Merge branch 'master' of /repos/git/net-next-2.6

Signed-off-by: Patrick McHardy <kaber@trash.net>

84 files changed, 1078 insertions, 284 deletions

diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h
index 9d7febde10a..09469971472 100644
--- a/include/acpi/platform/aclinux.h
+++ b/include/acpi/platform/aclinux.h
@@ -152,7 +152,7 @@ static inline void *acpi_os_acquire_object(acpi_cache_t * cache)
 #include <linux/hardirq.h>
 #define ACPI_PREEMPTION_POINT() \
         do { \
-                if (!in_atomic_preempt_off()) \
+                if (!in_atomic_preempt_off() && !irqs_disabled()) \
                         cond_resched(); \
         } while (0)
 
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 29245c6b5c0..0ea5ef4eb6a 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -224,8 +224,6 @@ struct acpi_processor {
         struct acpi_processor_throttling throttling;
         struct acpi_processor_limit limit;
         struct thermal_cooling_device *cdev;
-        /* the _PDC objects for this processor, if any */
-        struct acpi_object_list *pdc;
 };
 
 struct acpi_processor_errata {
@@ -257,9 +255,6 @@ int acpi_processor_notify_smm(struct module *calling_module);
 DECLARE_PER_CPU(struct acpi_processor *, processors);
 extern struct acpi_processor_errata errata;
 
-void arch_acpi_processor_init_pdc(struct acpi_processor *pr);
-void arch_acpi_processor_cleanup_pdc(struct acpi_processor *pr);
-
 #ifdef ARCH_HAS_POWER_INIT
 void acpi_processor_power_init_bm_check(struct acpi_processor_flags *flags,
                                         unsigned int cpu);
@@ -325,6 +320,9 @@ static inline int acpi_processor_get_bios_limit(int cpu, unsigned int *limit)
 
 #endif                          /* CONFIG_CPU_FREQ */
 
+/* in processor_pdc.c */
+void acpi_processor_set_pdc(acpi_handle handle);
+
 /* in processor_throttling.c */
 int acpi_processor_tstate_has_changed(struct acpi_processor *pr);
 int acpi_processor_get_throttling_info(struct acpi_processor *pr);
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 71dafb69cfe..ffac157fb5b 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -1408,7 +1408,7 @@ extern int drm_ati_pcigart_cleanup(struct drm_device *dev,
                                    struct drm_ati_pcigart_info * gart_info);
 
 extern drm_dma_handle_t *drm_pci_alloc(struct drm_device *dev, size_t size,
-                                       size_t align, dma_addr_t maxaddr);
+                                       size_t align);
 extern void __drm_pci_free(struct drm_device *dev, drm_dma_handle_t * dmah);
 extern void drm_pci_free(struct drm_device *dev, drm_dma_handle_t * dmah);
 
diff --git a/include/drm/drm_mode.h b/include/drm/drm_mode.h
index 43009bc2e75..bc4fdf27bd2 100644
--- a/include/drm/drm_mode.h
+++ b/include/drm/drm_mode.h
@@ -160,6 +160,7 @@ struct drm_mode_get_encoder {
 #define DRM_MODE_CONNECTOR_HDMIA        11
 #define DRM_MODE_CONNECTOR_HDMIB        12
 #define DRM_MODE_CONNECTOR_TV           13
+#define DRM_MODE_CONNECTOR_eDP          14
 
 struct drm_mode_get_connector {
 
diff --git a/include/drm/i915_drm.h b/include/drm/i915_drm.h
index ec3f5e80a5d..b64a8d7cdf6 100644
--- a/include/drm/i915_drm.h
+++ b/include/drm/i915_drm.h
@@ -188,6 +188,7 @@ typedef struct _drm_i915_sarea {
 #define DRM_I915_GEM_MADVISE    0x26
 #define DRM_I915_OVERLAY_PUT_IMAGE      0x27
 #define DRM_I915_OVERLAY_ATTRS  0x28
+#define DRM_I915_GEM_EXECBUFFER2        0x29
 
 #define DRM_IOCTL_I915_INIT             DRM_IOW( DRM_COMMAND_BASE + DRM_I915_INIT, drm_i915_init_t)
 #define DRM_IOCTL_I915_FLUSH            DRM_IO ( DRM_COMMAND_BASE + DRM_I915_FLUSH)
@@ -207,6 +208,7 @@ typedef struct _drm_i915_sarea {
 #define DRM_IOCTL_I915_VBLANK_SWAP      DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_VBLANK_SWAP, drm_i915_vblank_swap_t)
 #define DRM_IOCTL_I915_GEM_INIT         DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_INIT, struct drm_i915_gem_init)
 #define DRM_IOCTL_I915_GEM_EXECBUFFER   DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_EXECBUFFER, struct drm_i915_gem_execbuffer)
+#define DRM_IOCTL_I915_GEM_EXECBUFFER2  DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_EXECBUFFER2, struct drm_i915_gem_execbuffer2)
 #define DRM_IOCTL_I915_GEM_PIN          DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_PIN, struct drm_i915_gem_pin)
 #define DRM_IOCTL_I915_GEM_UNPIN        DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_UNPIN, struct drm_i915_gem_unpin)
 #define DRM_IOCTL_I915_GEM_BUSY         DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_BUSY, struct drm_i915_gem_busy)
@@ -272,6 +274,7 @@ typedef struct drm_i915_irq_wait {
 #define I915_PARAM_NUM_FENCES_AVAIL      6
 #define I915_PARAM_HAS_OVERLAY           7
 #define I915_PARAM_HAS_PAGEFLIPPING      8
+#define I915_PARAM_HAS_EXECBUF2          9
 
 typedef struct drm_i915_getparam {
         int param;
@@ -567,6 +570,57 @@ struct drm_i915_gem_execbuffer {
         __u64 cliprects_ptr;
 };
 
+struct drm_i915_gem_exec_object2 {
+        /**
+         * User's handle for a buffer to be bound into the GTT for this
+         * operation.
+         */
+        __u32 handle;
+
+        /** Number of relocations to be performed on this buffer */
+        __u32 relocation_count;
+        /**
+         * Pointer to array of struct drm_i915_gem_relocation_entry containing
+         * the relocations to be performed in this buffer.
+         */
+        __u64 relocs_ptr;
+
+        /** Required alignment in graphics aperture */
+        __u64 alignment;
+
+        /**
+         * Returned value of the updated offset of the object, for future
+         * presumed_offset writes.
+         */
+        __u64 offset;
+
+#define EXEC_OBJECT_NEEDS_FENCE (1<<0)
+        __u64 flags;
+        __u64 rsvd1;
+        __u64 rsvd2;
+};
+
+struct drm_i915_gem_execbuffer2 {
+        /**
+         * List of gem_exec_object2 structs
+         */
+        __u64 buffers_ptr;
+        __u32 buffer_count;
+
+        /** Offset in the batchbuffer to start execution from. */
+        __u32 batch_start_offset;
+        /** Bytes used in batchbuffer from batch_start_offset */
+        __u32 batch_len;
+        __u32 DR1;
+        __u32 DR4;
+        __u32 num_cliprects;
+        /** This is a struct drm_clip_rect *cliprects */
+        __u64 cliprects_ptr;
+        __u64 flags; /* currently unused */
+        __u64 rsvd1;
+        __u64 rsvd2;
+};
+
 struct drm_i915_gem_pin {
         /** Handle of the buffer to be pinned. */
         __u32 handle;
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 756f831cbdd..d93080748a9 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -362,6 +362,7 @@ unifdef-y += uio.h
 unifdef-y += unistd.h
 unifdef-y += usbdevice_fs.h
 unifdef-y += utsname.h
+unifdef-y += vhost.h
 unifdef-y += videodev2.h
 unifdef-y += videodev.h
 unifdef-y += virtio_config.h
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index ce945d4845f..b926afe8c03 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -80,7 +80,7 @@ char * __acpi_map_table (unsigned long phys_addr, unsigned long size);
 void __acpi_unmap_table(char *map, unsigned long size);
 int early_acpi_boot_init(void);
 int acpi_boot_init (void);
-int acpi_boot_table_init (void);
+void acpi_boot_table_init (void);
 int acpi_mps_check (void);
 int acpi_numa_init (void);
 
@@ -251,6 +251,7 @@ int acpi_check_mem_region(resource_size_t start, resource_size_t n,
 void __init acpi_no_s4_hw_signature(void);
 void __init acpi_old_suspend_ordering(void);
 void __init acpi_s4_no_nvs(void);
+void __init acpi_set_sci_en_on_resume(void);
 #endif /* CONFIG_PM_SLEEP */
 
 struct acpi_osc_context {
@@ -320,9 +321,9 @@ static inline int acpi_boot_init(void)
         return 0;
 }
 
-static inline int acpi_boot_table_init(void)
+static inline void acpi_boot_table_init(void)
 {
-        return 0;
+        return;
 }
 
 static inline int acpi_mps_check(void)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 784a919aa0d..5c8018977ef 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -845,7 +845,6 @@ static inline struct request_queue *bdev_get_queue(struct block_device *bdev)
  * blk_rq_err_bytes()           : bytes left till the next error boundary
  * blk_rq_sectors()             : sectors left in the entire request
  * blk_rq_cur_sectors()         : sectors left in the current segment
- * blk_rq_err_sectors()         : sectors left till the next error boundary
  */
 static inline sector_t blk_rq_pos(const struct request *rq)
 {
@@ -874,11 +873,6 @@ static inline unsigned int blk_rq_cur_sectors(const struct request *rq)
         return blk_rq_cur_bytes(rq) >> 9;
 }
 
-static inline unsigned int blk_rq_err_sectors(const struct request *rq)
-{
-        return blk_rq_err_bytes(rq) >> 9;
-}
-
 /*
  * Request issue related functions.
  */
@@ -944,6 +938,8 @@ extern void blk_queue_io_opt(struct request_queue *q, unsigned int opt);
 extern void blk_set_default_limits(struct queue_limits *lim);
 extern int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
                             sector_t offset);
+extern int bdev_stack_limits(struct queue_limits *t, struct block_device *bdev,
+                            sector_t offset);
 extern void disk_stack_limits(struct gendisk *disk, struct block_device *bdev,
                               sector_t offset);
 extern void blk_queue_stack_limits(struct request_queue *t, struct request_queue *b);
@@ -1116,11 +1112,18 @@ static inline int queue_alignment_offset(struct request_queue *q)
         return q->limits.alignment_offset;
 }
 
+static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t offset)
+{
+        unsigned int granularity = max(lim->physical_block_size, lim->io_min);
+
+        offset &= granularity - 1;
+        return (granularity + lim->alignment_offset - offset) & (granularity - 1);
+}
+
 static inline int queue_sector_alignment_offset(struct request_queue *q,
                                                 sector_t sector)
 {
-        return ((sector << 9) - q->limits.alignment_offset)
-                & (q->limits.io_min - 1);
+        return queue_limit_alignment_offset(&q->limits, sector << 9);
 }
 
 static inline int bdev_alignment_offset(struct block_device *bdev)
@@ -1147,8 +1150,11 @@ static inline int queue_discard_alignment(struct request_queue *q)
 static inline int queue_sector_discard_alignment(struct request_queue *q,
                                                  sector_t sector)
 {
-        return ((sector << 9) - q->limits.discard_alignment)
-                & (q->limits.discard_granularity - 1);
+        struct queue_limits *lim = &q->limits;
+        unsigned int alignment = (sector << 9) & (lim->discard_granularity - 1);
+
+        return (lim->discard_granularity + lim->discard_alignment - alignment)
+                & (lim->discard_granularity - 1);
 }
 
 static inline unsigned int queue_discard_zeroes_data(struct request_queue *q)
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index 3db7767d2a1..c8c660a79f9 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -38,6 +38,7 @@ struct can_priv {
 
         enum can_state state;
         u32 ctrlmode;
+        u32 ctrlmode_supported;
 
         int restart_ms;
         struct timer_list restart_timer;
@@ -60,6 +61,21 @@ struct can_priv {
  */
 #define get_can_dlc(i)  (min_t(__u8, (i), 8))
 
+/* Drop a given socketbuffer if it does not contain a valid CAN frame. */
+static inline int can_dropped_invalid_skb(struct net_device *dev,
+                                          struct sk_buff *skb)
+{
+        const struct can_frame *cf = (struct can_frame *)skb->data;
+
+        if (unlikely(skb->len != sizeof(*cf) || cf->can_dlc > 8)) {
+                kfree_skb(skb);
+                dev->stats.tx_dropped++;
+                return 1;
+        }
+
+        return 0;
+}
+
 struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max);
 void free_candev(struct net_device *dev);
 
diff --git a/include/linux/connector.h b/include/linux/connector.h
index 72ba63eb83c..3a779ffba60 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -24,9 +24,6 @@
 
 #include <linux/types.h>
 
-#define CN_IDX_CONNECTOR                0xffffffff
-#define CN_VAL_CONNECTOR                0xffffffff
-
 /*
  * Process Events connector unique ids -- used for message routing
  */
@@ -75,30 +72,6 @@ struct cn_msg {
         __u8 data[0];
 };
 
-/*
- * Notify structure - requests notification about
- * registering/unregistering idx/val in range [first, first+range].
- */
-struct cn_notify_req {
-        __u32 first;
-        __u32 range;
-};
-
-/*
- * Main notification control message
- * *_notify_num         - number of appropriate cn_notify_req structures after 
- *                              this struct.
- * group                - notification receiver's idx.
- * len                  - total length of the attached data.
- */
-struct cn_ctl_msg {
-        __u32 idx_notify_num;
-        __u32 val_notify_num;
-        __u32 group;
-        __u32 len;
-        __u8 data[0];
-};
-
 #ifdef __KERNEL__
 
 #include <asm/atomic.h>
@@ -151,11 +124,6 @@ struct cn_callback_entry {
         u32 seq, group;
 };
 
-struct cn_ctl_entry {
-        struct list_head notify_entry;
-        struct cn_ctl_msg *msg;
-};
-
 struct cn_dev {
         struct cb_id id;
 
diff --git a/include/linux/decompress/unlzo.h b/include/linux/decompress/unlzo.h
new file mode 100644
index 00000000000..98722975251
--- /dev/null
+++ b/include/linux/decompress/unlzo.h
@@ -0,0 +1,10 @@
+#ifndef DECOMPRESS_UNLZO_H
+#define DECOMPRESS_UNLZO_H
+
+int unlzo(unsigned char *inbuf, int len,
+        int(*fill)(void*, unsigned int),
+        int(*flush)(void*, unsigned int),
+        unsigned char *output,
+        int *pos,
+        void(*error)(char *x));
+#endif
diff --git a/include/linux/drbd.h b/include/linux/drbd.h
index e84f4733cb5..78962272338 100644
--- a/include/linux/drbd.h
+++ b/include/linux/drbd.h
@@ -53,7 +53,7 @@
 
 
 extern const char *drbd_buildtag(void);
-#define REL_VERSION "8.3.6"
+#define REL_VERSION "8.3.7"
 #define API_VERSION 88
 #define PRO_VERSION_MIN 86
 #define PRO_VERSION_MAX 91
diff --git a/include/linux/drbd_nl.h b/include/linux/drbd_nl.h
index db5721ad50d..a4d82f89599 100644
--- a/include/linux/drbd_nl.h
+++ b/include/linux/drbd_nl.h
@@ -69,6 +69,7 @@ NL_PACKET(disconnect, 6, )
 
