diff -druN linux-libre-3.2.27-gnu/arch/arm/configs/mxs_defconfig linux-libre-3.2.28-gnu/arch/arm/configs/mxs_defconfig
--- linux-libre-3.2.27-gnu/arch/arm/configs/mxs_defconfig	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/arch/arm/configs/mxs_defconfig	2012-08-19 13:15:38.000000000 -0400
@@ -32,7 +32,6 @@
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_PREEMPT_VOLUNTARY=y
 CONFIG_AEABI=y
-CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
 CONFIG_AUTO_ZRELADDR=y
 CONFIG_FPE_NWFPE=y
 CONFIG_NET=y
diff -druN linux-libre-3.2.27-gnu/arch/arm/mach-pxa/raumfeld.c linux-libre-3.2.28-gnu/arch/arm/mach-pxa/raumfeld.c
--- linux-libre-3.2.27-gnu/arch/arm/mach-pxa/raumfeld.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/arch/arm/mach-pxa/raumfeld.c	2012-08-19 13:15:38.000000000 -0400
@@ -951,12 +951,12 @@
 
 static struct eeti_ts_platform_data eeti_ts_pdata = {
 	.irq_active_high = 1,
+	.irq_gpio = GPIO_TOUCH_IRQ,
 };
 
 static struct i2c_board_info raumfeld_controller_i2c_board_info __initdata = {
 	.type	= "eeti_ts",
 	.addr	= 0x0a,
-	.irq	= gpio_to_irq(GPIO_TOUCH_IRQ),
 	.platform_data = &eeti_ts_pdata,
 };
 
diff -druN linux-libre-3.2.27-gnu/arch/s390/kernel/compat_linux.c linux-libre-3.2.28-gnu/arch/s390/kernel/compat_linux.c
--- linux-libre-3.2.27-gnu/arch/s390/kernel/compat_linux.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/arch/s390/kernel/compat_linux.c	2012-08-19 13:15:38.000000000 -0400
@@ -615,7 +615,6 @@
 		return -EFAULT;
 	if (a.offset & ~PAGE_MASK)
 		return -EINVAL;
-	a.addr = (unsigned long) compat_ptr(a.addr);
 	return sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
 			      a.offset >> PAGE_SHIFT);
 }
@@ -626,7 +625,6 @@
 
 	if (copy_from_user(&a, arg, sizeof(a)))
 		return -EFAULT;
-	a.addr = (unsigned long) compat_ptr(a.addr);
 	return sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd, a.offset);
 }
 
diff -druN linux-libre-3.2.27-gnu/arch/s390/kernel/compat_wrapper.S linux-libre-3.2.28-gnu/arch/s390/kernel/compat_wrapper.S
--- linux-libre-3.2.27-gnu/arch/s390/kernel/compat_wrapper.S	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/arch/s390/kernel/compat_wrapper.S	2012-08-19 13:15:38.000000000 -0400
@@ -1636,7 +1636,7 @@
 	llgfr	%r6,%r6			# unsigned long
 	llgf	%r0,164(%r15)		# unsigned long
 	stg	%r0,160(%r15)
-	jg	sys_process_vm_readv
+	jg	compat_sys_process_vm_readv
 
 ENTRY(compat_sys_process_vm_writev_wrapper)
 	lgfr	%r2,%r2			# compat_pid_t
@@ -1646,4 +1646,4 @@
 	llgfr	%r6,%r6			# unsigned long
 	llgf	%r0,164(%r15)		# unsigned long
 	stg	%r0,160(%r15)
-	jg	sys_process_vm_writev
+	jg	compat_sys_process_vm_writev
diff -druN linux-libre-3.2.27-gnu/arch/x86/kvm/vmx.c linux-libre-3.2.28-gnu/arch/x86/kvm/vmx.c
--- linux-libre-3.2.27-gnu/arch/x86/kvm/vmx.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/arch/x86/kvm/vmx.c	2012-08-19 13:15:38.000000000 -0400
@@ -1956,6 +1956,7 @@
 #endif
 		CPU_BASED_MOV_DR_EXITING | CPU_BASED_UNCOND_IO_EXITING |
 		CPU_BASED_USE_IO_BITMAPS | CPU_BASED_MONITOR_EXITING |
+		CPU_BASED_RDPMC_EXITING |
 		CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
 	/*
 	 * We can allow some features even when not supported by the
diff -druN linux-libre-3.2.27-gnu/drivers/gpu/drm/i915/i915_drv.h linux-libre-3.2.28-gnu/drivers/gpu/drm/i915/i915_drv.h
--- linux-libre-3.2.27-gnu/drivers/gpu/drm/i915/i915_drv.h	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/gpu/drm/i915/i915_drv.h	2012-08-19 13:15:38.000000000 -0400
@@ -1170,12 +1170,7 @@
 	return (int32_t)(seq1 - seq2) >= 0;
 }
 
-static inline u32
-i915_gem_next_request_seqno(struct intel_ring_buffer *ring)
-{
-	drm_i915_private_t *dev_priv = ring->dev->dev_private;
-	return ring->outstanding_lazy_request = dev_priv->next_seqno;
-}
+u32 i915_gem_next_request_seqno(struct intel_ring_buffer *ring);
 
 int __must_check i915_gem_object_get_fence(struct drm_i915_gem_object *obj,
 					   struct intel_ring_buffer *pipelined);
diff -druN linux-libre-3.2.27-gnu/drivers/gpu/drm/i915/i915_gem.c linux-libre-3.2.28-gnu/drivers/gpu/drm/i915/i915_gem.c
--- linux-libre-3.2.27-gnu/drivers/gpu/drm/i915/i915_gem.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/gpu/drm/i915/i915_gem.c	2012-08-19 13:15:38.000000000 -0400
@@ -1647,6 +1647,28 @@
 	}
 }
 
+static u32
+i915_gem_get_seqno(struct drm_device *dev)
+{
+	drm_i915_private_t *dev_priv = dev->dev_private;
+	u32 seqno = dev_priv->next_seqno;
+
+	/* reserve 0 for non-seqno */
+	if (++dev_priv->next_seqno == 0)
+		dev_priv->next_seqno = 1;
+
+	return seqno;
+}
+
+u32
+i915_gem_next_request_seqno(struct intel_ring_buffer *ring)
+{
+	if (ring->outstanding_lazy_request == 0)
+		ring->outstanding_lazy_request = i915_gem_get_seqno(ring->dev);
+
+	return ring->outstanding_lazy_request;
+}
+
 int
 i915_add_request(struct intel_ring_buffer *ring,
 		 struct drm_file *file,
@@ -1658,6 +1680,7 @@
 	int ret;
 
