34 files changed, 242 insertions, 111 deletions

diff --git a/Makefile b/Makefile
index 037ff4e62ca0..886bf04931d4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 35
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Sheep on Meth
 
 # *DOCUMENTATION*
diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
index abdf321c2d41..c5555ca13d00 100644
--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
+++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
@@ -175,6 +175,10 @@ static void __init rx51_add_gpio_keys(void)
 #endif /* CONFIG_KEYBOARD_GPIO || CONFIG_KEYBOARD_GPIO_MODULE */
 
 static int board_keymap[] = {
+        /*
+         * Note that KEY(x, 8, KEY_XXX) entries represent "entrire row
+         * connected to the ground" matrix state.
+         */
         KEY(0, 0, KEY_Q),
         KEY(0, 1, KEY_O),
         KEY(0, 2, KEY_P),
@@ -182,6 +186,7 @@ static int board_keymap[] = {
         KEY(0, 4, KEY_BACKSPACE),
         KEY(0, 6, KEY_A),
         KEY(0, 7, KEY_S),
+
         KEY(1, 0, KEY_W),
         KEY(1, 1, KEY_D),
         KEY(1, 2, KEY_F),
@@ -190,6 +195,7 @@ static int board_keymap[] = {
         KEY(1, 5, KEY_J),
         KEY(1, 6, KEY_K),
         KEY(1, 7, KEY_L),
+
         KEY(2, 0, KEY_E),
         KEY(2, 1, KEY_DOT),
         KEY(2, 2, KEY_UP),
@@ -197,6 +203,8 @@ static int board_keymap[] = {
         KEY(2, 5, KEY_Z),
         KEY(2, 6, KEY_X),
         KEY(2, 7, KEY_C),
+        KEY(2, 8, KEY_F9),
+
         KEY(3, 0, KEY_R),
         KEY(3, 1, KEY_V),
         KEY(3, 2, KEY_B),
@@ -205,20 +213,23 @@ static int board_keymap[] = {
         KEY(3, 5, KEY_SPACE),
         KEY(3, 6, KEY_SPACE),
         KEY(3, 7, KEY_LEFT),
+
         KEY(4, 0, KEY_T),
         KEY(4, 1, KEY_DOWN),
         KEY(4, 2, KEY_RIGHT),
         KEY(4, 4, KEY_LEFTCTRL),
         KEY(4, 5, KEY_RIGHTALT),
         KEY(4, 6, KEY_LEFTSHIFT),
+        KEY(4, 8, KEY_10),
+
         KEY(5, 0, KEY_Y),
+        KEY(5, 8, KEY_11),
+
         KEY(6, 0, KEY_U),
+
         KEY(7, 0, KEY_I),
         KEY(7, 1, KEY_F7),
         KEY(7, 2, KEY_F8),
-        KEY(0xff, 2, KEY_F9),
-        KEY(0xff, 4, KEY_F10),
-        KEY(0xff, 5, KEY_F11),
 };
 
 static struct matrix_keymap_data board_map_data = {
diff --git a/arch/powerpc/include/asm/mmu-hash64.h b/arch/powerpc/include/asm/mmu-hash64.h
index 2102b214a87c..0e398cfee2c8 100644
--- a/arch/powerpc/include/asm/mmu-hash64.h
+++ b/arch/powerpc/include/asm/mmu-hash64.h
@@ -250,7 +250,9 @@ extern int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
 int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
                      pte_t *ptep, unsigned long trap, int local, int ssize,
                      unsigned int shift, unsigned int mmu_psize);
-
+extern void hash_failure_debug(unsigned long ea, unsigned long access,
+                               unsigned long vsid, unsigned long trap,
+                               int ssize, int psize, unsigned long pte);
 extern int htab_bolt_mapping(unsigned long vstart, unsigned long vend,
                              unsigned long pstart, unsigned long prot,
                              int psize, int ssize);
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 9d3953983fb7..fed9bf6187d1 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -414,7 +414,7 @@ static int __init early_init_dt_scan_drconf_memory(unsigned long node)
         u64 base, size, memblock_size;
         unsigned int is_kexec_kdump = 0, rngs;
 
-        ls = of_get_flat_dt_prop(node, "ibm,memblock-size", &l);
+        ls = of_get_flat_dt_prop(node, "ibm,lmb-size", &l);
         if (ls == NULL || l < dt_root_size_cells * sizeof(__be32))
                 return 0;
         memblock_size = dt_mem_next_cell(dt_root_size_cells, &ls);
diff --git a/arch/powerpc/mm/hash_low_64.S b/arch/powerpc/mm/hash_low_64.S
index a719f53921a5..3079f6b44cf5 100644
--- a/arch/powerpc/mm/hash_low_64.S
+++ b/arch/powerpc/mm/hash_low_64.S
@@ -68,9 +68,6 @@ _GLOBAL(__hash_page_4K)
         std     r8,STK_PARM(r8)(r1)
         std     r9,STK_PARM(r9)(r1)
         