 NL_PACKET(resize, 7,
         NL_INT64(               29,     T_MAY_IGNORE,   resize_size)
+        NL_BIT(                 68,     T_MAY_IGNORE,   resize_force)
 )
 
 NL_PACKET(syncer_conf, 8,
diff --git a/include/linux/fiemap.h b/include/linux/fiemap.h
index 934e22d6580..d830747f5c0 100644
--- a/include/linux/fiemap.h
+++ b/include/linux/fiemap.h
@@ -62,5 +62,7 @@ struct fiemap {
 #define FIEMAP_EXTENT_MERGED            0x00001000 /* File does not natively
                                                     * support extents. Result
                                                     * merged for efficiency. */
+#define FIEMAP_EXTENT_SHARED            0x00002000 /* Space shared with other
+                                                    * files. */
 
 #endif /* _LINUX_FIEMAP_H */
diff --git a/include/linux/firewire-cdev.h b/include/linux/firewire-cdev.h
index c6b3ca3af6d..1f716d9f714 100644
--- a/include/linux/firewire-cdev.h
+++ b/include/linux/firewire-cdev.h
@@ -340,6 +340,9 @@ struct fw_cdev_send_response {
  * The @closure field is passed back to userspace in the response event.
  * The @handle field is an out parameter, returning a handle to the allocated
  * range to be used for later deallocation of the range.
+ *
+ * The address range is allocated on all local nodes.  The address allocation
+ * is exclusive except for the FCP command and response registers.
  */
 struct fw_cdev_allocate {
         __u64 offset;
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index 9416a461b69..a0e67150a72 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -248,8 +248,8 @@ typedef void (*fw_transaction_callback_t)(struct fw_card *card, int rcode,
                                           void *data, size_t length,
                                           void *callback_data);
 /*
- * Important note:  The callback must guarantee that either fw_send_response()
- * or kfree() is called on the @request.
+ * Important note:  Except for the FCP registers, the callback must guarantee
+ * that either fw_send_response() or kfree() is called on the @request.
  */
 typedef void (*fw_address_callback_t)(struct fw_card *card,
                                       struct fw_request *request,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 9147ca88f25..b1bcb275b59 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2463,7 +2463,7 @@ int proc_nr_files(struct ctl_table *table, int write,
 
 int __init get_filesystem_list(char *buf);
 
-#define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
+#define ACC_MODE(x) ("\004\002\006\006"[(x)&O_ACCMODE])
 #define OPEN_FMODE(flag) ((__force fmode_t)((flag + 1) & O_ACCMODE))
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index c6c0c41af35..9717081c75a 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -256,9 +256,9 @@ extern struct hd_struct *disk_map_sector_rcu(struct gendisk *disk,
 #define part_stat_read(part, field)                                     \
 ({                                                                      \
         typeof((part)->dkstats->field) res = 0;                         \
-        int i;                                                          \
-        for_each_possible_cpu(i)                                        \
-                res += per_cpu_ptr((part)->dkstats, i)->field;          \
+        unsigned int _cpu;                                              \
+        for_each_possible_cpu(_cpu)                                     \
+                res += per_cpu_ptr((part)->dkstats, _cpu)->field;       \
         res;                                                            \
 })
 
diff --git a/include/linux/highmem.h b/include/linux/highmem.h
index 211ff449726..ab2cc20e21a 100644
--- a/include/linux/highmem.h
+++ b/include/linux/highmem.h
@@ -46,7 +46,7 @@ void kmap_flush_unused(void);
 
 static inline unsigned int nr_free_highpages(void) { return 0; }
 
-#define totalhigh_pages 0
+#define totalhigh_pages 0UL
 
 #ifndef ARCH_HAS_KMAP
 static inline void *kmap(struct page *page)
diff --git a/include/linux/i2c/adp5588.h b/include/linux/i2c/adp5588.h
index fc5db826b48..02c9af37474 100644
--- a/include/linux/i2c/adp5588.h
+++ b/include/linux/i2c/adp5588.h
@@ -89,4 +89,16 @@ struct adp5588_kpad_platform_data {
         unsigned short unlock_key2;     /* Unlock Key 2 */
 };
 
+struct adp5588_gpio_platform_data {
+        unsigned gpio_start;            /* GPIO Chip base # */
+        unsigned pullup_dis_mask;       /* Pull-Up Disable Mask */
+        int     (*setup)(struct i2c_client *client,
+                                int gpio, unsigned ngpio,
+                                void *context);
+        int     (*teardown)(struct i2c_client *client,
+                                int gpio, unsigned ngpio,
+                                void *context);
+        void    *context;
+};
+
 #endif
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index aeea282bd2f..19984958ab7 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -120,6 +120,26 @@
 #define IEEE80211_QOS_CTL_TID_MASK      0x000F
 #define IEEE80211_QOS_CTL_TAG1D_MASK    0x0007
 
+/* U-APSD queue for WMM IEs sent by AP */
+#define IEEE80211_WMM_IE_AP_QOSINFO_UAPSD       (1<<7)
+
+/* U-APSD queues for WMM IEs sent by STA */
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_VO      (1<<0)
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_VI      (1<<1)
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_BK      (1<<2)
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_BE      (1<<3)
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK    0x0f
+
+/* U-APSD max SP length for WMM IEs sent by STA */
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL     0x00
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_2       0x01
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_4       0x02
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_6       0x03
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK    0x03
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT   5
+
+#define IEEE80211_HT_CTL_LEN            4
+
 struct ieee80211_hdr {
         __le16 frame_control;
         __le16 duration_id;
@@ -130,6 +150,25 @@ struct ieee80211_hdr {
         u8 addr4[6];
 } __attribute__ ((packed));
 
+struct ieee80211_hdr_3addr {
+        __le16 frame_control;
+        __le16 duration_id;
+        u8 addr1[6];
+        u8 addr2[6];
+        u8 addr3[6];
+        __le16 seq_ctrl;
+} __attribute__ ((packed));
+
+struct ieee80211_qos_hdr {
+        __le16 frame_control;
+        __le16 duration_id;
+        u8 addr1[6];
+        u8 addr2[6];
+        u8 addr3[6];
+        __le16 seq_ctrl;
+        __le16 qos_ctrl;
+} __attribute__ ((packed));
+
 /**
  * ieee80211_has_tods - check if IEEE80211_FCTL_TODS is set
  * @fc: frame control bytes in little-endian byteorder
diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index 5f200bac374..51f1512045e 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -1,6 +1,77 @@
 #ifndef _LINUX_IF_MACVLAN_H
 #define _LINUX_IF_MACVLAN_H
 
+#include <linux/if_link.h>
+#include <linux/list.h>
+#include <linux/netdevice.h>
+#include <linux/netlink.h>
+#include <net/netlink.h>
+
+struct macvlan_port;
+struct macvtap_queue;
+
+/**
+ *      struct macvlan_rx_stats - MACVLAN percpu rx stats
+ *      @rx_packets: number of received packets
+ *      @rx_bytes: number of received bytes
+ *      @multicast: number of received multicast packets
+ *      @rx_errors: number of errors
+ */
+struct macvlan_rx_stats {
+        unsigned long rx_packets;
+        unsigned long rx_bytes;
+        unsigned long multicast;
+        unsigned long rx_errors;
+};
+
+struct macvlan_dev {
+        struct net_device       *dev;
+        struct list_head        list;
+        struct hlist_node       hlist;
+        struct macvlan_port     *port;
+        struct net_device       *lowerdev;
+        struct macvlan_rx_stats *rx_stats;
+        enum macvlan_mode       mode;
+        int (*receive)(struct sk_buff *skb);
+        int (*forward)(struct net_device *dev, struct sk_buff *skb);
+        struct macvtap_queue    *tap;
+};
+
+static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
+                                    unsigned int len, bool success,
+                                    bool multicast)
+{
+        struct macvlan_rx_stats *rx_stats;
+
+        rx_stats = per_cpu_ptr(vlan->rx_stats, smp_processor_id());
+        if (likely(success)) {
+                rx_stats->rx_packets++;;
+                rx_stats->rx_bytes += len;
+                if (multicast)
+                        rx_stats->multicast++;
+        } else {
+                rx_stats->rx_errors++;
+        }
+}
+
+extern int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
+                                  struct nlattr *tb[], struct nlattr *data[],
+                                  int (*receive)(struct sk_buff *skb),
+                                  int (*forward)(struct net_device *dev,
+                                                 struct sk_buff *skb));
+
+extern void macvlan_count_rx(const struct macvlan_dev *vlan,
+                             unsigned int len, bool success,
+                             bool multicast);
+
+extern void macvlan_dellink(struct net_device *dev, struct list_head *head);
+
+extern int macvlan_link_register(struct rtnl_link_ops *ops);
+
+extern netdev_tx_t macvlan_start_xmit(struct sk_buff *skb,
+                                      struct net_device *dev);
+
+
 extern struct sk_buff *(*macvlan_handle_frame_hook)(struct sk_buff *);
 
 #endif /* _LINUX_IF_MACVLAN_H */
diff --git a/include/linux/if_packet.h b/include/linux/if_packet.h
index 4021d47cc43..aa57a5f993f 100644
--- a/include/linux/if_packet.h
+++ b/include/linux/if_packet.h
@@ -46,6 +46,7 @@ struct sockaddr_ll {
 #define PACKET_RESERVE                  12
 #define PACKET_TX_RING                  13
 #define PACKET_LOSS                     14
+#define PACKET_VNET_HDR                 15
 
 struct tpacket_stats {
         unsigned int    tp_packets;
diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
index 3f5fd523b49..404abe00162 100644
--- a/include/linux/if_tun.h
+++ b/include/linux/if_tun.h
@@ -86,4 +86,18 @@ struct tun_filter {
         __u8   addr[0][ETH_ALEN];
 };
 
+#ifdef __KERNEL__
+#if defined(CONFIG_TUN) || defined(CONFIG_TUN_MODULE)
+struct socket *tun_get_socket(struct file *);
+#else
+#include <linux/err.h>
+#include <linux/errno.h>
+struct file;
+struct socket;
+static inline struct socket *tun_get_socket(struct file *f)
+{
+        return ERR_PTR(-EINVAL);
+}
+#endif /* CONFIG_TUN */
+#endif /* __KERNEL__ */
 #endif /* __IF_TUN_H */
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index 724c27e5d17..93fc2449af1 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -153,6 +153,7 @@ extern int sysctl_igmp_max_msf;
 struct ip_sf_socklist {
         unsigned int            sl_max;
         unsigned int            sl_count;
+        struct rcu_head         rcu;
         __be32                  sl_addr[0];
 };
 
@@ -170,6 +171,7 @@ struct ip_mc_socklist {
         struct ip_mreqn         multi;
         unsigned int            sfmode;         /* MCAST_{INCLUDE,EXCLUDE} */
         struct ip_sf_socklist   *sflist;
+        struct rcu_head         rcu;
 };
 
 struct ip_sf_list {
diff --git a/include/linux/in.h b/include/linux/in.h
index b615649db12..583c76f9c30 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -84,6 +84,8 @@ struct in_addr {
 #define IP_ORIGDSTADDR       20
 #define IP_RECVORIGDSTADDR   IP_ORIGDSTADDR
 
+#define IP_MINTTL       21
+
 /* IP_MTU_DISCOVER values */
 #define IP_PMTUDISC_DONT                0       /* Never send DF frames */
 #define IP_PMTUDISC_WANT                1       /* Use per route hints  */
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 699e85c01a4..cf257809771 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -81,6 +81,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 #define IN_DEV_FORWARD(in_dev)          IN_DEV_CONF_GET((in_dev), FORWARDING)
 #define IN_DEV_MFORWARD(in_dev)         IN_DEV_ANDCONF((in_dev), MC_FORWARDING)
 #define IN_DEV_RPFILTER(in_dev)         IN_DEV_MAXCONF((in_dev), RP_FILTER)
+#define IN_DEV_SRC_VMARK(in_dev)        IN_DEV_ORCONF((in_dev), SRC_VMARK)
 #define IN_DEV_SOURCE_ROUTE(in_dev)     IN_DEV_ANDCONF((in_dev), \
                                                        ACCEPT_SOURCE_ROUTE)
 #define IN_DEV_ACCEPT_LOCAL(in_dev)     IN_DEV_ORCONF((in_dev), ACCEPT_LOCAL)
@@ -88,6 +89,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 
 #define IN_DEV_LOG_MARTIANS(in_dev)     IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
 #define IN_DEV_PROXY_ARP(in_dev)        IN_DEV_ORCONF((in_dev), PROXY_ARP)
+#define IN_DEV_PROXY_ARP_PVLAN(in_dev)  IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN)
 #define IN_DEV_SHARED_MEDIA(in_dev)     IN_DEV_ORCONF((in_dev), SHARED_MEDIA)
 #define IN_DEV_TX_REDIRECTS(in_dev)     IN_DEV_ORCONF((in_dev), SEND_REDIRECTS)
 #define IN_DEV_SEC_REDIRECTS(in_dev)    IN_DEV_ORCONF((in_dev), \
diff --git a/include/linux/iocontext.h b/include/linux/iocontext.h
index a6323599630..78ef023227d 100644
--- a/include/linux/iocontext.h
+++ b/include/linux/iocontext.h
@@ -4,32 +4,6 @@
 #include <linux/radix-tree.h>
 #include <linux/rcupdate.h>
 
-/*
- * This is the per-process anticipatory I/O scheduler state.
- */
-struct as_io_context {
-        spinlock_t lock;
-
-        void (*dtor)(struct as_io_context *aic); /* destructor */
-        void (*exit)(struct as_io_context *aic); /* called on task exit */
-
-        unsigned long state;
-        atomic_t nr_queued; /* queued reads & sync writes */
-        atomic_t nr_dispatched; /* number of requests gone to the drivers */
-
-        /* IO History tracking */
-        /* Thinktime */
-        unsigned long last_end_request;
-        unsigned long ttime_total;
-        unsigned long ttime_samples;
-        unsigned long ttime_mean;
-        /* Layout pattern */
-        unsigned int seek_samples;
-        sector_t last_request_pos;
-        u64 seek_total;
-        sector_t seek_mean;
-};
-
 struct cfq_queue;
 struct cfq_io_context {
         void *key;
@@ -78,7 +52,6 @@ struct io_context {
         unsigned long last_waited; /* Time last woken after wait for request */
         int nr_batch_requests;     /* Number of requests left in the batch */
 
