diff --git a/[refs] b/[refs]
index dfe1050d1502..b221ddc33da4 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 055bf38d3d6069707e2d555cffdde629b8404ff2
+refs/heads/master: c22ab332902333f83766017478c1ef6607ace681
diff --git a/trunk/Documentation/kernel-parameters.txt b/trunk/Documentation/kernel-parameters.txt
index 033d4e69b43b..d99fd9c0ec0e 100644
--- a/trunk/Documentation/kernel-parameters.txt
+++ b/trunk/Documentation/kernel-parameters.txt
@@ -2211,6 +2211,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
 			default: off.
 
+	printk.always_kmsg_dump=
+			Trigger kmsg_dump for cases other than kernel oops or
+			panics
+			Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
+			default: disabled
+
 	printk.time=	Show timing data prefixed to each printk message line
 			Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
 
diff --git a/trunk/arch/mips/alchemy/common/time.c b/trunk/arch/mips/alchemy/common/time.c
index a7193ae13a5d..7da4d0081487 100644
--- a/trunk/arch/mips/alchemy/common/time.c
+++ b/trunk/arch/mips/alchemy/common/time.c
@@ -146,7 +146,7 @@ static int __init alchemy_time_init(unsigned int m2int)
 	cd->shift = 32;
 	cd->mult = div_sc(32768, NSEC_PER_SEC, cd->shift);
 	cd->max_delta_ns = clockevent_delta2ns(0xffffffff, cd);
-	cd->min_delta_ns = clockevent_delta2ns(9, cd);	/* ~0.28ms */
+	cd->min_delta_ns = clockevent_delta2ns(8, cd);	/* ~0.25ms */
 	clockevents_register_device(cd);
 	setup_irq(m2int, &au1x_rtcmatch2_irqaction);
 
diff --git a/trunk/arch/mips/ath79/dev-wmac.c b/trunk/arch/mips/ath79/dev-wmac.c
index e21507052066..24f546985b69 100644
--- a/trunk/arch/mips/ath79/dev-wmac.c
+++ b/trunk/arch/mips/ath79/dev-wmac.c
@@ -96,7 +96,7 @@ void __init ath79_register_wmac(u8 *cal_data)
 {
 	if (soc_is_ar913x())
 		ar913x_wmac_setup();
-	else if (soc_is_ar933x())
+	if (soc_is_ar933x())
 		ar933x_wmac_setup();
 	else
 		BUG();
diff --git a/trunk/arch/mips/configs/nlm_xlp_defconfig b/trunk/arch/mips/configs/nlm_xlp_defconfig
index 28c6b276c216..4479fd669ac1 100644
--- a/trunk/arch/mips/configs/nlm_xlp_defconfig
+++ b/trunk/arch/mips/configs/nlm_xlp_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 # CONFIG_SECCOMP is not set
 CONFIG_USE_OF=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE=""
+CONFIG_CROSS_COMPILE="mips-linux-gnu-"
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_CGROUPS=y
 CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlp"
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_LZMA=y
diff --git a/trunk/arch/mips/configs/nlm_xlr_defconfig b/trunk/arch/mips/configs/nlm_xlr_defconfig
index d0b857d98c91..7c68666fdd64 100644
--- a/trunk/arch/mips/configs/nlm_xlr_defconfig
+++ b/trunk/arch/mips/configs/nlm_xlr_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 CONFIG_PREEMPT_VOLUNTARY=y
 CONFIG_KEXEC=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE=""
+CONFIG_CROSS_COMPILE="mips-linux-gnu-"
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_NAMESPACES=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlr"
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_GZIP=y
diff --git a/trunk/arch/mips/configs/powertv_defconfig b/trunk/arch/mips/configs/powertv_defconfig
index 7fda0ce5f692..3b0b6e8c8533 100644
--- a/trunk/arch/mips/configs/powertv_defconfig
+++ b/trunk/arch/mips/configs/powertv_defconfig
@@ -6,7 +6,7 @@ CONFIG_HZ_1000=y
 CONFIG_PREEMPT=y
 # CONFIG_SECCOMP is not set
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE=""
+CONFIG_CROSS_COMPILE="mips-linux-"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=16
diff --git a/trunk/arch/mips/include/asm/mach-au1x00/gpio-au1300.h b/trunk/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
index fb9975c74c57..556e1be20bf6 100644
--- a/trunk/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
+++ b/trunk/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
@@ -11,9 +11,6 @@
 #include <asm/io.h>
 #include <asm/mach-au1x00/au1000.h>
 
-struct gpio;
-struct gpio_chip;
-
 /* with the current GPIC design, up to 128 GPIOs are possible.
  * The only implementation so far is in the Au1300, which has 75 externally
  * available GPIOs.
@@ -206,22 +203,7 @@ static inline int gpio_request(unsigned int gpio, const char *label)
 	return 0;
 }
 
-static inline int gpio_request_one(unsigned gpio,
-					unsigned long flags, const char *label)
-{
-	return 0;
-}
-
-static inline int gpio_request_array(struct gpio *array, size_t num)
-{
-	return 0;
-}
-
-static inline void gpio_free(unsigned gpio)
-{
-}
-
-static inline void gpio_free_array(struct gpio *array, size_t num)
+static inline void gpio_free(unsigned int gpio)
 {
 }
 
diff --git a/trunk/arch/mips/include/asm/page.h b/trunk/arch/mips/include/asm/page.h
index da9bd7d270d1..d41790928c64 100644
--- a/trunk/arch/mips/include/asm/page.h
+++ b/trunk/arch/mips/include/asm/page.h
@@ -39,6 +39,9 @@
 #define HPAGE_MASK	(~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER	(HPAGE_SHIFT - PAGE_SHIFT)
 #else /* !CONFIG_HUGETLB_PAGE */
+# ifndef BUILD_BUG
+#  define BUILD_BUG() do { extern void __build_bug(void); __build_bug(); } while (0)
+# endif
 #define HPAGE_SHIFT	({BUILD_BUG(); 0; })
 #define HPAGE_SIZE	({BUILD_BUG(); 0; })
 #define HPAGE_MASK	({BUILD_BUG(); 0; })
diff --git a/trunk/arch/mips/kernel/smp-bmips.c b/trunk/arch/mips/kernel/smp-bmips.c
index d5e950ab8527..58fe71afd879 100644
--- a/trunk/arch/mips/kernel/smp-bmips.c
+++ b/trunk/arch/mips/kernel/smp-bmips.c
@@ -8,6 +8,7 @@
  * SMP support for BMIPS
  */
 