 	BUG_ON(request == NULL);
+	seqno = i915_gem_next_request_seqno(ring);
 
 	ret = ring->add_request(ring, &seqno);
 	if (ret)
diff -druN linux-libre-3.2.27-gnu/drivers/gpu/drm/i915/intel_ringbuffer.c linux-libre-3.2.28-gnu/drivers/gpu/drm/i915/intel_ringbuffer.c
--- linux-libre-3.2.27-gnu/drivers/gpu/drm/i915/intel_ringbuffer.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/gpu/drm/i915/intel_ringbuffer.c	2012-08-19 13:15:38.000000000 -0400
@@ -52,20 +52,6 @@
 	return space;
 }
 
-static u32 i915_gem_get_seqno(struct drm_device *dev)
-{
-	drm_i915_private_t *dev_priv = dev->dev_private;
-	u32 seqno;
-
-	seqno = dev_priv->next_seqno;
-
-	/* reserve 0 for non-seqno */
-	if (++dev_priv->next_seqno == 0)
-		dev_priv->next_seqno = 1;
-
-	return seqno;
-}
-
 static int
 render_ring_flush(struct intel_ring_buffer *ring,
 		  u32	invalidate_domains,
@@ -277,8 +263,6 @@
 	I915_WRITE_HEAD(ring, 0);
 	ring->write_tail(ring, 0);
 
-	/* Initialize the ring. */
-	I915_WRITE_START(ring, obj->gtt_offset);
 	head = I915_READ_HEAD(ring) & HEAD_ADDR;
 
 	/* G45 ring initialization fails to reset head to zero */
@@ -304,14 +288,19 @@
 		}
 	}
 
+	/* Initialize the ring. This must happen _after_ we've cleared the ring
+	 * registers with the above sequence (the readback of the HEAD registers
+	 * also enforces ordering), otherwise the hw might lose the new ring
+	 * register values. */
+	I915_WRITE_START(ring, obj->gtt_offset);
 	I915_WRITE_CTL(ring,
 			((ring->size - PAGE_SIZE) & RING_NR_PAGES)
 			| RING_VALID);
 
 	/* If the head is still not zero, the ring is dead */
-	if ((I915_READ_CTL(ring) & RING_VALID) == 0 ||
-	    I915_READ_START(ring) != obj->gtt_offset ||
-	    (I915_READ_HEAD(ring) & HEAD_ADDR) != 0) {
+	if (wait_for((I915_READ_CTL(ring) & RING_VALID) != 0 &&
+		     I915_READ_START(ring) == obj->gtt_offset &&
+		     (I915_READ_HEAD(ring) & HEAD_ADDR) == 0, 50)) {
 		DRM_ERROR("%s initialization failed "
 				"ctl %08x head %08x tail %08x start %08x\n",
 				ring->name,
@@ -488,7 +477,7 @@
 	mbox1_reg = ring->signal_mbox[0];
 	mbox2_reg = ring->signal_mbox[1];
 
-	*seqno = i915_gem_get_seqno(ring->dev);
+	*seqno = i915_gem_next_request_seqno(ring);
 
 	update_mboxes(ring, *seqno, mbox1_reg);
 	update_mboxes(ring, *seqno, mbox2_reg);
@@ -586,8 +575,7 @@
 pc_render_add_request(struct intel_ring_buffer *ring,
 		      u32 *result)
 {
-	struct drm_device *dev = ring->dev;
-	u32 seqno = i915_gem_get_seqno(dev);
+	u32 seqno = i915_gem_next_request_seqno(ring);
 	struct pipe_control *pc = ring->private;
 	u32 scratch_addr = pc->gtt_offset + 128;
 	int ret;
@@ -638,8 +626,7 @@
 render_ring_add_request(struct intel_ring_buffer *ring,
 			u32 *result)
 {
-	struct drm_device *dev = ring->dev;
-	u32 seqno = i915_gem_get_seqno(dev);
+	u32 seqno = i915_gem_next_request_seqno(ring);
 	int ret;
 
 	ret = intel_ring_begin(ring, 4);
@@ -813,7 +800,7 @@
 	if (ret)
 		return ret;
 
-	seqno = i915_gem_get_seqno(ring->dev);
+	seqno = i915_gem_next_request_seqno(ring);
 
 	intel_ring_emit(ring, MI_STORE_DWORD_INDEX);
 	intel_ring_emit(ring, I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
diff -druN linux-libre-3.2.27-gnu/drivers/gpu/drm/radeon/evergreen.c linux-libre-3.2.28-gnu/drivers/gpu/drm/radeon/evergreen.c
--- linux-libre-3.2.27-gnu/drivers/gpu/drm/radeon/evergreen.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/gpu/drm/radeon/evergreen.c	2012-08-19 13:15:38.000000000 -0400
@@ -1065,24 +1065,8 @@
 
 void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *save)
 {
-	save->vga_control[0] = RREG32(D1VGA_CONTROL);
-	save->vga_control[1] = RREG32(D2VGA_CONTROL);
 	save->vga_render_control = RREG32(VGA_RENDER_CONTROL);
 	save->vga_hdp_control = RREG32(VGA_HDP_CONTROL);
-	save->crtc_control[0] = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET);
-	save->crtc_control[1] = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET);
-	if (rdev->num_crtc >= 4) {
-		save->vga_control[2] = RREG32(EVERGREEN_D3VGA_CONTROL);
-		save->vga_control[3] = RREG32(EVERGREEN_D4VGA_CONTROL);
-		save->crtc_control[2] = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET);
-		save->crtc_control[3] = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET);
-	}
-	if (rdev->num_crtc >= 6) {
-		save->vga_control[4] = RREG32(EVERGREEN_D5VGA_CONTROL);
-		save->vga_control[5] = RREG32(EVERGREEN_D6VGA_CONTROL);
-		save->crtc_control[4] = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET);
-		save->crtc_control[5] = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET);
-	}
 