-        /* Add _PAGE_PRESENT to access */
-        ori     r4,r4,_PAGE_PRESENT
-
         /* Save non-volatile registers.
          * r31 will hold "old PTE"
          * r30 is "new PTE"
@@ -347,9 +344,6 @@ _GLOBAL(__hash_page_4K)
         std     r8,STK_PARM(r8)(r1)
         std     r9,STK_PARM(r9)(r1)
 
-        /* Add _PAGE_PRESENT to access */
-        ori     r4,r4,_PAGE_PRESENT
-
         /* Save non-volatile registers.
          * r31 will hold "old PTE"
          * r30 is "new PTE"
@@ -687,9 +681,6 @@ _GLOBAL(__hash_page_64K)
         std     r8,STK_PARM(r8)(r1)
         std     r9,STK_PARM(r9)(r1)
 
-        /* Add _PAGE_PRESENT to access */
-        ori     r4,r4,_PAGE_PRESENT
-
         /* Save non-volatile registers.
          * r31 will hold "old PTE"
          * r30 is "new PTE"
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 98f262de5585..09dffe6efa46 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -871,6 +871,18 @@ static inline int subpage_protection(struct mm_struct *mm, unsigned long ea)
 }
 #endif
 
+void hash_failure_debug(unsigned long ea, unsigned long access,
+                        unsigned long vsid, unsigned long trap,
+                        int ssize, int psize, unsigned long pte)
+{
+        if (!printk_ratelimit())
+                return;
+        pr_info("mm: Hashing failure ! EA=0x%lx access=0x%lx current=%s\n",
+                ea, access, current->comm);
+        pr_info("    trap=0x%lx vsid=0x%lx ssize=%d psize=%d pte=0x%lx\n",
+                trap, vsid, ssize, psize, pte);
+}
+
 /* Result code is:
  *  0 - handled
  *  1 - normal page fault
@@ -955,6 +967,17 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
                 return 1;
         }
 
+        /* Add _PAGE_PRESENT to the required access perm */
+        access |= _PAGE_PRESENT;
+
+        /* Pre-check access permissions (will be re-checked atomically
+         * in __hash_page_XX but this pre-check is a fast path
+         */
+        if (access & ~pte_val(*ptep)) {
+                DBG_LOW(" no access !\n");
+                return 1;
+        }
+
 #ifdef CONFIG_HUGETLB_PAGE
         if (hugeshift)
                 return __hash_page_huge(ea, access, vsid, ptep, trap, local,
@@ -967,14 +990,6 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
         DBG_LOW(" i-pte: %016lx %016lx\n", pte_val(*ptep),
                 pte_val(*(ptep + PTRS_PER_PTE)));
 #endif
-        /* Pre-check access permissions (will be re-checked atomically
-         * in __hash_page_XX but this pre-check is a fast path
-         */
-        if (access & ~pte_val(*ptep)) {
-                DBG_LOW(" no access !\n");
-                return 1;
-        }
-
         /* Do actual hashing */
 #ifdef CONFIG_PPC_64K_PAGES
         /* If _PAGE_4K_PFN is set, make sure this is a 4k segment */
@@ -1033,6 +1048,12 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
                                             local, ssize, spp);
         }
 
+        /* Dump some info in case of hash insertion failure, they should
+         * never happen so it is really useful to know if/when they do
+         */
+        if (rc == -1)
+                hash_failure_debug(ea, access, vsid, trap, ssize, psize,
+                                   pte_val(*ptep));
 #ifndef CONFIG_PPC_64K_PAGES
         DBG_LOW(" o-pte: %016lx\n", pte_val(*ptep));
 #else
@@ -1051,8 +1072,7 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
         void *pgdir;
         pte_t *ptep;
         unsigned long flags;
-        int local = 0;
-        int ssize;
+        int rc, ssize, local = 0;
 
         BUG_ON(REGION_ID(ea) != USER_REGION_ID);
 
@@ -1098,11 +1118,18 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
         /* Hash it in */
 #ifdef CONFIG_PPC_HAS_HASH_64K
         if (mm->context.user_psize == MMU_PAGE_64K)
-                __hash_page_64K(ea, access, vsid, ptep, trap, local, ssize);
+                rc = __hash_page_64K(ea, access, vsid, ptep, trap, local, ssize);
         else
 #endif /* CONFIG_PPC_HAS_HASH_64K */
-                __hash_page_4K(ea, access, vsid, ptep, trap, local, ssize,
-                               subpage_protection(pgdir, ea));
+                rc = __hash_page_4K(ea, access, vsid, ptep, trap, local, ssize,
+                                    subpage_protection(pgdir, ea));
+
+        /* Dump some info in case of hash insertion failure, they should
+         * never happen so it is really useful to know if/when they do
+         */
+        if (rc == -1)
+                hash_failure_debug(ea, access, vsid, trap, ssize,
+                                   mm->context.user_psize, pte_val(*ptep));
 
         local_irq_restore(flags);
 }
diff --git a/arch/powerpc/mm/hugetlbpage-hash64.c b/arch/powerpc/mm/hugetlbpage-hash64.c
index 199539882f92..cc5c273086cf 100644
--- a/arch/powerpc/mm/hugetlbpage-hash64.c
+++ b/arch/powerpc/mm/hugetlbpage-hash64.c
@@ -21,21 +21,13 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
         unsigned long old_pte, new_pte;
         unsigned long va, rflags, pa, sz;
         long slot;
-        int err = 1;
 
