image.ppm
- *
- *	Copyright (C) 1998-05-03, Phil Blundell <philb@gnu.org>
- *	Copied from http://www.tazenda.demon.co.uk/phil/vgrabber.c
- *	with minor modifications (Dave Forrest, drf5n@virginia.edu).
- *
- *
- *	For some cameras you may need to pre-load libv4l to perform
- *	the necessary decompression, e.g.:
- *
- *	export LD_PRELOAD=/usr/lib/libv4l/v4l1compat.so
- *	./v4lgrab >image.ppm
- *
- *	see http://hansdegoede.livejournal.com/3636.html for details.
- *
- */
-
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <sys/ioctl.h>
-#include <stdlib.h>
-
-#include <linux/types.h>
-#include <linux/videodev.h>
-
-#define VIDEO_DEV "/dev/video0"
-
-/* Stole this from tvset.c */
-
-#define READ_VIDEO_PIXEL(buf, format, depth, r, g, b)                   \
-{                                                                       \
-	switch (format)                                                 \
-	{                                                               \
-		case VIDEO_PALETTE_GREY:                                \
-			switch (depth)                                  \
-			{                                               \
-				case 4:                                 \
-				case 6:                                 \
-				case 8:                                 \
-					(r) = (g) = (b) = (*buf++ << 8);\
-					break;                          \
-									\
-				case 16:                                \
-					(r) = (g) = (b) =               \
-						*((unsigned short *) buf);      \
-					buf += 2;                       \
-					break;                          \
-			}                                               \
-			break;                                          \
-									\
-									\
-		case VIDEO_PALETTE_RGB565:                              \
-		{                                                       \
-			unsigned short tmp = *(unsigned short *)buf;    \
-			(r) = tmp&0xF800;                               \
-			(g) = (tmp<<5)&0xFC00;                          \
-			(b) = (tmp<<11)&0xF800;                         \
-			buf += 2;                                       \
-		}                                                       \
-		break;                                                  \
-									\
-		case VIDEO_PALETTE_RGB555:                              \
-			(r) = (buf[0]&0xF8)<<8;                         \
-			(g) = ((buf[0] << 5 | buf[1] >> 3)&0xF8)<<8;    \
-			(b) = ((buf[1] << 2 ) & 0xF8)<<8;               \
-			buf += 2;                                       \
-			break;                                          \
-									\
-		case VIDEO_PALETTE_RGB24:                               \
-			(r) = buf[0] << 8; (g) = buf[1] << 8;           \
-			(b) = buf[2] << 8;                              \
-			buf += 3;                                       \
-			break;                                          \
-									\
-		default:                                                \
-			fprintf(stderr,                                 \
-				"Format %d not yet supported\n",        \
-				format);                                \
-	}                                                               \
-}
-
-static int get_brightness_adj(unsigned char *image, long size, int *brightness) {
-  long i, tot = 0;
-  for (i=0;i<size*3;i++)
-    tot += image[i];
-  *brightness = (128 - tot/(size*3))/3;
-  return !((tot/(size*3)) >= 126 && (tot/(size*3)) <= 130);
-}
-
-int main(int argc, char ** argv)
-{
-  int fd = open(VIDEO_DEV, O_RDONLY), f;
-  struct video_capability cap;
-  struct video_window win;
-  struct video_picture vpic;
-
-  unsigned char *buffer, *src;
-  int bpp = 24, r = 0, g = 0, b = 0;
-  unsigned int i, src_depth = 16;
-
-  if (fd < 0) {
-    perror(VIDEO_DEV);
-    exit(1);
-  }
-
-  if (ioctl(fd, VIDIOCGCAP, &cap) < 0) {
-    perror("VIDIOGCAP");
-    fprintf(stderr, "(" VIDEO_DEV " not a video4linux device?)\n");
-    close(fd);
-    exit(1);
-  }
-
-  if (ioctl(fd, VIDIOCGWIN, &win) < 0) {
-    perror("VIDIOCGWIN");
-    close(fd);
-    exit(1);
-  }
-
-  if (ioctl(fd, VIDIOCGPICT, &vpic) < 0) {
-    perror("VIDIOCGPICT");
-    close(fd);
-    exit(1);
-  }
-
-  if (cap.type & VID_TYPE_MONOCHROME) {
-    vpic.depth=8;
-    vpic.palette=VIDEO_PALETTE_GREY;    /* 8bit grey */
-    if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
-      vpic.depth=6;
-      if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
-	vpic.depth=4;
-	if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
-	  fprintf(stderr, "Unable to find a supported capture format.\n");
-	  close(fd);
-	  exit(1);
-	}
-      }
-    }
-  } else {
-    vpic.depth=24;
-    vpic.palette=VIDEO_PALETTE_RGB24;
-
-    if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
-      vpic.palette=VIDEO_PALETTE_RGB565;
-      vpic.depth=16;
-
-      if(ioctl(fd, VIDIOCSPICT, &vpic)==-1) {
-	vpic.palette=VIDEO_PALETTE_RGB555;
-	vpic.depth=15;
-
-	if(ioctl(fd, VIDIOCSPICT, &vpic)==-1) {
-	  fprintf(stderr, "Unable to find a supported capture format.\n");
-	  return -1;
-	}
-      }
-    }
-  }
-
-  buffer = malloc(win.width * win.height * bpp);
-  if (!buffer) {
-    fprintf(stderr, "Out of memory.\n");
-    exit(1);
-  }
-
-  do {
-    int newbright;
-    read(fd, buffer, win.width * win.height * bpp);
-    f = get_brightness_adj(buffer, win.width * win.height, &newbright);
-    if (f) {
-      vpic.brightness += (newbright << 8);
-      if(ioctl(fd, VIDIOCSPICT, &vpic)==-1) {
-	perror("VIDIOSPICT");
-	break;
-      }
-    }
-  } while (f);
-
-  fprintf(stdout, "P6\n%d %d 255\n", win.width, win.height);
-
-  src = buffer;
-
-  for (i = 0; i < win.width * win.height; i++) {
-    READ_VIDEO_PIXEL(src, vpic.palette, src_depth, r, g, b);
-    fputc(r>>8, stdout);
-    fputc(g>>8, stdout);
-    fputc(b>>8, stdout);
-  }
-
-  close(fd);
-  return 0;
-}
diff -druN linux-2.6.35.13-libre3/drivers/ata/libata-scsi.c linux-2.6.35.14-libre3/drivers/ata/libata-scsi.c
--- linux-2.6.35.13-libre3/drivers/ata/libata-scsi.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/ata/libata-scsi.c	2011-08-01 16:56:51.000000000 -0400
@@ -1129,13 +1129,13 @@
 	/* configure max sectors */
 	blk_queue_max_hw_sectors(sdev->request_queue, dev->max_sectors);
 
+	sdev->sector_size = ATA_SECT_SIZE;
+
 	if (dev->class == ATA_DEV_ATAPI) {
 		struct request_queue *q = sdev->request_queue;
 		void *buf;
 
-		/* set the min alignment and padding */
-		blk_queue_update_dma_alignment(sdev->request_queue,
-					       ATA_DMA_PAD_SZ - 1);
+		/* set DMA padding */
 		blk_queue_update_dma_pad(sdev->request_queue,
 					 ATA_DMA_PAD_SZ - 1);
 
@@ -1149,12 +1149,24 @@
 
 		blk_queue_dma_drain(q, atapi_drain_needed, buf, ATAPI_MAX_DRAIN);
 	} else {
-		/* ATA devices must be sector aligned */
-		blk_queue_update_dma_alignment(sdev->request_queue,
-					       ATA_SECT_SIZE - 1);
 		sdev->manage_start_stop = 1;
 	}
 
+	/*
+	 * ata_pio_sectors() expects buffer for each sector to not cross
+	 * page boundary.  Enforce it by requiring buffers to be sector
+	 * aligned, which works iff sector_size is not larger than
+	 * PAGE_SIZE.  ATAPI devices also need the alignment as
+	 * IDENTIFY_PACKET is executed as ATA_PROT_PIO.
+	 */
+	if (sdev->sector_size > PAGE_SIZE)
+		ata_dev_printk(dev, KERN_WARNING,
+			"sector_size=%u > PAGE_SIZE, PIO may malfunction\n",
+			sdev->sector_size);
+
+	blk_queue_update_dma_alignment(sdev->request_queue,
+				       sdev->sector_size - 1);
+
 	if (dev->flags & ATA_DFLAG_AN)
 		set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events);
 
diff -druN linux-2.6.35.13-libre3/drivers/block/brd.c linux-2.6.35.14-libre3/drivers/block/brd.c
--- linux-2.6.35.13-libre3/drivers/block/brd.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/block/brd.c	2011-08-01 16:56:51.000000000 -0400
@@ -549,7 +549,7 @@
 	struct kobject *kobj;
 
 	mutex_lock(&brd_devices_mutex);
-	brd = brd_init_one(dev & MINORMASK);
+	brd = brd_init_one(MINOR(dev) >> part_shift);
 	kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM);
 	mutex_unlock(&brd_devices_mutex);
 
@@ -582,15 +582,18 @@
 	if (max_part > 0)
 		part_shift = fls(max_part);
 
+	if ((1UL << part_shift) > DISK_MAX_PARTS)
+		return -EINVAL;
+
 	if (rd_nr > 1UL << (MINORBITS - part_shift))
 		return -EINVAL;
 
 	if (rd_nr) {
 		nr = rd_nr;
-		range = rd_nr;
+		range = rd_nr << part_shift;
 	} else {
 		nr = CONFIG_BLK_DEV_RAM_COUNT;
-		range = 1UL << (MINORBITS - part_shift);
+		range = 1UL << MINORBITS;
 	}
 
 	if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
@@ -629,7 +632,7 @@
 	unsigned long range;
 	struct brd_device *brd, *next;
 
-	range = rd_nr ? rd_nr :  1UL << (MINORBITS - part_shift);
+	range = rd_nr ? rd_nr << part_shift : 1UL << MINORBITS;
 
 	list_for_each_entry_safe(brd, next, &brd_devices, brd_list)
 		brd_del_one(brd);
diff -druN linux-2.6.35.13-libre3/drivers/block/loop.c linux-2.6.35.14-libre3/drivers/block/loop.c
--- linux-2.6.35.13-libre3/drivers/block/loop.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/block/loop.c	2011-08-01 16:56:51.000000000 -0400
@@ -1579,7 +1579,7 @@
 	struct kobject *kobj;
 
 	mutex_lock(&loop_devices_mutex);
-	lo = loop_init_one(dev & MINORMASK);
+	lo = loop_init_one(MINOR(dev) >> part_shift);
 	kobj = lo ? get_disk(lo->lo_disk) : ERR_PTR(-ENOMEM);
 	mutex_unlock(&loop_devices_mutex);
 
@@ -1612,15 +1612,18 @@
 	if (max_part > 0)
 		part_shift = fls(max_part);
 
+	if ((1UL << part_shift) > DISK_MAX_PARTS)
+		return -EINVAL;
+
 	if (max_loop > 1UL << (MINORBITS - part_shift))
 		return -EINVAL;
 
 	if (max_loop) {
 		nr = max_loop;
-		range = max_loop;
+		range = max_loop << part_shift;
 	} else {
 		nr = 8;
-		range = 1UL << (MINORBITS - part_shift);
+		range = 1UL << MINORBITS;
 	}
 
 	if (register_blkdev(LOOP_MAJOR, "loop"))
@@ -1659,7 +1662,7 @@
 	unsigned long range;
 	struct loop_device *lo, *next;
 
-	range = max_loop ? max_loop :  1UL << (MINORBITS - part_shift);
+	range = max_loop ? max_loop << part_shift : 1UL << MINORBITS;
 
 	list_for_each_entry_safe(lo, next, &loop_devices, lo_list)
 		loop_del_one(lo);
diff -druN linux-2.6.35.13-libre3/drivers/block/nbd.c linux-2.6.35.14-libre3/drivers/block/nbd.c
--- linux-2.6.35.13-libre3/drivers/block/nbd.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/block/nbd.c	2011-08-01 16:56:51.000000000 -0400
@@ -755,6 +755,12 @@
 	if (max_part > 0)
 		part_shift = fls(max_part);
 
+	if ((1UL << part_shift) > DISK_MAX_PARTS)
+		return -EINVAL;
+
+	if (nbds_max > 1UL << (MINORBITS - part_shift))
+		return -EINVAL;
+
 	for (i = 0; i < nbds_max; i++) {
 		struct gendisk *disk = alloc_disk(1 << part_shift);
 		if (!disk)
diff -druN linux-2.6.35.13-libre3/drivers/bluetooth/btusb.c linux-2.6.35.14-libre3/drivers/bluetooth/btusb.c
--- linux-2.6.35.13-libre3/drivers/bluetooth/btusb.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/bluetooth/btusb.c	2011-08-01 16:56:51.000000000 -0400
@@ -59,9 +59,18 @@
 	/* Generic Bluetooth USB device */
 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
 
+	/* Apple MacBookPro 7,1 */
+	{ USB_DEVICE(0x05ac, 0x8213) },
+
 	/* Apple iMac11,1 */
 	{ USB_DEVICE(0x05ac, 0x8215) },
 
+	/* Apple MacBookPro6,2 */
+	{ USB_DEVICE(0x05ac, 0x8218) },
+
+	/* Apple MacBookAir3,1, MacBookAir3,2 */
+	{ USB_DEVICE(0x05ac, 0x821b) },
+
 	/* Apple MacBookPro8,2 */
 	{ USB_DEVICE(0x05ac, 0x821a) },
 
diff -druN linux-2.6.35.13-libre3/drivers/char/agp/generic.c linux-2.6.35.14-libre3/drivers/char/agp/generic.c
--- linux-2.6.35.13-libre3/drivers/char/agp/generic.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/char/agp/generic.c	2011-08-01 16:56:51.000000000 -0400
@@ -122,6 +122,9 @@
 	struct agp_memory *new;
 	unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
 
+	if (INT_MAX/sizeof(struct page *) < num_agp_pages)
+		return NULL;
+
 	new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
 	if (new == NULL)
 		return NULL;
@@ -241,11 +244,14 @@
 	int scratch_pages;
 	struct agp_memory *new;
 	size_t i;
+	int cur_memory;
 
 	if (!bridge)
 		return NULL;
 
-	if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
+	cur_memory = atomic_read(&bridge->current_memory_agp);
+	if ((cur_memory + page_count > bridge->max_memory_agp) ||
+	    (cur_memory + page_count < page_count))
 		return NULL;
 
 	if (type >= AGP_USER_TYPES) {
@@ -1122,8 +1128,8 @@
 		return -EINVAL;
 	}
 
-	/* AK: could wrap */
-	if ((pg_start + mem->page_count) > num_entries)
+	if (((pg_start + mem->page_count) > num_entries) ||
+	    ((pg_start + mem->page_count) < pg_start))
 		return -EINVAL;
 
 	j = pg_start;
@@ -1157,7 +1163,7 @@
 {
 	size_t i;
 	struct agp_bridge_data *bridge;
-	int mask_type;
+	int mask_type, num_entries;
 
 	bridge = mem->bridge;
 	if (!bridge)
@@ -1169,6 +1175,11 @@
 	if (type != mem->type)
 		return -EINVAL;
 
+	num_entries = agp_num_entries();
+	if (((pg_start + mem->page_count) > num_entries) ||
+	    ((pg_start + mem->page_count) < pg_start))
+		return -EINVAL;
+
 	mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
 	if (mask_type != 0) {
 		/* The generic routines know nothing of memory types */
diff -druN linux-2.6.35.13-libre3/drivers/char/hvc_console.c linux-2.6.35.14-libre3/drivers/char/hvc_console.c
--- linux-2.6.35.13-libre3/drivers/char/hvc_console.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/char/hvc_console.c	2011-08-01 16:56:51.000000000 -0400
@@ -163,8 +163,10 @@
 		} else {
 			r = cons_ops[index]->put_chars(vtermnos[index], c, i);
 			if (r <= 0) {
-				/* throw away chars on error */
-				i = 0;
+				/* throw away characters on error
+				 * but spin in case of -EAGAIN */
+				if (r != -EAGAIN)
+					i = 0;
 			} else if (r > 0) {
 				i -= r;
 				if (i > 0)
@@ -448,7 +450,7 @@
 
 	n = hp->ops->put_chars(hp->vtermno, hp->outbuf, hp->n_outbuf);
 	if (n <= 0) {
-		if (n == 0) {
+		if (n == 0 || n == -EAGAIN) {
 			hp->do_wakeup = 1;
 			return 0;
 		}
diff -druN linux-2.6.35.13-libre3/drivers/char/i8k.c linux-2.6.35.14-libre3/drivers/char/i8k.c
--- linux-2.6.35.13-libre3/drivers/char/i8k.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/char/i8k.c	2011-08-01 16:56:51.000000000 -0400
@@ -119,7 +119,7 @@
 	int eax = regs->eax;
 
 #if defined(CONFIG_X86_64)
-	asm("pushq %%rax\n\t"
+	asm volatile("pushq %%rax\n\t"
 		"movl 0(%%rax),%%edx\n\t"
 		"pushq %%rdx\n\t"
 		"movl 4(%%rax),%%ebx\n\t"
@@ -138,14 +138,14 @@
 		"movl %%edi,20(%%rax)\n\t"
 		"popq %%rdx\n\t"
 		"movl %%edx,0(%%rax)\n\t"
-		"lahf\n\t"
-		"shrl $8,%%eax\n\t"
+		"pushfq\n\t"
+		"popq %%rax\n\t"
 		"andl $1,%%eax\n"
 		:"=a"(rc)
 		:    "a"(regs)
 		:    "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
 #else
-	asm("pushl %%eax\n\t"
+	asm volatile("pushl %%eax\n\t"
 	    "movl 0(%%eax),%%edx\n\t"
 	    "push %%edx\n\t"
 	    "movl 4(%%eax),%%ebx\n\t"
@@ -166,7 +166,8 @@
 	    "movl %%edx,0(%%eax)\n\t"
 	    "lahf\n\t"
 	    "shrl $8,%%eax\n\t"
-	    "andl $1,%%eax\n":"=a"(rc)
+	    "andl $1,%%eax\n"
+	    :"=a"(rc)
 	    :    "a"(regs)
 	    :    "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
 #endif
diff -druN linux-2.6.35.13-libre3/drivers/cpufreq/cpufreq.c linux-2.6.35.14-libre3/drivers/cpufreq/cpufreq.c
--- linux-2.6.35.13-libre3/drivers/cpufreq/cpufreq.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/cpufreq/cpufreq.c	2011-08-01 16:56:51.000000000 -0400
@@ -1205,12 +1205,28 @@
 		cpufreq_driver->exit(data);
 	unlock_policy_rwsem_write(cpu);
 
+	cpufreq_debug_enable_ratelimit();
+
+#ifdef CONFIG_HOTPLUG_CPU
+	/* when the CPU which is the parent of the kobj is hotplugged
+	 * offline, check for siblings, and create cpufreq sysfs interface
+	 * and symlinks
+	 */
+	if (unlikely(cpumask_weight(data->cpus) > 1)) {
+		/* first sibling now owns the new sysfs dir */
+		cpumask_clear_cpu(cpu, data->cpus);
+		cpufreq_add_dev(get_cpu_sysdev(cpumask_first(data->cpus)));
+
+		/* finally remove our own symlink */
+		lock_policy_rwsem_write(cpu);
+		__cpufreq_remove_dev(sys_dev);
+	}
+#endif
+
 	free_cpumask_var(data->related_cpus);
 	free_cpumask_var(data->cpus);
 	kfree(data);
-	per_cpu(cpufreq_cpu_data, cpu) = NULL;
 
-	cpufreq_debug_enable_ratelimit();
 	return 0;
 }
 
diff -druN linux-2.6.35.13-libre3/drivers/cpufreq/cpufreq_stats.c linux-2.6.35.14-libre3/drivers/cpufreq/cpufreq_stats.c
--- linux-2.6.35.13-libre3/drivers/cpufreq/cpufreq_stats.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/cpufreq/cpufreq_stats.c	2011-08-01 16:56:51.000000000 -0400
@@ -165,17 +165,27 @@
 	return -1;
 }
 
+/* should be called late in the CPU removal sequence so that the stats
+ * memory is still available in case someone tries to use it.
+ */
 static void cpufreq_stats_free_table(unsigned int cpu)
 {
 	struct cpufreq_stats *stat = per_cpu(cpufreq_stats_table, cpu);
-	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
-	if (policy && policy->cpu == cpu)
-		sysfs_remove_group(&policy->kobj, &stats_attr_group);
 	if (stat) {
 		kfree(stat->time_in_state);
 		kfree(stat);
 	}
 	per_cpu(cpufreq_stats_table, cpu) = NULL;
+}
+
+/* must be called early in the CPU removal sequence (before
+ * cpufreq_remove_dev) so that policy is still valid.
+ */
+static void cpufreq_stats_free_sysfs(unsigned int cpu)
+{
+	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
+	if (policy && policy->cpu == cpu)
+		sysfs_remove_group(&policy->kobj, &stats_attr_group);
 	if (policy)
 		cpufreq_cpu_put(policy);
 }
@@ -316,6 +326,9 @@
 	case CPU_ONLINE_FROZEN:
 		cpufreq_update_policy(cpu);
 		break;
+	case CPU_DOWN_PREPARE:
+		cpufreq_stats_free_sysfs(cpu);
+		break;
 	case CPU_DEAD:
 	case CPU_DEAD_FROZEN:
 		cpufreq_stats_free_table(cpu);
@@ -324,9 +337,11 @@
 	return NOTIFY_OK;
 }
 
+/* priority=1 so this will get called before cpufreq_remove_dev */
 static struct notifier_block cpufreq_stat_cpu_notifier __refdata =
 {
 	.notifier_call = cpufreq_stat_cpu_callback,
+	.priority = 1,
 };
 
 static struct notifier_block notifier_policy_block = {
@@ -373,6 +388,7 @@
 	unregister_hotcpu_notifier(&cpufreq_stat_cpu_notifier);
 	for_each_online_cpu(cpu) {
 		cpufreq_stats_free_table(cpu);
+		cpufreq_stats_free_sysfs(cpu);
 	}
 }
 
diff -druN linux-2.6.35.13-libre3/drivers/cpuidle/governors/menu.c linux-2.6.35.14-libre3/drivers/cpuidle/governors/menu.c
--- linux-2.6.35.13-libre3/drivers/cpuidle/governors/menu.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/cpuidle/governors/menu.c	2011-08-01 16:56:51.000000000 -0400
@@ -236,6 +236,7 @@
 	int latency_req = pm_qos_request(PM_QOS_CPU_DMA_LATENCY);
 	int i;
 	int multiplier;
+	struct timespec t;
 
 	if (data->needs_update) {
 		menu_update(dev);
@@ -250,8 +251,9 @@
 		return 0;
 
 	/* determine the expected residency time, round up */
+	t = ktime_to_timespec(tick_nohz_get_sleep_length());
 	data->expected_us =
-	    DIV_ROUND_UP((u32)ktime_to_ns(tick_nohz_get_sleep_length()), 1000);
+		t.tv_sec * USEC_PER_SEC + t.tv_nsec / NSEC_PER_USEC;
 
 
 	data->bucket = which_bucket(data->expected_us);
diff -druN linux-2.6.35.13-libre3/drivers/firewire/core-cdev.c linux-2.6.35.14-libre3/drivers/firewire/core-cdev.c
--- linux-2.6.35.13-libre3/drivers/firewire/core-cdev.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/firewire/core-cdev.c	2011-08-01 16:56:51.000000000 -0400
@@ -219,14 +219,11 @@
 	idr_init(&client->resource_idr);
 	INIT_LIST_HEAD(&client->event_list);
 	init_waitqueue_head(&client->wait);
+	INIT_LIST_HEAD(&client->link);
 	kref_init(&client->kref);
 
 	file->private_data = client;
 
-	mutex_lock(&device->client_list_mutex);
-	list_add_tail(&client->link, &device->client_list);
-	mutex_unlock(&device->client_list_mutex);
-
 	return nonseekable_open(inode, file);
 }
 
@@ -414,15 +411,20 @@
 	if (ret != 0)
 		return -EFAULT;
 
+	mutex_lock(&client->device->client_list_mutex);
+
 	client->bus_reset_closure = a->bus_reset_closure;
 	if (a->bus_reset != 0) {
 		fill_bus_reset_event(&bus_reset, client);
-		if (copy_to_user(u64_to_uptr(a->bus_reset),
-				 &bus_reset, sizeof(bus_reset)))
-			return -EFAULT;
+		ret = copy_to_user(u64_to_uptr(a->bus_reset),
+				   &bus_reset, sizeof(bus_reset));
 	}
+	if (ret == 0 && list_empty(&client->link))
+		list_add_tail(&client->link, &client->device->client_list);
 
-	return 0;
+	mutex_unlock(&client->device->client_list_mutex);
+
+	return ret ? -EFAULT : 0;
 }
 
 static int add_client_resource(struct client *client,
@@ -1359,7 +1361,7 @@
 	if (_IOC_TYPE(cmd) != '#' ||
 	    _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers) ||
 	    _IOC_SIZE(cmd) > sizeof(buffer))
-		return -EINVAL;
+		return -ENOTTY;
 
 	if (_IOC_DIR(cmd) == _IOC_READ)
 		memset(&buffer, 0, _IOC_SIZE(cmd));
diff -druN linux-2.6.35.13-libre3/drivers/firewire/ohci.c linux-2.6.35.14-libre3/drivers/firewire/ohci.c
--- linux-2.6.35.13-libre3/drivers/firewire/ohci.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/firewire/ohci.c	2011-08-01 16:56:51.000000000 -0400
@@ -232,6 +232,7 @@
 static char ohci_driver_name[] = KBUILD_MODNAME;
 
 #define PCI_DEVICE_ID_TI_TSB12LV22	0x8009
+#define PCI_VENDOR_ID_PINNACLE_SYSTEMS	0x11bd
 
 #define QUIRK_CYCLE_TIMER		1
 #define QUIRK_RESET_PACKET		2
@@ -2480,6 +2481,11 @@
 	int i, err, n_ir, n_it;
 	size_t size;
 
+	if (dev->vendor == PCI_VENDOR_ID_PINNACLE_SYSTEMS) {
+		dev_err(&dev->dev, "Pinnacle MovieBoard is not yet supported\n");
+		return -ENOSYS;
+	}
+
 	ohci = kzalloc(sizeof(*ohci), GFP_KERNEL);
 	if (ohci == NULL) {
 		err = -ENOMEM;
diff -druN linux-2.6.35.13-libre3/drivers/gpu/drm/i915/intel_lvds.c linux-2.6.35.14-libre3/drivers/gpu/drm/i915/intel_lvds.c
--- linux-2.6.35.13-libre3/drivers/gpu/drm/i915/intel_lvds.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/gpu/drm/i915/intel_lvds.c	2011-08-01 16:56:51.000000000 -0400
@@ -832,6 +832,14 @@
 			DMI_MATCH(DMI_PRODUCT_NAME, "U800"),
 		},
 	},
+	{
+		.callback = intel_no_lvds_dmi_callback,
+		.ident = "Asus EeeBox PC EB1007",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "EB1007"),
+		},
+	},
 
 	{ }	/* terminating entry */
 };
diff -druN linux-2.6.35.13-libre3/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.35.14-libre3/drivers/gpu/drm/radeon/radeon_device.c
--- linux-2.6.35.13-libre3/drivers/gpu/drm/radeon/radeon_device.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/gpu/drm/radeon/radeon_device.c	2011-08-01 16:56:51.000000000 -0400
@@ -645,6 +645,7 @@
 	dma_bits = rdev->need_dma32 ? 32 : 40;
 	r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
 	if (r) {
+		rdev->need_dma32 = true;
 		printk(KERN_WARNING "radeon: No suitable DMA available.\n");
 	}
 
diff -druN linux-2.6.35.13-libre3/drivers/hid/hid-apple.c linux-2.6.35.14-libre3/drivers/hid/hid-apple.c
--- linux-2.6.35.13-libre3/drivers/hid/hid-apple.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/hid/hid-apple.c	2011-08-01 16:56:51.000000000 -0400
@@ -59,6 +59,27 @@
 	u8 flags;
 };
 
+static const struct apple_key_translation macbookair_fn_keys[] = {
+	{ KEY_BACKSPACE, KEY_DELETE },
+	{ KEY_ENTER,	KEY_INSERT },
+	{ KEY_F1,	KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY },
+	{ KEY_F2,	KEY_BRIGHTNESSUP,   APPLE_FLAG_FKEY },
+	{ KEY_F3,	KEY_SCALE,          APPLE_FLAG_FKEY },
+	{ KEY_F4,	KEY_DASHBOARD,      APPLE_FLAG_FKEY },
+	{ KEY_F6,	KEY_PREVIOUSSONG,   APPLE_FLAG_FKEY },
+	{ KEY_F7,	KEY_PLAYPAUSE,      APPLE_FLAG_FKEY },
+	{ KEY_F8,	KEY_NEXTSONG,       APPLE_FLAG_FKEY },
+	{ KEY_F9,	KEY_MUTE,           APPLE_FLAG_FKEY },
+	{ KEY_F10,	KEY_VOLUMEDOWN,     APPLE_FLAG_FKEY },
+	{ KEY_F11,	KEY_VOLUMEUP,       APPLE_FLAG_FKEY },
+	{ KEY_F12,	KEY_EJECTCD,        APPLE_FLAG_FKEY },
+	{ KEY_UP,	KEY_PAGEUP },
+	{ KEY_DOWN,	KEY_PAGEDOWN },
+	{ KEY_LEFT,	KEY_HOME },
+	{ KEY_RIGHT,	KEY_END },
+	{ }
+};
+
 static const struct apple_key_translation apple_fn_keys[] = {
 	{ KEY_BACKSPACE, KEY_DELETE },
 	{ KEY_ENTER,	KEY_INSERT },
@@ -157,10 +178,15 @@
 	if (fnmode) {
 		int do_translate;
 