-        struct as_io_context *aic;
         struct radix_tree_root radix_root;
         struct hlist_head cic_list;
         void *ioc_data;
diff --git a/include/linux/isdn/capilli.h b/include/linux/isdn/capilli.h
index 7acb87a4487..d3e5e9da0c8 100644
--- a/include/linux/isdn/capilli.h
+++ b/include/linux/isdn/capilli.h
@@ -50,8 +50,7 @@ struct capi_ctr {
         u16  (*send_message)(struct capi_ctr *, struct sk_buff *skb);
         
         char *(*procinfo)(struct capi_ctr *);
-        int (*ctr_read_proc)(char *page, char **start, off_t off,
-                             int count, int *eof, struct capi_ctr *card);
+        const struct file_operations *proc_fops;
 
         /* filled in before calling ready callback */
         u8 manu[CAPI_MANUFACTURER_LEN];         /* CAPI_GET_MANUFACTURER */
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index f1011f7f3d4..638ce4554c7 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -653,6 +653,7 @@ struct transaction_s
          * waiting for it to finish.
          */
         unsigned int t_synchronous_commit:1;
+        unsigned int t_flushed_data_blocks:1;
 
         /*
          * For use by the filesystem to store fs-specific data
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 3fc9f5aab5f..328bca609b9 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -734,6 +734,10 @@ struct sysinfo {
 /* Force a compilation error if condition is constant and true */
 #define MAYBE_BUILD_BUG_ON(cond) ((void)sizeof(char[1 - 2 * !!(cond)]))
 
+/* Force a compilation error if a constant expression is not a power of 2 */
+#define BUILD_BUG_ON_NOT_POWER_OF_2(n)                  \
+        BUILD_BUG_ON((n) == 0 || (((n) & ((n) - 1)) != 0))
+
 /* Force a compilation error if condition is true, but also produce a
    result (of value 0 and type size_t), so the expression can be used
    e.g. in a structure initializer (or where-ever else comma expressions
diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h
index 3d44e9c65a8..6f6c5f300af 100644
--- a/include/linux/kfifo.h
+++ b/include/linux/kfifo.h
@@ -67,7 +67,7 @@ struct kfifo {
 /**
  * DECLARE_KFIFO - macro to declare a kfifo and the associated buffer
  * @name: name of the declared kfifo datatype
- * @size: size of the fifo buffer
+ * @size: size of the fifo buffer. Must be a power of two.
  *
  * Note1: the macro can be used inside struct or union declaration
  * Note2: the macro creates two objects:
@@ -81,7 +81,7 @@ union { \
 }
 
 /**
- * INIT_KFIFO - Initialize a kfifo declared by DECLARED_KFIFO
+ * INIT_KFIFO - Initialize a kfifo declared by DECLARE_KFIFO
  * @name: name of the declared kfifo datatype
  */
 #define INIT_KFIFO(name) \
@@ -91,7 +91,7 @@ union { \
 /**
  * DEFINE_KFIFO - macro to define and initialize a kfifo
  * @name: name of the declared kfifo datatype
- * @size: size of the fifo buffer
+ * @size: size of the fifo buffer. Must be a power of two.
  *
  * Note1: the macro can be used for global and local kfifo data type variables
  * Note2: the macro creates two objects:
@@ -104,15 +104,28 @@ union { \
 
 #undef __kfifo_initializer
 
-extern void kfifo_init(struct kfifo *fifo, unsigned char *buffer,
+extern void kfifo_init(struct kfifo *fifo, void *buffer,
                         unsigned int size);
 extern __must_check int kfifo_alloc(struct kfifo *fifo, unsigned int size,
                         gfp_t gfp_mask);
 extern void kfifo_free(struct kfifo *fifo);
 extern unsigned int kfifo_in(struct kfifo *fifo,
-                                const unsigned char *from, unsigned int len);
+                                const void *from, unsigned int len);
 extern __must_check unsigned int kfifo_out(struct kfifo *fifo,
-                                unsigned char *to, unsigned int len);
+                                void *to, unsigned int len);
+extern __must_check unsigned int kfifo_out_peek(struct kfifo *fifo,
+                                void *to, unsigned int len, unsigned offset);
+
+/**
+ * kfifo_initialized - Check if kfifo is initialized.
+ * @fifo: fifo to check
+ * Return %true if FIFO is initialized, otherwise %false.
+ * Assumes the fifo was 0 before.
+ */
+static inline bool kfifo_initialized(struct kfifo *fifo)
+{
+        return fifo->buffer != 0;
+}
 
 /**
  * kfifo_reset - removes the entire FIFO contents
@@ -194,7 +207,7 @@ static inline __must_check unsigned int kfifo_avail(struct kfifo *fifo)
  * bytes copied.
  */
 static inline unsigned int kfifo_in_locked(struct kfifo *fifo,
-                const unsigned char *from, unsigned int n, spinlock_t *lock)
+                const void *from, unsigned int n, spinlock_t *lock)
 {
         unsigned long flags;
         unsigned int ret;
@@ -219,7 +232,7 @@ static inline unsigned int kfifo_in_locked(struct kfifo *fifo,
  * @to buffer and returns the number of copied bytes.
  */
 static inline __must_check unsigned int kfifo_out_locked(struct kfifo *fifo,
-        unsigned char *to, unsigned int n, spinlock_t *lock)
+        void *to, unsigned int n, spinlock_t *lock)
 {
         unsigned long flags;
         unsigned int ret;
@@ -228,13 +241,6 @@ static inline __must_check unsigned int kfifo_out_locked(struct kfifo *fifo,
 
         ret = kfifo_out(fifo, to, n);
 
-        /*
-         * optimization: if the FIFO is empty, set the indices to 0
-         * so we don't wrap the next time
-         */
-        if (kfifo_is_empty(fifo))
-                kfifo_reset(fifo);
-
         spin_unlock_irqrestore(lock, flags);
 
         return ret;
@@ -242,11 +248,11 @@ static inline __must_check unsigned int kfifo_out_locked(struct kfifo *fifo,
 
 extern void kfifo_skip(struct kfifo *fifo, unsigned int len);
 
-extern __must_check unsigned int kfifo_from_user(struct kfifo *fifo,
-        const void __user *from, unsigned int n);
+extern __must_check int kfifo_from_user(struct kfifo *fifo,
+        const void __user *from, unsigned int n, unsigned *lenout);
 
-extern __must_check unsigned int kfifo_to_user(struct kfifo *fifo,
-        void __user *to, unsigned int n);
+extern __must_check int kfifo_to_user(struct kfifo *fifo,
+        void __user *to, unsigned int n, unsigned *lenout);
 
 /*
  * __kfifo_add_out internal helper function for updating the out offset
diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
index 6adcc297e35..19ec41a183f 100644
--- a/include/linux/kgdb.h
+++ b/include/linux/kgdb.h
@@ -29,8 +29,7 @@ struct pt_regs;
  *
  *      On some architectures it is required to skip a breakpoint
  *      exception when it occurs after a breakpoint has been removed.
- *      This can be implemented in the architecture specific portion of
- *      for kgdb.
+ *      This can be implemented in the architecture specific portion of kgdb.
  */
 extern int kgdb_skipexception(int exception, struct pt_regs *regs);
 
@@ -65,7 +64,7 @@ struct uart_port;
 /**
  *      kgdb_breakpoint - compiled in breakpoint
  *
- *      This will be impelmented a static inline per architecture.  This
+ *      This will be implemented as a static inline per architecture.  This
  *      function is called by the kgdb core to execute an architecture
  *      specific trap to cause kgdb to enter the exception processing.
  *
@@ -190,7 +189,7 @@ kgdb_arch_handle_exception(int vector, int signo, int err_code,
  *      @flags: Current IRQ state
  *
  *      On SMP systems, we need to get the attention of the other CPUs
- *      and get them be in a known state.  This should do what is needed
+ *      and get them into a known state.  This should do what is needed
  *      to get the other CPUs to call kgdb_wait(). Note that on some arches,
  *      the NMI approach is not used for rounding up all the CPUs. For example,
  *      in case of MIPS, smp_call_function() is used to roundup CPUs. In
diff --git a/include/linux/kmemcheck.h b/include/linux/kmemcheck.h
index e880d4cf9e2..08d7dc4ddf4 100644
--- a/include/linux/kmemcheck.h
+++ b/include/linux/kmemcheck.h
@@ -36,6 +36,56 @@ int kmemcheck_hide_addr(unsigned long address);
 
 bool kmemcheck_is_obj_initialized(unsigned long addr, size_t size);
 
+/*
+ * Bitfield annotations
+ *
+ * How to use: If you have a struct using bitfields, for example
+ *
+ *     struct a {
+ *             int x:8, y:8;
+ *     };
+ *
+ * then this should be rewritten as
+ *
+ *     struct a {
+ *             kmemcheck_bitfield_begin(flags);
+ *             int x:8, y:8;
+ *             kmemcheck_bitfield_end(flags);
+ *     };
+ *
+ * Now the "flags_begin" and "flags_end" members may be used to refer to the
+ * beginning and end, respectively, of the bitfield (and things like
+ * &x.flags_begin is allowed). As soon as the struct is allocated, the bit-
+ * fields should be annotated:
+ *
+ *     struct a *a = kmalloc(sizeof(struct a), GFP_KERNEL);
+ *     kmemcheck_annotate_bitfield(a, flags);
+ */
+#define kmemcheck_bitfield_begin(name)  \
+        int name##_begin[0];
+
+#define kmemcheck_bitfield_end(name)    \
+        int name##_end[0];
+
+#define kmemcheck_annotate_bitfield(ptr, name)                          \
+        do {                                                            \
+                int _n;                                                 \
+                                                                        \
+                if (!ptr)                                               \
+                        break;                                          \
+                                                                        \
+                _n = (long) &((ptr)->name##_end)                        \
+                        - (long) &((ptr)->name##_begin);                \
+                MAYBE_BUILD_BUG_ON(_n < 0);                             \
+                                                                        \
+                kmemcheck_mark_initialized(&((ptr)->name##_begin), _n); \
+        } while (0)
+
+#define kmemcheck_annotate_variable(var)                                \
+        do {                                                            \
+                kmemcheck_mark_initialized(&(var), sizeof(var));        \
+        } while (0)                                                     \
+
 #else
 #define kmemcheck_enabled 0
 
@@ -106,60 +156,16 @@ static inline bool kmemcheck_is_obj_initialized(unsigned long addr, size_t size)
         return true;
 }
 
-#endif /* CONFIG_KMEMCHECK */
-
-/*
- * Bitfield annotations
- *
- * How to use: If you have a struct using bitfields, for example
- *
- *     struct a {
- *             int x:8, y:8;
- *     };
- *
- * then this should be rewritten as
- *
- *     struct a {
- *             kmemcheck_bitfield_begin(flags);
- *             int x:8, y:8;
- *             kmemcheck_bitfield_end(flags);
- *     };
- *
- * Now the "flags_begin" and "flags_end" members may be used to refer to the
- * beginning and end, respectively, of the bitfield (and things like
- * &x.flags_begin is allowed). As soon as the struct is allocated, the bit-
- * fields should be annotated:
- *
- *     struct a *a = kmalloc(sizeof(struct a), GFP_KERNEL);
- *     kmemcheck_annotate_bitfield(a, flags);
- *
- * Note: We provide the same definitions for both kmemcheck and non-
- * kmemcheck kernels. This makes it harder to introduce accidental errors. It
- * is also allowed to pass NULL pointers to kmemcheck_annotate_bitfield().
- */
-#define kmemcheck_bitfield_begin(name)  \
-        int name##_begin[0];
-
-#define kmemcheck_bitfield_end(name)    \
-        int name##_end[0];
+#define kmemcheck_bitfield_begin(name)
+#define kmemcheck_bitfield_end(name)
+#define kmemcheck_annotate_bitfield(ptr, name)  \
+        do {                                    \
+        } while (0)
 
-#define kmemcheck_annotate_bitfield(ptr, name)                          \
-        do {                                                            \
-                int _n;                                                 \
-                                                                        \
-                if (!ptr)                                               \
-                        break;                                          \
-                                                                        \
-                _n = (long) &((ptr)->name##_end)                        \
-                        - (long) &((ptr)->name##_begin);                \
-                MAYBE_BUILD_BUG_ON(_n < 0);                             \
-                                                                        \
-                kmemcheck_mark_initialized(&((ptr)->name##_begin), _n); \
+#define kmemcheck_annotate_variable(var)        \
+        do {                                    \
         } while (0)
 
-#define kmemcheck_annotate_variable(var)                                \
-        do {                                                            \
-                kmemcheck_mark_initialized(&(var), sizeof(var));        \
-        } while (0)                                                     \
+#endif /* CONFIG_KMEMCHECK */
 
 #endif /* LINUX_KMEMCHECK_H */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 6a9c4ddd3d9..73112250862 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -354,6 +354,9 @@ enum {
         /* max tries if error condition is still set after ->error_handler */
         ATA_EH_MAX_TRIES        = 5,
 
+        /* sometimes resuming a link requires several retries */
+        ATA_LINK_RESUME_TRIES   = 5,
+
         /* how hard are we gonna try to probe/recover devices */
         ATA_PROBE_MAX_TRIES     = 3,
         ATA_EH_DEV_TRIES        = 3,
diff --git a/include/linux/list_sort.h b/include/linux/list_sort.h
new file mode 100644
index 00000000000..1a2df2efb77
--- /dev/null
+++ b/include/linux/list_sort.h
@@ -0,0 +1,11 @@
+#ifndef _LINUX_LIST_SORT_H
+#define _LINUX_LIST_SORT_H
+
+#include <linux/types.h>
+
+struct list_head;
+
+void list_sort(void *priv, struct list_head *head,
+               int (*cmp)(void *priv, struct list_head *a,
+                          struct list_head *b));
+#endif
diff --git a/include/linux/mfd/tmio.h b/include/linux/mfd/tmio.h
index 6b9c5d06690..9cb1834deff 100644
--- a/include/linux/mfd/tmio.h
+++ b/include/linux/mfd/tmio.h
@@ -2,6 +2,8 @@
 #define MFD_TMIO_H
 
 #include <linux/fb.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
 
 #define tmio_ioread8(addr) readb(addr)
 #define tmio_ioread16(addr) readw(addr)
@@ -18,11 +20,48 @@
         writew((val) >> 16, (addr) + 2); \
         } while (0)
 
