Merge commit 'v2.6.31-rc6' into core/rcu

Merge reason: the branch was on pre-rc1 .30, update to latest.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

138 files changed, 1740 insertions, 644 deletions

diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index c34b11022908..c65e4ce6c3af 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -114,10 +114,13 @@ struct acpi_device_ops {
         acpi_op_notify notify;
 };
 
+#define ACPI_DRIVER_ALL_NOTIFY_EVENTS   0x1     /* system AND device events */
+
 struct acpi_driver {
         char name[80];
         char class[80];
         const struct acpi_device_id *ids; /* Supported Hardware IDs */
+        unsigned int flags;
         struct acpi_device_ops ops;
         struct device_driver drv;
         struct module *owner;
@@ -168,7 +171,7 @@ struct acpi_device_dir {
 
 /* Plug and Play */
 
-typedef char acpi_bus_id[5];
+typedef char acpi_bus_id[8];
 typedef unsigned long acpi_bus_address;
 typedef char acpi_hardware_id[15];
 typedef char acpi_unique_id[9];
@@ -365,10 +368,10 @@ struct acpi_bus_type {
 int register_acpi_bus_type(struct acpi_bus_type *);
 int unregister_acpi_bus_type(struct acpi_bus_type *);
 struct device *acpi_get_physical_device(acpi_handle);
-struct device *acpi_get_physical_pci_device(acpi_handle);
 
 /* helper */
 acpi_handle acpi_get_child(acpi_handle, acpi_integer);
+int acpi_is_root_bridge(acpi_handle);
 acpi_handle acpi_get_pci_rootbridge_handle(unsigned int, unsigned int);
 #define DEVICE_ACPI_HANDLE(dev) ((acpi_handle)((dev)->archdata.acpi_handle))
 
diff --git a/include/acpi/acpi_drivers.h b/include/acpi/acpi_drivers.h
index 0352c8f0b05b..f4906f6568d4 100644
--- a/include/acpi/acpi_drivers.h
+++ b/include/acpi/acpi_drivers.h
@@ -57,8 +57,7 @@
  */
 
 #define ACPI_POWER_HID                  "LNXPOWER"
-#define ACPI_PROCESSOR_OBJECT_HID       "ACPI_CPU"
-#define ACPI_PROCESSOR_HID              "ACPI0007"
+#define ACPI_PROCESSOR_OBJECT_HID       "LNXCPU"
 #define ACPI_SYSTEM_HID                 "LNXSYSTM"
 #define ACPI_THERMAL_HID                "LNXTHERM"
 #define ACPI_BUTTON_HID_POWERF          "LNXPWRBN"
@@ -91,17 +90,15 @@ int acpi_pci_link_free_irq(acpi_handle handle);
 
 /* ACPI PCI Interrupt Routing (pci_irq.c) */
 
-int acpi_pci_irq_add_prt(acpi_handle handle, int segment, int bus);
-void acpi_pci_irq_del_prt(int segment, int bus);
+int acpi_pci_irq_add_prt(acpi_handle handle, struct pci_bus *bus);
+void acpi_pci_irq_del_prt(struct pci_bus *bus);
 
 /* ACPI PCI Device Binding (pci_bind.c) */
 
 struct pci_bus;
 
-acpi_status acpi_get_pci_id(acpi_handle handle, struct acpi_pci_id *id);
-int acpi_pci_bind(struct acpi_device *device);
-int acpi_pci_bind_root(struct acpi_device *device, struct acpi_pci_id *id,
-                       struct pci_bus *bus);
+struct pci_dev *acpi_get_pci_dev(acpi_handle);
+int acpi_pci_bind_root(struct acpi_device *device);
 
 /* Arch-defined function to add a bus to the system */
 
diff --git a/include/acpi/acpiosxf.h b/include/acpi/acpiosxf.h
index 3e798593b17b..ab0b85cf21f3 100644
--- a/include/acpi/acpiosxf.h
+++ b/include/acpi/acpiosxf.h
@@ -242,6 +242,10 @@ acpi_os_derive_pci_id(acpi_handle rhandle,
 acpi_status acpi_os_validate_interface(char *interface);
 acpi_status acpi_osi_invalidate(char* interface);
 
+acpi_status
+acpi_os_validate_address(u8 space_id, acpi_physical_address address,
+                         acpi_size length, char *name);
+
 u64 acpi_os_get_timer(void);
 
 acpi_status acpi_os_signal(u32 function, void *info);
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 4927c063347c..baf1e0a9a7ee 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -258,6 +258,7 @@ DECLARE_PER_CPU(struct acpi_processor *, processors);
 extern struct acpi_processor_errata errata;
 
 void arch_acpi_processor_init_pdc(struct acpi_processor *pr);
+void arch_acpi_processor_cleanup_pdc(struct acpi_processor *pr);
 
 #ifdef ARCH_HAS_POWER_INIT
 void acpi_processor_power_init_bm_check(struct acpi_processor_flags *flags,
diff --git a/include/acpi/video.h b/include/acpi/video.h
index af6fe95fd3d0..cf7be3dd157b 100644
--- a/include/acpi/video.h
+++ b/include/acpi/video.h
@@ -3,10 +3,10 @@
 
 #if (defined CONFIG_ACPI_VIDEO || defined CONFIG_ACPI_VIDEO_MODULE)
 extern int acpi_video_register(void);
-extern int acpi_video_exit(void);
+extern void acpi_video_unregister(void);
 #else
 static inline int acpi_video_register(void) { return 0; }
-static inline void acpi_video_exit(void) { return; }
+static inline void acpi_video_unregister(void) { return; }
 #endif
 
 #endif
diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
index 9d40e879f99e..77ff547730af 100644
--- a/include/asm-generic/4level-fixup.h
+++ b/include/asm-generic/4level-fixup.h
@@ -27,9 +27,9 @@
 #define pud_page_vaddr(pud)             pgd_page_vaddr(pud)
 
 #undef pud_free_tlb
-#define pud_free_tlb(tlb, x)            do { } while (0)
+#define pud_free_tlb(tlb, x, addr)      do { } while (0)
 #define pud_free(mm, x)                 do { } while (0)
-#define __pud_free_tlb(tlb, x)          do { } while (0)
+#define __pud_free_tlb(tlb, x, addr)    do { } while (0)
 
 #undef  pud_addr_end
 #define pud_addr_end(addr, end)         (end)
diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h
index d7d50d7ee51e..aa00800adacc 100644
--- a/include/asm-generic/percpu.h
+++ b/include/asm-generic/percpu.h
@@ -97,4 +97,8 @@ extern void setup_per_cpu_areas(void);
 #define PER_CPU_ATTRIBUTES
 #endif
 
+#ifndef PER_CPU_DEF_ATTRIBUTES
+#define PER_CPU_DEF_ATTRIBUTES
+#endif
+
 #endif /* _ASM_GENERIC_PERCPU_H_ */
diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
index a7cdc48e8b78..725612b793ce 100644
--- a/include/asm-generic/pgtable-nopmd.h
+++ b/include/asm-generic/pgtable-nopmd.h
@@ -59,7 +59,7 @@ static inline pmd_t * pmd_offset(pud_t * pud, unsigned long address)
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 {
 }
-#define __pmd_free_tlb(tlb, x)                  do { } while (0)
+#define __pmd_free_tlb(tlb, x, a)               do { } while (0)
 
 #undef  pmd_addr_end
 #define pmd_addr_end(addr, end)                 (end)
diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
index 87cf449a6df3..810431d8351b 100644
--- a/include/asm-generic/pgtable-nopud.h
+++ b/include/asm-generic/pgtable-nopud.h
@@ -52,7 +52,7 @@ static inline pud_t * pud_offset(pgd_t * pgd, unsigned long address)
  */
 #define pud_alloc_one(mm, address)              NULL
 #define pud_free(mm, x)                         do { } while (0)
-#define __pud_free_tlb(tlb, x)                  do { } while (0)
+#define __pud_free_tlb(tlb, x, a)               do { } while (0)
 
 #undef  pud_addr_end
 #define pud_addr_end(addr, end)                 (end)
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index f490e43a90b9..e43f9766259f 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -123,24 +123,24 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
                 __tlb_remove_tlb_entry(tlb, ptep, address);     \
         } while (0)
 
-#define pte_free_tlb(tlb, ptep)                                 \
+#define pte_free_tlb(tlb, ptep, address)                        \
         do {                                                    \
                 tlb->need_flush = 1;                            \
-                __pte_free_tlb(tlb, ptep);                      \
+                __pte_free_tlb(tlb, ptep, address);             \
         } while (0)
 
 #ifndef __ARCH_HAS_4LEVEL_HACK
-#define pud_free_tlb(tlb, pudp)                                 \
+#define pud_free_tlb(tlb, pudp, address)                        \
         do {                                                    \
                 tlb->need_flush = 1;                            \
-                __pud_free_tlb(tlb, pudp);                      \
+                __pud_free_tlb(tlb, pudp, address);             \
         } while (0)
 #endif
 
-#define pmd_free_tlb(tlb, pmdp)                                 \
+#define pmd_free_tlb(tlb, pmdp, address)                        \
         do {                                                    \
                 tlb->need_flush = 1;                            \
-                __pmd_free_tlb(tlb, pmdp);                      \
+                __pmd_free_tlb(tlb, pmdp, address);             \
         } while (0)
 
 #define tlb_migrate_finish(mm) do {} while (0)
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 92b73b6140ff..6ad76bf5fb40 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -30,9 +30,7 @@
  *      EXCEPTION_TABLE(...)
  *      NOTES
  *
- *      __bss_start = .;
- *      BSS_SECTION(0, 0)
- *      __bss_stop = .;
+ *      BSS_SECTION(0, 0, 0)
  *      _end = .;
  *
  *      /DISCARD/ : {
@@ -191,7 +189,7 @@
         . = ALIGN(align);                                               \
         *(.data.cacheline_aligned)
 
-#define INIT_TASK(align)                                                \
+#define INIT_TASK_DATA(align)                                           \
         . = ALIGN(align);                                               \
         *(.data.init_task)
 
@@ -434,14 +432,15 @@
 /*
  * Init task
  */
-#define INIT_TASK_DATA(align)                                           \
+#define INIT_TASK_DATA_SECTION(align)                                   \
         . = ALIGN(align);                                               \
         .data.init_task : {                                             \
-                INIT_TASK                                               \
+                INIT_TASK_DATA(align)                                   \
         }
 
 #ifdef CONFIG_CONSTRUCTORS
-#define KERNEL_CTORS()  VMLINUX_SYMBOL(__ctors_start) = .; \
+#define KERNEL_CTORS()  . = ALIGN(8);                      \
+                        VMLINUX_SYMBOL(__ctors_start) = .; \
                         *(.ctors)                          \
                         VMLINUX_SYMBOL(__ctors_end) = .;
 #else
@@ -488,7 +487,8 @@
  * bss (Block Started by Symbol) - uninitialized data
  * zeroed during startup
  */
-#define SBSS                                                            \
+#define SBSS(sbss_align)                                                \
+        . = ALIGN(sbss_align);                                          \
         .sbss : AT(ADDR(.sbss) - LOAD_OFFSET) {                         \
                 *(.sbss)                                                \
                 *(.scommon)                                             \
@@ -497,12 +497,10 @@
 #define BSS(bss_align)                                                  \
         . = ALIGN(bss_align);                                           \
         .bss : AT(ADDR(.bss) - LOAD_OFFSET) {                           \
-                VMLINUX_SYMBOL(__bss_start) = .;                        \
                 *(.bss.page_aligned)                                    \
                 *(.dynbss)                                              \
                 *(.bss)                                                 \
                 *(COMMON)                                               \
-                VMLINUX_SYMBOL(__bss_stop) = .;                         \
         }
 
 /*
@@ -704,15 +702,15 @@
  * matches the requirment of PAGE_ALIGNED_DATA.
  *
  * use 0 as page_align if page_aligned data is not used */
-#define RW_DATA_SECTION(cacheline, nosave, pagealigned, inittask)       \
+#define RW_DATA_SECTION(cacheline, pagealigned, inittask)               \
         . = ALIGN(PAGE_SIZE);                                           \
         .data : AT(ADDR(.data) - LOAD_OFFSET) {                         \
-                INIT_TASK(inittask)                                     \
+                INIT_TASK_DATA(inittask)                                \
                 CACHELINE_ALIGNED_DATA(cacheline)                       \
                 READ_MOSTLY_DATA(cacheline)                             \
                 DATA_DATA                                               \
                 CONSTRUCTORS                                            \
-                NOSAVE_DATA(nosave)                                     \
+                NOSAVE_DATA                                             \
                 PAGE_ALIGNED_DATA(pagealigned)                          \
         }
 
@@ -734,8 +732,10 @@
                 INIT_RAM_FS                                             \
         }
 
-#define BSS_SECTION(sbss_align, bss_align)                              \
-        SBSS                                                            \
+#define BSS_SECTION(sbss_align, bss_align, stop_align)                  \
+        . = ALIGN(sbss_align);                                          \
+        VMLINUX_SYMBOL(__bss_start) = .;                                \
+        SBSS(sbss_align)                                                \
         BSS(bss_align)                                                  \
-        . = ALIGN(4);
-
+        . = ALIGN(stop_align);                                          \
+        VMLINUX_SYMBOL(__bss_stop) = .;
diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h
index c263e4d71754..7d6c9a2dfcbb 100644
--- a/include/drm/drm_edid.h
+++ b/include/drm/drm_edid.h
@@ -35,11 +35,11 @@ struct est_timings {
 } __attribute__((packed));
 
 /* 00=16:10, 01=4:3, 10=5:4, 11=16:9 */
-#define EDID_TIMING_ASPECT_SHIFT 0
+#define EDID_TIMING_ASPECT_SHIFT 6
 #define EDID_TIMING_ASPECT_MASK  (0x3 << EDID_TIMING_ASPECT_SHIFT)
 
 /* need to add 60 */
-#define EDID_TIMING_VFREQ_SHIFT  2
+#define EDID_TIMING_VFREQ_SHIFT  0
 #define EDID_TIMING_VFREQ_MASK   (0x3f << EDID_TIMING_VFREQ_SHIFT)
 
 struct std_timing {
@@ -47,11 +47,11 @@ struct std_timing {
         u8 vfreq_aspect;
 } __attribute__((packed));
 
-#define DRM_EDID_PT_HSYNC_POSITIVE (1 << 6)
-#define DRM_EDID_PT_VSYNC_POSITIVE (1 << 5)
+#define DRM_EDID_PT_HSYNC_POSITIVE (1 << 1)
+#define DRM_EDID_PT_VSYNC_POSITIVE (1 << 2)
 #define DRM_EDID_PT_SEPARATE_SYNC  (3 << 3)
-#define DRM_EDID_PT_STEREO         (1 << 2)
-#define DRM_EDID_PT_INTERLACED     (1 << 1)
+#define DRM_EDID_PT_STEREO         (1 << 5)
+#define DRM_EDID_PT_INTERLACED     (1 << 7)
 
 /* If detailed data is pixel timing */
 struct detailed_pixel_timing {
@@ -93,7 +93,7 @@ struct detailed_data_monitor_range {
 } __attribute__((packed));
 
 struct detailed_data_wpindex {
-        u8 white_xy_lo; /* Upper 2 bits each */
+        u8 white_yx_lo; /* Lower 2 bits each */
         u8 white_x_hi;
         u8 white_y_hi;
         u8 gamma; /* need to divide by 100 then add 1 */
@@ -135,21 +135,21 @@ struct detailed_timing {
         } data;
 } __attribute__((packed));
 
-#define DRM_EDID_INPUT_SERRATION_VSYNC (1 << 7)
-#define DRM_EDID_INPUT_SYNC_ON_GREEN   (1 << 5)
-#define DRM_EDID_INPUT_COMPOSITE_SYNC  (1 << 4)
+#define DRM_EDID_INPUT_SERRATION_VSYNC (1 << 0)
+#define DRM_EDID_INPUT_SYNC_ON_GREEN   (1 << 1)
+#define DRM_EDID_INPUT_COMPOSITE_SYNC  (1 << 2)
 #define DRM_EDID_INPUT_SEPARATE_SYNCS  (1 << 3)
-#define DRM_EDID_INPUT_BLANK_TO_BLACK  (1 << 2)
-#define DRM_EDID_INPUT_VIDEO_LEVEL     (3 << 1)
-#define DRM_EDID_INPUT_DIGITAL         (1 << 0) /* bits above must be zero if set */
+#define DRM_EDID_INPUT_BLANK_TO_BLACK  (1 << 4)
+#define DRM_EDID_INPUT_VIDEO_LEVEL     (3 << 5)
+#define DRM_EDID_INPUT_DIGITAL         (1 << 7) /* bits below must be zero if set */
 
-#define DRM_EDID_FEATURE_DEFAULT_GTF      (1 << 7)
-#define DRM_EDID_FEATURE_PREFERRED_TIMING (1 << 6)
-#define DRM_EDID_FEATURE_STANDARD_COLOR   (1 << 5)
+#define DRM_EDID_FEATURE_DEFAULT_GTF      (1 << 0)
+#define DRM_EDID_FEATURE_PREFERRED_TIMING (1 << 1)
+#define DRM_EDID_FEATURE_STANDARD_COLOR   (1 << 2)
 #define DRM_EDID_FEATURE_DISPLAY_TYPE     (3 << 3) /* 00=mono, 01=rgb, 10=non-rgb, 11=unknown */
-#define DRM_EDID_FEATURE_PM_ACTIVE_OFF    (1 << 2)
-#define DRM_EDID_FEATURE_PM_SUSPEND       (1 << 1)
-#define DRM_EDID_FEATURE_PM_STANDBY       (1 << 0)
+#define DRM_EDID_FEATURE_PM_ACTIVE_OFF    (1 << 5)
+#define DRM_EDID_FEATURE_PM_SUSPEND       (1 << 6)
+#define DRM_EDID_FEATURE_PM_STANDBY       (1 << 7)
 
 struct edid {
         u8 header[8];
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 45c18672b093..853508499d20 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -43,6 +43,7 @@
         {0x1002, 0x4A4F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4A50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4A54, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x4B48, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4B49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4B4A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4B4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
@@ -256,12 +257,16 @@
         {0x1002, 0x940F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R600|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94A1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94A3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94B1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94B3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94B4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94B5, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94B9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9440, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9441, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9442, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9443, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9444, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x944A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
@@ -286,6 +291,7 @@
         {0x1002, 0x948F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9490, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9491, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9495, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9498, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x949C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x949E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
@@ -323,6 +329,7 @@
         {0x1002, 0x9552, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9553, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9555, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9557, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9580, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9581, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9583, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
@@ -346,12 +353,12 @@
         {0x1002, 0x9599, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV635|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x959B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV635|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x95C2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x95C4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C5, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C7, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x95C2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x95C4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95CC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95CD, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95CE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
@@ -363,6 +370,11 @@
         {0x1002, 0x9614, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS780|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9615, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS780|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9616, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS780|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9710, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9711, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9712, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0, 0, 0}
 
 #define r128_PCI_IDS \
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index 41862e9a4c20..af4b4826997e 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -506,6 +506,8 @@ typedef struct {
 #define DRM_RADEON_GEM_WAIT_IDLE        0x24
 #define DRM_RADEON_CS                   0x26
 #define DRM_RADEON_INFO                 0x27
+#define DRM_RADEON_GEM_SET_TILING       0x28
+#define DRM_RADEON_GEM_GET_TILING       0x29
 
 #define DRM_IOCTL_RADEON_CP_INIT    DRM_IOW( DRM_COMMAND_BASE + DRM_RADEON_CP_INIT, drm_radeon_init_t)
 #define DRM_IOCTL_RADEON_CP_START   DRM_IO(  DRM_COMMAND_BASE + DRM_RADEON_CP_START)
@@ -544,7 +546,8 @@ typedef struct {
 #define DRM_IOCTL_RADEON_GEM_WAIT_IDLE  DRM_IOW(DRM_COMMAND_BASE + DRM_RADEON_GEM_WAIT_IDLE, struct drm_radeon_gem_wait_idle)
 #define DRM_IOCTL_RADEON_CS             DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_CS, struct drm_radeon_cs)
 #define DRM_IOCTL_RADEON_INFO           DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_INFO, struct drm_radeon_info)
-
+#define DRM_IOCTL_RADEON_SET_TILING     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_SET_TILING, struct drm_radeon_gem_set_tiling)
+#define DRM_IOCTL_RADEON_GET_TILING     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_GET_TILING, struct drm_radeon_gem_get_tiling)
 
 typedef struct drm_radeon_init {
         enum {
@@ -796,6 +799,24 @@ struct drm_radeon_gem_create {
         uint32_t        flags;
 };
 
+#define RADEON_TILING_MACRO 0x1
+#define RADEON_TILING_MICRO 0x2
+#define RADEON_TILING_SWAP  0x4
+#define RADEON_TILING_SURFACE  0x8 /* this object requires a surface
+                                    * when mapped - i.e. front buffer */
+
+struct drm_radeon_gem_set_tiling {
+        uint32_t        handle;
+        uint32_t        tiling_flags;
+        uint32_t        pitch;
+};
+
+struct drm_radeon_gem_get_tiling {
+        uint32_t        handle;
+        uint32_t        tiling_flags;
+        uint32_t        pitch;
+};
+
 struct drm_radeon_gem_mmap {
         uint32_t        handle;
         uint32_t        pad;
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 62ed733c52a2..a68829db381a 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -121,6 +121,7 @@ struct ttm_backend {
 #define TTM_PAGE_FLAG_SWAPPED         (1 << 4)
 #define TTM_PAGE_FLAG_PERSISTANT_SWAP (1 << 5)
 #define TTM_PAGE_FLAG_ZERO_ALLOC      (1 << 6)
+#define TTM_PAGE_FLAG_DMA32           (1 << 7)
 
 enum ttm_caching_state {
         tt_uncached,
@@ -353,6 +354,14 @@ struct ttm_bo_driver {
         int (*sync_obj_flush) (void *sync_obj, void *sync_arg);
         void (*sync_obj_unref) (void **sync_obj);
         void *(*sync_obj_ref) (void *sync_obj);
+
+        /* hook to notify driver about a driver move so it
+         * can do tiling things */
+        void (*move_notify)(struct ttm_buffer_object *bo,
+                            struct ttm_mem_reg *new_mem);
+        /* notify the driver we are taking a fault on this BO
+         * and have reserved it */
+        void (*fault_reserve_notify)(struct ttm_buffer_object *bo);
 };
 