 	/* Stop all video */
 	WREG32(VGA_RENDER_CONTROL, 0);
@@ -1193,47 +1177,6 @@
 	/* Unlock host access */
 	WREG32(VGA_HDP_CONTROL, save->vga_hdp_control);
 	mdelay(1);
-	/* Restore video state */
-	WREG32(D1VGA_CONTROL, save->vga_control[0]);
-	WREG32(D2VGA_CONTROL, save->vga_control[1]);
-	if (rdev->num_crtc >= 4) {
-		WREG32(EVERGREEN_D3VGA_CONTROL, save->vga_control[2]);
-		WREG32(EVERGREEN_D4VGA_CONTROL, save->vga_control[3]);
-	}
-	if (rdev->num_crtc >= 6) {
-		WREG32(EVERGREEN_D5VGA_CONTROL, save->vga_control[4]);
-		WREG32(EVERGREEN_D6VGA_CONTROL, save->vga_control[5]);
-	}
-	WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC0_REGISTER_OFFSET, 1);
-	WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC1_REGISTER_OFFSET, 1);
-	if (rdev->num_crtc >= 4) {
-		WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC2_REGISTER_OFFSET, 1);
-		WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC3_REGISTER_OFFSET, 1);
-	}
-	if (rdev->num_crtc >= 6) {
-		WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC4_REGISTER_OFFSET, 1);
-		WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC5_REGISTER_OFFSET, 1);
-	}
-	WREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, save->crtc_control[0]);
-	WREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, save->crtc_control[1]);
-	if (rdev->num_crtc >= 4) {
-		WREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, save->crtc_control[2]);
-		WREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, save->crtc_control[3]);
-	}
-	if (rdev->num_crtc >= 6) {
-		WREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, save->crtc_control[4]);
-		WREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, save->crtc_control[5]);
-	}
-	WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
-	WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
-	if (rdev->num_crtc >= 4) {
-		WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC2_REGISTER_OFFSET, 0);
-		WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC3_REGISTER_OFFSET, 0);
-	}
-	if (rdev->num_crtc >= 6) {
-		WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC4_REGISTER_OFFSET, 0);
-		WREG32(EVERGREEN_CRTC_UPDATE_LOCK + EVERGREEN_CRTC5_REGISTER_OFFSET, 0);
-	}
 	WREG32(VGA_RENDER_CONTROL, save->vga_render_control);
 }
 
@@ -2080,10 +2023,18 @@
 	if (rdev->flags & RADEON_IS_IGP)
 		rdev->config.evergreen.tile_config |= 1 << 4;
 	else {
-		if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
-			rdev->config.evergreen.tile_config |= 1 << 4;
-		else
+		switch ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) {
+		case 0: /* four banks */
 			rdev->config.evergreen.tile_config |= 0 << 4;
+			break;
+		case 1: /* eight banks */
+			rdev->config.evergreen.tile_config |= 1 << 4;
+			break;
+		case 2: /* sixteen banks */
+		default:
+			rdev->config.evergreen.tile_config |= 2 << 4;
+			break;
+		}
 	}
 	rdev->config.evergreen.tile_config |=
 		((mc_arb_ramcfg & BURSTLENGTH_MASK) >> BURSTLENGTH_SHIFT) << 8;
diff -druN linux-libre-3.2.27-gnu/drivers/gpu/drm/radeon/ni.c linux-libre-3.2.28-gnu/drivers/gpu/drm/radeon/ni.c
--- linux-libre-3.2.27-gnu/drivers/gpu/drm/radeon/ni.c	2012-08-10 16:36:08.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/gpu/drm/radeon/ni.c	2012-08-20 05:09:44.000000000 -0400
@@ -763,10 +763,18 @@
 		rdev->config.cayman.tile_config |= (3 << 0);
 		break;
 	}
-	if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
-		rdev->config.cayman.tile_config |= 1 << 4;
-	else
+	switch ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) {
+	case 0: /* four banks */
 		rdev->config.cayman.tile_config |= 0 << 4;
+		break;
+	case 1: /* eight banks */
+		rdev->config.cayman.tile_config |= 1 << 4;
+		break;
+	case 2: /* sixteen banks */
+	default:
+		rdev->config.cayman.tile_config |= 2 << 4;
+		break;
+	}
 	rdev->config.cayman.tile_config |=
 		((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
 	rdev->config.cayman.tile_config |=
diff -druN linux-libre-3.2.27-gnu/drivers/gpu/drm/radeon/radeon_asic.h linux-libre-3.2.28-gnu/drivers/gpu/drm/radeon/radeon_asic.h
--- linux-libre-3.2.27-gnu/drivers/gpu/drm/radeon/radeon_asic.h	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/gpu/drm/radeon/radeon_asic.h	2012-08-19 13:15:38.000000000 -0400
@@ -253,13 +253,10 @@
  * rv515
  */
 struct rv515_mc_save {
-	u32 d1vga_control;
-	u32 d2vga_control;
 	u32 vga_render_control;
 	u32 vga_hdp_control;
-	u32 d1crtc_control;
-	u32 d2crtc_control;
 };
+
 int rv515_init(struct radeon_device *rdev);
 void rv515_fini(struct radeon_device *rdev);
 uint32_t rv515_mc_rreg(struct radeon_device *rdev, uint32_t reg);
@@ -387,11 +384,10 @@
  * evergreen
  */
 struct evergreen_mc_save {
-	u32 vga_control[6];
 	u32 vga_render_control;
 	u32 vga_hdp_control;
-	u32 crtc_control[6];
 };
+
 void evergreen_pcie_gart_tlb_flush(struct radeon_device *rdev);
 int evergreen_init(struct radeon_device *rdev);
 void evergreen_fini(struct radeon_device *rdev);
diff -druN linux-libre-3.2.27-gnu/drivers/gpu/drm/radeon/rv515.c linux-libre-3.2.28-gnu/drivers/gpu/drm/radeon/rv515.c
--- linux-libre-3.2.27-gnu/drivers/gpu/drm/radeon/rv515.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/gpu/drm/radeon/rv515.c	2012-08-19 13:15:38.000000000 -0400
@@ -281,12 +281,8 @@
 
 void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
 {
-	save->d1vga_control = RREG32(R_000330_D1VGA_CONTROL);
-	save->d2vga_control = RREG32(R_000338_D2VGA_CONTROL);
 	save->vga_render_control = RREG32(R_000300_VGA_RENDER_CONTROL);
 	save->vga_hdp_control = RREG32(R_000328_VGA_HDP_CONTROL);
-	save->d1crtc_control = RREG32(R_006080_D1CRTC_CONTROL);
-	save->d2crtc_control = RREG32(R_006880_D2CRTC_CONTROL);
 
