Merge branch 'sh/stable-updates'

35 files changed, 248 insertions, 121 deletions

diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index e7cb5dbf6c26..69103e053c92 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -913,6 +913,7 @@ extern void blk_queue_logical_block_size(struct request_queue *, unsigned short)
 extern void blk_queue_physical_block_size(struct request_queue *, unsigned short);
 extern void blk_queue_alignment_offset(struct request_queue *q,
                                        unsigned int alignment);
+extern void blk_limits_io_min(struct queue_limits *limits, unsigned int min);
 extern void blk_queue_io_min(struct request_queue *q, unsigned int min);
 extern void blk_queue_io_opt(struct request_queue *q, unsigned int opt);
 extern void blk_set_default_limits(struct queue_limits *lim);
diff --git a/include/linux/cb710.h b/include/linux/cb710.h
index 63bc9a4d2926..8cc10411bab2 100644
--- a/include/linux/cb710.h
+++ b/include/linux/cb710.h
@@ -140,29 +140,6 @@ void cb710_dump_regs(struct cb710_chip *chip, unsigned dump);
 #include <linux/highmem.h>
 #include <linux/scatterlist.h>
 
-/**
- * cb710_sg_miter_stop_writing - stop mapping iteration after writing
- * @miter: sg mapping iter to be stopped
- *
- * Description:
- *   Stops mapping iterator @miter.  @miter should have been started
- *   started using sg_miter_start().  A stopped iteration can be
- *   resumed by calling sg_miter_next() on it.  This is useful when
- *   resources (kmap) need to be released during iteration.
- *
- *   This is a convenience wrapper that will be optimized out for arches
- *   that don't need flush_kernel_dcache_page().
- *
- * Context:
- *   IRQ disabled if the SG_MITER_ATOMIC is set.  Don't care otherwise.
- */
-static inline void cb710_sg_miter_stop_writing(struct sg_mapping_iter *miter)
-{
-        if (miter->page)
-                flush_kernel_dcache_page(miter->page);
-        sg_miter_stop(miter);
-}
-
 /*
  * 32-bit PIO mapping sg iterator
  *
@@ -171,12 +148,12 @@ static inline void cb710_sg_miter_stop_writing(struct sg_mapping_iter *miter)
  * without DMA support).
  *
  * Best-case reading (transfer from device):
- *   sg_miter_start();
+ *   sg_miter_start(, SG_MITER_TO_SG);
  *   cb710_sg_dwiter_write_from_io();
- *   cb710_sg_miter_stop_writing();
+ *   sg_miter_stop();
  *
  * Best-case writing (transfer to device):
- *   sg_miter_start();
+ *   sg_miter_start(, SG_MITER_FROM_SG);
  *   cb710_sg_dwiter_read_to_io();
  *   sg_miter_stop();
  */
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 665fa70e4094..90bba9e62286 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -179,14 +179,11 @@ struct cgroup {
          */
         struct list_head release_list;
 
-        /* pids_mutex protects the fields below */
+        /* pids_mutex protects pids_list and cached pid arrays. */
         struct rw_semaphore pids_mutex;
-        /* Array of process ids in the cgroup */
-        pid_t *tasks_pids;
-        /* How many files are using the current tasks_pids array */
-        int pids_use_count;
-        /* Length of the current tasks_pids array */
-        int pids_length;
+
+        /* Linked list of struct cgroup_pids */
+        struct list_head pids_list;
 
         /* For RCU-protected deletion */
         struct rcu_head rcu_head;
@@ -366,6 +363,23 @@ int cgroup_task_count(const struct cgroup *cgrp);
 int cgroup_is_descendant(const struct cgroup *cgrp, struct task_struct *task);
 
 /*
+ * When the subsys has to access css and may add permanent refcnt to css,
+ * it should take care of racy conditions with rmdir(). Following set of
+ * functions, is for stop/restart rmdir if necessary.
+ * Because these will call css_get/put, "css" should be alive css.
+ *
+ *  cgroup_exclude_rmdir();
+ *  ...do some jobs which may access arbitrary empty cgroup
+ *  cgroup_release_and_wakeup_rmdir();
+ *
+ *  When someone removes a cgroup while cgroup_exclude_rmdir() holds it,
+ *  it sleeps and cgroup_release_and_wakeup_rmdir() will wake him up.
+ */
+
+void cgroup_exclude_rmdir(struct cgroup_subsys_state *css);
+void cgroup_release_and_wakeup_rmdir(struct cgroup_subsys_state *css);
+
+/*
  * Control Group subsystem type.
  * See Documentation/cgroups/cgroups.txt for details
  */
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index c56457c8334e..1219be4fb42e 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -293,7 +293,12 @@ static inline int clocksource_enable(struct clocksource *cs)
         if (cs->enable)
                 ret = cs->enable(cs);
 