 #define TTM_NUM_MEM_TYPES 8
@@ -429,6 +438,8 @@ struct ttm_bo_device {
          */
 
         struct delayed_work wq;
+
+        bool need_dma32;
 };
 
 /**
@@ -648,7 +659,14 @@ extern int ttm_bo_device_release(struct ttm_bo_device *bdev);
 extern int ttm_bo_device_init(struct ttm_bo_device *bdev,
                               struct ttm_mem_global *mem_glob,
                               struct ttm_bo_driver *driver,
-                              uint64_t file_page_offset);
+                              uint64_t file_page_offset, bool need_dma32);
+
+/**
+ * ttm_bo_unmap_virtual
+ *
+ * @bo: tear down the virtual mappings for this BO
+ */
+extern void ttm_bo_unmap_virtual(struct ttm_buffer_object *bo);
 
 /**
  * ttm_bo_reserve:
diff --git a/include/drm/ttm/ttm_module.h b/include/drm/ttm/ttm_module.h
index 889a4c7958ae..d1d433834e4f 100644
--- a/include/drm/ttm/ttm_module.h
+++ b/include/drm/ttm/ttm_module.h
@@ -33,7 +33,7 @@
 
 #include <linux/kernel.h>
 
-#define TTM_PFX "[TTM]"
+#define TTM_PFX "[TTM] "
 
 enum ttm_global_types {
         TTM_GLOBAL_TTM_MEM = 0,
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 03f22076381f..334a3593cdfd 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -57,6 +57,7 @@ header-y += dlmconstants.h
 header-y += dlm_device.h
 header-y += dlm_netlink.h
 header-y += dm-ioctl.h
+header-y += dm-log-userspace.h
 header-y += dn.h
 header-y += dqblk_xfs.h
 header-y += efs_fs_sb.h
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 51b4b0a5ce8c..34321cfffeab 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -113,9 +113,6 @@ void acpi_irq_stats_init(void);
 extern u32 acpi_irq_handled;
 extern u32 acpi_irq_not_handled;
 
-extern struct acpi_mcfg_allocation *pci_mmcfg_config;
-extern int pci_mmcfg_config_num;
-
 extern int sbf_port;
 extern unsigned long acpi_realmode_flags;
 
@@ -293,7 +290,10 @@ void __init acpi_s4_no_nvs(void);
                                 OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL)
 
 extern acpi_status acpi_pci_osc_control_set(acpi_handle handle, u32 flags);
+extern void acpi_early_init(void);
+
 #else   /* CONFIG_ACPI */
+static inline void acpi_early_init(void) { }
 
 static inline int early_acpi_boot_init(void)
 {
diff --git a/include/linux/aio.h b/include/linux/aio.h
index b16a957030f8..47f7d932a01d 100644
--- a/include/linux/aio.h
+++ b/include/linux/aio.h
@@ -121,9 +121,9 @@ struct kiocb {
 
         /*
          * If the aio_resfd field of the userspace iocb is not zero,
-         * this is the underlying file* to deliver event to.
+         * this is the underlying eventfd context to deliver events to.
          */
-        struct file             *ki_eventfd;
+        struct eventfd_ctx      *ki_eventfd;
 };
 
 #define is_sync_kiocb(iocb)     ((iocb)->ki_key == KIOCB_SYNC_KEY)
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 4fa2810b675e..3c7a358241a7 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -599,6 +599,8 @@ extern void		    audit_log_untrustedstring(struct audit_buffer *ab,
 extern void                 audit_log_d_path(struct audit_buffer *ab,
                                              const char *prefix,
                                              struct path *path);
+extern void                 audit_log_key(struct audit_buffer *ab,
+                                          char *key);
 extern void                 audit_log_lost(const char *message);
 extern int                  audit_update_lsm_rules(void);
 
@@ -621,6 +623,7 @@ extern int audit_enabled;
 #define audit_log_n_untrustedstring(a,n,s) do { ; } while (0)
 #define audit_log_untrustedstring(a,s) do { ; } while (0)
 #define audit_log_d_path(b, p, d) do { ; } while (0)
+#define audit_log_key(b, k) do { ; } while (0)
 #define audit_enabled 0
 #endif
 #endif
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index 0ec2c594868e..1d52425a6118 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -229,9 +229,14 @@ static inline int bdi_rw_congested(struct backing_dev_info *bdi)
                                   (1 << BDI_async_congested));
 }
 
-void clear_bdi_congested(struct backing_dev_info *bdi, int rw);
-void set_bdi_congested(struct backing_dev_info *bdi, int rw);
-long congestion_wait(int rw, long timeout);
+enum {
+        BLK_RW_ASYNC    = 0,
+        BLK_RW_SYNC     = 1,
+};
+
+void clear_bdi_congested(struct backing_dev_info *bdi, int sync);
+void set_bdi_congested(struct backing_dev_info *bdi, int sync);
+long congestion_wait(int sync, long timeout);
 
 
 static inline bool bdi_cap_writeback_dirty(struct backing_dev_info *bdi)
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 2a04eb54c0dd..2892b710771c 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -319,7 +319,6 @@ static inline int bio_has_allocated_vec(struct bio *bio)
  */
 struct bio_integrity_payload {
         struct bio              *bip_bio;       /* parent bio */
-        struct bio_vec          *bip_vec;       /* integrity data vector */
 
         sector_t                bip_sector;     /* virtual start sector */
 
@@ -328,11 +327,12 @@ struct bio_integrity_payload {
 
         unsigned int            bip_size;
 
-        unsigned short          bip_pool;       /* pool the ivec came from */
+        unsigned short          bip_slab;       /* slab the bip came from */
         unsigned short          bip_vcnt;       /* # of integrity bio_vecs */
         unsigned short          bip_idx;        /* current bip_vec index */
 
         struct work_struct      bip_work;       /* I/O completion */
+        struct bio_vec          bip_vec[0];     /* embedded bvec array */
 };
 #endif /* CONFIG_BLK_DEV_INTEGRITY */
 
@@ -430,6 +430,9 @@ struct bio_set {
         unsigned int front_pad;
 
         mempool_t *bio_pool;
+#if defined(CONFIG_BLK_DEV_INTEGRITY)
+        mempool_t *bio_integrity_pool;
+#endif
         mempool_t *bvec_pool;
 };
 
@@ -634,8 +637,9 @@ static inline struct bio *bio_list_get(struct bio_list *bl)
 
 #define bio_integrity(bio) (bio->bi_integrity != NULL)
 
+extern struct bio_integrity_payload *bio_integrity_alloc_bioset(struct bio *, gfp_t, unsigned int, struct bio_set *);
 extern struct bio_integrity_payload *bio_integrity_alloc(struct bio *, gfp_t, unsigned int);
-extern void bio_integrity_free(struct bio *);
+extern void bio_integrity_free(struct bio *, struct bio_set *);
 extern int bio_integrity_add_page(struct bio *, struct page *, unsigned int, unsigned int);
 extern int bio_integrity_enabled(struct bio *bio);
 extern int bio_integrity_set_tag(struct bio *, void *, unsigned int);
@@ -645,21 +649,27 @@ extern void bio_integrity_endio(struct bio *, int);
 extern void bio_integrity_advance(struct bio *, unsigned int);
 extern void bio_integrity_trim(struct bio *, unsigned int, unsigned int);
 extern void bio_integrity_split(struct bio *, struct bio_pair *, int);
-extern int bio_integrity_clone(struct bio *, struct bio *, gfp_t);
+extern int bio_integrity_clone(struct bio *, struct bio *, gfp_t, struct bio_set *);
+extern int bioset_integrity_create(struct bio_set *, int);
+extern void bioset_integrity_free(struct bio_set *);
+extern void bio_integrity_init(void);
 
 #else /* CONFIG_BLK_DEV_INTEGRITY */
 
 #define bio_integrity(a)                (0)
+#define bioset_integrity_create(a, b)   (0)
 #define bio_integrity_prep(a)           (0)
 #define bio_integrity_enabled(a)        (0)
-#define bio_integrity_clone(a, b, c)    (0)
-#define bio_integrity_free(a)           do { } while (0)
+#define bio_integrity_clone(a, b, c, d) (0)
+#define bioset_integrity_free(a)        do { } while (0)
+#define bio_integrity_free(a, b)        do { } while (0)
 #define bio_integrity_endio(a, b)       do { } while (0)
 #define bio_integrity_advance(a, b)     do { } while (0)
 #define bio_integrity_trim(a, b, c)     do { } while (0)
 #define bio_integrity_split(a, b, c)    do { } while (0)
 #define bio_integrity_set_tag(a, b, c)  do { } while (0)
 #define bio_integrity_get_tag(a, b, c)  do { } while (0)
+#define bio_integrity_init(a)           do { } while (0)
 
 #endif /* CONFIG_BLK_DEV_INTEGRITY */
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 8963d9149b5f..69103e053c92 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -70,11 +70,6 @@ enum rq_cmd_type_bits {
         REQ_TYPE_ATA_PC,
 };
 
-enum {
-        BLK_RW_ASYNC    = 0,
-        BLK_RW_SYNC     = 1,
-};
-
 /*
  * For request of type REQ_TYPE_LINUX_BLOCK, rq->cmd[0] is the opcode being
  * sent down (similar to how REQ_TYPE_BLOCK_PC means that ->cmd[] holds a
@@ -301,12 +296,6 @@ struct blk_queue_tag {
 #define BLK_SCSI_MAX_CMDS       (256)
 #define BLK_SCSI_CMD_PER_LONG   (BLK_SCSI_MAX_CMDS / (sizeof(long) * 8))
 
-struct blk_cmd_filter {
-        unsigned long read_ok[BLK_SCSI_CMD_PER_LONG];
-        unsigned long write_ok[BLK_SCSI_CMD_PER_LONG];
-        struct kobject kobj;
-};
-
 struct queue_limits {
         unsigned long           bounce_pfn;
         unsigned long           seg_boundary_mask;
@@ -445,7 +434,6 @@ struct request_queue
 #if defined(CONFIG_BLK_DEV_BSG)
         struct bsg_class_device bsg_dev;
 #endif
-        struct blk_cmd_filter cmd_filter;
 };
 
 #define QUEUE_FLAG_CLUSTER      0       /* cluster several segments into 1 */
@@ -730,6 +718,7 @@ struct rq_map_data {
         int nr_entries;
         unsigned long offset;
         int null_mapped;
+        int from_user;
 };
 
 struct req_iterator {
@@ -786,18 +775,18 @@ extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
  * congested queues, and wake up anyone who was waiting for requests to be
  * put back.
  */
-static inline void blk_clear_queue_congested(struct request_queue *q, int rw)
+static inline void blk_clear_queue_congested(struct request_queue *q, int sync)
 {
-        clear_bdi_congested(&q->backing_dev_info, rw);
+        clear_bdi_congested(&q->backing_dev_info, sync);
 }
 
 /*
  * A queue has just entered congestion.  Flag that in the queue's VM-visible
  * state flags and increment the global gounter of congested queues.
  */
-static inline void blk_set_queue_congested(struct request_queue *q, int rw)
+static inline void blk_set_queue_congested(struct request_queue *q, int sync)
 {
-        set_bdi_congested(&q->backing_dev_info, rw);
+        set_bdi_congested(&q->backing_dev_info, sync);
 }
 
 extern void blk_start_queue(struct request_queue *q);
@@ -924,6 +913,7 @@ extern void blk_queue_logical_block_size(struct request_queue *, unsigned short)
 extern void blk_queue_physical_block_size(struct request_queue *, unsigned short);
 extern void blk_queue_alignment_offset(struct request_queue *q,
                                        unsigned int alignment);
+extern void blk_limits_io_min(struct queue_limits *limits, unsigned int min);
 extern void blk_queue_io_min(struct request_queue *q, unsigned int min);
 extern void blk_queue_io_opt(struct request_queue *q, unsigned int opt);
 extern void blk_set_default_limits(struct queue_limits *lim);
@@ -998,13 +988,7 @@ static inline int sb_issue_discard(struct super_block *sb,
         return blkdev_issue_discard(sb->s_bdev, block, nr_blocks, GFP_KERNEL);
 }
 
-/*
-* command filter functions
-*/
-extern int blk_verify_command(struct blk_cmd_filter *filter,
-                              unsigned char *cmd, fmode_t has_write_perm);
-extern void blk_unregister_filter(struct gendisk *disk);
-extern void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter);
+extern int blk_verify_command(unsigned char *cmd, fmode_t has_write_perm);
 
 #define MAX_PHYS_SEGMENTS 128
 #define MAX_HW_SEGMENTS 128
diff --git a/include/linux/cb710.h b/include/linux/cb710.h
index 63bc9a4d2926..8cc10411bab2 100644
--- a/include/linux/cb710.h
+++ b/include/linux/cb710.h
@@ -140,29 +140,6 @@ void cb710_dump_regs(struct cb710_chip *chip, unsigned dump);
 #include <linux/highmem.h>
 #include <linux/scatterlist.h>
 
-/**
- * cb710_sg_miter_stop_writing - stop mapping iteration after writing
- * @miter: sg mapping iter to be stopped
- *
- * Description:
- *   Stops mapping iterator @miter.  @miter should have been started
- *   started using sg_miter_start().  A stopped iteration can be
- *   resumed by calling sg_miter_next() on it.  This is useful when
- *   resources (kmap) need to be released during iteration.
- *
- *   This is a convenience wrapper that will be optimized out for arches
- *   that don't need flush_kernel_dcache_page().
- *
- * Context:
- *   IRQ disabled if the SG_MITER_ATOMIC is set.  Don't care otherwise.
- */
-static inline void cb710_sg_miter_stop_writing(struct sg_mapping_iter *miter)
-{
-        if (miter->page)
-                flush_kernel_dcache_page(miter->page);
-        sg_miter_stop(miter);
-}
-
 /*
  * 32-bit PIO mapping sg iterator
  *
@@ -171,12 +148,12 @@ static inline void cb710_sg_miter_stop_writing(struct sg_mapping_iter *miter)
  * without DMA support).
  *
  * Best-case reading (transfer from device):
- *   sg_miter_start();
+ *   sg_miter_start(, SG_MITER_TO_SG);
  *   cb710_sg_dwiter_write_from_io();
- *   cb710_sg_miter_stop_writing();
+ *   sg_miter_stop();
  *
  * Best-case writing (transfer to device):
- *   sg_miter_start();
+ *   sg_miter_start(, SG_MITER_FROM_SG);
  *   cb710_sg_dwiter_read_to_io();
  *   sg_miter_stop();
  */
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 665fa70e4094..90bba9e62286 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -179,14 +179,11 @@ struct cgroup {
          */
         struct list_head release_list;
 
-        /* pids_mutex protects the fields below */
+        /* pids_mutex protects pids_list and cached pid arrays. */
         struct rw_semaphore pids_mutex;
-        /* Array of process ids in the cgroup */
-        pid_t *tasks_pids;
-        /* How many files are using the current tasks_pids array */
-        int pids_use_count;
-        /* Length of the current tasks_pids array */
-        int pids_length;
+
+        /* Linked list of struct cgroup_pids */
+        struct list_head pids_list;
 
         /* For RCU-protected deletion */
         struct rcu_head rcu_head;
@@ -366,6 +363,23 @@ int cgroup_task_count(const struct cgroup *cgrp);
 int cgroup_is_descendant(const struct cgroup *cgrp, struct task_struct *task);
 
 /*
+ * When the subsys has to access css and may add permanent refcnt to css,
+ * it should take care of racy conditions with rmdir(). Following set of
+ * functions, is for stop/restart rmdir if necessary.
+ * Because these will call css_get/put, "css" should be alive css.
+ *
+ *  cgroup_exclude_rmdir();
+ *  ...do some jobs which may access arbitrary empty cgroup
+ *  cgroup_release_and_wakeup_rmdir();
+ *
+ *  When someone removes a cgroup while cgroup_exclude_rmdir() holds it,
+ *  it sleeps and cgroup_release_and_wakeup_rmdir() will wake him up.
+ */
+
+void cgroup_exclude_rmdir(struct cgroup_subsys_state *css);
+void cgroup_release_and_wakeup_rmdir(struct cgroup_subsys_state *css);
+
+/*
  * Control Group subsystem type.
  * See Documentation/cgroups/cgroups.txt for details
  */
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index 20a100fe2b4f..3a1dbba4d3ae 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -143,12 +143,3 @@ extern void clockevents_notify(unsigned long reason, void *arg);
 #endif
 
 #endif
-
-#ifdef CONFIG_GENERIC_CLOCKEVENTS
-extern ktime_t clockevents_get_next_event(int cpu);
-#else
-static inline ktime_t clockevents_get_next_event(int cpu)
-{
-        return (ktime_t) { .tv64 = KTIME_MAX };
-}
-#endif
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index c56457c8334e..1219be4fb42e 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -293,7 +293,12 @@ static inline int clocksource_enable(struct clocksource *cs)
         if (cs->enable)
                 ret = cs->enable(cs);
 
-        /* save mult_orig on enable */
+        /*
+         * The frequency may have changed while the clocksource
+         * was disabled. If so the code in ->enable() must update
+         * the mult value to reflect the new frequency. Make sure
+         * mult_orig follows this change.
+         */
         cs->mult_orig = cs->mult;
 
         return ret;
@@ -309,6 +314,13 @@ static inline int clocksource_enable(struct clocksource *cs)
  */
 static inline void clocksource_disable(struct clocksource *cs)
 {
+        /*
+         * Save mult_orig in mult so clocksource_enable() can
+         * restore the value regardless if ->enable() updates
+         * the value of mult or not.
+         */
+        cs->mult = cs->mult_orig;
+
         if (cs->disable)
                 cs->disable(cs);
 }
diff --git a/include/linux/connector.h b/include/linux/connector.h
index b9966e64604e..b68d27850d51 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -41,8 +41,10 @@
 #define CN_IDX_BB                       0x5     /* BlackBoard, from the TSP GPL sampling framework */
 #define CN_DST_IDX                      0x6
 #define CN_DST_VAL                      0x1
+#define CN_IDX_DM                       0x7     /* Device Mapper */
+#define CN_VAL_DM_USERSPACE_LOG         0x1
 
-#define CN_NETLINK_USERS                7
+#define CN_NETLINK_USERS                8
 
 /*
  * Maximum connector's message size.
diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
index d71f7c0f931b..38fe59dc89ae 100644
--- a/include/linux/console_struct.h
+++ b/include/linux/console_struct.h
@@ -89,7 +89,6 @@ struct vc_data {
         unsigned int    vc_need_wrap    : 1;
         unsigned int    vc_can_do_color : 1;
         unsigned int    vc_report_mouse : 2;
-        unsigned int    vc_kmalloced    : 1;
         unsigned char   vc_utf          : 1;    /* Unicode UTF-8 encoding */
         unsigned char   vc_utf_count;
                  int    vc_utf_char;
diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
index 2dac064d8359..0026f267da20 100644
--- a/include/linux/crash_dump.h
+++ b/include/linux/crash_dump.h
@@ -3,7 +3,6 @@
 
 #ifdef CONFIG_CRASH_DUMP
 #include <linux/kexec.h>
-#include <linux/smp_lock.h>
 #include <linux/device.h>
 #include <linux/proc_fs.h>
 
diff --git a/include/linux/decompress/generic.h b/include/linux/decompress/generic.h
index 6dfb856327bb..0c7111a55a1a 100644
--- a/include/linux/decompress/generic.h
+++ b/include/linux/decompress/generic.h
@@ -1,31 +1,37 @@
 #ifndef DECOMPRESS_GENERIC_H
 #define DECOMPRESS_GENERIC_H
 
-/* Minimal chunksize to be read.
- *Bzip2 prefers at least 4096
- *Lzma prefers 0x10000 */
-#define COMPR_IOBUF_SIZE        4096
-
 typedef int (*decompress_fn) (unsigned char *inbuf, int len,
                               int(*fill)(void*, unsigned int),
-                              int(*writebb)(void*, unsigned int),
-                              unsigned char *output,
+                              int(*flush)(void*, unsigned int),
+                              unsigned char *outbuf,
                               int *posp,
                               void(*error)(char *x));
 
 /* inbuf   - input buffer
  *len     - len of pre-read data in inbuf
- *fill    - function to fill inbuf if empty
- *writebb - function to write out outbug
+ *fill    - function to fill inbuf when empty
+ *flush   - function to write out outbuf
+ *outbuf  - output buffer
  *posp    - if non-null, input position (number of bytes read) will be
  *        returned here
  *
- *If len != 0, the inbuf is initialized (with as much data), and fill
- *should not be called
- *If len = 0, the inbuf is allocated, but empty. Its size is IOBUF_SIZE
- *fill should be called (repeatedly...) to read data, at most IOBUF_SIZE
+ *If len != 0, inbuf should contain all the necessary input data, and fill
+ *should be NULL
+ *If len = 0, inbuf can be NULL, in which case the decompressor will allocate
+ *the input buffer.  If inbuf != NULL it must be at least XXX_IOBUF_SIZE bytes.
+ *fill will be called (repeatedly...) to read data, at most XXX_IOBUF_SIZE
+ *bytes should be read per call.  Replace XXX with the appropriate decompressor
+ *name, i.e. LZMA_IOBUF_SIZE.
+ *
+ *If flush = NULL, outbuf must be large enough to buffer all the expected
+ *output.  If flush != NULL, the output buffer will be allocated by the
+ *decompressor (outbuf = NULL), and the flush function will be called to
+ *flush the output buffer at the appropriate time (decompressor and stream
+ *dependent).
  */
 