+#define CNF_CMD     0x04
+#define CNF_CTL_BASE   0x10
+#define CNF_INT_PIN  0x3d
+#define CNF_STOP_CLK_CTL 0x40
+#define CNF_GCLK_CTL 0x41
+#define CNF_SD_CLK_MODE 0x42
+#define CNF_PIN_STATUS 0x44
+#define CNF_PWR_CTL_1 0x48
+#define CNF_PWR_CTL_2 0x49
+#define CNF_PWR_CTL_3 0x4a
+#define CNF_CARD_DETECT_MODE 0x4c
+#define CNF_SD_SLOT 0x50
+#define CNF_EXT_GCLK_CTL_1 0xf0
+#define CNF_EXT_GCLK_CTL_2 0xf1
+#define CNF_EXT_GCLK_CTL_3 0xf9
+#define CNF_SD_LED_EN_1 0xfa
+#define CNF_SD_LED_EN_2 0xfe
+
+#define   SDCREN 0x2   /* Enable access to MMC CTL regs. (flag in COMMAND_REG)*/
+
+#define sd_config_write8(base, shift, reg, val) \
+        tmio_iowrite8((val), (base) + ((reg) << (shift)))
+#define sd_config_write16(base, shift, reg, val) \
+        tmio_iowrite16((val), (base) + ((reg) << (shift)))
+#define sd_config_write32(base, shift, reg, val) \
+        do { \
+                tmio_iowrite16((val), (base) + ((reg) << (shift)));   \
+                tmio_iowrite16((val) >> 16, (base) + ((reg + 2) << (shift))); \
+        } while (0)
+
+int tmio_core_mmc_enable(void __iomem *cnf, int shift, unsigned long base);
+int tmio_core_mmc_resume(void __iomem *cnf, int shift, unsigned long base);
+void tmio_core_mmc_pwr(void __iomem *cnf, int shift, int state);
+void tmio_core_mmc_clk_div(void __iomem *cnf, int shift, int state);
+
 /*
  * data for the MMC controller
  */
 struct tmio_mmc_data {
         const unsigned int              hclk;
+        void (*set_pwr)(struct platform_device *host, int state);
+        void (*set_clk_div)(struct platform_device *host, int state);
 };
 
 /*
diff --git a/include/linux/mfd/wm8350/pmic.h b/include/linux/mfd/wm8350/pmic.h
index be3264e286e..e786fe9841e 100644
--- a/include/linux/mfd/wm8350/pmic.h
+++ b/include/linux/mfd/wm8350/pmic.h
@@ -666,20 +666,20 @@
 #define WM8350_ISINK_FLASH_DUR_64MS             (1 << 8)
 #define WM8350_ISINK_FLASH_DUR_96MS             (2 << 8)
 #define WM8350_ISINK_FLASH_DUR_1024MS           (3 << 8)
-#define WM8350_ISINK_FLASH_ON_INSTANT           (0 << 4)
-#define WM8350_ISINK_FLASH_ON_0_25S             (1 << 4)
-#define WM8350_ISINK_FLASH_ON_0_50S             (2 << 4)
-#define WM8350_ISINK_FLASH_ON_1_00S             (3 << 4)
-#define WM8350_ISINK_FLASH_ON_1_95S             (1 << 4)
-#define WM8350_ISINK_FLASH_ON_3_91S             (2 << 4)
-#define WM8350_ISINK_FLASH_ON_7_80S             (3 << 4)
-#define WM8350_ISINK_FLASH_OFF_INSTANT          (0 << 0)
-#define WM8350_ISINK_FLASH_OFF_0_25S            (1 << 0)
-#define WM8350_ISINK_FLASH_OFF_0_50S            (2 << 0)
-#define WM8350_ISINK_FLASH_OFF_1_00S            (3 << 0)
-#define WM8350_ISINK_FLASH_OFF_1_95S            (1 << 0)
-#define WM8350_ISINK_FLASH_OFF_3_91S            (2 << 0)
-#define WM8350_ISINK_FLASH_OFF_7_80S            (3 << 0)
+#define WM8350_ISINK_FLASH_ON_INSTANT           (0 << 0)
+#define WM8350_ISINK_FLASH_ON_0_25S             (1 << 0)
+#define WM8350_ISINK_FLASH_ON_0_50S             (2 << 0)
+#define WM8350_ISINK_FLASH_ON_1_00S             (3 << 0)
+#define WM8350_ISINK_FLASH_ON_1_95S             (1 << 0)
+#define WM8350_ISINK_FLASH_ON_3_91S             (2 << 0)
+#define WM8350_ISINK_FLASH_ON_7_80S             (3 << 0)
+#define WM8350_ISINK_FLASH_OFF_INSTANT          (0 << 4)
+#define WM8350_ISINK_FLASH_OFF_0_25S            (1 << 4)
+#define WM8350_ISINK_FLASH_OFF_0_50S            (2 << 4)
+#define WM8350_ISINK_FLASH_OFF_1_00S            (3 << 4)
+#define WM8350_ISINK_FLASH_OFF_1_95S            (1 << 4)
+#define WM8350_ISINK_FLASH_OFF_3_91S            (2 << 4)
+#define WM8350_ISINK_FLASH_OFF_7_80S            (3 << 4)
 
 /*
  * Regulator Interrupts.
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index adaf3c15e44..8b5f7cc0fba 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -30,6 +30,7 @@
 #define HPET_MINOR              228
 #define FUSE_MINOR              229
 #define KVM_MINOR               232
+#define VHOST_NET_MINOR         233
 #define MISC_DYNAMIC_MINOR      255
 
 struct device;
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 2265f28eb47..60c467bfbab 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1089,6 +1089,7 @@ extern void zone_pcp_update(struct zone *zone);
 
 /* nommu.c */
 extern atomic_long_t mmap_pages_allocated;
+extern int nommu_shrink_inode_mappings(struct inode *, size_t, size_t);
 
 /* prio_tree.c */
 void vma_prio_tree_add(struct vm_area_struct *, struct vm_area_struct *old);
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 84a524afb3d..36f96271306 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -122,7 +122,9 @@ struct vm_region {
         unsigned long   vm_pgoff;       /* the offset in vm_file corresponding to vm_start */
         struct file     *vm_file;       /* the backing file or NULL */
 
-        atomic_t        vm_usage;       /* region usage count */
+        int             vm_usage;       /* region usage count (access under nommu_region_sem) */
+        bool            vm_icache_flushed : 1; /* true if the icache has been flushed for
+                                                * this region */
 };
 
 /*
@@ -203,10 +205,12 @@ struct mm_struct {
         struct vm_area_struct * mmap;           /* list of VMAs */
         struct rb_root mm_rb;
         struct vm_area_struct * mmap_cache;     /* last find_vma result */
+#ifdef CONFIG_MMU
         unsigned long (*get_unmapped_area) (struct file *filp,
                                 unsigned long addr, unsigned long len,
                                 unsigned long pgoff, unsigned long flags);
         void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
+#endif
         unsigned long mmap_base;                /* base of mmap area */
         unsigned long task_size;                /* size of task vm space */
         unsigned long cached_hole_size;         /* if non-zero, the largest hole below free_area_cache */
diff --git a/include/linux/net.h b/include/linux/net.h
index 5e8083cacc8..4157b5d42bd 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -174,18 +174,22 @@ struct proto_ops {
                                       struct poll_table_struct *wait);
         int             (*ioctl)     (struct socket *sock, unsigned int cmd,
                                       unsigned long arg);
+#ifdef CONFIG_COMPAT
         int             (*compat_ioctl) (struct socket *sock, unsigned int cmd,
                                       unsigned long arg);
+#endif
         int             (*listen)    (struct socket *sock, int len);
         int             (*shutdown)  (struct socket *sock, int flags);
         int             (*setsockopt)(struct socket *sock, int level,
                                       int optname, char __user *optval, unsigned int optlen);
         int             (*getsockopt)(struct socket *sock, int level,
                                       int optname, char __user *optval, int __user *optlen);
+#ifdef CONFIG_COMPAT
         int             (*compat_setsockopt)(struct socket *sock, int level,
                                       int optname, char __user *optval, unsigned int optlen);
         int             (*compat_getsockopt)(struct socket *sock, int level,
                                       int optname, char __user *optval, int __user *optlen);
+#endif
         int             (*sendmsg)   (struct kiocb *iocb, struct socket *sock,
                                       struct msghdr *m, size_t total_len);
         int             (*recvmsg)   (struct kiocb *iocb, struct socket *sock,
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index a3fccc85b1a..e535700a3b7 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -263,6 +263,17 @@ struct netdev_hw_addr_list {
         int                     count;
 };
 
+#define netdev_uc_count(dev) ((dev)->uc.count)
+#define netdev_uc_empty(dev) ((dev)->uc.count == 0)
+#define netdev_for_each_uc_addr(ha, dev) \
+        list_for_each_entry(ha, &dev->uc.list, list)
+
+#define netdev_mc_count(dev) ((dev)->mc_count)
+#define netdev_mc_empty(dev) (netdev_mc_count(dev) == 0)
+
+#define netdev_for_each_mc_addr(mclist, dev) \
+        for (mclist = dev->mc_list; mclist; mclist = mclist->next)
+
 struct hh_cache {
         struct hh_cache *hh_next;       /* Next entry                        */
         atomic_t        hh_refcnt;      /* number of users                   */
@@ -621,30 +632,21 @@ struct net_device_ops {
                                                    struct net_device *dev);
         u16                     (*ndo_select_queue)(struct net_device *dev,
                                                     struct sk_buff *skb);
-#define HAVE_CHANGE_RX_FLAGS
         void                    (*ndo_change_rx_flags)(struct net_device *dev,
                                                        int flags);
-#define HAVE_SET_RX_MODE
         void                    (*ndo_set_rx_mode)(struct net_device *dev);
-#define HAVE_MULTICAST
         void                    (*ndo_set_multicast_list)(struct net_device *dev);
-#define HAVE_SET_MAC_ADDR
         int                     (*ndo_set_mac_address)(struct net_device *dev,
                                                        void *addr);
-#define HAVE_VALIDATE_ADDR
         int                     (*ndo_validate_addr)(struct net_device *dev);
-#define HAVE_PRIVATE_IOCTL
         int                     (*ndo_do_ioctl)(struct net_device *dev,
                                                 struct ifreq *ifr, int cmd);
-#define HAVE_SET_CONFIG
         int                     (*ndo_set_config)(struct net_device *dev,
                                                   struct ifmap *map);
-#define HAVE_CHANGE_MTU
         int                     (*ndo_change_mtu)(struct net_device *dev,
                                                   int new_mtu);
         int                     (*ndo_neigh_setup)(struct net_device *dev,
                                                    struct neigh_parms *);
-#define HAVE_TX_TIMEOUT
         void                    (*ndo_tx_timeout) (struct net_device *dev);
 
         struct net_device_stats* (*ndo_get_stats)(struct net_device *dev);
@@ -656,7 +658,6 @@ struct net_device_ops {
         void                    (*ndo_vlan_rx_kill_vid)(struct net_device *dev,
                                                         unsigned short vid);
 #ifdef CONFIG_NET_POLL_CONTROLLER
-#define HAVE_NETDEV_POLL
         void                    (*ndo_poll_controller)(struct net_device *dev);
 #endif
 #if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
@@ -1009,6 +1010,15 @@ static inline bool netdev_uses_dsa_tags(struct net_device *dev)
         return 0;
 }
 
+#ifndef CONFIG_NET_NS
+static inline void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
+{
+        skb->dev = dev;
+}
+#else /* CONFIG_NET_NS */
+void skb_set_dev(struct sk_buff *skb, struct net_device *dev);
+#endif
+
 static inline bool netdev_uses_trailer_tags(struct net_device *dev)
 {
 #ifdef CONFIG_NET_DSA_TAG_TRAILER
@@ -1527,7 +1537,6 @@ extern int		netif_rx(struct sk_buff *skb);
 extern int              netif_rx_ni(struct sk_buff *skb);
 #define HAVE_NETIF_RECEIVE_SKB 1
 extern int              netif_receive_skb(struct sk_buff *skb);
-extern void             napi_gro_flush(struct napi_struct *napi);
 extern gro_result_t     dev_gro_receive(struct napi_struct *napi,
                                         struct sk_buff *skb);
 extern gro_result_t     napi_skb_finish(gro_result_t ret, struct sk_buff *skb);
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index 2524267210d..a765ea89854 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -21,15 +21,20 @@ struct netpoll {
         __be32 local_ip, remote_ip;
         u16 local_port, remote_port;
         u8 remote_mac[ETH_ALEN];
+
+        struct list_head rx; /* rx_np list element */
 };
 
 struct netpoll_info {
         atomic_t refcnt;
+
         int rx_flags;
         spinlock_t rx_lock;
-        struct netpoll *rx_np; /* netpoll that registered an rx_hook */
+        struct list_head rx_np; /* netpolls that registered an rx_hook */
+
         struct sk_buff_head arp_tx; /* list of arp requests to reply to */
         struct sk_buff_head txq;
+
         struct delayed_work tx_work;
 };
 
@@ -51,7 +56,7 @@ static inline int netpoll_rx(struct sk_buff *skb)
         unsigned long flags;
         int ret = 0;
 
-        if (!npinfo || (!npinfo->rx_np && !npinfo->rx_flags))
+        if (!npinfo || (list_empty(&npinfo->rx_np) && !npinfo->rx_flags))
                 return 0;
 
         spin_lock_irqsave(&npinfo->rx_lock, flags);
@@ -67,7 +72,7 @@ static inline int netpoll_rx_on(struct sk_buff *skb)
 {
         struct netpoll_info *npinfo = skb->dev->npinfo;
 
-        return npinfo && (npinfo->rx_np || npinfo->rx_flags);
+        return npinfo && (!list_empty(&npinfo->rx_np) || npinfo->rx_flags);
 }
 
 static inline int netpoll_receive_skb(struct sk_buff *skb)
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 2bfbe88837e..127a7301576 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -295,6 +295,10 @@
  *      This command is also used as an event to notify when a requested
  *      remain-on-channel duration has expired.
  *
+ * @NL80211_CMD_SET_TX_BITRATE_MASK: Set the mask of rates to be used in TX
+ *      rate selection. %NL80211_ATTR_IFINDEX is used to specify the interface
+ *      and @NL80211_ATTR_TX_RATES the set of allowed rates.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -381,6 +385,8 @@ enum nl80211_commands {
         NL80211_CMD_REMAIN_ON_CHANNEL,
         NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
 