+#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
diff --git a/trunk/arch/mips/kernel/traps.c b/trunk/arch/mips/kernel/traps.c
index d79ae5437b58..cc4a3f120f54 100644
--- a/trunk/arch/mips/kernel/traps.c
+++ b/trunk/arch/mips/kernel/traps.c
@@ -1135,7 +1135,7 @@ asmlinkage void do_mt(struct pt_regs *regs)
 		printk(KERN_DEBUG "YIELD Scheduler Exception\n");
 		break;
 	case 5:
-		printk(KERN_DEBUG "Gating Storage Scheduler Exception\n");
+		printk(KERN_DEBUG "Gating Storage Schedulier Exception\n");
 		break;
 	default:
 		printk(KERN_DEBUG "*** UNKNOWN THREAD EXCEPTION %d ***\n",
diff --git a/trunk/arch/mips/kernel/vmlinux.lds.S b/trunk/arch/mips/kernel/vmlinux.lds.S
index 924da5eb7031..a81176f44c74 100644
--- a/trunk/arch/mips/kernel/vmlinux.lds.S
+++ b/trunk/arch/mips/kernel/vmlinux.lds.S
@@ -69,6 +69,7 @@ SECTIONS
 	RODATA
 
 	/* writeable */
+	_sdata = .;				/* Start of data section */
 	.data : {	/* Data */
 		. = . + DATAOFFSET;		/* for CONFIG_MAPPED_KERNEL */
 
diff --git a/trunk/arch/mips/mm/fault.c b/trunk/arch/mips/mm/fault.c
index 69ebd586d7ff..937cf3368164 100644
--- a/trunk/arch/mips/mm/fault.c
+++ b/trunk/arch/mips/mm/fault.c
@@ -42,8 +42,6 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
 	const int field = sizeof(unsigned long) * 2;
 	siginfo_t info;
 	int fault;
-	unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
-						 (write ? FAULT_FLAG_WRITE : 0);
 
 #if 0
 	printk("Cpu%d[%s:%d:%0*lx:%ld:%0*lx]\n", raw_smp_processor_id(),
@@ -93,7 +91,6 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
 	if (in_atomic() || !mm)
 		goto bad_area_nosemaphore;
 
-retry:
 	down_read(&mm->mmap_sem);
 	vma = find_vma(mm, address);
 	if (!vma)
@@ -147,11 +144,7 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
 	 * make sure we exit gracefully rather than endlessly redo
 	 * the fault.
 	 */
-	fault = handle_mm_fault(mm, vma, address, flags);
-
-	if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
-		return;
-
+	fault = handle_mm_fault(mm, vma, address, write ? FAULT_FLAG_WRITE : 0);
 	perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
@@ -160,27 +153,12 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
 			goto do_sigbus;
 		BUG();
 	}
-	if (flags & FAULT_FLAG_ALLOW_RETRY) {
-		if (fault & VM_FAULT_MAJOR) {
-			perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
-						  regs, address);
-			tsk->maj_flt++;
-		} else {
-			perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1,
-						  regs, address);
-			tsk->min_flt++;
-		}
-		if (fault & VM_FAULT_RETRY) {
-			flags &= ~FAULT_FLAG_ALLOW_RETRY;
-
-			/*
-			 * No need to up_read(&mm->mmap_sem) as we would
-			 * have already released it in __lock_page_or_retry
-			 * in mm/filemap.c.
-			 */
-
-			goto retry;
-		}
+	if (fault & VM_FAULT_MAJOR) {
+		perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
+		tsk->maj_flt++;
+	} else {
+		perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
+		tsk->min_flt++;
 	}
 
 	up_read(&mm->mmap_sem);
diff --git a/trunk/arch/mips/pci/pci.c b/trunk/arch/mips/pci/pci.c
index 15521505ebe8..aec2b111d35b 100644
--- a/trunk/arch/mips/pci/pci.c
+++ b/trunk/arch/mips/pci/pci.c
@@ -279,6 +279,7 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
 {
 	/* Propagate hose info into the subordinate devices.  */
 
+	struct list_head *ln;
 	struct pci_dev *dev = bus->self;
 
 	if (pci_probe_only && dev &&
@@ -287,7 +288,9 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
 		pcibios_fixup_device_resources(dev, bus);
 	}
 
-	list_for_each_entry(dev, &bus->devices, bus_list) {
+	for (ln = bus->devices.next; ln != &bus->devices; ln = ln->next) {
+		dev = pci_dev_b(ln);
+
 		if ((dev->class >> 8) != PCI_CLASS_BRIDGE_PCI)
 			pcibios_fixup_device_resources(dev, bus);
 	}
diff --git a/trunk/arch/mips/pmc-sierra/yosemite/ht-irq.c b/trunk/arch/mips/pmc-sierra/yosemite/ht-irq.c
index 62ead6601c69..86b98e98fb4f 100644
--- a/trunk/arch/mips/pmc-sierra/yosemite/ht-irq.c
+++ b/trunk/arch/mips/pmc-sierra/yosemite/ht-irq.c
@@ -35,6 +35,16 @@
  */
 void __init titan_ht_pcibios_fixup_bus(struct pci_bus *bus)
 {
+	struct pci_bus *current_bus = bus;
+	struct pci_dev *devices;
+	struct list_head *devices_link;
+
+	list_for_each(devices_link, &(current_bus->devices)) {
+		devices = pci_dev_b(devices_link);
+		if (devices == NULL)
+			continue;
+	}
+
 	/*
 	 * PLX and SPKT related changes go here
 	 */
diff --git a/trunk/arch/mips/txx9/generic/7segled.c b/trunk/arch/mips/txx9/generic/7segled.c
index 4642f56e70e5..8e93b2122524 100644
--- a/trunk/arch/mips/txx9/generic/7segled.c
+++ b/trunk/arch/mips/txx9/generic/7segled.c
@@ -102,7 +102,7 @@ static int __init tx_7segled_init_sysfs(void)
 			break;
 		}
 		dev->id = i;
-		dev->bus = &tx_7segled_subsys;
+		dev->dev = &tx_7segled_subsys;
 		error = device_register(dev);
 		if (!error) {
 			device_create_file(dev, &dev_attr_ascii);
diff --git a/trunk/arch/x86/ia32/ia32_aout.c b/trunk/arch/x86/ia32/ia32_aout.c
index 39e49091f648..fd843877e841 100644
--- a/trunk/arch/x86/ia32/ia32_aout.c
+++ b/trunk/arch/x86/ia32/ia32_aout.c
@@ -315,13 +315,6 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 	current->mm->free_area_cache = TASK_UNMAPPED_BASE;
 	current->mm->cached_hole_size = 0;
 
-	retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
-	if (retval < 0) {
-		/* Someone check-me: is this error path enough? */
-		send_sig(SIGKILL, current, 0);
-		return retval;
-	}
-
 	install_exec_creds(bprm);
 	current->flags &= ~PF_FORKNOEXEC;
 