-		trans = apple_find_translation((hid->product < 0x21d ||
-					hid->product >= 0x300) ?
-					powerbook_fn_keys : apple_fn_keys,
-					usage->code);
+		if(hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
+				hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) {
+			trans = apple_find_translation(macbookair_fn_keys, usage->code);
+		} else if (hid->product < 0x21d || hid->product >= 0x300) {
+			trans = apple_find_translation(powerbook_fn_keys, usage->code);
+		} else {
+			trans = apple_find_translation(apple_fn_keys, usage->code);
+		}
+
 		if (trans) {
 			if (test_bit(usage->code, asc->pressed_fn))
 				do_translate = 1;
@@ -439,6 +465,18 @@
 		.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
 		.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI),
+		.driver_data = APPLE_HAS_FN },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO),
+		.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS),
+		.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI),
+		.driver_data = APPLE_HAS_FN },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO),
+		.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS),
+		.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
 		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
diff -druN linux-2.6.35.13-libre3/drivers/hid/hid-core.c linux-2.6.35.14-libre3/drivers/hid/hid-core.c
--- linux-2.6.35.13-libre3/drivers/hid/hid-core.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/hid/hid-core.c	2011-08-01 16:56:51.000000000 -0400
@@ -1275,6 +1275,12 @@
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
@@ -1735,6 +1741,12 @@
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
 	{ }
diff -druN linux-2.6.35.13-libre3/drivers/hid/hid-ids.h linux-2.6.35.14-libre3/drivers/hid/hid-ids.h
--- linux-2.6.35.13-libre3/drivers/hid/hid-ids.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/hid/hid-ids.h	2011-08-01 16:56:51.000000000 -0400
@@ -93,6 +93,12 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI	0x0236
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO	0x0237
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS	0x0238
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI	0x023f
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO	0x0240
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS	0x0241
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI	0x0242
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO	0x0243
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS	0x0244
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI  0x0239
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO   0x023a
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
diff -druN linux-2.6.35.13-libre3/drivers/hwmon/applesmc.c linux-2.6.35.14-libre3/drivers/hwmon/applesmc.c
--- linux-2.6.35.13-libre3/drivers/hwmon/applesmc.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/hwmon/applesmc.c	2011-08-01 16:56:51.000000000 -0400
@@ -162,6 +162,10 @@
 /* Set 22: MacBook Pro 7,1 */
 	{ "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S",
 	  "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL },
+/* Set 23: MacBook Air 3,1 */
+	{ "TB0T", "TB1T", "TB2T", "TC0D", "TC0E", "TC0P", "TC1E", "TCZ3",
+	  "TCZ4", "TCZ5", "TG0E", "TG1E", "TG2E", "TGZ3", "TGZ4", "TGZ5",
+	  "TH0F", "TH0O", "TM0P" },
 };
 
 /* List of keys used to read/write fan speeds */
@@ -1524,11 +1528,17 @@
 	{ .accelerometer = 1, .light = 1, .temperature_set = 21 },
 /* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */
 	{ .accelerometer = 1, .light = 1, .temperature_set = 22 },
+/* MacBook Air 3,1: accelerometer, backlight and temperature set 23 */
+	{ .accelerometer = 0, .light = 0, .temperature_set = 23 },
 };
 
 /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
  * So we need to put "Apple MacBook Pro" before "Apple MacBook". */
 static __initdata struct dmi_system_id applesmc_whitelist[] = {
+	{ applesmc_dmi_match, "Apple MacBook Air 3", {
+	  DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+	  DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3") },
+		&applesmc_dmi_data[23]},
 	{ applesmc_dmi_match, "Apple MacBook Air 2", {
 	  DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
 	  DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir2") },
diff -druN linux-2.6.35.13-libre3/drivers/hwmon/asus_atk0110.c linux-2.6.35.14-libre3/drivers/hwmon/asus_atk0110.c
--- linux-2.6.35.13-libre3/drivers/hwmon/asus_atk0110.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/hwmon/asus_atk0110.c	2011-08-01 16:56:51.000000000 -0400
@@ -655,6 +655,7 @@
 	else
 		err = -EIO;
 
+	ACPI_FREE(ret);
 	return err;
 }
 
diff -druN linux-2.6.35.13-libre3/drivers/hwmon/max1111.c linux-2.6.35.14-libre3/drivers/hwmon/max1111.c
--- linux-2.6.35.13-libre3/drivers/hwmon/max1111.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/hwmon/max1111.c	2011-08-01 16:56:51.000000000 -0400
@@ -40,6 +40,8 @@
 	struct spi_transfer	xfer[2];
 	uint8_t *tx_buf;
 	uint8_t *rx_buf;
+	struct mutex		drvdata_lock;
+	/* protect msg, xfer and buffers from multiple access */
 };
 
 static int max1111_read(struct device *dev, int channel)
@@ -48,6 +50,9 @@
 	uint8_t v1, v2;
 	int err;
 
+	/* writing to drvdata struct is not thread safe, wait on mutex */
+	mutex_lock(&data->drvdata_lock);
+
 	data->tx_buf[0] = (channel << MAX1111_CTRL_SEL_SH) |
 		MAX1111_CTRL_PD0 | MAX1111_CTRL_PD1 |
 		MAX1111_CTRL_SGL | MAX1111_CTRL_UNI | MAX1111_CTRL_STR;
@@ -55,12 +60,15 @@
 	err = spi_sync(data->spi, &data->msg);
 	if (err < 0) {
 		dev_err(dev, "spi_sync failed with %d\n", err);
+		mutex_unlock(&data->drvdata_lock);
 		return err;
 	}
 
 	v1 = data->rx_buf[0];
 	v2 = data->rx_buf[1];
 
+	mutex_unlock(&data->drvdata_lock);
+
 	if ((v1 & 0xc0) || (v2 & 0x3f))
 		return -EINVAL;
 
@@ -176,6 +184,8 @@
 	if (err)
 		goto err_free_data;
 
+	mutex_init(&data->drvdata_lock);
+
 	data->spi = spi;
 	spi_set_drvdata(spi, data);
 
@@ -213,6 +223,7 @@
 
 	hwmon_device_unregister(data->hwmon_dev);
 	sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
+	mutex_destroy(&data->drvdata_lock);
 	kfree(data->rx_buf);
 	kfree(data->tx_buf);
 	kfree(data);
diff -druN linux-2.6.35.13-libre3/drivers/i2c/busses/i2c-taos-evm.c linux-2.6.35.14-libre3/drivers/i2c/busses/i2c-taos-evm.c
--- linux-2.6.35.13-libre3/drivers/i2c/busses/i2c-taos-evm.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/i2c/busses/i2c-taos-evm.c	2011-08-01 16:56:51.000000000 -0400
@@ -234,7 +234,7 @@
 
 	if (taos->state != TAOS_STATE_IDLE) {
 		err = -ENODEV;
-		dev_dbg(&serio->dev, "TAOS EVM reset failed (state=%d, "
+		dev_err(&serio->dev, "TAOS EVM reset failed (state=%d, "
 			"pos=%d)\n", taos->state, taos->pos);
 		goto exit_close;
 	}
@@ -255,7 +255,7 @@
 					 msecs_to_jiffies(250));
 	if (taos->state != TAOS_STATE_IDLE) {
 		err = -ENODEV;
-		dev_err(&adapter->dev, "Echo off failed "
+		dev_err(&serio->dev, "TAOS EVM echo off failed "
 			"(state=%d)\n", taos->state);
 		goto exit_close;
 	}
@@ -263,7 +263,7 @@
 	err = i2c_add_adapter(adapter);
 	if (err)
 		goto exit_close;
-	dev_dbg(&serio->dev, "Connected to TAOS EVM\n");
+	dev_info(&serio->dev, "Connected to TAOS EVM\n");
 
 	taos->client = taos_instantiate_device(adapter);
 	return 0;
@@ -288,7 +288,7 @@
 	serio_set_drvdata(serio, NULL);
 	kfree(taos);
 
-	dev_dbg(&serio->dev, "Disconnected from TAOS EVM\n");
+	dev_info(&serio->dev, "Disconnected from TAOS EVM\n");
 }
 
 static struct serio_device_id taos_serio_ids[] = {
diff -druN linux-2.6.35.13-libre3/drivers/input/mouse/elantech.c linux-2.6.35.14-libre3/drivers/input/mouse/elantech.c
--- linux-2.6.35.13-libre3/drivers/input/mouse/elantech.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/input/mouse/elantech.c	2011-08-01 16:56:51.000000000 -0400
@@ -185,7 +185,6 @@
 	struct elantech_data *etd = psmouse->private;
 	unsigned char *packet = psmouse->packet;
 	int fingers;
-	static int old_fingers;
 
 	if (etd->fw_version < 0x020000) {
 		/*
@@ -203,11 +202,14 @@
 	}
 
 	if (etd->jumpy_cursor) {
-		/* Discard packets that are likely to have bogus coordinates */
-		if (fingers > old_fingers) {
-			elantech_debug("discarding packet\n");
-			goto discard_packet_v1;
-		}
+		if (fingers != 1) {
+			etd->single_finger_reports = 0;
+		} else if (etd->single_finger_reports < 2) {
+			/* Discard first 2 reports of one finger, bogus */
+			etd->single_finger_reports++;
+ 			elantech_debug("elantech.c: discarding packet\n");
+			return;
+ 		}
 	}
 
 	input_report_key(dev, BTN_TOUCH, fingers != 0);
@@ -238,9 +240,6 @@
 	}
 
 	input_sync(dev);
-
- discard_packet_v1:
-	old_fingers = fingers;
 }
 
 /*
@@ -733,13 +732,14 @@
 	etd->capabilities = param[0];
 
 	/*
-	 * This firmware seems to suffer from misreporting coordinates when
+	 * This firmware suffers from misreporting coordinates when
 	 * a touch action starts causing the mouse cursor or scrolled page
 	 * to jump. Enable a workaround.
 	 */
-	if (etd->fw_version == 0x020022) {
-		pr_info("firmware version 2.0.34 detected, enabling jumpy cursor workaround\n");
-		etd->jumpy_cursor = 1;
+	if (etd->fw_version == 0x020022 || etd->fw_version == 0x020600) {
+		pr_info("elantech.c: firmware version 2.0.34/2.6.0 detected, "
+			"enabling jumpy cursor workaround\n");
+		etd->jumpy_cursor = true;
 	}
 
 	if (elantech_set_absolute_mode(psmouse)) {
diff -druN linux-2.6.35.13-libre3/drivers/input/mouse/elantech.h linux-2.6.35.14-libre3/drivers/input/mouse/elantech.h
--- linux-2.6.35.13-libre3/drivers/input/mouse/elantech.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/input/mouse/elantech.h	2011-08-01 16:56:51.000000000 -0400
@@ -100,10 +100,11 @@
 	unsigned char reg_26;
 	unsigned char debug;
 	unsigned char capabilities;
-	unsigned char paritycheck;
-	unsigned char jumpy_cursor;
+	bool paritycheck;
+	bool jumpy_cursor;
 	unsigned char hw_version;
-	unsigned int  fw_version;
+	unsigned int fw_version;
+	unsigned int single_finger_reports;
 	unsigned char parity[256];
 };
 
diff -druN linux-2.6.35.13-libre3/drivers/input/xen-kbdfront.c linux-2.6.35.14-libre3/drivers/input/xen-kbdfront.c
--- linux-2.6.35.13-libre3/drivers/input/xen-kbdfront.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/input/xen-kbdfront.c	2011-08-01 16:56:51.000000000 -0400
@@ -285,7 +285,7 @@
 				   enum xenbus_state backend_state)
 {
 	struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
-	int val;
+	int ret, val;
 
 	switch (backend_state) {
 	case XenbusStateInitialising:
@@ -296,6 +296,16 @@
 
 	case XenbusStateInitWait:
 InitWait:
+		ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+				   "feature-abs-pointer", "%d", &val);
+		if (ret < 0)
+			val = 0;
+		if (val) {
+			ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
+					    "request-abs-pointer", "1");
+			if (ret)
+				pr_warning("can't request abs-pointer\n");
+		}
 		xenbus_switch_state(dev, XenbusStateConnected);
 		break;
 
diff -druN linux-2.6.35.13-libre3/drivers/md/dm-table.c linux-2.6.35.14-libre3/drivers/md/dm-table.c
--- linux-2.6.35.13-libre3/drivers/md/dm-table.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/md/dm-table.c	2011-08-01 16:56:51.000000000 -0400
@@ -352,6 +352,7 @@
 static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
 				  sector_t start, sector_t len, void *data)
 {
+	struct request_queue *q;
 	struct queue_limits *limits = data;
 	struct block_device *bdev = dev->bdev;
 	sector_t dev_size =
@@ -360,6 +361,22 @@
 		limits->logical_block_size >> SECTOR_SHIFT;
 	char b[BDEVNAME_SIZE];
 
+	/*
+	 * Some devices exist without request functions,
+	 * such as loop devices not yet bound to backing files.
+	 * Forbid the use of such devices.
+	 */
+	q = bdev_get_queue(bdev);
+	if (!q || !q->make_request_fn) {
+		DMWARN("%s: %s is not yet initialised: "
+		       "start=%llu, len=%llu, dev_size=%llu",
+		       dm_device_name(ti->table->md), bdevname(bdev, b),
+		       (unsigned long long)start,
+		       (unsigned long long)len,
+		       (unsigned long long)dev_size);
+		return 1;
+	}
+
 	if (!dev_size)
 		return 0;
 
diff -druN linux-2.6.35.13-libre3/drivers/md/md.c linux-2.6.35.14-libre3/drivers/md/md.c
--- linux-2.6.35.13-libre3/drivers/md/md.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/md/md.c	2011-08-01 16:56:51.000000000 -0400
@@ -2399,7 +2399,7 @@
 		if (rdev->raid_disk == -1)
 			return -EEXIST;
 		/* personality does all needed checks */
-		if (rdev->mddev->pers->hot_add_disk == NULL)
+		if (rdev->mddev->pers->hot_remove_disk == NULL)
 			return -EINVAL;
 		err = rdev->mddev->pers->
 			hot_remove_disk(rdev->mddev, rdev->raid_disk);
@@ -6967,6 +6967,7 @@
 		list_for_each_entry(rdev, &mddev->disks, same_set) {
 			if (rdev->raid_disk >= 0 &&
 			    !test_bit(In_sync, &rdev->flags) &&
+			    !test_bit(Faulty, &rdev->flags) &&
 			    !test_bit(Blocked, &rdev->flags))
 				spares++;
 			if (rdev->raid_disk < 0
diff -druN linux-2.6.35.13-libre3/drivers/md/raid5.c linux-2.6.35.14-libre3/drivers/md/raid5.c
--- linux-2.6.35.13-libre3/drivers/md/raid5.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/md/raid5.c	2011-08-01 16:56:51.000000000 -0400
@@ -129,7 +129,7 @@
 
 static inline void raid5_set_bi_hw_segments(struct bio *bio, unsigned int cnt)
 {
-	bio->bi_phys_segments = raid5_bi_phys_segments(bio) || (cnt << 16);
+	bio->bi_phys_segments = raid5_bi_phys_segments(bio) | (cnt << 16);
 }
 
 /* Find first data disk in a raid6 stripe */
diff -druN linux-2.6.35.13-libre3/drivers/media/dvb/b2c2/flexcop-pci.c linux-2.6.35.14-libre3/drivers/media/dvb/b2c2/flexcop-pci.c
--- linux-2.6.35.13-libre3/drivers/media/dvb/b2c2/flexcop-pci.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/media/dvb/b2c2/flexcop-pci.c	2011-08-01 16:56:51.000000000 -0400
@@ -38,7 +38,7 @@
 	DEBSTATUS);
 
 #define DRIVER_VERSION "0.1"
-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
+#define DRIVER_NAME "flexcop-pci"
 #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
 
 struct flexcop_pci {
diff -druN linux-2.6.35.13-libre3/drivers/media/radio/si4713-i2c.c linux-2.6.35.14-libre3/drivers/media/radio/si4713-i2c.c
--- linux-2.6.35.13-libre3/drivers/media/radio/si4713-i2c.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/media/radio/si4713-i2c.c	2011-08-01 16:56:51.000000000 -0400
@@ -1004,7 +1004,7 @@
 		char ps_name[MAX_RDS_PS_NAME + 1];
 
 		len = control->size - 1;
-		if (len > MAX_RDS_PS_NAME) {
+		if (len < 0 || len > MAX_RDS_PS_NAME) {
 			rval = -ERANGE;
 			goto exit;
 		}
@@ -1026,7 +1026,7 @@
 		char radio_text[MAX_RDS_RADIO_TEXT + 1];
 
 		len = control->size - 1;
-		if (len > MAX_RDS_RADIO_TEXT) {
+		if (len < 0 || len > MAX_RDS_RADIO_TEXT) {
 			rval = -ERANGE;
 			goto exit;
 		}
diff -druN linux-2.6.35.13-libre3/drivers/media/video/bt8xx/bttv-driver.c linux-2.6.35.14-libre3/drivers/media/video/bt8xx/bttv-driver.c
--- linux-2.6.35.13-libre3/drivers/media/video/bt8xx/bttv-driver.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/media/video/bt8xx/bttv-driver.c	2011-08-01 16:56:51.000000000 -0400
@@ -3525,7 +3525,7 @@
 	if (0 != t->index)
 		return -EINVAL;
 
-	bttv_call_all(btv, tuner, g_tuner, t);
+	bttv_call_all(btv, tuner, s_tuner, t);
 	return 0;
 }
 
diff -druN linux-2.6.35.13-libre3/drivers/media/video/pvrusb2/pvrusb2-hdw.c linux-2.6.35.14-libre3/drivers/media/video/pvrusb2/pvrusb2-hdw.c
--- linux-2.6.35.13-libre3/drivers/media/video/pvrusb2/pvrusb2-hdw.c	2011-04-28 16:15:58.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/media/video/pvrusb2/pvrusb2-hdw.c	2011-08-01 23:36:08.000000000 -0400
@@ -3039,6 +3039,8 @@
 	if (hdw->input_dirty || hdw->audiomode_dirty || hdw->force_dirty) {
 		struct v4l2_tuner vt;
 		memset(&vt, 0, sizeof(vt));
+		vt.type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ?
+			V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
 		vt.audmode = hdw->audiomode_val;
 		v4l2_device_call_all(&hdw->v4l2_dev, 0, tuner, s_tuner, &vt);
 	}
@@ -5163,6 +5165,8 @@
 {
 	struct v4l2_tuner *vtp = &hdw->tuner_signal_info;
 	memset(vtp, 0, sizeof(*vtp));
+	vtp->type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ?
+		V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
 	hdw->tuner_signal_stale = 0;
 	/* Note: There apparently is no replacement for VIDIOC_CROPCAP
 	   using v4l2-subdev - therefore we can't support that AT ALL right
diff -druN linux-2.6.35.13-libre3/drivers/media/video/uvc/uvc_queue.c linux-2.6.35.14-libre3/drivers/media/video/uvc/uvc_queue.c
--- linux-2.6.35.13-libre3/drivers/media/video/uvc/uvc_queue.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/media/video/uvc/uvc_queue.c	2011-08-01 16:56:51.000000000 -0400
@@ -165,6 +165,8 @@
 	}
 
 	if (queue->count) {
+		uvc_queue_cancel(queue, 0);
+		INIT_LIST_HEAD(&queue->mainqueue);
 		vfree(queue->mem);
 		queue->count = 0;
 	}
diff -druN linux-2.6.35.13-libre3/drivers/media/video/v4l2-ioctl.c linux-2.6.35.14-libre3/drivers/media/video/v4l2-ioctl.c
--- linux-2.6.35.13-libre3/drivers/media/video/v4l2-ioctl.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/media/video/v4l2-ioctl.c	2011-08-01 16:56:51.000000000 -0400
@@ -1644,6 +1644,8 @@
 		if (!ops->vidioc_g_tuner)
 			break;
 
+		p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
+			V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
 		ret = ops->vidioc_g_tuner(file, fh, p);
 		if (!ret)
 			dbgarg(cmd, "index=%d, name=%s, type=%d, "
@@ -1662,6 +1664,8 @@
 
 		if (!ops->vidioc_s_tuner)
 			break;
+		p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
+			V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
 		dbgarg(cmd, "index=%d, name=%s, type=%d, "
 				"capability=0x%x, rangelow=%d, "
 				"rangehigh=%d, signal=%d, afc=%d, "
@@ -1680,6 +1684,8 @@
 		if (!ops->vidioc_g_frequency)
 			break;
 
+		p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
+			V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
 		ret = ops->vidioc_g_frequency(file, fh, p);
 		if (!ret)
 			dbgarg(cmd, "tuner=%d, type=%d, frequency=%d\n",
diff -druN linux-2.6.35.13-libre3/drivers/mmc/host/sdhci.c linux-2.6.35.14-libre3/drivers/mmc/host/sdhci.c
--- linux-2.6.35.13-libre3/drivers/mmc/host/sdhci.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/mmc/host/sdhci.c	2011-08-01 16:56:51.000000000 -0400
@@ -1278,6 +1278,13 @@
 
 	host = (struct sdhci_host*)param;
 
+        /*
+         * If this tasklet gets rescheduled while running, it will
+         * be run again afterwards but without any active request.
+         */
+	if (!host->mrq)
+		return;
+
 	spin_lock_irqsave(&host->lock, flags);
 
 	del_timer(&host->timer);
@@ -1289,7 +1296,7 @@
 	 * upon error conditions.
 	 */
 	if (!(host->flags & SDHCI_DEVICE_DEAD) &&
-		(mrq->cmd->error ||
+	    ((mrq->cmd && mrq->cmd->error) ||
 		 (mrq->data && (mrq->data->error ||
 		  (mrq->data->stop && mrq->data->stop->error))) ||
 		   (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {
diff -druN linux-2.6.35.13-libre3/drivers/mmc/host/sdhci-pci.c linux-2.6.35.14-libre3/drivers/mmc/host/sdhci-pci.c
--- linux-2.6.35.13-libre3/drivers/mmc/host/sdhci-pci.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/mmc/host/sdhci-pci.c	2011-08-01 16:56:51.000000000 -0400
@@ -653,6 +653,7 @@
 	host->ioaddr = pci_ioremap_bar(pdev, bar);
 	if (!host->ioaddr) {
 		dev_err(&pdev->dev, "failed to remap registers\n");
+		ret = -ENOMEM;
 		goto release;
 	}
 
diff -druN linux-2.6.35.13-libre3/drivers/mtd/mtdconcat.c linux-2.6.35.14-libre3/drivers/mtd/mtdconcat.c
--- linux-2.6.35.13-libre3/drivers/mtd/mtdconcat.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/mtd/mtdconcat.c	2011-08-01 16:56:51.000000000 -0400
@@ -305,7 +305,7 @@
 	if (!(mtd->flags & MTD_WRITEABLE))
 		return -EROFS;
 
-	ops->retlen = 0;
+	ops->retlen = ops->oobretlen = 0;
 
 	for (i = 0; i < concat->num_subdev; i++) {
 		struct mtd_info *subdev = concat->subdev[i];
@@ -320,7 +320,7 @@
 			devops.len = subdev->size - to;
 
 		err = subdev->write_oob(subdev, to, &devops);
-		ops->retlen += devops.retlen;
+		ops->retlen += devops.oobretlen;
 		if (err)
 			return err;
 
diff -druN linux-2.6.35.13-libre3/drivers/net/bonding/bond_3ad.c linux-2.6.35.14-libre3/drivers/net/bonding/bond_3ad.c
--- linux-2.6.35.13-libre3/drivers/net/bonding/bond_3ad.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/bonding/bond_3ad.c	2011-08-01 16:56:51.000000000 -0400
@@ -2466,6 +2466,10 @@
 	if (!(dev->flags & IFF_MASTER))
 		goto out;
 
+	skb = skb_share_check(skb, GFP_ATOMIC);
+	if (!skb)
+		goto out;
+
 	if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
 		goto out;
 
diff -druN linux-2.6.35.13-libre3/drivers/net/bonding/bond_alb.c linux-2.6.35.14-libre3/drivers/net/bonding/bond_alb.c
--- linux-2.6.35.13-libre3/drivers/net/bonding/bond_alb.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/bonding/bond_alb.c	2011-08-01 16:56:51.000000000 -0400
@@ -369,6 +369,10 @@
 		goto out;
 	}
 
+	skb = skb_share_check(skb, GFP_ATOMIC);
+	if (!skb)
+		goto out;
+
 	if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
 		goto out;
 
diff -druN linux-2.6.35.13-libre3/drivers/net/bonding/bond_main.c linux-2.6.35.14-libre3/drivers/net/bonding/bond_main.c
--- linux-2.6.35.13-libre3/drivers/net/bonding/bond_main.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/bonding/bond_main.c	2011-08-01 16:56:51.000000000 -0400
@@ -2686,6 +2686,10 @@
 	if (!slave || !slave_do_arp_validate(bond, slave))
 		goto out_unlock;
 
+	skb = skb_share_check(skb, GFP_ATOMIC);
+	if (!skb)
+		goto out_unlock;
+
 	if (!pskb_may_pull(skb, arp_hdr_len(dev)))
 		goto out_unlock;
 
diff -druN linux-2.6.35.13-libre3/drivers/net/ehea/ehea_ethtool.c linux-2.6.35.14-libre3/drivers/net/ehea/ehea_ethtool.c
--- linux-2.6.35.13-libre3/drivers/net/ehea/ehea_ethtool.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/ehea/ehea_ethtool.c	2011-08-01 16:56:51.000000000 -0400
@@ -53,15 +53,20 @@
 		cmd->duplex = -1;
 	}
 
-	cmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_1000baseT_Full
-		       | SUPPORTED_100baseT_Full |  SUPPORTED_100baseT_Half
-		       | SUPPORTED_10baseT_Full | SUPPORTED_10baseT_Half
-		       | SUPPORTED_Autoneg | SUPPORTED_FIBRE);
-
-	cmd->advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_Autoneg
-			 | ADVERTISED_FIBRE);
+	if (cmd->speed == SPEED_10000) {
+		cmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
+		cmd->advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_FIBRE);
+		cmd->port = PORT_FIBRE;
+	} else {
+		cmd->supported = (SUPPORTED_1000baseT_Full | SUPPORTED_100baseT_Full
+			       | SUPPORTED_100baseT_Half | SUPPORTED_10baseT_Full
+			       | SUPPORTED_10baseT_Half | SUPPORTED_Autoneg
+			       | SUPPORTED_TP);
+		cmd->advertising = (ADVERTISED_1000baseT_Full | ADVERTISED_Autoneg
+				 | ADVERTISED_TP);
+		cmd->port = PORT_TP;
+	}
 
-	cmd->port = PORT_FIBRE;
 	cmd->autoneg = port->autoneg == 1 ? AUTONEG_ENABLE : AUTONEG_DISABLE;
 
 	return 0;
diff -druN linux-2.6.35.13-libre3/drivers/net/hamradio/6pack.c linux-2.6.35.14-libre3/drivers/net/hamradio/6pack.c
--- linux-2.6.35.13-libre3/drivers/net/hamradio/6pack.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/hamradio/6pack.c	2011-08-01 16:56:51.000000000 -0400
@@ -692,10 +692,10 @@
 {
 	struct sixpack *sp;
 
-	write_lock(&disc_data_lock);
+	write_lock_bh(&disc_data_lock);
 	sp = tty->disc_data;
 	tty->disc_data = NULL;
-	write_unlock(&disc_data_lock);
+	write_unlock_bh(&disc_data_lock);
 	if (!sp)
 		return;
 
diff -druN linux-2.6.35.13-libre3/drivers/net/hamradio/mkiss.c linux-2.6.35.14-libre3/drivers/net/hamradio/mkiss.c
--- linux-2.6.35.13-libre3/drivers/net/hamradio/mkiss.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/hamradio/mkiss.c	2011-08-01 16:56:51.000000000 -0400
@@ -813,10 +813,10 @@
 {
 	struct mkiss *ax;
 
-	write_lock(&disc_data_lock);
+	write_lock_bh(&disc_data_lock);
 	ax = tty->disc_data;
 	tty->disc_data = NULL;
-	write_unlock(&disc_data_lock);
+	write_unlock_bh(&disc_data_lock);
 
 	if (!ax)
 		return;
diff -druN linux-2.6.35.13-libre3/drivers/net/hydra.c linux-2.6.35.14-libre3/drivers/net/hydra.c
--- linux-2.6.35.13-libre3/drivers/net/hydra.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/hydra.c	2011-08-01 16:56:51.000000000 -0400
@@ -98,15 +98,15 @@
 	.ndo_open		= hydra_open,
 	.ndo_stop		= hydra_close,
 
-	.ndo_start_xmit		= ei_start_xmit,
-	.ndo_tx_timeout		= ei_tx_timeout,
-	.ndo_get_stats		= ei_get_stats,
-	.ndo_set_multicast_list = ei_set_multicast_list,
+	.ndo_start_xmit		= __ei_start_xmit,
+	.ndo_tx_timeout		= __ei_tx_timeout,
+	.ndo_get_stats		= __ei_get_stats,
+	.ndo_set_multicast_list = __ei_set_multicast_list,
 	.ndo_validate_addr	= eth_validate_addr,
-	.ndo_set_mac_address 	= eth_mac_addr,
+	.ndo_set_mac_address	= eth_mac_addr,
 	.ndo_change_mtu		= eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-	.ndo_poll_controller	= ei_poll,
+	.ndo_poll_controller	= __ei_poll,
 #endif
 };
 
@@ -125,7 +125,7 @@
 	0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
     };
 
-    dev = alloc_ei_netdev();
+    dev = ____alloc_ei_netdev(0);
     if (!dev)
 	return -ENOMEM;
 
diff -druN linux-2.6.35.13-libre3/drivers/net/jme.c linux-2.6.35.14-libre3/drivers/net/jme.c
--- linux-2.6.35.13-libre3/drivers/net/jme.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/jme.c	2011-08-01 16:56:51.000000000 -0400
@@ -678,20 +678,28 @@
 	struct jme_ring *rxring = &(jme->rxring[0]);
 	struct jme_buffer_info *rxbi = rxring->bufinf + i;
 	struct sk_buff *skb;
+	dma_addr_t mapping;
 
 	skb = netdev_alloc_skb(jme->dev,
 		jme->dev->mtu + RX_EXTRA_LEN);
 	if (unlikely(!skb))
 		return -ENOMEM;
 
+	mapping = pci_map_page(jme->pdev, virt_to_page(skb->data),
+			       offset_in_page(skb->data), skb_tailroom(skb),
+			       PCI_DMA_FROMDEVICE);
+	if (unlikely(pci_dma_mapping_error(jme->pdev, mapping))) {
+		dev_kfree_skb(skb);
+		return -ENOMEM;
+	}
+
+	if (likely(rxbi->mapping))
+		pci_unmap_page(jme->pdev, rxbi->mapping,
+			       rxbi->len, PCI_DMA_FROMDEVICE);
+
 	rxbi->skb = skb;
 	rxbi->len = skb_tailroom(skb);
-	rxbi->mapping = pci_map_page(jme->pdev,
-					virt_to_page(skb->data),
-					offset_in_page(skb->data),
-					rxbi->len,
-					PCI_DMA_FROMDEVICE);
-
+	rxbi->mapping = mapping;
 	return 0;
 }
 
diff -druN linux-2.6.35.13-libre3/drivers/net/Makefile linux-2.6.35.14-libre3/drivers/net/Makefile
--- linux-2.6.35.13-libre3/drivers/net/Makefile	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/Makefile	2011-08-01 16:56:51.000000000 -0400
@@ -141,7 +141,7 @@
 obj-$(CONFIG_SB1250_MAC) += sb1250-mac.o
 obj-$(CONFIG_B44) += b44.o
 obj-$(CONFIG_FORCEDETH) += forcedeth.o
-obj-$(CONFIG_NE_H8300) += ne-h8300.o 8390.o
+obj-$(CONFIG_NE_H8300) += ne-h8300.o
 obj-$(CONFIG_AX88796) += ax88796.o
 obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
 