+        NL80211_CMD_SET_TX_BITRATE_MASK,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -430,6 +436,8 @@ enum nl80211_commands {
  * @NL80211_ATTR_WIPHY_RTS_THRESHOLD: RTS threshold (TX frames with length
  *      larger than or equal to this use RTS/CTS handshake); allowed range:
  *      0..65536, disable with (u32)-1; dot11RTSThreshold; u32
+ * @NL80211_ATTR_WIPHY_COVERAGE_CLASS: Coverage Class as defined by IEEE 802.11
+ *      section 7.3.2.9; dot11CoverageClass; u8
  *
  * @NL80211_ATTR_IFINDEX: network interface index of the device to operate on
  * @NL80211_ATTR_IFNAME: network interface name
@@ -638,6 +646,13 @@ enum nl80211_commands {
  *
  * @NL80211_ATTR_COOKIE: Generic 64-bit cookie to identify objects.
  *
+ * @NL80211_ATTR_TX_RATES: Nested set of attributes
+ *      (enum nl80211_tx_rate_attributes) describing TX rates per band. The
+ *      enum nl80211_band value is used as the index (nla_type() of the nested
+ *      data. If a band is not included, it will be configured to allow all
+ *      rates based on negotiated supported rates information. This attribute
+ *      is used with %NL80211_CMD_SET_TX_BITRATE_MASK.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -779,6 +794,10 @@ enum nl80211_attrs {
 
         NL80211_ATTR_COOKIE,
 
+        NL80211_ATTR_WIPHY_COVERAGE_CLASS,
+
+        NL80211_ATTR_TX_RATES,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1359,13 +1378,20 @@ enum nl80211_channel_type {
  * @NL80211_BSS_BEACON_INTERVAL: beacon interval of the (I)BSS (u16)
  * @NL80211_BSS_CAPABILITY: capability field (CPU order, u16)
  * @NL80211_BSS_INFORMATION_ELEMENTS: binary attribute containing the
- *      raw information elements from the probe response/beacon (bin)
+ *      raw information elements from the probe response/beacon (bin);
+ *      if the %NL80211_BSS_BEACON_IES attribute is present, the IEs here are
+ *      from a Probe Response frame; otherwise they are from a Beacon frame.
+ *      However, if the driver does not indicate the source of the IEs, these
+ *      IEs may be from either frame subtype.
  * @NL80211_BSS_SIGNAL_MBM: signal strength of probe response/beacon
  *      in mBm (100 * dBm) (s32)
  * @NL80211_BSS_SIGNAL_UNSPEC: signal strength of the probe response/beacon
  *      in unspecified units, scaled to 0..100 (u8)
  * @NL80211_BSS_STATUS: status, if this BSS is "used"
  * @NL80211_BSS_SEEN_MS_AGO: age of this BSS entry in ms
+ * @NL80211_BSS_BEACON_IES: binary attribute containing the raw information
+ *      elements from a Beacon frame (bin); not present if no Beacon frame has
+ *      yet been received
  * @__NL80211_BSS_AFTER_LAST: internal
  * @NL80211_BSS_MAX: highest BSS attribute
  */
@@ -1381,6 +1407,7 @@ enum nl80211_bss {
         NL80211_BSS_SIGNAL_UNSPEC,
         NL80211_BSS_STATUS,
         NL80211_BSS_SEEN_MS_AGO,
+        NL80211_BSS_BEACON_IES,
 
         /* keep last */
         __NL80211_BSS_AFTER_LAST,
@@ -1478,4 +1505,33 @@ enum nl80211_key_attributes {
         NL80211_KEY_MAX = __NL80211_KEY_AFTER_LAST - 1
 };
 
+/**
+ * enum nl80211_tx_rate_attributes - TX rate set attributes
+ * @__NL80211_TXRATE_INVALID: invalid
+ * @NL80211_TXRATE_LEGACY: Legacy (non-MCS) rates allowed for TX rate selection
+ *      in an array of rates as defined in IEEE 802.11 7.3.2.2 (u8 values with
+ *      1 = 500 kbps) but without the IE length restriction (at most
+ *      %NL80211_MAX_SUPP_RATES in a single array).
+ * @__NL80211_TXRATE_AFTER_LAST: internal
+ * @NL80211_TXRATE_MAX: highest TX rate attribute
+ */
+enum nl80211_tx_rate_attributes {
+        __NL80211_TXRATE_INVALID,
+        NL80211_TXRATE_LEGACY,
+
+        /* keep last */
+        __NL80211_TXRATE_AFTER_LAST,
+        NL80211_TXRATE_MAX = __NL80211_TXRATE_AFTER_LAST - 1
+};
+
+/**
+ * enum nl80211_band - Frequency band
+ * @NL80211_BAND_2GHZ - 2.4 GHz ISM band
+ * @NL80211_BAND_5GHZ - around 5 GHz band (4.9 - 5.7 GHz)
+ */
+enum nl80211_band {
+        NL80211_BAND_2GHZ,
+        NL80211_BAND_5GHZ,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index bf1e6708084..174e5392e51 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -243,6 +243,7 @@ struct pci_dev {
         unsigned int    d2_support:1;   /* Low power state D2 is supported */
         unsigned int    no_d1d2:1;      /* Only allow D0 and D3 */
         unsigned int    wakeup_prepared:1;
+        unsigned int    d3_delay;       /* D3->D0 transition time in ms */
 
 #ifdef CONFIG_PCIEASPM
         struct pcie_link_state  *link_state;    /* ASPM link state. */
@@ -566,6 +567,9 @@ void pcibios_align_resource(void *, struct resource *, resource_size_t,
                                 resource_size_t);
 void pcibios_update_irq(struct pci_dev *, int irq);
 
+/* Weak but can be overriden by arch */
+void pci_fixup_cardbus(struct pci_bus *);
+
 /* Generic PCI functions used internally */
 
 extern struct pci_bus *pci_find_bus(int domain, int busnr);
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index c66b34f75ee..8fa71874113 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -814,9 +814,14 @@ extern int perf_event_overflow(struct perf_event *event, int nmi,
  */
 static inline int is_software_event(struct perf_event *event)
 {
-        return (event->attr.type != PERF_TYPE_RAW) &&
-                (event->attr.type != PERF_TYPE_HARDWARE) &&
-                (event->attr.type != PERF_TYPE_HW_CACHE);
+        switch (event->attr.type) {
+        case PERF_TYPE_SOFTWARE:
+        case PERF_TYPE_TRACEPOINT:
+        /* for now the breakpoint stuff also works as software event */
+        case PERF_TYPE_BREAKPOINT:
+                return 1;
+        }
+        return 0;
 }
 
 extern atomic_t perf_swevent_enabled[PERF_COUNT_SW_MAX];
diff --git a/include/linux/phy.h b/include/linux/phy.h
index b1368b8f657..14d7fdf6a90 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -447,10 +447,12 @@ struct phy_device* get_phy_device(struct mii_bus *bus, int addr);
 int phy_device_register(struct phy_device *phy);
 int phy_clear_interrupt(struct phy_device *phydev);
 int phy_config_interrupt(struct phy_device *phydev, u32 interrupts);
+int phy_init_hw(struct phy_device *phydev);
 int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                 u32 flags, phy_interface_t interface);
 struct phy_device * phy_attach(struct net_device *dev,
                 const char *bus_id, u32 flags, phy_interface_t interface);
+struct phy_device *phy_find_first(struct mii_bus *bus);
 int phy_connect_direct(struct net_device *dev, struct phy_device *phydev,
                 void (*handler)(struct net_device *), u32 flags,
                 phy_interface_t interface);
@@ -484,6 +486,7 @@ void phy_driver_unregister(struct phy_driver *drv);
 int phy_driver_register(struct phy_driver *new_driver);
 void phy_prepare_link(struct phy_device *phydev,
                 void (*adjust_link)(struct net_device *));
+void phy_state_machine(struct work_struct *work);
 void phy_start_machine(struct phy_device *phydev,
                 void (*handler)(struct net_device *));
 void phy_stop_machine(struct phy_device *phydev);
diff --git a/include/linux/poison.h b/include/linux/poison.h
index 7fc194aef8c..2110a81c5e2 100644
--- a/include/linux/poison.h
+++ b/include/linux/poison.h
@@ -2,13 +2,25 @@
 #define _LINUX_POISON_H
 
 /********** include/linux/list.h **********/
+
+/*
+ * Architectures might want to move the poison pointer offset
+ * into some well-recognized area such as 0xdead000000000000,
+ * that is also not mappable by user-space exploits:
+ */
+#ifdef CONFIG_ILLEGAL_POINTER_VALUE
+# define POISON_POINTER_DELTA _AC(CONFIG_ILLEGAL_POINTER_VALUE, UL)
+#else
+# define POISON_POINTER_DELTA 0
+#endif
+
 /*
  * These are non-NULL pointers that will result in page faults
  * under normal circumstances, used to verify that nobody uses
  * non-initialized list entries.
  */
-#define LIST_POISON1  ((void *) 0x00100100)
-#define LIST_POISON2  ((void *) 0x00200200)
+#define LIST_POISON1  ((void *) 0x00100100 + POISON_POINTER_DELTA)
+#define LIST_POISON2  ((void *) 0x00200200 + POISON_POINTER_DELTA)
 
 /********** include/linux/timer.h **********/
 /*
diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
index c96c1858fe2..1ba3cf6edfb 100644
--- a/include/linux/reiserfs_fs.h
+++ b/include/linux/reiserfs_fs.h
@@ -62,6 +62,12 @@ void reiserfs_write_unlock(struct super_block *s);
 int reiserfs_write_lock_once(struct super_block *s);
 void reiserfs_write_unlock_once(struct super_block *s, int lock_depth);
 
+#ifdef CONFIG_REISERFS_CHECK
+void reiserfs_lock_check_recursive(struct super_block *s);
+#else
+static inline void reiserfs_lock_check_recursive(struct super_block *s) { }
+#endif
+
 /*
  * Several mutexes depend on the write lock.
  * However sometimes we want to relax the write lock while we hold
@@ -92,11 +98,31 @@ void reiserfs_write_unlock_once(struct super_block *s, int lock_depth);
 static inline void reiserfs_mutex_lock_safe(struct mutex *m,
                                struct super_block *s)
 {
+        reiserfs_lock_check_recursive(s);
         reiserfs_write_unlock(s);
         mutex_lock(m);
         reiserfs_write_lock(s);
 }
 
+static inline void
+reiserfs_mutex_lock_nested_safe(struct mutex *m, unsigned int subclass,
+                               struct super_block *s)
+{
+        reiserfs_lock_check_recursive(s);
+        reiserfs_write_unlock(s);
+        mutex_lock_nested(m, subclass);
+        reiserfs_write_lock(s);
+}
+
+static inline void
+reiserfs_down_read_safe(struct rw_semaphore *sem, struct super_block *s)
+{
+        reiserfs_lock_check_recursive(s);
+        reiserfs_write_unlock(s);
+        down_read(sem);
+        reiserfs_write_lock(s);
+}
+
 /*
  * When we schedule, we usually want to also release the write lock,
  * according to the previous bkl based locking scheme of reiserfs.
diff --git a/include/linux/resource.h b/include/linux/resource.h
index 40fc7e62608..f1e914eefea 100644
--- a/include/linux/resource.h
+++ b/include/linux/resource.h
@@ -3,8 +3,6 @@
 
 #include <linux/time.h>
 
-struct task_struct;
-
 /*
  * Resource control/accounting header file for linux
  */
@@ -70,6 +68,12 @@ struct rlimit {
  */
 #include <asm/resource.h>
 
+#ifdef __KERNEL__
+
+struct task_struct;
+
 int getrusage(struct task_struct *p, int who, struct rusage __user *ru);
 
+#endif /* __KERNEL__ */
+
 #endif
diff --git a/include/linux/sched.h b/include/linux/sched.h
index f2f842db03c..6f7bba93929 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -377,6 +377,8 @@ extern int sysctl_max_map_count;
 
 #include <linux/aio.h>
 
+#ifdef CONFIG_MMU
+extern void arch_pick_mmap_layout(struct mm_struct *mm);
 extern unsigned long
 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
                        unsigned long, unsigned long);
@@ -386,6 +388,9 @@ arch_get_unmapped_area_topdown(struct file *filp, unsigned long addr,
                           unsigned long flags);
 extern void arch_unmap_area(struct mm_struct *, unsigned long);
 extern void arch_unmap_area_topdown(struct mm_struct *, unsigned long);
+#else
+static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
+#endif
 
 #if USE_SPLIT_PTLOCKS
 /*
@@ -2491,8 +2496,6 @@ static inline void set_task_cpu(struct task_struct *p, unsigned int cpu)
 
 #endif /* CONFIG_SMP */
 
-extern void arch_pick_mmap_layout(struct mm_struct *mm);
-
 #ifdef CONFIG_TRACING
 extern void
 __trace_special(void *__tr, void *__data,
@@ -2601,6 +2604,28 @@ static inline void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
 }
 #endif /* CONFIG_MM_OWNER */
 
+static inline unsigned long task_rlimit(const struct task_struct *tsk,
+                unsigned int limit)
+{
+        return ACCESS_ONCE(tsk->signal->rlim[limit].rlim_cur);
+}
+
+static inline unsigned long task_rlimit_max(const struct task_struct *tsk,
+                unsigned int limit)
+{
+        return ACCESS_ONCE(tsk->signal->rlim[limit].rlim_max);
+}
+
+static inline unsigned long rlimit(unsigned int limit)
+{
+        return task_rlimit(current, limit);
+}
+
+static inline unsigned long rlimit_max(unsigned int limit)
+{
+        return task_rlimit_max(current, limit);
+}
+
 #endif /* __KERNEL__ */
 
 #endif
diff --git a/include/linux/serio.h b/include/linux/serio.h
index e2f3044d4a4..813d26c247e 100644
--- a/include/linux/serio.h
+++ b/include/linux/serio.h
@@ -136,25 +136,6 @@ static inline void serio_continue_rx(struct serio *serio)
         spin_unlock_irq(&serio->lock);
 }
 
-/*
- * Use the following functions to pin serio's driver in process context
- */
-static inline int serio_pin_driver(struct serio *serio)
-{
-        return mutex_lock_interruptible(&serio->drv_mutex);
-}
-
-static inline void serio_pin_driver_uninterruptible(struct serio *serio)
-{
-        mutex_lock(&serio->drv_mutex);
-}
-
-static inline void serio_unpin_driver(struct serio *serio)
-{
-        mutex_unlock(&serio->drv_mutex);
-}
-
-
 #endif
 
 /*
diff --git a/include/linux/sonypi.h b/include/linux/sonypi.h
index 34c4475ac4a..4f95c1aac2f 100644
--- a/include/linux/sonypi.h
+++ b/include/linux/sonypi.h
@@ -111,6 +111,7 @@
 #define SONYPI_EVENT_VOLUME_INC_PRESSED         69
 #define SONYPI_EVENT_VOLUME_DEC_PRESSED         70
 #define SONYPI_EVENT_BRIGHTNESS_PRESSED         71
+#define SONYPI_EVENT_MEDIA_PRESSED              72
 