@@ -417,6 +410,13 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 
 	set_brk(current->mm->start_brk, current->mm->brk);
 
+	retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
+	if (retval < 0) {
+		/* Someone check-me: is this error path enough? */
+		send_sig(SIGKILL, current, 0);
+		return retval;
+	}
+
 	current->mm->start_stack =
 		(unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
 	/* start thread */
diff --git a/trunk/arch/x86/pci/acpi.c b/trunk/arch/x86/pci/acpi.c
index 49a5cb55429b..a312e76063a7 100644
--- a/trunk/arch/x86/pci/acpi.c
+++ b/trunk/arch/x86/pci/acpi.c
@@ -60,16 +60,6 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = {
 			DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
 		},
 	},
-	/* https://bugzilla.kernel.org/show_bug.cgi?id=42619 */
-	{
-		.callback = set_use_crs,
-		.ident = "MSI MS-7253",
-		.matches = {
-			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
-			DMI_MATCH(DMI_BOARD_NAME, "MS-7253"),
-			DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
-		},
-	},
 
 	/* Now for the blacklist.. */
 
@@ -292,6 +282,9 @@ static void add_resources(struct pci_root_info *info)
 	int i;
 	struct resource *res, *root, *conflict;
 
+	if (!pci_use_crs)
+		return;
+
 	coalesce_windows(info, IORESOURCE_MEM);
 	coalesce_windows(info, IORESOURCE_IO);
 
@@ -343,13 +336,8 @@ get_current_resources(struct acpi_device *device, int busnum,
 	acpi_walk_resources(device->handle, METHOD_NAME__CRS, setup_resource,
 				&info);
 
-	if (pci_use_crs) {
-		add_resources(&info);
-
-		return;
-	}
-
-	kfree(info.name);
+	add_resources(&info);
+	return;
 
 name_alloc_fail:
 	kfree(info.res);
diff --git a/trunk/drivers/gpu/drm/gma500/cdv_device.c b/trunk/drivers/gpu/drm/gma500/cdv_device.c
index 53404af2e748..4a5b099c3bc5 100644
--- a/trunk/drivers/gpu/drm/gma500/cdv_device.c
+++ b/trunk/drivers/gpu/drm/gma500/cdv_device.c
@@ -321,8 +321,6 @@ static int cdv_chip_setup(struct drm_device *dev)
 	cdv_get_core_freq(dev);
 	gma_intel_opregion_init(dev);
 	psb_intel_init_bios(dev);
-	REG_WRITE(PORT_HOTPLUG_EN, 0);
-	REG_WRITE(PORT_HOTPLUG_STAT, REG_READ(PORT_HOTPLUG_STAT));
 	return 0;
 }
 
diff --git a/trunk/drivers/gpu/drm/gma500/framebuffer.c b/trunk/drivers/gpu/drm/gma500/framebuffer.c
index be616735ec91..830dfdd6bf15 100644
--- a/trunk/drivers/gpu/drm/gma500/framebuffer.c
+++ b/trunk/drivers/gpu/drm/gma500/framebuffer.c
@@ -247,6 +247,7 @@ static struct fb_ops psbfb_roll_ops = {
 	.fb_imageblit = cfb_imageblit,
 	.fb_pan_display = psbfb_pan,
 	.fb_mmap = psbfb_mmap,
+	.fb_sync = psbfb_sync,
 	.fb_ioctl = psbfb_ioctl,
 };
 
diff --git a/trunk/drivers/gpu/drm/gma500/gtt.c b/trunk/drivers/gpu/drm/gma500/gtt.c
index aff194fbe9f3..5d5330f667f1 100644
--- a/trunk/drivers/gpu/drm/gma500/gtt.c
+++ b/trunk/drivers/gpu/drm/gma500/gtt.c
@@ -446,9 +446,10 @@ int psb_gtt_init(struct drm_device *dev, int resume)
 	pg->gtt_start = pci_resource_start(dev->pdev, PSB_GTT_RESOURCE);
 	gtt_pages = pci_resource_len(dev->pdev, PSB_GTT_RESOURCE)
 								>> PAGE_SHIFT;
-	/* CDV doesn't report this. In which case the system has 64 gtt pages */
+	/* Some CDV firmware doesn't report this currently. In which case the
+	   system has 64 gtt pages */
 	if (pg->gtt_start == 0 || gtt_pages == 0) {
-		dev_dbg(dev->dev, "GTT PCI BAR not initialized.\n");
+		dev_err(dev->dev, "GTT PCI BAR not initialized.\n");
 		gtt_pages = 64;
 		pg->gtt_start = dev_priv->pge_ctl;
 	}
@@ -460,10 +461,10 @@ int psb_gtt_init(struct drm_device *dev, int resume)
 
 	if (pg->gatt_pages == 0 || pg->gatt_start == 0) {
 		static struct resource fudge;	/* Preferably peppermint */
-		/* This can occur on CDV systems. Fudge it in this case.
+		/* This can occur on CDV SDV systems. Fudge it in this case.
 		   We really don't care what imaginary space is being allocated
 		   at this point */
-		dev_dbg(dev->dev, "GATT PCI BAR not initialized.\n");
+		dev_err(dev->dev, "GATT PCI BAR not initialized.\n");
 		pg->gatt_start = 0x40000000;
 		pg->gatt_pages = (128 * 1024 * 1024) >> PAGE_SHIFT;
 		/* This is a little confusing but in fact the GTT is providing
diff --git a/trunk/drivers/net/ethernet/broadcom/tg3.c b/trunk/drivers/net/ethernet/broadcom/tg3.c
index 423d0235a878..a1f2e0fed78b 100644
--- a/trunk/drivers/net/ethernet/broadcom/tg3.c
+++ b/trunk/drivers/net/ethernet/broadcom/tg3.c
@@ -7886,8 +7886,10 @@ static int tg3_chip_reset(struct tg3 *tp)
 	return 0;
 }
 
-static void tg3_get_nstats(struct tg3 *, struct rtnl_link_stats64 *);
-static void tg3_get_estats(struct tg3 *, struct tg3_ethtool_stats *);
+static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *,
+						 struct rtnl_link_stats64 *);
+static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *,
+						struct tg3_ethtool_stats *);
 
 /* tp->lock is held. */
 static int tg3_halt(struct tg3 *tp, int kind, int silent)
@@ -7908,7 +7910,7 @@ static int tg3_halt(struct tg3 *tp, int kind, int silent)
 
 	if (tp->hw_stats) {
 		/* Save the stats across chip resets... */
-		tg3_get_nstats(tp, &tp->net_stats_prev),
+		tg3_get_stats64(tp->dev, &tp->net_stats_prev),
 		tg3_get_estats(tp, &tp->estats_prev);
 