@@ -213,7 +213,7 @@
 obj-$(CONFIG_LP486E) += lp486e.o
 
 obj-$(CONFIG_ETH16I) += eth16i.o
-obj-$(CONFIG_ZORRO8390) += zorro8390.o 8390.o
+obj-$(CONFIG_ZORRO8390) += zorro8390.o
 obj-$(CONFIG_HPLANCE) += hplance.o 7990.o
 obj-$(CONFIG_MVME147_NET) += mvme147.o 7990.o
 obj-$(CONFIG_EQUALIZER) += eql.o
@@ -225,7 +225,7 @@
 obj-$(CONFIG_DECLANCE) += declance.o
 obj-$(CONFIG_ATARILANCE) += atarilance.o
 obj-$(CONFIG_A2065) += a2065.o
-obj-$(CONFIG_HYDRA) += hydra.o 8390.o
+obj-$(CONFIG_HYDRA) += hydra.o
 obj-$(CONFIG_ARIADNE) += ariadne.o
 obj-$(CONFIG_CS89x0) += cs89x0.o
 obj-$(CONFIG_MACSONIC) += macsonic.o
diff -druN linux-2.6.35.13-libre3/drivers/net/ne-h8300.c linux-2.6.35.14-libre3/drivers/net/ne-h8300.c
--- linux-2.6.35.13-libre3/drivers/net/ne-h8300.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/ne-h8300.c	2011-08-01 16:56:51.000000000 -0400
@@ -167,7 +167,7 @@
 #ifndef MODULE
 struct net_device * __init ne_probe(int unit)
 {
-	struct net_device *dev = alloc_ei_netdev();
+	struct net_device *dev = ____alloc_ei_netdev(0);
 	int err;
 
 	if (!dev)
@@ -197,15 +197,15 @@
 	.ndo_open		= ne_open,
 	.ndo_stop		= ne_close,
 
-	.ndo_start_xmit		= ei_start_xmit,
-	.ndo_tx_timeout		= ei_tx_timeout,
-	.ndo_get_stats		= ei_get_stats,
-	.ndo_set_multicast_list = ei_set_multicast_list,
+	.ndo_start_xmit		= __ei_start_xmit,
+	.ndo_tx_timeout		= __ei_tx_timeout,
+	.ndo_get_stats		= __ei_get_stats,
+	.ndo_set_multicast_list = __ei_set_multicast_list,
 	.ndo_validate_addr	= eth_validate_addr,
-	.ndo_set_mac_address 	= eth_mac_addr,
+	.ndo_set_mac_address	= eth_mac_addr,
 	.ndo_change_mtu		= eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-	.ndo_poll_controller	= ei_poll,
+	.ndo_poll_controller	= __ei_poll,
 #endif
 };
 
@@ -637,7 +637,7 @@
 	int err;
 
 	for (this_dev = 0; this_dev < MAX_NE_CARDS; this_dev++) {
-		struct net_device *dev = alloc_ei_netdev();
+		struct net_device *dev = ____alloc_ei_netdev(0);
 		if (!dev)
 			break;
 		if (io[this_dev]) {
diff -druN linux-2.6.35.13-libre3/drivers/net/netxen/netxen_nic.h linux-2.6.35.14-libre3/drivers/net/netxen/netxen_nic.h
--- linux-2.6.35.13-libre3/drivers/net/netxen/netxen_nic.h	2011-04-28 16:17:12.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/netxen/netxen_nic.h	2011-08-01 23:37:54.000000000 -0400
@@ -522,7 +522,6 @@
 #define NX_P2_MN_ROMIMAGE_NAME		"/*(DEBLOBBED)*/"
 #define NX_P3_CT_ROMIMAGE_NAME		"/*(DEBLOBBED)*/"
 #define NX_P3_MN_ROMIMAGE_NAME		"/*(DEBLOBBED)*/"
-#define NX_UNIFIED_ROMIMAGE_NAME	"/*(DEBLOBBED)*/"
 #define NX_FLASH_ROMIMAGE_NAME		"flash"
 
 extern char netxen_nic_driver_name[];
diff -druN linux-2.6.35.13-libre3/drivers/net/netxen/netxen_nic_init.c linux-2.6.35.14-libre3/drivers/net/netxen/netxen_nic_init.c
--- linux-2.6.35.13-libre3/drivers/net/netxen/netxen_nic_init.c	2011-04-28 16:17:10.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/netxen/netxen_nic_init.c	2011-08-01 23:37:50.000000000 -0400
@@ -971,7 +971,6 @@
 	NX_P2_MN_ROMIMAGE_NAME,
 	NX_P3_CT_ROMIMAGE_NAME,
 	NX_P3_MN_ROMIMAGE_NAME,
-	NX_UNIFIED_ROMIMAGE_NAME,
 	NX_FLASH_ROMIMAGE_NAME,
 };
 
diff -druN linux-2.6.35.13-libre3/drivers/net/niu.c linux-2.6.35.14-libre3/drivers/net/niu.c
--- linux-2.6.35.13-libre3/drivers/net/niu.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/niu.c	2011-08-01 16:56:51.000000000 -0400
@@ -7270,32 +7270,28 @@
 	struct niu_parent *parent = np->parent;
 	struct niu_tcam_entry *tp;
 	int i, idx, cnt;
-	u16 n_entries;
 	unsigned long flags;
-
+	int ret = 0;
 
 	/* put the tcam size here */
 	nfc->data = tcam_get_size(np);
 
 	niu_lock_parent(np, flags);
-	n_entries = nfc->rule_cnt;
 	for (cnt = 0, i = 0; i < nfc->data; i++) {
 		idx = tcam_get_index(np, i);
 		tp = &parent->tcam[idx];
 		if (!tp->valid)
 			continue;
+		if (cnt == nfc->rule_cnt) {
+			ret = -EMSGSIZE;
+			break;
+		}
 		rule_locs[cnt] = i;
 		cnt++;
 	}
 	niu_unlock_parent(np, flags);
 
-	if (n_entries != cnt) {
-		/* print warning, this should not happen */
-		netdev_info(np->dev, "niu%d: In %s(): n_entries[%d] != cnt[%d]!!!\n",
-			    np->parent->index, __func__, n_entries, cnt);
-	}
-
-	return 0;
+	return ret;
 }
 
 static int niu_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
diff -druN linux-2.6.35.13-libre3/drivers/net/slip.c linux-2.6.35.14-libre3/drivers/net/slip.c
--- linux-2.6.35.13-libre3/drivers/net/slip.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/slip.c	2011-08-01 16:56:51.000000000 -0400
@@ -852,7 +852,9 @@
 	/* Done.  We have linked the TTY line to a channel. */
 	rtnl_unlock();
 	tty->receive_room = 65536;	/* We don't flow control */
-	return sl->dev->base_addr;
+
+	/* TTY layer expects 0 on success */
+	return 0;
 
 err_free_bufs:
 	sl_free_bufs(sl);
diff -druN linux-2.6.35.13-libre3/drivers/net/virtio_net.c linux-2.6.35.14-libre3/drivers/net/virtio_net.c
--- linux-2.6.35.13-libre3/drivers/net/virtio_net.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/virtio_net.c	2011-08-01 16:56:51.000000000 -0400
@@ -446,6 +446,20 @@
 	}
 }
 
+static void virtnet_napi_enable(struct virtnet_info *vi)
+{
+	napi_enable(&vi->napi);
+
+	/* If all buffers were filled by other side before we napi_enabled, we
+	 * won't get another interrupt, so process any outstanding packets
+	 * now.  virtnet_poll wants re-enable the queue, so we disable here.
+	 * We synchronize against interrupts via NAPI_STATE_SCHED */
+	if (napi_schedule_prep(&vi->napi)) {
+		virtqueue_disable_cb(vi->rvq);
+		__napi_schedule(&vi->napi);
+	}
+}
+
 static void refill_work(struct work_struct *work)
 {
 	struct virtnet_info *vi;
@@ -454,7 +468,7 @@
 	vi = container_of(work, struct virtnet_info, refill.work);
 	napi_disable(&vi->napi);
 	still_empty = !try_fill_recv(vi, GFP_KERNEL);
-	napi_enable(&vi->napi);
+	virtnet_napi_enable(vi);
 
 	/* In theory, this can happen: if we don't get any buffers in
 	 * we will *never* try to fill again. */
@@ -638,16 +652,7 @@
 {
 	struct virtnet_info *vi = netdev_priv(dev);
 
-	napi_enable(&vi->napi);
-
-	/* If all buffers were filled by other side before we napi_enabled, we
-	 * won't get another interrupt, so process any outstanding packets
-	 * now.  virtnet_poll wants re-enable the queue, so we disable here.
-	 * We synchronize against interrupts via NAPI_STATE_SCHED */
-	if (napi_schedule_prep(&vi->napi)) {
-		virtqueue_disable_cb(vi->rvq);
-		__napi_schedule(&vi->napi);
-	}
+	virtnet_napi_enable(vi);
 	return 0;
 }
 
diff -druN linux-2.6.35.13-libre3/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-2.6.35.14-libre3/drivers/net/vmxnet3/vmxnet3_ethtool.c
--- linux-2.6.35.13-libre3/drivers/net/vmxnet3/vmxnet3_ethtool.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/vmxnet3/vmxnet3_ethtool.c	2011-08-01 16:56:51.000000000 -0400
@@ -290,6 +290,9 @@
 		/* toggle the LRO feature*/
 		netdev->features ^= NETIF_F_LRO;
 
+		/* Update private LRO flag */
+		adapter->lro = lro_requested;
+
 		/* update harware LRO capability accordingly */
 		if (lro_requested)
 			adapter->shared->devRead.misc.uptFeatures &= UPT1_F_LRO;
diff -druN linux-2.6.35.13-libre3/drivers/net/wireless/ath/ath5k/eeprom.c linux-2.6.35.14-libre3/drivers/net/wireless/ath/ath5k/eeprom.c
--- linux-2.6.35.13-libre3/drivers/net/wireless/ath/ath5k/eeprom.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/wireless/ath/ath5k/eeprom.c	2011-08-01 16:56:51.000000000 -0400
@@ -1592,14 +1592,12 @@
 		if (!chinfo[pier].pd_curves)
 			continue;
 
-		for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
+		for (pdg = 0; pdg < AR5K_EEPROM_N_PD_CURVES; pdg++) {
 			struct ath5k_pdgain_info *pd =
 					&chinfo[pier].pd_curves[pdg];
 
-			if (pd != NULL) {
-				kfree(pd->pd_step);
-				kfree(pd->pd_pwr);
-			}
+			kfree(pd->pd_step);
+			kfree(pd->pd_pwr);
 		}
 
 		kfree(chinfo[pier].pd_curves);
diff -druN linux-2.6.35.13-libre3/drivers/net/wireless/libertas/cmd.c linux-2.6.35.14-libre3/drivers/net/wireless/libertas/cmd.c
--- linux-2.6.35.13-libre3/drivers/net/wireless/libertas/cmd.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/wireless/libertas/cmd.c	2011-08-01 16:56:51.000000000 -0400
@@ -1267,8 +1267,8 @@
 				    cpu_to_le16(CMD_SUBCMD_EXIT_PS)) {
 					lbs_deb_host(
 					       "EXEC_NEXT_CMD: ignore ENTER_PS cmd\n");
-					list_del(&cmdnode->list);
 					spin_lock_irqsave(&priv->driver_lock, flags);
+					list_del(&cmdnode->list);
 					lbs_complete_command(priv, cmdnode, 0);
 					spin_unlock_irqrestore(&priv->driver_lock, flags);
 
@@ -1280,8 +1280,8 @@
 				    (priv->psstate == PS_STATE_PRE_SLEEP)) {
 					lbs_deb_host(
 					       "EXEC_NEXT_CMD: ignore EXIT_PS cmd in sleep\n");
-					list_del(&cmdnode->list);
 					spin_lock_irqsave(&priv->driver_lock, flags);
+					list_del(&cmdnode->list);
 					lbs_complete_command(priv, cmdnode, 0);
 					spin_unlock_irqrestore(&priv->driver_lock, flags);
 					priv->needtowakeup = 1;
@@ -1294,7 +1294,9 @@
 				       "EXEC_NEXT_CMD: sending EXIT_PS\n");
 			}
 		}
+		spin_lock_irqsave(&priv->driver_lock, flags);
 		list_del(&cmdnode->list);
+		spin_unlock_irqrestore(&priv->driver_lock, flags);
 		lbs_deb_host("EXEC_NEXT_CMD: sending command 0x%04x\n",
 			    le16_to_cpu(cmd->command));
 		lbs_submit_command(priv, cmdnode);
diff -druN linux-2.6.35.13-libre3/drivers/net/wireless/p54/p54usb.c linux-2.6.35.14-libre3/drivers/net/wireless/p54/p54usb.c
--- linux-2.6.35.13-libre3/drivers/net/wireless/p54/p54usb.c	2011-04-28 16:19:47.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/wireless/p54/p54usb.c	2011-08-01 23:42:08.000000000 -0400
@@ -81,6 +81,7 @@
 	{USB_DEVICE(0x06b9, 0x0121)},	/* Thomson SpeedTouch 121g */
 	{USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
 	{USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
+	{USB_DEVICE(0x083a, 0xc501)},	/* Zoom Wireless-G 4410 */
 	{USB_DEVICE(0x083a, 0xf503)},	/* Accton FD7050E ver 1010ec  */
 	{USB_DEVICE(0x0846, 0x4240)},	/* Netgear WG111 (v2) */
 	{USB_DEVICE(0x0915, 0x2000)},	/* Cohiba Proto board */
diff -druN linux-2.6.35.13-libre3/drivers/net/wireless/rt2x00/rt2500usb.c linux-2.6.35.14-libre3/drivers/net/wireless/rt2x00/rt2500usb.c
--- linux-2.6.35.13-libre3/drivers/net/wireless/rt2x00/rt2500usb.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/wireless/rt2x00/rt2500usb.c	2011-08-01 16:56:51.000000000 -0400
@@ -348,6 +348,7 @@
 	int timeout;
 	u32 mask;
 	u16 reg;
+	enum cipher curr_cipher;
 
 	if (crypto->cmd == SET_KEY) {
 		/*
@@ -358,6 +359,7 @@
 		mask = TXRX_CSR0_KEY_ID.bit_mask;
 
 		rt2500usb_register_read(rt2x00dev, TXRX_CSR0, &reg);
+		curr_cipher = rt2x00_get_field16(reg, TXRX_CSR0_ALGORITHM);
 		reg &= mask;
 
 		if (reg && reg == mask)
@@ -366,6 +368,14 @@
 		reg = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID);
 
 		key->hw_key_idx += reg ? ffz(reg) : 0;
+		/*
+		 * Hardware requires that all keys use the same cipher
+		 * (e.g. TKIP-only, AES-only, but not TKIP+AES).
+		 * If this is not the first key, compare the cipher with the
+		 * first one and fall back to SW crypto if not the same.
+		 */
+		if (key->hw_key_idx > 0 && crypto->cipher != curr_cipher)
+			return -EOPNOTSUPP;
 
 		/*
 		 * The encryption key doesn't fit within the CSR cache,
diff -druN linux-2.6.35.13-libre3/drivers/net/zorro8390.c linux-2.6.35.14-libre3/drivers/net/zorro8390.c
--- linux-2.6.35.13-libre3/drivers/net/zorro8390.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/net/zorro8390.c	2011-08-01 16:56:51.000000000 -0400
@@ -126,7 +126,7 @@
 
     board = z->resource.start;
     ioaddr = board+cards[i].offset;
-    dev = alloc_ei_netdev();
+    dev = ____alloc_ei_netdev(0);
     if (!dev)
 	return -ENOMEM;
     if (!request_mem_region(ioaddr, NE_IO_EXTENT*2, DRV_NAME)) {
@@ -146,15 +146,15 @@
 static const struct net_device_ops zorro8390_netdev_ops = {
 	.ndo_open		= zorro8390_open,
 	.ndo_stop		= zorro8390_close,
-	.ndo_start_xmit		= ei_start_xmit,
-	.ndo_tx_timeout		= ei_tx_timeout,
-	.ndo_get_stats		= ei_get_stats,
-	.ndo_set_multicast_list = ei_set_multicast_list,
+	.ndo_start_xmit		= __ei_start_xmit,
+	.ndo_tx_timeout		= __ei_tx_timeout,
+	.ndo_get_stats		= __ei_get_stats,
+	.ndo_set_multicast_list = __ei_set_multicast_list,
 	.ndo_validate_addr	= eth_validate_addr,
 	.ndo_set_mac_address 	= eth_mac_addr,
 	.ndo_change_mtu		= eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-	.ndo_poll_controller	= ei_poll,
+	.ndo_poll_controller	= __ei_poll,
 #endif
 };
 
diff -druN linux-2.6.35.13-libre3/drivers/pci/hotplug/pcihp_slot.c linux-2.6.35.14-libre3/drivers/pci/hotplug/pcihp_slot.c
--- linux-2.6.35.13-libre3/drivers/pci/hotplug/pcihp_slot.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/pci/hotplug/pcihp_slot.c	2011-08-01 16:56:51.000000000 -0400
@@ -158,6 +158,47 @@
 	 */
 }
 
+/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */
+static int pci_set_payload(struct pci_dev *dev)
+{
+       int pos, ppos;
+       u16 pctl, psz;
+       u16 dctl, dsz, dcap, dmax;
+       struct pci_dev *parent;
+
+       parent = dev->bus->self;
+       pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+       if (!pos)
+               return 0;
+
+       /* Read Device MaxPayload capability and setting */
+       pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl);
+       pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap);
+       dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5;
+       dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD);
+
+       /* Read Parent MaxPayload setting */
+       ppos = pci_find_capability(parent, PCI_CAP_ID_EXP);
+       if (!ppos)
+               return 0;
+       pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl);
+       psz = (pctl &  PCI_EXP_DEVCTL_PAYLOAD) >> 5;
+
+       /* If parent payload > device max payload -> error
+        * If parent payload > device payload -> set speed
+        * If parent payload <= device payload -> do nothing
+        */
+       if (psz > dmax)
+               return -1;
+       else if (psz > dsz) {
+               dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz);
+               pci_write_config_word(dev, pos + PCI_EXP_DEVCTL,
+                                     (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) +
+                                     (psz << 5));
+       }
+       return 0;
+}
+
 void pci_configure_slot(struct pci_dev *dev)
 {
 	struct pci_dev *cdev;
@@ -169,6 +210,10 @@
 			(dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
 		return;
 
+       ret = pci_set_payload(dev);
+       if (ret)
+               dev_warn(&dev->dev, "could not set device max payload\n");
+
 	memset(&hpp, 0, sizeof(hpp));
 	ret = pci_get_hp_params(dev, &hpp);
 	if (ret)
diff -druN linux-2.6.35.13-libre3/drivers/pci/quirks.c linux-2.6.35.14-libre3/drivers/pci/quirks.c
--- linux-2.6.35.13-libre3/drivers/pci/quirks.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/pci/quirks.c	2011-08-01 16:56:51.000000000 -0400
@@ -2698,9 +2698,34 @@
 
 	dev_notice(&dev->dev, "proprietary Ricoh MMC controller disabled (via firewire function)\n");
 	dev_notice(&dev->dev, "MMC cards are now supported by standard SDHCI controller\n");
+
+	/*
+	 * RICOH 0xe823 SD/MMC card reader fails to recognize
+	 * certain types of SD/MMC cards. Lowering the SD base
+	 * clock frequency from 200Mhz to 50Mhz fixes this issue.
+	 *
+	 * 0x150 - SD2.0 mode enable for changing base clock
+	 *	   frequency to 50Mhz
+	 * 0xe1  - Base clock frequency
+	 * 0x32  - 50Mhz new clock frequency
+	 * 0xf9  - Key register for 0x150
+	 * 0xfc  - key register for 0xe1
+	 */
+	if (dev->device == PCI_DEVICE_ID_RICOH_R5CE823) {
+		pci_write_config_byte(dev, 0xf9, 0xfc);
+		pci_write_config_byte(dev, 0x150, 0x10);
+		pci_write_config_byte(dev, 0xf9, 0x00);
+		pci_write_config_byte(dev, 0xfc, 0x01);
+		pci_write_config_byte(dev, 0xe1, 0x32);
+		pci_write_config_byte(dev, 0xfc, 0x00);
+
+		dev_notice(&dev->dev, "MMC controller base frequency changed to 50Mhz.\n");
+	}
 }
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
 #endif /*CONFIG_MMC_RICOH_MMC*/
 
 #if defined(CONFIG_DMAR) || defined(CONFIG_INTR_REMAP)
@@ -2727,6 +2752,16 @@
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors);
 #endif
 
+static void __devinit fixup_ti816x_class(struct pci_dev* dev)
+{
+	/* TI 816x devices do not have class code set when in PCIe boot mode */
+	if (dev->class == PCI_CLASS_NOT_DEFINED) {
+		dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n");
+		dev->class = PCI_CLASS_MULTIMEDIA_VIDEO;
+	}
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_TI, 0xb800, fixup_ti816x_class);
+
 static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
 			  struct pci_fixup *end)
 {
diff -druN linux-2.6.35.13-libre3/drivers/platform/x86/dell-laptop.c linux-2.6.35.14-libre3/drivers/platform/x86/dell-laptop.c
--- linux-2.6.35.13-libre3/drivers/platform/x86/dell-laptop.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/platform/x86/dell-laptop.c	2011-08-01 16:56:51.000000000 -0400
@@ -83,6 +83,12 @@
 		},
 	},
 	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_CHASSIS_TYPE, "9"), /*Laptop*/
+		},
+	},
+	{
 		.ident = "Dell Computer Corporation",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
@@ -628,4 +634,5 @@
 MODULE_DESCRIPTION("Dell laptop driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("dmi:*svnDellInc.:*:ct8:*");
+MODULE_ALIAS("dmi:*svnDellInc.:*:ct9:*");
 MODULE_ALIAS("dmi:*svnDellComputerCorporation.:*:ct8:*");
diff -druN linux-2.6.35.13-libre3/drivers/scsi/megaraid/megaraid_sas.c linux-2.6.35.14-libre3/drivers/scsi/megaraid/megaraid_sas.c
--- linux-2.6.35.13-libre3/drivers/scsi/megaraid/megaraid_sas.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/scsi/megaraid/megaraid_sas.c	2011-08-01 16:56:51.000000000 -0400
@@ -3669,6 +3669,9 @@
 	 * For each user buffer, create a mirror buffer and copy in
 	 */
 	for (i = 0; i < ioc->sge_count; i++) {
+		if (!ioc->sgl[i].iov_len)
+			continue;
+
 		kbuff_arr[i] = dma_alloc_coherent(&instance->pdev->dev,
 						    ioc->sgl[i].iov_len,
 						    &buf_handle, GFP_KERNEL);
diff -druN linux-2.6.35.13-libre3/drivers/scsi/mpt2sas/mpt2sas_ctl.c linux-2.6.35.14-libre3/drivers/scsi/mpt2sas/mpt2sas_ctl.c
--- linux-2.6.35.13-libre3/drivers/scsi/mpt2sas/mpt2sas_ctl.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/scsi/mpt2sas/mpt2sas_ctl.c	2011-08-01 16:56:51.000000000 -0400
@@ -637,6 +637,13 @@
 	data_out_sz = karg.data_out_size;
 	data_in_sz = karg.data_in_size;
 
+	/* Check for overflow and wraparound */
+	if (karg.data_sge_offset * 4 > ioc->request_sz ||
+	    karg.data_sge_offset > (UINT_MAX / 4)) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	/* copy in request message frame from user */
 	if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
 		printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
@@ -1883,7 +1890,7 @@
 	Mpi2DiagBufferPostReply_t *mpi_reply;
 	int rc, i;
 	u8 buffer_type;
-	unsigned long timeleft;
+	unsigned long timeleft, request_size, copy_size;
 	u16 smid;
 	u16 ioc_status;
 	u8 issue_reset = 0;
@@ -1919,6 +1926,8 @@
 		return -ENOMEM;
 	}
 
+	request_size = ioc->diag_buffer_sz[buffer_type];
+
 	if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
 		printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
 		    "or bytes_to_read are not 4 byte aligned\n", ioc->name,
@@ -1926,13 +1935,23 @@
 		return -EINVAL;
 	}
 
+	if (karg.starting_offset > request_size)
+		return -EINVAL;
+
 	diag_data = (void *)(request_data + karg.starting_offset);
 	dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "
 	    "offset(%d), sz(%d)\n", ioc->name, __func__,
 	    diag_data, karg.starting_offset, karg.bytes_to_read));
 
+	/* Truncate data on requests that are too large */
+	if ((diag_data + karg.bytes_to_read < diag_data) ||
+	    (diag_data + karg.bytes_to_read > request_data + request_size))
+		copy_size = request_size - karg.starting_offset;
+	else
+		copy_size = karg.bytes_to_read;
+
 	if (copy_to_user((void __user *)uarg->diagnostic_data,
-	    diag_data, karg.bytes_to_read)) {
+	    diag_data, copy_size)) {
 		printk(MPT2SAS_ERR_FMT "%s: Unable to write "
 		    "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
 		    __func__, diag_data);
diff -druN linux-2.6.35.13-libre3/drivers/scsi/pmcraid.c linux-2.6.35.14-libre3/drivers/scsi/pmcraid.c
--- linux-2.6.35.13-libre3/drivers/scsi/pmcraid.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/scsi/pmcraid.c	2011-08-01 16:56:51.000000000 -0400
@@ -3528,6 +3528,9 @@
 			rc = -EFAULT;
 			goto out_free_buffer;
 		}
+	} else if (request_size < 0) {
+		rc = -EINVAL;
+		goto out_free_buffer;
 	}
 
 	/* check if we have any additional command parameters */
diff -druN linux-2.6.35.13-libre3/drivers/scsi/scsi_lib.c linux-2.6.35.14-libre3/drivers/scsi/scsi_lib.c
--- linux-2.6.35.13-libre3/drivers/scsi/scsi_lib.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/scsi/scsi_lib.c	2011-08-01 16:56:51.000000000 -0400
@@ -215,6 +215,8 @@
 	int ret = DRIVER_ERROR << 24;
 
 	req = blk_get_request(sdev->request_queue, write, __GFP_WAIT);
+	if (!req)
+		return ret;
 
 	if (bufflen &&	blk_rq_map_kern(sdev->request_queue, req,
 					buffer, bufflen, __GFP_WAIT))
@@ -400,10 +402,15 @@
 static void scsi_run_queue(struct request_queue *q)
 {
 	struct scsi_device *sdev = q->queuedata;
-	struct Scsi_Host *shost = sdev->host;
+	struct Scsi_Host *shost;
 	LIST_HEAD(starved_list);
 	unsigned long flags;
 
+	/* if the device is dead, sdev will be NULL, so no queue to run */
+	if (!sdev)
+		return;
+
+	shost = sdev->host;
 	if (scsi_target(sdev)->single_lun)
 		scsi_single_lun_run(sdev);
 
diff -druN linux-2.6.35.13-libre3/drivers/scsi/scsi_scan.c linux-2.6.35.14-libre3/drivers/scsi/scsi_scan.c
--- linux-2.6.35.13-libre3/drivers/scsi/scsi_scan.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/scsi/scsi_scan.c	2011-08-01 16:56:51.000000000 -0400
@@ -295,7 +295,7 @@
 		kfree(sdev);
 		goto out;
 	}
-
+	blk_get_queue(sdev->request_queue);
 	sdev->request_queue->queuedata = sdev;
 	scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);
 
diff -druN linux-2.6.35.13-libre3/drivers/scsi/scsi_sysfs.c linux-2.6.35.14-libre3/drivers/scsi/scsi_sysfs.c
--- linux-2.6.35.13-libre3/drivers/scsi/scsi_sysfs.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/scsi/scsi_sysfs.c	2011-08-01 16:56:51.000000000 -0400
@@ -319,14 +319,9 @@
 		kfree(evt);
 	}
 
-	if (sdev->request_queue) {
-		sdev->request_queue->queuedata = NULL;
-		/* user context needed to free queue */
-		scsi_free_queue(sdev->request_queue);
-		/* temporary expedient, try to catch use of queue lock
-		 * after free of sdev */
-		sdev->request_queue = NULL;
-	}
+	blk_put_queue(sdev->request_queue);
+	/* NULL queue means the device can't be used */
+	sdev->request_queue = NULL;
 
 	scsi_target_reap(scsi_target(sdev));
 
@@ -961,6 +956,12 @@
 	if (sdev->host->hostt->slave_destroy)
 		sdev->host->hostt->slave_destroy(sdev);
 	transport_destroy_device(dev);
+
+	/* cause the request function to reject all I/O requests */
+	sdev->request_queue->queuedata = NULL;
+
+	/* Freeing the queue signals to block that we're done */
+	scsi_free_queue(sdev->request_queue);
 	put_device(dev);
 }
 
diff -druN linux-2.6.35.13-libre3/drivers/scsi/ultrastor.c linux-2.6.35.14-libre3/drivers/scsi/ultrastor.c
--- linux-2.6.35.13-libre3/drivers/scsi/ultrastor.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/scsi/ultrastor.c	2011-08-01 16:56:51.000000000 -0400
@@ -306,7 +306,7 @@
 	"0: bsfw %1,%w0\n\t"
 	"btr %0,%1\n\t"
 	"jnc 0b"
-	: "=&r" (rv), "=m" (*field) :);
+	: "=&r" (rv), "+m" (*field) :);
 
   return rv;
 }
diff -druN linux-2.6.35.13-libre3/drivers/serial/Kconfig linux-2.6.35.14-libre3/drivers/serial/Kconfig
--- linux-2.6.35.13-libre3/drivers/serial/Kconfig	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/serial/Kconfig	2011-08-01 16:56:51.000000000 -0400
@@ -1417,7 +1417,7 @@
 
 config SERIAL_SC26XX_CONSOLE
 	bool "Console on SC2681/SC2692 serial port"
-	depends on SERIAL_SC26XX
+	depends on SERIAL_SC26XX=y
 	select SERIAL_CORE_CONSOLE
 	help
 	  Support for Console on SC2681/SC2692 serial ports.
diff -druN linux-2.6.35.13-libre3/drivers/staging/comedi/comedi_fops.c linux-2.6.35.14-libre3/drivers/staging/comedi/comedi_fops.c
--- linux-2.6.35.13-libre3/drivers/staging/comedi/comedi_fops.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/staging/comedi/comedi_fops.c	2011-08-01 16:56:51.000000000 -0400
@@ -383,8 +383,8 @@
 	/* fill devinfo structure */
 	devinfo.version_code = COMEDI_VERSION_CODE;
 	devinfo.n_subdevs = dev->n_subdevices;
-	memcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
-	memcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
+	strlcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
+	strlcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
 
 	if (read_subdev)
 		devinfo.read_subdevice = read_subdev - dev->subdevices;
diff -druN linux-2.6.35.13-libre3/drivers/staging/hv/netvsc_drv.c linux-2.6.35.14-libre3/drivers/staging/hv/netvsc_drv.c
--- linux-2.6.35.13-libre3/drivers/staging/hv/netvsc_drv.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/staging/hv/netvsc_drv.c	2011-08-01 16:56:51.000000000 -0400
@@ -19,6 +19,7 @@
  *   Hank Janssen  <hjanssen@microsoft.com>
  */
 #include <linux/init.h>
+#include <linux/atomic.h>
 #include <linux/module.h>
 #include <linux/highmem.h>
 #include <linux/device.h>
@@ -45,7 +46,7 @@
 struct net_device_context {
 	/* point back to our device context */
 	struct vm_device *device_ctx;
-	unsigned long avail;
+	atomic_t avail;
 	struct work_struct work;
 };
 