 /* get/set brightness */
 #define SONYPI_IOCGBRT          _IOR('v', 0, __u8)
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
new file mode 100644
index 00000000000..32bfd1a8a48
--- /dev/null
+++ b/include/linux/stmmac.h
@@ -0,0 +1,53 @@
+/*******************************************************************************
+
+  Header file for stmmac platform data
+
+  Copyright (C) 2009  STMicroelectronics Ltd
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+*******************************************************************************/
+
+#ifndef __STMMAC_PLATFORM_DATA
+#define __STMMAC_PLATFORM_DATA
+
+/* platfrom data for platfrom device structure's platfrom_data field */
+
+/* Private data for the STM on-board ethernet driver */
+struct plat_stmmacenet_data {
+        int bus_id;
+        int pbl;
+        int has_gmac;
+        void (*fix_mac_speed)(void *priv, unsigned int speed);
+        void (*bus_setup)(unsigned long ioaddr);
+#ifdef CONFIG_STM_DRIVERS
+        struct stm_pad_config *pad_config;
+#endif
+        void *bsp_priv;
+};
+
+struct plat_stmmacphy_data {
+        int bus_id;
+        int phy_addr;
+        unsigned int phy_mask;
+        int interface;
+        int (*phy_reset)(void *priv);
+        void *priv;
+};
+#endif
+
diff --git a/include/linux/string.h b/include/linux/string.h
index 651839a2a75..a716ee2a8ad 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -72,7 +72,10 @@ static inline __must_check char *strstrip(char *str)
 }
 
 #ifndef __HAVE_ARCH_STRSTR
-extern char * strstr(const char *,const char *);
+extern char * strstr(const char *, const char *);
+#endif
+#ifndef __HAVE_ARCH_STRNSTR
+extern char * strnstr(const char *, const char *, size_t);
 #endif
 #ifndef __HAVE_ARCH_STRLEN
 extern __kernel_size_t strlen(const char *);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 65793e90d6f..207466a49f3 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -195,7 +195,7 @@ struct perf_event_attr;
         static const struct syscall_metadata __used             \
           __attribute__((__aligned__(4)))                       \
           __attribute__((section("__syscalls_metadata")))       \
-          __syscall_meta_##sname = {                            \
+          __syscall_meta__##sname = {                           \
                 .name           = "sys_"#sname,                 \
                 .nb_args        = 0,                            \
                 .enter_event    = &event_enter__##sname,        \
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 877ba039e6a..9f236cdcf3f 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -482,6 +482,8 @@ enum
         NET_IPV4_CONF_ARP_ACCEPT=21,
         NET_IPV4_CONF_ARP_NOTIFY=22,
         NET_IPV4_CONF_ACCEPT_LOCAL=23,
+        NET_IPV4_CONF_SRC_VMARK=24,
+        NET_IPV4_CONF_PROXY_ARP_PVLAN=25,
         __NET_IPV4_CONF_MAX
 };
 
diff --git a/include/linux/topology.h b/include/linux/topology.h
index 57e63579bfd..5b81156780b 100644
--- a/include/linux/topology.h
+++ b/include/linux/topology.h
@@ -99,7 +99,7 @@ int arch_update_cpu_topology(void);
                                 | 1*SD_WAKE_AFFINE                      \
                                 | 1*SD_SHARE_CPUPOWER                   \
                                 | 0*SD_POWERSAVINGS_BALANCE             \
-                                | 0*SD_SHARE_PKG_RESOURCES              \
+                                | 1*SD_SHARE_PKG_RESOURCES              \
                                 | 0*SD_SERIALIZE                        \
                                 | 0*SD_PREFER_SIBLING                   \
                                 ,                                       \
diff --git a/include/linux/tty.h b/include/linux/tty.h
index ef3a2947b10..6abfcf5b588 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -464,7 +464,7 @@ extern int tty_port_alloc_xmit_buf(struct tty_port *port);
 extern void tty_port_free_xmit_buf(struct tty_port *port);
 extern void tty_port_put(struct tty_port *port);
 
-extern inline struct tty_port *tty_port_get(struct tty_port *port)
+static inline struct tty_port *tty_port_get(struct tty_port *port)
 {
         if (port)
                 kref_get(&port->kref);
@@ -486,7 +486,7 @@ extern void tty_port_close(struct tty_port *port,
                                 struct tty_struct *tty, struct file *filp);
 extern int tty_port_open(struct tty_port *port,
                                 struct tty_struct *tty, struct file *filp);
-extern inline int tty_port_users(struct tty_port *port)
+static inline int tty_port_users(struct tty_port *port)
 {
         return port->count + port->blocked_open;
 }
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index 6b58367d145..d512d98dfb7 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -94,6 +94,7 @@ static inline unsigned long __copy_from_user_nocache(void *to,
  * happens, handle that and return -EFAULT.
  */
 extern long probe_kernel_read(void *dst, void *src, size_t size);
+extern long __probe_kernel_read(void *dst, void *src, size_t size);
 
 /*
  * probe_kernel_write(): safely attempt to write to a location
@@ -104,6 +105,7 @@ extern long probe_kernel_read(void *dst, void *src, size_t size);
  * Safely write to address @dst from the buffer at @src.  If a kernel fault
  * happens, handle that and return -EFAULT.
  */
-extern long probe_kernel_write(void *dst, void *src, size_t size);
+extern long notrace probe_kernel_write(void *dst, void *src, size_t size);
+extern long notrace __probe_kernel_write(void *dst, void *src, size_t size);
 
 #endif          /* __LINUX_UACCESS_H__ */
diff --git a/include/linux/usb.h b/include/linux/usb.h
index e101a2d04d7..d7ace1b80f0 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -192,6 +192,7 @@ struct usb_interface {
         unsigned needs_altsetting0:1;   /* switch to altsetting 0 is pending */
         unsigned needs_binding:1;       /* needs delayed unbind/rebind */
         unsigned reset_running:1;
+        unsigned resetting_device:1;    /* true: bandwidth alloc after reset */
 
         struct device dev;              /* interface specific device info */
         struct device *usb_dev;
diff --git a/include/linux/vhost.h b/include/linux/vhost.h
new file mode 100644
index 00000000000..e847f1e3075
--- /dev/null
+++ b/include/linux/vhost.h
@@ -0,0 +1,130 @@
+#ifndef _LINUX_VHOST_H
+#define _LINUX_VHOST_H
+/* Userspace interface for in-kernel virtio accelerators. */
+
+/* vhost is used to reduce the number of system calls involved in virtio.
+ *
+ * Existing virtio net code is used in the guest without modification.
+ *
+ * This header includes interface used by userspace hypervisor for
+ * device configuration.
+ */
+
+#include <linux/types.h>
+#include <linux/compiler.h>
+#include <linux/ioctl.h>
+#include <linux/virtio_config.h>
+#include <linux/virtio_ring.h>
+
+struct vhost_vring_state {
+        unsigned int index;
+        unsigned int num;
+};
+
+struct vhost_vring_file {
+        unsigned int index;
+        int fd; /* Pass -1 to unbind from file. */
+
+};
+
+struct vhost_vring_addr {
+        unsigned int index;
+        /* Option flags. */
+        unsigned int flags;
+        /* Flag values: */
+        /* Whether log address is valid. If set enables logging. */
+#define VHOST_VRING_F_LOG 0
+
+        /* Start of array of descriptors (virtually contiguous) */
+        __u64 desc_user_addr;
+        /* Used structure address. Must be 32 bit aligned */
+        __u64 used_user_addr;
+        /* Available structure address. Must be 16 bit aligned */
+        __u64 avail_user_addr;
+        /* Logging support. */
+        /* Log writes to used structure, at offset calculated from specified
+         * address. Address must be 32 bit aligned. */
+        __u64 log_guest_addr;
+};
+
+struct vhost_memory_region {
+        __u64 guest_phys_addr;
+        __u64 memory_size; /* bytes */
+        __u64 userspace_addr;
+        __u64 flags_padding; /* No flags are currently specified. */
+};
+
+/* All region addresses and sizes must be 4K aligned. */
+#define VHOST_PAGE_SIZE 0x1000
+
+struct vhost_memory {
+        __u32 nregions;
+        __u32 padding;
+        struct vhost_memory_region regions[0];
+};
+
+/* ioctls */
+
+#define VHOST_VIRTIO 0xAF
+
+/* Features bitmask for forward compatibility.  Transport bits are used for
+ * vhost specific features. */
+#define VHOST_GET_FEATURES      _IOR(VHOST_VIRTIO, 0x00, __u64)
+#define VHOST_SET_FEATURES      _IOW(VHOST_VIRTIO, 0x00, __u64)
+
+/* Set current process as the (exclusive) owner of this file descriptor.  This
+ * must be called before any other vhost command.  Further calls to
+ * VHOST_OWNER_SET fail until VHOST_OWNER_RESET is called. */
+#define VHOST_SET_OWNER _IO(VHOST_VIRTIO, 0x01)
+/* Give up ownership, and reset the device to default values.
+ * Allows subsequent call to VHOST_OWNER_SET to succeed. */
+#define VHOST_RESET_OWNER _IO(VHOST_VIRTIO, 0x02)
+
+/* Set up/modify memory layout */
+#define VHOST_SET_MEM_TABLE     _IOW(VHOST_VIRTIO, 0x03, struct vhost_memory)
+
+/* Write logging setup. */
+/* Memory writes can optionally be logged by setting bit at an offset
+ * (calculated from the physical address) from specified log base.
+ * The bit is set using an atomic 32 bit operation. */
+/* Set base address for logging. */
+#define VHOST_SET_LOG_BASE _IOW(VHOST_VIRTIO, 0x04, __u64)
+/* Specify an eventfd file descriptor to signal on log write. */
+#define VHOST_SET_LOG_FD _IOW(VHOST_VIRTIO, 0x07, int)
+
+/* Ring setup. */
+/* Set number of descriptors in ring. This parameter can not
+ * be modified while ring is running (bound to a device). */
+#define VHOST_SET_VRING_NUM _IOW(VHOST_VIRTIO, 0x10, struct vhost_vring_state)
+/* Set addresses for the ring. */
+#define VHOST_SET_VRING_ADDR _IOW(VHOST_VIRTIO, 0x11, struct vhost_vring_addr)
+/* Base value where queue looks for available descriptors */
+#define VHOST_SET_VRING_BASE _IOW(VHOST_VIRTIO, 0x12, struct vhost_vring_state)
+/* Get accessor: reads index, writes value in num */
+#define VHOST_GET_VRING_BASE _IOWR(VHOST_VIRTIO, 0x12, struct vhost_vring_state)
+
+/* The following ioctls use eventfd file descriptors to signal and poll
+ * for events. */
+
+/* Set eventfd to poll for added buffers */
+#define VHOST_SET_VRING_KICK _IOW(VHOST_VIRTIO, 0x20, struct vhost_vring_file)
+/* Set eventfd to signal when buffers have beed used */
+#define VHOST_SET_VRING_CALL _IOW(VHOST_VIRTIO, 0x21, struct vhost_vring_file)
+/* Set eventfd to signal an error */
+#define VHOST_SET_VRING_ERR _IOW(VHOST_VIRTIO, 0x22, struct vhost_vring_file)
+
+/* VHOST_NET specific defines */
+
+/* Attach virtio net ring to a raw socket, or tap device.
+ * The socket must be already bound to an ethernet device, this device will be
+ * used for transmit.  Pass fd -1 to unbind from the socket and the transmit
+ * device.  This can be used to stop the ring (e.g. for migration). */
+#define VHOST_NET_SET_BACKEND _IOW(VHOST_VIRTIO, 0x30, struct vhost_vring_file)
+
+/* Feature bits */
+/* Log all write descriptors. Can be changed while device is active. */
+#define VHOST_F_LOG_ALL 26
+/* vhost-net should add virtio_net_hdr for RX, and strip for TX packets. */
+#define VHOST_NET_F_VIRTIO_NET_HDR 27
+
+#endif
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index 057a2e01075..f508c651e53 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -51,6 +51,9 @@ struct virtqueue {
  *      This re-enables callbacks; it returns "false" if there are pending
  *      buffers in the queue, to detect a possible race between the driver
  *      checking for more work, and enabling callbacks.
+ * @detach_unused_buf: detach first unused buffer
+ *      vq: the struct virtqueue we're talking about.
+ *      Returns NULL or the "data" token handed to add_buf
  *
  * Locking rules are straightforward: the driver is responsible for
  * locking.  No two operations may be invoked simultaneously, with the exception
@@ -71,6 +74,7 @@ struct virtqueue_ops {
 
         void (*disable_cb)(struct virtqueue *vq);
         bool (*enable_cb)(struct virtqueue *vq);
+        void *(*detach_unused_buf)(struct virtqueue *vq);
 };
 
 /**
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index c18c008f4bb..76e8903cd20 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -70,6 +70,7 @@ struct writeback_control {
 struct bdi_writeback;
 int inode_wait(void *);
 void writeback_inodes_sb(struct super_block *);
+int writeback_inodes_sb_if_idle(struct super_block *);
 void sync_inodes_sb(struct super_block *);
 void writeback_inodes_wbc(struct writeback_control *wbc);
 long wb_do_writeback(struct bdi_writeback *wb, int force_wait);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index add79930f47..a3f0a7ed31a 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -39,8 +39,8 @@
  * @IEEE80211_BAND_5GHZ: around 5GHz band (4.9-5.7)
  */
 enum ieee80211_band {
-        IEEE80211_BAND_2GHZ,
-        IEEE80211_BAND_5GHZ,
+        IEEE80211_BAND_2GHZ = NL80211_BAND_2GHZ,
+        IEEE80211_BAND_5GHZ = NL80211_BAND_5GHZ,
 
         /* keep last */
         IEEE80211_NUM_BANDS
@@ -626,8 +626,14 @@ enum cfg80211_signal_type {
  * @beacon_interval: the beacon interval as from the frame
  * @capability: the capability field in host byte order
  * @information_elements: the information elements (Note that there
- *      is no guarantee that these are well-formed!)
+ *      is no guarantee that these are well-formed!); this is a pointer to
+ *      either the beacon_ies or proberesp_ies depending on whether Probe
+ *      Response frame has been received
  * @len_information_elements: total length of the information elements
+ * @beacon_ies: the information elements from the last Beacon frame
+ * @len_beacon_ies: total length of the beacon_ies
+ * @proberesp_ies: the information elements from the last Probe Response frame
+ * @len_proberesp_ies: total length of the proberesp_ies
  * @signal: signal strength value (type depends on the wiphy's signal_type)
  * @free_priv: function pointer to free private data
  * @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
@@ -641,6 +647,10 @@ struct cfg80211_bss {
         u16 capability;
         u8 *information_elements;
         size_t len_information_elements;
+        u8 *beacon_ies;
+        size_t len_beacon_ies;
+        u8 *proberesp_ies;
+        size_t len_proberesp_ies;
 
         s32 signal;
 
@@ -837,6 +847,7 @@ enum wiphy_params_flags {
         WIPHY_PARAM_RETRY_LONG          = 1 << 1,
         WIPHY_PARAM_FRAG_THRESHOLD      = 1 << 2,
         WIPHY_PARAM_RTS_THRESHOLD       = 1 << 3,
+        WIPHY_PARAM_COVERAGE_CLASS      = 1 << 4,
 };
 