 		/* And make sure the next sample is new data */
@@ -9845,7 +9847,7 @@ static inline u64 get_stat64(tg3_stat64_t *val)
        return ((u64)val->high << 32) | ((u64)val->low);
 }
 
-static u64 tg3_calc_crc_errors(struct tg3 *tp)
+static u64 calc_crc_errors(struct tg3 *tp)
 {
 	struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
@@ -9854,12 +9856,14 @@ static u64 tg3_calc_crc_errors(struct tg3 *tp)
 	     GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
 		u32 val;
 
+		spin_lock_bh(&tp->lock);
 		if (!tg3_readphy(tp, MII_TG3_TEST1, &val)) {
 			tg3_writephy(tp, MII_TG3_TEST1,
 				     val | MII_TG3_TEST1_CRC_EN);
 			tg3_readphy(tp, MII_TG3_RXR_COUNTERS, &val);
 		} else
 			val = 0;
+		spin_unlock_bh(&tp->lock);
 
 		tp->phy_crc_errors += val;
 
@@ -9873,13 +9877,14 @@ static u64 tg3_calc_crc_errors(struct tg3 *tp)
 	estats->member =	old_estats->member + \
 				get_stat64(&hw_stats->member)
 
-static void tg3_get_estats(struct tg3 *tp, struct tg3_ethtool_stats *estats)
+static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
+					       struct tg3_ethtool_stats *estats)
 {
 	struct tg3_ethtool_stats *old_estats = &tp->estats_prev;
 	struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
 	if (!hw_stats)
-		return;
+		return old_estats;
 
 	ESTAT_ADD(rx_octets);
 	ESTAT_ADD(rx_fragments);
@@ -9958,13 +9963,20 @@ static void tg3_get_estats(struct tg3 *tp, struct tg3_ethtool_stats *estats)
 	ESTAT_ADD(nic_tx_threshold_hit);
 
 	ESTAT_ADD(mbuf_lwm_thresh_hit);
+
+	return estats;
 }
 
-static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats)
+static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
+						 struct rtnl_link_stats64 *stats)
 {
+	struct tg3 *tp = netdev_priv(dev);
 	struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev;
 	struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
+	if (!hw_stats)
+		return old_stats;
+
 	stats->rx_packets = old_stats->rx_packets +
 		get_stat64(&hw_stats->rx_ucast_packets) +
 		get_stat64(&hw_stats->rx_mcast_packets) +
@@ -10007,13 +10019,15 @@ static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats)
 		get_stat64(&hw_stats->tx_carrier_sense_errors);
 
 	stats->rx_crc_errors = old_stats->rx_crc_errors +
-		tg3_calc_crc_errors(tp);
+		calc_crc_errors(tp);
 
 	stats->rx_missed_errors = old_stats->rx_missed_errors +
 		get_stat64(&hw_stats->rx_discards);
 
 	stats->rx_dropped = tp->rx_dropped;
 	stats->tx_dropped = tp->tx_dropped;
+
+	return stats;
 }
 
 static inline u32 calc_crc(unsigned char *buf, int len)
@@ -15395,21 +15409,6 @@ static void __devinit tg3_init_coal(struct tg3 *tp)
 	}
 }
 
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
-						struct rtnl_link_stats64 *stats)
-{
-	struct tg3 *tp = netdev_priv(dev);
-
-	if (!tp->hw_stats)
-		return &tp->net_stats_prev;
-
-	spin_lock_bh(&tp->lock);
-	tg3_get_nstats(tp, stats);
-	spin_unlock_bh(&tp->lock);
-
-	return stats;
-}
-
 static const struct net_device_ops tg3_netdev_ops = {
 	.ndo_open		= tg3_open,
 	.ndo_stop		= tg3_close,
diff --git a/trunk/drivers/net/ethernet/cisco/enic/enic.h b/trunk/drivers/net/ethernet/cisco/enic/enic.h
index c52295cd05ef..ee93a2087fe6 100644
--- a/trunk/drivers/net/ethernet/cisco/enic/enic.h
+++ b/trunk/drivers/net/ethernet/cisco/enic/enic.h
@@ -94,7 +94,7 @@ struct enic {
 	u32 rx_coalesce_usecs;
 	u32 tx_coalesce_usecs;
 #ifdef CONFIG_PCI_IOV
-	u16 num_vfs;
+	u32 num_vfs;
 #endif
 	struct enic_port_profile *pp;
 
diff --git a/trunk/drivers/net/ethernet/cisco/enic/enic_main.c b/trunk/drivers/net/ethernet/cisco/enic/enic_main.c
index 0e4edd3b6bee..ab3f67f980d8 100644
--- a/trunk/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/trunk/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2370,7 +2370,7 @@ static int __devinit enic_probe(struct pci_dev *pdev,
 	pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_SRIOV);
 	if (pos) {
 		pci_read_config_word(pdev, pos + PCI_SRIOV_TOTAL_VF,
-			&enic->num_vfs);
+			(u16 *)&enic->num_vfs);
 		if (enic->num_vfs) {
 			err = pci_enable_sriov(pdev, enic->num_vfs);
 			if (err) {
diff --git a/trunk/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c b/trunk/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
index 29e23bec809c..9cb5f912e489 100644
--- a/trunk/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
+++ b/trunk/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
@@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
 			pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
 			hw->phy.autoneg_advertised = opt.def;
 		} else {
-			int tmp = AutoNeg;
-
-			pch_gbe_validate_option(&tmp, &opt, adapter);
-			hw->phy.autoneg_advertised = tmp;
+			hw->phy.autoneg_advertised = AutoNeg;
+			pch_gbe_validate_option(
+				(int *)(&hw->phy.autoneg_advertised),
+				&opt, adapter);
 		}
 	}
 