+
 /* Utility routine to detect the decompression method */
 decompress_fn decompress_method(const unsigned char *inbuf, int len,
                                 const char **name);
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 49c2362977fd..655e7721580a 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -11,6 +11,7 @@
 #include <linux/bio.h>
 #include <linux/blkdev.h>
 
+struct dm_dev;
 struct dm_target;
 struct dm_table;
 struct mapped_device;
@@ -21,6 +22,7 @@ typedef enum { STATUSTYPE_INFO, STATUSTYPE_TABLE } status_type_t;
 union map_info {
         void *ptr;
         unsigned long long ll;
+        unsigned flush_request;
 };
 
 /*
@@ -80,6 +82,15 @@ typedef int (*dm_ioctl_fn) (struct dm_target *ti, unsigned int cmd,
 typedef int (*dm_merge_fn) (struct dm_target *ti, struct bvec_merge_data *bvm,
                             struct bio_vec *biovec, int max_size);
 
+typedef int (*iterate_devices_callout_fn) (struct dm_target *ti,
+                                           struct dm_dev *dev,
+                                           sector_t start, sector_t len,
+                                           void *data);
+
+typedef int (*dm_iterate_devices_fn) (struct dm_target *ti,
+                                      iterate_devices_callout_fn fn,
+                                      void *data);
+
 /*
  * Returns:
  *    0: The target can handle the next I/O immediately.
@@ -92,7 +103,8 @@ void dm_error(const char *message);
 /*
  * Combine device limits.
  */
-void dm_set_device_limits(struct dm_target *ti, struct block_device *bdev);
+int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
+                         sector_t start, sector_t len, void *data);
 
 struct dm_dev {
         struct block_device *bdev;
@@ -138,23 +150,12 @@ struct target_type {
         dm_ioctl_fn ioctl;
         dm_merge_fn merge;
         dm_busy_fn busy;
+        dm_iterate_devices_fn iterate_devices;
 
         /* For internal device-mapper use. */
         struct list_head list;
 };
 
-struct io_restrictions {
-        unsigned long bounce_pfn;
-        unsigned long seg_boundary_mask;
-        unsigned max_hw_sectors;
-        unsigned max_sectors;
-        unsigned max_segment_size;
-        unsigned short logical_block_size;
-        unsigned short max_hw_segments;
-        unsigned short max_phys_segments;
-        unsigned char no_cluster; /* inverted so that 0 is default */
-};
-
 struct dm_target {
         struct dm_table *table;
         struct target_type *type;
@@ -163,15 +164,18 @@ struct dm_target {
         sector_t begin;
         sector_t len;
 
-        /* FIXME: turn this into a mask, and merge with io_restrictions */
         /* Always a power of 2 */
         sector_t split_io;
 
         /*
-         * These are automatically filled in by
-         * dm_table_get_device.
+         * A number of zero-length barrier requests that will be submitted
+         * to the target for the purpose of flushing cache.
+         *
+         * The request number will be placed in union map_info->flush_request.
+         * It is a responsibility of the target driver to remap these requests
+         * to the real underlying devices.
          */
-        struct io_restrictions limits;
+        unsigned num_flush_requests;
 
         /* target specific data */
         void *private;
@@ -230,6 +234,7 @@ struct gendisk *dm_disk(struct mapped_device *md);
 int dm_suspended(struct mapped_device *md);
 int dm_noflush_suspending(struct dm_target *ti);
 union map_info *dm_get_mapinfo(struct bio *bio);
+union map_info *dm_get_rq_mapinfo(struct request *rq);
 
 /*
  * Geometry functions.
@@ -392,4 +397,12 @@ static inline unsigned long to_bytes(sector_t n)
         return (n << SECTOR_SHIFT);
 }
 
+/*-----------------------------------------------------------------
+ * Helper for block layer and dm core operations
+ *---------------------------------------------------------------*/
+void dm_dispatch_request(struct request *rq);
+void dm_requeue_unmapped_request(struct request *rq);
+void dm_kill_unmapped_request(struct request *rq, int error);
+int dm_underlying_device_busy(struct request_queue *q);
+
 #endif  /* _LINUX_DEVICE_MAPPER_H */
diff --git a/include/linux/device.h b/include/linux/device.h
index ed4e39f2c423..aebb81036db2 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -25,8 +25,6 @@
 #include <asm/atomic.h>
 #include <asm/device.h>
 
-#define BUS_ID_SIZE             20
-
 struct device;
 struct device_private;
 struct device_driver;
diff --git a/include/linux/dm-ioctl.h b/include/linux/dm-ioctl.h
index 48e44ee2b466..2ab84c83c31a 100644
--- a/include/linux/dm-ioctl.h
+++ b/include/linux/dm-ioctl.h
@@ -123,6 +123,16 @@ struct dm_ioctl {
         __u32 target_count;     /* in/out */
         __s32 open_count;       /* out */
         __u32 flags;            /* in/out */
+
+        /*
+         * event_nr holds either the event number (input and output) or the
+         * udev cookie value (input only).
+         * The DM_DEV_WAIT ioctl takes an event number as input.
+         * The DM_SUSPEND, DM_DEV_REMOVE and DM_DEV_RENAME ioctls
+         * use the field as a cookie to return in the DM_COOKIE
+         * variable with the uevents they issue.
+         * For output, the ioctls return the event number, not the cookie.
+         */
         __u32 event_nr;         /* in/out */
         __u32 padding;
 
@@ -256,9 +266,9 @@ enum {
 #define DM_DEV_SET_GEOMETRY     _IOWR(DM_IOCTL, DM_DEV_SET_GEOMETRY_CMD, struct dm_ioctl)
 
 #define DM_VERSION_MAJOR        4
-#define DM_VERSION_MINOR        14
+#define DM_VERSION_MINOR        15
 #define DM_VERSION_PATCHLEVEL   0
-#define DM_VERSION_EXTRA        "-ioctl (2008-04-23)"
+#define DM_VERSION_EXTRA        "-ioctl (2009-04-01)"
 
 /* Status bits */
 #define DM_READONLY_FLAG        (1 << 0) /* In/Out */
diff --git a/include/linux/dm-log-userspace.h b/include/linux/dm-log-userspace.h
new file mode 100644
index 000000000000..642e3017b51f
--- /dev/null
+++ b/include/linux/dm-log-userspace.h
@@ -0,0 +1,386 @@
+/*
+ * Copyright (C) 2006-2009 Red Hat, Inc.
+ *
+ * This file is released under the LGPL.
+ */
+
+#ifndef __DM_LOG_USERSPACE_H__
+#define __DM_LOG_USERSPACE_H__
+
+#include <linux/dm-ioctl.h> /* For DM_UUID_LEN */
+
+/*
+ * The device-mapper userspace log module consists of a kernel component and
+ * a user-space component.  The kernel component implements the API defined
+ * in dm-dirty-log.h.  Its purpose is simply to pass the parameters and
+ * return values of those API functions between kernel and user-space.
+ *
+ * Below are defined the 'request_types' - DM_ULOG_CTR, DM_ULOG_DTR, etc.
+ * These request types represent the different functions in the device-mapper
+ * dirty log API.  Each of these is described in more detail below.
+ *
+ * The user-space program must listen for requests from the kernel (representing
+ * the various API functions) and process them.
+ *
+ * User-space begins by setting up the communication link (error checking
+ * removed for clarity):
+ *      fd = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR);
+ *      addr.nl_family = AF_NETLINK;
+ *      addr.nl_groups = CN_IDX_DM;
+ *      addr.nl_pid = 0;
+ *      r = bind(fd, (struct sockaddr *) &addr, sizeof(addr));
+ *      opt = addr.nl_groups;
+ *      setsockopt(fd, SOL_NETLINK, NETLINK_ADD_MEMBERSHIP, &opt, sizeof(opt));
+ *
+ * User-space will then wait to receive requests form the kernel, which it
+ * will process as described below.  The requests are received in the form,
+ * ((struct dm_ulog_request) + (additional data)).  Depending on the request
+ * type, there may or may not be 'additional data'.  In the descriptions below,
+ * you will see 'Payload-to-userspace' and 'Payload-to-kernel'.  The
+ * 'Payload-to-userspace' is what the kernel sends in 'additional data' as
+ * necessary parameters to complete the request.  The 'Payload-to-kernel' is
+ * the 'additional data' returned to the kernel that contains the necessary
+ * results of the request.  The 'data_size' field in the dm_ulog_request
+ * structure denotes the availability and amount of payload data.
+ */
+
+/*
+ * DM_ULOG_CTR corresponds to (found in dm-dirty-log.h):
+ * int (*ctr)(struct dm_dirty_log *log, struct dm_target *ti,
+ *            unsigned argc, char **argv);
+ *
+ * Payload-to-userspace:
+ *      A single string containing all the argv arguments separated by ' 's
+ * Payload-to-kernel:
+ *      None.  ('data_size' in the dm_ulog_request struct should be 0.)
+ *
+ * The UUID contained in the dm_ulog_request structure is the reference that
+ * will be used by all request types to a specific log.  The constructor must
+ * record this assotiation with instance created.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_CTR                    1
+
+/*
+ * DM_ULOG_DTR corresponds to (found in dm-dirty-log.h):
+ * void (*dtr)(struct dm_dirty_log *log);
+ *
+ * Payload-to-userspace:
+ *      A single string containing all the argv arguments separated by ' 's
+ * Payload-to-kernel:
+ *      None.  ('data_size' in the dm_ulog_request struct should be 0.)
+ *
+ * The UUID contained in the dm_ulog_request structure is all that is
+ * necessary to identify the log instance being destroyed.  There is no
+ * payload data.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and clearing
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_DTR                    2
+
+/*
+ * DM_ULOG_PRESUSPEND corresponds to (found in dm-dirty-log.h):
+ * int (*presuspend)(struct dm_dirty_log *log);
+ *
+ * Payload-to-userspace:
+ *      None.
+ * Payload-to-kernel:
+ *      None.
+ *
+ * The UUID contained in the dm_ulog_request structure is all that is
+ * necessary to identify the log instance being presuspended.  There is no
+ * payload data.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_PRESUSPEND             3
+
+/*
+ * DM_ULOG_POSTSUSPEND corresponds to (found in dm-dirty-log.h):
+ * int (*postsuspend)(struct dm_dirty_log *log);
+ *
+ * Payload-to-userspace:
+ *      None.
+ * Payload-to-kernel:
+ *      None.
+ *
+ * The UUID contained in the dm_ulog_request structure is all that is
+ * necessary to identify the log instance being postsuspended.  There is no
+ * payload data.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_POSTSUSPEND            4
+
+/*
+ * DM_ULOG_RESUME corresponds to (found in dm-dirty-log.h):
+ * int (*resume)(struct dm_dirty_log *log);
+ *
+ * Payload-to-userspace:
+ *      None.
+ * Payload-to-kernel:
+ *      None.
+ *
+ * The UUID contained in the dm_ulog_request structure is all that is
+ * necessary to identify the log instance being resumed.  There is no
+ * payload data.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_RESUME                 5
+
+/*
+ * DM_ULOG_GET_REGION_SIZE corresponds to (found in dm-dirty-log.h):
+ * uint32_t (*get_region_size)(struct dm_dirty_log *log);
+ *
+ * Payload-to-userspace:
+ *      None.
+ * Payload-to-kernel:
+ *      uint64_t - contains the region size
+ *
+ * The region size is something that was determined at constructor time.
+ * It is returned in the payload area and 'data_size' is set to
+ * reflect this.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field appropriately.
+ */
+#define DM_ULOG_GET_REGION_SIZE        6
+
+/*
+ * DM_ULOG_IS_CLEAN corresponds to (found in dm-dirty-log.h):
+ * int (*is_clean)(struct dm_dirty_log *log, region_t region);
+ *
+ * Payload-to-userspace:
+ *      uint64_t - the region to get clean status on
+ * Payload-to-kernel:
+ *      int64_t  - 1 if clean, 0 otherwise
+ *
+ * Payload is sizeof(uint64_t) and contains the region for which the clean
+ * status is being made.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - filling the payload with 0 (not clean) or
+ * 1 (clean), setting 'data_size' and 'error' appropriately.
+ */
+#define DM_ULOG_IS_CLEAN               7
+
+/*
+ * DM_ULOG_IN_SYNC corresponds to (found in dm-dirty-log.h):
+ * int (*in_sync)(struct dm_dirty_log *log, region_t region,
+ *                int can_block);
+ *
+ * Payload-to-userspace:
+ *      uint64_t - the region to get sync status on
+ * Payload-to-kernel:
+ *      int64_t - 1 if in-sync, 0 otherwise
+ *
+ * Exactly the same as 'is_clean' above, except this time asking "has the
+ * region been recovered?" vs. "is the region not being modified?"
+ */
+#define DM_ULOG_IN_SYNC                8
+
+/*
+ * DM_ULOG_FLUSH corresponds to (found in dm-dirty-log.h):
+ * int (*flush)(struct dm_dirty_log *log);
+ *
+ * Payload-to-userspace:
+ *      None.
+ * Payload-to-kernel:
+ *      None.
+ *
+ * No incoming or outgoing payload.  Simply flush log state to disk.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and clearing
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_FLUSH                  9
+
+/*
+ * DM_ULOG_MARK_REGION corresponds to (found in dm-dirty-log.h):
+ * void (*mark_region)(struct dm_dirty_log *log, region_t region);
+ *
+ * Payload-to-userspace:
+ *      uint64_t [] - region(s) to mark
+ * Payload-to-kernel:
+ *      None.
+ *
+ * Incoming payload contains the one or more regions to mark dirty.
+ * The number of regions contained in the payload can be determined from
+ * 'data_size/sizeof(uint64_t)'.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and clearing
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_MARK_REGION           10
+
+/*
+ * DM_ULOG_CLEAR_REGION corresponds to (found in dm-dirty-log.h):
+ * void (*clear_region)(struct dm_dirty_log *log, region_t region);
+ *
+ * Payload-to-userspace:
+ *      uint64_t [] - region(s) to clear
+ * Payload-to-kernel:
+ *      None.
+ *
+ * Incoming payload contains the one or more regions to mark clean.
+ * The number of regions contained in the payload can be determined from
+ * 'data_size/sizeof(uint64_t)'.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and clearing
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_CLEAR_REGION          11
+
+/*
+ * DM_ULOG_GET_RESYNC_WORK corresponds to (found in dm-dirty-log.h):
+ * int (*get_resync_work)(struct dm_dirty_log *log, region_t *region);
+ *
+ * Payload-to-userspace:
+ *      None.
+ * Payload-to-kernel:
+ *      {
+ *              int64_t i; -- 1 if recovery necessary, 0 otherwise
+ *              uint64_t r; -- The region to recover if i=1
+ *      }
+ * 'data_size' should be set appropriately.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field appropriately.
+ */
+#define DM_ULOG_GET_RESYNC_WORK       12
+
+/*
+ * DM_ULOG_SET_REGION_SYNC corresponds to (found in dm-dirty-log.h):
+ * void (*set_region_sync)(struct dm_dirty_log *log,
+ *                         region_t region, int in_sync);
+ *
+ * Payload-to-userspace:
+ *      {
+ *              uint64_t - region to set sync state on
+ *              int64_t  - 0 if not-in-sync, 1 if in-sync
+ *      }
+ * Payload-to-kernel:
+ *      None.
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and clearing
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_SET_REGION_SYNC       13
+
+/*
+ * DM_ULOG_GET_SYNC_COUNT corresponds to (found in dm-dirty-log.h):
+ * region_t (*get_sync_count)(struct dm_dirty_log *log);
+ *
+ * Payload-to-userspace:
+ *      None.
+ * Payload-to-kernel:
+ *      uint64_t - the number of in-sync regions
+ *
+ * No incoming payload.  Kernel-bound payload contains the number of
+ * regions that are in-sync (in a size_t).
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_GET_SYNC_COUNT        14
+
+/*
+ * DM_ULOG_STATUS_INFO corresponds to (found in dm-dirty-log.h):
+ * int (*status)(struct dm_dirty_log *log, STATUSTYPE_INFO,
+ *               char *result, unsigned maxlen);
+ *
+ * Payload-to-userspace:
+ *      None.
+ * Payload-to-kernel:
+ *      Character string containing STATUSTYPE_INFO
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_STATUS_INFO           15
+
+/*
+ * DM_ULOG_STATUS_TABLE corresponds to (found in dm-dirty-log.h):
+ * int (*status)(struct dm_dirty_log *log, STATUSTYPE_TABLE,
+ *               char *result, unsigned maxlen);
+ *
+ * Payload-to-userspace:
+ *      None.
+ * Payload-to-kernel:
+ *      Character string containing STATUSTYPE_TABLE
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_STATUS_TABLE          16
+
+/*
+ * DM_ULOG_IS_REMOTE_RECOVERING corresponds to (found in dm-dirty-log.h):
+ * int (*is_remote_recovering)(struct dm_dirty_log *log, region_t region);
+ *
+ * Payload-to-userspace:
+ *      uint64_t - region to determine recovery status on
+ * Payload-to-kernel:
+ *      {
+ *              int64_t is_recovering;  -- 0 if no, 1 if yes
+ *              uint64_t in_sync_hint;  -- lowest region still needing resync
+ *      }
+ *
+ * When the request has been processed, user-space must return the
+ * dm_ulog_request to the kernel - setting the 'error' field and
+ * 'data_size' appropriately.
+ */
+#define DM_ULOG_IS_REMOTE_RECOVERING  17
+
+/*
+ * (DM_ULOG_REQUEST_MASK & request_type) to get the request type
+ *
+ * Payload-to-userspace:
+ *      A single string containing all the argv arguments separated by ' 's
+ * Payload-to-kernel:
+ *      None.  ('data_size' in the dm_ulog_request struct should be 0.)
+ *
+ * We are reserving 8 bits of the 32-bit 'request_type' field for the
+ * various request types above.  The remaining 24-bits are currently
+ * set to zero and are reserved for future use and compatibility concerns.
+ *
+ * User-space should always use DM_ULOG_REQUEST_TYPE to aquire the
+ * request type from the 'request_type' field to maintain forward compatibility.
+ */
+#define DM_ULOG_REQUEST_MASK 0xFF
+#define DM_ULOG_REQUEST_TYPE(request_type) \
+        (DM_ULOG_REQUEST_MASK & (request_type))
+
+struct dm_ulog_request {
+        char uuid[DM_UUID_LEN]; /* Ties a request to a specific mirror log */
+        char padding[7];        /* Padding because DM_UUID_LEN = 129 */
+
+        int32_t error;          /* Used to report back processing errors */
+
+        uint32_t seq;           /* Sequence number for request */
+        uint32_t request_type;  /* DM_ULOG_* defined above */
+        uint32_t data_size;     /* How much data (not including this struct) */
+
+        char data[0];
+};
+
+#endif /* __DM_LOG_USERSPACE_H__ */
diff --git a/include/linux/dmar.h b/include/linux/dmar.h
index 1731fb5fd775..4a2b162c256a 100644
--- a/include/linux/dmar.h
+++ b/include/linux/dmar.h
@@ -126,6 +126,8 @@ extern int free_irte(int irq);
 extern int irq_remapped(int irq);
 extern struct intel_iommu *map_dev_to_ir(struct pci_dev *dev);
 extern struct intel_iommu *map_ioapic_to_ir(int apic);
+extern int set_ioapic_sid(struct irte *irte, int apic);
+extern int set_msi_sid(struct irte *irte, struct pci_dev *dev);
 #else
 static inline int alloc_irte(struct intel_iommu *iommu, int irq, u16 count)
 {
@@ -156,6 +158,15 @@ static inline struct intel_iommu *map_ioapic_to_ir(int apic)
 {
         return NULL;
 }
+static inline int set_ioapic_sid(struct irte *irte, int apic)
+{
+        return 0;
+}
+static inline int set_msi_sid(struct irte *irte, struct pci_dev *dev)
+{
+        return 0;
+}
+
 #define irq_remapped(irq)               (0)
 #define enable_intr_remapping(mode)     (-1)
 #define disable_intr_remapping()        (0)
diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
index 7605c5e9589f..00d6a68d0421 100644
--- a/include/linux/elfcore.h
+++ b/include/linux/elfcore.h
@@ -122,9 +122,10 @@ static inline void elf_core_copy_kernel_regs(elf_gregset_t *elfregs, struct pt_r
 
 static inline int elf_core_copy_task_regs(struct task_struct *t, elf_gregset_t* elfregs)
 {
-#ifdef ELF_CORE_COPY_TASK_REGS
-        
+#if defined (ELF_CORE_COPY_TASK_REGS)
         return ELF_CORE_COPY_TASK_REGS(t, elfregs);
+#elif defined (task_pt_regs)
+        elf_core_copy_regs(elfregs, task_pt_regs(t));
 #endif
         return 0;
 }
diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
index f45a8ae5f828..3b85ba6479f4 100644
--- a/include/linux/eventfd.h
+++ b/include/linux/eventfd.h
@@ -8,10 +8,8 @@
 #ifndef _LINUX_EVENTFD_H
 #define _LINUX_EVENTFD_H
 
-#ifdef CONFIG_EVENTFD
-
-/* For O_CLOEXEC and O_NONBLOCK */
 #include <linux/fcntl.h>
+#include <linux/file.h>
 