         BUG_ON(shift != mmu_psize_defs[mmu_psize].shift);
 
         /* Search the Linux page table for a match with va */
         va = hpt_va(ea, vsid, ssize);
 
-        /*
-         * Check the user's access rights to the page.  If access should be
-         * prevented then send the problem up to do_page_fault.
-         */
-        if (unlikely(access & ~pte_val(*ptep)))
-                goto out;
-        /*
-         * At this point, we have a pte (old_pte) which can be used to build
+        /* At this point, we have a pte (old_pte) which can be used to build
          * or update an HPTE. There are 2 cases:
          *
          * 1. There is a valid (present) pte with no associated HPTE (this is
@@ -49,9 +41,17 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
 
         do {
                 old_pte = pte_val(*ptep);
-                if (old_pte & _PAGE_BUSY)
-                        goto out;
+                /* If PTE busy, retry the access */
+                if (unlikely(old_pte & _PAGE_BUSY))
+                        return 0;
+                /* If PTE permissions don't match, take page fault */
+                if (unlikely(access & ~old_pte))
+                        return 1;
+                /* Try to lock the PTE, add ACCESSED and DIRTY if it was
+                 * a write access */
                 new_pte = old_pte | _PAGE_BUSY | _PAGE_ACCESSED;
+                if (access & _PAGE_RW)
+                        new_pte |= _PAGE_DIRTY;
         } while(old_pte != __cmpxchg_u64((unsigned long *)ptep,
                                          old_pte, new_pte));
 
@@ -121,8 +121,16 @@ repeat:
                         }
                 }
 
-                if (unlikely(slot == -2))
-                        panic("hash_huge_page: pte_insert failed\n");
+                /*
+                 * Hypervisor failure. Restore old pte and return -1
+                 * similar to __hash_page_*
+                 */
+                if (unlikely(slot == -2)) {
+                        *ptep = __pte(old_pte);
+                        hash_failure_debug(ea, access, vsid, trap, ssize,
+                                           mmu_psize, old_pte);
+                        return -1;
+                }
 
                 new_pte |= (slot << 12) & (_PAGE_F_SECOND | _PAGE_F_GIX);
         }
@@ -131,9 +139,5 @@ repeat:
          * No need to use ldarx/stdcx here
          */
         *ptep = __pte(new_pte & ~_PAGE_BUSY);
-
-        err = 0;
-
- out:
-        return err;
+        return 0;
 }
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index f47364585ecd..aa731af720c0 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -398,15 +398,15 @@ static int of_get_drconf_memory(struct device_node *memory, const u32 **dm)
 }
 
 /*
- * Retreive and validate the ibm,memblock-size property for drconf memory
+ * Retreive and validate the ibm,lmb-size property for drconf memory
  * from the device tree.
  */
-static u64 of_get_memblock_size(struct device_node *memory)
+static u64 of_get_lmb_size(struct device_node *memory)
 {
         const u32 *prop;
         u32 len;
 
-        prop = of_get_property(memory, "ibm,memblock-size", &len);
+        prop = of_get_property(memory, "ibm,lmb-size", &len);
         if (!prop || len < sizeof(unsigned int))
                 return 0;
 
@@ -562,7 +562,7 @@ static unsigned long __init numa_enforce_memory_limit(unsigned long start,
 static inline int __init read_usm_ranges(const u32 **usm)
 {
         /*
-         * For each memblock in ibm,dynamic-memory a corresponding
+         * For each lmb in ibm,dynamic-memory a corresponding
          * entry in linux,drconf-usable-memory property contains
          * a counter followed by that many (base, size) duple.
          * read the counter from linux,drconf-usable-memory
@@ -578,7 +578,7 @@ static void __init parse_drconf_memory(struct device_node *memory)
 {
         const u32 *dm, *usm;
         unsigned int n, rc, ranges, is_kexec_kdump = 0;
-        unsigned long memblock_size, base, size, sz;
+        unsigned long lmb_size, base, size, sz;
         int nid;
         struct assoc_arrays aa;
 
@@ -586,8 +586,8 @@ static void __init parse_drconf_memory(struct device_node *memory)
         if (!n)
                 return;
 
-        memblock_size = of_get_memblock_size(memory);
-        if (!memblock_size)
+        lmb_size = of_get_lmb_size(memory);
+        if (!lmb_size)
                 return;
 
         rc = of_get_assoc_arrays(memory, &aa);
@@ -611,7 +611,7 @@ static void __init parse_drconf_memory(struct device_node *memory)
                         continue;
 
                 base = drmem.base_addr;
-                size = memblock_size;
+                size = lmb_size;
                 ranges = 1;
 
                 if (is_kexec_kdump) {
@@ -1072,7 +1072,7 @@ static int hot_add_drconf_scn_to_nid(struct device_node *memory,
 {
         const u32 *dm;
         unsigned int drconf_cell_cnt, rc;
-        unsigned long memblock_size;
+        unsigned long lmb_size;
         struct assoc_arrays aa;
         int nid = -1;
 