-        /* save mult_orig on enable */
+        /*
+         * The frequency may have changed while the clocksource
+         * was disabled. If so the code in ->enable() must update
+         * the mult value to reflect the new frequency. Make sure
+         * mult_orig follows this change.
+         */
         cs->mult_orig = cs->mult;
 
         return ret;
@@ -309,6 +314,13 @@ static inline int clocksource_enable(struct clocksource *cs)
  */
 static inline void clocksource_disable(struct clocksource *cs)
 {
+        /*
+         * Save mult_orig in mult so clocksource_enable() can
+         * restore the value regardless if ->enable() updates
+         * the value of mult or not.
+         */
+        cs->mult = cs->mult_orig;
+
         if (cs->disable)
                 cs->disable(cs);
 }
diff --git a/include/linux/decompress/generic.h b/include/linux/decompress/generic.h
index 6dfb856327bb..0c7111a55a1a 100644
--- a/include/linux/decompress/generic.h
+++ b/include/linux/decompress/generic.h
@@ -1,31 +1,37 @@
 #ifndef DECOMPRESS_GENERIC_H
 #define DECOMPRESS_GENERIC_H
 
-/* Minimal chunksize to be read.
- *Bzip2 prefers at least 4096
- *Lzma prefers 0x10000 */
-#define COMPR_IOBUF_SIZE        4096
-
 typedef int (*decompress_fn) (unsigned char *inbuf, int len,
                               int(*fill)(void*, unsigned int),
-                              int(*writebb)(void*, unsigned int),
-                              unsigned char *output,
+                              int(*flush)(void*, unsigned int),
+                              unsigned char *outbuf,
                               int *posp,
                               void(*error)(char *x));
 
 /* inbuf   - input buffer
  *len     - len of pre-read data in inbuf
- *fill    - function to fill inbuf if empty
- *writebb - function to write out outbug
+ *fill    - function to fill inbuf when empty
+ *flush   - function to write out outbuf
+ *outbuf  - output buffer
  *posp    - if non-null, input position (number of bytes read) will be
  *        returned here
  *
- *If len != 0, the inbuf is initialized (with as much data), and fill
- *should not be called
- *If len = 0, the inbuf is allocated, but empty. Its size is IOBUF_SIZE
- *fill should be called (repeatedly...) to read data, at most IOBUF_SIZE
+ *If len != 0, inbuf should contain all the necessary input data, and fill
+ *should be NULL
+ *If len = 0, inbuf can be NULL, in which case the decompressor will allocate
+ *the input buffer.  If inbuf != NULL it must be at least XXX_IOBUF_SIZE bytes.
+ *fill will be called (repeatedly...) to read data, at most XXX_IOBUF_SIZE
+ *bytes should be read per call.  Replace XXX with the appropriate decompressor
+ *name, i.e. LZMA_IOBUF_SIZE.
+ *
+ *If flush = NULL, outbuf must be large enough to buffer all the expected
+ *output.  If flush != NULL, the output buffer will be allocated by the
+ *decompressor (outbuf = NULL), and the flush function will be called to
+ *flush the output buffer at the appropriate time (decompressor and stream
+ *dependent).
  */
 
+
 /* Utility routine to detect the decompression method */
 decompress_fn decompress_method(const unsigned char *inbuf, int len,
                                 const char **name);
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 0d6310657f32..655e7721580a 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -84,7 +84,7 @@ typedef int (*dm_merge_fn) (struct dm_target *ti, struct bvec_merge_data *bvm,
 
 typedef int (*iterate_devices_callout_fn) (struct dm_target *ti,
                                            struct dm_dev *dev,
-                                           sector_t physical_start,
+                                           sector_t start, sector_t len,
                                            void *data);
 
 typedef int (*dm_iterate_devices_fn) (struct dm_target *ti,
@@ -104,7 +104,7 @@ void dm_error(const char *message);
  * Combine device limits.
  */
 int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
-                         sector_t start, void *data);
+                         sector_t start, sector_t len, void *data);
 
 struct dm_dev {
         struct block_device *bdev;
diff --git a/include/linux/ext3_fs.h b/include/linux/ext3_fs.h
index 634a5e5aba3e..7499b3667798 100644
--- a/include/linux/ext3_fs.h
+++ b/include/linux/ext3_fs.h
@@ -874,7 +874,7 @@ struct buffer_head * ext3_getblk (handle_t *, struct inode *, long, int, int *);
 struct buffer_head * ext3_bread (handle_t *, struct inode *, int, int, int *);
 int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
         sector_t iblock, unsigned long maxblocks, struct buffer_head *bh_result,
-        int create, int extend_disksize);
+        int create);
 