 	/* Stop all video */
 	WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 0);
@@ -311,15 +307,6 @@
 	/* Unlock host access */
 	WREG32(R_000328_VGA_HDP_CONTROL, save->vga_hdp_control);
 	mdelay(1);
-	/* Restore video state */
-	WREG32(R_000330_D1VGA_CONTROL, save->d1vga_control);
-	WREG32(R_000338_D2VGA_CONTROL, save->d2vga_control);
-	WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 1);
-	WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 1);
-	WREG32(R_006080_D1CRTC_CONTROL, save->d1crtc_control);
-	WREG32(R_006880_D2CRTC_CONTROL, save->d2crtc_control);
-	WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 0);
-	WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 0);
 	WREG32(R_000300_VGA_RENDER_CONTROL, save->vga_render_control);
 }
 
diff -druN linux-libre-3.2.27-gnu/drivers/input/touchscreen/eeti_ts.c linux-libre-3.2.28-gnu/drivers/input/touchscreen/eeti_ts.c
--- linux-libre-3.2.27-gnu/drivers/input/touchscreen/eeti_ts.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/input/touchscreen/eeti_ts.c	2012-08-19 13:15:38.000000000 -0400
@@ -48,7 +48,7 @@
 	struct input_dev *input;
 	struct work_struct work;
 	struct mutex mutex;
-	int irq, irq_active_high;
+	int irq_gpio, irq, irq_active_high;
 };
 
 #define EETI_TS_BITDEPTH	(11)
@@ -62,7 +62,7 @@
 
 static inline int eeti_ts_irq_active(struct eeti_ts_priv *priv)
 {
-	return gpio_get_value(irq_to_gpio(priv->irq)) == priv->irq_active_high;
+	return gpio_get_value(priv->irq_gpio) == priv->irq_active_high;
 }
 
 static void eeti_ts_read(struct work_struct *work)
@@ -157,7 +157,7 @@
 static int __devinit eeti_ts_probe(struct i2c_client *client,
 				   const struct i2c_device_id *idp)
 {
-	struct eeti_ts_platform_data *pdata;
+	struct eeti_ts_platform_data *pdata = client->dev.platform_data;
 	struct eeti_ts_priv *priv;
 	struct input_dev *input;
 	unsigned int irq_flags;
@@ -199,9 +199,12 @@
 
 	priv->client = client;
 	priv->input = input;
-	priv->irq = client->irq;
+	priv->irq_gpio = pdata->irq_gpio;
+	priv->irq = gpio_to_irq(pdata->irq_gpio);
 
-	pdata = client->dev.platform_data;
+	err = gpio_request_one(pdata->irq_gpio, GPIOF_IN, client->name);
+	if (err < 0)
+		goto err1;
 
 	if (pdata)
 		priv->irq_active_high = pdata->irq_active_high;
@@ -215,13 +218,13 @@
 
 	err = input_register_device(input);
 	if (err)
-		goto err1;
+		goto err2;
 
 	err = request_irq(priv->irq, eeti_ts_isr, irq_flags,
 			  client->name, priv);
 	if (err) {
 		dev_err(&client->dev, "Unable to request touchscreen IRQ.\n");
-		goto err2;
+		goto err3;
 	}
 
 	/*
@@ -233,9 +236,11 @@
 	device_init_wakeup(&client->dev, 0);
 	return 0;
 
-err2:
+err3:
 	input_unregister_device(input);
 	input = NULL; /* so we dont try to free it below */
+err2:
+	gpio_free(pdata->irq_gpio);
 err1:
 	input_free_device(input);
 	kfree(priv);
diff -druN linux-libre-3.2.27-gnu/drivers/mfd/ezx-pcap.c linux-libre-3.2.28-gnu/drivers/mfd/ezx-pcap.c
--- linux-libre-3.2.27-gnu/drivers/mfd/ezx-pcap.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/mfd/ezx-pcap.c	2012-08-19 13:15:38.000000000 -0400
@@ -202,7 +202,7 @@
 		}
 		local_irq_enable();
 		ezx_pcap_write(pcap, PCAP_REG_MSR, pcap->msr);
-	} while (gpio_get_value(irq_to_gpio(pcap->spi->irq)));
+	} while (gpio_get_value(pdata->gpio));
 }
 
 static void pcap_irq_handler(unsigned int irq, struct irq_desc *desc)
diff -druN linux-libre-3.2.27-gnu/drivers/net/caif/caif_serial.c linux-libre-3.2.28-gnu/drivers/net/caif/caif_serial.c
--- linux-libre-3.2.27-gnu/drivers/net/caif/caif_serial.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/caif/caif_serial.c	2012-08-19 13:15:38.000000000 -0400
@@ -325,6 +325,9 @@
 
 	sprintf(name, "cf%s", tty->name);
 	dev = alloc_netdev(sizeof(*ser), name, caifdev_setup);
+	if (!dev)
+		return -ENOMEM;
+
 	ser = netdev_priv(dev);
 	ser->tty = tty_kref_get(tty);
 	ser->dev = dev;
diff -druN linux-libre-3.2.27-gnu/drivers/net/ethernet/broadcom/bnx2.c linux-libre-3.2.28-gnu/drivers/net/ethernet/broadcom/bnx2.c
--- linux-libre-3.2.27-gnu/drivers/net/ethernet/broadcom/bnx2.c	2012-08-10 16:39:27.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/ethernet/broadcom/bnx2.c	2012-08-20 05:13:12.000000000 -0400
@@ -5374,7 +5374,7 @@
 			int k, last;
 
 			if (skb == NULL) {
-				j++;
+				j = NEXT_TX_BD(j);
 				continue;
 			}
 
@@ -5386,8 +5386,8 @@
 			tx_buf->skb = NULL;
 
 			last = tx_buf->nr_frags;
-			j++;
-			for (k = 0; k < last; k++, j++) {
+			j = NEXT_TX_BD(j);
+			for (k = 0; k < last; k++, j = NEXT_TX_BD(j)) {
 				tx_buf = &txr->tx_buf_ring[TX_RING_IDX(j)];
 				dma_unmap_page(&bp->pdev->dev,
 					dma_unmap_addr(tx_buf, mapping),
diff -druN linux-libre-3.2.27-gnu/drivers/net/ethernet/intel/e1000/e1000_main.c linux-libre-3.2.28-gnu/drivers/net/ethernet/intel/e1000/e1000_main.c
--- linux-libre-3.2.27-gnu/drivers/net/ethernet/intel/e1000/e1000_main.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/ethernet/intel/e1000/e1000_main.c	2012-08-19 13:15:38.000000000 -0400
@@ -4743,12 +4743,14 @@
 		e1000_setup_rctl(adapter);
 		e1000_set_rx_mode(netdev);
 