@@ -1080,8 +1080,8 @@ static int hot_add_drconf_scn_to_nid(struct device_node *memory,
         if (!drconf_cell_cnt)
                 return -1;
 
-        memblock_size = of_get_memblock_size(memory);
-        if (!memblock_size)
+        lmb_size = of_get_lmb_size(memory);
+        if (!lmb_size)
                 return -1;
 
         rc = of_get_assoc_arrays(memory, &aa);
@@ -1100,7 +1100,7 @@ static int hot_add_drconf_scn_to_nid(struct device_node *memory,
                         continue;
 
                 if ((scn_addr < drmem.base_addr)
-                    || (scn_addr >= (drmem.base_addr + memblock_size)))
+                    || (scn_addr >= (drmem.base_addr + lmb_size)))
                         continue;
 
                 nid = of_drconf_to_nid_single(&drmem, &aa);
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index deab5f946090..bc8803664140 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -69,7 +69,7 @@ static int pseries_remove_memory(struct device_node *np)
         const char *type;
         const unsigned int *regs;
         unsigned long base;
-        unsigned int memblock_size;
+        unsigned int lmb_size;
         int ret = -EINVAL;
 
         /*
@@ -87,9 +87,9 @@ static int pseries_remove_memory(struct device_node *np)
                 return ret;
 
         base = *(unsigned long *)regs;
-        memblock_size = regs[3];
+        lmb_size = regs[3];
 
-        ret = pseries_remove_memblock(base, memblock_size);
+        ret = pseries_remove_memblock(base, lmb_size);
         return ret;
 }
 
@@ -98,7 +98,7 @@ static int pseries_add_memory(struct device_node *np)
         const char *type;
         const unsigned int *regs;
         unsigned long base;
-        unsigned int memblock_size;
+        unsigned int lmb_size;
         int ret = -EINVAL;
 
         /*
@@ -116,36 +116,36 @@ static int pseries_add_memory(struct device_node *np)
                 return ret;
 
         base = *(unsigned long *)regs;
-        memblock_size = regs[3];
+        lmb_size = regs[3];
 
         /*
          * Update memory region to represent the memory add
          */
-        ret = memblock_add(base, memblock_size);
+        ret = memblock_add(base, lmb_size);
         return (ret < 0) ? -EINVAL : 0;
 }
 
 static int pseries_drconf_memory(unsigned long *base, unsigned int action)
 {
         struct device_node *np;
-        const unsigned long *memblock_size;
+        const unsigned long *lmb_size;
         int rc;
 
         np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory");
         if (!np)
                 return -EINVAL;
 
-        memblock_size = of_get_property(np, "ibm,memblock-size", NULL);
-        if (!memblock_size) {
+        lmb_size = of_get_property(np, "ibm,lmb-size", NULL);
+        if (!lmb_size) {
                 of_node_put(np);
                 return -EINVAL;
         }
 
         if (action == PSERIES_DRCONF_MEM_ADD) {
-                rc = memblock_add(*base, *memblock_size);
+                rc = memblock_add(*base, *lmb_size);
                 rc = (rc < 0) ? -EINVAL : 0;
         } else if (action == PSERIES_DRCONF_MEM_REMOVE) {
-                rc = pseries_remove_memblock(*base, *memblock_size);
+                rc = pseries_remove_memblock(*base, *lmb_size);
         } else {
                 rc = -EINVAL;
         }
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 0697ff139837..4db7c4d12ffa 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -571,8 +571,8 @@ auditsys:
          * masked off.
          */
 sysret_audit:
-        movq %rax,%rsi          /* second arg, syscall return value */
-        cmpq $0,%rax            /* is it < 0? */
+        movq RAX-ARGOFFSET(%rsp),%rsi   /* second arg, syscall return value */
+        cmpq $0,%rsi            /* is it < 0? */
         setl %al                /* 1 if so, 0 if not */
         movzbl %al,%edi         /* zero-extend that into %edi */
         inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 5d64e3acb000..878ac0c2cc68 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -493,7 +493,7 @@ static void __sysrq_put_key_op(int key, struct sysrq_key_op *op_p)
                 sysrq_key_table[i] = op_p;
 }
 
-static void __handle_sysrq(int key, struct tty_struct *tty, int check_mask)
+void __handle_sysrq(int key, struct tty_struct *tty, int check_mask)
 {
         struct sysrq_key_op *op_p;
         int orig_log_level;
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 637c105f53d2..bd78acf3c365 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1183,10 +1183,14 @@ static size_t sg_copy_end_to_buffer(struct scatterlist *sgl, unsigned int nents,
                                 /* Copy part of this segment */
                                 ignore = skip - offset;
                                 len = miter.length - ignore;
+                                if (boffset + len > buflen)
+                                        len = buflen - boffset;
                                 memcpy(buf + boffset, miter.addr + ignore, len);
                         } else {
-                                /* Copy all of this segment */
+                                /* Copy all of this segment (up to buflen) */
                                 len = miter.length;
+                                if (boffset + len > buflen)
+                                        len = buflen - boffset;
                                 memcpy(buf + boffset, miter.addr, len);
                         }
                         boffset += len;
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 010963d4570f..345a75a03c96 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -333,7 +333,6 @@ static int evergreen_cs_packet_parse_vline(struct radeon_cs_parser *p)
         header = radeon_get_ib_value(p, h_idx);
         crtc_id = radeon_get_ib_value(p, h_idx + 2 + 7 + 1);
         reg = CP_PACKET0_GET_REG(header);
-        mutex_lock(&p->rdev->ddev->mode_config.mutex);
         obj = drm_mode_object_find(p->rdev->ddev, crtc_id, DRM_MODE_OBJECT_CRTC);
         if (!obj) {
                 DRM_ERROR("cannot find crtc %d\n", crtc_id);
@@ -368,7 +367,6 @@ static int evergreen_cs_packet_parse_vline(struct radeon_cs_parser *p)
                 }
         }
 out:
-        mutex_unlock(&p->rdev->ddev->mode_config.mutex);
         return r;
 }
 