 /**
@@ -856,20 +867,11 @@ enum tx_power_setting {
  * cfg80211_bitrate_mask - masks for bitrate control
  */
 struct cfg80211_bitrate_mask {
-/*
- * As discussed in Berlin, this struct really
- * should look like this:
-
         struct {
                 u32 legacy;
-                u8 mcs[IEEE80211_HT_MCS_MASK_LEN];
+                /* TODO: add support for masking MCS rates; e.g.: */
+                /* u8 mcs[IEEE80211_HT_MCS_MASK_LEN]; */
         } control[IEEE80211_NUM_BANDS];
-
- * Since we can always fix in-kernel users, let's keep
- * it simpler for now:
- */
-        u32 fixed;   /* fixed bitrate, 0 == not fixed */
-        u32 maxrate; /* in kbps, 0 == no limit */
 };
 /**
  * struct cfg80211_pmksa - PMK Security Association
@@ -1193,6 +1195,10 @@ enum wiphy_flags {
         WIPHY_FLAG_4ADDR_STATION        = BIT(6),
 };
 
+struct mac_address {
+        u8 addr[ETH_ALEN];
+};
+
 /**
  * struct wiphy - wireless hardware description
  * @idx: the wiphy index assigned to this item
@@ -1211,12 +1217,28 @@ enum wiphy_flags {
  *      -1 = fragmentation disabled, only odd values >= 256 used
  * @rts_threshold: RTS threshold (dot11RTSThreshold); -1 = RTS/CTS disabled
  * @net: the network namespace this wiphy currently lives in
+ * @perm_addr: permanent MAC address of this device
+ * @addr_mask: If the device supports multiple MAC addresses by masking,
+ *      set this to a mask with variable bits set to 1, e.g. if the last
+ *      four bits are variable then set it to 00:...:00:0f. The actual
+ *      variable bits shall be determined by the interfaces added, with
+ *      interfaces not matching the mask being rejected to be brought up.
+ * @n_addresses: number of addresses in @addresses.
+ * @addresses: If the device has more than one address, set this pointer
+ *      to a list of addresses (6 bytes each). The first one will be used
+ *      by default for perm_addr. In this case, the mask should be set to
+ *      all-zeroes. In this case it is assumed that the device can handle
+ *      the same number of arbitrary MAC addresses.
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
 
-        /* permanent MAC address */
+        /* permanent MAC address(es) */
         u8 perm_addr[ETH_ALEN];
+        u8 addr_mask[ETH_ALEN];
+
+        u16 n_addresses;
+        struct mac_address *addresses;
 
         /* Supported interface modes, OR together BIT(NL80211_IFTYPE_...) */
         u16 interface_modes;
@@ -1236,6 +1258,7 @@ struct wiphy {
         u8 retry_long;
         u32 frag_threshold;
         u32 rts_threshold;
+        u8 coverage_class;
 
         char fw_version[ETHTOOL_BUSINFO_LEN];
         u32 hw_version;
@@ -1635,6 +1658,22 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
  */
 unsigned int cfg80211_classify8021d(struct sk_buff *skb);
 
+/**
+ * cfg80211_find_ie - find information element in data
+ *
+ * @eid: element ID
+ * @ies: data consisting of IEs
+ * @len: length of data
+ *
+ * This function will return %NULL if the element ID could
+ * not be found or if the element is invalid (claims to be
+ * longer than the given data), or a pointer to the first byte
+ * of the requested element, that is the byte containing the
+ * element ID. There are no checks on the element length
+ * other than having to fit into the given data.
+ */
+const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len);
+
 /*
  * Regulatory helper functions for wiphys
  */
diff --git a/include/net/icmp.h b/include/net/icmp.h
index dfa72d4e890..15b3dfe9fce 100644
--- a/include/net/icmp.h
+++ b/include/net/icmp.h
@@ -28,7 +28,7 @@ struct icmp_err {
   unsigned      fatal:1;
 };
 
-extern struct icmp_err icmp_err_convert[];
+extern const struct icmp_err icmp_err_convert[];
 #define ICMP_INC_STATS(net, field)      SNMP_INC_STATS((net)->mib.icmp_statistics, field)
 #define ICMP_INC_STATS_BH(net, field)   SNMP_INC_STATS_BH((net)->mib.icmp_statistics, field)
 #define ICMPMSGOUT_INC_STATS(net, field)        SNMP_INC_STATS((net)->mib.icmpmsg_statistics, field+256)
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index bd4c53f75ac..83fd34437cf 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -122,10 +122,12 @@ struct inet_sock {
         __be32                  inet_saddr;
         __s16                   uc_ttl;
         __u16                   cmsg_flags;
-        struct ip_options       *opt;
         __be16                  inet_sport;
         __u16                   inet_id;
+
+        struct ip_options       *opt;
         __u8                    tos;
+        __u8                    min_ttl;
         __u8                    mc_ttl;
         __u8                    pmtudisc;
         __u8                    recverr:1,
diff --git a/include/net/ip.h b/include/net/ip.h
index 85108cfbb1a..fb63371c07a 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -326,6 +326,22 @@ static __inline__ void inet_reset_saddr(struct sock *sk)
 
 #endif
 
+static inline int sk_mc_loop(struct sock *sk)
+{
+        if (!sk)
+                return 1;
+        switch (sk->sk_family) {
+        case AF_INET:
+                return inet_sk(sk)->mc_loop;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        case AF_INET6:
+                return inet6_sk(sk)->mc_loop;
+#endif
+        }
+        WARN_ON(1);
+        return 1;
+}
+
 extern int      ip_call_ra_chain(struct sk_buff *skb);
 
 /*
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index f073a2a5057..74ccf30fdf8 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -107,12 +107,14 @@ enum ieee80211_max_queues {
  *      2^n-1 in the range 1..32767]
  * @cw_max: maximum contention window [like @cw_min]
  * @txop: maximum burst time in units of 32 usecs, 0 meaning disabled
+ * @uapsd: is U-APSD mode enabled for the queue
  */
 struct ieee80211_tx_queue_params {
         u16 txop;
         u16 cw_min;
         u16 cw_max;
         u8 aifs;
+        bool uapsd;
 };
 
 /**
@@ -184,7 +186,8 @@ enum ieee80211_bss_change {
  * @use_short_slot: use short slot time (only relevant for ERP);
  *      if the hardware cannot handle this it must set the
  *      IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE hardware flag
- * @dtim_period: num of beacons before the next DTIM, for PSM
+ * @dtim_period: num of beacons before the next DTIM, for beaconing,
+ *      not valid in station mode (cf. hw conf ps_dtim_period)
  * @timestamp: beacon timestamp
  * @beacon_int: beacon interval
  * @assoc_capability: capabilities taken from assoc resp
@@ -255,9 +258,6 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_RATE_CTRL_PROBE: internal to mac80211, can be
  *      set by rate control algorithms to indicate probe rate, will
  *      be cleared for fragmented frames (except on the last fragment)
- * @IEEE80211_TX_INTFL_RCALGO: mac80211 internal flag, do not test or
- *      set this flag in the driver; indicates that the rate control
- *      algorithm was used and should be notified of TX status
  * @IEEE80211_TX_INTFL_NEED_TXPROCESSING: completely internal to mac80211,
  *      used to indicate that a pending frame requires TX processing before
  *      it can be sent out.
@@ -272,6 +272,11 @@ struct ieee80211_bss_conf {
  *      transmit function after the current frame, this can be used
  *      by drivers to kick the DMA queue only if unset or when the
  *      queue gets full.
+ * @IEEE80211_TX_INTFL_RETRANSMISSION: This frame is being retransmitted
+ *      after TX status because the destination was asleep, it must not
+ *      be modified again (no seqno assignment, crypto, etc.)
+ * @IEEE80211_TX_INTFL_HAS_RADIOTAP: This frame was injected and still
+ *      has a radiotap header at skb->data.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -287,12 +292,13 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_STAT_AMPDU                 = BIT(10),
         IEEE80211_TX_STAT_AMPDU_NO_BACK         = BIT(11),
         IEEE80211_TX_CTL_RATE_CTRL_PROBE        = BIT(12),
-        IEEE80211_TX_INTFL_RCALGO               = BIT(13),
         IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
         IEEE80211_TX_INTFL_RETRIED              = BIT(15),
         IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
         IEEE80211_TX_CTL_PSPOLL_RESPONSE        = BIT(17),
         IEEE80211_TX_CTL_MORE_FRAMES            = BIT(18),
+        IEEE80211_TX_INTFL_RETRANSMISSION       = BIT(19),
+        IEEE80211_TX_INTFL_HAS_RADIOTAP         = BIT(20),
 };
 
 /**
@@ -571,7 +577,13 @@ struct ieee80211_rx_status {
  * @IEEE80211_CONF_MONITOR: there's a monitor interface present -- use this
  *      to determine for example whether to calculate timestamps for packets
  *      or not, do not use instead of filter flags!
- * @IEEE80211_CONF_PS: Enable 802.11 power save mode (managed mode only)
+ * @IEEE80211_CONF_PS: Enable 802.11 power save mode (managed mode only).
+ *      This is the power save mode defined by IEEE 802.11-2007 section 11.2,
+ *      meaning that the hardware still wakes up for beacons, is able to
+ *      transmit frames and receive the possible acknowledgment frames.
+ *      Not to be confused with hardware specific wakeup/sleep states,
+ *      driver is responsible for that. See the section "Powersave support"
+ *      for more.
  * @IEEE80211_CONF_IDLE: The device is running, but idle; if the flag is set
  *      the driver should be prepared to handle configuration requests but
  *      may turn the device off as much as possible. Typically, this flag will
@@ -611,7 +623,11 @@ enum ieee80211_conf_changed {
 /**
  * enum ieee80211_smps_mode - spatial multiplexing power save mode
  *
- * @
+ * @IEEE80211_SMPS_AUTOMATIC: automatic
+ * @IEEE80211_SMPS_OFF: off
+ * @IEEE80211_SMPS_STATIC: static
+ * @IEEE80211_SMPS_DYNAMIC: dynamic
+ * @IEEE80211_SMPS_NUM_MODES: internal, don't use
  */
 enum ieee80211_smps_mode {
         IEEE80211_SMPS_AUTOMATIC,
@@ -636,6 +652,9 @@ enum ieee80211_smps_mode {
  *      value will be only achievable between DTIM frames, the hardware
  *      needs to check for the multicast traffic bit in DTIM beacons.
  *      This variable is valid only when the CONF_PS flag is set.
+ * @ps_dtim_period: The DTIM period of the AP we're connected to, for use
+ *      in power saving. Power saving will not be enabled until a beacon
+ *      has been received and the DTIM period is known.
  * @dynamic_ps_timeout: The dynamic powersave timeout (in ms), see the
  *      powersave documentation below. This variable is valid only when
  *      the CONF_PS flag is set.
@@ -662,6 +681,7 @@ struct ieee80211_conf {
         int max_sleep_period;
 
         u16 listen_interval;
+        u8 ps_dtim_period;
 
         u8 long_frame_max_tx_count, short_frame_max_tx_count;
 
@@ -933,6 +953,11 @@ enum ieee80211_tkip_key_type {
  *      Hardware supports dynamic spatial multiplexing powersave,
  *      ie. can turn off all but one chain and then wake the rest
  *      up as required after, for example, rts/cts handshake.
+ *
+ * @IEEE80211_HW_SUPPORTS_UAPSD:
+ *      Hardware supports Unscheduled Automatic Power Save Delivery
+ *      (U-APSD) in managed mode. The mode is configured with
+ *      conf_tx() operation.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -952,6 +977,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_BEACON_FILTER                      = 1<<14,
         IEEE80211_HW_SUPPORTS_STATIC_SMPS               = 1<<15,
         IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS              = 1<<16,
+        IEEE80211_HW_SUPPORTS_UAPSD                     = 1<<17,
 };
 
 /**
@@ -1130,18 +1156,24 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  *
  * mac80211 has support for various powersave implementations.
  *
- * First, it can support hardware that handles all powersaving by
- * itself, such hardware should simply set the %IEEE80211_HW_SUPPORTS_PS
- * hardware flag. In that case, it will be told about the desired
- * powersave mode depending on the association status, and the driver
- * must take care of sending nullfunc frames when necessary, i.e. when
- * entering and leaving powersave mode. The driver is required to look at
- * the AID in beacons and signal to the AP that it woke up when it finds
- * traffic directed to it. This mode supports dynamic PS by simply
- * enabling/disabling PS.
- *
- * Additionally, such hardware may set the %IEEE80211_HW_SUPPORTS_DYNAMIC_PS
- * flag to indicate that it can support dynamic PS mode itself (see below).
+ * First, it can support hardware that handles all powersaving by itself,
+ * such hardware should simply set the %IEEE80211_HW_SUPPORTS_PS hardware
+ * flag. In that case, it will be told about the desired powersave mode
+ * with the %IEEE80211_CONF_PS flag depending on the association status.
+ * The hardware must take care of sending nullfunc frames when necessary,
+ * i.e. when entering and leaving powersave mode. The hardware is required
+ * to look at the AID in beacons and signal to the AP that it woke up when
+ * it finds traffic directed to it.
+ *
+ * %IEEE80211_CONF_PS flag enabled means that the powersave mode defined in
+ * IEEE 802.11-2007 section 11.2 is enabled. This is not to be confused
+ * with hardware wakeup and sleep states. Driver is responsible for waking
+ * up the hardware before issueing commands to the hardware and putting it
+ * back to sleep at approriate times.
+ *
+ * When PS is enabled, hardware needs to wakeup for beacons and receive the
+ * buffered multicast/broadcast frames after the beacon. Also it must be
+ * possible to send frames and receive the acknowledment frame.
  *
  * Other hardware designs cannot send nullfunc frames by themselves and also
  * need software support for parsing the TIM bitmap. This is also supported
@@ -1149,14 +1181,35 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * %IEEE80211_HW_PS_NULLFUNC_STACK flags. The hardware is of course still
  * required to pass up beacons. The hardware is still required to handle
  * waking up for multicast traffic; if it cannot the driver must handle that
- * as best as it can, mac80211 is too slow.
- *
- * Dynamic powersave mode is an extension to normal powersave mode in which
- * the hardware stays awake for a user-specified period of time after sending
- * a frame so that reply frames need not be buffered and therefore delayed
- * to the next wakeup. This can either be supported by hardware, in which case
- * the driver needs to look at the @dynamic_ps_timeout hardware configuration
- * value, or by the stack if all nullfunc handling is in the stack.
+ * as best as it can, mac80211 is too slow to do that.
+ *
+ * Dynamic powersave is an extension to normal powersave in which the
+ * hardware stays awake for a user-specified period of time after sending a
+ * frame so that reply frames need not be buffered and therefore delayed to
+ * the next wakeup. It's compromise of getting good enough latency when
+ * there's data traffic and still saving significantly power in idle
+ * periods.
+ *
+ * Dynamic powersave is supported by simply mac80211 enabling and disabling
+ * PS based on traffic. Driver needs to only set %IEEE80211_HW_SUPPORTS_PS
+ * flag and mac80211 will handle everything automatically. Additionally,
+ * hardware having support for the dynamic PS feature may set the
+ * %IEEE80211_HW_SUPPORTS_DYNAMIC_PS flag to indicate that it can support
+ * dynamic PS mode itself. The driver needs to look at the
+ * @dynamic_ps_timeout hardware configuration value and use it that value
+ * whenever %IEEE80211_CONF_PS is set. In this case mac80211 will disable
+ * dynamic PS feature in stack and will just keep %IEEE80211_CONF_PS
+ * enabled whenever user has enabled powersave.
+ *
+ * Driver informs U-APSD client support by enabling
+ * %IEEE80211_HW_SUPPORTS_UAPSD flag. The mode is configured through the
+ * uapsd paramater in conf_tx() operation. Hardware needs to send the QoS
+ * Nullfunc frames and stay awake until the service period has ended. To
+ * utilize U-APSD, dynamic powersave is disabled for voip AC and all frames
+ * from that AC are transmitted with powersave enabled.
+ *
+ * Note: U-APSD client mode is not yet supported with
+ * %IEEE80211_HW_PS_NULLFUNC_STACK.
  */
 