+		rctl = er32(RCTL);
+
 		/* turn on all-multi mode if wake on multicast is enabled */
-		if (wufc & E1000_WUFC_MC) {
-			rctl = er32(RCTL);
+		if (wufc & E1000_WUFC_MC)
 			rctl |= E1000_RCTL_MPE;
-			ew32(RCTL, rctl);
-		}
+
+		/* enable receives in the hardware */
+		ew32(RCTL, rctl | E1000_RCTL_EN);
 
 		if (hw->mac_type >= e1000_82540) {
 			ctrl = er32(CTRL);
diff -druN linux-libre-3.2.27-gnu/drivers/net/ethernet/intel/e1000e/82571.c linux-libre-3.2.28-gnu/drivers/net/ethernet/intel/e1000e/82571.c
--- linux-libre-3.2.27-gnu/drivers/net/ethernet/intel/e1000e/82571.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/ethernet/intel/e1000e/82571.c	2012-08-19 13:15:38.000000000 -0400
@@ -1600,10 +1600,8 @@
 			 * auto-negotiation in the TXCW register and disable
 			 * forced link in the Device Control register in an
 			 * attempt to auto-negotiate with our link partner.
-			 * If the partner code word is null, stop forcing
-			 * and restart auto negotiation.
 			 */
-			if ((rxcw & E1000_RXCW_C) || !(rxcw & E1000_RXCW_CW))  {
+			if (rxcw & E1000_RXCW_C) {
 				/* Enable autoneg, and unforce link up */
 				ew32(TXCW, mac->txcw);
 				ew32(CTRL, (ctrl & ~E1000_CTRL_SLU));
diff -druN linux-libre-3.2.27-gnu/drivers/net/tun.c linux-libre-3.2.28-gnu/drivers/net/tun.c
--- linux-libre-3.2.27-gnu/drivers/net/tun.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/tun.c	2012-08-19 13:15:38.000000000 -0400
@@ -1243,10 +1243,12 @@
 	int vnet_hdr_sz;
 	int ret;
 
-	if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
+	if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89) {
 		if (copy_from_user(&ifr, argp, ifreq_len))
 			return -EFAULT;
-
+	} else {
+		memset(&ifr, 0, sizeof(ifr));
+	}
 	if (cmd == TUNGETFEATURES) {
 		/* Currently this just means: "what IFF flags are valid?".
 		 * This is needed because we never checked for invalid flags on
diff -druN linux-libre-3.2.27-gnu/drivers/net/usb/kaweth.c linux-libre-3.2.28-gnu/drivers/net/usb/kaweth.c
--- linux-libre-3.2.27-gnu/drivers/net/usb/kaweth.c	2012-08-10 16:41:27.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/usb/kaweth.c	2012-08-20 05:14:58.000000000 -0400
@@ -1305,7 +1305,7 @@
         int retv;
         int length = 0; /* shut up GCC */
 
-        urb = usb_alloc_urb(0, GFP_NOIO);
+	urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!urb)
                 return -ENOMEM;
 
diff -druN linux-libre-3.2.27-gnu/drivers/net/wireless/ath/ath9k/hw.c linux-libre-3.2.28-gnu/drivers/net/wireless/ath/ath9k/hw.c
--- linux-libre-3.2.27-gnu/drivers/net/wireless/ath/ath9k/hw.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/wireless/ath/ath9k/hw.c	2012-08-19 13:15:38.000000000 -0400
@@ -674,6 +674,7 @@
 	case AR9300_DEVID_AR9340:
 	case AR9300_DEVID_AR9580:
 	case AR9300_DEVID_AR9462:
+	case AR9485_DEVID_AR1111:
 		break;
 	default:
 		if (common->bus_ops->ath_bus_type == ATH_USB)
diff -druN linux-libre-3.2.27-gnu/drivers/net/wireless/ath/ath9k/hw.h linux-libre-3.2.28-gnu/drivers/net/wireless/ath/ath9k/hw.h
--- linux-libre-3.2.27-gnu/drivers/net/wireless/ath/ath9k/hw.h	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/wireless/ath/ath9k/hw.h	2012-08-19 13:15:38.000000000 -0400
@@ -48,6 +48,7 @@
 #define AR9300_DEVID_AR9580	0x0033
 #define AR9300_DEVID_AR9462	0x0034
 #define AR9300_DEVID_AR9330	0x0035
+#define AR9485_DEVID_AR1111	0x0037
 
 #define AR5416_AR9100_DEVID	0x000b
 
diff -druN linux-libre-3.2.27-gnu/drivers/net/wireless/ath/ath9k/pci.c linux-libre-3.2.28-gnu/drivers/net/wireless/ath/ath9k/pci.c
--- linux-libre-3.2.27-gnu/drivers/net/wireless/ath/ath9k/pci.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/wireless/ath/ath9k/pci.c	2012-08-19 13:15:38.000000000 -0400
@@ -35,6 +35,7 @@
 	{ PCI_VDEVICE(ATHEROS, 0x0032) }, /* PCI-E  AR9485 */
 	{ PCI_VDEVICE(ATHEROS, 0x0033) }, /* PCI-E  AR9580 */
 	{ PCI_VDEVICE(ATHEROS, 0x0034) }, /* PCI-E  AR9462 */
+	{ PCI_VDEVICE(ATHEROS, 0x0037) }, /* PCI-E  AR1111/AR9485 */
 	{ 0 }
 };
 
diff -druN linux-libre-3.2.27-gnu/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-libre-3.2.28-gnu/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
--- linux-libre-3.2.27-gnu/drivers/net/wireless/iwlwifi/iwl-agn-rs.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/wireless/iwlwifi/iwl-agn-rs.c	2012-08-19 13:15:38.000000000 -0400
@@ -708,11 +708,14 @@
  */
 static bool rs_use_green(struct ieee80211_sta *sta)
 {
-	struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
-	struct iwl_rxon_context *ctx = sta_priv->ctx;
-
-	return (sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD) &&
-		!(ctx->ht.non_gf_sta_present);
+	/*
+	 * There's a bug somewhere in this code that causes the
+	 * scaling to get stuck because GF+SGI can't be combined
+	 * in SISO rates. Until we find that bug, disable GF, it
+	 * has only limited benefit and we still interoperate with
+	 * GF APs since we can always receive GF transmissions.
+	 */
+	return false;
 }
 