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index aab5ba040bd6..a89a15ab524d 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1230,7 +1230,6 @@ int r100_cs_packet_parse_vline(struct radeon_cs_parser *p)
         header = radeon_get_ib_value(p, h_idx);
         crtc_id = radeon_get_ib_value(p, h_idx + 5);
         reg = CP_PACKET0_GET_REG(header);
-        mutex_lock(&p->rdev->ddev->mode_config.mutex);
         obj = drm_mode_object_find(p->rdev->ddev, crtc_id, DRM_MODE_OBJECT_CRTC);
         if (!obj) {
                 DRM_ERROR("cannot find crtc %d\n", crtc_id);
@@ -1264,7 +1263,6 @@ int r100_cs_packet_parse_vline(struct radeon_cs_parser *p)
                 ib[h_idx + 3] |= RADEON_ENG_DISPLAY_SELECT_CRTC1;
         }
 out:
-        mutex_unlock(&p->rdev->ddev->mode_config.mutex);
         return r;
 }
 
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index c39c1bc13016..144c32d37136 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -585,7 +585,7 @@ static int r600_cs_packet_parse_vline(struct radeon_cs_parser *p)
         header = radeon_get_ib_value(p, h_idx);
         crtc_id = radeon_get_ib_value(p, h_idx + 2 + 7 + 1);
         reg = CP_PACKET0_GET_REG(header);
-        mutex_lock(&p->rdev->ddev->mode_config.mutex);
+
         obj = drm_mode_object_find(p->rdev->ddev, crtc_id, DRM_MODE_OBJECT_CRTC);
         if (!obj) {
                 DRM_ERROR("cannot find crtc %d\n", crtc_id);
@@ -620,7 +620,6 @@ static int r600_cs_packet_parse_vline(struct radeon_cs_parser *p)
                 ib[h_idx + 4] = AVIVO_D2MODE_VLINE_STATUS >> 2;
         }
 out:
-        mutex_unlock(&p->rdev->ddev->mode_config.mutex);
         return r;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index d1c1d8dd93ce..2417d7b06fdb 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -3050,6 +3050,14 @@ void radeon_combios_asic_init(struct drm_device *dev)
             rdev->pdev->subsystem_device == 0x308b)
                 return;
 
+        /* quirk for rs4xx HP dv5000 laptop to make it resume
+         * - it hangs on resume inside the dynclk 1 table.
+         */
+        if (rdev->family == CHIP_RS480 &&
+            rdev->pdev->subsystem_vendor == 0x103c &&
+            rdev->pdev->subsystem_device == 0x30a4)
+                return;
+
         /* DYN CLK 1 */
         table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
         if (table)
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 6a70c0dc7f92..ab389f89fa8d 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -128,7 +128,8 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                 for (i = 0, found = 0; i < rdev->num_crtc; i++) {
                         crtc = (struct drm_crtc *)minfo->crtcs[i];
                         if (crtc && crtc->base.id == value) {
-                                value = i;
+                                struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+                                value = radeon_crtc->crtc_id;
                                 found = 1;
                                 break;
                         }
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index bad77f40a9da..5688a0cf6bbe 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -108,6 +108,7 @@ static void radeon_legacy_lvds_dpms(struct drm_encoder *encoder, int mode)
                 udelay(panel_pwr_delay * 1000);
                 WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
                 WREG32_PLL(RADEON_PIXCLKS_CNTL, pixclks_cntl);
+                udelay(panel_pwr_delay * 1000);
                 break;
         }
 
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index d233c65f3f7f..ca904799f018 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -40,13 +40,13 @@
 #include <linux/slab.h>
 
 #include <asm/atomic.h>
-#ifdef TTM_HAS_AGP
-#include <asm/agp.h>
-#endif
 
 #include "ttm/ttm_bo_driver.h"
 #include "ttm/ttm_page_alloc.h"
 