 /*
  * CAREFUL: Check include/asm-generic/fcntl.h when defining
@@ -27,16 +25,37 @@
 #define EFD_SHARED_FCNTL_FLAGS (O_CLOEXEC | O_NONBLOCK)
 #define EFD_FLAGS_SET (EFD_SHARED_FCNTL_FLAGS | EFD_SEMAPHORE)
 
+#ifdef CONFIG_EVENTFD
+
+struct eventfd_ctx *eventfd_ctx_get(struct eventfd_ctx *ctx);
+void eventfd_ctx_put(struct eventfd_ctx *ctx);
 struct file *eventfd_fget(int fd);
-int eventfd_signal(struct file *file, int n);
+struct eventfd_ctx *eventfd_ctx_fdget(int fd);
+struct eventfd_ctx *eventfd_ctx_fileget(struct file *file);
+int eventfd_signal(struct eventfd_ctx *ctx, int n);
 
 #else /* CONFIG_EVENTFD */
 
-#define eventfd_fget(fd) ERR_PTR(-ENOSYS)
-static inline int eventfd_signal(struct file *file, int n)
-{ return 0; }
+/*
+ * Ugly ugly ugly error layer to support modules that uses eventfd but
+ * pretend to work in !CONFIG_EVENTFD configurations. Namely, AIO.
+ */
+static inline struct eventfd_ctx *eventfd_ctx_fdget(int fd)
+{
+        return ERR_PTR(-ENOSYS);
+}
+
+static inline int eventfd_signal(struct eventfd_ctx *ctx, int n)
+{
+        return -ENOSYS;
+}
+
+static inline void eventfd_ctx_put(struct eventfd_ctx *ctx)
+{
+
+}
 
-#endif /* CONFIG_EVENTFD */
+#endif
 
 #endif /* _LINUX_EVENTFD_H */
 
diff --git a/include/linux/ext3_fs.h b/include/linux/ext3_fs.h
index 634a5e5aba3e..7499b3667798 100644
--- a/include/linux/ext3_fs.h
+++ b/include/linux/ext3_fs.h
@@ -874,7 +874,7 @@ struct buffer_head * ext3_getblk (handle_t *, struct inode *, long, int, int *);
 struct buffer_head * ext3_bread (handle_t *, struct inode *, int, int, int *);
 int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
         sector_t iblock, unsigned long maxblocks, struct buffer_head *bh_result,
-        int create, int extend_disksize);
+        int create);
 
 extern struct inode *ext3_iget(struct super_block *, unsigned long);
 extern int  ext3_write_inode (struct inode *, int);
diff --git a/include/linux/ext3_fs_i.h b/include/linux/ext3_fs_i.h
index 7894dd0f3b77..ca1bfe90004f 100644
--- a/include/linux/ext3_fs_i.h
+++ b/include/linux/ext3_fs_i.h
@@ -103,10 +103,6 @@ struct ext3_inode_info {
          */
         struct rw_semaphore xattr_sem;
 #endif
-#ifdef CONFIG_EXT3_FS_POSIX_ACL
-        struct posix_acl        *i_acl;
-        struct posix_acl        *i_default_acl;
-#endif
 
         struct list_head i_orphan;      /* unlinked but open inodes */
 
diff --git a/include/linux/falloc.h b/include/linux/falloc.h
index 8e912ab6a072..3c155107d61f 100644
--- a/include/linux/falloc.h
+++ b/include/linux/falloc.h
@@ -3,4 +3,25 @@
 
 #define FALLOC_FL_KEEP_SIZE     0x01 /* default is extend size */
 
+#ifdef __KERNEL__
+
+/*
+ * Space reservation ioctls and argument structure
+ * are designed to be compatible with the legacy XFS ioctls.
+ */
+struct space_resv {
+        __s16           l_type;
+        __s16           l_whence;
+        __s64           l_start;
+        __s64           l_len;          /* len == 0 means until end of file */
+        __s32           l_sysid;
+        __u32           l_pid;
+        __s32           l_pad[4];       /* reserved area */
+};
+
+#define FS_IOC_RESVSP           _IOW('X', 40, struct space_resv)
+#define FS_IOC_RESVSP64         _IOW('X', 42, struct space_resv)
+
+#endif /* __KERNEL__ */
+
 #endif /* _FALLOC_H_ */
diff --git a/include/linux/fb.h b/include/linux/fb.h
index dd68358996b7..f847df9e99b6 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -819,6 +819,7 @@ struct fb_info {
         int node;
         int flags;
         struct mutex lock;              /* Lock for open/release/ioctl funcs */
+        struct mutex mm_lock;           /* Lock for fb_mmap and smem_* fields */
         struct fb_var_screeninfo var;   /* Current var */
         struct fb_fix_screeninfo fix;   /* Current fix */
         struct fb_monspecs monspecs;    /* Current Monitor specs */
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index 9823946adbc5..192d1e43c43c 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -127,6 +127,7 @@ struct fw_card {
         struct delayed_work work;
         int bm_retries;
         int bm_generation;
+        __be32 bm_transaction_data[2];
 
         bool broadcast_channel_allocated;
         u32 broadcast_channel;
diff --git a/include/linux/flex_array.h b/include/linux/flex_array.h
new file mode 100644
index 000000000000..23c1ec79a31b
--- /dev/null
+++ b/include/linux/flex_array.h
@@ -0,0 +1,47 @@
+#ifndef _FLEX_ARRAY_H
+#define _FLEX_ARRAY_H
+
+#include <linux/types.h>
+#include <asm/page.h>
+
+#define FLEX_ARRAY_PART_SIZE PAGE_SIZE
+#define FLEX_ARRAY_BASE_SIZE PAGE_SIZE
+
+struct flex_array_part;
+
+/*
+ * This is meant to replace cases where an array-like
+ * structure has gotten too big to fit into kmalloc()
+ * and the developer is getting tempted to use
+ * vmalloc().
+ */
+
+struct flex_array {
+        union {
+                struct {
+                        int element_size;
+                        int total_nr_elements;
+                        struct flex_array_part *parts[0];
+                };
+                /*
+                 * This little trick makes sure that
+                 * sizeof(flex_array) == PAGE_SIZE
+                 */
+                char padding[FLEX_ARRAY_BASE_SIZE];
+        };
+};
+
+#define FLEX_ARRAY_INIT(size, total) { { {\
+        .element_size = (size),         \
+        .total_nr_elements = (total),   \
+} } }
+
+struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags);
+int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags);
+void flex_array_free(struct flex_array *fa);
+void flex_array_free_parts(struct flex_array *fa);
+int flex_array_put(struct flex_array *fa, int element_nr, void *src,
+                gfp_t flags);
+void *flex_array_get(struct flex_array *fa, int element_nr);
+
+#endif /* _FLEX_ARRAY_H */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 1ff5e4e01952..67888a9e0655 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -710,6 +710,9 @@ static inline int mapping_writably_mapped(struct address_space *mapping)
 #define i_size_ordered_init(inode) do { } while (0)
 #endif
 
+struct posix_acl;
+#define ACL_NOT_CACHED ((void *)(-1))
+
 struct inode {
         struct hlist_node       i_hash;
         struct list_head        i_list;
@@ -773,6 +776,10 @@ struct inode {
 #ifdef CONFIG_SECURITY
         void                    *i_security;
 #endif
+#ifdef CONFIG_FS_POSIX_ACL
+        struct posix_acl        *i_acl;
+        struct posix_acl        *i_default_acl;
+#endif
         void                    *i_private; /* fs or device private pointer */
 };
 
@@ -1906,6 +1913,8 @@ static inline int break_lease(struct inode *inode, unsigned int mode)
 
 extern int do_truncate(struct dentry *, loff_t start, unsigned int time_attrs,
                        struct file *filp);
+extern int do_fallocate(struct file *file, int mode, loff_t offset,
+                        loff_t len);
 extern long do_sys_open(int dfd, const char __user *filename, int flags,
                         int mode);
 extern struct file *filp_open(const char *, int, int);
@@ -1914,6 +1923,10 @@ extern struct file * dentry_open(struct dentry *, struct vfsmount *, int,
 extern int filp_close(struct file *, fl_owner_t id);
 extern char * getname(const char __user *);
 
+/* fs/ioctl.c */
+
+extern int ioctl_preallocate(struct file *filp, void __user *argp);
+
 /* fs/dcache.c */
 extern void __init vfs_caches_init_early(void);
 extern void __init vfs_caches_init(unsigned long);
@@ -1933,6 +1946,7 @@ extern void putname(const char *name);
 extern int register_blkdev(unsigned int, const char *);
 extern void unregister_blkdev(unsigned int, const char *);
 extern struct block_device *bdget(dev_t);
+extern struct block_device *bdgrab(struct block_device *bdev);
 extern void bd_set_size(struct block_device *, loff_t size);
 extern void bd_forget(struct inode *inode);
 extern void bdput(struct block_device *);
@@ -2123,7 +2137,7 @@ extern loff_t default_llseek(struct file *file, loff_t offset, int origin);
 
 extern loff_t vfs_llseek(struct file *file, loff_t offset, int origin);
 
-extern struct inode * inode_init_always(struct super_block *, struct inode *);
+extern int inode_init_always(struct super_block *, struct inode *);
 extern void inode_init_once(struct inode *);
 extern void inode_add_to_lists(struct super_block *, struct inode *);
 extern void iput(struct inode *);
@@ -2150,6 +2164,7 @@ extern void __iget(struct inode * inode);
 extern void iget_failed(struct inode *);
 extern void clear_inode(struct inode *);
 extern void destroy_inode(struct inode *);
+extern void __destroy_inode(struct inode *);
 extern struct inode *new_inode(struct super_block *);
 extern int should_remove_suid(struct dentry *);
 extern int file_remove_suid(struct file *);
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 44848aa830dc..4d6f47b51189 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -280,7 +280,7 @@ static inline void __fsnotify_update_dcache_flags(struct dentry *dentry)
         assert_spin_locked(&dentry->d_lock);
 
         parent = dentry->d_parent;
-        if (fsnotify_inode_watches_children(parent->d_inode))
+        if (parent->d_inode && fsnotify_inode_watches_children(parent->d_inode))
                 dentry->d_flags |= DCACHE_FSNOTIFY_PARENT_WATCHED;
         else
                 dentry->d_flags &= ~DCACHE_FSNOTIFY_PARENT_WATCHED;
@@ -352,7 +352,7 @@ extern void fsnotify_unmount_inodes(struct list_head *list);
 /* put here because inotify does some weird stuff when destroying watches */
 extern struct fsnotify_event *fsnotify_create_event(struct inode *to_tell, __u32 mask,
                                                     void *data, int data_is, const char *name,
-                                                    u32 cookie);
+                                                    u32 cookie, gfp_t gfp);
 
 #else
 
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 5c093ffc655b..a81170de7f6b 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -89,7 +89,9 @@ enum print_line_t {
         TRACE_TYPE_NO_CONSUME   = 3     /* Handled but ask to not consume */
 };
 
-
+void tracing_generic_entry_update(struct trace_entry *entry,
+                                  unsigned long flags,
+                                  int pc);
 struct ring_buffer_event *
 trace_current_buffer_lock_reserve(int type, unsigned long len,
                                   unsigned long flags, int pc);
@@ -119,11 +121,9 @@ struct ftrace_event_call {
         void                    *filter;
         void                    *mod;
 
-#ifdef CONFIG_EVENT_PROFILE
-        atomic_t        profile_count;
-        int             (*profile_enable)(struct ftrace_event_call *);
-        void            (*profile_disable)(struct ftrace_event_call *);
-#endif
+        atomic_t                profile_count;
+        int                     (*profile_enable)(struct ftrace_event_call *);
+        void                    (*profile_disable)(struct ftrace_event_call *);
 };
 
 #define MAX_FILTER_PRED         32
diff --git a/include/linux/fuse.h b/include/linux/fuse.h
index d41ed593f79f..cf593bf9fd32 100644
--- a/include/linux/fuse.h
+++ b/include/linux/fuse.h
@@ -25,6 +25,11 @@
  *  - add IOCTL message
  *  - add unsolicited notification support
  *  - add POLL message and NOTIFY_POLL notification
+ *
+ * 7.12
+ *  - add umask flag to input argument of open, mknod and mkdir
+ *  - add notification messages for invalidation of inodes and
+ *    directory entries
  */
 
 #ifndef _LINUX_FUSE_H
@@ -36,7 +41,7 @@
 #define FUSE_KERNEL_VERSION 7
 
 /** Minor version number of this interface */
-#define FUSE_KERNEL_MINOR_VERSION 11
+#define FUSE_KERNEL_MINOR_VERSION 12
 
 /** The node ID of the root inode */
 #define FUSE_ROOT_ID 1
@@ -112,6 +117,7 @@ struct fuse_file_lock {
  * INIT request/reply flags
  *
  * FUSE_EXPORT_SUPPORT: filesystem handles lookups of "." and ".."
+ * FUSE_DONT_MASK: don't apply umask to file mode on create operations
  */
 #define FUSE_ASYNC_READ         (1 << 0)
 #define FUSE_POSIX_LOCKS        (1 << 1)
@@ -119,6 +125,7 @@ struct fuse_file_lock {
 #define FUSE_ATOMIC_O_TRUNC     (1 << 3)
 #define FUSE_EXPORT_SUPPORT     (1 << 4)
 #define FUSE_BIG_WRITES         (1 << 5)
+#define FUSE_DONT_MASK          (1 << 6)
 
 /**
  * CUSE INIT request/reply flags
@@ -224,6 +231,8 @@ enum fuse_opcode {
 
 enum fuse_notify_code {
         FUSE_NOTIFY_POLL   = 1,
+        FUSE_NOTIFY_INVAL_INODE = 2,
+        FUSE_NOTIFY_INVAL_ENTRY = 3,
         FUSE_NOTIFY_CODE_MAX,
 };
 
@@ -262,14 +271,18 @@ struct fuse_attr_out {
         struct fuse_attr attr;
 };
 
+#define FUSE_COMPAT_MKNOD_IN_SIZE 8
+
 struct fuse_mknod_in {
         __u32   mode;
         __u32   rdev;
+        __u32   umask;
+        __u32   padding;
 };
 
 struct fuse_mkdir_in {
         __u32   mode;
-        __u32   padding;
+        __u32   umask;
 };
 
 struct fuse_rename_in {
@@ -301,7 +314,14 @@ struct fuse_setattr_in {
 
 struct fuse_open_in {
         __u32   flags;
+        __u32   unused;
+};
+
+struct fuse_create_in {
+        __u32   flags;
         __u32   mode;
+        __u32   umask;
+        __u32   padding;
 };
 
 struct fuse_open_out {
@@ -508,4 +528,16 @@ struct fuse_dirent {
 #define FUSE_DIRENT_SIZE(d) \
         FUSE_DIRENT_ALIGN(FUSE_NAME_OFFSET + (d)->namelen)
 
+struct fuse_notify_inval_inode_out {
+        __u64   ino;
+        __s64   off;
+        __s64   len;
+};
+
+struct fuse_notify_inval_entry_out {
+        __u64   parent;
+        __u32   namelen;
+        __u32   padding;
+};
+
 #endif /* _LINUX_FUSE_H */
diff --git a/include/linux/hardirq.h b/include/linux/hardirq.h
index 45257475623c..8246c697863d 100644
--- a/include/linux/hardirq.h
+++ b/include/linux/hardirq.h
@@ -2,7 +2,9 @@
 #define LINUX_HARDIRQ_H
 
 #include <linux/preempt.h>
+#ifdef CONFIG_PREEMPT
 #include <linux/smp_lock.h>
+#endif
 #include <linux/lockdep.h>
 #include <linux/ftrace_irq.h>
 #include <asm/hardirq.h>
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 7400900de94a..4759917adc71 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -21,6 +21,7 @@
 #include <linux/list.h>
 #include <linux/wait.h>
 #include <linux/percpu.h>
+#include <linux/timer.h>
 
 
 struct hrtimer_clock_base;
@@ -447,6 +448,8 @@ extern void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
 
 static inline void timer_stats_account_hrtimer(struct hrtimer *timer)
 {
+        if (likely(!timer->start_site))
+                return;
         timer_stats_update_stats(timer, timer->start_pid, timer->start_site,
                                  timer->function, timer->start_comm, 0);
 }
@@ -456,6 +459,8 @@ extern void __timer_stats_hrtimer_set_start_info(struct hrtimer *timer,
 
 static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
 {
+        if (likely(!timer_stats_active))
+                return;
         __timer_stats_hrtimer_set_start_info(timer, __builtin_return_address(0));
 }
 
diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h
index 10d701eec484..b6a85183c333 100644
--- a/include/linux/icmpv6.h
+++ b/include/linux/icmpv6.h
@@ -175,16 +175,16 @@ struct icmp6_filter {
 
 
 extern void                             icmpv6_send(struct sk_buff *skb,
-                                                    int type, int code,
+                                                    u8 type, u8 code,
                                                     __u32 info, 
                                                     struct net_device *dev);
 
 extern int                              icmpv6_init(void);
-extern int                              icmpv6_err_convert(int type, int code,
+extern int                              icmpv6_err_convert(u8 type, u8 code,
                                                            int *err);
 extern void                             icmpv6_cleanup(void);
 extern void                             icmpv6_param_prob(struct sk_buff *skb,
-                                                          int code, int pos);
+                                                          u8 code, int pos);
 
 struct flowi;
 struct in6_addr;
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 95c6e00a72e8..edc93a6d931d 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -1062,7 +1062,6 @@ int generic_ide_ioctl(ide_drive_t *, struct block_device *, unsigned, unsigned l
 extern int ide_vlb_clk;
 extern int ide_pci_clk;
 
-unsigned int ide_rq_bytes(struct request *);
 int ide_end_rq(ide_drive_t *, struct request *, int, unsigned int);
 void ide_kill_rq(ide_drive_t *, struct request *);
 
@@ -1361,7 +1360,6 @@ int ide_in_drive_list(u16 *, const struct drive_list_entry *);
 #ifdef CONFIG_BLK_DEV_IDEDMA
 int ide_dma_good_drive(ide_drive_t *);
 int __ide_dma_bad_drive(ide_drive_t *);
-int ide_id_dma_bug(ide_drive_t *);
 
 u8 ide_find_dma_mode(ide_drive_t *, u8);
 
@@ -1402,7 +1400,6 @@ void ide_dma_lost_irq(ide_drive_t *);
 ide_startstop_t ide_dma_timeout_retry(ide_drive_t *, int);
 
 #else
-static inline int ide_id_dma_bug(ide_drive_t *drive) { return 0; }
 static inline u8 ide_find_dma_mode(ide_drive_t *drive, u8 speed) { return 0; }
 static inline u8 ide_max_dma_mode(ide_drive_t *drive) { return 0; }
 static inline void ide_dma_off_quietly(ide_drive_t *drive) { ; }
@@ -1422,6 +1419,7 @@ static inline void ide_dma_unmap_sg(ide_drive_t *drive,
 
 #ifdef CONFIG_BLK_DEV_IDEACPI
 int ide_acpi_init(void);
+bool ide_port_acpi(ide_hwif_t *hwif);
 extern int ide_acpi_exec_tfs(ide_drive_t *drive);
 extern void ide_acpi_get_timing(ide_hwif_t *hwif);
 extern void ide_acpi_push_timing(ide_hwif_t *hwif);
@@ -1430,6 +1428,7 @@ void ide_acpi_port_init_devices(ide_hwif_t *);
 extern void ide_acpi_set_state(ide_hwif_t *hwif, int on);
 #else
 static inline int ide_acpi_init(void) { return 0; }
+static inline bool ide_port_acpi(ide_hwif_t *hwif) { return 0; }
 static inline int ide_acpi_exec_tfs(ide_drive_t *drive) { return 0; }
 static inline void ide_acpi_get_timing(ide_hwif_t *hwif) { ; }
 static inline void ide_acpi_push_timing(ide_hwif_t *hwif) { ; }
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index ae3a1871413d..70fdba2bbf71 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -78,6 +78,7 @@
 #define ETH_P_PAE       0x888E          /* Port Access Entity (IEEE 802.1X) */
 #define ETH_P_AOE       0x88A2          /* ATA over Ethernet            */
 #define ETH_P_TIPC      0x88CA          /* TIPC                         */
+#define ETH_P_1588      0x88F7          /* IEEE 1588 Timesync */
 #define ETH_P_FCOE      0x8906          /* Fibre Channel over Ethernet  */
 #define ETH_P_FIP       0x8914          /* FCoE Initialization Protocol */
 #define ETH_P_EDSA      0xDADA          /* Ethertype DSA [ NOT AN OFFICIALLY REGISTERED ID ] */
diff --git a/include/linux/ima.h b/include/linux/ima.h
index b1b827d091a9..0e3f2a4c25f6 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -24,6 +24,7 @@ extern int ima_path_check(struct path *path, int mask, int update_counts);
 extern void ima_file_free(struct file *file);
 extern int ima_file_mmap(struct file *file, unsigned long prot);
 extern void ima_counts_get(struct file *file);
+extern void ima_counts_put(struct path *path, int mask);
 