@@ -495,10 +495,9 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
 			.arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
 					 .p = fc_list } }
 		};
-		int tmp = FlowControl;
-
-		pch_gbe_validate_option(&tmp, &opt, adapter);
-		hw->mac.fc = tmp;
+		hw->mac.fc = FlowControl;
+		pch_gbe_validate_option((int *)(&hw->mac.fc),
+						&opt, adapter);
 	}
 
 	pch_gbe_check_copper_options(adapter);
diff --git a/trunk/drivers/net/ethernet/packetengines/Kconfig b/trunk/drivers/net/ethernet/packetengines/Kconfig
index 8f29feb35548..b97132d9dff0 100644
--- a/trunk/drivers/net/ethernet/packetengines/Kconfig
+++ b/trunk/drivers/net/ethernet/packetengines/Kconfig
@@ -4,7 +4,6 @@
 
 config NET_PACKET_ENGINE
 	bool "Packet Engine devices"
-	default y
 	depends on PCI
 	---help---
 	  If you have a network (Ethernet) card belonging to this class, say Y
diff --git a/trunk/drivers/net/ethernet/qlogic/qla3xxx.c b/trunk/drivers/net/ethernet/qlogic/qla3xxx.c
index e61560e16385..7931531c3a40 100644
--- a/trunk/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/trunk/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -3017,6 +3017,7 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
 		(void __iomem *)port_regs;
 	u32 delay = 10;
 	int status = 0;
+	unsigned long hw_flags = 0;
 
 	if (ql_mii_setup(qdev))
 		return -1;
@@ -3227,9 +3228,9 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
 		value = ql_read_page0_reg(qdev, &port_regs->portStatus);
 		if (value & PORT_STATUS_IC)
 			break;
-		spin_unlock_irq(&qdev->hw_lock);
+		spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
 		msleep(500);
-		spin_lock_irq(&qdev->hw_lock);
+		spin_lock_irqsave(&qdev->hw_lock, hw_flags);
 	} while (--delay);
 
 	if (delay == 0) {
diff --git a/trunk/drivers/net/ethernet/realtek/r8169.c b/trunk/drivers/net/ethernet/realtek/r8169.c
index 1adf17757cea..7a0c800b50ad 100644
--- a/trunk/drivers/net/ethernet/realtek/r8169.c
+++ b/trunk/drivers/net/ethernet/realtek/r8169.c
@@ -3781,20 +3781,12 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
 
 static void rtl_hw_jumbo_enable(struct rtl8169_private *tp)
 {
-	void __iomem *ioaddr = tp->mmio_addr;
-
-	RTL_W8(Cfg9346, Cfg9346_Unlock);
 	rtl_generic_op(tp, tp->jumbo_ops.enable);
-	RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void rtl_hw_jumbo_disable(struct rtl8169_private *tp)
 {
-	void __iomem *ioaddr = tp->mmio_addr;
-
-	RTL_W8(Cfg9346, Cfg9346_Unlock);
 	rtl_generic_op(tp, tp->jumbo_ops.disable);
-	RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
diff --git a/trunk/drivers/net/vmxnet3/vmxnet3_drv.c b/trunk/drivers/net/vmxnet3/vmxnet3_drv.c
index 756c0f5565a5..3dcd3857a36c 100644
--- a/trunk/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/trunk/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -830,8 +830,13 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 					ctx->l4_hdr_size = ((struct tcphdr *)
 					   skb_transport_header(skb))->doff * 4;
 				else if (iph->protocol == IPPROTO_UDP)
+					/*
+					 * Use tcp header size so that bytes to
+					 * be copied are more than required by
+					 * the device.
+					 */
 					ctx->l4_hdr_size =
-							sizeof(struct udphdr);
+							sizeof(struct tcphdr);
 				else
 					ctx->l4_hdr_size = 0;
 			} else {
diff --git a/trunk/drivers/net/vmxnet3/vmxnet3_int.h b/trunk/drivers/net/vmxnet3/vmxnet3_int.h
index fc46a81ad538..ed54797db191 100644
--- a/trunk/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/trunk/drivers/net/vmxnet3/vmxnet3_int.h
@@ -70,10 +70,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.1.29.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.1.18.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01011D00
+#define VMXNET3_DRIVER_VERSION_NUM      0x01011200
 
 #if defined(CONFIG_PCI_MSI)
 	/* RSS only makes sense if MSI-X is supported. */
diff --git a/trunk/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/trunk/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 86a891f93fc9..f901a17f76ba 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -489,6 +489,8 @@ static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
 	ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
 	ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
 	ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
+	ATH_ALLOC_BANK(ah->addac5416_21,
+		       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
 	ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
 
 	return 0;
@@ -517,6 +519,7 @@ static void ar5008_hw_rf_free_ext_banks(struct ath_hw *ah)
 	ATH_FREE_BANK(ah->analogBank6Data);
 	ATH_FREE_BANK(ah->analogBank6TPCData);
 	ATH_FREE_BANK(ah->analogBank7Data);
+	ATH_FREE_BANK(ah->addac5416_21);
 	ATH_FREE_BANK(ah->bank6Temp);
 
 #undef ATH_FREE_BANK
@@ -802,7 +805,27 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
 	if (ah->eep_ops->set_addac)
 		ah->eep_ops->set_addac(ah, chan);
 
-	REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
+	if (AR_SREV_5416_22_OR_LATER(ah)) {
+		REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
+	} else {
+		struct ar5416IniArray temp;
+		u32 addacSize =
+			sizeof(u32) * ah->iniAddac.ia_rows *
+			ah->iniAddac.ia_columns;
+
+		/* For AR5416 2.0/2.1 */
+		memcpy(ah->addac5416_21,
+		       ah->iniAddac.ia_array, addacSize);
+
+		/* override CLKDRV value at [row, column] = [31, 1] */
+		(ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
+
+		temp.ia_array = ah->addac5416_21;
+		temp.ia_columns = ah->iniAddac.ia_columns;
+		temp.ia_rows = ah->iniAddac.ia_rows;
+		REG_WRITE_ARRAY(&temp, 1, regWrites);
+	}
+
 	REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_INTERNAL_ADDAC);
 
 	ENABLE_REGWRITE_BUFFER(ah);
diff --git a/trunk/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/trunk/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index d190411ac8f5..11f192a1ceb7 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -180,25 +180,6 @@ static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
 		INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac,
 			       ARRAY_SIZE(ar5416Addac), 2);
 	}
-
-	/* iniAddac needs to be modified for these chips */
-	if (AR_SREV_9160(ah) || !AR_SREV_5416_22_OR_LATER(ah)) {
-		struct ar5416IniArray *addac = &ah->iniAddac;
-		u32 size = sizeof(u32) * addac->ia_rows * addac->ia_columns;
-		u32 *data;
-
-		data = kmalloc(size, GFP_KERNEL);
-		if (!data)
-			return;
-
-		memcpy(data, addac->ia_array, size);
-		addac->ia_array = data;
-
-		if (!AR_SREV_5416_22_OR_LATER(ah)) {
-			/* override CLKDRV value */
-			INI_RA(addac, 31,1) = 0;
-		}
-	}
 }
 