+#ifdef TTM_HAS_AGP
+#include <asm/agp.h>
+#endif
 
 #define NUM_PAGES_TO_ALLOC              (PAGE_SIZE/sizeof(struct page *))
 #define SMALL_ALLOCATION                16
diff --git a/drivers/input/joystick/gamecon.c b/drivers/input/joystick/gamecon.c
index fbd62abb66f9..0ffaf2c77a19 100644
--- a/drivers/input/joystick/gamecon.c
+++ b/drivers/input/joystick/gamecon.c
@@ -89,7 +89,6 @@ struct gc_pad {
 struct gc {
         struct pardevice *pd;
         struct gc_pad pads[GC_MAX_DEVICES];
-        struct input_dev *dev[GC_MAX_DEVICES];
         struct timer_list timer;
         int pad_count[GC_MAX];
         int used;
@@ -387,7 +386,7 @@ static void gc_nes_process_packet(struct gc *gc)
         for (i = 0; i < GC_MAX_DEVICES; i++) {
 
                 pad = &gc->pads[i];
-                dev = gc->dev[i];
+                dev = pad->dev;
                 s = gc_status_bit[i];
 
                 switch (pad->type) {
@@ -579,7 +578,7 @@ static void gc_psx_command(struct gc *gc, int b, unsigned char *data)
                 read = parport_read_status(port) ^ 0x80;
 
                 for (j = 0; j < GC_MAX_DEVICES; j++) {
-                        struct gc_pad *pad = &gc->pads[i];
+                        struct gc_pad *pad = &gc->pads[j];
 
                         if (pad->type == GC_PSX || pad->type == GC_DDR)
                                 data[j] |= (read & gc_status_bit[j]) ? (1 << i) : 0;
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 3525f533e186..1ba25145b333 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -124,7 +124,7 @@ config KEYBOARD_ATKBD_RDI_KEYCODES
           right-hand column will be interpreted as the key shown in the
           left-hand column.
 
-config QT2160
+config KEYBOARD_QT2160
         tristate "Atmel AT42QT2160 Touch Sensor Chip"
         depends on I2C && EXPERIMENTAL
         help
diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
index 7aa59e07b689..fb16b5e5ea13 100644
--- a/drivers/input/keyboard/twl4030_keypad.c
+++ b/drivers/input/keyboard/twl4030_keypad.c
@@ -51,8 +51,12 @@
  */
 #define TWL4030_MAX_ROWS        8       /* TWL4030 hard limit */
 #define TWL4030_MAX_COLS        8
-#define TWL4030_ROW_SHIFT       3
-#define TWL4030_KEYMAP_SIZE     (TWL4030_MAX_ROWS * TWL4030_MAX_COLS)
+/*
+ * Note that we add space for an extra column so that we can handle
+ * row lines connected to the gnd (see twl4030_col_xlate()).
+ */
+#define TWL4030_ROW_SHIFT       4
+#define TWL4030_KEYMAP_SIZE     (TWL4030_MAX_ROWS << TWL4030_ROW_SHIFT)
 
 struct twl4030_keypad {
         unsigned short  keymap[TWL4030_KEYMAP_SIZE];
@@ -182,7 +186,7 @@ static int twl4030_read_kp_matrix_state(struct twl4030_keypad *kp, u16 *state)
         return ret;
 }
 
-static int twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
+static bool twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
 {
         int i;
         u16 check = 0;
@@ -191,12 +195,12 @@ static int twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
                 u16 col = key_state[i];
 
                 if ((col & check) && hweight16(col) > 1)
-                        return 1;
+                        return true;
 
                 check |= col;
         }
 
-        return 0;
+        return false;
 }
 
 static void twl4030_kp_scan(struct twl4030_keypad *kp, bool release_all)
@@ -225,7 +229,8 @@ static void twl4030_kp_scan(struct twl4030_keypad *kp, bool release_all)
                 if (!changed)
                         continue;
 
-                for (col = 0; col < kp->n_cols; col++) {
+                /* Extra column handles "all gnd" rows */
+                for (col = 0; col < kp->n_cols + 1; col++) {
                         int code;
 
                         if (!(changed & (1 << col)))
diff --git a/drivers/input/keyboard/w90p910_keypad.c b/drivers/input/keyboard/w90p910_keypad.c
index 4ef764cc493c..ee2bf6bcf291 100644
--- a/drivers/input/keyboard/w90p910_keypad.c
+++ b/drivers/input/keyboard/w90p910_keypad.c
@@ -258,7 +258,7 @@ static struct platform_driver w90p910_keypad_driver = {
         .probe          = w90p910_keypad_probe,
         .remove         = __devexit_p(w90p910_keypad_remove),
         .driver         = {
-                .name   = "nuc900-keypad",
+                .name   = "nuc900-kpi",
                 .owner  = THIS_MODULE,
         },
 };
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 9ba9c4a17e15..705589dc9ac5 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -141,8 +141,13 @@ static int synaptics_capability(struct psmouse *psmouse)
         priv->capabilities = (cap[0] << 16) | (cap[1] << 8) | cap[2];
         priv->ext_cap = priv->ext_cap_0c = 0;
 
-        if (!SYN_CAP_VALID(priv->capabilities))
+        /*
+         * Older firmwares had submodel ID fixed to 0x47
+         */
+        if (SYN_ID_FULL(priv->identity) < 0x705 &&
+            SYN_CAP_SUBMODEL_ID(priv->capabilities) != 0x47) {
                 return -1;
+        }
 