 #else
 static inline int ima_bprm_check(struct linux_binprm *bprm)
@@ -60,5 +61,10 @@ static inline void ima_counts_get(struct file *file)
 {
         return;
 }
+
+static inline void ima_counts_put(struct path *path, int mask)
+{
+        return;
+}
 #endif /* CONFIG_IMA_H */
 #endif /* _LINUX_IMA_H */
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index acef2a770b6b..ad27c7da8798 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -82,7 +82,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 
 #define IN_DEV_FORWARD(in_dev)          IN_DEV_CONF_GET((in_dev), FORWARDING)
 #define IN_DEV_MFORWARD(in_dev)         IN_DEV_ANDCONF((in_dev), MC_FORWARDING)
-#define IN_DEV_RPFILTER(in_dev)         IN_DEV_ANDCONF((in_dev), RP_FILTER)
+#define IN_DEV_RPFILTER(in_dev)         IN_DEV_MAXCONF((in_dev), RP_FILTER)
 #define IN_DEV_SOURCE_ROUTE(in_dev)     IN_DEV_ANDCONF((in_dev), \
                                                        ACCEPT_SOURCE_ROUTE)
 #define IN_DEV_BOOTP_RELAY(in_dev)      IN_DEV_ANDCONF((in_dev), BOOTP_RELAY)
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index 5368fbdc7801..7fc01b13be43 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -183,5 +183,8 @@ extern struct cred init_cred;
         LIST_HEAD_INIT(cpu_timers[2]),                                  \
 }
 
+/* Attach to the init_task data structure for proper alignment */
+#define __init_task_data __attribute__((__section__(".data.init_task")))
+
 
 #endif
diff --git a/include/linux/input/matrix_keypad.h b/include/linux/input/matrix_keypad.h
new file mode 100644
index 000000000000..15d5903af2dd
--- /dev/null
+++ b/include/linux/input/matrix_keypad.h
@@ -0,0 +1,66 @@
+#ifndef _MATRIX_KEYPAD_H
+#define _MATRIX_KEYPAD_H
+
+#include <linux/types.h>
+#include <linux/input.h>
+
+#define MATRIX_MAX_ROWS         16
+#define MATRIX_MAX_COLS         16
+
+#define KEY(row, col, val)      ((((row) & (MATRIX_MAX_ROWS - 1)) << 24) |\
+                                 (((col) & (MATRIX_MAX_COLS - 1)) << 16) |\
+                                 (val & 0xffff))
+
+#define KEY_ROW(k)              (((k) >> 24) & 0xff)
+#define KEY_COL(k)              (((k) >> 16) & 0xff)
+#define KEY_VAL(k)              ((k) & 0xffff)
+
+#define MATRIX_SCAN_CODE(row, col, row_shift)   (((row) << (row_shift)) + (col))
+
+/**
+ * struct matrix_keymap_data - keymap for matrix keyboards
+ * @keymap: pointer to array of uint32 values encoded with KEY() macro
+ *      representing keymap
+ * @keymap_size: number of entries (initialized) in this keymap
+ *
+ * This structure is supposed to be used by platform code to supply
+ * keymaps to drivers that implement matrix-like keypads/keyboards.
+ */
+struct matrix_keymap_data {
+        const uint32_t *keymap;
+        unsigned int    keymap_size;
+};
+
+/**
+ * struct matrix_keypad_platform_data - platform-dependent keypad data
+ * @keymap_data: pointer to &matrix_keymap_data
+ * @row_gpios: pointer to array of gpio numbers representing rows
+ * @col_gpios: pointer to array of gpio numbers reporesenting colums
+ * @num_row_gpios: actual number of row gpios used by device
+ * @num_col_gpios: actual number of col gpios used by device
+ * @col_scan_delay_us: delay, measured in microseconds, that is
+ *      needed before we can keypad after activating column gpio
+ * @debounce_ms: debounce interval in milliseconds
+ *
+ * This structure represents platform-specific data that use used by
+ * matrix_keypad driver to perform proper initialization.
+ */
+struct matrix_keypad_platform_data {
+        const struct matrix_keymap_data *keymap_data;
+
+        const unsigned int *row_gpios;
+        const unsigned int *col_gpios;
+
+        unsigned int    num_row_gpios;
+        unsigned int    num_col_gpios;
+
+        unsigned int    col_scan_delay_us;
+
+        /* key debounce interval in milli-second */
+        unsigned int    debounce_ms;
+
+        bool            active_low;
+        bool            wakeup;
+};
+
+#endif /* _MATRIX_KEYPAD_H */
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 2721f07e9354..35e7df1e9f30 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -14,6 +14,7 @@
 #include <linux/irqflags.h>
 #include <linux/smp.h>
 #include <linux/percpu.h>
+#include <linux/hrtimer.h>
 
 #include <asm/atomic.h>
 #include <asm/ptrace.h>
@@ -64,11 +65,13 @@
  * IRQTF_RUNTHREAD - signals that the interrupt handler thread should run
  * IRQTF_DIED      - handler thread died
  * IRQTF_WARNED    - warning "IRQ_WAKE_THREAD w/o thread_fn" has been printed
+ * IRQTF_AFFINITY  - irq thread is requested to adjust affinity
  */
 enum {
         IRQTF_RUNTHREAD,
         IRQTF_DIED,
         IRQTF_WARNED,
+        IRQTF_AFFINITY,
 };
 
 typedef irqreturn_t (*irq_handler_t)(int, void *);
@@ -517,6 +520,31 @@ extern void tasklet_kill_immediate(struct tasklet_struct *t, unsigned int cpu);
 extern void tasklet_init(struct tasklet_struct *t,
                          void (*func)(unsigned long), unsigned long data);
 
+struct tasklet_hrtimer {
+        struct hrtimer          timer;
+        struct tasklet_struct   tasklet;
+        enum hrtimer_restart    (*function)(struct hrtimer *);
+};
+
+extern void
+tasklet_hrtimer_init(struct tasklet_hrtimer *ttimer,
+                     enum hrtimer_restart (*function)(struct hrtimer *),
+                     clockid_t which_clock, enum hrtimer_mode mode);
+
+static inline
+int tasklet_hrtimer_start(struct tasklet_hrtimer *ttimer, ktime_t time,
+                          const enum hrtimer_mode mode)
+{
+        return hrtimer_start(&ttimer->timer, time, mode);
+}
+
+static inline
+void tasklet_hrtimer_cancel(struct tasklet_hrtimer *ttimer)
+{
+        hrtimer_cancel(&ttimer->timer);
+        tasklet_kill(&ttimer->tasklet);
+}
+
 /*
  * Autoprobing for irqs:
  *
diff --git a/include/linux/iocontext.h b/include/linux/iocontext.h
index dd05434fa45f..4da4a75c3f1e 100644
--- a/include/linux/iocontext.h
+++ b/include/linux/iocontext.h
@@ -92,7 +92,7 @@ static inline struct io_context *ioc_task_link(struct io_context *ioc)
          * a race).
          */
         if (ioc && atomic_long_inc_not_zero(&ioc->refcount)) {
-                atomic_long_inc(&ioc->refcount);
+                atomic_inc(&ioc->nr_tasks);
                 return ioc;
         }
 
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index fac104e7186a..d6320a3e8def 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -303,6 +303,7 @@ extern int oops_in_progress;		/* If set, an oops, panic(), BUG() or die() is in
 extern int panic_timeout;
 extern int panic_on_oops;
 extern int panic_on_unrecovered_nmi;
+extern int panic_on_io_nmi;
 extern const char *print_tainted(void);
 extern void add_taint(unsigned flag);
 extern int test_taint(unsigned flag);
diff --git a/include/linux/kmemleak.h b/include/linux/kmemleak.h
index 7796aed6cdd5..6a63807f714e 100644
--- a/include/linux/kmemleak.h
+++ b/include/linux/kmemleak.h
@@ -27,6 +27,7 @@ extern void kmemleak_init(void);
 extern void kmemleak_alloc(const void *ptr, size_t size, int min_count,
                            gfp_t gfp);
 extern void kmemleak_free(const void *ptr);
+extern void kmemleak_free_part(const void *ptr, size_t size);
 extern void kmemleak_padding(const void *ptr, unsigned long offset,
                              size_t size);
 extern void kmemleak_not_leak(const void *ptr);
@@ -71,6 +72,9 @@ static inline void kmemleak_alloc_recursive(const void *ptr, size_t size,
 static inline void kmemleak_free(const void *ptr)
 {
 }
+static inline void kmemleak_free_part(const void *ptr, size_t size)
+{
+}
 static inline void kmemleak_free_recursive(const void *ptr, unsigned long flags)
 {
 }
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index aacc5449f586..3060bdc35ffe 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -110,6 +110,7 @@ struct kvm_memory_slot {
 
 struct kvm_kernel_irq_routing_entry {
         u32 gsi;
+        u32 type;
         int (*set)(struct kvm_kernel_irq_routing_entry *e,
                     struct kvm *kvm, int level);
         union {
@@ -125,6 +126,7 @@ struct kvm_kernel_irq_routing_entry {
 struct kvm {
         struct mutex lock; /* protects the vcpus array and APIC accesses */
         spinlock_t mmu_lock;
+        spinlock_t requests_lock;
         struct rw_semaphore slots_lock;
         struct mm_struct *mm; /* userspace tied to this vm */
         int nmemslots;
diff --git a/include/linux/leds-lp3944.h b/include/linux/leds-lp3944.h
new file mode 100644
index 000000000000..afc9f9fd70f5
--- /dev/null
+++ b/include/linux/leds-lp3944.h
@@ -0,0 +1,53 @@
+/*
+ * leds-lp3944.h - platform data structure for lp3944 led controller
+ *
+ * Copyright (C) 2009 Antonio Ospite <ospite@studenti.unina.it>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#ifndef __LINUX_LEDS_LP3944_H
+#define __LINUX_LEDS_LP3944_H
+
+#include <linux/leds.h>
+#include <linux/workqueue.h>
+
+#define LP3944_LED0 0
+#define LP3944_LED1 1
+#define LP3944_LED2 2
+#define LP3944_LED3 3
+#define LP3944_LED4 4
+#define LP3944_LED5 5
+#define LP3944_LED6 6
+#define LP3944_LED7 7
+#define LP3944_LEDS_MAX 8
+
+#define LP3944_LED_STATUS_MASK  0x03
+enum lp3944_status {
+        LP3944_LED_STATUS_OFF  = 0x0,
+        LP3944_LED_STATUS_ON   = 0x1,
+        LP3944_LED_STATUS_DIM0 = 0x2,
+        LP3944_LED_STATUS_DIM1 = 0x3
+};
+
+enum lp3944_type {
+        LP3944_LED_TYPE_NONE,
+        LP3944_LED_TYPE_LED,
+        LP3944_LED_TYPE_LED_INVERTED,
+};
+
+struct lp3944_led {
+        char *name;
+        enum lp3944_type type;
+        enum lp3944_status status;
+};
+
+struct lp3944_platform_data {
+        struct lp3944_led leds[LP3944_LEDS_MAX];
+        u8 leds_size;
+};
+
+#endif /* __LINUX_LEDS_LP3944_H */
diff --git a/include/linux/leds.h b/include/linux/leds.h
index 376fe07732ea..d8bf9665e70c 100644
--- a/include/linux/leds.h
+++ b/include/linux/leds.h
@@ -45,7 +45,10 @@ struct led_classdev {
         /* Get LED brightness level */
         enum led_brightness (*brightness_get)(struct led_classdev *led_cdev);
 
-        /* Activate hardware accelerated blink */
+        /* Activate hardware accelerated blink, delays are in
+         * miliseconds and if none is provided then a sensible default
+         * should be chosen. The call can adjust the timings if it can't
+         * match the values specified exactly. */
         int             (*blink_set)(struct led_classdev *led_cdev,
                                      unsigned long *delay_on,
                                      unsigned long *delay_off);
@@ -141,9 +144,14 @@ struct gpio_led {
         const char *name;
         const char *default_trigger;
         unsigned        gpio;
-        u8              active_low : 1;
-        u8              retain_state_suspended : 1;
+        unsigned        active_low : 1;
+        unsigned        retain_state_suspended : 1;
+        unsigned        default_state : 2;
+        /* default_state should be one of LEDS_GPIO_DEFSTATE_(ON|OFF|KEEP) */
 };
+#define LEDS_GPIO_DEFSTATE_OFF  0
+#define LEDS_GPIO_DEFSTATE_ON   1
+#define LEDS_GPIO_DEFSTATE_KEEP 2
 
 struct gpio_led_platform_data {
         int             num_leds;
diff --git a/include/linux/lguest.h b/include/linux/lguest.h
index 7bc1440fc473..2fb1dcbcb5aa 100644
--- a/include/linux/lguest.h
+++ b/include/linux/lguest.h
@@ -1,5 +1,7 @@
-/* Things the lguest guest needs to know.  Note: like all lguest interfaces,
- * this is subject to wild and random change between versions. */
+/*
+ * Things the lguest guest needs to know.  Note: like all lguest interfaces,
+ * this is subject to wild and random change between versions.
+ */
 #ifndef _LINUX_LGUEST_H
 #define _LINUX_LGUEST_H
 
@@ -11,32 +13,41 @@
 #define LG_CLOCK_MIN_DELTA      100UL
 #define LG_CLOCK_MAX_DELTA      ULONG_MAX
 
-/*G:032 The second method of communicating with the Host is to via "struct
+/*G:031
+ * The second method of communicating with the Host is to via "struct
  * lguest_data".  Once the Guest's initialization hypercall tells the Host where
- * this is, the Guest and Host both publish information in it. :*/
-struct lguest_data
-{
-        /* 512 == enabled (same as eflags in normal hardware).  The Guest
-         * changes interrupts so often that a hypercall is too slow. */
+ * this is, the Guest and Host both publish information in it.
+:*/
+struct lguest_data {
+        /*
+         * 512 == enabled (same as eflags in normal hardware).  The Guest
+         * changes interrupts so often that a hypercall is too slow.
+         */
         unsigned int irq_enabled;
         /* Fine-grained interrupt disabling by the Guest */
         DECLARE_BITMAP(blocked_interrupts, LGUEST_IRQS);
 
-        /* The Host writes the virtual address of the last page fault here,
+        /*
+         * The Host writes the virtual address of the last page fault here,
          * which saves the Guest a hypercall.  CR2 is the native register where
-         * this address would normally be found. */
+         * this address would normally be found.
+         */
         unsigned long cr2;
 
         /* Wallclock time set by the Host. */
         struct timespec time;
 
-        /* Interrupt pending set by the Host.  The Guest should do a hypercall
-         * if it re-enables interrupts and sees this set (to X86_EFLAGS_IF). */
+        /*
+         * Interrupt pending set by the Host.  The Guest should do a hypercall
+         * if it re-enables interrupts and sees this set (to X86_EFLAGS_IF).
+         */
         int irq_pending;
 
-        /* Async hypercall ring.  Instead of directly making hypercalls, we can
+        /*
+         * Async hypercall ring.  Instead of directly making hypercalls, we can
          * place them in here for processing the next time the Host wants.
-         * This batching can be quite efficient. */
+         * This batching can be quite efficient.
+         */
 
         /* 0xFF == done (set by Host), 0 == pending (set by Guest). */
         u8 hcall_status[LHCALL_RING_SIZE];
diff --git a/include/linux/lguest_launcher.h b/include/linux/lguest_launcher.h
index bfefbdf7498a..495203ff221c 100644
--- a/include/linux/lguest_launcher.h
+++ b/include/linux/lguest_launcher.h
@@ -29,8 +29,10 @@ struct lguest_device_desc {
         __u8 type;
         /* The number of virtqueues (first in config array) */
         __u8 num_vq;
-        /* The number of bytes of feature bits.  Multiply by 2: one for host
-         * features and one for Guest acknowledgements. */
+        /*
+         * The number of bytes of feature bits.  Multiply by 2: one for host
+         * features and one for Guest acknowledgements.
+         */
         __u8 feature_len;
         /* The number of bytes of the config array after virtqueues. */
         __u8 config_len;
@@ -39,8 +41,10 @@ struct lguest_device_desc {
         __u8 config[0];
 };
 
-/*D:135 This is how we expect the device configuration field for a virtqueue
- * to be laid out in config space. */
+/*D:135
+ * This is how we expect the device configuration field for a virtqueue
+ * to be laid out in config space.
+ */
 struct lguest_vqconfig {
         /* The number of entries in the virtio_ring */
         __u16 num;
@@ -61,7 +65,9 @@ enum lguest_req
         LHREQ_EVENTFD, /* + address, fd. */
 };
 
-/* The alignment to use between consumer and producer parts of vring.
- * x86 pagesize for historical reasons. */
+/*
+ * The alignment to use between consumer and producer parts of vring.
+ * x86 pagesize for historical reasons.
+ */
 #define LGUEST_VRING_ALIGN      4096
 #endif /* _LINUX_LGUEST_LAUNCHER */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 3d501db36a26..e5b6e33c6571 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -385,6 +385,7 @@ enum {
                                                     not multiple of 16 bytes */
         ATA_HORKAGE_FIRMWARE_WARN = (1 << 12),  /* firmware update warning */
         ATA_HORKAGE_1_5_GBPS    = (1 << 13),    /* force 1.5 Gbps */
+        ATA_HORKAGE_NOSETXFER   = (1 << 14),    /* skip SETXFER, SATA only */
 
          /* DMA mask for user DMA control: User visible values; DO NOT
             renumber */
@@ -588,6 +589,7 @@ struct ata_device {
 #endif
         /* n_sector is CLEAR_BEGIN, read comment above CLEAR_BEGIN */
         u64                     n_sectors;      /* size of device, if ATA */
+        u64                     n_native_sectors; /* native size, if ATA */
         unsigned int            class;          /* ATA_DEV_xxx */
         unsigned long           unpark_deadline;
 
diff --git a/include/linux/linkage.h b/include/linux/linkage.h
index fee9e59649c1..691f59171c6c 100644
--- a/include/linux/linkage.h
+++ b/include/linux/linkage.h
@@ -22,6 +22,15 @@
 #define __page_aligned_bss      __section(.bss.page_aligned) __aligned(PAGE_SIZE)
 
 /*
+ * For assembly routines.
+ *
+ * Note when using these that you must specify the appropriate
+ * alignment directives yourself
+ */
+#define __PAGE_ALIGNED_DATA     .section ".data.page_aligned", "aw"
+#define __PAGE_ALIGNED_BSS      .section ".bss.page_aligned", "aw"
+
+/*
  * This is used by architectures to keep arguments on the stack
  * untouched by the compiler by keeping them live until the end.
  * The argument stack may be owned by the assembly-language
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index da5a5a1f4cd2..b25d1b53df0d 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -258,6 +258,16 @@ extern void lockdep_init_map(struct lockdep_map *lock, const char *name,
 #define lockdep_set_subclass(lock, sub) \
                 lockdep_init_map(&(lock)->dep_map, #lock, \
                                  (lock)->dep_map.key, sub)
+/*
+ * Compare locking classes
+ */
+#define lockdep_match_class(lock, key) lockdep_match_key(&(lock)->dep_map, key)
+
+static inline int lockdep_match_key(struct lockdep_map *lock,
+                                    struct lock_class_key *key)
+{
+        return lock->key == key;
+}
 
 /*
  * Acquire a lock.
@@ -326,6 +336,11 @@ static inline void lockdep_on(void)
 #define lockdep_set_class_and_subclass(lock, key, sub) \
                 do { (void)(key); } while (0)
 #define lockdep_set_subclass(lock, sub)         do { } while (0)
+/*
+ * We don't define lockdep_match_class() and lockdep_match_key() for !LOCKDEP
+ * case since the result is not well defined and the caller should rather
+ * #ifdef the call himself.
+ */
 
 # define INIT_LOCKDEP
 # define lockdep_reset()                do { debug_locks = 1; } while (0)
diff --git a/include/linux/max17040_battery.h b/include/linux/max17040_battery.h
new file mode 100644
index 000000000000..ad97b06cf930
--- /dev/null
+++ b/include/linux/max17040_battery.h
@@ -0,0 +1,19 @@
+/*
+ *  Copyright (C) 2009 Samsung Electronics
+ *  Minkyu Kang <mk7.kang@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __MAX17040_BATTERY_H_
+#define __MAX17040_BATTERY_H_
+
+struct max17040_platform_data {
+        int (*battery_online)(void);
+        int (*charger_online)(void);
+        int (*charger_enable)(void);
+};
+
+#endif
diff --git a/include/linux/mm.h b/include/linux/mm.h
index d006e93d5c93..ba3a7cb1eaa0 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -826,7 +826,7 @@ extern int make_pages_present(unsigned long addr, unsigned long end);
 extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write);
 
 int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
-                        unsigned long start, int len, int write, int force,
+                        unsigned long start, int nr_pages, int write, int force,
                         struct page **pages, struct vm_area_struct **vmas);
 int get_user_pages_fast(unsigned long start, int nr_pages, int write,
                         struct page **pages);
diff --git a/include/linux/mnt_namespace.h b/include/linux/mnt_namespace.h
index 3beb2592b03f..d74785c2393a 100644
--- a/include/linux/mnt_namespace.h
+++ b/include/linux/mnt_namespace.h
@@ -2,10 +2,9 @@
 #define _NAMESPACE_H_
 #ifdef __KERNEL__
 
-#include <linux/mount.h>
-#include <linux/sched.h>
-#include <linux/nsproxy.h>
+#include <linux/path.h>
 #include <linux/seq_file.h>
+#include <linux/wait.h>
 
 struct mnt_namespace {
         atomic_t                count;
@@ -28,14 +27,6 @@ extern struct mnt_namespace *create_mnt_ns(struct vfsmount *mnt);
 extern struct mnt_namespace *copy_mnt_ns(unsigned long, struct mnt_namespace *,
                 struct fs_struct *);
 extern void put_mnt_ns(struct mnt_namespace *ns);
-
-static inline void exit_mnt_ns(struct task_struct *p)
-{
-        struct mnt_namespace *ns = p->nsproxy->mnt_ns;
-        if (ns)
-                put_mnt_ns(ns);
-}
-
 static inline void get_mnt_ns(struct mnt_namespace *ns)
 {
         atomic_inc(&ns->count);
diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
index 5675b63a0631..0f32a9b6ff55 100644
--- a/include/linux/mtd/mtd.h
+++ b/include/linux/mtd/mtd.h
@@ -251,7 +251,7 @@ struct mtd_info {
 
 static inline struct mtd_info *dev_to_mtd(struct device *dev)
 {
-        return dev ? container_of(dev, struct mtd_info, dev) : NULL;
+        return dev ? dev_get_drvdata(dev) : NULL;
 }
 
 static inline uint32_t mtd_div_by_eb(uint64_t sz, struct mtd_info *mtd)
diff --git a/include/linux/mtd/partitions.h b/include/linux/mtd/partitions.h
index af6dcb992bc3..b70313d33ff8 100644
--- a/include/linux/mtd/partitions.h
+++ b/include/linux/mtd/partitions.h
@@ -47,6 +47,8 @@ struct mtd_partition {
 #define MTDPART_SIZ_FULL        (0)
 