@@ -133,7 +134,9 @@
 
 		dev_kfree_skb_any(skb);
 
-		if ((net_device_ctx->avail += num_pages) >= PACKET_PAGES_HIWATER)
+		atomic_add(num_pages, &net_device_ctx->avail);
+		if (atomic_read(&net_device_ctx->avail) >=
+				PACKET_PAGES_HIWATER)
  			netif_wake_queue(net);
 	}
 
@@ -159,7 +162,7 @@
 
 	/* Add 1 for skb->data and additional one for RNDIS */
 	num_pages = skb_shinfo(skb)->nr_frags + 1 + 1;
-	if (num_pages > net_device_ctx->avail)
+	if (num_pages > atomic_read(&net_device_ctx->avail))
 		return NETDEV_TX_BUSY;
 
 	/* Allocate a netvsc packet based on # of frags. */
@@ -218,7 +221,8 @@
 			   net->stats.tx_packets,
 			   net->stats.tx_bytes);
 
-		if ((net_device_ctx->avail -= num_pages) < PACKET_PAGES_LOWATER)
+		atomic_sub(num_pages, &net_device_ctx->avail);
+		if (atomic_read(&net_device_ctx->avail) < PACKET_PAGES_LOWATER)
 			netif_stop_queue(net);
 	} else {
 		/* we are shutting down or bus overloaded, just drop packet */
@@ -406,7 +410,7 @@
 
 	net_device_ctx = netdev_priv(net);
 	net_device_ctx->device_ctx = device_ctx;
-	net_device_ctx->avail = ring_size;
+	atomic_set(&net_device_ctx->avail, ring_size);
 	dev_set_drvdata(device, net);
 	INIT_WORK(&net_device_ctx->work, netvsc_send_garp);
 
diff -druN linux-2.6.35.13-libre3/drivers/staging/rtl8192e/r8192E_core.c linux-2.6.35.14-libre3/drivers/staging/rtl8192e/r8192E_core.c
--- linux-2.6.35.13-libre3/drivers/staging/rtl8192e/r8192E_core.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/staging/rtl8192e/r8192E_core.c	2011-08-01 16:56:51.000000000 -0400
@@ -6334,6 +6334,7 @@
 	struct net_device *dev = NULL;
 	struct r8192_priv *priv= NULL;
 	u8 unit = 0;
+	u8 revisionid;
 
 #ifdef CONFIG_RTL8192_IO_MAP
 	unsigned long pio_start, pio_len, pio_flags;
@@ -6423,6 +6424,11 @@
          pci_write_config_byte(pdev, 0x41, 0x00);
 
 
+	pci_read_config_byte(pdev, 0x08, &revisionid);
+	/* If the revisionid is 0x10, the device uses rtl8192se. */
+	if (pdev->device == 0x8192 && revisionid == 0x10)
+		goto fail1;
+
 	pci_read_config_byte(pdev, 0x05, &unit);
 	pci_write_config_byte(pdev, 0x05, unit & (~0x04));
 
diff -druN linux-2.6.35.13-libre3/drivers/staging/rtl8192su/r8192U_core.c linux-2.6.35.14-libre3/drivers/staging/rtl8192su/r8192U_core.c
--- linux-2.6.35.13-libre3/drivers/staging/rtl8192su/r8192U_core.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/staging/rtl8192su/r8192U_core.c	2011-08-01 16:56:51.000000000 -0400
@@ -27,6 +27,7 @@
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
 #include <linux/eeprom_93cx6.h>
+#include <linux/notifier.h>
 
 #undef LOOP_TEST
 #undef DUMP_RX
@@ -162,6 +163,8 @@
 static int __devinit rtl8192_usb_probe(struct usb_interface *intf,
 			 const struct usb_device_id *id);
 static void __devexit rtl8192_usb_disconnect(struct usb_interface *intf);
+static const struct net_device_ops rtl8192_netdev_ops;
+static struct notifier_block proc_netdev_notifier;
 
 static struct usb_driver rtl8192_usb_driver = {
 	.name		= RTL819xU_MODULE_NAME,	          /* Driver name   */
@@ -991,15 +994,24 @@
 	return len;
 }
 
-void rtl8192_proc_module_init(void)
+int rtl8192_proc_module_init(void)
 {
+	int ret;
+
 	RT_TRACE(COMP_INIT, "Initializing proc filesystem");
 	rtl8192_proc=create_proc_entry(RTL819xU_MODULE_NAME, S_IFDIR, init_net.proc_net);
+	if (!rtl8192_proc)
+		return -ENOMEM;
+	ret = register_netdevice_notifier(&proc_netdev_notifier);
+	if (ret)
+		remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net);
+	return ret;
 }
 
 
 void rtl8192_proc_module_remove(void)
 {
+	unregister_netdevice_notifier(&proc_netdev_notifier);
 	remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net);
 }
 
@@ -1027,8 +1039,7 @@
 		remove_proc_entry("registers-e", priv->dir_dev);
 	//	remove_proc_entry("cck-registers",priv->dir_dev);
 	//	remove_proc_entry("ofdm-registers",priv->dir_dev);
-		//remove_proc_entry(dev->name, rtl8192_proc);
-		remove_proc_entry("wlan0", rtl8192_proc);
+		remove_proc_entry(priv->dir_dev->name, rtl8192_proc);
 		priv->dir_dev = NULL;
 	}
 }
@@ -1145,6 +1156,25 @@
 		      dev->name);
 	}
 }
+
+static int proc_netdev_event(struct notifier_block *this,
+			     unsigned long event, void *ptr)
+{
+	struct net_device *net_dev = ptr;
+
+	if (net_dev->netdev_ops == &rtl8192_netdev_ops &&
+	    event == NETDEV_CHANGENAME) {
+		rtl8192_proc_remove_one(net_dev);
+		rtl8192_proc_init_one(net_dev);
+	}
+
+	return NOTIFY_DONE;
+}
+
+static struct notifier_block proc_netdev_notifier = {
+	.notifier_call = proc_netdev_event,
+};
+
 /****************************************************************************
    -----------------------------MISC STUFF-------------------------
 *****************************************************************************/
@@ -7474,35 +7504,63 @@
 	ret = ieee80211_crypto_init();
 	if (ret) {
 		printk(KERN_ERR "ieee80211_crypto_init() failed %d\n", ret);
-		return ret;
+		goto fail_crypto;
 	}
 
 	ret = ieee80211_crypto_tkip_init();
 	if (ret) {
 		printk(KERN_ERR "ieee80211_crypto_tkip_init() failed %d\n",
 			ret);
-		return ret;
+		goto fail_crypto_tkip;
 	}
 
 	ret = ieee80211_crypto_ccmp_init();
 	if (ret) {
 		printk(KERN_ERR "ieee80211_crypto_ccmp_init() failed %d\n",
 			ret);
-		return ret;
+		goto fail_crypto_ccmp;
 	}
 
 	ret = ieee80211_crypto_wep_init();
 	if (ret) {
 		printk(KERN_ERR "ieee80211_crypto_wep_init() failed %d\n", ret);
-		return ret;
+		goto fail_crypto_wep;
 	}
 
 	printk(KERN_INFO "\nLinux kernel driver for RTL8192 based WLAN cards\n");
 	printk(KERN_INFO "Copyright (c) 2007-2008, Realsil Wlan\n");
 	RT_TRACE(COMP_INIT, "Initializing module");
 	RT_TRACE(COMP_INIT, "Wireless extensions version %d", WIRELESS_EXT);
-	rtl8192_proc_module_init();
-	return usb_register(&rtl8192_usb_driver);
+
+	ret = rtl8192_proc_module_init();
+	if (ret) {
+		pr_err("rtl8192_proc_module_init() failed %d\n", ret);
+		goto fail_proc;
+	}
+
+	ret = usb_register(&rtl8192_usb_driver);
+	if (ret) {
+		pr_err("usb_register() failed %d\n", ret);
+		goto fail_usb;
+	}
+
+	return 0;
+
+fail_usb:
+	rtl8192_proc_module_remove();
+fail_proc:
+	ieee80211_crypto_wep_exit();
+fail_crypto_wep:
+	ieee80211_crypto_ccmp_exit();
+fail_crypto_ccmp:
+	ieee80211_crypto_tkip_exit();
+fail_crypto_tkip:
+	ieee80211_crypto_deinit();
+fail_crypto:
+#ifdef CONFIG_IEEE80211_DEBUG
+	ieee80211_debug_exit();
+#endif
+	return ret;
 }
 
 
diff -druN linux-2.6.35.13-libre3/drivers/staging/usbip/usbip_common.c linux-2.6.35.14-libre3/drivers/staging/usbip/usbip_common.c
--- linux-2.6.35.13-libre3/drivers/staging/usbip/usbip_common.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/staging/usbip/usbip_common.c	2011-08-01 16:56:51.000000000 -0400
@@ -709,7 +709,7 @@
 		be32_to_cpus(&pdu->status);
 		be32_to_cpus(&pdu->actual_length);
 		be32_to_cpus(&pdu->start_frame);
-		cpu_to_be32s(&pdu->number_of_packets);
+		be32_to_cpus(&pdu->number_of_packets);
 		be32_to_cpus(&pdu->error_count);
 	}
 }
diff -druN linux-2.6.35.13-libre3/drivers/staging/usbip/vhci_hcd.c linux-2.6.35.14-libre3/drivers/staging/usbip/vhci_hcd.c
--- linux-2.6.35.13-libre3/drivers/staging/usbip/vhci_hcd.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/staging/usbip/vhci_hcd.c	2011-08-01 16:56:51.000000000 -0400
@@ -1135,7 +1135,7 @@
 		usbip_uerr("create hcd failed\n");
 		return -ENOMEM;
 	}
-
+	hcd->has_tt = 1;
 
 	/* this is private data for vhci_hcd */
 	the_controller = hcd_to_vhci(hcd);
diff -druN linux-2.6.35.13-libre3/drivers/usb/class/cdc-acm.c linux-2.6.35.14-libre3/drivers/usb/class/cdc-acm.c
--- linux-2.6.35.13-libre3/drivers/usb/class/cdc-acm.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/class/cdc-acm.c	2011-08-01 16:56:51.000000000 -0400
@@ -1619,6 +1619,8 @@
 	{ NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
 	{ NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
 	{ NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0335), }, /* Nokia E7 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */
 	{ SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
 
 	/* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
diff -druN linux-2.6.35.13-libre3/drivers/usb/core/devices.c linux-2.6.35.14-libre3/drivers/usb/core/devices.c
--- linux-2.6.35.13-libre3/drivers/usb/core/devices.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/core/devices.c	2011-08-01 16:56:51.000000000 -0400
@@ -66,8 +66,8 @@
 #define ALLOW_SERIAL_NUMBER
 
 static const char *format_topo =
-/* T:  Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd */
-"\nT:  Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%3s MxCh=%2d\n";
+/* T:  Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd */
+"\nT:  Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%-4s MxCh=%2d\n";
 
 static const char *format_string_manufacturer =
 /* S:  Manufacturer=xxxx */
@@ -521,11 +521,13 @@
 		speed = "1.5"; break;
 	case USB_SPEED_UNKNOWN:		/* usb 1.1 root hub code */
 	case USB_SPEED_FULL:
-		speed = "12 "; break;
+		speed = "12"; break;
 	case USB_SPEED_HIGH:
 		speed = "480"; break;
+	case USB_SPEED_SUPER:
+		speed = "5000"; break;
 	default:
-		speed = "?? ";
+		speed = "??";
 	}
 	data_end = pages_start + sprintf(pages_start, format_topo,
 			bus->busnum, level, parent_devnum,
diff -druN linux-2.6.35.13-libre3/drivers/usb/core/driver.c linux-2.6.35.14-libre3/drivers/usb/core/driver.c
--- linux-2.6.35.13-libre3/drivers/usb/core/driver.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/core/driver.c	2011-08-01 16:56:51.000000000 -0400
@@ -1189,13 +1189,22 @@
 		for (i = n - 1; i >= 0; --i) {
 			intf = udev->actconfig->interface[i];
 			status = usb_suspend_interface(udev, intf, msg);
+
+			/* Ignore errors during system sleep transitions */
+			if (!(msg.event & PM_EVENT_AUTO))
+				status = 0;
 			if (status != 0)
 				break;
 		}
 	}
-	if (status == 0)
+	if (status == 0) {
 		status = usb_suspend_device(udev, msg);
 
+		/* Again, ignore errors during system sleep transitions */
+		if (!(msg.event & PM_EVENT_AUTO))
+			status = 0;
+	}
+
 	/* If the suspend failed, resume interfaces that did get suspended */
 	if (status != 0) {
 		msg.event ^= (PM_EVENT_SUSPEND | PM_EVENT_RESUME);
diff -druN linux-2.6.35.13-libre3/drivers/usb/core/hcd-pci.c linux-2.6.35.14-libre3/drivers/usb/core/hcd-pci.c
--- linux-2.6.35.13-libre3/drivers/usb/core/hcd-pci.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/core/hcd-pci.c	2011-08-01 16:56:51.000000000 -0400
@@ -317,8 +317,10 @@
 	if (!hcd)
 		return;
 
-	if (hcd->driver->shutdown)
+	if (hcd->driver->shutdown) {
 		hcd->driver->shutdown(hcd);
+		pci_disable_device(dev);
+	}
 }
 EXPORT_SYMBOL_GPL(usb_hcd_pci_shutdown);
 
diff -druN linux-2.6.35.13-libre3/drivers/usb/core/hub.c linux-2.6.35.14-libre3/drivers/usb/core/hub.c
--- linux-2.6.35.13-libre3/drivers/usb/core/hub.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/core/hub.c	2011-08-01 16:56:51.000000000 -0400
@@ -327,7 +327,8 @@
 {
 	int i, status = -ETIMEDOUT;
 
-	for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) {
+	for (i = 0; i < USB_STS_RETRIES &&
+			(status == -ETIMEDOUT || status == -EPIPE); i++) {
 		status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
 			USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_HUB, 0, 0,
 			data, sizeof(*data), USB_STS_TIMEOUT);
@@ -343,7 +344,8 @@
 {
 	int i, status = -ETIMEDOUT;
 
-	for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) {
+	for (i = 0; i < USB_STS_RETRIES &&
+			(status == -ETIMEDOUT || status == -EPIPE); i++) {
 		status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
 			USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_PORT, 0, port1,
 			data, sizeof(*data), USB_STS_TIMEOUT);
@@ -2231,6 +2233,10 @@
 				USB_DEVICE_REMOTE_WAKEUP, 0,
 				NULL, 0,
 				USB_CTRL_SET_TIMEOUT);
+
+		/* System sleep transitions should never fail */
+		if (!(msg.event & PM_EVENT_AUTO))
+			status = 0;
 	} else {
 		/* device has up to 10 msec to fully suspend */
 		dev_dbg(&udev->dev, "usb %ssuspend\n",
@@ -2468,16 +2474,15 @@
 	struct usb_device	*hdev = hub->hdev;
 	unsigned		port1;
 
-	/* fail if children aren't already suspended */
+	/* Warn if children aren't already suspended */
 	for (port1 = 1; port1 <= hdev->maxchild; port1++) {
 		struct usb_device	*udev;
 
 		udev = hdev->children [port1-1];
 		if (udev && udev->can_submit) {
-			if (!(msg.event & PM_EVENT_AUTO))
-				dev_dbg(&intf->dev, "port %d nyet suspended\n",
-						port1);
-			return -EBUSY;
+			dev_warn(&intf->dev, "port %d nyet suspended\n", port1);
+			if (msg.event & PM_EVENT_AUTO)
+				return -EBUSY;
 		}
 	}
 
diff -druN linux-2.6.35.13-libre3/drivers/usb/gadget/at91_udc.c linux-2.6.35.14-libre3/drivers/usb/gadget/at91_udc.c
--- linux-2.6.35.13-libre3/drivers/usb/gadget/at91_udc.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/gadget/at91_udc.c	2011-08-01 16:56:51.000000000 -0400
@@ -1701,7 +1701,7 @@
 	}
 
 	/* newer chips have more FIFO memory than rm9200 */
-	if (cpu_is_at91sam9260()) {
+	if (cpu_is_at91sam9260() || cpu_is_at91sam9g20()) {
 		udc->ep[0].maxpacket = 64;
 		udc->ep[3].maxpacket = 64;
 		udc->ep[4].maxpacket = 512;
diff -druN linux-2.6.35.13-libre3/drivers/usb/gadget/f_rndis.c linux-2.6.35.14-libre3/drivers/usb/gadget/f_rndis.c
--- linux-2.6.35.13-libre3/drivers/usb/gadget/f_rndis.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/gadget/f_rndis.c	2011-08-01 16:56:51.000000000 -0400
@@ -420,8 +420,7 @@
 	 */
 	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 			| USB_CDC_SEND_ENCAPSULATED_COMMAND:
-		if (w_length > req->length || w_value
-				|| w_index != rndis->ctrl_id)
+		if (w_value || w_index != rndis->ctrl_id)
 			goto invalid;
 		/* read the request; process it later */
 		value = w_length;
diff -druN linux-2.6.35.13-libre3/drivers/usb/host/ehci-hub.c linux-2.6.35.14-libre3/drivers/usb/host/ehci-hub.c
--- linux-2.6.35.13-libre3/drivers/usb/host/ehci-hub.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/host/ehci-hub.c	2011-08-01 16:56:51.000000000 -0400
@@ -837,10 +837,11 @@
 			 * power switching; they're allowed to just limit the
 			 * current.  khubd will turn the power back on.
 			 */
-			if (HCS_PPC (ehci->hcs_params)){
+			if ((temp & PORT_OC) && HCS_PPC(ehci->hcs_params)) {
 				ehci_writel(ehci,
 					temp & ~(PORT_RWC_BITS | PORT_POWER),
 					status_reg);
+				temp = ehci_readl(ehci, status_reg);
 			}
 		}
 
diff -druN linux-2.6.35.13-libre3/drivers/usb/host/ohci.h linux-2.6.35.14-libre3/drivers/usb/host/ohci.h
--- linux-2.6.35.13-libre3/drivers/usb/host/ohci.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/host/ohci.h	2011-08-01 16:56:51.000000000 -0400
@@ -403,6 +403,7 @@
 #define	OHCI_QUIRK_HUB_POWER	0x100			/* distrust firmware power/oc setup */
 #define	OHCI_QUIRK_AMD_ISO	0x200			/* ISO transfers*/
 #define	OHCI_QUIRK_AMD_PREFETCH	0x400			/* pre-fetch for ISO transfer */
+#define	OHCI_QUIRK_SHUTDOWN	0x800			/* nVidia power bug */
 	// there are also chip quirks/bugs in init logic
 
 	struct work_struct	nec_work;	/* Worker for NEC quirk */
diff -druN linux-2.6.35.13-libre3/drivers/usb/host/ohci-hcd.c linux-2.6.35.14-libre3/drivers/usb/host/ohci-hcd.c
--- linux-2.6.35.13-libre3/drivers/usb/host/ohci-hcd.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/host/ohci-hcd.c	2011-08-01 16:56:51.000000000 -0400
@@ -398,7 +398,14 @@
 
 	ohci = hcd_to_ohci (hcd);
 	ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
-	ohci_usb_reset (ohci);
+	ohci->hc_control = ohci_readl(ohci, &ohci->regs->control);
+
+	/* If the SHUTDOWN quirk is set, don't put the controller in RESET */
+	ohci->hc_control &= (ohci->flags & OHCI_QUIRK_SHUTDOWN ?
+			OHCI_CTRL_RWC | OHCI_CTRL_HCFS :
+			OHCI_CTRL_RWC);
+	ohci_writel(ohci, ohci->hc_control, &ohci->regs->control);
+
 	/* flush the writes */
 	(void) ohci_readl (ohci, &ohci->regs->control);
 }
diff -druN linux-2.6.35.13-libre3/drivers/usb/host/ohci-pci.c linux-2.6.35.14-libre3/drivers/usb/host/ohci-pci.c
--- linux-2.6.35.13-libre3/drivers/usb/host/ohci-pci.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/host/ohci-pci.c	2011-08-01 16:56:51.000000000 -0400
@@ -201,6 +201,28 @@
 	return 0;
 }
 
+/* nVidia controllers continue to drive Reset signalling on the bus
+ * even after system shutdown, wasting power.  This flag tells the
+ * shutdown routine to leave the controller OPERATIONAL instead of RESET.
+ */
+static int ohci_quirk_nvidia_shutdown(struct usb_hcd *hcd)
+{
+	struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+	struct ohci_hcd	*ohci = hcd_to_ohci(hcd);
+
+	/* Evidently nVidia fixed their later hardware; this is a guess at
+	 * the changeover point.
+	 */
+#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_USB		0x026d
+
+	if (pdev->device < PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_USB) {
+		ohci->flags |= OHCI_QUIRK_SHUTDOWN;
+		ohci_dbg(ohci, "enabled nVidia shutdown quirk\n");
+	}
+
+	return 0;
+}
+
 /*
  * The hardware normally enables the A-link power management feature, which
  * lets the system lower the power consumption in idle states.
@@ -332,6 +354,10 @@
 		PCI_DEVICE(PCI_VENDOR_ID_ATI, 0x4399),
 		.driver_data = (unsigned long)ohci_quirk_amd700,
 	},
+	{
+		PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID),
+		.driver_data = (unsigned long) ohci_quirk_nvidia_shutdown,
+	},
 
 	/* FIXME for some of the early AMD 760 southbridges, OHCI
 	 * won't work at all.  blacklist them.
diff -druN linux-2.6.35.13-libre3/drivers/usb/host/pci-quirks.c linux-2.6.35.14-libre3/drivers/usb/host/pci-quirks.c
--- linux-2.6.35.13-libre3/drivers/usb/host/pci-quirks.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/host/pci-quirks.c	2011-08-01 16:56:51.000000000 -0400
@@ -34,6 +34,8 @@
 #define OHCI_INTRSTATUS		0x0c
 #define OHCI_INTRENABLE		0x10
 #define OHCI_INTRDISABLE	0x14
+#define OHCI_FMINTERVAL		0x34
+#define OHCI_HCR		(1 << 0)	/* host controller reset */
 #define OHCI_OCR		(1 << 3)	/* ownership change request */
 #define OHCI_CTRL_RWC		(1 << 9)	/* remote wakeup connected */
 #define OHCI_CTRL_IR		(1 << 8)	/* interrupt routing */
@@ -169,6 +171,7 @@
 static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
 {
 	void __iomem *base;
+	u32 control;
 
 	if (!mmio_resource_enabled(pdev, 0))
 		return;
@@ -177,10 +180,14 @@
 	if (base == NULL)
 		return;
 
+	control = readl(base + OHCI_CONTROL);
+
 /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
-#ifndef __hppa__
-{
-	u32 control = readl(base + OHCI_CONTROL);
+#ifdef __hppa__
+#define	OHCI_CTRL_MASK		(OHCI_CTRL_RWC | OHCI_CTRL_IR)
+#else
+#define	OHCI_CTRL_MASK		OHCI_CTRL_RWC
+
 	if (control & OHCI_CTRL_IR) {
 		int wait_time = 500; /* arbitrary; 5 seconds */
 		writel(OHCI_INTR_OC, base + OHCI_INTRENABLE);
@@ -194,13 +201,38 @@
 			dev_warn(&pdev->dev, "OHCI: BIOS handoff failed"
 					" (BIOS bug?) %08x\n",
 					readl(base + OHCI_CONTROL));
-
-		/* reset controller, preserving RWC */
-		writel(control & OHCI_CTRL_RWC, base + OHCI_CONTROL);
 	}
-}
 #endif
 
+	/* reset controller, preserving RWC (and possibly IR) */
+	writel(control & OHCI_CTRL_MASK, base + OHCI_CONTROL);
+	readl(base + OHCI_CONTROL);
+
+	/* Some NVIDIA controllers stop working if kept in RESET for too long */
+	if (pdev->vendor == PCI_VENDOR_ID_NVIDIA) {
+		u32 fminterval;
+		int cnt;
+
+		/* drive reset for at least 50 ms (7.1.7.5) */
+		msleep(50);
+
+		/* software reset of the controller, preserving HcFmInterval */
+		fminterval = readl(base + OHCI_FMINTERVAL);
+		writel(OHCI_HCR, base + OHCI_CMDSTATUS);
+
+		/* reset requires max 10 us delay */
+		for (cnt = 30; cnt > 0; --cnt) {	/* ... allow extra time */
+			if ((readl(base + OHCI_CMDSTATUS) & OHCI_HCR) == 0)
+				break;
+			udelay(1);
+		}
+		writel(fminterval, base + OHCI_FMINTERVAL);
+
+		/* Now we're in the SUSPEND state with all devices reset
+		 * and wakeups and interrupts disabled
+		 */
+	}
+
 	/*
 	 * disable interrupts
 	 */
diff -druN linux-2.6.35.13-libre3/drivers/usb/host/xhci.c linux-2.6.35.14-libre3/drivers/usb/host/xhci.c
--- linux-2.6.35.13-libre3/drivers/usb/host/xhci.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/host/xhci.c	2011-08-01 16:56:51.000000000 -0400
@@ -1016,6 +1016,7 @@
 	u32 added_ctxs;
 	unsigned int last_ctx;
 	u32 new_add_flags, new_drop_flags, new_slot_info;
+	struct xhci_virt_device *virt_dev;
 	int ret = 0;
 
 	ret = xhci_check_args(hcd, udev, ep, 1, __func__);
@@ -1044,11 +1045,25 @@
 		return -EINVAL;
 	}
 
-	in_ctx = xhci->devs[udev->slot_id]->in_ctx;
-	out_ctx = xhci->devs[udev->slot_id]->out_ctx;
+	virt_dev = xhci->devs[udev->slot_id];
+	in_ctx = virt_dev->in_ctx;
+	out_ctx = virt_dev->out_ctx;
 	ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
 	ep_index = xhci_get_endpoint_index(&ep->desc);
 	ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
+
+	/* If this endpoint is already in use, and the upper layers are trying
+	 * to add it again without dropping it, reject the addition.
+	 */
+	if (virt_dev->eps[ep_index].ring &&
+			!(le32_to_cpu(ctrl_ctx->drop_flags) &
+				xhci_get_endpoint_flag(&ep->desc))) {
+		xhci_warn(xhci, "Trying to add endpoint 0x%x "
+				"without dropping it.\n",
+				(unsigned int) ep->desc.bEndpointAddress);
+		return -EINVAL;
+	}
+
 	/* If the HCD has already noted the endpoint is enabled,
 	 * ignore this request.
 	 */
@@ -1063,8 +1078,7 @@
 	 * process context, not interrupt context (or so documenation
 	 * for usb_set_interface() and usb_set_configuration() claim).
 	 */
-	if (xhci_endpoint_init(xhci, xhci->devs[udev->slot_id],
-				udev, ep, GFP_NOIO) < 0) {
+	if (xhci_endpoint_init(xhci, virt_dev, udev, ep, GFP_NOIO) < 0) {
 		dev_dbg(&udev->dev, "%s - could not initialize ep %#x\n",
 				__func__, ep->desc.bEndpointAddress);
 		return -ENOMEM;
diff -druN linux-2.6.35.13-libre3/drivers/usb/host/xhci-mem.c linux-2.6.35.14-libre3/drivers/usb/host/xhci-mem.c
--- linux-2.6.35.13-libre3/drivers/usb/host/xhci-mem.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/host/xhci-mem.c	2011-08-01 16:56:51.000000000 -0400
@@ -974,9 +974,19 @@
 	interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
 	if (interval != ep->desc.bInterval - 1)
 		dev_warn(&udev->dev,
-			 "ep %#x - rounding interval to %d microframes\n",
+			 "ep %#x - rounding interval to %d %sframes\n",
 			 ep->desc.bEndpointAddress,
-			 1 << interval);
+			 1 << interval,
+			 udev->speed == USB_SPEED_FULL ? "" : "micro");
+
+	if (udev->speed == USB_SPEED_FULL) {
+		/*
+		 * Full speed isoc endpoints specify interval in frames,
+		 * not microframes. We are using microframes everywhere,
+		 * so adjust accordingly.
+		 */
+		interval += 3;	/* 1 frame = 2^3 uframes */
+	}
 
 	return interval;
 }
@@ -1034,12 +1044,12 @@
 	 * nearest power of 2.
 	 */
 	case USB_SPEED_FULL:
-		if (usb_endpoint_xfer_int(&ep->desc)) {
+		if (usb_endpoint_xfer_isoc(&ep->desc)) {
 			interval = xhci_parse_exponent_interval(udev, ep);
 			break;
 		}
 		/*
-		 * Fall through for isochronous endpoint interval decoding
+		 * Fall through for interrupt endpoint interval decoding
 		 * since it uses the same rules as low speed interrupt
 		 * endpoints.
 		 */
diff -druN linux-2.6.35.13-libre3/drivers/usb/musb/musb_core.c linux-2.6.35.14-libre3/drivers/usb/musb/musb_core.c
--- linux-2.6.35.13-libre3/drivers/usb/musb/musb_core.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/musb/musb_core.c	2011-08-01 16:56:51.000000000 -0400
@@ -1697,6 +1697,7 @@
 			}
 		}
 	}
+	musb_writeb(musb_base, MUSB_INDEX, musb->context.index);
 }
 
 #else
@@ -1868,6 +1869,7 @@
 	INIT_LIST_HEAD(&musb->out_bulk);
 
 	hcd->uses_new_polling = 1;
+	hcd->has_tt = 1;
 
 	musb->vbuserr_retry = VBUSERR_RETRY_COUNT;
 	musb->a_wait_bcon = OTG_TIME_A_WAIT_BCON;
diff -druN linux-2.6.35.13-libre3/drivers/usb/serial/cp210x.c linux-2.6.35.14-libre3/drivers/usb/serial/cp210x.c
--- linux-2.6.35.13-libre3/drivers/usb/serial/cp210x.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/serial/cp210x.c	2011-08-01 16:56:51.000000000 -0400
@@ -112,6 +112,10 @@
 	{ USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
 	{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
 	{ USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
+	{ USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
+	{ USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */
+	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
+	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
diff -druN linux-2.6.35.13-libre3/drivers/usb/serial/ftdi_sio.c linux-2.6.35.14-libre3/drivers/usb/serial/ftdi_sio.c
--- linux-2.6.35.13-libre3/drivers/usb/serial/ftdi_sio.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/serial/ftdi_sio.c	2011-08-01 16:56:51.000000000 -0400
@@ -565,6 +565,7 @@
 	{ USB_DEVICE(FTDI_VID, FTDI_IBS_APP70_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) },
 	/*
 	 * ELV devices:
 	 */
@@ -645,6 +646,7 @@
 	{ USB_DEVICE(FTDI_VID, EVER_ECO_PRO_CDS) },
 	{ USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_1_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_2_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_3_PID) },
 	{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_0_PID) },
 	{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_1_PID) },
 	{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_2_PID) },
diff -druN linux-2.6.35.13-libre3/drivers/usb/serial/ftdi_sio_ids.h linux-2.6.35.14-libre3/drivers/usb/serial/ftdi_sio_ids.h
--- linux-2.6.35.13-libre3/drivers/usb/serial/ftdi_sio_ids.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/serial/ftdi_sio_ids.h	2011-08-01 16:56:51.000000000 -0400
@@ -351,6 +351,7 @@
  */
 #define FTDI_4N_GALAXY_DE_1_PID	0xF3C0
 #define FTDI_4N_GALAXY_DE_2_PID	0xF3C1
+#define FTDI_4N_GALAXY_DE_3_PID	0xF3C2
 