 /**
diff -druN linux-libre-3.2.27-gnu/drivers/net/wireless/rt2x00/rt61pci.c linux-libre-3.2.28-gnu/drivers/net/wireless/rt2x00/rt61pci.c
--- linux-libre-3.2.27-gnu/drivers/net/wireless/rt2x00/rt61pci.c	2012-08-10 16:43:45.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/wireless/rt2x00/rt61pci.c	2012-08-20 05:17:21.000000000 -0400
@@ -2243,8 +2243,7 @@
 
 static void rt61pci_wakeup(struct rt2x00_dev *rt2x00dev)
 {
-	struct ieee80211_conf conf = { .flags = 0 };
-	struct rt2x00lib_conf libconf = { .conf = &conf };
+	struct rt2x00lib_conf libconf = { .conf = &rt2x00dev->hw->conf };
 
 	rt61pci_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
 }
diff -druN linux-libre-3.2.27-gnu/drivers/net/wireless/rtlwifi/usb.c linux-libre-3.2.28-gnu/drivers/net/wireless/rtlwifi/usb.c
--- linux-libre-3.2.27-gnu/drivers/net/wireless/rtlwifi/usb.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/wireless/rtlwifi/usb.c	2012-08-19 13:15:38.000000000 -0400
@@ -120,15 +120,19 @@
 	u8 request;
 	u16 wvalue;
 	u16 index;
-	__le32 *data = &rtlpriv->usb_data[rtlpriv->usb_data_index];
+	__le32 *data;
+	unsigned long flags;
 
+	spin_lock_irqsave(&rtlpriv->locks.usb_lock, flags);
+	if (++rtlpriv->usb_data_index >= RTL_USB_MAX_RX_COUNT)
+		rtlpriv->usb_data_index = 0;
+	data = &rtlpriv->usb_data[rtlpriv->usb_data_index];
+	spin_unlock_irqrestore(&rtlpriv->locks.usb_lock, flags);
 	request = REALTEK_USB_VENQT_CMD_REQ;
 	index = REALTEK_USB_VENQT_CMD_IDX; /* n/a */
 
 	wvalue = (u16)addr;
 	_usbctrl_vendorreq_sync_read(udev, request, wvalue, index, data, len);
-	if (++rtlpriv->usb_data_index >= RTL_USB_MAX_RX_COUNT)
-		rtlpriv->usb_data_index = 0;
 	return le32_to_cpu(*data);
 }
 
@@ -909,6 +913,10 @@
 				    GFP_KERNEL);
 	if (!rtlpriv->usb_data)
 		return -ENOMEM;
+
+	/* this spin lock must be initialized early */
+	spin_lock_init(&rtlpriv->locks.usb_lock);
+
 	rtlpriv->usb_data_index = 0;
 	SET_IEEE80211_DEV(hw, &intf->dev);
 	udev = interface_to_usbdev(intf);
diff -druN linux-libre-3.2.27-gnu/drivers/net/wireless/rtlwifi/wifi.h linux-libre-3.2.28-gnu/drivers/net/wireless/rtlwifi/wifi.h
--- linux-libre-3.2.27-gnu/drivers/net/wireless/rtlwifi/wifi.h	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/drivers/net/wireless/rtlwifi/wifi.h	2012-08-19 13:15:38.000000000 -0400
@@ -1550,6 +1550,7 @@
 	spinlock_t rf_lock;
 	spinlock_t lps_lock;
 	spinlock_t waitq_lock;
+	spinlock_t usb_lock;
 
 	/*Dual mac*/
 	spinlock_t cck_and_rw_pagea_lock;
diff -druN linux-libre-3.2.27-gnu/fs/hfsplus/wrapper.c linux-libre-3.2.28-gnu/fs/hfsplus/wrapper.c
--- linux-libre-3.2.27-gnu/fs/hfsplus/wrapper.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/fs/hfsplus/wrapper.c	2012-08-19 13:15:38.000000000 -0400
@@ -56,7 +56,7 @@
 	DECLARE_COMPLETION_ONSTACK(wait);
 	struct bio *bio;
 	int ret = 0;
-	unsigned int io_size;
+	u64 io_size;
 	loff_t start;
 	int offset;
 
diff -druN linux-libre-3.2.27-gnu/include/linux/input/eeti_ts.h linux-libre-3.2.28-gnu/include/linux/input/eeti_ts.h
--- linux-libre-3.2.27-gnu/include/linux/input/eeti_ts.h	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/include/linux/input/eeti_ts.h	2012-08-19 13:15:38.000000000 -0400
@@ -2,6 +2,7 @@
 #define LINUX_INPUT_EETI_TS_H
 
 struct eeti_ts_platform_data {
+	int irq_gpio;
 	unsigned int irq_active_high;
 };
 
diff -druN linux-libre-3.2.27-gnu/include/linux/mfd/ezx-pcap.h linux-libre-3.2.28-gnu/include/linux/mfd/ezx-pcap.h
--- linux-libre-3.2.27-gnu/include/linux/mfd/ezx-pcap.h	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/include/linux/mfd/ezx-pcap.h	2012-08-19 13:15:38.000000000 -0400
@@ -16,6 +16,7 @@
 struct pcap_platform_data {
 	unsigned int irq_base;
 	unsigned int config;
+	int gpio;
 	void (*init) (void *);	/* board specific init */
 	int num_subdevs;
 	struct pcap_subdev *subdevs;
diff -druN linux-libre-3.2.27-gnu/Makefile linux-libre-3.2.28-gnu/Makefile
--- linux-libre-3.2.27-gnu/Makefile	2012-08-10 16:34:55.000000000 -0400
+++ linux-libre-3.2.28-gnu/Makefile	2012-08-20 05:08:42.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 2
-SUBLEVEL = 27
+SUBLEVEL = 28
 EXTRAVERSION =-gnu
 NAME = Saber-toothed Squirrel
 
diff -druN linux-libre-3.2.27-gnu/net/caif/caif_dev.c linux-libre-3.2.28-gnu/net/caif/caif_dev.c
--- linux-libre-3.2.27-gnu/net/caif/caif_dev.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/caif/caif_dev.c	2012-08-19 13:15:38.000000000 -0400
@@ -428,9 +428,9 @@
 
 static void __exit caif_device_exit(void)
 {
-	unregister_pernet_subsys(&caif_net_ops);
 	unregister_netdevice_notifier(&caif_device_notifier);
 	dev_remove_pack(&caif_packet_type);
+	unregister_pernet_subsys(&caif_net_ops);
 }
 
 module_init(caif_device_init);
diff -druN linux-libre-3.2.27-gnu/net/core/rtnetlink.c linux-libre-3.2.28-gnu/net/core/rtnetlink.c
--- linux-libre-3.2.27-gnu/net/core/rtnetlink.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/core/rtnetlink.c	2012-08-19 13:15:38.000000000 -0400
@@ -670,6 +670,12 @@
 	}
 }
 