 /* Support for Japan ch.14 (2484) spread */
diff --git a/trunk/drivers/net/wireless/ath/ath9k/hw.h b/trunk/drivers/net/wireless/ath/ath9k/hw.h
index c8261d4fc780..6a29004a71b0 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/hw.h
+++ b/trunk/drivers/net/wireless/ath/ath9k/hw.h
@@ -940,6 +940,7 @@ struct ath_hw {
 	u32 *analogBank6Data;
 	u32 *analogBank6TPCData;
 	u32 *analogBank7Data;
+	u32 *addac5416_21;
 	u32 *bank6Temp;
 
 	u8 txpower_limit;
diff --git a/trunk/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/trunk/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 30b58870b1b6..90911eec0cf5 100644
--- a/trunk/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/trunk/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -1051,13 +1051,17 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
 		}
 		/* either retransmit or send bar if ack not recd */
 		if (!ack_recd) {
-			if (retry && (ini->txretry[index] < (int)retry_limit)) {
+			struct ieee80211_tx_rate *txrate =
+			    tx_info->status.rates;
+			if (retry && (txrate[0].count < (int)retry_limit)) {
 				ini->txretry[index]++;
 				ini->tx_in_transit--;
 				/*
 				 * Use high prededence for retransmit to
 				 * give some punch
 				 */
+				/* brcms_c_txq_enq(wlc, scb, p,
+				 * BRCMS_PRIO_TO_PREC(tid)); */
 				brcms_c_txq_enq(wlc, scb, p,
 						BRCMS_PRIO_TO_HI_PREC(tid));
 			} else {
@@ -1070,9 +1074,9 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
 				    IEEE80211_TX_STAT_AMPDU_NO_BACK;
 				skb_pull(p, D11_PHY_HDR_LEN);
 				skb_pull(p, D11_TXH_LEN);
-				BCMMSG(wiphy,
-				       "BA Timeout, seq %d, in_transit %d\n",
-				       seq, ini->tx_in_transit);
+				wiphy_err(wiphy, "%s: BA Timeout, seq %d, in_"
+					"transit %d\n", "AMPDU status", seq,
+					ini->tx_in_transit);
 				ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
 							    p);
 			}
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/trunk/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index e483cfa8d14e..7353826095f1 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1187,7 +1187,6 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
 	unsigned long flags;
 	struct iwl_addsta_cmd sta_cmd;
 	u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
-	__le16 key_flags;
 
 	/* if station isn't there, neither is the key */
 	if (sta_id == IWL_INVALID_STATION)
@@ -1213,14 +1212,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
 		IWL_ERR(priv, "offset %d not used in uCode key table.\n",
 			keyconf->hw_key_idx);
 
-	key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
-	key_flags |= STA_KEY_FLG_MAP_KEY_MSK | STA_KEY_FLG_NO_ENC |
-		     STA_KEY_FLG_INVALID;
-
-	if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
-		key_flags |= STA_KEY_MULTICAST_MSK;
-
-	sta_cmd.key.key_flags = key_flags;
+	sta_cmd.key.key_flags = STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
 	sta_cmd.key.key_offset = WEP_INVALID_OFFSET;
 	sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
 	sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
diff --git a/trunk/drivers/net/wireless/rt2x00/rt2x00dev.c b/trunk/drivers/net/wireless/rt2x00/rt2x00dev.c
index d2a1ea98d0f2..c3e1aa7c1a80 100644
--- a/trunk/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/trunk/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1220,8 +1220,7 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
 		cancel_work_sync(&rt2x00dev->rxdone_work);
 		cancel_work_sync(&rt2x00dev->txdone_work);
 	}
-	if (rt2x00dev->workqueue)
-		destroy_workqueue(rt2x00dev->workqueue);
+	destroy_workqueue(rt2x00dev->workqueue);
 
 	/*
 	 * Free the tx status fifo.
diff --git a/trunk/fs/binfmt_aout.c b/trunk/fs/binfmt_aout.c
index 1ff94054d35a..a6395bdb26ae 100644
--- a/trunk/fs/binfmt_aout.c
+++ b/trunk/fs/binfmt_aout.c
@@ -259,13 +259,6 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 	current->mm->free_area_cache = current->mm->mmap_base;
 	current->mm->cached_hole_size = 0;
 
-	retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-	if (retval < 0) {
-		/* Someone check-me: is this error path enough? */
-		send_sig(SIGKILL, current, 0);
-		return retval;
-	}
-
 	install_exec_creds(bprm);
  	current->flags &= ~PF_FORKNOEXEC;
 
@@ -359,6 +352,13 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 		return retval;
 	}
 
+	retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
+	if (retval < 0) { 
+		/* Someone check-me: is this error path enough? */ 
+		send_sig(SIGKILL, current, 0); 
+		return retval;
+	}
+
 	current->mm->start_stack =
 		(unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
 #ifdef __alpha__
diff --git a/trunk/include/linux/kmsg_dump.h b/trunk/include/linux/kmsg_dump.h
index fee66317e071..35f7237ec972 100644
--- a/trunk/include/linux/kmsg_dump.h
+++ b/trunk/include/linux/kmsg_dump.h
@@ -15,13 +15,18 @@
 #include <linux/errno.h>
 #include <linux/list.h>
 
+/*
+ * Keep this list arranged in rough order of priority. Anything listed after
+ * KMSG_DUMP_OOPS will not be logged by default unless printk.always_kmsg_dump
+ * is passed to the kernel.
+ */
 enum kmsg_dump_reason {
-	KMSG_DUMP_OOPS,
 	KMSG_DUMP_PANIC,
+	KMSG_DUMP_OOPS,
+	KMSG_DUMP_EMERG,
 	KMSG_DUMP_RESTART,
 	KMSG_DUMP_HALT,
 	KMSG_DUMP_POWEROFF,
-	KMSG_DUMP_EMERG,
 };
 
 /**
diff --git a/trunk/include/linux/percpu.h b/trunk/include/linux/percpu.h
index 21638ae14e07..32cd1f67462e 100644
--- a/trunk/include/linux/percpu.h
+++ b/trunk/include/linux/percpu.h
@@ -348,9 +348,9 @@ do {									\
 #define _this_cpu_generic_to_op(pcp, val, op)				\
 do {									\
 	unsigned long flags;						\
-	raw_local_irq_save(flags);					\
+	local_irq_save(flags);						\
 	*__this_cpu_ptr(&(pcp)) op val;					\
-	raw_local_irq_restore(flags);					\
+	local_irq_restore(flags);					\
 } while (0)
 
 #ifndef this_cpu_write
@@ -449,10 +449,10 @@ do {									\
 ({									\
 	typeof(pcp) ret__;						\
 	unsigned long flags;						\
-	raw_local_irq_save(flags);					\
+	local_irq_save(flags);						\
 	__this_cpu_add(pcp, val);					\
 	ret__ = __this_cpu_read(pcp);					\
-	raw_local_irq_restore(flags);					\
+	local_irq_restore(flags);					\
 	ret__;								\
 })
 