 extern struct inode *ext3_iget(struct super_block *, unsigned long);
 extern int  ext3_write_inode (struct inode *, int);
diff --git a/include/linux/flex_array.h b/include/linux/flex_array.h
new file mode 100644
index 000000000000..23c1ec79a31b
--- /dev/null
+++ b/include/linux/flex_array.h
@@ -0,0 +1,47 @@
+#ifndef _FLEX_ARRAY_H
+#define _FLEX_ARRAY_H
+
+#include <linux/types.h>
+#include <asm/page.h>
+
+#define FLEX_ARRAY_PART_SIZE PAGE_SIZE
+#define FLEX_ARRAY_BASE_SIZE PAGE_SIZE
+
+struct flex_array_part;
+
+/*
+ * This is meant to replace cases where an array-like
+ * structure has gotten too big to fit into kmalloc()
+ * and the developer is getting tempted to use
+ * vmalloc().
+ */
+
+struct flex_array {
+        union {
+                struct {
+                        int element_size;
+                        int total_nr_elements;
+                        struct flex_array_part *parts[0];
+                };
+                /*
+                 * This little trick makes sure that
+                 * sizeof(flex_array) == PAGE_SIZE
+                 */
+                char padding[FLEX_ARRAY_BASE_SIZE];
+        };
+};
+
+#define FLEX_ARRAY_INIT(size, total) { { {\
+        .element_size = (size),         \
+        .total_nr_elements = (total),   \
+} } }
+
+struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags);
+int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags);
+void flex_array_free(struct flex_array *fa);
+void flex_array_free_parts(struct flex_array *fa);
+int flex_array_put(struct flex_array *fa, int element_nr, void *src,
+                gfp_t flags);
+void *flex_array_get(struct flex_array *fa, int element_nr);
+
+#endif /* _FLEX_ARRAY_H */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 0872372184fe..67888a9e0655 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1946,6 +1946,7 @@ extern void putname(const char *name);
 extern int register_blkdev(unsigned int, const char *);
 extern void unregister_blkdev(unsigned int, const char *);
 extern struct block_device *bdget(dev_t);
+extern struct block_device *bdgrab(struct block_device *bdev);
 extern void bd_set_size(struct block_device *, loff_t size);
 extern void bd_forget(struct inode *inode);
 extern void bdput(struct block_device *);
@@ -2136,7 +2137,7 @@ extern loff_t default_llseek(struct file *file, loff_t offset, int origin);
 
 extern loff_t vfs_llseek(struct file *file, loff_t offset, int origin);
 
-extern struct inode * inode_init_always(struct super_block *, struct inode *);
+extern int inode_init_always(struct super_block *, struct inode *);
 extern void inode_init_once(struct inode *);
 extern void inode_add_to_lists(struct super_block *, struct inode *);
 extern void iput(struct inode *);
@@ -2163,6 +2164,7 @@ extern void __iget(struct inode * inode);
 extern void iget_failed(struct inode *);
 extern void clear_inode(struct inode *);
 extern void destroy_inode(struct inode *);
+extern void __destroy_inode(struct inode *);
 extern struct inode *new_inode(struct super_block *);
 extern int should_remove_suid(struct dentry *);
 extern int file_remove_suid(struct file *);
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 6c3de999fb34..4d6f47b51189 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -352,7 +352,7 @@ extern void fsnotify_unmount_inodes(struct list_head *list);
 /* put here because inotify does some weird stuff when destroying watches */
 extern struct fsnotify_event *fsnotify_create_event(struct inode *to_tell, __u32 mask,
                                                     void *data, int data_is, const char *name,
-                                                    u32 cookie);
+                                                    u32 cookie, gfp_t gfp);
 
 #else
 
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 5c093ffc655b..a81170de7f6b 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -89,7 +89,9 @@ enum print_line_t {
         TRACE_TYPE_NO_CONSUME   = 3     /* Handled but ask to not consume */
 };
 
-
+void tracing_generic_entry_update(struct trace_entry *entry,
+                                  unsigned long flags,
+                                  int pc);
 struct ring_buffer_event *
 trace_current_buffer_lock_reserve(int type, unsigned long len,
                                   unsigned long flags, int pc);
@@ -119,11 +121,9 @@ struct ftrace_event_call {
         void                    *filter;
         void                    *mod;
 
-#ifdef CONFIG_EVENT_PROFILE
-        atomic_t        profile_count;
-        int             (*profile_enable)(struct ftrace_event_call *);
-        void            (*profile_disable)(struct ftrace_event_call *);
-#endif
+        atomic_t                profile_count;
+        int                     (*profile_enable)(struct ftrace_event_call *);
+        void                    (*profile_disable)(struct ftrace_event_call *);
 };
 
 #define MAX_FILTER_PRED         32
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index acef2a770b6b..ad27c7da8798 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -82,7 +82,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 
 #define IN_DEV_FORWARD(in_dev)          IN_DEV_CONF_GET((in_dev), FORWARDING)
 #define IN_DEV_MFORWARD(in_dev)         IN_DEV_ANDCONF((in_dev), MC_FORWARDING)
-#define IN_DEV_RPFILTER(in_dev)         IN_DEV_ANDCONF((in_dev), RP_FILTER)
+#define IN_DEV_RPFILTER(in_dev)         IN_DEV_MAXCONF((in_dev), RP_FILTER)
 #define IN_DEV_SOURCE_ROUTE(in_dev)     IN_DEV_ANDCONF((in_dev), \
                                                        ACCEPT_SOURCE_ROUTE)
 #define IN_DEV_BOOTP_RELAY(in_dev)      IN_DEV_ANDCONF((in_dev), BOOTP_RELAY)
diff --git a/include/linux/input/matrix_keypad.h b/include/linux/input/matrix_keypad.h
index 7964516c6954..15d5903af2dd 100644
--- a/include/linux/input/matrix_keypad.h
+++ b/include/linux/input/matrix_keypad.h
@@ -15,12 +15,13 @@
 #define KEY_COL(k)              (((k) >> 16) & 0xff)
 #define KEY_VAL(k)              ((k) & 0xffff)
 