+static unsigned int rtnl_dev_get_flags(const struct net_device *dev)
+{
+	return (dev->flags & ~(IFF_PROMISC | IFF_ALLMULTI)) |
+	       (dev->gflags & (IFF_PROMISC | IFF_ALLMULTI));
+}
+
 static unsigned int rtnl_dev_combine_flags(const struct net_device *dev,
 					   const struct ifinfomsg *ifm)
 {
@@ -678,7 +684,7 @@
 	/* bugwards compatibility: ifi_change == 0 is treated as ~0 */
 	if (ifm->ifi_change)
 		flags = (flags & ifm->ifi_change) |
-			(dev->flags & ~ifm->ifi_change);
+			(rtnl_dev_get_flags(dev) & ~ifm->ifi_change);
 
 	return flags;
 }
diff -druN linux-libre-3.2.27-gnu/net/ipv4/cipso_ipv4.c linux-libre-3.2.28-gnu/net/ipv4/cipso_ipv4.c
--- linux-libre-3.2.27-gnu/net/ipv4/cipso_ipv4.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/ipv4/cipso_ipv4.c	2012-08-19 13:15:38.000000000 -0400
@@ -1725,8 +1725,10 @@
 		case CIPSO_V4_TAG_LOCAL:
 			/* This is a non-standard tag that we only allow for
 			 * local connections, so if the incoming interface is
-			 * not the loopback device drop the packet. */
-			if (!(skb->dev->flags & IFF_LOOPBACK)) {
+			 * not the loopback device drop the packet. Further,
+			 * there is no legitimate reason for setting this from
+			 * userspace so reject it if skb is NULL. */
+			if (skb == NULL || !(skb->dev->flags & IFF_LOOPBACK)) {
 				err_offset = opt_iter;
 				goto validate_return_locked;
 			}
diff -druN linux-libre-3.2.27-gnu/net/ipv4/tcp.c linux-libre-3.2.28-gnu/net/ipv4/tcp.c
--- linux-libre-3.2.27-gnu/net/ipv4/tcp.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/ipv4/tcp.c	2012-08-19 13:15:38.000000000 -0400
@@ -2391,7 +2391,10 @@
 		/* Cap the max timeout in ms TCP will retry/retrans
 		 * before giving up and aborting (ETIMEDOUT) a connection.
 		 */
-		icsk->icsk_user_timeout = msecs_to_jiffies(val);
+		if (val < 0)
+			err = -EINVAL;
+		else
+			icsk->icsk_user_timeout = msecs_to_jiffies(val);
 		break;
 	default:
 		err = -ENOPROTOOPT;
diff -druN linux-libre-3.2.27-gnu/net/ipv4/tcp_input.c linux-libre-3.2.28-gnu/net/ipv4/tcp_input.c
--- linux-libre-3.2.27-gnu/net/ipv4/tcp_input.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/ipv4/tcp_input.c	2012-08-19 13:15:38.000000000 -0400
@@ -5415,7 +5415,9 @@
 			if (tp->copied_seq == tp->rcv_nxt &&
 			    len - tcp_header_len <= tp->ucopy.len) {
 #ifdef CONFIG_NET_DMA
-				if (tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
+				if (tp->ucopy.task == current &&
+				    sock_owned_by_user(sk) &&
+				    tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
 					copied_early = 1;
 					eaten = 1;
 				}
diff -druN linux-libre-3.2.27-gnu/net/mac80211/mesh.c linux-libre-3.2.28-gnu/net/mac80211/mesh.c
--- linux-libre-3.2.27-gnu/net/mac80211/mesh.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/mac80211/mesh.c	2012-08-19 13:15:38.000000000 -0400
@@ -543,6 +543,7 @@
 
 	del_timer_sync(&sdata->u.mesh.housekeeping_timer);
 	del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
+	del_timer_sync(&sdata->u.mesh.mesh_path_timer);
 	/*
 	 * If the timer fired while we waited for it, it will have
 	 * requeued the work. Now the work will be running again
diff -druN linux-libre-3.2.27-gnu/net/sched/sch_sfb.c linux-libre-3.2.28-gnu/net/sched/sch_sfb.c
--- linux-libre-3.2.27-gnu/net/sched/sch_sfb.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/sched/sch_sfb.c	2012-08-19 13:15:38.000000000 -0400
@@ -559,6 +559,8 @@
 
 	sch->qstats.backlog = q->qdisc->qstats.backlog;
 	opts = nla_nest_start(skb, TCA_OPTIONS);
+	if (opts == NULL)
+		goto nla_put_failure;
 	NLA_PUT(skb, TCA_SFB_PARMS, sizeof(opt), &opt);
 	return nla_nest_end(skb, opts);
 
diff -druN linux-libre-3.2.27-gnu/net/sctp/input.c linux-libre-3.2.28-gnu/net/sctp/input.c
--- linux-libre-3.2.27-gnu/net/sctp/input.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/sctp/input.c	2012-08-19 13:15:38.000000000 -0400
@@ -736,15 +736,12 @@
 
 	epb = &ep->base;
 
-	if (hlist_unhashed(&epb->node))
-		return;
-
 	epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
 
 	head = &sctp_ep_hashtable[epb->hashent];
 
 	sctp_write_lock(&head->lock);
-	__hlist_del(&epb->node);
+	hlist_del_init(&epb->node);
 	sctp_write_unlock(&head->lock);
 }
 
@@ -825,7 +822,7 @@
 	head = &sctp_assoc_hashtable[epb->hashent];
 
 	sctp_write_lock(&head->lock);
-	__hlist_del(&epb->node);
+	hlist_del_init(&epb->node);
 	sctp_write_unlock(&head->lock);
 }
 
diff -druN linux-libre-3.2.27-gnu/net/sctp/socket.c linux-libre-3.2.28-gnu/net/sctp/socket.c
--- linux-libre-3.2.27-gnu/net/sctp/socket.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/sctp/socket.c	2012-08-19 13:15:38.000000000 -0400
@@ -1231,8 +1231,14 @@
 	SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p"
 			  " kaddrs: %p err: %d\n",
 			  asoc, kaddrs, err);
-	if (asoc)
+	if (asoc) {
+		/* sctp_primitive_ASSOCIATE may have added this association
+		 * To the hash table, try to unhash it, just in case, its a noop
+		 * if it wasn't hashed so we're safe
+		 */
+		sctp_unhash_established(asoc);
 		sctp_association_free(asoc);
+	}
 	return err;
 }
 