@@ -479,10 +479,10 @@ do {									\
 #define _this_cpu_generic_xchg(pcp, nval)				\
 ({	typeof(pcp) ret__;						\
 	unsigned long flags;						\
-	raw_local_irq_save(flags);					\
+	local_irq_save(flags);						\
 	ret__ = __this_cpu_read(pcp);					\
 	__this_cpu_write(pcp, nval);					\
-	raw_local_irq_restore(flags);					\
+	local_irq_restore(flags);					\
 	ret__;								\
 })
 
@@ -507,11 +507,11 @@ do {									\
 ({									\
 	typeof(pcp) ret__;						\
 	unsigned long flags;						\
-	raw_local_irq_save(flags);					\
+	local_irq_save(flags);						\
 	ret__ = __this_cpu_read(pcp);					\
 	if (ret__ == (oval))						\
 		__this_cpu_write(pcp, nval);				\
-	raw_local_irq_restore(flags);					\
+	local_irq_restore(flags);					\
 	ret__;								\
 })
 
@@ -544,10 +544,10 @@ do {									\
 ({									\
 	int ret__;							\
 	unsigned long flags;						\
-	raw_local_irq_save(flags);					\
+	local_irq_save(flags);						\
 	ret__ = __this_cpu_generic_cmpxchg_double(pcp1, pcp2,		\
 			oval1, oval2, nval1, nval2);			\
-	raw_local_irq_restore(flags);					\
+	local_irq_restore(flags);					\
 	ret__;								\
 })
 
@@ -718,13 +718,12 @@ do {									\
 # ifndef __this_cpu_add_return_8
 #  define __this_cpu_add_return_8(pcp, val)	__this_cpu_generic_add_return(pcp, val)
 # endif
-# define __this_cpu_add_return(pcp, val)	\
-	__pcpu_size_call_return2(__this_cpu_add_return_, pcp, val)
+# define __this_cpu_add_return(pcp, val)	__pcpu_size_call_return2(this_cpu_add_return_, pcp, val)
 #endif
 
-#define __this_cpu_sub_return(pcp, val)	__this_cpu_add_return(pcp, -(val))
-#define __this_cpu_inc_return(pcp)	__this_cpu_add_return(pcp, 1)
-#define __this_cpu_dec_return(pcp)	__this_cpu_add_return(pcp, -1)
+#define __this_cpu_sub_return(pcp, val)	this_cpu_add_return(pcp, -(val))
+#define __this_cpu_inc_return(pcp)	this_cpu_add_return(pcp, 1)
+#define __this_cpu_dec_return(pcp)	this_cpu_add_return(pcp, -1)
 
 #define __this_cpu_generic_xchg(pcp, nval)				\
 ({	typeof(pcp) ret__;						\
diff --git a/trunk/include/linux/tcp.h b/trunk/include/linux/tcp.h
index 3c7ffdb40dc6..46a85c9e1f25 100644
--- a/trunk/include/linux/tcp.h
+++ b/trunk/include/linux/tcp.h
@@ -412,8 +412,7 @@ struct tcp_sock {
 
 	struct tcp_sack_block recv_sack_cache[4];
 
-	struct sk_buff *highest_sack;   /* skb just after the highest
-					 * skb with SACKed bit set
+	struct sk_buff *highest_sack;   /* highest skb with SACK received
 					 * (validity guaranteed only if
 					 * sacked_out > 0)
 					 */
diff --git a/trunk/include/net/tcp.h b/trunk/include/net/tcp.h
index 2d80c291fffb..42c29bfbcee3 100644
--- a/trunk/include/net/tcp.h
+++ b/trunk/include/net/tcp.h
@@ -1364,9 +1364,8 @@ static inline void tcp_push_pending_frames(struct sock *sk)
 	}
 }
 
-/* Start sequence of the skb just after the highest skb with SACKed
- * bit, valid only if sacked_out > 0 or when the caller has ensured
- * validity by itself.
+/* Start sequence of the highest skb with SACKed bit, valid only if
+ * sacked > 0 or when the caller has ensured validity by itself.
  */
 static inline u32 tcp_highest_sack_seq(struct tcp_sock *tp)
 {
diff --git a/trunk/kernel/printk.c b/trunk/kernel/printk.c
index 13c0a1143f49..32690a0b7a18 100644
--- a/trunk/kernel/printk.c
+++ b/trunk/kernel/printk.c
@@ -702,6 +702,9 @@ static bool printk_time = 0;
 #endif
 module_param_named(time, printk_time, bool, S_IRUGO | S_IWUSR);
 
+static bool always_kmsg_dump;
+module_param_named(always_kmsg_dump, always_kmsg_dump, bool, S_IRUGO | S_IWUSR);
+
 /* Check if we have any console registered that can be called early in boot. */
 static int have_callable_console(void)
 {
@@ -1732,6 +1735,9 @@ void kmsg_dump(enum kmsg_dump_reason reason)
 	unsigned long l1, l2;
 	unsigned long flags;
 
+	if ((reason > KMSG_DUMP_OOPS) && !always_kmsg_dump)
+		return;
+
 	/* Theoretically, the log could move on after we do this, but
 	   there's not a lot we can do about that. The new messages
 	   will overwrite the start of what we dump. */
diff --git a/trunk/mm/hugetlb.c b/trunk/mm/hugetlb.c
index a876871f6be5..5f34bd8dda34 100644
--- a/trunk/mm/hugetlb.c
+++ b/trunk/mm/hugetlb.c
@@ -2277,8 +2277,8 @@ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
 			set_page_dirty(page);
 		list_add(&page->lru, &page_list);
 	}
-	flush_tlb_range(vma, start, end);
 	spin_unlock(&mm->page_table_lock);
+	flush_tlb_range(vma, start, end);
 	mmu_notifier_invalidate_range_end(mm, start, end);
 	list_for_each_entry_safe(page, tmp, &page_list, lru) {
 		page_remove_rmap(page);
diff --git a/trunk/mm/mmap.c b/trunk/mm/mmap.c
index 22e1a0b2f70c..3f758c7f4c81 100644
--- a/trunk/mm/mmap.c
+++ b/trunk/mm/mmap.c
@@ -1293,8 +1293,6 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
 		pgoff = vma->vm_pgoff;
 		vm_flags = vma->vm_flags;
 	} else if (vm_flags & VM_SHARED) {
-		if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP)))
-			goto free_vma;
 		error = shmem_zero_setup(vma);
 		if (error)
 			goto free_vma;
diff --git a/trunk/mm/percpu-vm.c b/trunk/mm/percpu-vm.c
index 405d331804c3..12a48a88c0d8 100644
--- a/trunk/mm/percpu-vm.c
+++ b/trunk/mm/percpu-vm.c
@@ -184,7 +184,8 @@ static void pcpu_unmap_pages(struct pcpu_chunk *chunk,
 				   page_end - page_start);
 	}
 