 /*
  * Linx Technologies product ids
@@ -491,6 +492,11 @@
 /* www.canusb.com Lawicel CANUSB device (FTDI_VID) */
 #define FTDI_CANUSB_PID 0xFFA8 /* Product Id */
 
+/*
+ * TavIR AVR product ids (FTDI_VID)
+ */
+#define FTDI_TAVIR_STK500_PID	0xFA33	/* STK500 AVR programmer */
+
 
 
 /********************************/
diff -druN linux-2.6.35.13-libre3/drivers/usb/serial/garmin_gps.c linux-2.6.35.14-libre3/drivers/usb/serial/garmin_gps.c
--- linux-2.6.35.13-libre3/drivers/usb/serial/garmin_gps.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/serial/garmin_gps.c	2011-08-01 16:56:51.000000000 -0400
@@ -1,7 +1,7 @@
 /*
  * Garmin GPS driver
  *
- * Copyright (C) 2006-2009 Hermann Kneissel herkne@users.sourceforge.net
+ * Copyright (C) 2006-2011 Hermann Kneissel herkne@gmx.de
  *
  * The latest version of the driver can be found at
  * http://sourceforge.net/projects/garmin-gps/
@@ -51,7 +51,7 @@
  */
 
 #define VERSION_MAJOR	0
-#define VERSION_MINOR	33
+#define VERSION_MINOR	36
 
 #define _STR(s) #s
 #define _DRIVER_VERSION(a, b) "v" _STR(a) "." _STR(b)
@@ -410,6 +410,7 @@
  */
 static int gsp_rec_packet(struct garmin_data *garmin_data_p, int count)
 {
+	unsigned long flags;
 	const __u8 *recpkt = garmin_data_p->inbuffer+GSP_INITIAL_OFFSET;
 	__le32 *usbdata = (__le32 *) garmin_data_p->inbuffer;
 
@@ -458,7 +459,9 @@
 	/* if this was an abort-transfer command, flush all
 	   queued data. */
 	if (isAbortTrfCmnd(garmin_data_p->inbuffer)) {
+		spin_lock_irqsave(&garmin_data_p->lock, flags);
 		garmin_data_p->flags |= FLAGS_DROP_DATA;
+		spin_unlock_irqrestore(&garmin_data_p->lock, flags);
 		pkt_clear(garmin_data_p);
 	}
 
@@ -943,7 +946,7 @@
 	spin_lock_irqsave(&garmin_data_p->lock, flags);
 	garmin_data_p->mode  = initial_mode;
 	garmin_data_p->count = 0;
-	garmin_data_p->flags = 0;
+	garmin_data_p->flags &= FLAGS_SESSION_REPLY1_SEEN;
 	spin_unlock_irqrestore(&garmin_data_p->lock, flags);
 
 	/* shutdown any bulk reads that might be going on */
@@ -1178,7 +1181,8 @@
 
 
 static void garmin_read_process(struct garmin_data *garmin_data_p,
-				 unsigned char *data, unsigned data_length)
+				 unsigned char *data, unsigned data_length,
+				 int bulk_data)
 {
 	unsigned long flags;
 
@@ -1193,7 +1197,8 @@
 		   send it directly to the tty port */
 		if (garmin_data_p->flags & FLAGS_QUEUING) {
 			pkt_add(garmin_data_p, data, data_length);
-		} else if (getLayerId(data) == GARMIN_LAYERID_APPL) {
+		} else if (bulk_data ||
+			   getLayerId(data) == GARMIN_LAYERID_APPL) {
 
 			spin_lock_irqsave(&garmin_data_p->lock, flags);
 			garmin_data_p->flags |= APP_RESP_SEEN;
@@ -1237,7 +1242,7 @@
 	usb_serial_debug_data(debug, &port->dev,
 				__func__, urb->actual_length, data);
 
-	garmin_read_process(garmin_data_p, data, urb->actual_length);
+	garmin_read_process(garmin_data_p, data, urb->actual_length, 1);
 
 	if (urb->actual_length == 0 &&
 			0 != (garmin_data_p->flags & FLAGS_BULK_IN_RESTART)) {
@@ -1347,7 +1352,7 @@
 			__func__, garmin_data_p->serial_num);
 	}
 
-	garmin_read_process(garmin_data_p, data, urb->actual_length);
+	garmin_read_process(garmin_data_p, data, urb->actual_length, 0);
 
 	port->interrupt_in_urb->dev = port->serial->dev;
 	retval = usb_submit_urb(urb, GFP_ATOMIC);
@@ -1462,6 +1467,7 @@
 	garmin_data_p->timer.function = timeout_handler;
 	garmin_data_p->port = port;
 	garmin_data_p->state = 0;
+	garmin_data_p->flags = 0;
 	garmin_data_p->count = 0;
 	usb_set_serial_port_data(port, garmin_data_p);
 
diff -druN linux-2.6.35.13-libre3/drivers/usb/serial/moto_modem.c linux-2.6.35.14-libre3/drivers/usb/serial/moto_modem.c
--- linux-2.6.35.13-libre3/drivers/usb/serial/moto_modem.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/serial/moto_modem.c	2011-08-01 16:56:51.000000000 -0400
@@ -25,6 +25,7 @@
 	{ USB_DEVICE(0x05c6, 0x3197) },	/* unknown Motorola phone */
 	{ USB_DEVICE(0x0c44, 0x0022) },	/* unknown Mororola phone */
 	{ USB_DEVICE(0x22b8, 0x2a64) },	/* Motorola KRZR K1m */
+	{ USB_DEVICE(0x22b8, 0x2c84) }, /* Motorola VE240 phone */
 	{ USB_DEVICE(0x22b8, 0x2c64) }, /* Motorola V950 phone */
 	{ },
 };
diff -druN linux-2.6.35.13-libre3/drivers/usb/serial/pl2303.c linux-2.6.35.14-libre3/drivers/usb/serial/pl2303.c
--- linux-2.6.35.13-libre3/drivers/usb/serial/pl2303.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/serial/pl2303.c	2011-08-01 16:56:51.000000000 -0400
@@ -91,6 +91,7 @@
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
 	{ USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
 	{ USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
+	{ USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) },
 	{ }					/* Terminating entry */
 };
 
diff -druN linux-2.6.35.13-libre3/drivers/usb/serial/pl2303.h linux-2.6.35.14-libre3/drivers/usb/serial/pl2303.h
--- linux-2.6.35.13-libre3/drivers/usb/serial/pl2303.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/serial/pl2303.h	2011-08-01 16:56:51.000000000 -0400
@@ -144,3 +144,7 @@
 /* ADLINK ND-6530 RS232,RS485 and RS422 adapter */
 #define ADLINK_VENDOR_ID		0x0b63
 #define ADLINK_ND6530_PRODUCT_ID	0x6530
+
+/* WinChipHead USB->RS 232 adapter */
+#define WINCHIPHEAD_VENDOR_ID		0x4348
+#define WINCHIPHEAD_USBSER_PRODUCT_ID	0x5523
diff -druN linux-2.6.35.13-libre3/drivers/usb/serial/usb_wwan.c linux-2.6.35.14-libre3/drivers/usb/serial/usb_wwan.c
--- linux-2.6.35.13-libre3/drivers/usb/serial/usb_wwan.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/usb/serial/usb_wwan.c	2011-08-01 16:56:51.000000000 -0400
@@ -216,12 +216,15 @@
 		    __func__, status, endpoint);
 	} else {
 		tty = tty_port_tty_get(&port->port);
-		if (urb->actual_length) {
-			tty_insert_flip_string(tty, data, urb->actual_length);
-			tty_flip_buffer_push(tty);
-		} else
-			dbg("%s: empty read urb received", __func__);
-		tty_kref_put(tty);
+		if (tty) {
+			if (urb->actual_length) {
+				tty_insert_flip_string(tty, data,
+						urb->actual_length);
+				tty_flip_buffer_push(tty);
+			} else
+				dbg("%s: empty read urb received", __func__);
+			tty_kref_put(tty);
+		}
 
 		/* Resubmit urb so we continue receiving */
 		if (status != -ESHUTDOWN) {
diff -druN linux-2.6.35.13-libre3/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.35.14-libre3/drivers/video/backlight/mbp_nvidia_bl.c
--- linux-2.6.35.13-libre3/drivers/video/backlight/mbp_nvidia_bl.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/video/backlight/mbp_nvidia_bl.c	2011-08-01 16:56:51.000000000 -0400
@@ -335,6 +335,24 @@
 		},
 		.driver_data	= (void *)&nvidia_chipset_data,
 	},
+	{
+		.callback	= mbp_dmi_match,
+		.ident		= "MacBookAir 3,1",
+		.matches	= {
+			DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,1"),
+		},
+		.driver_data	= (void *)&nvidia_chipset_data,
+	},
+	{
+		.callback	= mbp_dmi_match,
+		.ident		= "MacBookAir 3,2",
+		.matches	= {
+			DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,2"),
+		},
+		.driver_data	= (void *)&nvidia_chipset_data,
+	},
 	{ }
 };
 
diff -druN linux-2.6.35.13-libre3/drivers/watchdog/mtx-1_wdt.c linux-2.6.35.14-libre3/drivers/watchdog/mtx-1_wdt.c
--- linux-2.6.35.13-libre3/drivers/watchdog/mtx-1_wdt.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/watchdog/mtx-1_wdt.c	2011-08-01 16:56:51.000000000 -0400
@@ -211,6 +211,12 @@
 	int ret;
 
 	mtx1_wdt_device.gpio = pdev->resource[0].start;
+	ret = gpio_request_one(mtx1_wdt_device.gpio,
+				GPIOF_OUT_INIT_HIGH, "mtx1-wdt");
+	if (ret < 0) {
+		dev_err(&pdev->dev, "failed to request gpio");
+		return ret;
+	}
 
 	spin_lock_init(&mtx1_wdt_device.lock);
 	init_completion(&mtx1_wdt_device.stop);
@@ -236,6 +242,8 @@
 		mtx1_wdt_device.queue = 0;
 		wait_for_completion(&mtx1_wdt_device.stop);
 	}
+
+	gpio_free(mtx1_wdt_device.gpio);
 	misc_deregister(&mtx1_wdt_misc);
 	return 0;
 }
diff -druN linux-2.6.35.13-libre3/drivers/xen/events.c linux-2.6.35.14-libre3/drivers/xen/events.c
--- linux-2.6.35.13-libre3/drivers/xen/events.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/drivers/xen/events.c	2011-08-01 16:56:51.000000000 -0400
@@ -537,7 +537,7 @@
 	if (irq < 0)
 		return irq;
 
-	irqflags |= IRQF_NO_SUSPEND;
+	irqflags |= IRQF_NO_SUSPEND | IRQF_FORCE_RESUME;
 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
 	if (retval != 0) {
 		unbind_from_irq(irq);
@@ -819,9 +819,6 @@
 		evtchn_to_irq[evtchn] = irq;
 		irq_info[irq] = mk_virq_info(evtchn, virq);
 		bind_evtchn_to_cpu(evtchn, cpu);
-
-		/* Ready for use. */
-		unmask_evtchn(evtchn);
 	}
 }
 
@@ -847,10 +844,6 @@
 		evtchn_to_irq[evtchn] = irq;
 		irq_info[irq] = mk_ipi_info(evtchn, ipi);
 		bind_evtchn_to_cpu(evtchn, cpu);
-
-		/* Ready for use. */
-		unmask_evtchn(evtchn);
-
 	}
 }
 
diff -druN linux-2.6.35.13-libre3/fs/btrfs/volumes.c linux-2.6.35.14-libre3/fs/btrfs/volumes.c
--- linux-2.6.35.13-libre3/fs/btrfs/volumes.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/btrfs/volumes.c	2011-08-01 16:56:51.000000000 -0400
@@ -22,6 +22,7 @@
 #include <linux/blkdev.h>
 #include <linux/random.h>
 #include <linux/iocontext.h>
+#include <linux/capability.h>
 #include <asm/div64.h>
 #include "compat.h"
 #include "ctree.h"
@@ -1909,6 +1910,9 @@
 	if (dev_root->fs_info->sb->s_flags & MS_RDONLY)
 		return -EROFS;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	mutex_lock(&dev_root->fs_info->volume_mutex);
 	dev_root = dev_root->fs_info->dev_root;
 
diff -druN linux-2.6.35.13-libre3/fs/cifs/connect.c linux-2.6.35.14-libre3/fs/cifs/connect.c
--- linux-2.6.35.13-libre3/fs/cifs/connect.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/cifs/connect.c	2011-08-01 16:56:51.000000000 -0400
@@ -801,8 +801,7 @@
 cifs_parse_mount_options(char *options, const char *devname,
 			 struct smb_vol *vol)
 {
-	char *value;
-	char *data;
+	char *value, *data, *end;
 	unsigned int  temp_len, i, j;
 	char separator[2];
 	short int override_uid = -1;
@@ -845,6 +844,7 @@
 	if (!options)
 		return 1;
 
+	end = options + strlen(options);
 	if (strncmp(options, "sep=", 4) == 0) {
 		if (options[4] != 0) {
 			separator[0] = options[4];
@@ -909,6 +909,7 @@
 			the only illegal character in a password is null */
 
 			if ((value[temp_len] == 0) &&
+			    (value + temp_len < end) &&
 			    (value[temp_len+1] == separator[0])) {
 				/* reinsert comma */
 				value[temp_len] = separator[0];
@@ -2422,6 +2423,11 @@
 			      0 /* not legacy */, cifs_sb->local_nls,
 			      cifs_sb->mnt_cifs_flags &
 				CIFS_MOUNT_MAP_SPECIAL_CHR);
+
+	if (rc == -EOPNOTSUPP || rc == -EINVAL)
+		rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
+				cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+				  CIFS_MOUNT_MAP_SPECIAL_CHR);
 	kfree(pfile_info);
 	return rc;
 }
diff -druN linux-2.6.35.13-libre3/fs/cifs/sess.c linux-2.6.35.14-libre3/fs/cifs/sess.c
--- linux-2.6.35.13-libre3/fs/cifs/sess.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/cifs/sess.c	2011-08-01 16:56:51.000000000 -0400
@@ -913,7 +913,9 @@
 	}
 
 	/* BB check if Unicode and decode strings */
-	if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
+	if (bytes_remaining == 0) {
+		/* no string area to decode, do nothing */
+	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
 		/* unicode string area must be word-aligned */
 		if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
 			++bcc_ptr;
diff -druN linux-2.6.35.13-libre3/fs/dcookies.c linux-2.6.35.14-libre3/fs/dcookies.c
--- linux-2.6.35.13-libre3/fs/dcookies.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/dcookies.c	2011-08-01 16:56:51.000000000 -0400
@@ -178,6 +178,8 @@
 	/* FIXME: (deleted) ? */
 	path = d_path(&dcs->path, kbuf, PAGE_SIZE);
 
+	mutex_unlock(&dcookie_mutex);
+
 	if (IS_ERR(path)) {
 		err = PTR_ERR(path);
 		goto out_free;
@@ -194,6 +196,7 @@
 
 out_free:
 	kfree(kbuf);
+	return err;
 out:
 	mutex_unlock(&dcookie_mutex);
 	return err;
diff -druN linux-2.6.35.13-libre3/fs/ecryptfs/keystore.c linux-2.6.35.14-libre3/fs/ecryptfs/keystore.c
--- linux-2.6.35.13-libre3/fs/ecryptfs/keystore.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/ecryptfs/keystore.c	2011-08-01 16:56:51.000000000 -0400
@@ -482,8 +482,8 @@
 	struct mutex *tfm_mutex;
 	char *block_aligned_filename;
 	struct ecryptfs_auth_tok *auth_tok;
-	struct scatterlist src_sg;
-	struct scatterlist dst_sg;
+	struct scatterlist src_sg[2];
+	struct scatterlist dst_sg[2];
 	struct blkcipher_desc desc;
 	char iv[ECRYPTFS_MAX_IV_BYTES];
 	char hash[ECRYPTFS_TAG_70_DIGEST_SIZE];
@@ -696,23 +696,21 @@
 	memcpy(&s->block_aligned_filename[s->num_rand_bytes], filename,
 	       filename_size);
 	rc = virt_to_scatterlist(s->block_aligned_filename,
-				 s->block_aligned_filename_size, &s->src_sg, 1);
-	if (rc != 1) {
+				 s->block_aligned_filename_size, s->src_sg, 2);
+	if (rc < 1) {
 		printk(KERN_ERR "%s: Internal error whilst attempting to "
-		       "convert filename memory to scatterlist; "
-		       "expected rc = 1; got rc = [%d]. "
+		       "convert filename memory to scatterlist; rc = [%d]. "
 		       "block_aligned_filename_size = [%zd]\n", __func__, rc,
 		       s->block_aligned_filename_size);
 		goto out_release_free_unlock;
 	}
 	rc = virt_to_scatterlist(&dest[s->i], s->block_aligned_filename_size,
-				 &s->dst_sg, 1);
-	if (rc != 1) {
+				 s->dst_sg, 2);
+	if (rc < 1) {
 		printk(KERN_ERR "%s: Internal error whilst attempting to "
 		       "convert encrypted filename memory to scatterlist; "
-		       "expected rc = 1; got rc = [%d]. "
-		       "block_aligned_filename_size = [%zd]\n", __func__, rc,
-		       s->block_aligned_filename_size);
+		       "rc = [%d]. block_aligned_filename_size = [%zd]\n",
+		       __func__, rc, s->block_aligned_filename_size);
 		goto out_release_free_unlock;
 	}
 	/* The characters in the first block effectively do the job
@@ -735,7 +733,7 @@
 		       mount_crypt_stat->global_default_fn_cipher_key_bytes);
 		goto out_release_free_unlock;
 	}
-	rc = crypto_blkcipher_encrypt_iv(&s->desc, &s->dst_sg, &s->src_sg,
+	rc = crypto_blkcipher_encrypt_iv(&s->desc, s->dst_sg, s->src_sg,
 					 s->block_aligned_filename_size);
 	if (rc) {
 		printk(KERN_ERR "%s: Error attempting to encrypt filename; "
@@ -767,8 +765,8 @@
 	struct mutex *tfm_mutex;
 	char *decrypted_filename;
 	struct ecryptfs_auth_tok *auth_tok;
-	struct scatterlist src_sg;
-	struct scatterlist dst_sg;
+	struct scatterlist src_sg[2];
+	struct scatterlist dst_sg[2];
 	struct blkcipher_desc desc;
 	char fnek_sig_hex[ECRYPTFS_SIG_SIZE_HEX + 1];
 	char iv[ECRYPTFS_MAX_IV_BYTES];
@@ -873,13 +871,12 @@
 	}
 	mutex_lock(s->tfm_mutex);
 	rc = virt_to_scatterlist(&data[(*packet_size)],
-				 s->block_aligned_filename_size, &s->src_sg, 1);
-	if (rc != 1) {
+				 s->block_aligned_filename_size, s->src_sg, 2);
+	if (rc < 1) {
 		printk(KERN_ERR "%s: Internal error whilst attempting to "
 		       "convert encrypted filename memory to scatterlist; "
-		       "expected rc = 1; got rc = [%d]. "
-		       "block_aligned_filename_size = [%zd]\n", __func__, rc,
-		       s->block_aligned_filename_size);
+		       "rc = [%d]. block_aligned_filename_size = [%zd]\n",
+		       __func__, rc, s->block_aligned_filename_size);
 		goto out_unlock;
 	}
 	(*packet_size) += s->block_aligned_filename_size;
@@ -893,13 +890,12 @@
 		goto out_unlock;
 	}
 	rc = virt_to_scatterlist(s->decrypted_filename,
-				 s->block_aligned_filename_size, &s->dst_sg, 1);
-	if (rc != 1) {
+				 s->block_aligned_filename_size, s->dst_sg, 2);
+	if (rc < 1) {
 		printk(KERN_ERR "%s: Internal error whilst attempting to "
 		       "convert decrypted filename memory to scatterlist; "
-		       "expected rc = 1; got rc = [%d]. "
-		       "block_aligned_filename_size = [%zd]\n", __func__, rc,
-		       s->block_aligned_filename_size);
+		       "rc = [%d]. block_aligned_filename_size = [%zd]\n",
+		       __func__, rc, s->block_aligned_filename_size);
 		goto out_free_unlock;
 	}
 	/* The characters in the first block effectively do the job of
@@ -938,7 +934,7 @@
 		       mount_crypt_stat->global_default_fn_cipher_key_bytes);
 		goto out_free_unlock;
 	}
-	rc = crypto_blkcipher_decrypt_iv(&s->desc, &s->dst_sg, &s->src_sg,
+	rc = crypto_blkcipher_decrypt_iv(&s->desc, s->dst_sg, s->src_sg,
 					 s->block_aligned_filename_size);
 	if (rc) {
 		printk(KERN_ERR "%s: Error attempting to decrypt filename; "
diff -druN linux-2.6.35.13-libre3/fs/exec.c linux-2.6.35.14-libre3/fs/exec.c
--- linux-2.6.35.13-libre3/fs/exec.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/exec.c	2011-08-01 16:56:51.000000000 -0400
@@ -1024,6 +1024,7 @@
 
 	bprm->mm = NULL;		/* We're using it now */
 
+	set_fs(USER_DS);
 	current->flags &= ~PF_RANDOMIZE;
 	flush_thread();
 	current->personality &= ~bprm->per_clear;
@@ -1288,10 +1289,6 @@
 	if (retval)
 		return retval;
 
-	/* kernel module loader fixup */
-	/* so we don't try to load run modprobe in kernel space. */
-	set_fs(USER_DS);
-
 	retval = audit_bprm(bprm);
 	if (retval)
 		return retval;
diff -druN linux-2.6.35.13-libre3/fs/ext3/namei.c linux-2.6.35.14-libre3/fs/ext3/namei.c
--- linux-2.6.35.13-libre3/fs/ext3/namei.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/ext3/namei.c	2011-08-01 16:56:51.000000000 -0400
@@ -1425,10 +1425,19 @@
 	frame->at = entries;
 	frame->bh = bh;
 	bh = bh2;
+	/*
+	 * Mark buffers dirty here so that if do_split() fails we write a
+	 * consistent set of buffers to disk.
+	 */
+	ext3_journal_dirty_metadata(handle, frame->bh);
+	ext3_journal_dirty_metadata(handle, bh);
 	de = do_split(handle,dir, &bh, frame, &hinfo, &retval);
-	dx_release (frames);
-	if (!(de))
+	if (!de) {
+		ext3_mark_inode_dirty(handle, dir);
+		dx_release(frames);
 		return retval;
+	}
+	dx_release(frames);
 
 	return add_dirent_to_buf(handle, dentry, inode, de, bh);
 }
diff -druN linux-2.6.35.13-libre3/fs/ext4/mballoc.c linux-2.6.35.14-libre3/fs/ext4/mballoc.c
--- linux-2.6.35.13-libre3/fs/ext4/mballoc.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/ext4/mballoc.c	2011-08-01 16:56:51.000000000 -0400
@@ -1175,6 +1175,8 @@
 	return 0;
 
 err:
+	if (page)
+		page_cache_release(page);
 	if (e4b->bd_bitmap_page)
 		page_cache_release(e4b->bd_bitmap_page);
 	if (e4b->bd_buddy_page)
diff -druN linux-2.6.35.13-libre3/fs/fat/file.c linux-2.6.35.14-libre3/fs/fat/file.c
--- linux-2.6.35.13-libre3/fs/fat/file.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/fat/file.c	2011-08-01 16:56:51.000000000 -0400
@@ -102,7 +102,7 @@
 		if (attr & ATTR_SYS)
 			inode->i_flags |= S_IMMUTABLE;
 		else
-			inode->i_flags &= S_IMMUTABLE;
+			inode->i_flags &= ~S_IMMUTABLE;
 	}
 
 	fat_save_attrs(inode, attr);
diff -druN linux-2.6.35.13-libre3/fs/inode.c linux-2.6.35.14-libre3/fs/inode.c
--- linux-2.6.35.13-libre3/fs/inode.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/inode.c	2011-08-01 16:56:51.000000000 -0400
@@ -245,6 +245,20 @@
 		kmem_cache_free(inode_cachep, (inode));
 }
 
+void address_space_init_once(struct address_space *mapping)
+{
+	memset(mapping, 0, sizeof(*mapping));
+	INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);
+	spin_lock_init(&mapping->tree_lock);
+	spin_lock_init(&mapping->i_mmap_lock);
+	INIT_LIST_HEAD(&mapping->private_list);
+	spin_lock_init(&mapping->private_lock);
+	INIT_RAW_PRIO_TREE_ROOT(&mapping->i_mmap);
+	INIT_LIST_HEAD(&mapping->i_mmap_nonlinear);
+	mutex_init(&mapping->unmap_mutex);
+}
+EXPORT_SYMBOL(address_space_init_once);
+
 /*
  * These are initializations that only need to be done
  * once, because the fields are idempotent across use
@@ -256,13 +270,7 @@
 	INIT_HLIST_NODE(&inode->i_hash);
 	INIT_LIST_HEAD(&inode->i_dentry);
 	INIT_LIST_HEAD(&inode->i_devices);
-	INIT_RADIX_TREE(&inode->i_data.page_tree, GFP_ATOMIC);
-	spin_lock_init(&inode->i_data.tree_lock);
-	spin_lock_init(&inode->i_data.i_mmap_lock);
-	INIT_LIST_HEAD(&inode->i_data.private_list);
-	spin_lock_init(&inode->i_data.private_lock);
-	INIT_RAW_PRIO_TREE_ROOT(&inode->i_data.i_mmap);
-	INIT_LIST_HEAD(&inode->i_data.i_mmap_nonlinear);
+	address_space_init_once(&inode->i_data);
 	i_size_ordered_init(inode);
 #ifdef CONFIG_INOTIFY
 	INIT_LIST_HEAD(&inode->inotify_watches);
diff -druN linux-2.6.35.13-libre3/fs/jbd/commit.c linux-2.6.35.14-libre3/fs/jbd/commit.c
--- linux-2.6.35.13-libre3/fs/jbd/commit.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/jbd/commit.c	2011-08-01 16:56:51.000000000 -0400
@@ -745,8 +745,13 @@
                    required. */
 		JBUFFER_TRACE(jh, "file as BJ_Forget");
 		journal_file_buffer(jh, commit_transaction, BJ_Forget);
-		/* Wake up any transactions which were waiting for this
-		   IO to complete */
+		/*
+		 * Wake up any transactions which were waiting for this
+		 * IO to complete. The barrier must be here so that changes
+		 * by journal_file_buffer() take effect before wake_up_bit()
+		 * does the waitqueue check.
+		 */
+		smp_mb();
 		wake_up_bit(&bh->b_state, BH_Unshadow);
 		JBUFFER_TRACE(jh, "brelse shadowed buffer");
 		__brelse(bh);
diff -druN linux-2.6.35.13-libre3/fs/jbd/journal.c linux-2.6.35.14-libre3/fs/jbd/journal.c
--- linux-2.6.35.13-libre3/fs/jbd/journal.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/jbd/journal.c	2011-08-01 16:56:51.000000000 -0400
@@ -435,9 +435,12 @@
 int __log_start_commit(journal_t *journal, tid_t target)
 {
 	/*
-	 * Are we already doing a recent enough commit?
+	 * The only transaction we can possibly wait upon is the
+	 * currently running transaction (if it exists).  Otherwise,
+	 * the target tid must be an old one.
 	 */
-	if (!tid_geq(journal->j_commit_request, target)) {
+	if (journal->j_running_transaction &&
+	    journal->j_running_transaction->t_tid == target) {
 		/*
 		 * We want a new commit: OK, mark the request and wakup the
 		 * commit thread.  We do _not_ do the commit ourselves.
@@ -449,7 +452,14 @@
 			  journal->j_commit_sequence);
 		wake_up(&journal->j_wait_commit);
 		return 1;
-	}
+	} else if (!tid_geq(journal->j_commit_request, target))
+		/* This should never happen, but if it does, preserve
+		   the evidence before kjournald goes into a loop and
+		   increments j_commit_sequence beyond all recognition. */
+		WARN_ONCE(1, "jbd: bad log_start_commit: %u %u %u %u\n",
+		    journal->j_commit_request, journal->j_commit_sequence,
+		    target, journal->j_running_transaction ?
+		    journal->j_running_transaction->t_tid : 0);
 	return 0;
 }
 
diff -druN linux-2.6.35.13-libre3/fs/nfs/nfs4proc.c linux-2.6.35.14-libre3/fs/nfs/nfs4proc.c
--- linux-2.6.35.13-libre3/fs/nfs/nfs4proc.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/nfs/nfs4proc.c	2011-08-01 16:56:51.000000000 -0400
@@ -3275,6 +3275,35 @@
 	}
 }
 
+static int buf_to_pages_noslab(const void *buf, size_t buflen,
+		struct page **pages, unsigned int *pgbase)
+{
+	struct page *newpage, **spages;
+	int rc = 0;
+	size_t len;
+	spages = pages;
+
+	do {
+		len = min_t(size_t, PAGE_CACHE_SIZE, buflen);
+		newpage = alloc_page(GFP_KERNEL);
+
+		if (newpage == NULL)
+			goto unwind;
+		memcpy(page_address(newpage), buf, len);
+                buf += len;
+                buflen -= len;
+		*pages++ = newpage;
+		rc++;
+	} while (buflen != 0);
+
+	return rc;
+
+unwind:
+	for(; rc > 0; rc--)
+		__free_page(spages[rc-1]);
+	return -ENOMEM;
+}
+
 struct nfs4_cached_acl {
 	int cached;
 	size_t len;
@@ -3441,13 +3470,23 @@
 		.rpc_argp	= &arg,
 		.rpc_resp	= &res,
 	};
-	int ret;
+	int ret, i;
 
 	if (!nfs4_server_supports_acls(server))
 		return -EOPNOTSUPP;
+	i = buf_to_pages_noslab(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
+	if (i < 0)
+		return i;
 	nfs_inode_return_delegation(inode);
-	buf_to_pages(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
 	ret = nfs4_call_sync(server, &msg, &arg, &res, 1);
+
+	/*
+	 * Free each page after tx, so the only ref left is
+	 * held by the network stack
+	 */
+	for (; i > 0; i--)
+		put_page(pages[i-1]);
+
 	nfs_access_zap_cache(inode);
 	nfs_zap_acl_cache(inode);
 	return ret;
diff -druN linux-2.6.35.13-libre3/fs/nfs/nfs4state.c linux-2.6.35.14-libre3/fs/nfs/nfs4state.c
--- linux-2.6.35.13-libre3/fs/nfs/nfs4state.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/nfs/nfs4state.c	2011-08-01 16:56:51.000000000 -0400
@@ -1410,7 +1410,7 @@
 	int status = 0;
 