+#define MATRIX_SCAN_CODE(row, col, row_shift)   (((row) << (row_shift)) + (col))
+
 /**
  * struct matrix_keymap_data - keymap for matrix keyboards
  * @keymap: pointer to array of uint32 values encoded with KEY() macro
  *      representing keymap
  * @keymap_size: number of entries (initialized) in this keymap
- * @max_keymap_size: maximum size of keymap supported by the device
  *
  * This structure is supposed to be used by platform code to supply
  * keymaps to drivers that implement matrix-like keypads/keyboards.
@@ -28,14 +29,13 @@
 struct matrix_keymap_data {
         const uint32_t *keymap;
         unsigned int    keymap_size;
-        unsigned int    max_keymap_size;
 };
 
 /**
  * struct matrix_keypad_platform_data - platform-dependent keypad data
  * @keymap_data: pointer to &matrix_keymap_data
- * @row_gpios: array of gpio numbers reporesenting rows
- * @col_gpios: array of gpio numbers reporesenting colums
+ * @row_gpios: pointer to array of gpio numbers representing rows
+ * @col_gpios: pointer to array of gpio numbers reporesenting colums
  * @num_row_gpios: actual number of row gpios used by device
  * @num_col_gpios: actual number of col gpios used by device
  * @col_scan_delay_us: delay, measured in microseconds, that is
@@ -48,8 +48,9 @@ struct matrix_keymap_data {
 struct matrix_keypad_platform_data {
         const struct matrix_keymap_data *keymap_data;
 
-        unsigned int    row_gpios[MATRIX_MAX_ROWS];
-        unsigned int    col_gpios[MATRIX_MAX_COLS];
+        const unsigned int *row_gpios;
+        const unsigned int *col_gpios;
+
         unsigned int    num_row_gpios;
         unsigned int    num_col_gpios;
 
diff --git a/include/linux/iocontext.h b/include/linux/iocontext.h
index dd05434fa45f..4da4a75c3f1e 100644
--- a/include/linux/iocontext.h
+++ b/include/linux/iocontext.h
@@ -92,7 +92,7 @@ static inline struct io_context *ioc_task_link(struct io_context *ioc)
          * a race).
          */
         if (ioc && atomic_long_inc_not_zero(&ioc->refcount)) {
-                atomic_long_inc(&ioc->refcount);
+                atomic_inc(&ioc->nr_tasks);
                 return ioc;
         }
 
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 16713dc672e4..3060bdc35ffe 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -110,6 +110,7 @@ struct kvm_memory_slot {
 
 struct kvm_kernel_irq_routing_entry {
         u32 gsi;
+        u32 type;
         int (*set)(struct kvm_kernel_irq_routing_entry *e,
                     struct kvm *kvm, int level);
         union {
diff --git a/include/linux/lguest.h b/include/linux/lguest.h
index dbf2479e808e..2fb1dcbcb5aa 100644
--- a/include/linux/lguest.h
+++ b/include/linux/lguest.h
@@ -1,5 +1,7 @@
-/* Things the lguest guest needs to know.  Note: like all lguest interfaces,
- * this is subject to wild and random change between versions. */
+/*
+ * Things the lguest guest needs to know.  Note: like all lguest interfaces,
+ * this is subject to wild and random change between versions.
+ */
 #ifndef _LINUX_LGUEST_H
 #define _LINUX_LGUEST_H
 
@@ -11,32 +13,41 @@
 #define LG_CLOCK_MIN_DELTA      100UL
 #define LG_CLOCK_MAX_DELTA      ULONG_MAX
 
-/*G:031 The second method of communicating with the Host is to via "struct
+/*G:031
+ * The second method of communicating with the Host is to via "struct
  * lguest_data".  Once the Guest's initialization hypercall tells the Host where
- * this is, the Guest and Host both publish information in it. :*/
-struct lguest_data
-{
-        /* 512 == enabled (same as eflags in normal hardware).  The Guest
-         * changes interrupts so often that a hypercall is too slow. */
+ * this is, the Guest and Host both publish information in it.
+:*/
+struct lguest_data {
+        /*
+         * 512 == enabled (same as eflags in normal hardware).  The Guest
+         * changes interrupts so often that a hypercall is too slow.
+         */
         unsigned int irq_enabled;
         /* Fine-grained interrupt disabling by the Guest */
         DECLARE_BITMAP(blocked_interrupts, LGUEST_IRQS);
 