 /**
@@ -1444,7 +1497,7 @@ enum ieee80211_ampdu_mlme_action {
  * @update_tkip_key: See the section "Hardware crypto acceleration"
  *      This callback will be called in the context of Rx. Called for drivers
  *      which set IEEE80211_KEY_FLAG_TKIP_REQ_RX_P1_KEY.
- *      The callback can sleep.
+ *      The callback must be atomic.
  *
  * @hw_scan: Ask the hardware to service the scan request, no need to start
  *      the scan state machine in stack. The scan must honour the channel
@@ -1533,6 +1586,10 @@ enum ieee80211_ampdu_mlme_action {
  *      and need to call wiphy_rfkill_set_hw_state() in the callback.
  *      The callback can sleep.
  *
+ * @set_coverage_class: Set slot time for given coverage class as specified
+ *      in IEEE 802.11-2007 section 17.3.8.6 and modify ACK timeout
+ *      accordingly. This callback is not required and may sleep.
+ *
  * @testmode_cmd: Implement a cfg80211 test mode command.
  *      The callback can sleep.
  *
@@ -1565,8 +1622,10 @@ struct ieee80211_ops {
                        struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                        struct ieee80211_key_conf *key);
         void (*update_tkip_key)(struct ieee80211_hw *hw,
-                        struct ieee80211_key_conf *conf, const u8 *address,
-                        u32 iv32, u16 *phase1key);
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_key_conf *conf,
+                                struct ieee80211_sta *sta,
+                                u32 iv32, u16 *phase1key);
         int (*hw_scan)(struct ieee80211_hw *hw,
                        struct cfg80211_scan_request *req);
         void (*sw_scan_start)(struct ieee80211_hw *hw);
@@ -1592,6 +1651,7 @@ struct ieee80211_ops {
                             struct ieee80211_sta *sta, u16 tid, u16 *ssn);
 
         void (*rfkill_poll)(struct ieee80211_hw *hw);
+        void (*set_coverage_class)(struct ieee80211_hw *hw, u8 coverage_class);
 #ifdef CONFIG_NL80211_TESTMODE
         int (*testmode_cmd)(struct ieee80211_hw *hw, void *data, int len);
 #endif
@@ -1874,6 +1934,53 @@ static inline struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 }
 
 /**
+ * ieee80211_pspoll_get - retrieve a PS Poll template
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * Creates a PS Poll a template which can, for example, uploaded to
+ * hardware. The template must be updated after association so that correct
+ * AID, BSSID and MAC address is used.
+ *
+ * Note: Caller (or hardware) is responsible for setting the
+ * &IEEE80211_FCTL_PM bit.
+ */
+struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif);
+
+/**
+ * ieee80211_nullfunc_get - retrieve a nullfunc template
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * Creates a Nullfunc template which can, for example, uploaded to
+ * hardware. The template must be updated after association so that correct
+ * BSSID and address is used.
+ *
+ * Note: Caller (or hardware) is responsible for setting the
+ * &IEEE80211_FCTL_PM bit as well as Duration and Sequence Control fields.
+ */
+struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif);
+
+/**
+ * ieee80211_probereq_get - retrieve a Probe Request template
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @ssid: SSID buffer
+ * @ssid_len: length of SSID
+ * @ie: buffer containing all IEs except SSID for the template
+ * @ie_len: length of the IE buffer
+ *
+ * Creates a Probe Request template which can, for example, be uploaded to
+ * hardware.
+ */
+struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       const u8 *ssid, size_t ssid_len,
+                                       const u8 *ie, size_t ie_len);
+
+/**
  * ieee80211_rts_get - RTS frame generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
@@ -2292,8 +2399,12 @@ enum rate_control_changed {
  * @short_preamble: whether mac80211 will request short-preamble transmission
  *      if the selected rate supports it
  * @max_rate_idx: user-requested maximum rate (not MCS for now)
+ *      (deprecated; this will be removed once drivers get updated to use
+ *      rate_idx_mask)
+ * @rate_idx_mask: user-requested rate mask (not MCS for now)
  * @skb: the skb that will be transmitted, the control information in it needs
  *      to be filled in
+ * @ap: whether this frame is sent out in AP mode
  */
 struct ieee80211_tx_rate_control {
         struct ieee80211_hw *hw;
@@ -2303,6 +2414,8 @@ struct ieee80211_tx_rate_control {
         struct ieee80211_tx_rate reported_rate;
         bool rts, short_preamble;
         u8 max_rate_idx;
+        u32 rate_idx_mask;
+        bool ap;
 };
 
 struct rate_control_ops {
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index ba1ba0c5efd..63d449807d9 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -11,6 +11,8 @@ struct nf_conntrack_ecache;
 struct netns_ct {
         atomic_t                count;
         unsigned int            expect_count;
+        unsigned int            htable_size;
+        struct kmem_cache       *nf_conntrack_cachep;
         struct hlist_nulls_head *hash;
         struct hlist_head       *expect_hash;
         struct hlist_nulls_head unconfirmed;
@@ -28,5 +30,6 @@ struct netns_ct {
 #endif
         int                     hash_vmalloc;
         int                     expect_vmalloc;
+        char                    *slabname;
 };
 #endif
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 8098f6b8319..2764994c913 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -42,6 +42,7 @@ struct netns_ipv4 {
 #endif
         struct xt_table         *nat_table;
         struct hlist_head       *nat_bysource;
+        unsigned int            nat_htable_size;
         int                     nat_vmalloced;
 #endif
 
diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index 56f8e5585df..74f119a2829 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -5,6 +5,7 @@
 #include <linux/wait.h>
 #include <linux/workqueue.h>
 #include <linux/xfrm.h>
+#include <net/dst_ops.h>
 
 struct ctl_table_header;
 
@@ -42,6 +43,11 @@ struct netns_xfrm {
         unsigned int            policy_count[XFRM_POLICY_MAX * 2];
         struct work_struct      policy_hash_work;
 
+        struct dst_ops          xfrm4_dst_ops;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        struct dst_ops          xfrm6_dst_ops;
+#endif
+
         struct sock             *nlsk;
         struct sock             *nlsk_stash;
 
diff --git a/include/net/netrom.h b/include/net/netrom.h
index 15696b1fd30..ab170a60e7d 100644
--- a/include/net/netrom.h
+++ b/include/net/netrom.h
@@ -132,6 +132,8 @@ static __inline__ void nr_node_put(struct nr_node *nr_node)
 static __inline__ void nr_neigh_put(struct nr_neigh *nr_neigh)
 {
         if (atomic_dec_and_test(&nr_neigh->refcount)) {
+                if (nr_neigh->ax25)
+                        ax25_cb_put(nr_neigh->ax25);
                 kfree(nr_neigh->digipeat);
                 kfree(nr_neigh);
         }
diff --git a/include/net/phonet/pep.h b/include/net/phonet/pep.h
index 4c61cdce4e5..35672b1cf44 100644
--- a/include/net/phonet/pep.h
+++ b/include/net/phonet/pep.h
@@ -44,6 +44,7 @@ struct pep_sock {
         u8                      rx_fc;  /* RX flow control */
         u8                      tx_fc;  /* TX flow control */
         u8                      init_enable;    /* auto-enable at creation */
+        u8                      aligned;
 };
 
 static inline struct pep_sock *pep_sk(struct sock *sk)
@@ -77,6 +78,7 @@ static inline struct pnpipehdr *pnp_hdr(struct sk_buff *skb)
 
 enum {
         PNS_PIPE_DATA = 0x20,
+        PNS_PIPE_ALIGNED_DATA,
 
         PNS_PEP_CONNECT_REQ = 0x40,
         PNS_PEP_CONNECT_RESP,
@@ -138,6 +140,7 @@ enum {
         PN_PIPE_SB_NEGOTIATED_FC,
         PN_PIPE_SB_REQUIRED_FC_TX,
         PN_PIPE_SB_PREFERRED_FC_RX,
+        PN_PIPE_SB_ALIGNED_DATA,
 };
 
 /* Phonet pipe flow control models */
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 2d567265363..b6cdc33b39c 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -71,6 +71,7 @@ extern void qdisc_watchdog_cancel(struct qdisc_watchdog *wd);
 
 extern struct Qdisc_ops pfifo_qdisc_ops;
 extern struct Qdisc_ops bfifo_qdisc_ops;
+extern struct Qdisc_ops pfifo_head_drop_qdisc_ops;
 
 extern int fifo_set_limit(struct Qdisc *q, unsigned int limit);
 extern struct Qdisc *fifo_create_dflt(struct Qdisc *sch, struct Qdisc_ops *ops,
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 47995b81c5d..f873ee37f7e 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -39,6 +39,7 @@ enum environment_cap {
  *      00 - World regulatory domain
  *      99 - built by driver but a specific alpha2 cannot be determined
  *      98 - result of an intersection between two regulatory domains
+ *      97 - regulatory domain has not yet been configured
  * @intersect: indicates whether the wireless core should intersect
  *      the requested regulatory domain with the presently set regulatory
  *      domain.
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index c9b50ebd9ce..99e6e19b57c 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -45,6 +45,8 @@ struct request_sock_ops {
         void            (*send_reset)(struct sock *sk,
                                       struct sk_buff *skb);
         void            (*destructor)(struct request_sock *req);
+        void            (*syn_ack_timeout)(struct sock *sk,
+                                           struct request_sock *req);
 };
 
 /* struct request_sock - mini sock to represent a connection request
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index dad558bc06f..67dc08eaaa4 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -427,6 +427,25 @@ static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch)
         return __qdisc_dequeue_head(sch, &sch->q);
 }
 
+static inline unsigned int __qdisc_queue_drop_head(struct Qdisc *sch,
+                                              struct sk_buff_head *list)
+{
+        struct sk_buff *skb = __qdisc_dequeue_head(sch, list);
+
+        if (likely(skb != NULL)) {
+                unsigned int len = qdisc_pkt_len(skb);
+                kfree_skb(skb);
+                return len;
+        }
+
+        return 0;
+}
+
+static inline unsigned int qdisc_queue_drop_head(struct Qdisc *sch)
+{
+        return __qdisc_queue_drop_head(sch, &sch->q);
+}
+
 static inline struct sk_buff *__qdisc_dequeue_tail(struct Qdisc *sch,
                                                    struct sk_buff_head *list)
 {
diff --git a/include/net/snmp.h b/include/net/snmp.h
index f0d756f2ac9..da02ee027d6 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -32,7 +32,7 @@
  *  - name of entries.
  */
 struct snmp_mib {
-        char *name;
+        const char *name;
         int entry;
 };
 
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 788c99f9859..87d164b9bd8 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -400,6 +400,8 @@ extern int			compat_tcp_setsockopt(struct sock *sk,
                                         int level, int optname,
                                         char __user *optval, unsigned int optlen);
 extern void                     tcp_set_keepalive(struct sock *sk, int val);
+extern void                     tcp_syn_ack_timeout(struct sock *sk,
+                                                    struct request_sock *req);
 extern int                      tcp_recvmsg(struct kiocb *iocb, struct sock *sk,
                                             struct msghdr *msg,
                                             size_t len, int nonblock, 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 6d85861ab99..fcee547ca7e 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1367,8 +1367,8 @@ struct xfrmk_spdinfo {
 extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 seq);
 extern int xfrm_state_delete(struct xfrm_state *x);
 extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
-extern void xfrm_sad_getinfo(struct xfrmk_sadinfo *si);
-extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si);
+extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
+extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
 extern int xfrm_replay_check(struct xfrm_state *x,
                              struct sk_buff *skb, __be32 seq);
 extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
@@ -1408,9 +1408,9 @@ extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                             xfrm_address_t *saddr, u8 proto);
 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
-extern __be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
-extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
-extern __be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
+extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
+extern void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr);
+extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr);
 extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_output(struct sk_buff *skb);
diff --git a/include/scsi/libsrp.h b/include/scsi/libsrp.h
index 07e3adde21d..f4105c91af5 100644
--- a/include/scsi/libsrp.h
+++ b/include/scsi/libsrp.h
@@ -2,6 +2,7 @@
 #define __LIBSRP_H__
 
 #include <linux/list.h>
+#include <linux/kfifo.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_host.h>
 #include <scsi/srp.h>
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 73523151a73..c6fe03e902c 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -414,7 +414,8 @@ ftrace_raw_output_##call(struct trace_iterator *iter, int flags)	\
         BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);                         \
         ret = trace_define_field(event_call, #type "[" #len "]", #item, \
                                  offsetof(typeof(field), item),         \
-                                 sizeof(field.item), 0, FILTER_OTHER);  \
+                                 sizeof(field.item),                    \
+                                 is_signed_type(type), FILTER_OTHER);   \
         if (ret)                                                        \
                 return ret;
 
@@ -422,8 +423,8 @@ ftrace_raw_output_##call(struct trace_iterator *iter, int flags)	\
 #define __dynamic_array(type, item, len)                                       \
         ret = trace_define_field(event_call, "__data_loc " #type "[]", #item,  \
                                  offsetof(typeof(field), __data_loc_##item),   \
-                                 sizeof(field.__data_loc_##item), 0,           \
-                                 FILTER_OTHER);
+                                 sizeof(field.__data_loc_##item),              \
+                                 is_signed_type(type), FILTER_OTHER);
 
 #undef __string
 #define __string(item, src) __dynamic_array(char, item, -1)