         /*
          * Unless capExtended is set the rest of the flags should be ignored
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index 7d4d5e12c0df..b6aa7d20d8a3 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -47,7 +47,7 @@
 #define SYN_CAP_FOUR_BUTTON(c)          ((c) & (1 << 3))
 #define SYN_CAP_MULTIFINGER(c)          ((c) & (1 << 1))
 #define SYN_CAP_PALMDETECT(c)           ((c) & (1 << 0))
-#define SYN_CAP_VALID(c)                ((((c) & 0x00ff00) >> 8) == 0x47)
+#define SYN_CAP_SUBMODEL_ID(c)          (((c) & 0x00ff00) >> 8)
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
 #define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
@@ -66,6 +66,7 @@
 #define SYN_ID_MODEL(i)                 (((i) >> 4) & 0x0f)
 #define SYN_ID_MAJOR(i)                 ((i) & 0x0f)
 #define SYN_ID_MINOR(i)                 (((i) >> 16) & 0xff)
+#define SYN_ID_FULL(i)                  ((SYN_ID_MAJOR(i) << 8) | SYN_ID_MINOR(i))
 #define SYN_ID_IS_SYNAPTICS(i)          ((((i) >> 8) & 0xff) == 0x47)
 
 /* synaptics special commands */
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 81003c4739f4..ed7ad7416b24 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -170,6 +170,13 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
                 },
         },
         {
+                /* Gigabyte Spring Peak - defines wrong chassis type */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Spring Peak"),
+                },
+        },
+        {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 484e52bb40bb..2cb1a70214d7 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -923,7 +923,7 @@ init_cifs(void)
                 goto out_unregister_filesystem;
 #endif
 #ifdef CONFIG_CIFS_DFS_UPCALL
-        rc = register_key_type(&key_type_dns_resolver);
+        rc = cifs_init_dns_resolver();
         if (rc)
                 goto out_unregister_key_type;
 #endif
@@ -935,7 +935,7 @@ init_cifs(void)
 
  out_unregister_resolver_key:
 #ifdef CONFIG_CIFS_DFS_UPCALL
-        unregister_key_type(&key_type_dns_resolver);
+        cifs_exit_dns_resolver();
  out_unregister_key_type:
 #endif
 #ifdef CONFIG_CIFS_UPCALL
@@ -961,7 +961,7 @@ exit_cifs(void)
         cifs_proc_clean();
 #ifdef CONFIG_CIFS_DFS_UPCALL
         cifs_dfs_release_automount_timer();
-        unregister_key_type(&key_type_dns_resolver);
+        cifs_exit_dns_resolver();
 #endif
 #ifdef CONFIG_CIFS_UPCALL
         unregister_key_type(&cifs_spnego_key_type);
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 4db2c5e7283f..49315cbf742d 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -24,12 +24,16 @@
  */
 
 #include <linux/slab.h>
+#include <linux/keyctl.h>
+#include <linux/key-type.h>
 #include <keys/user-type.h>
 #include "dns_resolve.h"
 #include "cifsglob.h"
 #include "cifsproto.h"
 #include "cifs_debug.h"
 
+static const struct cred *dns_resolver_cache;
+
 /* Checks if supplied name is IP address
  * returns:
  *              1 - name is IP
@@ -94,6 +98,7 @@ struct key_type key_type_dns_resolver = {
 int
 dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
 {
+        const struct cred *saved_cred;
         int rc = -EAGAIN;
         struct key *rkey = ERR_PTR(-EAGAIN);
         char *name;
@@ -133,8 +138,15 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
                 goto skip_upcall;
         }
 
+        saved_cred = override_creds(dns_resolver_cache);
         rkey = request_key(&key_type_dns_resolver, name, "");
+        revert_creds(saved_cred);
         if (!IS_ERR(rkey)) {
+                if (!(rkey->perm & KEY_USR_VIEW)) {
+                        down_read(&rkey->sem);
+                        rkey->perm |= KEY_USR_VIEW;
+                        up_read(&rkey->sem);
+                }
                 len = rkey->type_data.x[0];
                 data = rkey->payload.data;
         } else {
@@ -165,4 +177,61 @@ out:
         return rc;
 }
 
+int __init cifs_init_dns_resolver(void)
+{
+        struct cred *cred;
+        struct key *keyring;
+        int ret;
+
+        printk(KERN_NOTICE "Registering the %s key type\n",
+               key_type_dns_resolver.name);
+
+        /* create an override credential set with a special thread keyring in
+         * which DNS requests are cached
+         *
+         * this is used to prevent malicious redirections from being installed
+         * with add_key().
+         */
+        cred = prepare_kernel_cred(NULL);
+        if (!cred)
+                return -ENOMEM;
+
+        keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred,
+                            (KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                            KEY_USR_VIEW | KEY_USR_READ,
+                            KEY_ALLOC_NOT_IN_QUOTA);
+        if (IS_ERR(keyring)) {
+                ret = PTR_ERR(keyring);
+                goto failed_put_cred;
+        }
+
+        ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);
+        if (ret < 0)
+                goto failed_put_key;
+
+        ret = register_key_type(&key_type_dns_resolver);
+        if (ret < 0)
+                goto failed_put_key;
+
+        /* instruct request_key() to use this special keyring as a cache for
+         * the results it looks up */
+        cred->thread_keyring = keyring;
+        cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
+        dns_resolver_cache = cred;
+        return 0;
+
+failed_put_key:
+        key_put(keyring);
+failed_put_cred:
+        put_cred(cred);
+        return ret;
+}
 