 
+struct mtd_info;
+
 int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
 int del_mtd_partitions(struct mtd_info *);
 
diff --git a/include/linux/netfilter/xt_conntrack.h b/include/linux/netfilter/xt_conntrack.h
index 3430c7751948..7ae05338e94c 100644
--- a/include/linux/netfilter/xt_conntrack.h
+++ b/include/linux/netfilter/xt_conntrack.h
@@ -81,4 +81,17 @@ struct xt_conntrack_mtinfo1 {
         __u8 state_mask, status_mask;
 };
 
+struct xt_conntrack_mtinfo2 {
+        union nf_inet_addr origsrc_addr, origsrc_mask;
+        union nf_inet_addr origdst_addr, origdst_mask;
+        union nf_inet_addr replsrc_addr, replsrc_mask;
+        union nf_inet_addr repldst_addr, repldst_mask;
+        __u32 expires_min, expires_max;
+        __u16 l4proto;
+        __be16 origsrc_port, origdst_port;
+        __be16 replsrc_port, repldst_port;
+        __u16 match_flags, invert_flags;
+        __u16 state_mask, status_mask;
+};
+
 #endif /*_XT_CONNTRACK_H*/
diff --git a/include/linux/netfilter/xt_osf.h b/include/linux/netfilter/xt_osf.h
index fd2272e0959a..18afa495f973 100644
--- a/include/linux/netfilter/xt_osf.h
+++ b/include/linux/netfilter/xt_osf.h
@@ -20,6 +20,8 @@
 #ifndef _XT_OSF_H
 #define _XT_OSF_H
 
+#include <linux/types.h>
+
 #define MAXGENRELEN             32
 
 #define XT_OSF_GENRE            (1<<0)
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index fdffb413b192..f6b90240dd41 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -473,7 +473,6 @@ extern int  nfs_writepages(struct address_space *, struct writeback_control *);
 extern int  nfs_flush_incompatible(struct file *file, struct page *page);
 extern int  nfs_updatepage(struct file *, struct page *, unsigned int, unsigned int);
 extern int nfs_writeback_done(struct rpc_task *, struct nfs_write_data *);
-extern void nfs_writedata_release(void *);
 
 /*
  * Try to write back everything synchronously (but check the
@@ -488,7 +487,6 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page);
 extern int  nfs_commit_inode(struct inode *, int);
 extern struct nfs_write_data *nfs_commitdata_alloc(void);
 extern void nfs_commit_free(struct nfs_write_data *wdata);
-extern void nfs_commitdata_release(void *wdata);
 #else
 static inline int
 nfs_commit_inode(struct inode *inode, int how)
@@ -507,6 +505,7 @@ nfs_have_writebacks(struct inode *inode)
  * Allocate nfs_write_data structures
  */
 extern struct nfs_write_data *nfs_writedata_alloc(unsigned int npages);
+extern void nfs_writedata_free(struct nfs_write_data *);
 
 /*
  * linux/fs/nfs/read.c
@@ -515,7 +514,6 @@ extern int  nfs_readpage(struct file *, struct page *);
 extern int  nfs_readpages(struct file *, struct address_space *,
                 struct list_head *, unsigned);
 extern int  nfs_readpage_result(struct rpc_task *, struct nfs_read_data *);
-extern void nfs_readdata_release(void *data);
 extern int  nfs_readpage_async(struct nfs_open_context *, struct inode *,
                                struct page *);
 
@@ -523,6 +521,7 @@ extern int  nfs_readpage_async(struct nfs_open_context *, struct inode *,
  * Allocate nfs_read_data structures
  */
 extern struct nfs_read_data *nfs_readdata_alloc(unsigned int npages);
+extern void nfs_readdata_free(struct nfs_read_data *);
 
 /*
  * linux/fs/nfs3proc.c
diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
index 829b94b156f2..b359c4a9ec9e 100644
--- a/include/linux/nodemask.h
+++ b/include/linux/nodemask.h
@@ -82,6 +82,12 @@
  *    to generate slightly worse code.  So use a simple one-line #define
  *    for node_isset(), instead of wrapping an inline inside a macro, the
  *    way we do the other calls.
+ *
+ * NODEMASK_SCRATCH
+ * When doing above logical AND, OR, XOR, Remap operations the callers tend to
+ * need temporary nodemask_t's on the stack. But if NODES_SHIFT is large,
+ * nodemask_t's consume too much stack space.  NODEMASK_SCRATCH is a helper
+ * for such situations. See below and CPUMASK_ALLOC also.
  */
 
 #include <linux/kernel.h>
@@ -473,4 +479,26 @@ static inline int num_node_state(enum node_states state)
 #define for_each_node(node)        for_each_node_state(node, N_POSSIBLE)
 #define for_each_online_node(node) for_each_node_state(node, N_ONLINE)
 
+/*
+ * For nodemask scrach area.(See CPUMASK_ALLOC() in cpumask.h)
+ */
+
+#if NODES_SHIFT > 8 /* nodemask_t > 64 bytes */
+#define NODEMASK_ALLOC(x, m) struct x *m = kmalloc(sizeof(*m), GFP_KERNEL)
+#define NODEMASK_FREE(m) kfree(m)
+#else
+#define NODEMASK_ALLOC(x, m) struct x _m, *m = &_m
+#define NODEMASK_FREE(m)
+#endif
+
+/* A example struture for using NODEMASK_ALLOC, used in mempolicy. */
+struct nodemask_scratch {
+        nodemask_t      mask1;
+        nodemask_t      mask2;
+};
+
+#define NODEMASK_SCRATCH(x) NODEMASK_ALLOC(nodemask_scratch, x)
+#define NODEMASK_SCRATCH_FREE(x)  NODEMASK_FREE(x)
+
+
 #endif /* __LINUX_NODEMASK_H */
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
index c9663c690303..53b94e025c7c 100644
--- a/include/linux/of_mdio.h
+++ b/include/linux/of_mdio.h
@@ -18,5 +18,8 @@ extern struct phy_device *of_phy_connect(struct net_device *dev,
                                          struct device_node *phy_np,
                                          void (*hndlr)(struct net_device *),
                                          u32 flags, phy_interface_t iface);
+extern struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
+                                         void (*hndlr)(struct net_device *),
+                                         phy_interface_t iface);
 
 #endif /* __LINUX_OF_MDIO_H */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index d304ddf412d0..115fb7ba5089 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1145,7 +1145,7 @@ static inline void pci_set_drvdata(struct pci_dev *pdev, void *data)
 /* If you want to know what to call your pci_dev, ask this function.
  * Again, it's a wrapper around the generic device.
  */
-static inline const char *pci_name(struct pci_dev *pdev)
+static inline const char *pci_name(const struct pci_dev *pdev)
 {
         return dev_name(&pdev->dev);
 }
diff --git a/include/linux/pci_hotplug.h b/include/linux/pci_hotplug.h
index b3646cd7fd5a..4391741b99dc 100644
--- a/include/linux/pci_hotplug.h
+++ b/include/linux/pci_hotplug.h
@@ -229,7 +229,6 @@ struct hotplug_params {
 extern acpi_status acpi_get_hp_params_from_firmware(struct pci_bus *bus,
                                 struct hotplug_params *hpp);
 int acpi_get_hp_hw_control_from_firmware(struct pci_dev *dev, u32 flags);
-int acpi_root_bridge(acpi_handle handle);
 int acpi_pci_check_ejectable(struct pci_bus *pbus, acpi_handle handle);
 int acpi_pci_detect_ejectable(struct pci_bus *pbus);
 #endif
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index a3b000365795..73b46b6b904f 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2645,6 +2645,7 @@
 #define PCI_DEVICE_ID_NETMOS_9835       0x9835
 #define PCI_DEVICE_ID_NETMOS_9845       0x9845
 #define PCI_DEVICE_ID_NETMOS_9855       0x9855
+#define PCI_DEVICE_ID_NETMOS_9901       0x9901
 
 #define PCI_VENDOR_ID_3COM_2            0xa727
 
diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h
index 8f921d74f49f..68438e18fff4 100644
--- a/include/linux/percpu-defs.h
+++ b/include/linux/percpu-defs.h
@@ -24,7 +24,8 @@
 
 #define DEFINE_PER_CPU_SECTION(type, name, section)                     \
         __attribute__((__section__(PER_CPU_BASE_SECTION section)))      \
-        PER_CPU_ATTRIBUTES __typeof__(type) per_cpu__##name
+        PER_CPU_ATTRIBUTES PER_CPU_DEF_ATTRIBUTES                       \
+        __typeof__(type) per_cpu__##name
 
 /*
  * Variant on the per-CPU variable declaration/definition theme used for
diff --git a/include/linux/perf_counter.h b/include/linux/perf_counter.h
index 89698d8aba5c..b53f7006cc4e 100644
--- a/include/linux/perf_counter.h
+++ b/include/linux/perf_counter.h
@@ -115,26 +115,44 @@ enum perf_counter_sample_format {
         PERF_SAMPLE_TID                         = 1U << 1,
         PERF_SAMPLE_TIME                        = 1U << 2,
         PERF_SAMPLE_ADDR                        = 1U << 3,
-        PERF_SAMPLE_GROUP                       = 1U << 4,
+        PERF_SAMPLE_READ                        = 1U << 4,
         PERF_SAMPLE_CALLCHAIN                   = 1U << 5,
         PERF_SAMPLE_ID                          = 1U << 6,
         PERF_SAMPLE_CPU                         = 1U << 7,
         PERF_SAMPLE_PERIOD                      = 1U << 8,
+        PERF_SAMPLE_STREAM_ID                   = 1U << 9,
+        PERF_SAMPLE_RAW                         = 1U << 10,
 
-        PERF_SAMPLE_MAX = 1U << 9,              /* non-ABI */
+        PERF_SAMPLE_MAX = 1U << 11,             /* non-ABI */
 };
 
 /*
- * Bits that can be set in attr.read_format to request that
- * reads on the counter should return the indicated quantities,
- * in increasing order of bit value, after the counter value.
+ * The format of the data returned by read() on a perf counter fd,
+ * as specified by attr.read_format:
+ *
+ * struct read_format {
+ *      { u64           value;
+ *        { u64         time_enabled; } && PERF_FORMAT_ENABLED
+ *        { u64         time_running; } && PERF_FORMAT_RUNNING
+ *        { u64         id;           } && PERF_FORMAT_ID
+ *      } && !PERF_FORMAT_GROUP
+ *
+ *      { u64           nr;
+ *        { u64         time_enabled; } && PERF_FORMAT_ENABLED
+ *        { u64         time_running; } && PERF_FORMAT_RUNNING
+ *        { u64         value;
+ *          { u64       id;           } && PERF_FORMAT_ID
+ *        }             cntr[nr];
+ *      } && PERF_FORMAT_GROUP
+ * };
  */
 enum perf_counter_read_format {
         PERF_FORMAT_TOTAL_TIME_ENABLED          = 1U << 0,
         PERF_FORMAT_TOTAL_TIME_RUNNING          = 1U << 1,
         PERF_FORMAT_ID                          = 1U << 2,
+        PERF_FORMAT_GROUP                       = 1U << 3,
 
-        PERF_FORMAT_MAX = 1U << 3,              /* non-ABI */
+        PERF_FORMAT_MAX = 1U << 4,              /* non-ABI */
 };
 
 #define PERF_ATTR_SIZE_VER0     64      /* sizeof first published struct */
@@ -178,8 +196,11 @@ struct perf_counter_attr {
                                 mmap           :  1, /* include mmap data     */
                                 comm           :  1, /* include comm data     */
                                 freq           :  1, /* use freq, not period  */
+                                inherit_stat   :  1, /* per task counts       */
+                                enable_on_exec :  1, /* next exec enables     */
+                                task           :  1, /* trace fork/exit       */
 
-                                __reserved_1   : 53;
+                                __reserved_1   : 50;
 
         __u32                   wakeup_events;  /* wakeup every n events */
         __u32                   __reserved_2;
@@ -232,6 +253,14 @@ struct perf_counter_mmap_page {
         __u32   lock;                   /* seqlock for synchronization */
         __u32   index;                  /* hardware counter identifier */
         __s64   offset;                 /* add to hardware counter value */
+        __u64   time_enabled;           /* time counter active */
+        __u64   time_running;           /* time counter on cpu */
+
+                /*
+                 * Hole for extension of the self monitor capabilities
+                 */
+
+        __u64   __reserved[123];        /* align to 1k */
 
         /*
          * Control data for the mmap() data buffer.
@@ -253,7 +282,6 @@ struct perf_counter_mmap_page {
 #define PERF_EVENT_MISC_KERNEL                  (1 << 0)
 #define PERF_EVENT_MISC_USER                    (2 << 0)
 #define PERF_EVENT_MISC_HYPERVISOR              (3 << 0)
-#define PERF_EVENT_MISC_OVERFLOW                (1 << 2)
 
 struct perf_event_header {
         __u32   type;
@@ -301,18 +329,18 @@ enum perf_event_type {
         /*
          * struct {
          *      struct perf_event_header        header;
-         *      u64                             time;
-         *      u64                             id;
-         *      u64                             sample_period;
+         *      u32                             pid, ppid;
+         *      u32                             tid, ptid;
          * };
          */
-        PERF_EVENT_PERIOD               = 4,
+        PERF_EVENT_EXIT                 = 4,
 
         /*
          * struct {
          *      struct perf_event_header        header;
          *      u64                             time;
          *      u64                             id;
+         *      u64                             stream_id;
          * };
          */
         PERF_EVENT_THROTTLE             = 5,
@@ -322,14 +350,22 @@ enum perf_event_type {
          * struct {
          *      struct perf_event_header        header;
          *      u32                             pid, ppid;
+         *      u32                             tid, ptid;
          * };
          */
         PERF_EVENT_FORK                 = 7,
 
         /*
-         * When header.misc & PERF_EVENT_MISC_OVERFLOW the event_type field
-         * will be PERF_SAMPLE_*
+         * struct {
+         *      struct perf_event_header        header;
+         *      u32                             pid, tid;
          *
+         *      struct read_format              values;
+         * };
+         */
+        PERF_EVENT_READ                 = 8,
+
+        /*
          * struct {
          *      struct perf_event_header        header;
          *
@@ -337,16 +373,34 @@ enum perf_event_type {
          *      { u32                   pid, tid; } && PERF_SAMPLE_TID
          *      { u64                   time;     } && PERF_SAMPLE_TIME
          *      { u64                   addr;     } && PERF_SAMPLE_ADDR
-         *      { u64                   config;   } && PERF_SAMPLE_CONFIG
+         *      { u64                   id;       } && PERF_SAMPLE_ID
+         *      { u64                   stream_id;} && PERF_SAMPLE_STREAM_ID
          *      { u32                   cpu, res; } && PERF_SAMPLE_CPU
+         *      { u64                   period;   } && PERF_SAMPLE_PERIOD
          *
-         *      { u64                   nr;
-         *        { u64 id, val; }      cnt[nr];  } && PERF_SAMPLE_GROUP
+         *      { struct read_format    values;   } && PERF_SAMPLE_READ
          *
          *      { u64                   nr,
          *        u64                   ips[nr];  } && PERF_SAMPLE_CALLCHAIN
+         *
+         *      #
+         *      # The RAW record below is opaque data wrt the ABI
+         *      #
+         *      # That is, the ABI doesn't make any promises wrt to
+         *      # the stability of its content, it may vary depending
+         *      # on event, hardware, kernel version and phase of
+         *      # the moon.
+         *      #
+         *      # In other words, PERF_SAMPLE_RAW contents are not an ABI.
+         *      #
+         *
+         *      { u32                   size;
+         *        char                  data[size];}&& PERF_SAMPLE_RAW
          * };
          */
+        PERF_EVENT_SAMPLE               = 9,
+
+        PERF_EVENT_MAX,                 /* non-ABI */
 };
 
 enum perf_callchain_context {
@@ -387,6 +441,11 @@ struct perf_callchain_entry {
         __u64                           ip[PERF_MAX_STACK_DEPTH];
 };
 
+struct perf_raw_record {
+        u32                             size;
+        void                            *data;
+};
+
 struct task_struct;
 
 /**
@@ -582,6 +641,7 @@ struct perf_counter_context {
         int                             nr_counters;
         int                             nr_active;
         int                             is_active;
+        int                             nr_stat;
         atomic_t                        refcount;
         struct task_struct              *task;
 
@@ -654,10 +714,13 @@ struct perf_sample_data {
         struct pt_regs                  *regs;
         u64                             addr;
         u64                             period;
+        struct perf_raw_record          *raw;
 };
 
 extern int perf_counter_overflow(struct perf_counter *counter, int nmi,
                                  struct perf_sample_data *data);
+extern void perf_counter_output(struct perf_counter *counter, int nmi,
+                                struct perf_sample_data *data);
 
 /*
  * Return 1 for a software counter, 0 for a hardware counter
@@ -669,7 +732,16 @@ static inline int is_software_counter(struct perf_counter *counter)
                 (counter->attr.type != PERF_TYPE_HW_CACHE);
 }
 
-extern void perf_swcounter_event(u32, u64, int, struct pt_regs *, u64);
+extern atomic_t perf_swcounter_enabled[PERF_COUNT_SW_MAX];
+
+extern void __perf_swcounter_event(u32, u64, int, struct pt_regs *, u64);
+
+static inline void
+perf_swcounter_event(u32 event, u64 nr, int nmi, struct pt_regs *regs, u64 addr)
+{
+        if (atomic_read(&perf_swcounter_enabled[event]))
+                __perf_swcounter_event(event, nr, nmi, regs, addr);
+}
 
 extern void __perf_counter_mmap(struct vm_area_struct *vma);
 
diff --git a/include/linux/personality.h b/include/linux/personality.h
index a84e9ff9b27e..126120819a0d 100644
--- a/include/linux/personality.h
+++ b/include/linux/personality.h
@@ -40,7 +40,10 @@ enum {
  * Security-relevant compatibility flags that must be
  * cleared upon setuid or setgid exec:
  */
-#define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC|ADDR_NO_RANDOMIZE)
+#define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC  | \
+                            ADDR_NO_RANDOMIZE  | \
+                            ADDR_COMPAT_LAYOUT | \
+                            MMAP_PAGE_ZERO)
 
 /*
  * Personality types.
diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h
index 4bc241290c24..065a3652a3ea 100644
--- a/include/linux/posix_acl.h
+++ b/include/linux/posix_acl.h
@@ -83,4 +83,78 @@ extern int posix_acl_chmod_masq(struct posix_acl *, mode_t);
 extern struct posix_acl *get_posix_acl(struct inode *, int);
 extern int set_posix_acl(struct inode *, int, struct posix_acl *);
 
+#ifdef CONFIG_FS_POSIX_ACL
+static inline struct posix_acl *get_cached_acl(struct inode *inode, int type)
+{
+        struct posix_acl **p, *acl;
+        switch (type) {
+        case ACL_TYPE_ACCESS:
+                p = &inode->i_acl;
+                break;
+        case ACL_TYPE_DEFAULT:
+                p = &inode->i_default_acl;
+                break;
+        default:
+                return ERR_PTR(-EINVAL);
+        }
+        acl = ACCESS_ONCE(*p);
+        if (acl) {
+                spin_lock(&inode->i_lock);
+                acl = *p;
+                if (acl != ACL_NOT_CACHED)
+                        acl = posix_acl_dup(acl);
+                spin_unlock(&inode->i_lock);
+        }
+        return acl;
+}
+
+static inline void set_cached_acl(struct inode *inode,
+                                  int type,
+                                  struct posix_acl *acl)
+{
+        struct posix_acl *old = NULL;
+        spin_lock(&inode->i_lock);
+        switch (type) {
+        case ACL_TYPE_ACCESS:
+                old = inode->i_acl;
+                inode->i_acl = posix_acl_dup(acl);
+                break;
+        case ACL_TYPE_DEFAULT:
+                old = inode->i_default_acl;
+                inode->i_default_acl = posix_acl_dup(acl);
+                break;
+        }
+        spin_unlock(&inode->i_lock);
+        if (old != ACL_NOT_CACHED)
+                posix_acl_release(old);
+}
+
+static inline void forget_cached_acl(struct inode *inode, int type)
+{
+        struct posix_acl *old = NULL;
+        spin_lock(&inode->i_lock);
+        switch (type) {
+        case ACL_TYPE_ACCESS:
+                old = inode->i_acl;
+                inode->i_acl = ACL_NOT_CACHED;
+                break;
+        case ACL_TYPE_DEFAULT:
+                old = inode->i_default_acl;
+                inode->i_default_acl = ACL_NOT_CACHED;
+                break;
+        }
+        spin_unlock(&inode->i_lock);
+        if (old != ACL_NOT_CACHED)
+                posix_acl_release(old);
+}
+#endif
+
+static inline void cache_no_acl(struct inode *inode)
+{
+#ifdef CONFIG_FS_POSIX_ACL
+        inode->i_acl = NULL;
+        inode->i_default_acl = NULL;
+#endif
+}
+
 #endif  /* __LINUX_POSIX_ACL_H */
diff --git a/include/linux/pps.h b/include/linux/pps.h
index cfe5c7214ec6..0194ab06177b 100644
--- a/include/linux/pps.h
+++ b/include/linux/pps.h
@@ -22,6 +22,8 @@
 #ifndef _PPS_H_
 #define _PPS_H_
 