 	/* Ensure exclusive access to NFSv4 state */
-	for(;;) {
+	do {
 		if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) {
 			/* We're going to have to re-establish a clientid */
 			status = nfs4_reclaim_lease(clp);
@@ -1493,7 +1493,7 @@
 			break;
 		if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
 			break;
-	}
+	} while (atomic_read(&clp->cl_count) > 1);
 	return;
 out_error:
 	printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
diff -druN linux-2.6.35.13-libre3/fs/nfs/super.c linux-2.6.35.14-libre3/fs/nfs/super.c
--- linux-2.6.35.13-libre3/fs/nfs/super.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/nfs/super.c	2011-08-01 16:56:51.000000000 -0400
@@ -2001,6 +2001,15 @@
 	if (error < 0)
 		goto out;
 
+	/*
+	 * noac is a special case. It implies -o sync, but that's not
+	 * necessarily reflected in the mtab options. do_remount_sb
+	 * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the
+	 * remount options, so we have to explicitly reset it.
+	 */
+	if (data->flags & NFS_MOUNT_NOAC)
+		*flags |= MS_SYNCHRONOUS;
+
 	/* compare new mount options with old ones */
 	error = nfs_compare_remount_data(nfss, data);
 out:
diff -druN linux-2.6.35.13-libre3/fs/nfsd/vfs.c linux-2.6.35.14-libre3/fs/nfsd/vfs.c
--- linux-2.6.35.13-libre3/fs/nfsd/vfs.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/nfsd/vfs.c	2011-08-01 16:56:51.000000000 -0400
@@ -1386,7 +1386,7 @@
 		goto out;
 	if (!(iap->ia_valid & ATTR_MODE))
 		iap->ia_mode = 0;
-	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
+	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
 	if (err)
 		goto out;
 
@@ -1408,6 +1408,13 @@
 	if (IS_ERR(dchild))
 		goto out_nfserr;
 
+	/* If file doesn't exist, check for permissions to create one */
+	if (!dchild->d_inode) {
+		err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
+		if (err)
+			goto out;
+	}
+
 	err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
 	if (err)
 		goto out;
diff -druN linux-2.6.35.13-libre3/fs/nilfs2/btnode.c linux-2.6.35.14-libre3/fs/nilfs2/btnode.c
--- linux-2.6.35.13-libre3/fs/nilfs2/btnode.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/nilfs2/btnode.c	2011-08-01 16:56:51.000000000 -0400
@@ -35,19 +35,6 @@
 #include "btnode.h"
 
 
-void nilfs_btnode_cache_init_once(struct address_space *btnc)
-{
-	memset(btnc, 0, sizeof(*btnc));
-	INIT_RADIX_TREE(&btnc->page_tree, GFP_ATOMIC);
-	spin_lock_init(&btnc->tree_lock);
-	INIT_LIST_HEAD(&btnc->private_list);
-	spin_lock_init(&btnc->private_lock);
-
-	spin_lock_init(&btnc->i_mmap_lock);
-	INIT_RAW_PRIO_TREE_ROOT(&btnc->i_mmap);
-	INIT_LIST_HEAD(&btnc->i_mmap_nonlinear);
-}
-
 static const struct address_space_operations def_btnode_aops = {
 	.sync_page		= block_sync_page,
 };
diff -druN linux-2.6.35.13-libre3/fs/nilfs2/btnode.h linux-2.6.35.14-libre3/fs/nilfs2/btnode.h
--- linux-2.6.35.13-libre3/fs/nilfs2/btnode.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/nilfs2/btnode.h	2011-08-01 16:56:51.000000000 -0400
@@ -37,7 +37,6 @@
 	struct buffer_head *newbh;
 };
 
-void nilfs_btnode_cache_init_once(struct address_space *);
 void nilfs_btnode_cache_init(struct address_space *, struct backing_dev_info *);
 void nilfs_btnode_cache_clear(struct address_space *);
 struct buffer_head *nilfs_btnode_create_block(struct address_space *btnc,
diff -druN linux-2.6.35.13-libre3/fs/nilfs2/super.c linux-2.6.35.14-libre3/fs/nilfs2/super.c
--- linux-2.6.35.13-libre3/fs/nilfs2/super.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/nilfs2/super.c	2011-08-01 16:56:51.000000000 -0400
@@ -1120,7 +1120,7 @@
 #ifdef CONFIG_NILFS_XATTR
 	init_rwsem(&ii->xattr_sem);
 #endif
-	nilfs_btnode_cache_init_once(&ii->i_btnode_cache);
+	address_space_init_once(&ii->i_btnode_cache);
 	ii->i_bmap = (struct nilfs_bmap *)&ii->i_bmap_union;
 	inode_init_once(&ii->vfs_inode);
 }
diff -druN linux-2.6.35.13-libre3/fs/partitions/efi.c linux-2.6.35.14-libre3/fs/partitions/efi.c
--- linux-2.6.35.13-libre3/fs/partitions/efi.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/partitions/efi.c	2011-08-01 16:56:51.000000000 -0400
@@ -347,6 +347,12 @@
 		goto fail;
 	}
 
+	/* Check that sizeof_partition_entry has the correct value */
+	if (le32_to_cpu((*gpt)->sizeof_partition_entry) != sizeof(gpt_entry)) {
+		pr_debug("GUID Partitition Entry Size check failed.\n");
+		goto fail;
+	}
+
 	if (!(*ptes = alloc_read_gpt_entries(state, *gpt)))
 		goto fail;
 
diff -druN linux-2.6.35.13-libre3/fs/partitions/ldm.c linux-2.6.35.14-libre3/fs/partitions/ldm.c
--- linux-2.6.35.13-libre3/fs/partitions/ldm.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/partitions/ldm.c	2011-08-01 16:56:51.000000000 -0400
@@ -1299,6 +1299,11 @@
 
 	BUG_ON (!data || !frags);
 
+	if (size < 2 * VBLK_SIZE_HEAD) {
+		ldm_error("Value of size is to small.");
+		return false;
+	}
+
 	group = get_unaligned_be32(data + 0x08);
 	rec   = get_unaligned_be16(data + 0x0C);
 	num   = get_unaligned_be16(data + 0x0E);
@@ -1306,6 +1311,10 @@
 		ldm_error ("A VBLK claims to have %d parts.", num);
 		return false;
 	}
+	if (rec >= num) {
+		ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
+		return false;
+	}
 
 	list_for_each (item, frags) {
 		f = list_entry (item, struct frag, list);
@@ -1326,6 +1335,11 @@
 
 	list_add_tail (&f->list, frags);
 found:
+	if (rec >= f->num) {
+		ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
+		return false;
+	}
+
 	if (f->map & (1 << rec)) {
 		ldm_error ("Duplicate VBLK, part %d.", rec);
 		f->map &= 0x7F;			/* Mark the group as broken */
@@ -1334,10 +1348,9 @@
 
 	f->map |= (1 << rec);
 
-	if (num > 0) {
-		data += VBLK_SIZE_HEAD;
-		size -= VBLK_SIZE_HEAD;
-	}
+	data += VBLK_SIZE_HEAD;
+	size -= VBLK_SIZE_HEAD;
+
 	memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
 
 	return true;
diff -druN linux-2.6.35.13-libre3/fs/partitions/osf.c linux-2.6.35.14-libre3/fs/partitions/osf.c
--- linux-2.6.35.13-libre3/fs/partitions/osf.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/partitions/osf.c	2011-08-01 16:56:51.000000000 -0400
@@ -10,10 +10,13 @@
 #include "check.h"
 #include "osf.h"
 
+#define MAX_OSF_PARTITIONS 18
+
 int osf_partition(struct parsed_partitions *state)
 {
 	int i;
 	int slot = 1;
+	unsigned int npartitions;
 	Sector sect;
 	unsigned char *data;
 	struct disklabel {
@@ -45,7 +48,7 @@
 			u8  p_fstype;
 			u8  p_frag;
 			__le16 p_cpg;
-		} d_partitions[8];
+		} d_partitions[MAX_OSF_PARTITIONS];
 	} * label;
 	struct d_partition * partition;
 
@@ -63,7 +66,12 @@
 		put_dev_sector(sect);
 		return 0;
 	}
-	for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {
+	npartitions = le16_to_cpu(label->d_npartitions);
+	if (npartitions > MAX_OSF_PARTITIONS) {
+		put_dev_sector(sect);
+		return 0;
+	}
+	for (i = 0 ; i < npartitions; i++, partition++) {
 		if (slot == state->limit)
 		        break;
 		if (le32_to_cpu(partition->p_size))
diff -druN linux-2.6.35.13-libre3/fs/proc/base.c linux-2.6.35.14-libre3/fs/proc/base.c
--- linux-2.6.35.13-libre3/fs/proc/base.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/proc/base.c	2011-08-01 16:56:51.000000000 -0400
@@ -2514,6 +2514,9 @@
 	struct task_io_accounting acct = task->ioac;
 	unsigned long flags;
 
+	if (!ptrace_may_access(task, PTRACE_MODE_READ))
+		return -EACCES;
+
 	if (whole && lock_task_sighand(task, &flags)) {
 		struct task_struct *t = task;
 
@@ -2636,7 +2639,7 @@
 	REG("coredump_filter", S_IRUGO|S_IWUSR, proc_coredump_filter_operations),
 #endif
 #ifdef CONFIG_TASK_IO_ACCOUNTING
-	INF("io",	S_IRUGO, proc_tgid_io_accounting),
+	INF("io",	S_IRUSR, proc_tgid_io_accounting),
 #endif
 };
 
@@ -2972,7 +2975,7 @@
 	REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),
 #endif
 #ifdef CONFIG_TASK_IO_ACCOUNTING
-	INF("io",	S_IRUGO, proc_tid_io_accounting),
+	INF("io",	S_IRUSR, proc_tid_io_accounting),
 #endif
 };
 
diff -druN linux-2.6.35.13-libre3/fs/ubifs/journal.c linux-2.6.35.14-libre3/fs/ubifs/journal.c
--- linux-2.6.35.13-libre3/fs/ubifs/journal.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/ubifs/journal.c	2011-08-01 16:56:51.000000000 -0400
@@ -665,6 +665,7 @@
 
 out_release:
 	release_head(c, BASEHD);
+	kfree(dent);
 out_ro:
 	ubifs_ro_mode(c, err);
 	if (last_reference)
diff -druN linux-2.6.35.13-libre3/fs/ubifs/sb.c linux-2.6.35.14-libre3/fs/ubifs/sb.c
--- linux-2.6.35.13-libre3/fs/ubifs/sb.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/ubifs/sb.c	2011-08-01 16:56:51.000000000 -0400
@@ -475,7 +475,8 @@
  * @c: UBIFS file-system description object
  *
  * This function returns a pointer to the superblock node or a negative error
- * code.
+ * code. Note, the user of this function is responsible of kfree()'ing the
+ * returned superblock buffer.
  */
 struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c)
 {
diff -druN linux-2.6.35.13-libre3/fs/ubifs/shrinker.c linux-2.6.35.14-libre3/fs/ubifs/shrinker.c
--- linux-2.6.35.13-libre3/fs/ubifs/shrinker.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/ubifs/shrinker.c	2011-08-01 16:56:51.000000000 -0400
@@ -283,7 +283,11 @@
 	long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt);
 
 	if (nr == 0)
-		return clean_zn_cnt;
+		/*
+		 * Due to the way UBIFS updates the clean znode counter it may
+		 * temporarily be negative.
+		 */
+		return clean_zn_cnt >= 0 ? clean_zn_cnt : 1;
 
 	if (!clean_zn_cnt) {
 		/*
diff -druN linux-2.6.35.13-libre3/fs/ubifs/super.c linux-2.6.35.14-libre3/fs/ubifs/super.c
--- linux-2.6.35.13-libre3/fs/ubifs/super.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/fs/ubifs/super.c	2011-08-01 16:56:51.000000000 -0400
@@ -1545,6 +1545,7 @@
 		}
 		sup->leb_cnt = cpu_to_le32(c->leb_cnt);
 		err = ubifs_write_sb_node(c, sup);
+		kfree(sup);
 		if (err)
 			goto out;
 	}
diff -druN linux-2.6.35.13-libre3/include/asm-generic/bug.h linux-2.6.35.14-libre3/include/asm-generic/bug.h
--- linux-2.6.35.13-libre3/include/asm-generic/bug.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/asm-generic/bug.h	2011-08-01 16:56:51.000000000 -0400
@@ -53,6 +53,22 @@
 #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while(0)
 #endif
 
+#define __WARN_RATELIMIT(condition, state, format...)		\
+({								\
+	int rtn = 0;						\
+	if (unlikely(__ratelimit(state)))			\
+		rtn = WARN(condition, format);			\
+	rtn;							\
+})
+
+#define WARN_RATELIMIT(condition, format...)			\
+({								\
+	static DEFINE_RATELIMIT_STATE(_rs,			\
+				      DEFAULT_RATELIMIT_INTERVAL,	\
+				      DEFAULT_RATELIMIT_BURST);	\
+	__WARN_RATELIMIT(condition, &_rs, format);		\
+})
+
 /*
  * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report
  * significant issues that need prompt attention if they should ever
diff -druN linux-2.6.35.13-libre3/include/linux/clocksource.h linux-2.6.35.14-libre3/include/linux/clocksource.h
--- linux-2.6.35.13-libre3/include/linux/clocksource.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/linux/clocksource.h	2011-08-01 16:56:51.000000000 -0400
@@ -192,6 +192,7 @@
 #ifdef CONFIG_CLOCKSOURCE_WATCHDOG
 	/* Watchdog related data, used by the framework */
 	struct list_head wd_list;
+	cycle_t cs_last;
 	cycle_t wd_last;
 #endif
 };
diff -druN linux-2.6.35.13-libre3/include/linux/firewire-cdev.h linux-2.6.35.14-libre3/include/linux/firewire-cdev.h
--- linux-2.6.35.13-libre3/include/linux/firewire-cdev.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/linux/firewire-cdev.h	2011-08-01 16:56:51.000000000 -0400
@@ -284,6 +284,9 @@
  *		of the bus.  This does not cause a bus reset to happen.
  * @bus_reset_closure: Value of &closure in this and subsequent bus reset events
  * @card:	The index of the card this device belongs to
+ *
+ * As a side effect, reception of %FW_CDEV_EVENT_BUS_RESET events to be read(2)
+ * is started by this ioctl.
  */
 struct fw_cdev_get_info {
 	__u32 version;
diff -druN linux-2.6.35.13-libre3/include/linux/fs.h linux-2.6.35.14-libre3/include/linux/fs.h
--- linux-2.6.35.13-libre3/include/linux/fs.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/linux/fs.h	2011-08-01 16:56:51.000000000 -0400
@@ -639,6 +639,7 @@
 	spinlock_t		private_lock;	/* for use by the address_space */
 	struct list_head	private_list;	/* ditto */
 	struct address_space	*assoc_mapping;	/* ditto */
+	struct mutex		unmap_mutex;    /* to protect unmapping */
 } __attribute__((aligned(sizeof(long))));
 	/*
 	 * On most architectures that alignment is already the case; but
@@ -2160,6 +2161,7 @@
 
 extern int inode_init_always(struct super_block *, struct inode *);
 extern void inode_init_once(struct inode *);
+extern void address_space_init_once(struct address_space *mapping);
 extern void inode_add_to_lists(struct super_block *, struct inode *);
 extern void iput(struct inode *);
 extern struct inode * igrab(struct inode *);
diff -druN linux-2.6.35.13-libre3/include/linux/if_packet.h linux-2.6.35.14-libre3/include/linux/if_packet.h
--- linux-2.6.35.13-libre3/include/linux/if_packet.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/linux/if_packet.h	2011-08-01 16:56:51.000000000 -0400
@@ -61,6 +61,7 @@
 	__u16		tp_mac;
 	__u16		tp_net;
 	__u16		tp_vlan_tci;
+	__u16		tp_padding;
 };
 
 /* Rx ring - header status */
@@ -99,6 +100,7 @@
 	__u32		tp_sec;
 	__u32		tp_nsec;
 	__u16		tp_vlan_tci;
+	__u16		tp_padding;
 };
 
 #define TPACKET2_HDRLEN		(TPACKET_ALIGN(sizeof(struct tpacket2_hdr)) + sizeof(struct sockaddr_ll))
diff -druN linux-2.6.35.13-libre3/include/linux/interrupt.h linux-2.6.35.14-libre3/include/linux/interrupt.h
--- linux-2.6.35.13-libre3/include/linux/interrupt.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/linux/interrupt.h	2011-08-01 16:56:51.000000000 -0400
@@ -54,7 +54,7 @@
  *                Used by threaded interrupts which need to keep the
  *                irq line disabled until the threaded handler has been run.
  * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend
- *
+ * IRQF_FORCE_RESUME - Force enable it on resume even if IRQF_NO_SUSPEND is set
  */
 #define IRQF_DISABLED		0x00000020
 #define IRQF_SAMPLE_RANDOM	0x00000040
@@ -66,6 +66,7 @@
 #define IRQF_IRQPOLL		0x00001000
 #define IRQF_ONESHOT		0x00002000
 #define IRQF_NO_SUSPEND		0x00004000
+#define IRQF_FORCE_RESUME	0x00008000
 
 #define IRQF_TIMER		(__IRQF_TIMER | IRQF_NO_SUSPEND)
 
diff -druN linux-2.6.35.13-libre3/include/linux/mm.h linux-2.6.35.14-libre3/include/linux/mm.h
--- linux-2.6.35.13-libre3/include/linux/mm.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/linux/mm.h	2011-08-01 16:56:51.000000000 -0400
@@ -850,6 +850,8 @@
 int get_user_pages_fast(unsigned long start, int nr_pages, int write,
 			struct page **pages);
 struct page *get_dump_page(unsigned long addr);
+extern int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+			    unsigned long address, unsigned int fault_flags);
 
 extern int try_to_release_page(struct page * page, gfp_t gfp_mask);
 extern void do_invalidatepage(struct page *page, unsigned long offset);
diff -druN linux-2.6.35.13-libre3/include/linux/pci_ids.h linux-2.6.35.14-libre3/include/linux/pci_ids.h
--- linux-2.6.35.13-libre3/include/linux/pci_ids.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/linux/pci_ids.h	2011-08-01 16:56:51.000000000 -0400
@@ -1524,6 +1524,7 @@
 #define PCI_DEVICE_ID_RICOH_RL5C476	0x0476
 #define PCI_DEVICE_ID_RICOH_RL5C478	0x0478
 #define PCI_DEVICE_ID_RICOH_R5C822	0x0822
+#define PCI_DEVICE_ID_RICOH_R5CE823	0xe823
 #define PCI_DEVICE_ID_RICOH_R5C832	0x0832
 #define PCI_DEVICE_ID_RICOH_R5C843	0x0843
 
diff -druN linux-2.6.35.13-libre3/include/linux/seqlock.h linux-2.6.35.14-libre3/include/linux/seqlock.h
--- linux-2.6.35.13-libre3/include/linux/seqlock.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/linux/seqlock.h	2011-08-01 16:56:51.000000000 -0400
@@ -88,12 +88,12 @@
 	unsigned ret;
 
 repeat:
-	ret = sl->sequence;
-	smp_rmb();
+	ret = ACCESS_ONCE(sl->sequence);
 	if (unlikely(ret & 1)) {
 		cpu_relax();
 		goto repeat;
 	}
+	smp_rmb();
 
 	return ret;
 }
diff -druN linux-2.6.35.13-libre3/include/linux/stop_machine.h linux-2.6.35.14-libre3/include/linux/stop_machine.h
--- linux-2.6.35.13-libre3/include/linux/stop_machine.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/include/linux/stop_machine.h	2011-08-01 16:56:51.000000000 -0400
@@ -27,6 +27,8 @@
 	struct cpu_stop_done	*done;
 };
 
+extern struct mutex stop_cpus_mutex;
+
 int stop_one_cpu(unsigned int cpu, cpu_stop_fn_t fn, void *arg);
 void stop_one_cpu_nowait(unsigned int cpu, cpu_stop_fn_t fn, void *arg,
 			 struct cpu_stop_work *work_buf);
diff -druN linux-2.6.35.13-libre3/ipc/sem.c linux-2.6.35.14-libre3/ipc/sem.c
--- linux-2.6.35.13-libre3/ipc/sem.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/ipc/sem.c	2011-08-01 16:56:51.000000000 -0400
@@ -1452,15 +1452,24 @@
 	}
 
 	sma = sem_lock(ns, semid);
+
+	/*
+	 * Wait until it's guaranteed that no wakeup_sem_queue_do() is ongoing.
+	 */
+	error = get_queue_result(&queue);
+
+	/*
+	 * Array removed? If yes, leave without sem_unlock().
+	 */
 	if (IS_ERR(sma)) {
 		error = -EIDRM;
 		goto out_free;
 	}
 
-	error = get_queue_result(&queue);
 
 	/*
-	 * If queue.status != -EINTR we are woken up by another process
+	 * If queue.status != -EINTR we are woken up by another process.
+	 * Leave without unlink_queue(), but with sem_unlock().
 	 */
 
 	if (error != -EINTR) {
diff -druN linux-2.6.35.13-libre3/kernel/futex.c linux-2.6.35.14-libre3/kernel/futex.c
--- linux-2.6.35.13-libre3/kernel/futex.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/futex.c	2011-08-01 16:56:51.000000000 -0400
@@ -306,8 +306,8 @@
 	int ret;
 
 	down_read(&mm->mmap_sem);
-	ret = get_user_pages(current, mm, (unsigned long)uaddr,
-			     1, 1, 0, NULL, NULL);
+	ret = fixup_user_fault(current, mm, (unsigned long)uaddr,
+			       FAULT_FLAG_WRITE);
 	up_read(&mm->mmap_sem);
 
 	return ret < 0 ? ret : 0;
diff -druN linux-2.6.35.13-libre3/kernel/irq/manage.c linux-2.6.35.14-libre3/kernel/irq/manage.c
--- linux-2.6.35.13-libre3/kernel/irq/manage.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/irq/manage.c	2011-08-01 16:56:51.000000000 -0400
@@ -281,8 +281,17 @@
 
 void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume)
 {
-	if (resume)
+	if (resume) {
+		if (!(desc->status & IRQ_SUSPENDED)) {
+			if (!desc->action)
+				return;
+			if (!(desc->action->flags & IRQF_FORCE_RESUME))
+				return;
+			/* Pretend that it got disabled ! */
+			desc->depth++;
+		}
 		desc->status &= ~IRQ_SUSPENDED;
+	}
 
 	switch (desc->depth) {
 	case 0:
diff -druN linux-2.6.35.13-libre3/kernel/irq/pm.c linux-2.6.35.14-libre3/kernel/irq/pm.c
--- linux-2.6.35.13-libre3/kernel/irq/pm.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/irq/pm.c	2011-08-01 16:56:51.000000000 -0400
@@ -53,9 +53,6 @@
 	for_each_irq_desc(irq, desc) {
 		unsigned long flags;
 
-		if (!(desc->status & IRQ_SUSPENDED))
-			continue;
-
 		raw_spin_lock_irqsave(&desc->lock, flags);
 		__enable_irq(desc, irq, true);
 		raw_spin_unlock_irqrestore(&desc->lock, flags);
diff -druN linux-2.6.35.13-libre3/kernel/lockdep.c linux-2.6.35.14-libre3/kernel/lockdep.c
--- linux-2.6.35.13-libre3/kernel/lockdep.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/lockdep.c	2011-08-01 16:56:51.000000000 -0400
@@ -3250,7 +3250,7 @@
 	int ret = 0;
 
 	if (unlikely(current->lockdep_recursion))
-		return ret;
+		return 1; /* avoid false negative lockdep_assert_held() */
 
 	raw_local_irq_save(flags);
 	check_flags(flags);
diff -druN linux-2.6.35.13-libre3/kernel/power/snapshot.c linux-2.6.35.14-libre3/kernel/power/snapshot.c
--- linux-2.6.35.13-libre3/kernel/power/snapshot.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/power/snapshot.c	2011-08-01 16:56:51.000000000 -0400
@@ -1199,7 +1199,11 @@
 		to_free_highmem = alloc_highmem - save;
 	} else {
 		to_free_highmem = 0;
-		to_free_normal -= save - alloc_highmem;
+		save -= alloc_highmem;
+		if (to_free_normal > save)
+			to_free_normal -= save;
+		else
+			to_free_normal = 0;
 	}
 
 	memory_bm_position_reset(&copy_bm);
diff -druN linux-2.6.35.13-libre3/kernel/power/user.c linux-2.6.35.14-libre3/kernel/power/user.c
--- linux-2.6.35.13-libre3/kernel/power/user.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/power/user.c	2011-08-01 16:56:51.000000000 -0400
@@ -113,8 +113,10 @@
 		if (error)
 			pm_notifier_call_chain(PM_POST_RESTORE);
 	}
-	if (error)
+	if (error) {
+		free_basic_memory_bitmaps();
 		atomic_inc(&snapshot_device_available);
+	}
 	data->frozen = 0;
 	data->ready = 0;
 	data->platform_support = 0;
diff -druN linux-2.6.35.13-libre3/kernel/stop_machine.c linux-2.6.35.14-libre3/kernel/stop_machine.c
--- linux-2.6.35.13-libre3/kernel/stop_machine.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/stop_machine.c	2011-08-01 16:56:51.000000000 -0400
@@ -132,8 +132,8 @@
 	cpu_stop_queue_work(&per_cpu(cpu_stopper, cpu), work_buf);
 }
 
+DEFINE_MUTEX(stop_cpus_mutex);
 /* static data for stop_cpus */
-static DEFINE_MUTEX(stop_cpus_mutex);
 static DEFINE_PER_CPU(struct cpu_stop_work, stop_cpus_work);
 
 int __stop_cpus(const struct cpumask *cpumask, cpu_stop_fn_t fn, void *arg)
diff -druN linux-2.6.35.13-libre3/kernel/taskstats.c linux-2.6.35.14-libre3/kernel/taskstats.c
--- linux-2.6.35.13-libre3/kernel/taskstats.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/taskstats.c	2011-08-01 16:56:51.000000000 -0400
@@ -292,16 +292,18 @@
 static int add_del_listener(pid_t pid, const struct cpumask *mask, int isadd)
 {
 	struct listener_list *listeners;
-	struct listener *s, *tmp;
+	struct listener *s, *tmp, *s2;
 	unsigned int cpu;
 
 	if (!cpumask_subset(mask, cpu_possible_mask))
 		return -EINVAL;
 
+	s = NULL;
 	if (isadd == REGISTER) {
 		for_each_cpu(cpu, mask) {
-			s = kmalloc_node(sizeof(struct listener), GFP_KERNEL,
-					 cpu_to_node(cpu));
+			if (!s)
+				s = kmalloc_node(sizeof(struct listener),
+						 GFP_KERNEL, cpu_to_node(cpu));
 			if (!s)
 				goto cleanup;
 			s->pid = pid;
@@ -310,9 +312,16 @@
 
 			listeners = &per_cpu(listener_array, cpu);
 			down_write(&listeners->sem);
+			list_for_each_entry_safe(s2, tmp, &listeners->list, list) {
+				if (s2->pid == pid)
+					goto next_cpu;
+			}
 			list_add(&s->list, &listeners->list);
+			s = NULL;
+next_cpu:
 			up_write(&listeners->sem);
 		}
+		kfree(s);
 		return 0;
 	}
 
diff -druN linux-2.6.35.13-libre3/kernel/time/clocksource.c linux-2.6.35.14-libre3/kernel/time/clocksource.c
--- linux-2.6.35.13-libre3/kernel/time/clocksource.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/time/clocksource.c	2011-08-01 16:56:51.000000000 -0400
@@ -184,7 +184,6 @@
 static struct timer_list watchdog_timer;
 static DECLARE_WORK(watchdog_work, clocksource_watchdog_work);
 static DEFINE_SPINLOCK(watchdog_lock);
-static cycle_t watchdog_last;
 static int watchdog_running;
 
 static int clocksource_watchdog_kthread(void *data);
@@ -253,11 +252,6 @@
 	if (!watchdog_running)
 		goto out;
 
-	wdnow = watchdog->read(watchdog);
-	wd_nsec = clocksource_cyc2ns((wdnow - watchdog_last) & watchdog->mask,
-				     watchdog->mult, watchdog->shift);
-	watchdog_last = wdnow;
-
 	list_for_each_entry(cs, &watchdog_list, wd_list) {
 
 		/* Clocksource already marked unstable? */
@@ -267,19 +261,28 @@
 			continue;
 		}
 
+		local_irq_disable();
 		csnow = cs->read(cs);
+		wdnow = watchdog->read(watchdog);
+		local_irq_enable();
 
 		/* Clocksource initialized ? */
 		if (!(cs->flags & CLOCK_SOURCE_WATCHDOG)) {
 			cs->flags |= CLOCK_SOURCE_WATCHDOG;
-			cs->wd_last = csnow;
+			cs->wd_last = wdnow;
+			cs->cs_last = csnow;
 			continue;
 		}
 