+void __exit cifs_exit_dns_resolver(void)
+{
+        key_revoke(dns_resolver_cache->thread_keyring);
+        unregister_key_type(&key_type_dns_resolver);
+        put_cred(dns_resolver_cache);
+        printk(KERN_NOTICE "Unregistered %s key type\n",
+               key_type_dns_resolver.name);
+}
diff --git a/fs/cifs/dns_resolve.h b/fs/cifs/dns_resolve.h
index 966e9288930b..26b9eaa9f5ee 100644
--- a/fs/cifs/dns_resolve.h
+++ b/fs/cifs/dns_resolve.h
@@ -24,8 +24,8 @@
 #define _DNS_RESOLVE_H
 
 #ifdef __KERNEL__
-#include <linux/key-type.h>
-extern struct key_type key_type_dns_resolver;
+extern int __init cifs_init_dns_resolver(void);
+extern void __exit cifs_exit_dns_resolver(void);
 extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr);
 #endif /* KERNEL */
 
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 48c5299cbf26..cdfff74e9739 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -435,7 +435,7 @@
  */
 #define INIT_TASK_DATA_SECTION(align)                                   \
         . = ALIGN(align);                                               \
-        .data..init_task : {                                            \
+        .data..init_task :  AT(ADDR(.data..init_task) - LOAD_OFFSET) {  \
                 INIT_TASK_DATA(align)                                   \
         }
 
diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
index 4496322e28dd..609e8ca5f534 100644
--- a/include/linux/sysrq.h
+++ b/include/linux/sysrq.h
@@ -45,6 +45,7 @@ struct sysrq_key_op {
  */
 
 void handle_sysrq(int key, struct tty_struct *tty);
+void __handle_sysrq(int key, struct tty_struct *tty, int check_mask);
 int register_sysrq_key(int key, struct sysrq_key_op *op);
 int unregister_sysrq_key(int key, struct sysrq_key_op *op);
 struct sysrq_key_op *__sysrq_get_key_op(int key);
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 5cb7cd1de10c..8bc5eeffec8a 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -605,13 +605,13 @@ cpu_master_loop:
                 if (dbg_kdb_mode) {
                         kgdb_connected = 1;
                         error = kdb_stub(ks);
+                        kgdb_connected = 0;
                 } else {
                         error = gdb_serial_stub(ks);
                 }
 
                 if (error == DBG_PASS_EVENT) {
                         dbg_kdb_mode = !dbg_kdb_mode;
-                        kgdb_connected = 0;
                 } else if (error == DBG_SWITCH_CPU_EVENT) {
                         dbg_cpu_switch(cpu, dbg_switch_cpu);
                         goto cpu_loop;
diff --git a/kernel/debug/gdbstub.c b/kernel/debug/gdbstub.c
index 4b17b3269525..e8fd6868682d 100644
--- a/kernel/debug/gdbstub.c
+++ b/kernel/debug/gdbstub.c
@@ -621,10 +621,8 @@ static void gdb_cmd_query(struct kgdb_state *ks)
         switch (remcom_in_buffer[1]) {
         case 's':
         case 'f':
-                if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10)) {
-                        error_packet(remcom_out_buffer, -EINVAL);
+                if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10))
                         break;
-                }
 
                 i = 0;
                 remcom_out_buffer[0] = 'm';
@@ -665,10 +663,9 @@ static void gdb_cmd_query(struct kgdb_state *ks)
                 pack_threadid(remcom_out_buffer + 2, thref);
                 break;
         case 'T':
-                if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16)) {
-                        error_packet(remcom_out_buffer, -EINVAL);
+                if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16))
                         break;
-                }
+
                 ks->threadid = 0;
                 ptr = remcom_in_buffer + 17;
                 kgdb_hex2long(&ptr, &ks->threadid);
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 184cd8209c36..ebe4a287419e 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -1820,9 +1820,8 @@ static int kdb_sr(int argc, const char **argv)
 {
         if (argc != 1)
                 return KDB_ARGCOUNT;
-        sysrq_toggle_support(1);
         kdb_trap_printk++;
-        handle_sysrq(*argv[1], NULL);
+        __handle_sysrq(*argv[1], NULL, 0);
         kdb_trap_printk--;
 
         return 0;
@@ -1883,6 +1882,7 @@ static int kdb_lsmod(int argc, const char **argv)
                         kdb_printf(" (Loading)");
                 else
                         kdb_printf(" (Live)");
+                kdb_printf(" 0x%p", mod->module_core);
 
 #ifdef CONFIG_MODULE_UNLOAD
                 {
@@ -2291,6 +2291,9 @@ static int kdb_ll(int argc, const char **argv)
         while (va) {
                 char buf[80];
 
+                if (KDB_FLAG(CMD_INTERRUPT))
+                        return 0;
+
                 sprintf(buf, "%s " kdb_machreg_fmt "\n", command, va);
                 diag = kdb_parse(buf);
                 if (diag)