+#include <linux/types.h>
+
 #define PPS_VERSION             "5.3.6"
 #define PPS_MAX_SOURCES         16              /* should be enough... */
 
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index 7bc457593684..26361c4c037a 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -7,7 +7,6 @@
 #ifndef _LINUX_QUOTAOPS_
 #define _LINUX_QUOTAOPS_
 
-#include <linux/smp_lock.h>
 #include <linux/fs.h>
 
 static inline struct quota_info *sb_dqopt(struct super_block *sb)
diff --git a/include/linux/reiserfs_acl.h b/include/linux/reiserfs_acl.h
index 8cc65757e47a..b4448853900e 100644
--- a/include/linux/reiserfs_acl.h
+++ b/include/linux/reiserfs_acl.h
@@ -56,15 +56,6 @@ int reiserfs_cache_default_acl(struct inode *dir);
 extern struct xattr_handler reiserfs_posix_acl_default_handler;
 extern struct xattr_handler reiserfs_posix_acl_access_handler;
 
-static inline void reiserfs_init_acl_access(struct inode *inode)
-{
-        REISERFS_I(inode)->i_acl_access = NULL;
-}
-
-static inline void reiserfs_init_acl_default(struct inode *inode)
-{
-        REISERFS_I(inode)->i_acl_default = NULL;
-}
 #else
 
 #define reiserfs_cache_default_acl(inode) 0
@@ -86,12 +77,4 @@ reiserfs_inherit_default_acl(struct reiserfs_transaction_handle *th,
 {
         return 0;
 }
-
-static inline void reiserfs_init_acl_access(struct inode *inode)
-{
-}
-
-static inline void reiserfs_init_acl_default(struct inode *inode)
-{
-}
 #endif
diff --git a/include/linux/reiserfs_fs_i.h b/include/linux/reiserfs_fs_i.h
index 76360b36ac33..89f4d3abbf5a 100644
--- a/include/linux/reiserfs_fs_i.h
+++ b/include/linux/reiserfs_fs_i.h
@@ -54,10 +54,6 @@ struct reiserfs_inode_info {
         unsigned int i_trans_id;
         struct reiserfs_journal_list *i_jl;
         struct mutex i_mmap;
-#ifdef CONFIG_REISERFS_FS_POSIX_ACL
-        struct posix_acl *i_acl_access;
-        struct posix_acl *i_acl_default;
-#endif
 #ifdef CONFIG_REISERFS_FS_XATTR
         struct rw_semaphore i_xattr_sem;
 #endif
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index e73e2429a1b1..278777fa8a3a 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -99,7 +99,6 @@ enum rfkill_user_states {
 #undef RFKILL_STATE_UNBLOCKED
 #undef RFKILL_STATE_HARD_BLOCKED
 
-#include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/mutex.h>
@@ -225,7 +224,7 @@ void rfkill_destroy(struct rfkill *rfkill);
  * should be blocked) so that drivers need not keep track of the soft
  * block state -- which they might not be able to.
  */
-bool __must_check rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
+bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
 
 /**
  * rfkill_set_sw_state - Set the internal rfkill software block state
diff --git a/include/linux/scatterlist.h b/include/linux/scatterlist.h
index e5996984ddd0..9aaf5bfdad1a 100644
--- a/include/linux/scatterlist.h
+++ b/include/linux/scatterlist.h
@@ -242,6 +242,8 @@ size_t sg_copy_to_buffer(struct scatterlist *sgl, unsigned int nents,
  */
 
 #define SG_MITER_ATOMIC         (1 << 0)         /* use kmap_atomic */
+#define SG_MITER_TO_SG          (1 << 1)        /* flush back to phys on unmap */
+#define SG_MITER_FROM_SG        (1 << 2)        /* nop */
 
 struct sg_mapping_iter {
         /* the following three fields can be accessed directly */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4d0754269884..3ab08e4bb6b8 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -209,7 +209,7 @@ extern unsigned long long time_sync_thresh;
                         ((task->state & (__TASK_STOPPED | __TASK_TRACED)) != 0)
 #define task_contributes_to_load(task)  \
                                 ((task->state & TASK_UNINTERRUPTIBLE) != 0 && \
-                                 (task->flags & PF_FROZEN) == 0)
+                                 (task->flags & PF_FREEZING) == 0)
 
 #define __set_task_state(tsk, state_value)              \
         do { (tsk)->state = (state_value); } while (0)
@@ -349,8 +349,20 @@ extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
 struct nsproxy;
 struct user_namespace;
 
-/* Maximum number of active map areas.. This is a random (large) number */
-#define DEFAULT_MAX_MAP_COUNT   65536
+/*
+ * Default maximum number of active map areas, this limits the number of vmas
+ * per mm struct. Users can overwrite this number by sysctl but there is a
+ * problem.
+ *
+ * When a program's coredump is generated as ELF format, a section is created
+ * per a vma. In ELF, the number of sections is represented in unsigned short.
+ * This means the number of sections should be smaller than 65535 at coredump.
+ * Because the kernel adds some informative sections to a image of program at
+ * generating coredump, we need some margin. The number of extra sections is
+ * 1-3 now and depends on arch. We use "5" as safe margin, here.
+ */
+#define MAPCOUNT_ELF_CORE_MARGIN        (5)
+#define DEFAULT_MAX_MAP_COUNT   (USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
 
 extern int sysctl_max_map_count;
 
@@ -486,6 +498,15 @@ struct task_cputime {
                 .sum_exec_runtime = 0,                          \
         }
 
+/*
+ * Disable preemption until the scheduler is running.
+ * Reset by start_kernel()->sched_init()->init_idle().
+ *
+ * We include PREEMPT_ACTIVE to avoid cond_resched() from working
+ * before the scheduler is active -- see should_resched().
+ */
+#define INIT_PREEMPT_COUNT      (1 + PREEMPT_ACTIVE)
+
 /**
  * struct thread_group_cputimer - thread group interval timer counts
  * @cputime:            thread group interval timers.
@@ -1659,6 +1680,7 @@ extern cputime_t task_gtime(struct task_struct *p);
 #define PF_MEMALLOC     0x00000800      /* Allocating memory */
 #define PF_FLUSHER      0x00001000      /* responsible for disk writeback */
 #define PF_USED_MATH    0x00002000      /* if unset the fpu must be initialized before use */
+#define PF_FREEZING     0x00004000      /* freeze in progress. do not account to load */
 #define PF_NOFREEZE     0x00008000      /* this thread should not be frozen */
 #define PF_FROZEN       0x00010000      /* frozen for system suspend */
 #define PF_FSTRANS      0x00020000      /* inside a filesystem transaction */
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index fd83f2584b15..abff6c9b413c 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -19,10 +19,6 @@ struct shmem_inode_info {
         swp_entry_t             i_direct[SHMEM_NR_DIRECT]; /* first blocks */
         struct list_head        swaplist;       /* chain of maybes on swap */
         struct inode            vfs_inode;
-#ifdef CONFIG_TMPFS_POSIX_ACL
-        struct posix_acl        *i_acl;
-        struct posix_acl        *i_default_acl;
-#endif
 };
 
 struct shmem_sb_info {
@@ -45,7 +41,6 @@ static inline struct shmem_inode_info *SHMEM_I(struct inode *inode)
 #ifdef CONFIG_TMPFS_POSIX_ACL
 int shmem_permission(struct inode *, int);
 int shmem_acl_init(struct inode *, struct inode *);
-void shmem_acl_destroy_inode(struct inode *);
 
 extern struct xattr_handler shmem_xattr_acl_access_handler;
 extern struct xattr_handler shmem_xattr_acl_default_handler;
@@ -57,9 +52,6 @@ static inline int shmem_acl_init(struct inode *inode, struct inode *dir)
 {
         return 0;
 }
-static inline void shmem_acl_destroy_inode(struct inode *inode)
-{
-}
 #endif  /* CONFIG_TMPFS_POSIX_ACL */
 
 #endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index b47b3f039d14..f2c69a2cca17 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1342,12 +1342,12 @@ static inline int skb_network_offset(const struct sk_buff *skb)
  * shifting the start of the packet by 2 bytes. Drivers should do this
  * with:
  *
- * skb_reserve(NET_IP_ALIGN);
+ * skb_reserve(skb, NET_IP_ALIGN);
  *
  * The downside to this alignment of the IP header is that the DMA is now
  * unaligned. On some architectures the cost of an unaligned DMA is high
  * and this cost outweighs the gains made by aligning the IP header.
- * 
+ *
  * Since this trade off varies between architectures, we allow NET_IP_ALIGN
  * to be overridden.
  */
diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
index 4dcbc2c71491..c1c862b1d01a 100644
--- a/include/linux/slub_def.h
+++ b/include/linux/slub_def.h
@@ -11,6 +11,7 @@
 #include <linux/workqueue.h>
 #include <linux/kobject.h>
 #include <linux/kmemtrace.h>
+#include <linux/kmemleak.h>
 
 enum stat_item {
         ALLOC_FASTPATH,         /* Allocation from cpu slab */
@@ -233,6 +234,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
         unsigned int order = get_order(size);
         void *ret = (void *) __get_free_pages(flags | __GFP_COMP, order);
 
+        kmemleak_alloc(ret, size, 1, flags);
         trace_kmalloc(_THIS_IP_, ret, size, PAGE_SIZE << order, flags);
 
         return ret;
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index 9c4cd27f4685..c47c4b4da97e 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -80,6 +80,8 @@ struct spi_device {
 #define SPI_LSB_FIRST   0x08                    /* per-word bits-on-wire */
 #define SPI_3WIRE       0x10                    /* SI/SO signals shared */
 #define SPI_LOOP        0x20                    /* loopback mode */
+#define SPI_NO_CS       0x40                    /* 1 dev/bus, no chipselect */
+#define SPI_READY       0x80                    /* slave pulls low to pause */
         u8                      bits_per_word;
         int                     irq;
         void                    *controller_state;
@@ -248,6 +250,10 @@ struct spi_master {
         /* spi_device.mode flags understood by this controller driver */
         u16                     mode_bits;
 
+        /* other constraints relevant to this driver */
+        u16                     flags;
+#define SPI_MASTER_HALF_DUPLEX  BIT(0)          /* can't do full duplex */
+
         /* Setup mode and clock, etc (spi driver may call many times).
          *
          * IMPORTANT:  this may be called when transfers to another
diff --git a/include/linux/spi/spidev.h b/include/linux/spi/spidev.h
index 95251ccd5a07..bf0570a84f7a 100644
--- a/include/linux/spi/spidev.h
+++ b/include/linux/spi/spidev.h
@@ -40,6 +40,8 @@
 #define SPI_LSB_FIRST           0x08
 #define SPI_3WIRE               0x10
 #define SPI_LOOP                0x20
+#define SPI_NO_CS               0x40
+#define SPI_READY               0x80
 
 /*---------------------------------------------------------------------------*/
 
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index 252b245cfcf4..4be57ab03478 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -132,6 +132,11 @@ do {								\
 #endif /*__raw_spin_is_contended*/
 #endif
 
+/* The lock does not imply full memory barrier. */
+#ifndef ARCH_HAS_SMP_MB_AFTER_LOCK
+static inline void smp_mb__after_lock(void) { smp_mb(); }
+#endif
+
 /**
  * spin_unlock_wait - wait until the spinlock gets unlocked
  * @lock: the spinlock in question.
diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index d8910b68e1bd..b99c625fddfe 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -12,7 +12,6 @@
 #include <linux/uio.h>
 #include <asm/byteorder.h>
 #include <linux/scatterlist.h>
-#include <linux/smp_lock.h>
 
 /*
  * Buffer adjustment
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index fa4242cdade8..80de7003d8c2 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -321,6 +321,8 @@ asmlinkage long sys_rt_sigtimedwait(const sigset_t __user *uthese,
                                 siginfo_t __user *uinfo,
                                 const struct timespec __user *uts,
                                 size_t sigsetsize);
+asmlinkage long sys_rt_tgsigqueueinfo(pid_t tgid, pid_t  pid, int sig,
+                siginfo_t __user *uinfo);
 asmlinkage long sys_kill(int pid, int sig);
 asmlinkage long sys_tgkill(int tgid, int pid, int sig);
 asmlinkage long sys_tkill(int pid, int sig);
diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
index 98a1d8cfb73d..99adcdc0d3ca 100644
--- a/include/linux/sysrq.h
+++ b/include/linux/sysrq.h
@@ -14,6 +14,8 @@
 #ifndef _LINUX_SYSRQ_H
 #define _LINUX_SYSRQ_H
 
+#include <linux/errno.h>
+
 struct pt_regs;
 struct tty_struct;
 
diff --git a/include/linux/timer.h b/include/linux/timer.h
index ccf882eed8f8..be62ec2ebea5 100644
--- a/include/linux/timer.h
+++ b/include/linux/timer.h
@@ -190,6 +190,8 @@ extern unsigned long get_next_timer_interrupt(unsigned long now);
  */
 #ifdef CONFIG_TIMER_STATS
 
+extern int timer_stats_active;
+
 #define TIMER_STATS_FLAG_DEFERRABLE     0x1
 
 extern void init_timer_stats(void);
@@ -203,6 +205,8 @@ extern void __timer_stats_timer_set_start_info(struct timer_list *timer,
 
 static inline void timer_stats_timer_set_start_info(struct timer_list *timer)
 {
+        if (likely(!timer_stats_active))
+                return;
         __timer_stats_timer_set_start_info(timer, __builtin_return_address(0));
 }
 
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 1488d8c81aac..e8c6c9136c97 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -394,6 +394,7 @@ extern void __do_SAK(struct tty_struct *tty);
 extern void disassociate_ctty(int priv);
 extern void no_tty(void);
 extern void tty_flip_buffer_push(struct tty_struct *tty);
+extern void tty_flush_to_ldisc(struct tty_struct *tty);
 extern void tty_buffer_free_all(struct tty_struct *tty);
 extern void tty_buffer_flush(struct tty_struct *tty);
 extern void tty_buffer_init(struct tty_struct *tty);
diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
index 40f38d896777..0c4ee9b88f85 100644
--- a/include/linux/tty_ldisc.h
+++ b/include/linux/tty_ldisc.h
@@ -144,7 +144,7 @@ struct tty_ldisc_ops {
 
 struct tty_ldisc {
         struct tty_ldisc_ops *ops;
-        int refcount;
+        atomic_t users;
 };
 
 #define TTY_LDISC_MAGIC 0x5403
diff --git a/include/linux/uio.h b/include/linux/uio.h
index b7fe13883bdb..98c114323a8b 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -19,15 +19,6 @@ struct iovec
         __kernel_size_t iov_len; /* Must be size_t (1003.1g) */
 };
 
-#ifdef __KERNEL__
-
-struct kvec {
-        void *iov_base; /* and that should *never* hold a userland pointer */
-        size_t iov_len;
-};
-
-#endif
-
 /*
  *      UIO_MAXIOV shall be at least 16 1003.1g (5.4.1.1)
  */
@@ -35,6 +26,13 @@ struct kvec {
 #define UIO_FASTIOV     8
 #define UIO_MAXIOV      1024
 
+#ifdef __KERNEL__
+
+struct kvec {
+        void *iov_base; /* and that should *never* hold a userland pointer */
+        size_t iov_len;
+};
+
 /*
  * Total number of bytes covered by an iovec.
  *
@@ -53,5 +51,6 @@ static inline size_t iov_length(const struct iovec *iov, unsigned long nr_segs)
 }
 
 unsigned long iov_shorten(struct iovec *iov, unsigned long nr_segs, size_t to);
+#endif
 
 #endif
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 84929e914034..b1e3c2fbfe11 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -888,8 +888,6 @@ struct usb_driver {
  * struct usb_device_driver - identifies USB device driver to usbcore
  * @name: The driver name should be unique among USB drivers,
  *      and should normally be the same as the module name.
- * @nodename: Callback to provide a naming hint for a possible
- *      device node to create.
  * @probe: Called to see if the driver is willing to manage a particular
  *      device.  If it is, probe returns zero and uses dev_set_drvdata()
  *      to associate driver-specific data with the device.  If unwilling
@@ -924,6 +922,8 @@ extern struct bus_type usb_bus_type;
 /**
  * struct usb_class_driver - identifies a USB driver that wants to use the USB major number
  * @name: the usb class device name for this driver.  Will show up in sysfs.
+ * @nodename: Callback to provide a naming hint for a possible
+ *      device node to create.
  * @fops: pointer to the struct file_operations of this driver.
  * @minor_base: the start of the minor range for this driver.
  *
@@ -1046,6 +1046,8 @@ typedef void (*usb_complete_t)(struct urb *);
  *      the device driver is saying that it provided this DMA address,
  *      which the host controller driver should use in preference to the
  *      transfer_buffer.
+ * @sg: scatter gather buffer list
+ * @num_sgs: number of entries in the sg list
  * @transfer_buffer_length: How big is transfer_buffer.  The transfer may
  *      be broken up into chunks according to the current maximum packet
  *      size for the endpoint, which is a function of the configuration
diff --git a/include/linux/usb/langwell_otg.h b/include/linux/usb/langwell_otg.h
deleted file mode 100644
index e115ae6df1da..000000000000
--- a/include/linux/usb/langwell_otg.h
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Intel Langwell USB OTG transceiver driver
- * Copyright (C) 2008, Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- */
-
-#ifndef __LANGWELL_OTG_H__
-#define __LANGWELL_OTG_H__
-
-/* notify transceiver driver about OTG events */
-extern void langwell_update_transceiver(void);
-/* HCD register bus driver */
-extern int langwell_register_host(struct pci_driver *host_driver);
-/* HCD unregister bus driver */
-extern void langwell_unregister_host(struct pci_driver *host_driver);
-/* DCD register bus driver */
-extern int langwell_register_peripheral(struct pci_driver *client_driver);
-/* DCD unregister bus driver */
-extern void langwell_unregister_peripheral(struct pci_driver *client_driver);
-/* No silent failure, output warning message */
-extern void langwell_otg_nsf_msg(unsigned long message);
-
-#define CI_USBCMD               0x30
-#       define USBCMD_RST               BIT(1)
-#       define USBCMD_RS                BIT(0)
-#define CI_USBSTS               0x34
-#       define USBSTS_SLI               BIT(8)
-#       define USBSTS_URI               BIT(6)
-#       define USBSTS_PCI               BIT(2)
-#define CI_PORTSC1              0x74
-#       define PORTSC_PP                BIT(12)
-#       define PORTSC_LS                (BIT(11) | BIT(10))
-#       define PORTSC_SUSP              BIT(7)
-#       define PORTSC_CCS               BIT(0)
-#define CI_HOSTPC1              0xb4
-#       define HOSTPC1_PHCD             BIT(22)
-#define CI_OTGSC                0xf4
-#       define OTGSC_DPIE               BIT(30)
-#       define OTGSC_1MSE               BIT(29)
-#       define OTGSC_BSEIE              BIT(28)
-#       define OTGSC_BSVIE              BIT(27)
-#       define OTGSC_ASVIE              BIT(26)
-#       define OTGSC_AVVIE              BIT(25)
-#       define OTGSC_IDIE               BIT(24)
-#       define OTGSC_DPIS               BIT(22)
-#       define OTGSC_1MSS               BIT(21)
-#       define OTGSC_BSEIS              BIT(20)
-#       define OTGSC_BSVIS              BIT(19)
-#       define OTGSC_ASVIS              BIT(18)
-#       define OTGSC_AVVIS              BIT(17)
-#       define OTGSC_IDIS               BIT(16)
-#       define OTGSC_DPS                BIT(14)
-#       define OTGSC_1MST               BIT(13)
-#       define OTGSC_BSE                BIT(12)
-#       define OTGSC_BSV                BIT(11)
-#       define OTGSC_ASV                BIT(10)
-#       define OTGSC_AVV                BIT(9)
-#       define OTGSC_ID                 BIT(8)
-#       define OTGSC_HABA               BIT(7)
-#       define OTGSC_HADP               BIT(6)
-#       define OTGSC_IDPU               BIT(5)
-#       define OTGSC_DP                 BIT(4)
-#       define OTGSC_OT                 BIT(3)
-#       define OTGSC_HAAR               BIT(2)
-#       define OTGSC_VC                 BIT(1)
-#       define OTGSC_VD                 BIT(0)
-#       define OTGSC_INTEN_MASK         (0x7f << 24)
-#       define OTGSC_INTSTS_MASK        (0x7f << 16)
-#define CI_USBMODE              0xf8
-#       define USBMODE_CM               (BIT(1) | BIT(0))
-#       define USBMODE_IDLE             0
-#       define USBMODE_DEVICE           0x2
-#       define USBMODE_HOST             0x3
-
-#define INTR_DUMMY_MASK (USBSTS_SLI | USBSTS_URI | USBSTS_PCI)
-
-struct otg_hsm {
-        /* Input */
-        int a_bus_resume;
-        int a_bus_suspend;
-        int a_conn;
-        int a_sess_vld;
-        int a_srp_det;
-        int a_vbus_vld;
-        int b_bus_resume;
-        int b_bus_suspend;
-        int b_conn;
-        int b_se0_srp;
-        int b_sess_end;
-        int b_sess_vld;
-        int id;
-
-        /* Internal variables */
-        int a_set_b_hnp_en;
-        int b_srp_done;
-        int b_hnp_enable;
-
-        /* Timeout indicator for timers */
-        int a_wait_vrise_tmout;
-        int a_wait_bcon_tmout;
-        int a_aidl_bdis_tmout;
-        int b_ase0_brst_tmout;
-        int b_bus_suspend_tmout;
-        int b_srp_res_tmout;
-
-        /* Informative variables */
-        int a_bus_drop;
-        int a_bus_req;
-        int a_clr_err;
-        int a_suspend_req;
-        int b_bus_req;
-
-        /* Output */
-        int drv_vbus;
-        int loc_conn;
-        int loc_sof;
-
-        /* Others */
-        int b_bus_suspend_vld;
-};
-
-#define TA_WAIT_VRISE   100
-#define TA_WAIT_BCON    30000
-#define TA_AIDL_BDIS    15000
-#define TB_ASE0_BRST    5000
-#define TB_SE0_SRP      2
-#define TB_SRP_RES      100
-#define TB_BUS_SUSPEND  500
-
-struct langwell_otg_timer {
-        unsigned long expires;  /* Number of count increase to timeout */
-        unsigned long count;    /* Tick counter */
-        void (*function)(unsigned long);        /* Timeout function */
-        unsigned long data;     /* Data passed to function */
-        struct list_head list;
-};
-
-struct langwell_otg {
-        struct otg_transceiver  otg;
-        struct otg_hsm          hsm;
-        void __iomem            *regs;
-        unsigned                region;
-        struct pci_driver       *host_ops;
-        struct pci_driver       *client_ops;
-        struct pci_dev          *pdev;
-        struct work_struct      work;
-        struct workqueue_struct *qwork;
-        spinlock_t              lock;
-        spinlock_t              wq_lock;
-};
-
-static inline struct langwell_otg *otg_to_langwell(struct otg_transceiver *otg)
-{
-        return container_of(otg, struct langwell_otg, otg);
-}
-
-#ifdef DEBUG
-#define otg_dbg(fmt, args...) \
-        printk(KERN_DEBUG fmt , ## args)
-#else
-#define otg_dbg(fmt, args...) \
-        do { } while (0)
-#endif /* DEBUG */
-#endif /* __LANGWELL_OTG_H__ */
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index 44801d26a37a..0ec50ba62139 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -317,7 +317,8 @@ extern int usb_serial_generic_register(int debug);
 extern void usb_serial_generic_deregister(void);
 extern void usb_serial_generic_resubmit_read_urb(struct usb_serial_port *port,
                                                  gfp_t mem_flags);
-extern int usb_serial_handle_sysrq_char(struct usb_serial_port *port,
+extern int usb_serial_handle_sysrq_char(struct tty_struct *tty,
+                                        struct usb_serial_port *port,
                                         unsigned int ch);
 extern int usb_serial_handle_break(struct usb_serial_port *port);
 