@@ -1942,8 +1948,10 @@
 	goto out_unlock;
 
 out_free:
-	if (new_asoc)
+	if (new_asoc) {
+		sctp_unhash_established(asoc);
 		sctp_association_free(asoc);
+	}
 out_unlock:
 	sctp_release_sock(sk);
 
diff -druN linux-libre-3.2.27-gnu/net/wanrouter/wanmain.c linux-libre-3.2.28-gnu/net/wanrouter/wanmain.c
--- linux-libre-3.2.27-gnu/net/wanrouter/wanmain.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/wanrouter/wanmain.c	2012-08-19 13:15:38.000000000 -0400
@@ -602,36 +602,31 @@
 		 * successfully, add it to the interface list.
 		 */
 
-		if (dev->name == NULL) {
-			err = -EINVAL;
-		} else {
-
-			#ifdef WANDEBUG
-			printk(KERN_INFO "%s: registering interface %s...\n",
-				wanrouter_modname, dev->name);
-			#endif
-
-			err = register_netdev(dev);
-			if (!err) {
-				struct net_device *slave = NULL;
-				unsigned long smp_flags=0;
+#ifdef WANDEBUG
+		printk(KERN_INFO "%s: registering interface %s...\n",
+		       wanrouter_modname, dev->name);
+#endif
 
-				lock_adapter_irq(&wandev->lock, &smp_flags);
+		err = register_netdev(dev);
+		if (!err) {
+			struct net_device *slave = NULL;
+			unsigned long smp_flags=0;
 
-				if (wandev->dev == NULL) {
-					wandev->dev = dev;
-				} else {
-					for (slave=wandev->dev;
-					     DEV_TO_SLAVE(slave);
-					     slave = DEV_TO_SLAVE(slave))
-						DEV_TO_SLAVE(slave) = dev;
-				}
-				++wandev->ndev;
+			lock_adapter_irq(&wandev->lock, &smp_flags);
 
-				unlock_adapter_irq(&wandev->lock, &smp_flags);
-				err = 0;	/* done !!! */
-				goto out;
+			if (wandev->dev == NULL) {
+				wandev->dev = dev;
+			} else {
+				for (slave=wandev->dev;
+				     DEV_TO_SLAVE(slave);
+				     slave = DEV_TO_SLAVE(slave))
+					DEV_TO_SLAVE(slave) = dev;
 			}
+			++wandev->ndev;
+
+			unlock_adapter_irq(&wandev->lock, &smp_flags);
+			err = 0;	/* done !!! */
+			goto out;
 		}
 		if (wandev->del_if)
 			wandev->del_if(wandev, dev);
diff -druN linux-libre-3.2.27-gnu/net/wireless/core.c linux-libre-3.2.28-gnu/net/wireless/core.c
--- linux-libre-3.2.27-gnu/net/wireless/core.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/wireless/core.c	2012-08-19 13:15:38.000000000 -0400
@@ -971,6 +971,11 @@
 		 */
 		synchronize_rcu();
 		INIT_LIST_HEAD(&wdev->list);
+		/*
+		 * Ensure that all events have been processed and
+		 * freed.
+		 */
+		cfg80211_process_wdev_events(wdev);
 		break;
 	case NETDEV_PRE_UP:
 		if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
diff -druN linux-libre-3.2.27-gnu/net/wireless/core.h linux-libre-3.2.28-gnu/net/wireless/core.h
--- linux-libre-3.2.27-gnu/net/wireless/core.h	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/wireless/core.h	2012-08-19 13:15:38.000000000 -0400
@@ -426,6 +426,7 @@
 			  struct net_device *dev, enum nl80211_iftype ntype,
 			  u32 *flags, struct vif_params *params);
 void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
+void cfg80211_process_wdev_events(struct wireless_dev *wdev);
 
 int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
 				  struct wireless_dev *wdev,
diff -druN linux-libre-3.2.27-gnu/net/wireless/util.c linux-libre-3.2.28-gnu/net/wireless/util.c
--- linux-libre-3.2.27-gnu/net/wireless/util.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/net/wireless/util.c	2012-08-19 13:15:38.000000000 -0400
@@ -725,7 +725,7 @@
 	wdev->connect_keys = NULL;
 }
 
-static void cfg80211_process_wdev_events(struct wireless_dev *wdev)
+void cfg80211_process_wdev_events(struct wireless_dev *wdev)
 {
 	struct cfg80211_event *ev;
 	unsigned long flags;
diff -druN linux-libre-3.2.27-gnu/sound/pci/hda/patch_conexant.c linux-libre-3.2.28-gnu/sound/pci/hda/patch_conexant.c
--- linux-libre-3.2.27-gnu/sound/pci/hda/patch_conexant.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/sound/pci/hda/patch_conexant.c	2012-08-19 13:15:38.000000000 -0400
@@ -3059,7 +3059,6 @@
 	SND_PCI_QUIRK(0x1028, 0x02d8, "Dell Vostro", CXT5066_DELL_VOSTRO),
 	SND_PCI_QUIRK(0x1028, 0x02f5, "Dell Vostro 320", CXT5066_IDEAPAD),
 	SND_PCI_QUIRK(0x1028, 0x0401, "Dell Vostro 1014", CXT5066_DELL_VOSTRO),
-	SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTRO),
 	SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
 	SND_PCI_QUIRK(0x1028, 0x050f, "Dell Inspiron", CXT5066_IDEAPAD),
 	SND_PCI_QUIRK(0x1028, 0x0510, "Dell Vostro", CXT5066_IDEAPAD),
diff -druN linux-libre-3.2.27-gnu/sound/pci/hda/patch_realtek.c linux-libre-3.2.28-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-3.2.27-gnu/sound/pci/hda/patch_realtek.c	2012-08-09 19:25:22.000000000 -0400
+++ linux-libre-3.2.28-gnu/sound/pci/hda/patch_realtek.c	2012-08-19 13:15:38.000000000 -0400
@@ -4981,6 +4981,8 @@
 	[ALC269_FIXUP_PCM_44K] = {
 		.type = ALC_FIXUP_FUNC,
 		.v.func = alc269_fixup_pcm_44k,
+		.chained = true,
+		.chain_id = ALC269_FIXUP_QUANTA_MUTE
 	},
 	[ALC269_FIXUP_STEREO_DMIC] = {
 		.type = ALC_FIXUP_FUNC,
@@ -5077,9 +5079,10 @@
 	SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE),
 	SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
 	SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK),
+	SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
+	SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK),
-	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_QUANTA_MUTE),
-	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Lenovo Ideapd", ALC269_FIXUP_PCM_44K),
+	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
 	SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
 
 #if 1