-		/* Check the deviation from the watchdog clocksource. */
-		cs_nsec = clocksource_cyc2ns((csnow - cs->wd_last) &
+		wd_nsec = clocksource_cyc2ns((wdnow - cs->wd_last) & watchdog->mask,
+					     watchdog->mult, watchdog->shift);
+
+		cs_nsec = clocksource_cyc2ns((csnow - cs->cs_last) &
 					     cs->mask, cs->mult, cs->shift);
-		cs->wd_last = csnow;
+		cs->cs_last = csnow;
+		cs->wd_last = wdnow;
+
+		/* Check the deviation from the watchdog clocksource. */
 		if (abs(cs_nsec - wd_nsec) > WATCHDOG_THRESHOLD) {
 			clocksource_unstable(cs, cs_nsec - wd_nsec);
 			continue;
@@ -317,7 +320,6 @@
 		return;
 	init_timer(&watchdog_timer);
 	watchdog_timer.function = clocksource_watchdog;
-	watchdog_last = watchdog->read(watchdog);
 	watchdog_timer.expires = jiffies + WATCHDOG_INTERVAL;
 	add_timer_on(&watchdog_timer, cpumask_first(cpu_online_mask));
 	watchdog_running = 1;
@@ -665,8 +667,8 @@
 
 	mutex_lock(&clocksource_mutex);
 	clocksource_enqueue(cs);
-	clocksource_select();
 	clocksource_enqueue_watchdog(cs);
+	clocksource_select();
 	mutex_unlock(&clocksource_mutex);
 	return 0;
 }
diff -druN linux-2.6.35.13-libre3/kernel/time/tick-broadcast.c linux-2.6.35.14-libre3/kernel/time/tick-broadcast.c
--- linux-2.6.35.13-libre3/kernel/time/tick-broadcast.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/time/tick-broadcast.c	2011-08-01 16:56:51.000000000 -0400
@@ -523,10 +523,11 @@
  */
 void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
+	int cpu = smp_processor_id();
+
 	/* Set it up only once ! */
 	if (bc->event_handler != tick_handle_oneshot_broadcast) {
 		int was_periodic = bc->mode == CLOCK_EVT_MODE_PERIODIC;
-		int cpu = smp_processor_id();
 
 		bc->event_handler = tick_handle_oneshot_broadcast;
 		clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
@@ -552,6 +553,15 @@
 			tick_broadcast_set_event(tick_next_period, 1);
 		} else
 			bc->next_event.tv64 = KTIME_MAX;
+	} else {
+		/*
+		 * The first cpu which switches to oneshot mode sets
+		 * the bit for all other cpus which are in the general
+		 * (periodic) broadcast mask. So the bit is set and
+		 * would prevent the first broadcast enter after this
+		 * to program the bc device.
+		 */
+		tick_broadcast_clear_oneshot(cpu);
 	}
 }
 
diff -druN linux-2.6.35.13-libre3/kernel/time/timekeeping.c linux-2.6.35.14-libre3/kernel/time/timekeeping.c
--- linux-2.6.35.13-libre3/kernel/time/timekeeping.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/time/timekeeping.c	2011-08-01 16:56:51.000000000 -0400
@@ -32,6 +32,8 @@
 	cycle_t cycle_interval;
 	/* Number of clock shifted nano seconds in one NTP interval. */
 	u64	xtime_interval;
+	/* shifted nano seconds left over when rounding cycle_interval */
+	s64	xtime_remainder;
 	/* Raw nano seconds accumulated per NTP interval. */
 	u32	raw_interval;
 
@@ -62,7 +64,7 @@
 static void timekeeper_setup_internals(struct clocksource *clock)
 {
 	cycle_t interval;
-	u64 tmp;
+	u64 tmp, ntpinterval;
 
 	timekeeper.clock = clock;
 	clock->cycle_last = clock->read(clock);
@@ -70,6 +72,7 @@
 	/* Do the ns -> cycle conversion first, using original mult */
 	tmp = NTP_INTERVAL_LENGTH;
 	tmp <<= clock->shift;
+	ntpinterval = tmp;
 	tmp += clock->mult/2;
 	do_div(tmp, clock->mult);
 	if (tmp == 0)
@@ -80,6 +83,7 @@
 
 	/* Go back from cycles -> shifted ns */
 	timekeeper.xtime_interval = (u64) interval * clock->mult;
+	timekeeper.xtime_remainder = ntpinterval - timekeeper.xtime_interval;
 	timekeeper.raw_interval =
 		((u64) interval * clock->mult) >> clock->shift;
 
@@ -765,7 +769,8 @@
 
 	/* Accumulate error between NTP and clock interval */
 	timekeeper.ntp_error += tick_length << shift;
-	timekeeper.ntp_error -= timekeeper.xtime_interval <<
+	timekeeper.ntp_error -= 
+		(timekeeper.xtime_interval + timekeeper.xtime_remainder) <<
 				(timekeeper.ntp_error_shift + shift);
 
 	return offset;
diff -druN linux-2.6.35.13-libre3/kernel/trace/ftrace.c linux-2.6.35.14-libre3/kernel/trace/ftrace.c
--- linux-2.6.35.13-libre3/kernel/trace/ftrace.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/trace/ftrace.c	2011-08-01 16:56:51.000000000 -0400
@@ -2377,14 +2377,16 @@
 		ftrace_match_records(parser->buffer, parser->idx, enable);
 	}
 
-	mutex_lock(&ftrace_lock);
-	if (ftrace_start_up && ftrace_enabled)
-		ftrace_run_update_code(FTRACE_ENABLE_CALLS);
-	mutex_unlock(&ftrace_lock);
-
 	trace_parser_put(parser);
 	kfree(iter);
 
+	if (file->f_mode & FMODE_WRITE) {
+		mutex_lock(&ftrace_lock);
+		if (ftrace_start_up && ftrace_enabled)
+			ftrace_run_update_code(FTRACE_ENABLE_CALLS);
+		mutex_unlock(&ftrace_lock);
+	}
+
 	mutex_unlock(&ftrace_regex_lock);
 	return 0;
 }
diff -druN linux-2.6.35.13-libre3/kernel/trace/trace_events.c linux-2.6.35.14-libre3/kernel/trace/trace_events.c
--- linux-2.6.35.13-libre3/kernel/trace/trace_events.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/trace/trace_events.c	2011-08-01 16:56:51.000000000 -0400
@@ -182,6 +182,35 @@
 	mutex_unlock(&event_mutex);
 }
 
+static void __put_system(struct event_subsystem *system)
+{
+	struct event_filter *filter = system->filter;
+
+	WARN_ON_ONCE(system->ref_count == 0);
+	if (--system->ref_count)
+		return;
+
+	if (filter) {
+		kfree(filter->filter_string);
+		kfree(filter);
+	}
+	kfree(system->name);
+	kfree(system);
+}
+
+static void __get_system(struct event_subsystem *system)
+{
+	WARN_ON_ONCE(system->ref_count == 0);
+	system->ref_count++;
+}
+
+static void put_system(struct event_subsystem *system)
+{
+	mutex_lock(&event_mutex);
+	__put_system(system);
+	mutex_unlock(&event_mutex);
+}
+
 /*
  * __ftrace_set_clr_event(NULL, NULL, NULL, set) will set/unset all events.
  */
@@ -466,7 +495,7 @@
 		   loff_t *ppos)
 {
 	const char set_to_char[4] = { '?', '0', '1', 'X' };
-	const char *system = filp->private_data;
+	struct event_subsystem *system = filp->private_data;
 	struct ftrace_event_call *call;
 	char buf[2];
 	int set = 0;
@@ -478,7 +507,7 @@
 		    (!call->class->probe && !call->class->reg))
 			continue;
 
-		if (system && strcmp(call->class->system, system) != 0)
+		if (system && strcmp(call->class->system, system->name) != 0)
 			continue;
 
 		/*
@@ -508,7 +537,8 @@
 system_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
 		    loff_t *ppos)
 {
-	const char *system = filp->private_data;
+	struct event_subsystem *system = filp->private_data;
+	const char *name = NULL;
 	unsigned long val;
 	char buf[64];
 	ssize_t ret;
@@ -532,7 +562,14 @@
 	if (val != 0 && val != 1)
 		return -EINVAL;
 
-	ret = __ftrace_set_clr_event(NULL, system, NULL, val);
+	/*
+	 * Opening of "enable" adds a ref count to system,
+	 * so the name is safe to use.
+	 */
+	if (system)
+		name = system->name;
+
+	ret = __ftrace_set_clr_event(NULL, name, NULL, val);
 	if (ret)
 		goto out;
 
@@ -704,6 +741,52 @@
 	return cnt;
 }
 
+static LIST_HEAD(event_subsystems);
+
+static int subsystem_open(struct inode *inode, struct file *filp)
+{
+	struct event_subsystem *system = NULL;
+	int ret;
+
+	if (!inode->i_private)
+		goto skip_search;
+
+	/* Make sure the system still exists */
+	mutex_lock(&event_mutex);
+	list_for_each_entry(system, &event_subsystems, list) {
+		if (system == inode->i_private) {
+			/* Don't open systems with no events */
+			if (!system->nr_events) {
+				system = NULL;
+				break;
+			}
+			__get_system(system);
+			break;
+		}
+	}
+	mutex_unlock(&event_mutex);
+
+	if (system != inode->i_private)
+		return -ENODEV;
+
+ skip_search:
+	ret = tracing_open_generic(inode, filp);
+	if (ret < 0 && system)
+		put_system(system);
+
+	return ret;
+}
+
+static int subsystem_release(struct inode *inode, struct file *file)
+{
+	struct event_subsystem *system = inode->i_private;
+
+	if (system)
+		put_system(system);
+
+	return 0;
+}
+
 static ssize_t
 subsystem_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
 		      loff_t *ppos)
@@ -836,15 +919,17 @@
 };
 
 static const struct file_operations ftrace_subsystem_filter_fops = {
-	.open = tracing_open_generic,
+	.open = subsystem_open,
 	.read = subsystem_filter_read,
 	.write = subsystem_filter_write,
+	.release = subsystem_release,
 };
 
 static const struct file_operations ftrace_system_enable_fops = {
-	.open = tracing_open_generic,
+	.open = subsystem_open,
 	.read = system_enable_read,
 	.write = system_enable_write,
+	.release = subsystem_release,
 };
 
 static const struct file_operations ftrace_show_header_fops = {
@@ -872,8 +957,6 @@
 	return d_events;
 }
 
-static LIST_HEAD(event_subsystems);
-
 static struct dentry *
 event_subsystem_dir(const char *name, struct dentry *d_events)
 {
@@ -883,6 +966,7 @@
 	/* First see if we did not already create this dir */
 	list_for_each_entry(system, &event_subsystems, list) {
 		if (strcmp(system->name, name) == 0) {
+			__get_system(system);
 			system->nr_events++;
 			return system->entry;
 		}
@@ -905,6 +989,7 @@
 	}
 
 	system->nr_events = 1;
+	system->ref_count = 1;
 	system->name = kstrdup(name, GFP_KERNEL);
 	if (!system->name) {
 		debugfs_remove(system->entry);
@@ -932,8 +1017,7 @@
 			   "'%s/filter' entry\n", name);
 	}
 
-	trace_create_file("enable", 0644, system->entry,
-			  (void *)system->name,
+	trace_create_file("enable", 0644, system->entry, system,
 			  &ftrace_system_enable_fops);
 
 	return system->entry;
@@ -1050,16 +1134,9 @@
 	list_for_each_entry(system, &event_subsystems, list) {
 		if (strcmp(system->name, name) == 0) {
 			if (!--system->nr_events) {
-				struct event_filter *filter = system->filter;
-
 				debugfs_remove_recursive(system->entry);
 				list_del(&system->list);
-				if (filter) {
-					kfree(filter->filter_string);
-					kfree(filter);
-				}
-				kfree(system->name);
-				kfree(system);
+				__put_system(system);
 			}
 			break;
 		}
diff -druN linux-2.6.35.13-libre3/kernel/trace/trace_events_filter.c linux-2.6.35.14-libre3/kernel/trace/trace_events_filter.c
--- linux-2.6.35.13-libre3/kernel/trace/trace_events_filter.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/trace/trace_events_filter.c	2011-08-01 16:56:51.000000000 -0400
@@ -1340,6 +1340,12 @@
 	if (err)
 		goto out_unlock;
 
+	/* Make sure the system still has events */
+	if (!system->nr_events) {
+		err = -ENODEV;
+		goto out_unlock;
+	}
+
 	if (!strcmp(strstrip(filter_string), "0")) {
 		filter_free_subsystem_preds(system);
 		remove_filter_string(system->filter);
diff -druN linux-2.6.35.13-libre3/kernel/trace/trace.h linux-2.6.35.14-libre3/kernel/trace/trace.h
--- linux-2.6.35.13-libre3/kernel/trace/trace.h	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/kernel/trace/trace.h	2011-08-01 16:56:51.000000000 -0400
@@ -731,6 +731,7 @@
 	struct dentry		*entry;
 	struct event_filter	*filter;
 	int			nr_events;
+	int			ref_count;
 };
 
 struct filter_pred;
diff -druN linux-2.6.35.13-libre3/lib/debugobjects.c linux-2.6.35.14-libre3/lib/debugobjects.c
--- linux-2.6.35.13-libre3/lib/debugobjects.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/lib/debugobjects.c	2011-08-01 16:56:51.000000000 -0400
@@ -198,7 +198,7 @@
 	 * initialized:
 	 */
 	if (obj_pool_free > ODEBUG_POOL_SIZE && obj_cache)
-		sched = !work_pending(&debug_obj_work);
+		sched = keventd_up() && !work_pending(&debug_obj_work);
 	hlist_add_head(&obj->node, &obj_pool);
 	obj_pool_free++;
 	obj_pool_used--;
diff -druN linux-2.6.35.13-libre3/lib/locking-selftest.c linux-2.6.35.14-libre3/lib/locking-selftest.c
--- linux-2.6.35.13-libre3/lib/locking-selftest.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/lib/locking-selftest.c	2011-08-01 16:56:51.000000000 -0400
@@ -144,7 +144,7 @@
 
 #define HARDIRQ_ENTER()				\
 	local_irq_disable();			\
-	irq_enter();				\
+	__irq_enter();				\
 	WARN_ON(!in_irq());
 
 #define HARDIRQ_EXIT()				\
diff -druN linux-2.6.35.13-libre3/MAINTAINERS linux-2.6.35.14-libre3/MAINTAINERS
--- linux-2.6.35.13-libre3/MAINTAINERS	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/MAINTAINERS	2011-08-01 16:56:51.000000000 -0400
@@ -3444,6 +3444,12 @@
 F:	include/linux/lguest*.h
 F:	arch/x86/include/asm/lguest*.h
 
+LINUX 2.6.35 LONGTERM:
+M:	Andi Kleen <andi@firstfloor.org>
+L:	stable@kernel.org
+S:	Maintained
+F:	*
+
 LINUX FOR IBM pSERIES (RS/6000)
 M:	Paul Mackerras <paulus@au.ibm.com>
 W:	http://www.ibm.com/linux/ltc/projects/ppc
diff -druN linux-2.6.35.13-libre3/Makefile linux-2.6.35.14-libre3/Makefile
--- linux-2.6.35.13-libre3/Makefile	2011-04-28 16:13:15.000000000 -0400
+++ linux-2.6.35.14-libre3/Makefile	2011-08-01 23:32:08.000000000 -0400
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 35
-EXTRAVERSION = .13-libre3
+EXTRAVERSION = .14-libre3
 NAME = Yokohama
 
 # *DOCUMENTATION*
@@ -546,6 +546,9 @@
 KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
 endif
 
+# This warning generated too much noise in a regular build.
+KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+
 ifdef CONFIG_FRAME_POINTER
 KBUILD_CFLAGS	+= -fno-omit-frame-pointer -fno-optimize-sibling-calls
 else
@@ -574,7 +577,7 @@
 KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
 
 # disable pointer signed / unsigned warnings in gcc 4.0
-KBUILD_CFLAGS += $(call cc-option,-Wno-pointer-sign,)
+KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
 
 # disable invalid "can't wrap" optimizations for signed / pointers
 KBUILD_CFLAGS	+= $(call cc-option,-fno-strict-overflow)
diff -druN linux-2.6.35.13-libre3/mm/backing-dev.c linux-2.6.35.14-libre3/mm/backing-dev.c
--- linux-2.6.35.13-libre3/mm/backing-dev.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/mm/backing-dev.c	2011-08-01 16:56:51.000000000 -0400
@@ -646,6 +646,7 @@
 void bdi_unregister(struct backing_dev_info *bdi)
 {
 	if (bdi->dev) {
+		bdi_set_min_ratio(bdi, 0);
 		bdi_prune_sb(bdi);
 
 		if (!bdi_cap_flush_forker(bdi))
diff -druN linux-2.6.35.13-libre3/mm/hugetlb.c linux-2.6.35.14-libre3/mm/hugetlb.c
--- linux-2.6.35.13-libre3/mm/hugetlb.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/mm/hugetlb.c	2011-08-01 16:56:51.000000000 -0400
@@ -1030,10 +1030,10 @@
 	 */
 	chg = vma_needs_reservation(h, vma, addr);
 	if (chg < 0)
-		return ERR_PTR(chg);
+		return ERR_PTR(-VM_FAULT_OOM);
 	if (chg)
 		if (hugetlb_get_quota(inode->i_mapping, chg))
-			return ERR_PTR(-ENOSPC);
+			return ERR_PTR(-VM_FAULT_SIGBUS);
 
 	spin_lock(&hugetlb_lock);
 	page = dequeue_huge_page_vma(h, vma, addr, avoid_reserve);
@@ -1109,6 +1109,14 @@
 		WARN_ON(page_count(page) != 1);
 		prep_compound_huge_page(page, h->order);
 		prep_new_huge_page(h, page, page_to_nid(page));
+		/*
+		 * If we had gigantic hugepages allocated at boot time, we need
+		 * to restore the 'stolen' pages to totalram_pages in order to
+		 * fix confusing memory reports from free(1) and another
+		 * side-effects, like CommitLimit going negative.
+		 */
+		if (h->order > (MAX_ORDER - 1))
+			totalram_pages += 1 << h->order;
 	}
 }
 
diff -druN linux-2.6.35.13-libre3/mm/kmemleak.c linux-2.6.35.14-libre3/mm/kmemleak.c
--- linux-2.6.35.13-libre3/mm/kmemleak.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/mm/kmemleak.c	2011-08-01 16:56:51.000000000 -0400
@@ -1368,9 +1368,12 @@
 	++(*pos);
 
 	list_for_each_continue_rcu(n, &object_list) {
-		next_obj = list_entry(n, struct kmemleak_object, object_list);
-		if (get_object(next_obj))
+		struct kmemleak_object *obj =
+			list_entry(n, struct kmemleak_object, object_list);
+		if (get_object(obj)) {
+			next_obj = obj;
 			break;
+		}
 	}
 
 	put_object(prev_obj);
diff -druN linux-2.6.35.13-libre3/mm/ksm.c linux-2.6.35.14-libre3/mm/ksm.c
--- linux-2.6.35.13-libre3/mm/ksm.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/mm/ksm.c	2011-08-01 16:56:51.000000000 -0400
@@ -1272,6 +1272,12 @@
 		slot = list_entry(slot->mm_list.next, struct mm_slot, mm_list);
 		ksm_scan.mm_slot = slot;
 		spin_unlock(&ksm_mmlist_lock);
+		/*
+		 * Although we tested list_empty() above, a racing __ksm_exit
+		 * of the last mm on the list may have removed it since then.
+		 */
+		if (slot == &ksm_mm_head)
+			return NULL;
 next_mm:
 		ksm_scan.address = 0;
 		ksm_scan.rmap_list = &slot->rmap_list;
diff -druN linux-2.6.35.13-libre3/mm/memory.c linux-2.6.35.14-libre3/mm/memory.c
--- linux-2.6.35.13-libre3/mm/memory.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/mm/memory.c	2011-08-01 16:56:51.000000000 -0400
@@ -1497,7 +1497,63 @@
 	return i;
 }
 
-/**
+/*
+ * fixup_user_fault() - manually resolve a user page fault
+ * @tsk:	the task_struct to use for page fault accounting, or
+ *		NULL if faults are not to be recorded.
+ * @mm:		mm_struct of target mm
+ * @address:	user address
+ * @fault_flags:flags to pass down to handle_mm_fault()
+ *
+ * This is meant to be called in the specific scenario where for locking reasons
+ * we try to access user memory in atomic context (within a pagefault_disable()
+ * section), this returns -EFAULT, and we want to resolve the user fault before
+ * trying again.
+ *
+ * Typically this is meant to be used by the futex code.
+ *
+ * The main difference with get_user_pages() is that this function will
+ * unconditionally call handle_mm_fault() which will in turn perform all the
+ * necessary SW fixup of the dirty and young bits in the PTE, while
+ * handle_mm_fault() only guarantees to update these in the struct page.
+ *
+ * This is important for some architectures where those bits also gate the
+ * access permission to the page because they are maintained in software.  On
+ * such architectures, gup() will not be enough to make a subsequent access
+ * succeed.
+ *
+ * This should be called with the mm_sem held for read.
+ */
+int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+		     unsigned long address, unsigned int fault_flags)
+{
+	struct vm_area_struct *vma;
+	int ret;
+
+	vma = find_extend_vma(mm, address);
+	if (!vma || address < vma->vm_start)
+		return -EFAULT;
+
+	ret = handle_mm_fault(mm, vma, address, fault_flags);
+	if (ret & VM_FAULT_ERROR) {
+		if (ret & VM_FAULT_OOM)
+			return -ENOMEM;
+		if (ret & VM_FAULT_HWPOISON)
+			return -EFAULT;
+		if (ret & VM_FAULT_SIGBUS)
+			return -EFAULT;
+		BUG();
+	}
+	if (tsk) {
+		if (ret & VM_FAULT_MAJOR)
+			tsk->maj_flt++;
+		else
+			tsk->min_flt++;
+	}
+	return 0;
+}
+
+/*
  * get_user_pages() - pin user pages in memory
  * @tsk:	task_struct of target task
  * @mm:		mm_struct of target mm
@@ -2573,6 +2629,7 @@
 		details.last_index = ULONG_MAX;
 	details.i_mmap_lock = &mapping->i_mmap_lock;
 
+	mutex_lock(&mapping->unmap_mutex);
 	spin_lock(&mapping->i_mmap_lock);
 
 	/* Protect against endless unmapping loops */
@@ -2589,6 +2646,7 @@
 	if (unlikely(!list_empty(&mapping->i_mmap_nonlinear)))
 		unmap_mapping_range_list(&mapping->i_mmap_nonlinear, &details);
 	spin_unlock(&mapping->i_mmap_lock);
+	mutex_unlock(&mapping->unmap_mutex);
 }
 EXPORT_SYMBOL(unmap_mapping_range);
 
diff -druN linux-2.6.35.13-libre3/mm/migrate.c linux-2.6.35.14-libre3/mm/migrate.c
--- linux-2.6.35.13-libre3/mm/migrate.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/mm/migrate.c	2011-08-01 16:56:51.000000000 -0400
@@ -266,7 +266,7 @@
 	 */
 	__dec_zone_page_state(page, NR_FILE_PAGES);
 	__inc_zone_page_state(newpage, NR_FILE_PAGES);
-	if (PageSwapBacked(page)) {
+	if (!PageSwapCache(page) && PageSwapBacked(page)) {
 		__dec_zone_page_state(page, NR_SHMEM);
 		__inc_zone_page_state(newpage, NR_SHMEM);
 	}
diff -druN linux-2.6.35.13-libre3/mm/nommu.c linux-2.6.35.14-libre3/mm/nommu.c
--- linux-2.6.35.13-libre3/mm/nommu.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/mm/nommu.c	2011-08-01 16:56:51.000000000 -0400
@@ -1747,10 +1747,13 @@
 	return NULL;
 }
 
-int remap_pfn_range(struct vm_area_struct *vma, unsigned long from,
-		unsigned long to, unsigned long size, pgprot_t prot)
+int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
+		unsigned long pfn, unsigned long size, pgprot_t prot)
 {
-	vma->vm_start = vma->vm_pgoff << PAGE_SHIFT;
+	if (addr != (pfn << PAGE_SHIFT))
+		return -EINVAL;
+
+	vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP;
 	return 0;
 }
 EXPORT_SYMBOL(remap_pfn_range);
diff -druN linux-2.6.35.13-libre3/mm/page_alloc.c linux-2.6.35.14-libre3/mm/page_alloc.c
--- linux-2.6.35.13-libre3/mm/page_alloc.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/mm/page_alloc.c	2011-08-01 16:56:51.000000000 -0400
@@ -2027,6 +2027,7 @@
 	 */
 	alloc_flags = gfp_to_alloc_flags(gfp_mask);
 
+rebalance:
 	/* This is the last chance, in general, before the goto nopage. */
 	page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
 			high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
@@ -2034,7 +2035,6 @@
 	if (page)
 		goto got_pg;
 
-rebalance:
 	/* Allocate without watermarks if the context allows */
 	if (alloc_flags & ALLOC_NO_WATERMARKS) {
 		page = __alloc_pages_high_priority(gfp_mask, order,
diff -druN linux-2.6.35.13-libre3/net/atm/atm_sysfs.c linux-2.6.35.14-libre3/net/atm/atm_sysfs.c
--- linux-2.6.35.13-libre3/net/atm/atm_sysfs.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/atm/atm_sysfs.c	2011-08-01 16:56:51.000000000 -0400
@@ -59,6 +59,14 @@
 	return pos - buf;
 }
 
+static ssize_t show_atmindex(struct device *cdev,
+			     struct device_attribute *attr, char *buf)
+{
+	struct atm_dev *adev = to_atm_dev(cdev);
+
+	return sprintf(buf, "%d\n", adev->number);
+}
+
 static ssize_t show_carrier(struct device *cdev,
 			    struct device_attribute *attr, char *buf)
 {
@@ -99,6 +107,7 @@
 
 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 static DEVICE_ATTR(atmaddress, S_IRUGO, show_atmaddress, NULL);
+static DEVICE_ATTR(atmindex, S_IRUGO, show_atmindex, NULL);
 static DEVICE_ATTR(carrier, S_IRUGO, show_carrier, NULL);
 static DEVICE_ATTR(type, S_IRUGO, show_type, NULL);
 static DEVICE_ATTR(link_rate, S_IRUGO, show_link_rate, NULL);
@@ -106,6 +115,7 @@
 static struct device_attribute *atm_attrs[] = {
 	&dev_attr_atmaddress,
 	&dev_attr_address,
+	&dev_attr_atmindex,
 	&dev_attr_carrier,
 	&dev_attr_type,
 	&dev_attr_link_rate,
diff -druN linux-2.6.35.13-libre3/net/bridge/br_multicast.c linux-2.6.35.14-libre3/net/bridge/br_multicast.c
--- linux-2.6.35.13-libre3/net/bridge/br_multicast.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/bridge/br_multicast.c	2011-08-01 16:56:51.000000000 -0400
@@ -1403,7 +1403,7 @@
 	switch (ih->type) {
 	case IGMP_HOST_MEMBERSHIP_REPORT:
 	case IGMPV2_HOST_MEMBERSHIP_REPORT:
-		BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
+		BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
 		err = br_ip4_multicast_add_group(br, port, ih->group);
 		break;
 	case IGMPV3_HOST_MEMBERSHIP_REPORT:
@@ -1517,7 +1517,7 @@
 	case ICMPV6_MGM_REPORT:
 	    {
 		struct mld_msg *mld = (struct mld_msg *)icmp6h;
-		BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
+		BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
 		err = br_ip6_multicast_add_group(br, port, &mld->mld_mca);
 		break;
 	    }
diff -druN linux-2.6.35.13-libre3/net/can/bcm.c linux-2.6.35.14-libre3/net/can/bcm.c
--- linux-2.6.35.13-libre3/net/can/bcm.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/can/bcm.c	2011-08-01 16:56:51.000000000 -0400
@@ -1424,9 +1424,14 @@
 static int bcm_release(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
-	struct bcm_sock *bo = bcm_sk(sk);
+	struct bcm_sock *bo;
 	struct bcm_op *op, *next;
 
+	if (sk == NULL)
+		return 0;
+
+	bo = bcm_sk(sk);
+
 	/* remove bcm_ops, timer, rx_unregister(), etc. */
 
 	unregister_netdevice_notifier(&bo->notifier);
diff -druN linux-2.6.35.13-libre3/net/can/raw.c linux-2.6.35.14-libre3/net/can/raw.c
--- linux-2.6.35.13-libre3/net/can/raw.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/can/raw.c	2011-08-01 16:56:51.000000000 -0400
@@ -281,7 +281,12 @@
 static int raw_release(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
-	struct raw_sock *ro = raw_sk(sk);
+	struct raw_sock *ro;
+
+	if (!sk)
+		return 0;
+
+	ro = raw_sk(sk);
 
 	unregister_netdevice_notifier(&ro->notifier);
 
diff -druN linux-2.6.35.13-libre3/net/core/filter.c linux-2.6.35.14-libre3/net/core/filter.c
--- linux-2.6.35.13-libre3/net/core/filter.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/core/filter.c	2011-08-01 16:56:51.000000000 -0400
@@ -292,7 +292,9 @@
 			mem[f_k] = X;
 			continue;
 		default:
-			WARN_ON(1);
+			WARN_RATELIMIT(1, "Unknown code:%u jt:%u tf:%u k:%u\n",
+				       fentry->code, fentry->jt,
+				       fentry->jf, fentry->k);
 			return 0;
 		}
 
diff -druN linux-2.6.35.13-libre3/net/dccp/options.c linux-2.6.35.14-libre3/net/dccp/options.c
--- linux-2.6.35.13-libre3/net/dccp/options.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/dccp/options.c	2011-08-01 16:56:51.000000000 -0400
@@ -131,6 +131,8 @@
 		case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:
 			if (pkt_type == DCCP_PKT_DATA)      /* RFC 4340, 6 */
 				break;
+			if (len == 0)
+				goto out_invalid_option;
 			rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,
 						    *value, value + 1, len - 1);
 			if (rc)
diff -druN linux-2.6.35.13-libre3/net/ipv4/af_inet.c linux-2.6.35.14-libre3/net/ipv4/af_inet.c
--- linux-2.6.35.13-libre3/net/ipv4/af_inet.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/ipv4/af_inet.c	2011-08-01 16:56:51.000000000 -0400
@@ -464,6 +464,9 @@
 	if (addr_len < sizeof(struct sockaddr_in))
 		goto out;
 
+	if (addr->sin_family != AF_INET)
+		goto out;
+
 	chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
 
 	/* Not specified by any standard per-se, however it breaks too
diff -druN linux-2.6.35.13-libre3/net/ipv4/inet_diag.c linux-2.6.35.14-libre3/net/ipv4/inet_diag.c
--- linux-2.6.35.13-libre3/net/ipv4/inet_diag.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/ipv4/inet_diag.c	2011-08-01 16:56:51.000000000 -0400
@@ -437,7 +437,7 @@
 			return 0;
 		if (cc == len)
 			return 1;
-		if (op->yes < 4)
+		if (op->yes < 4 || op->yes & 3)
 			return 0;
 		len -= op->yes;
 		bc  += op->yes;
@@ -447,11 +447,11 @@
 
 static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
 {
-	const unsigned char *bc = bytecode;
+	const void *bc = bytecode;
 	int  len = bytecode_len;
 
 	while (len > 0) {
-		struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc;
+		const struct inet_diag_bc_op *op = bc;
 