-	bitmap_clear(populated, page_start, page_end - page_start);
+	for (i = page_start; i < page_end; i++)
+		__clear_bit(i, populated);
 }
 
 /**
diff --git a/trunk/net/bridge/br_multicast.c b/trunk/net/bridge/br_multicast.c
index 702a1ae9220b..568d5bf17534 100644
--- a/trunk/net/bridge/br_multicast.c
+++ b/trunk/net/bridge/br_multicast.c
@@ -446,11 +446,8 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
 	ip6h->nexthdr = IPPROTO_HOPOPTS;
 	ip6h->hop_limit = 1;
 	ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
-	if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
-			       &ip6h->saddr)) {
-		kfree_skb(skb);
-		return NULL;
-	}
+	ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+			   &ip6h->saddr);
 	ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
 	hopopt = (u8 *)(ip6h + 1);
diff --git a/trunk/net/bridge/br_stp.c b/trunk/net/bridge/br_stp.c
index 6751ed4e0c07..dd147d78a588 100644
--- a/trunk/net/bridge/br_stp.c
+++ b/trunk/net/bridge/br_stp.c
@@ -17,9 +17,9 @@
 #include "br_private_stp.h"
 
 /* since time values in bpdu are in jiffies and then scaled (1/256)
- * before sending, make sure that is at least one STP tick.
+ * before sending, make sure that is at least one.
  */
-#define MESSAGE_AGE_INCR	((HZ / 256) + 1)
+#define MESSAGE_AGE_INCR	((HZ < 256) ? 1 : (HZ/256))
 
 static const char *const br_port_state_names[] = {
 	[BR_STATE_DISABLED] = "disabled",
@@ -186,7 +186,7 @@ static void br_record_config_information(struct net_bridge_port *p,
 	p->designated_cost = bpdu->root_path_cost;
 	p->designated_bridge = bpdu->bridge_id;
 	p->designated_port = bpdu->port_id;
-	p->designated_age = jiffies - bpdu->message_age;
+	p->designated_age = jiffies + bpdu->message_age;
 
 	mod_timer(&p->message_age_timer, jiffies
 		  + (p->br->max_age - bpdu->message_age));
diff --git a/trunk/net/bridge/netfilter/ebtables.c b/trunk/net/bridge/netfilter/ebtables.c
index 8aa4ad0e06af..5864cc491369 100644
--- a/trunk/net/bridge/netfilter/ebtables.c
+++ b/trunk/net/bridge/netfilter/ebtables.c
@@ -1893,7 +1893,10 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
 
 	switch (compat_mwt) {
 	case EBT_COMPAT_MATCH:
-		match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
+		match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
+						name, 0), "ebt_%s", name);
+		if (match == NULL)
+			return -ENOENT;
 		if (IS_ERR(match))
 			return PTR_ERR(match);
 
@@ -1912,7 +1915,10 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
 		break;
 	case EBT_COMPAT_WATCHER: /* fallthrough */
 	case EBT_COMPAT_TARGET:
-		wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
+		wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
+						name, 0), "ebt_%s", name);
+		if (wt == NULL)
+			return -ENOENT;
 		if (IS_ERR(wt))
 			return PTR_ERR(wt);
 		off = xt_compat_target_offset(wt);
diff --git a/trunk/net/core/rtnetlink.c b/trunk/net/core/rtnetlink.c
index f965dce6f20f..606a6e8f3671 100644
--- a/trunk/net/core/rtnetlink.c
+++ b/trunk/net/core/rtnetlink.c
@@ -1060,12 +1060,11 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 	rcu_read_lock();
 	cb->seq = net->dev_base_seq;
 
-	if (nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
-			ifla_policy) >= 0) {
+	nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+		    ifla_policy);
 
-		if (tb[IFLA_EXT_MASK])
-			ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
-	}
+	if (tb[IFLA_EXT_MASK])
+		ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
 
 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
 		idx = 0;
@@ -1901,11 +1900,10 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
 	u32 ext_filter_mask = 0;
 	u16 min_ifinfo_dump_size = 0;
 
-	if (nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
-			ifla_policy) >= 0) {
-		if (tb[IFLA_EXT_MASK])
-			ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
-	}
+	nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX, ifla_policy);
+
+	if (tb[IFLA_EXT_MASK])
+		ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
 
 	if (!ext_filter_mask)
 		return NLMSG_GOODSIZE;
diff --git a/trunk/net/ipv4/tcp_input.c b/trunk/net/ipv4/tcp_input.c
index d9b83d198c3d..53c8ce4046b2 100644
--- a/trunk/net/ipv4/tcp_input.c
+++ b/trunk/net/ipv4/tcp_input.c
@@ -1403,16 +1403,8 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 
 	BUG_ON(!pcount);
 
-	/* Adjust counters and hints for the newly sacked sequence
-	 * range but discard the return value since prev is already
-	 * marked. We must tag the range first because the seq
-	 * advancement below implicitly advances
-	 * tcp_highest_sack_seq() when skb is highest_sack.
-	 */
-	tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
-			start_seq, end_seq, dup_sack, pcount);
-
-	if (skb == tp->lost_skb_hint)
+	/* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
+	if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
 		tp->lost_cnt_hint += pcount;
 
 	TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1438,6 +1430,12 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 		skb_shinfo(skb)->gso_type = 0;
 	}
 
+	/* Adjust counters and hints for the newly sacked sequence range but
+	 * discard the return value since prev is already marked.
+	 */
+	tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
+			start_seq, end_seq, dup_sack, pcount);
+
 	/* Difference in this won't matter, both ACKed by the same cumul. ACK */
 	TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
 
@@ -2569,7 +2567,6 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 
 		if (cnt > packets) {
 			if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
-			    (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
 			    (oldcnt >= packets))
 				break;
 
diff --git a/trunk/net/mac80211/iface.c b/trunk/net/mac80211/iface.c
index 8e2137bd87e2..01a21c2f6ab3 100644
--- a/trunk/net/mac80211/iface.c
+++ b/trunk/net/mac80211/iface.c
@@ -1332,9 +1332,6 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
 		hw_roc = true;
 
 	list_for_each_entry(sdata, &local->interfaces, list) {
-		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-			continue;
 		if (sdata->old_idle == sdata->vif.bss_conf.idle)
 			continue;
 		if (!ieee80211_sdata_running(sdata))
diff --git a/trunk/net/mac80211/rate.c b/trunk/net/mac80211/rate.c
index f9b8e819ca63..ad64f4d5271a 100644
--- a/trunk/net/mac80211/rate.c
+++ b/trunk/net/mac80211/rate.c
@@ -344,7 +344,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
 		info->control.rates[i].idx = -1;
 		info->control.rates[i].flags = 0;
-		info->control.rates[i].count = 0;
+		info->control.rates[i].count = 1;
 	}
 
 	if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)