-        /* The Host writes the virtual address of the last page fault here,
+        /*
+         * The Host writes the virtual address of the last page fault here,
          * which saves the Guest a hypercall.  CR2 is the native register where
-         * this address would normally be found. */
+         * this address would normally be found.
+         */
         unsigned long cr2;
 
         /* Wallclock time set by the Host. */
         struct timespec time;
 
-        /* Interrupt pending set by the Host.  The Guest should do a hypercall
-         * if it re-enables interrupts and sees this set (to X86_EFLAGS_IF). */
+        /*
+         * Interrupt pending set by the Host.  The Guest should do a hypercall
+         * if it re-enables interrupts and sees this set (to X86_EFLAGS_IF).
+         */
         int irq_pending;
 
-        /* Async hypercall ring.  Instead of directly making hypercalls, we can
+        /*
+         * Async hypercall ring.  Instead of directly making hypercalls, we can
          * place them in here for processing the next time the Host wants.
-         * This batching can be quite efficient. */
+         * This batching can be quite efficient.
+         */
 
         /* 0xFF == done (set by Host), 0 == pending (set by Guest). */
         u8 hcall_status[LHCALL_RING_SIZE];
diff --git a/include/linux/lguest_launcher.h b/include/linux/lguest_launcher.h
index bfefbdf7498a..495203ff221c 100644
--- a/include/linux/lguest_launcher.h
+++ b/include/linux/lguest_launcher.h
@@ -29,8 +29,10 @@ struct lguest_device_desc {
         __u8 type;
         /* The number of virtqueues (first in config array) */
         __u8 num_vq;
-        /* The number of bytes of feature bits.  Multiply by 2: one for host
-         * features and one for Guest acknowledgements. */
+        /*
+         * The number of bytes of feature bits.  Multiply by 2: one for host
+         * features and one for Guest acknowledgements.
+         */
         __u8 feature_len;
         /* The number of bytes of the config array after virtqueues. */
         __u8 config_len;
@@ -39,8 +41,10 @@ struct lguest_device_desc {
         __u8 config[0];
 };
 
-/*D:135 This is how we expect the device configuration field for a virtqueue
- * to be laid out in config space. */
+/*D:135
+ * This is how we expect the device configuration field for a virtqueue
+ * to be laid out in config space.
+ */
 struct lguest_vqconfig {
         /* The number of entries in the virtio_ring */
         __u16 num;
@@ -61,7 +65,9 @@ enum lguest_req
         LHREQ_EVENTFD, /* + address, fd. */
 };
 
-/* The alignment to use between consumer and producer parts of vring.
- * x86 pagesize for historical reasons. */
+/*
+ * The alignment to use between consumer and producer parts of vring.
+ * x86 pagesize for historical reasons.
+ */
 #define LGUEST_VRING_ALIGN      4096
 #endif /* _LINUX_LGUEST_LAUNCHER */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 79b6d7fd4ac2..e5b6e33c6571 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -589,6 +589,7 @@ struct ata_device {
 #endif
         /* n_sector is CLEAR_BEGIN, read comment above CLEAR_BEGIN */
         u64                     n_sectors;      /* size of device, if ATA */
+        u64                     n_native_sectors; /* native size, if ATA */
         unsigned int            class;          /* ATA_DEV_xxx */
         unsigned long           unpark_deadline;
 
diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
index 5675b63a0631..0f32a9b6ff55 100644
--- a/include/linux/mtd/mtd.h
+++ b/include/linux/mtd/mtd.h
@@ -251,7 +251,7 @@ struct mtd_info {
 
 static inline struct mtd_info *dev_to_mtd(struct device *dev)
 {
-        return dev ? container_of(dev, struct mtd_info, dev) : NULL;
+        return dev ? dev_get_drvdata(dev) : NULL;
 }
 
 static inline uint32_t mtd_div_by_eb(uint64_t sz, struct mtd_info *mtd)
diff --git a/include/linux/mtd/partitions.h b/include/linux/mtd/partitions.h
index af6dcb992bc3..b70313d33ff8 100644
--- a/include/linux/mtd/partitions.h
+++ b/include/linux/mtd/partitions.h
@@ -47,6 +47,8 @@ struct mtd_partition {
 #define MTDPART_SIZ_FULL        (0)
 
 
+struct mtd_info;
+
 int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
 int del_mtd_partitions(struct mtd_info *);
 
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index fdffb413b192..f6b90240dd41 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -473,7 +473,6 @@ extern int  nfs_writepages(struct address_space *, struct writeback_control *);
 extern int  nfs_flush_incompatible(struct file *file, struct page *page);
 extern int  nfs_updatepage(struct file *, struct page *, unsigned int, unsigned int);
 extern int nfs_writeback_done(struct rpc_task *, struct nfs_write_data *);
-extern void nfs_writedata_release(void *);
 