 //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
 		switch (op->code) {
@@ -462,22 +462,20 @@
 		case INET_DIAG_BC_S_LE:
 		case INET_DIAG_BC_D_GE:
 		case INET_DIAG_BC_D_LE:
-			if (op->yes < 4 || op->yes > len + 4)
-				return -EINVAL;
 		case INET_DIAG_BC_JMP:
-			if (op->no < 4 || op->no > len + 4)
+			if (op->no < 4 || op->no > len + 4 || op->no & 3)
 				return -EINVAL;
 			if (op->no < len &&
 			    !valid_cc(bytecode, bytecode_len, len - op->no))
 				return -EINVAL;
 			break;
 		case INET_DIAG_BC_NOP:
-			if (op->yes < 4 || op->yes > len + 4)
-				return -EINVAL;
 			break;
 		default:
 			return -EINVAL;
 		}
+		if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
+			return -EINVAL;
 		bc  += op->yes;
 		len -= op->yes;
 	}
diff -druN linux-2.6.35.13-libre3/net/ipv4/udp.c linux-2.6.35.14-libre3/net/ipv4/udp.c
--- linux-2.6.35.13-libre3/net/ipv4/udp.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/ipv4/udp.c	2011-08-01 16:56:51.000000000 -0400
@@ -1206,6 +1206,9 @@
 
 	if (noblock)
 		return -EAGAIN;
+
+	/* starting over for a new packet */
+	msg->msg_flags &= ~MSG_TRUNC;
 	goto try_again;
 }
 
diff -druN linux-2.6.35.13-libre3/net/ipv6/addrconf.c linux-2.6.35.14-libre3/net/ipv6/addrconf.c
--- linux-2.6.35.13-libre3/net/ipv6/addrconf.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/ipv6/addrconf.c	2011-08-01 16:56:51.000000000 -0400
@@ -415,9 +415,6 @@
 	    dev->type == ARPHRD_TUNNEL6 ||
 	    dev->type == ARPHRD_SIT ||
 	    dev->type == ARPHRD_NONE) {
-		printk(KERN_INFO
-		       "%s: Disabled Privacy Extensions\n",
-		       dev->name);
 		ndev->cnf.use_tempaddr = -1;
 	} else {
 		in6_dev_hold(ndev);
@@ -2963,7 +2960,8 @@
 	   start sending router solicitations.
 	 */
 
-	if (ifp->idev->cnf.forwarding == 0 &&
+	if ((ifp->idev->cnf.forwarding == 0 ||
+	     ifp->idev->cnf.forwarding == 2) &&
 	    ifp->idev->cnf.rtr_solicits > 0 &&
 	    (dev->flags&IFF_LOOPBACK) == 0 &&
 	    (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) {
diff -druN linux-2.6.35.13-libre3/net/ipv6/ndisc.c linux-2.6.35.14-libre3/net/ipv6/ndisc.c
--- linux-2.6.35.13-libre3/net/ipv6/ndisc.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/ipv6/ndisc.c	2011-08-01 16:56:51.000000000 -0400
@@ -1105,6 +1105,18 @@
 	rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
 }
 
+static inline int accept_ra(struct inet6_dev *in6_dev)
+{
+	/*
+	 * If forwarding is enabled, RA are not accepted unless the special
+	 * hybrid mode (accept_ra=2) is enabled.
+	 */
+	if (in6_dev->cnf.forwarding && in6_dev->cnf.accept_ra < 2)
+		return 0;
+
+	return in6_dev->cnf.accept_ra;
+}
+
 static void ndisc_router_discovery(struct sk_buff *skb)
 {
 	struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
@@ -1158,8 +1170,7 @@
 		return;
 	}
 
-	/* skip route and link configuration on routers */
-	if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
+	if (!accept_ra(in6_dev))
 		goto skip_linkparms;
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
@@ -1309,8 +1320,7 @@
 			     NEIGH_UPDATE_F_ISROUTER);
 	}
 
-	/* skip route and link configuration on routers */
-	if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
+	if (!accept_ra(in6_dev))
 		goto out;
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
diff -druN linux-2.6.35.13-libre3/net/ipv6/netfilter/ip6t_REJECT.c linux-2.6.35.14-libre3/net/ipv6/netfilter/ip6t_REJECT.c
--- linux-2.6.35.13-libre3/net/ipv6/netfilter/ip6t_REJECT.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/ipv6/netfilter/ip6t_REJECT.c	2011-08-01 16:56:51.000000000 -0400
@@ -45,6 +45,8 @@
 	int tcphoff, needs_ack;
 	const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
 	struct ipv6hdr *ip6h;
+#define DEFAULT_TOS_VALUE	0x0U
+	const __u8 tclass = DEFAULT_TOS_VALUE;
 	struct dst_entry *dst = NULL;
 	u8 proto;
 	struct flowi fl;
@@ -123,7 +125,7 @@
 	skb_put(nskb, sizeof(struct ipv6hdr));
 	skb_reset_network_header(nskb);
 	ip6h = ipv6_hdr(nskb);
-	ip6h->version = 6;
+	*(__be32 *)ip6h =  htonl(0x60000000 | (tclass << 20));
 	ip6h->hop_limit = dst_metric(dst, RTAX_HOPLIMIT);
 	ip6h->nexthdr = IPPROTO_TCP;
 	ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr);
diff -druN linux-2.6.35.13-libre3/net/ipv6/udp.c linux-2.6.35.14-libre3/net/ipv6/udp.c
--- linux-2.6.35.13-libre3/net/ipv6/udp.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/ipv6/udp.c	2011-08-01 16:56:51.000000000 -0400
@@ -445,8 +445,11 @@
 	}
 	unlock_sock_fast(sk, slow);
 
-	if (flags & MSG_DONTWAIT)
+	if (noblock)
 		return -EAGAIN;
+
+	/* starting over for a new packet */
+	msg->msg_flags &= ~MSG_TRUNC;
 	goto try_again;
 }
 
diff -druN linux-2.6.35.13-libre3/net/mac80211/mlme.c linux-2.6.35.14-libre3/net/mac80211/mlme.c
--- linux-2.6.35.13-libre3/net/mac80211/mlme.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/mac80211/mlme.c	2011-08-01 16:56:51.000000000 -0400
@@ -1995,6 +1995,9 @@
 {
 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
+	if (!ifmgd->associated)
+		return;
+
 	if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
 		add_timer(&ifmgd->timer);
 	if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
diff -druN linux-2.6.35.13-libre3/net/mac80211/wpa.c linux-2.6.35.14-libre3/net/mac80211/wpa.c
--- linux-2.6.35.13-libre3/net/mac80211/wpa.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/mac80211/wpa.c	2011-08-01 16:56:51.000000000 -0400
@@ -89,6 +89,11 @@
 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 	int authenticator = 1, wpa_test = 0;
+	int queue = rx->queue;
+
+	/* otherwise, TKIP is vulnerable to TID 0 vs. non-QoS replays */
+	if (rx->queue == NUM_RX_DATA_QUEUES - 1)
+		queue = 0;
 
 	/* No way to verify the MIC if the hardware stripped it */
 	if (status->flag & RX_FLAG_MMIC_STRIPPED)
@@ -130,8 +135,8 @@
 	skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
 
 	/* update IV in key information to be able to detect replays */
-	rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
-	rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
+	rx->key->u.tkip.rx[queue].iv32 = rx->tkip_iv32;
+	rx->key->u.tkip.rx[queue].iv16 = rx->tkip_iv16;
 
 	return RX_CONTINUE;
 }
@@ -213,6 +218,11 @@
 	struct ieee80211_key *key = rx->key;
 	struct sk_buff *skb = rx->skb;
 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+	int queue = rx->queue;
+
+	/* otherwise, TKIP is vulnerable to TID 0 vs. non-QoS replays */
+	if (rx->queue == NUM_RX_DATA_QUEUES - 1)
+		queue = 0;
 
 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
@@ -239,7 +249,7 @@
 	res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
 					  key, skb->data + hdrlen,
 					  skb->len - hdrlen, rx->sta->sta.addr,
-					  hdr->addr1, hwaccel, rx->queue,
+					  hdr->addr1, hwaccel, queue,
 					  &rx->tkip_iv32,
 					  &rx->tkip_iv16);
 	if (res != TKIP_DECRYPT_OK || wpa_test)
diff -druN linux-2.6.35.13-libre3/net/netfilter/xt_DSCP.c linux-2.6.35.14-libre3/net/netfilter/xt_DSCP.c
--- linux-2.6.35.13-libre3/net/netfilter/xt_DSCP.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/netfilter/xt_DSCP.c	2011-08-01 16:56:51.000000000 -0400
@@ -99,7 +99,7 @@
 	u_int8_t orig, nv;
 
 	orig = ipv6_get_dsfield(iph);
-	nv   = (orig & info->tos_mask) ^ info->tos_value;
+	nv   = (orig & ~info->tos_mask) ^ info->tos_value;
 
 	if (orig != nv) {
 		if (!skb_make_writable(skb, sizeof(struct iphdr)))
diff -druN linux-2.6.35.13-libre3/net/packet/af_packet.c linux-2.6.35.14-libre3/net/packet/af_packet.c
--- linux-2.6.35.13-libre3/net/packet/af_packet.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/packet/af_packet.c	2011-08-01 16:56:51.000000000 -0400
@@ -757,6 +757,7 @@
 		h.h2->tp_sec = ts.tv_sec;
 		h.h2->tp_nsec = ts.tv_nsec;
 		h.h2->tp_vlan_tci = vlan_tx_tag_get(skb);
+		h.h2->tp_padding = 0;
 		hdrlen = sizeof(*h.h2);
 		break;
 	default:
@@ -1678,6 +1679,7 @@
 		aux.tp_net = skb_network_offset(skb);
 		aux.tp_vlan_tci = vlan_tx_tag_get(skb);
 
+		aux.tp_padding = 0;
 		put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
 	}
 
diff -druN linux-2.6.35.13-libre3/net/phonet/pn_dev.c linux-2.6.35.14-libre3/net/phonet/pn_dev.c
--- linux-2.6.35.13-libre3/net/phonet/pn_dev.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/phonet/pn_dev.c	2011-08-01 16:56:51.000000000 -0400
@@ -298,6 +298,9 @@
 {
 	struct net_device *dev = arg;
 
+	if (!net_eq(dev_net(dev), &init_net))
+		return 0;
+
 	switch (what) {
 	case NETDEV_REGISTER:
 		if (dev->type == ARPHRD_PHONET)
diff -druN linux-2.6.35.13-libre3/net/sunrpc/auth_gss/auth_gss.c linux-2.6.35.14-libre3/net/sunrpc/auth_gss/auth_gss.c
--- linux-2.6.35.13-libre3/net/sunrpc/auth_gss/auth_gss.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/sunrpc/auth_gss/auth_gss.c	2011-08-01 16:56:51.000000000 -0400
@@ -575,13 +575,13 @@
 	}
 	inode = &gss_msg->inode->vfs_inode;
 	for (;;) {
-		prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_INTERRUPTIBLE);
+		prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
 		spin_lock(&inode->i_lock);
 		if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
 			break;
 		}
 		spin_unlock(&inode->i_lock);
-		if (signalled()) {
+		if (fatal_signal_pending(current)) {
 			err = -ERESTARTSYS;
 			goto out_intr;
 		}
diff -druN linux-2.6.35.13-libre3/net/sunrpc/clnt.c linux-2.6.35.14-libre3/net/sunrpc/clnt.c
--- linux-2.6.35.13-libre3/net/sunrpc/clnt.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/sunrpc/clnt.c	2011-08-01 16:56:51.000000000 -0400
@@ -928,7 +928,7 @@
 
 	dprintk("RPC: %5u rpc_buffer allocation failed\n", task->tk_pid);
 
-	if (RPC_IS_ASYNC(task) || !signalled()) {
+	if (RPC_IS_ASYNC(task) || !fatal_signal_pending(current)) {
 		task->tk_action = call_allocate;
 		rpc_delay(task, HZ>>4);
 		return;
diff -druN linux-2.6.35.13-libre3/net/sunrpc/rpcb_clnt.c linux-2.6.35.14-libre3/net/sunrpc/rpcb_clnt.c
--- linux-2.6.35.13-libre3/net/sunrpc/rpcb_clnt.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/sunrpc/rpcb_clnt.c	2011-08-01 16:56:51.000000000 -0400
@@ -580,7 +580,7 @@
 	u32 bind_version;
 	struct rpc_xprt *xprt;
 	struct rpc_clnt	*rpcb_clnt;
-	static struct rpcbind_args *map;
+	struct rpcbind_args *map;
 	struct rpc_task	*child;
 	struct sockaddr_storage addr;
 	struct sockaddr *sap = (struct sockaddr *)&addr;
diff -druN linux-2.6.35.13-libre3/net/sunrpc/sched.c linux-2.6.35.14-libre3/net/sunrpc/sched.c
--- linux-2.6.35.13-libre3/net/sunrpc/sched.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/sunrpc/sched.c	2011-08-01 16:56:51.000000000 -0400
@@ -623,30 +623,25 @@
 	BUG_ON(RPC_IS_QUEUED(task));
 
 	for (;;) {
+		void (*do_action)(struct rpc_task *);
 
 		/*
-		 * Execute any pending callback.
+		 * Execute any pending callback first.
 		 */
-		if (task->tk_callback) {
-			void (*save_callback)(struct rpc_task *);
-
-			/*
-			 * We set tk_callback to NULL before calling it,
-			 * in case it sets the tk_callback field itself:
-			 */
-			save_callback = task->tk_callback;
-			task->tk_callback = NULL;
-			save_callback(task);
-		} else {
+		do_action = task->tk_callback;
+		task->tk_callback = NULL;
+		if (do_action == NULL) {
 			/*
 			 * Perform the next FSM step.
-			 * tk_action may be NULL when the task has been killed
-			 * by someone else.
+			 * tk_action may be NULL if the task has been killed.
+			 * In particular, note that rpc_killall_tasks may
+			 * do this at any time, so beware when dereferencing.
 			 */
-			if (task->tk_action == NULL)
+			do_action = task->tk_action;
+			if (do_action == NULL)
 				break;
-			task->tk_action(task);
 		}
+		do_action(task);
 
 		/*
 		 * Lockless check for whether task is sleeping or not.
diff -druN linux-2.6.35.13-libre3/net/sunrpc/svc_xprt.c linux-2.6.35.14-libre3/net/sunrpc/svc_xprt.c
--- linux-2.6.35.13-libre3/net/sunrpc/svc_xprt.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/sunrpc/svc_xprt.c	2011-08-01 16:56:51.000000000 -0400
@@ -894,12 +894,13 @@
 	if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
 		list_del_init(&xprt->xpt_list);
 	/*
-	 * We used to delete the transport from whichever list
-	 * it's sk_xprt.xpt_ready node was on, but we don't actually
-	 * need to.  This is because the only time we're called
-	 * while still attached to a queue, the queue itself
-	 * is about to be destroyed (in svc_destroy).
+	 * The only time we're called while xpt_ready is still on a list
+	 * is while the list itself is about to be destroyed (in
+	 * svc_destroy).  BUT svc_xprt_enqueue could still be attempting
+	 * to add new entries to the sp_sockets list, so we can't leave
+	 * a freed xprt on it.
 	 */
+	list_del_init(&xprt->xpt_ready);
 	if (test_bit(XPT_TEMP, &xprt->xpt_flags))
 		serv->sv_tmpcnt--;
 	spin_unlock_bh(&serv->sv_lock);
diff -druN linux-2.6.35.13-libre3/net/sunrpc/xprtsock.c linux-2.6.35.14-libre3/net/sunrpc/xprtsock.c
--- linux-2.6.35.13-libre3/net/sunrpc/xprtsock.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/sunrpc/xprtsock.c	2011-08-01 16:56:51.000000000 -0400
@@ -1307,10 +1307,11 @@
 	if (!(xprt = xprt_from_sock(sk)))
 		goto out;
 	dprintk("RPC:       xs_tcp_state_change client %p...\n", xprt);
-	dprintk("RPC:       state %x conn %d dead %d zapped %d\n",
+	dprintk("RPC:       state %x conn %d dead %d zapped %d sk_shutdown %d\n",
 			sk->sk_state, xprt_connected(xprt),
 			sock_flag(sk, SOCK_DEAD),
-			sock_flag(sk, SOCK_ZAPPED));
+			sock_flag(sk, SOCK_ZAPPED),
+			sk->sk_shutdown);
 
 	switch (sk->sk_state) {
 	case TCP_ESTABLISHED:
@@ -1344,7 +1345,6 @@
 	case TCP_CLOSE_WAIT:
 		/* The server initiated a shutdown of the socket */
 		xprt_force_disconnect(xprt);
-	case TCP_SYN_SENT:
 		xprt->connect_cookie++;
 	case TCP_CLOSING:
 		/*
@@ -1781,16 +1781,32 @@
 {
 	unsigned int state = transport->inet->sk_state;
 
-	if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED)
-		return;
-	if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT))
-		return;
+	if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED) {
+		/* we don't need to abort the connection if the socket
+		 * hasn't undergone a shutdown
+		 */
+		if (transport->inet->sk_shutdown == 0)
+			return;
+		dprintk("RPC:       %s: TCP_CLOSEd and sk_shutdown set to %d\n",
+				__func__, transport->inet->sk_shutdown);
+	}
+	if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT)) {
+		/* we don't need to abort the connection if the socket
+		 * hasn't undergone a shutdown
+		 */
+		if (transport->inet->sk_shutdown == 0)
+			return;
+		dprintk("RPC:       %s: ESTABLISHED/SYN_SENT "
+				"sk_shutdown set to %d\n",
+				__func__, transport->inet->sk_shutdown);
+	}
 	xs_abort_connection(xprt, transport);
 }
 
 static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
 {
 	struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+	int ret = -ENOTCONN;
 
 	if (!transport->inet) {
 		struct sock *sk = sock->sk;
@@ -1822,12 +1838,22 @@
 	}
 
 	if (!xprt_bound(xprt))
-		return -ENOTCONN;
+		goto out;
 
 	/* Tell the socket layer to start connecting... */
 	xprt->stat.connect_count++;
 	xprt->stat.connect_start = jiffies;
-	return kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
+	ret = kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
+	switch (ret) {
+	case 0:
+	case -EINPROGRESS:
+		/* SYN_SENT! */
+		xprt->connect_cookie++;
+		if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
+			xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
+	}
+out:
+	return ret;
 }
 
 /**
diff -druN linux-2.6.35.13-libre3/net/wireless/nl80211.c linux-2.6.35.14-libre3/net/wireless/nl80211.c
--- linux-2.6.35.13-libre3/net/wireless/nl80211.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/net/wireless/nl80211.c	2011-08-01 16:56:51.000000000 -0400
@@ -3179,12 +3179,12 @@
 	i = 0;
 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
+			request->ssids[i].ssid_len = nla_len(attr);
 			if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
 				err = -EINVAL;
 				goto out_free;
 			}
 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
-			request->ssids[i].ssid_len = nla_len(attr);
 			i++;
 		}
 	}
diff -druN linux-2.6.35.13-libre3/scripts/Kbuild.include linux-2.6.35.14-libre3/scripts/Kbuild.include
--- linux-2.6.35.13-libre3/scripts/Kbuild.include	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/scripts/Kbuild.include	2011-08-01 16:56:51.000000000 -0400
@@ -118,6 +118,11 @@
 cc-option-align = $(subst -functions=0,,\
 	$(call cc-option,-falign-functions=0,-malign-functions=0))
 
+# cc-disable-warning
+# Usage: cflags-y += $(call cc-disable-warning,unused-but-set-variable)
+cc-disable-warning = $(call try-run,\
+	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -xc /dev/null -o "$$TMP",-Wno-$(strip $(1)))
+
 # cc-version
 # Usage gcc-ver := $(call cc-version)
 cc-version = $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-version.sh $(CC))
diff -druN linux-2.6.35.13-libre3/sound/pci/hda/patch_cirrus.c linux-2.6.35.14-libre3/sound/pci/hda/patch_cirrus.c
--- linux-2.6.35.13-libre3/sound/pci/hda/patch_cirrus.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/sound/pci/hda/patch_cirrus.c	2011-08-01 16:56:51.000000000 -0400
@@ -65,6 +65,7 @@
 
 /* available models */
 enum {
+	CS420X_MBP53,
 	CS420X_MBP55,
 	CS420X_IMAC27,
 	CS420X_AUTO,
@@ -838,7 +839,8 @@
 				    AC_VERB_SET_PIN_WIDGET_CONTROL,
 				    hp_present ? 0 : PIN_OUT);
 	}
-	if (spec->board_config == CS420X_MBP55 ||
+	if (spec->board_config == CS420X_MBP53 ||
+	    spec->board_config == CS420X_MBP55 ||
 	    spec->board_config == CS420X_IMAC27) {
 		unsigned int gpio = hp_present ? 0x02 : 0x08;
 		snd_hda_codec_write(codec, 0x01, 0,
@@ -1130,6 +1132,7 @@
 }
 
 static const char *cs420x_models[CS420X_MODELS] = {
+	[CS420X_MBP53] = "mbp53",
 	[CS420X_MBP55] = "mbp55",
 	[CS420X_IMAC27] = "imac27",
 	[CS420X_AUTO] = "auto",
@@ -1137,7 +1140,10 @@
 
 
 static struct snd_pci_quirk cs420x_cfg_tbl[] = {
+	SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53),
+	SND_PCI_QUIRK(0x10de, 0x0d94, "MacBookAir 3,1(2)", CS420X_MBP55),
 	SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55),
+	SND_PCI_QUIRK(0x10de, 0xcb89, "MacBookPro 7,1", CS420X_MBP55),
 	SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),
 	{} /* terminator */
 };
@@ -1147,6 +1153,20 @@
 	u32 val;
 };
 
+static struct cs_pincfg mbp53_pincfgs[] = {
+	{ 0x09, 0x012b4050 },
+	{ 0x0a, 0x90100141 },
+	{ 0x0b, 0x90100140 },
+	{ 0x0c, 0x018b3020 },
+	{ 0x0d, 0x90a00110 },
+	{ 0x0e, 0x400000f0 },
+	{ 0x0f, 0x01cbe030 },
+	{ 0x10, 0x014be060 },
+	{ 0x12, 0x400000f0 },
+	{ 0x15, 0x400000f0 },
+	{} /* terminator */
+};
+
 static struct cs_pincfg mbp55_pincfgs[] = {
 	{ 0x09, 0x012b4030 },
 	{ 0x0a, 0x90100121 },
@@ -1176,6 +1196,7 @@
 };
 
 static struct cs_pincfg *cs_pincfgs[CS420X_MODELS] = {
+	[CS420X_MBP53] = mbp53_pincfgs,
 	[CS420X_MBP55] = mbp55_pincfgs,
 	[CS420X_IMAC27] = imac27_pincfgs,
 };
@@ -1208,6 +1229,7 @@
 
 	switch (spec->board_config) {
 	case CS420X_IMAC27:
+	case CS420X_MBP53:
 	case CS420X_MBP55:
 		/* GPIO1 = headphones */
 		/* GPIO3 = speakers */
diff -druN linux-2.6.35.13-libre3/sound/pci/hda/patch_realtek.c linux-2.6.35.14-libre3/sound/pci/hda/patch_realtek.c
--- linux-2.6.35.13-libre3/sound/pci/hda/patch_realtek.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/sound/pci/hda/patch_realtek.c	2011-08-01 16:56:51.000000000 -0400
@@ -13296,6 +13296,7 @@
 	SND_PCI_QUIRK(0x1025, 0x015b, "Acer Aspire One",
 						ALC268_ACER_ASPIRE_ONE),
 	SND_PCI_QUIRK(0x1028, 0x0253, "Dell OEM", ALC268_DELL),
+	SND_PCI_QUIRK(0x1028, 0x02b0, "Dell Inspiron 910", ALC268_AUTO),
 	SND_PCI_QUIRK_MASK(0x1028, 0xfff0, 0x02b0,
 			"Dell Inspiron Mini9/Vostro A90", ALC268_DELL),
 	/* almost compatible with toshiba but with optional digital outs;
diff -druN linux-2.6.35.13-libre3/sound/pci/hda/patch_sigmatel.c linux-2.6.35.14-libre3/sound/pci/hda/patch_sigmatel.c
--- linux-2.6.35.13-libre3/sound/pci/hda/patch_sigmatel.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/sound/pci/hda/patch_sigmatel.c	2011-08-01 16:56:51.000000000 -0400
@@ -1623,7 +1623,7 @@
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe,
 				"Dell Studio XPS 1645", STAC_DELL_M6_BOTH),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413,
-				"Dell Studio 1558", STAC_DELL_M6_BOTH),
+				"Dell Studio 1558", STAC_DELL_M6_DMIC),
 	{} /* terminator */
 };
 
diff -druN linux-2.6.35.13-libre3/sound/soc/codecs/ak4642.c linux-2.6.35.14-libre3/sound/soc/codecs/ak4642.c
--- linux-2.6.35.13-libre3/sound/soc/codecs/ak4642.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/sound/soc/codecs/ak4642.c	2011-08-01 16:56:51.000000000 -0400
@@ -319,7 +319,7 @@
 	default:
 		return -EINVAL;
 	}
-	snd_soc_update_bits(codec, PW_MGMT2, MS, data);
+	snd_soc_update_bits(codec, PW_MGMT2, MS | MCKO | PMPLL, data);
 	snd_soc_update_bits(codec, MD_CTL1, BCKO_MASK, bcko);
 
 	return 0;
diff -druN linux-2.6.35.13-libre3/sound/soc/codecs/wm8994.c linux-2.6.35.14-libre3/sound/soc/codecs/wm8994.c
--- linux-2.6.35.13-libre3/sound/soc/codecs/wm8994.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/sound/soc/codecs/wm8994.c	2011-08-01 16:56:51.000000000 -0400
@@ -2929,6 +2929,8 @@
 		snd_soc_update_bits(codec, WM8994_FLL1_CONTROL_1 + reg_offset,
 				    WM8994_FLL1_ENA | WM8994_FLL1_FRAC,
 				    reg);
+
+		msleep(5);
 	}
 
 	wm8994->fll[id].in = freq_in;
diff -druN linux-2.6.35.13-libre3/sound/soc/codecs/wm_hubs.c linux-2.6.35.14-libre3/sound/soc/codecs/wm_hubs.c
--- linux-2.6.35.13-libre3/sound/soc/codecs/wm_hubs.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/sound/soc/codecs/wm_hubs.c	2011-08-01 16:56:51.000000000 -0400
@@ -752,17 +752,17 @@
 static const struct snd_soc_dapm_route lineout1_diff_routes[] = {
 	{ "LINEOUT1 Mixer", "IN1L Switch", "IN1L PGA" },
 	{ "LINEOUT1 Mixer", "IN1R Switch", "IN1R PGA" },
-	{ "LINEOUT1 Mixer", "Output Switch", "Left Output Mixer" },
+	{ "LINEOUT1 Mixer", "Output Switch", "Left Output PGA" },
 
 	{ "LINEOUT1N Driver", NULL, "LINEOUT1 Mixer" },
 	{ "LINEOUT1P Driver", NULL, "LINEOUT1 Mixer" },
 };
 
 static const struct snd_soc_dapm_route lineout1_se_routes[] = {
-	{ "LINEOUT1N Mixer", "Left Output Switch", "Left Output Mixer" },
-	{ "LINEOUT1N Mixer", "Right Output Switch", "Left Output Mixer" },
+	{ "LINEOUT1N Mixer", "Left Output Switch", "Left Output PGA" },
+	{ "LINEOUT1N Mixer", "Right Output Switch", "Right Output PGA" },
 
-	{ "LINEOUT1P Mixer", "Left Output Switch", "Left Output Mixer" },
+	{ "LINEOUT1P Mixer", "Left Output Switch", "Left Output PGA" },
 
 	{ "LINEOUT1N Driver", NULL, "LINEOUT1N Mixer" },
 	{ "LINEOUT1P Driver", NULL, "LINEOUT1P Mixer" },
@@ -771,17 +771,17 @@
 static const struct snd_soc_dapm_route lineout2_diff_routes[] = {
 	{ "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" },
 	{ "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" },
-	{ "LINEOUT2 Mixer", "Output Switch", "Right Output Mixer" },
+	{ "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" },
 
 	{ "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" },
 	{ "LINEOUT2P Driver", NULL, "LINEOUT2 Mixer" },
 };
 
 static const struct snd_soc_dapm_route lineout2_se_routes[] = {
-	{ "LINEOUT2N Mixer", "Left Output Switch", "Left Output Mixer" },
-	{ "LINEOUT2N Mixer", "Right Output Switch", "Left Output Mixer" },
+	{ "LINEOUT2N Mixer", "Left Output Switch", "Left Output PGA" },
+	{ "LINEOUT2N Mixer", "Right Output Switch", "Right Output PGA" },
 
-	{ "LINEOUT2P Mixer", "Right Output Switch", "Right Output Mixer" },
+	{ "LINEOUT2P Mixer", "Right Output Switch", "Right Output PGA" },
 
 	{ "LINEOUT2N Driver", NULL, "LINEOUT2N Mixer" },
 	{ "LINEOUT2P Driver", NULL, "LINEOUT2P Mixer" },
@@ -799,17 +799,21 @@
 	snd_soc_update_bits(codec, WM8993_RIGHT_LINE_INPUT_3_4_VOLUME,
 			    WM8993_IN2_VU, WM8993_IN2_VU);
 
+	snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_LEFT,
+			    WM8993_SPKOUT_VU, WM8993_SPKOUT_VU);
 	snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_RIGHT,
 			    WM8993_SPKOUT_VU, WM8993_SPKOUT_VU);
 
 	snd_soc_update_bits(codec, WM8993_LEFT_OUTPUT_VOLUME,
-			    WM8993_HPOUT1L_ZC, WM8993_HPOUT1L_ZC);
+			    WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC,
+			    WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC);
 	snd_soc_update_bits(codec, WM8993_RIGHT_OUTPUT_VOLUME,
 			    WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC,
 			    WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC);
 
 	snd_soc_update_bits(codec, WM8993_LEFT_OPGA_VOLUME,
-			    WM8993_MIXOUTL_ZC, WM8993_MIXOUTL_ZC);
+			    WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU,
+			    WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU);
 	snd_soc_update_bits(codec, WM8993_RIGHT_OPGA_VOLUME,
 			    WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU,
 			    WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU);
diff -druN linux-2.6.35.13-libre3/sound/synth/emux/emux_hwdep.c linux-2.6.35.14-libre3/sound/synth/emux/emux_hwdep.c
--- linux-2.6.35.13-libre3/sound/synth/emux/emux_hwdep.c	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/sound/synth/emux/emux_hwdep.c	2011-08-01 16:56:51.000000000 -0400
@@ -128,6 +128,9 @@
 	strcpy(hw->name, SNDRV_EMUX_HWDEP_NAME);
 	hw->iface = SNDRV_HWDEP_IFACE_EMUX_WAVETABLE;
 	hw->ops.ioctl = snd_emux_hwdep_ioctl;
+	/* The ioctl parameter types are compatible between 32- and
+	 * 64-bit architectures, so use the same function. */
+	hw->ops.ioctl_compat = snd_emux_hwdep_ioctl;
 	hw->exclusive = 1;
 	hw->private_data = emu;
 	if ((err = snd_card_register(emu->card)) < 0)
diff -druN linux-2.6.35.13-libre3/tools/perf/Makefile linux-2.6.35.14-libre3/tools/perf/Makefile
--- linux-2.6.35.13-libre3/tools/perf/Makefile	2011-04-28 11:21:24.000000000 -0400
+++ linux-2.6.35.14-libre3/tools/perf/Makefile	2011-08-01 16:56:51.000000000 -0400
@@ -225,7 +225,7 @@
   CFLAGS_OPTIMIZE = -O6
 endif
 
-CFLAGS = -ggdb3 -Wall -Wextra -std=gnu99 -Werror $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
+CFLAGS = -ggdb3 -Wall -Wextra -std=gnu99 $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
 EXTLIBS = -lpthread -lrt -lelf -lm
 ALL_CFLAGS = $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
 ALL_LDFLAGS = $(LDFLAGS)