 /*
  * Try to write back everything synchronously (but check the
@@ -488,7 +487,6 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page);
 extern int  nfs_commit_inode(struct inode *, int);
 extern struct nfs_write_data *nfs_commitdata_alloc(void);
 extern void nfs_commit_free(struct nfs_write_data *wdata);
-extern void nfs_commitdata_release(void *wdata);
 #else
 static inline int
 nfs_commit_inode(struct inode *inode, int how)
@@ -507,6 +505,7 @@ nfs_have_writebacks(struct inode *inode)
  * Allocate nfs_write_data structures
  */
 extern struct nfs_write_data *nfs_writedata_alloc(unsigned int npages);
+extern void nfs_writedata_free(struct nfs_write_data *);
 
 /*
  * linux/fs/nfs/read.c
@@ -515,7 +514,6 @@ extern int  nfs_readpage(struct file *, struct page *);
 extern int  nfs_readpages(struct file *, struct address_space *,
                 struct list_head *, unsigned);
 extern int  nfs_readpage_result(struct rpc_task *, struct nfs_read_data *);
-extern void nfs_readdata_release(void *data);
 extern int  nfs_readpage_async(struct nfs_open_context *, struct inode *,
                                struct page *);
 
@@ -523,6 +521,7 @@ extern int  nfs_readpage_async(struct nfs_open_context *, struct inode *,
  * Allocate nfs_read_data structures
  */
 extern struct nfs_read_data *nfs_readdata_alloc(unsigned int npages);
+extern void nfs_readdata_free(struct nfs_read_data *);
 
 /*
  * linux/fs/nfs3proc.c
diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
index 829b94b156f2..b359c4a9ec9e 100644
--- a/include/linux/nodemask.h
+++ b/include/linux/nodemask.h
@@ -82,6 +82,12 @@
  *    to generate slightly worse code.  So use a simple one-line #define
  *    for node_isset(), instead of wrapping an inline inside a macro, the
  *    way we do the other calls.
+ *
+ * NODEMASK_SCRATCH
+ * When doing above logical AND, OR, XOR, Remap operations the callers tend to
+ * need temporary nodemask_t's on the stack. But if NODES_SHIFT is large,
+ * nodemask_t's consume too much stack space.  NODEMASK_SCRATCH is a helper
+ * for such situations. See below and CPUMASK_ALLOC also.
  */
 
 #include <linux/kernel.h>
@@ -473,4 +479,26 @@ static inline int num_node_state(enum node_states state)
 #define for_each_node(node)        for_each_node_state(node, N_POSSIBLE)
 #define for_each_online_node(node) for_each_node_state(node, N_ONLINE)
 
+/*
+ * For nodemask scrach area.(See CPUMASK_ALLOC() in cpumask.h)
+ */
+
+#if NODES_SHIFT > 8 /* nodemask_t > 64 bytes */
+#define NODEMASK_ALLOC(x, m) struct x *m = kmalloc(sizeof(*m), GFP_KERNEL)
+#define NODEMASK_FREE(m) kfree(m)
+#else
+#define NODEMASK_ALLOC(x, m) struct x _m, *m = &_m
+#define NODEMASK_FREE(m)
+#endif
+
+/* A example struture for using NODEMASK_ALLOC, used in mempolicy. */
+struct nodemask_scratch {
+        nodemask_t      mask1;
+        nodemask_t      mask2;
+};
+
+#define NODEMASK_SCRATCH(x) NODEMASK_ALLOC(nodemask_scratch, x)
+#define NODEMASK_SCRATCH_FREE(x)  NODEMASK_FREE(x)
+
+
 #endif /* __LINUX_NODEMASK_H */
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
index c9663c690303..53b94e025c7c 100644
--- a/include/linux/of_mdio.h
+++ b/include/linux/of_mdio.h
@@ -18,5 +18,8 @@ extern struct phy_device *of_phy_connect(struct net_device *dev,
                                          struct device_node *phy_np,
                                          void (*hndlr)(struct net_device *),
                                          u32 flags, phy_interface_t iface);
+extern struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
+                                         void (*hndlr)(struct net_device *),
+                                         phy_interface_t iface);
 
 #endif /* __LINUX_OF_MDIO_H */
diff --git a/include/linux/perf_counter.h b/include/linux/perf_counter.h
index bd15d7a5f5ce..a9d823a93fe8 100644
--- a/include/linux/perf_counter.h
+++ b/include/linux/perf_counter.h
@@ -121,8 +121,9 @@ enum perf_counter_sample_format {
         PERF_SAMPLE_CPU                         = 1U << 7,
         PERF_SAMPLE_PERIOD                      = 1U << 8,
         PERF_SAMPLE_STREAM_ID                   = 1U << 9,
+        PERF_SAMPLE_RAW                         = 1U << 10,
 
-        PERF_SAMPLE_MAX = 1U << 10,             /* non-ABI */
+        PERF_SAMPLE_MAX = 1U << 11,             /* non-ABI */
 };
 
 /*
@@ -181,8 +182,9 @@ struct perf_counter_attr {
                                 freq           :  1, /* use freq, not period  */
                                 inherit_stat   :  1, /* per task counts       */
                                 enable_on_exec :  1, /* next exec enables     */
+                                task           :  1, /* trace fork/exit       */
 
-                                __reserved_1   : 51;
+                                __reserved_1   : 50;
 
         __u32                   wakeup_events;  /* wakeup every n events */
         __u32                   __reserved_2;
@@ -311,6 +313,15 @@ enum perf_event_type {
         /*
          * struct {
          *      struct perf_event_header        header;
+         *      u32                             pid, ppid;
+         *      u32                             tid, ptid;
+         * };
+         */
+        PERF_EVENT_EXIT                 = 4,
+
+        /*
+         * struct {
+         *      struct perf_event_header        header;
          *      u64                             time;
          *      u64                             id;
          *      u64                             stream_id;
@@ -323,6 +334,7 @@ enum perf_event_type {
          * struct {
          *      struct perf_event_header        header;
          *      u32                             pid, ppid;
+         *      u32                             tid, ptid;
          * };
          */
         PERF_EVENT_FORK                 = 7,
@@ -357,6 +369,8 @@ enum perf_event_type {
          *
          *      { u64                   nr,
          *        u64                   ips[nr];  } && PERF_SAMPLE_CALLCHAIN
+         *      { u32                   size;
+         *        char                  data[size];}&& PERF_SAMPLE_RAW
          * };
          */
         PERF_EVENT_SAMPLE               = 9,
@@ -402,6 +416,11 @@ struct perf_callchain_entry {
         __u64                           ip[PERF_MAX_STACK_DEPTH];
 };
 
+struct perf_raw_record {
+        u32                             size;
+        void                            *data;
+};
+
 struct task_struct;
 
 /**
@@ -670,6 +689,7 @@ struct perf_sample_data {
         struct pt_regs                  *regs;
         u64                             addr;
         u64                             period;
+        struct perf_raw_record          *raw;
 };
 
 extern int perf_counter_overflow(struct perf_counter *counter, int nmi,
diff --git a/include/linux/pps.h b/include/linux/pps.h
index cfe5c7214ec6..0194ab06177b 100644
--- a/include/linux/pps.h
+++ b/include/linux/pps.h
@@ -22,6 +22,8 @@
 #ifndef _PPS_H_
 #define _PPS_H_
 
+#include <linux/types.h>
+
 #define PPS_VERSION             "5.3.6"
 #define PPS_MAX_SOURCES         16              /* should be enough... */
 
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index 2ce29831feb6..278777fa8a3a 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -224,7 +224,7 @@ void rfkill_destroy(struct rfkill *rfkill);
  * should be blocked) so that drivers need not keep track of the soft
  * block state -- which they might not be able to.
  */
-bool __must_check rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
+bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
 
 /**
  * rfkill_set_sw_state - Set the internal rfkill software block state
diff --git a/include/linux/scatterlist.h b/include/linux/scatterlist.h
index e5996984ddd0..9aaf5bfdad1a 100644
--- a/include/linux/scatterlist.h
+++ b/include/linux/scatterlist.h
@@ -242,6 +242,8 @@ size_t sg_copy_to_buffer(struct scatterlist *sgl, unsigned int nents,
  */
 
 #define SG_MITER_ATOMIC         (1 << 0)         /* use kmap_atomic */
+#define SG_MITER_TO_SG          (1 << 1)        /* flush back to phys on unmap */
+#define SG_MITER_FROM_SG        (1 << 2)        /* nop */
 
 struct sg_mapping_iter {
         /* the following three fields can be accessed directly */
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 1488d8c81aac..e8c6c9136c97 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -394,6 +394,7 @@ extern void __do_SAK(struct tty_struct *tty);
 extern void disassociate_ctty(int priv);
 extern void no_tty(void);
 extern void tty_flip_buffer_push(struct tty_struct *tty);
+extern void tty_flush_to_ldisc(struct tty_struct *tty);
 extern void tty_buffer_free_all(struct tty_struct *tty);
 extern void tty_buffer_flush(struct tty_struct *tty);
 extern void tty_buffer_init(struct tty_struct *tty);
diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
index 40f38d896777..0c4ee9b88f85 100644
--- a/include/linux/tty_ldisc.h
+++ b/include/linux/tty_ldisc.h
@@ -144,7 +144,7 @@ struct tty_ldisc_ops {
 
 struct tty_ldisc {
         struct tty_ldisc_ops *ops;
-        int refcount;
+        atomic_t users;
 };
 
 #define TTY_LDISC_MAGIC 0x5403
diff --git a/include/linux/uio.h b/include/linux/uio.h
index b7fe13883bdb..98c114323a8b 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -19,15 +19,6 @@ struct iovec
         __kernel_size_t iov_len; /* Must be size_t (1003.1g) */
 };
 
-#ifdef __KERNEL__
-
-struct kvec {
-        void *iov_base; /* and that should *never* hold a userland pointer */
-        size_t iov_len;
-};
-
-#endif
-
 /*
  *      UIO_MAXIOV shall be at least 16 1003.1g (5.4.1.1)
  */
@@ -35,6 +26,13 @@ struct kvec {
 #define UIO_FASTIOV     8
 #define UIO_MAXIOV      1024
 
+#ifdef __KERNEL__
+
+struct kvec {
+        void *iov_base; /* and that should *never* hold a userland pointer */
+        size_t iov_len;
+};
+
 /*
  * Total number of bytes covered by an iovec.
  *
@@ -53,5 +51,6 @@ static inline size_t iov_length(const struct iovec *iov, unsigned long nr_segs)
 }
 
 unsigned long iov_shorten(struct iovec *iov, unsigned long nr_segs, size_t to);
+#endif
 
 #endif
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index 95846d988011..74f16876f38d 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -338,6 +338,7 @@ struct v4l2_pix_format {
 /*  Vendor-specific formats   */
 #define V4L2_PIX_FMT_WNVA     v4l2_fourcc('W', 'N', 'V', 'A') /* Winnov hw compress */
 #define V4L2_PIX_FMT_SN9C10X  v4l2_fourcc('S', '9', '1', '0') /* SN9C10x compression */
+#define V4L2_PIX_FMT_SN9C20X_I420 v4l2_fourcc('S', '9', '2', '0') /* SN9C20x YUV 4:2:0 */
 #define V4L2_PIX_FMT_PWC1     v4l2_fourcc('P', 'W', 'C', '1') /* pwc older webcam */
 #define V4L2_PIX_FMT_PWC2     v4l2_fourcc('P', 'W', 'C', '2') /* pwc newer webcam */
 #define V4L2_PIX_FMT_ET61X251 v4l2_fourcc('E', '6', '2', '5') /* ET61X251 compression */
diff --git a/include/linux/virtio_blk.h b/include/linux/virtio_blk.h
index be7d255fc7cf..8dab9f2b8832 100644
--- a/include/linux/virtio_blk.h
+++ b/include/linux/virtio_blk.h
@@ -20,8 +20,7 @@
 
 #define VIRTIO_BLK_ID_BYTES     (sizeof(__u16[256]))    /* IDENTIFY DATA */
 
-struct virtio_blk_config
-{
+struct virtio_blk_config {
         /* The capacity (in 512-byte sectors). */
         __u64 capacity;
         /* The maximum segment size (if VIRTIO_BLK_F_SIZE_MAX) */
@@ -50,8 +49,7 @@ struct virtio_blk_config
 #define VIRTIO_BLK_T_BARRIER    0x80000000
 
 /* This is the first element of the read scatter-gather list. */
-struct virtio_blk_outhdr
-{
+struct virtio_blk_outhdr {
         /* VIRTIO_BLK_T* */
         __u32 type;
         /* io priority. */
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 99f514575f6a..e547e3c8ee9a 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -79,8 +79,7 @@
  *      the dev->feature bits if it wants.
  */
 typedef void vq_callback_t(struct virtqueue *);
-struct virtio_config_ops
-{
+struct virtio_config_ops {
         void (*get)(struct virtio_device *vdev, unsigned offset,
                     void *buf, unsigned len);
         void (*set)(struct virtio_device *vdev, unsigned offset,
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index 9c543d6ac535..d8dd539c9f48 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -31,8 +31,7 @@
 
 #define VIRTIO_NET_S_LINK_UP    1       /* Link is up */
 
-struct virtio_net_config
-{
+struct virtio_net_config {
         /* The config defining mac address (if VIRTIO_NET_F_MAC) */
         __u8 mac[6];
         /* See VIRTIO_NET_F_STATUS and VIRTIO_NET_S_* above */
@@ -41,8 +40,7 @@ struct virtio_net_config
 
 /* This is the first element of the scatter-gather list.  If you don't
  * specify GSO or CSUM features, you can simply ignore the header. */
-struct virtio_net_hdr
-{
+struct virtio_net_hdr {
 #define VIRTIO_NET_HDR_F_NEEDS_CSUM     1       // Use csum_start, csum_offset
         __u8 flags;
 #define VIRTIO_NET_HDR_GSO_NONE         0       // Not a GSO frame
diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
index 693e0ec5afa6..e4d144b132b5 100644
--- a/include/linux/virtio_ring.h
+++ b/include/linux/virtio_ring.h
@@ -30,8 +30,7 @@
 #define VIRTIO_RING_F_INDIRECT_DESC     28
 
 /* Virtio ring descriptors: 16 bytes.  These can chain together via "next". */
-struct vring_desc
-{
+struct vring_desc {
         /* Address (guest-physical). */
         __u64 addr;
         /* Length. */
@@ -42,24 +41,21 @@ struct vring_desc
         __u16 next;
 };
 
-struct vring_avail
-{
+struct vring_avail {
         __u16 flags;
         __u16 idx;
         __u16 ring[];
 };
 
 /* u32 is used here for ids for padding reasons. */
-struct vring_used_elem
-{
+struct vring_used_elem {
         /* Index of start of used descriptor chain. */
         __u32 id;
         /* Total length of the descriptor chain which was used (written to) */
         __u32 len;
 };
 
-struct vring_used
-{
+struct vring_used {
         __u16 flags;
         __u16 idx;
         struct vring_used_elem ring[];