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 5d44059f6d63..310e18a880ff 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -42,7 +42,6 @@ struct usbnet {
 
         /* protocol/interface state */
         struct net_device       *net;
-        struct net_device_stats stats;
         int                     msg_enable;
         unsigned long           data [5];
         u32                     xid;
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index 8a025d510904..74f16876f38d 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -318,6 +318,8 @@ struct v4l2_pix_format {
 /* see http://www.siliconimaging.com/RGB%20Bayer.htm */
 #define V4L2_PIX_FMT_SBGGR8  v4l2_fourcc('B', 'A', '8', '1') /*  8  BGBG.. GRGR.. */
 #define V4L2_PIX_FMT_SGBRG8  v4l2_fourcc('G', 'B', 'R', 'G') /*  8  GBGB.. RGRG.. */
+#define V4L2_PIX_FMT_SGRBG8  v4l2_fourcc('G', 'R', 'B', 'G') /*  8  GRGR.. BGBG.. */
+
 /*
  * 10bit raw bayer, expanded to 16 bits
  * xxxxrrrrrrrrrrxxxxgggggggggg xxxxggggggggggxxxxbbbbbbbbbb...
@@ -336,6 +338,7 @@ struct v4l2_pix_format {
 /*  Vendor-specific formats   */
 #define V4L2_PIX_FMT_WNVA     v4l2_fourcc('W', 'N', 'V', 'A') /* Winnov hw compress */
 #define V4L2_PIX_FMT_SN9C10X  v4l2_fourcc('S', '9', '1', '0') /* SN9C10x compression */
+#define V4L2_PIX_FMT_SN9C20X_I420 v4l2_fourcc('S', '9', '2', '0') /* SN9C20x YUV 4:2:0 */
 #define V4L2_PIX_FMT_PWC1     v4l2_fourcc('P', 'W', 'C', '1') /* pwc older webcam */
 #define V4L2_PIX_FMT_PWC2     v4l2_fourcc('P', 'W', 'C', '2') /* pwc newer webcam */
 #define V4L2_PIX_FMT_ET61X251 v4l2_fourcc('E', '6', '2', '5') /* ET61X251 compression */
diff --git a/include/linux/virtio_blk.h b/include/linux/virtio_blk.h
index be7d255fc7cf..8dab9f2b8832 100644
--- a/include/linux/virtio_blk.h
+++ b/include/linux/virtio_blk.h
@@ -20,8 +20,7 @@
 
 #define VIRTIO_BLK_ID_BYTES     (sizeof(__u16[256]))    /* IDENTIFY DATA */
 
-struct virtio_blk_config
-{
+struct virtio_blk_config {
         /* The capacity (in 512-byte sectors). */
         __u64 capacity;
         /* The maximum segment size (if VIRTIO_BLK_F_SIZE_MAX) */
@@ -50,8 +49,7 @@ struct virtio_blk_config
 #define VIRTIO_BLK_T_BARRIER    0x80000000
 
 /* This is the first element of the read scatter-gather list. */
-struct virtio_blk_outhdr
-{
+struct virtio_blk_outhdr {
         /* VIRTIO_BLK_T* */
         __u32 type;
         /* io priority. */
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 99f514575f6a..e547e3c8ee9a 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -79,8 +79,7 @@
  *      the dev->feature bits if it wants.
  */
 typedef void vq_callback_t(struct virtqueue *);
-struct virtio_config_ops
-{
+struct virtio_config_ops {
         void (*get)(struct virtio_device *vdev, unsigned offset,
                     void *buf, unsigned len);
         void (*set)(struct virtio_device *vdev, unsigned offset,
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index cec79adbe3ea..d8dd539c9f48 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -27,11 +27,11 @@
 #define VIRTIO_NET_F_CTRL_VQ    17      /* Control channel available */
 #define VIRTIO_NET_F_CTRL_RX    18      /* Control channel RX mode support */
 #define VIRTIO_NET_F_CTRL_VLAN  19      /* Control channel VLAN filtering */
+#define VIRTIO_NET_F_CTRL_RX_EXTRA 20   /* Extra RX mode control support */
 
 #define VIRTIO_NET_S_LINK_UP    1       /* Link is up */
 
-struct virtio_net_config
-{
+struct virtio_net_config {
         /* The config defining mac address (if VIRTIO_NET_F_MAC) */
         __u8 mac[6];
         /* See VIRTIO_NET_F_STATUS and VIRTIO_NET_S_* above */
@@ -40,8 +40,7 @@ struct virtio_net_config
 
 /* This is the first element of the scatter-gather list.  If you don't
  * specify GSO or CSUM features, you can simply ignore the header. */
-struct virtio_net_hdr
-{
+struct virtio_net_hdr {
 #define VIRTIO_NET_HDR_F_NEEDS_CSUM     1       // Use csum_start, csum_offset
         __u8 flags;
 #define VIRTIO_NET_HDR_GSO_NONE         0       // Not a GSO frame
@@ -81,14 +80,19 @@ typedef __u8 virtio_net_ctrl_ack;
 #define VIRTIO_NET_ERR    1
 
 /*
- * Control the RX mode, ie. promisucous and allmulti.  PROMISC and
- * ALLMULTI commands require an "out" sg entry containing a 1 byte
- * state value, zero = disable, non-zero = enable.  These commands
- * are supported with the VIRTIO_NET_F_CTRL_RX feature.
+ * Control the RX mode, ie. promisucous, allmulti, etc...
+ * All commands require an "out" sg entry containing a 1 byte
+ * state value, zero = disable, non-zero = enable.  Commands
+ * 0 and 1 are supported with the VIRTIO_NET_F_CTRL_RX feature.
+ * Commands 2-5 are added with VIRTIO_NET_F_CTRL_RX_EXTRA.
  */
 #define VIRTIO_NET_CTRL_RX    0
  #define VIRTIO_NET_CTRL_RX_PROMISC      0
  #define VIRTIO_NET_CTRL_RX_ALLMULTI     1
+ #define VIRTIO_NET_CTRL_RX_ALLUNI       2
+ #define VIRTIO_NET_CTRL_RX_NOMULTI      3
+ #define VIRTIO_NET_CTRL_RX_NOUNI        4
+ #define VIRTIO_NET_CTRL_RX_NOBCAST      5
 
 /*
  * Control the MAC filter table.
diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
index 693e0ec5afa6..e4d144b132b5 100644
--- a/include/linux/virtio_ring.h
+++ b/include/linux/virtio_ring.h
@@ -30,8 +30,7 @@
 #define VIRTIO_RING_F_INDIRECT_DESC     28
 
 /* Virtio ring descriptors: 16 bytes.  These can chain together via "next". */
-struct vring_desc
-{
+struct vring_desc {
         /* Address (guest-physical). */
         __u64 addr;
         /* Length. */
@@ -42,24 +41,21 @@ struct vring_desc
         __u16 next;
 };
 
-struct vring_avail
-{
+struct vring_avail {
         __u16 flags;
         __u16 idx;
         __u16 ring[];
 };
 
 /* u32 is used here for ids for padding reasons. */
-struct vring_used_elem
-{
+struct vring_used_elem {
         /* Index of start of used descriptor chain. */
         __u32 id;
         /* Total length of the descriptor chain which was used (written to) */
         __u32 len;
 };
 
-struct vring_used
-{
+struct vring_used {
         __u16 flags;
         __u16 idx;
         struct vring_used_elem ring[];
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 6788e1a4d4ca..cf3c2f5dba51 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -77,7 +77,14 @@ struct task_struct;
 #define __WAIT_BIT_KEY_INITIALIZER(word, bit)                           \
         { .flags = word, .bit_nr = bit, }
 
-extern void init_waitqueue_head(wait_queue_head_t *q);
+extern void __init_waitqueue_head(wait_queue_head_t *q, struct lock_class_key *);
+
+#define init_waitqueue_head(q)                          \
+        do {                                            \
+                static struct lock_class_key __key;     \
+                                                        \
+                __init_waitqueue_head((q), &__key);     \
+        } while (0)
 
 #ifdef CONFIG_LOCKDEP
 # define __WAIT_QUEUE_HEAD_INIT_ONSTACK(name) \
diff --git a/include/media/v4l2-chip-ident.h b/include/media/v4l2-chip-ident.h
index 4d7e2272c42f..94e908c0d7a0 100644
--- a/include/media/v4l2-chip-ident.h
+++ b/include/media/v4l2-chip-ident.h
@@ -60,6 +60,10 @@ enum {
         V4L2_IDENT_OV7670 = 250,
         V4L2_IDENT_OV7720 = 251,
         V4L2_IDENT_OV7725 = 252,
+        V4L2_IDENT_OV7660 = 253,
+        V4L2_IDENT_OV9650 = 254,
+        V4L2_IDENT_OV9655 = 255,
+        V4L2_IDENT_SOI968 = 256,
 
         /* module saa7146: reserved range 300-309 */
         V4L2_IDENT_SAA7146 = 300,
@@ -155,9 +159,15 @@ enum {
         /* module cafe_ccic, just ident 8801 */
         V4L2_IDENT_CAFE = 8801,
 
+        /* module mt9v011, just ident 8243 */
+        V4L2_IDENT_MT9V011 = 8243,
+
         /* module tw9910: just ident 9910 */
         V4L2_IDENT_TW9910 = 9910,
 
+        /* module sn9c20x: just ident 10000 */
+        V4L2_IDENT_SN9C20X = 10000,
+
         /* module msp3400: reserved range 34000-34999 and 44000-44999 */
         V4L2_IDENT_MSPX4XX  = 34000, /* generic MSPX4XX identifier, only
                                         use internally (tveeprom.c). */
@@ -234,6 +244,11 @@ enum {
         V4L2_IDENT_MT9V022IX7ATC        = 45010, /* No way to detect "normal" I77ATx */
         V4L2_IDENT_MT9V022IX7ATM        = 45015, /* and "lead free" IA7ATx chips */
         V4L2_IDENT_MT9T031              = 45020,
+        V4L2_IDENT_MT9V111              = 45031,
+        V4L2_IDENT_MT9V112              = 45032,
+
+        /* HV7131R CMOS sensor: just ident 46000 */
+        V4L2_IDENT_HV7131R              = 46000,
 
         /* module cs53132a: just ident 53132 */
         V4L2_IDENT_CS53l32A = 53132,
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 80072611d26a..c274993234e3 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -355,7 +355,17 @@ struct rfcomm_dev_list_req {
 };
 
 int  rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
+
+#ifdef CONFIG_BT_RFCOMM_TTY
 int  rfcomm_init_ttys(void);
 void rfcomm_cleanup_ttys(void);
-
+#else
+static inline int rfcomm_init_ttys(void)
+{
+        return 0;
+}
+static inline void rfcomm_cleanup_ttys(void)
+{
+}
+#endif
 #endif /* __RFCOMM_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 1a21895b732b..d1892d66701a 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -979,6 +979,10 @@ struct cfg80211_ops {
  *      channels at a later time. This can be used for devices which do not
  *      have calibration information gauranteed for frequencies or settings
  *      outside of its regulatory domain.
+ * @disable_beacon_hints: enable this if your driver needs to ensure that
+ *      passive scan flags and beaconing flags may not be lifted by cfg80211
+ *      due to regulatory beacon hints. For more information on beacon
+ *      hints read the documenation for regulatory_hint_found_beacon()
  * @reg_notifier: the driver's regulatory notification callback
  * @regd: the driver's regulatory domain, if one was requested via
  *      the regulatory_hint() API. This can be used by the driver
@@ -1004,6 +1008,7 @@ struct wiphy {
 
         bool custom_regulatory;
         bool strict_regulatory;
+        bool disable_beacon_hints;
 
         enum cfg80211_signal_type signal_type;
 
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index a632689b61b4..cbdd6284996d 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -258,8 +258,8 @@ static inline bool nf_ct_kill(struct nf_conn *ct)
 /* Update TCP window tracking data when NAT mangles the packet */
 extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
                                     unsigned int dataoff,
-                                    struct nf_conn *ct,
-                                    int dir);
+                                    struct nf_conn *ct, int dir,
+                                    s16 offset);
 
 /* Fake conntrack entry for untracked connections */
 extern struct nf_conn nf_conntrack_untracked;
diff --git a/include/net/phonet/pn_dev.h b/include/net/phonet/pn_dev.h
index 5054dc5ea2c2..29d126736611 100644
--- a/include/net/phonet/pn_dev.h
+++ b/include/net/phonet/pn_dev.h
@@ -45,6 +45,7 @@ int phonet_address_add(struct net_device *dev, u8 addr);
 int phonet_address_del(struct net_device *dev, u8 addr);
 u8 phonet_address_get(struct net_device *dev, u8 addr);
 int phonet_address_lookup(struct net *net, u8 addr);
+void phonet_address_notify(int event, struct net_device *dev, u8 addr);
 
 #define PN_NO_ADDR      0xff
 
diff --git a/include/net/protocol.h b/include/net/protocol.h
index ffa5b8b1f1df..1089d5aabd49 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -53,7 +53,7 @@ struct inet6_protocol
 
         void    (*err_handler)(struct sk_buff *skb,
                                struct inet6_skb_parm *opt,
-                               int type, int code, int offset,
+                               u8 type, u8 code, int offset,
                                __be32 info);
 
         int     (*gso_send_check)(struct sk_buff *skb);
diff --git a/include/net/rawv6.h b/include/net/rawv6.h
index 8a22599f26ba..f6b9b830df8c 100644
--- a/include/net/rawv6.h
+++ b/include/net/rawv6.h
@@ -6,7 +6,7 @@
 #include <net/protocol.h>
 
 void raw6_icmp_error(struct sk_buff *, int nexthdr,
-                int type, int code, int inner_offset, __be32);
+                u8 type, u8 code, int inner_offset, __be32);
 int raw6_local_deliver(struct sk_buff *, int);
 
 extern int                      rawv6_rcv(struct sock *sk,
diff --git a/include/net/rose.h b/include/net/rose.h
index cbd5364b2c8a..5ba9f02731eb 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -156,7 +156,7 @@ extern int  sysctl_rose_maximum_vcs;
 extern int  sysctl_rose_window_size;
 extern int  rosecmp(rose_address *, rose_address *);
 extern int  rosecmpm(rose_address *, rose_address *, unsigned short);
-extern const char *rose2asc(const rose_address *);
+extern char *rose2asc(char *buf, const rose_address *);
 extern struct sock *rose_find_socket(unsigned int, struct rose_neigh *);
 extern void rose_kill_by_neigh(struct rose_neigh *);
 extern unsigned int rose_new_lci(struct rose_neigh *);
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 9f80a7668289..d16a304cbed4 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -448,6 +448,7 @@ static inline void sctp_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
 {
         struct sctp_ulpevent *event = sctp_skb2event(skb);
 
+        skb_orphan(skb);
         skb->sk = sk;
         skb->destructor = sctp_sock_rfree;
         atomic_add(event->rmem_len, &sk->sk_rmem_alloc);
diff --git a/include/net/sock.h b/include/net/sock.h
index 07133c5e9868..950409dcec3d 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -54,6 +54,7 @@
 
 #include <linux/filter.h>
 #include <linux/rculist_nulls.h>
+#include <linux/poll.h>
 
 #include <asm/atomic.h>
 #include <net/dst.h>
@@ -103,15 +104,15 @@ struct net;
 
 /**
  *      struct sock_common - minimal network layer representation of sockets
+ *      @skc_node: main hash linkage for various protocol lookup tables
+ *      @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol
+ *      @skc_refcnt: reference count
+ *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_family: network address family
  *      @skc_state: Connection state
  *      @skc_reuse: %SO_REUSEADDR setting
  *      @skc_bound_dev_if: bound device index if != 0
- *      @skc_node: main hash linkage for various protocol lookup tables
- *      @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol
  *      @skc_bind_node: bind hash linkage for various protocol lookup tables
- *      @skc_refcnt: reference count
- *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_prot: protocol handlers inside a network family
  *      @skc_net: reference to the network namespace of this socket
  *
@@ -119,17 +120,21 @@ struct net;
  *      for struct sock and struct inet_timewait_sock.
  */
 struct sock_common {
-        unsigned short          skc_family;
-        volatile unsigned char  skc_state;
-        unsigned char           skc_reuse;
-        int                     skc_bound_dev_if;
+        /*
+         * first fields are not copied in sock_copy()
+         */
         union {
                 struct hlist_node       skc_node;
                 struct hlist_nulls_node skc_nulls_node;
         };
-        struct hlist_node       skc_bind_node;
         atomic_t                skc_refcnt;
+
         unsigned int            skc_hash;
+        unsigned short          skc_family;
+        volatile unsigned char  skc_state;
+        unsigned char           skc_reuse;
+        int                     skc_bound_dev_if;
+        struct hlist_node       skc_bind_node;
         struct proto            *skc_prot;
 #ifdef CONFIG_NET_NS
         struct net              *skc_net;
@@ -207,15 +212,17 @@ struct sock {
          * don't add nothing before this first member (__sk_common) --acme
          */
         struct sock_common      __sk_common;
+#define sk_node                 __sk_common.skc_node
+#define sk_nulls_node           __sk_common.skc_nulls_node
+#define sk_refcnt               __sk_common.skc_refcnt
+
+#define sk_copy_start           __sk_common.skc_hash
+#define sk_hash                 __sk_common.skc_hash
 #define sk_family               __sk_common.skc_family
 #define sk_state                __sk_common.skc_state
 #define sk_reuse                __sk_common.skc_reuse
 #define sk_bound_dev_if         __sk_common.skc_bound_dev_if
-#define sk_node                 __sk_common.skc_node
-#define sk_nulls_node           __sk_common.skc_nulls_node
 #define sk_bind_node            __sk_common.skc_bind_node
-#define sk_refcnt               __sk_common.skc_refcnt
-#define sk_hash                 __sk_common.skc_hash
 #define sk_prot                 __sk_common.skc_prot
 #define sk_net                  __sk_common.skc_net
         kmemcheck_bitfield_begin(flags);
@@ -1241,6 +1248,74 @@ static inline int sk_has_allocations(const struct sock *sk)
         return sk_wmem_alloc_get(sk) || sk_rmem_alloc_get(sk);
 }
 
+/**
+ * sk_has_sleeper - check if there are any waiting processes
+ * @sk: socket
+ *
+ * Returns true if socket has waiting processes
+ *
+ * The purpose of the sk_has_sleeper and sock_poll_wait is to wrap the memory
+ * barrier call. They were added due to the race found within the tcp code.
+ *
+ * Consider following tcp code paths:
+ *
+ * CPU1                  CPU2
+ *
+ * sys_select            receive packet
+ *   ...                 ...
+ *   __add_wait_queue    update tp->rcv_nxt
+ *   ...                 ...
+ *   tp->rcv_nxt check   sock_def_readable
+ *   ...                 {
+ *   schedule               ...
+ *                          if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+ *                              wake_up_interruptible(sk->sk_sleep)
+ *                          ...
+ *                       }
+ *
+ * The race for tcp fires when the __add_wait_queue changes done by CPU1 stay
+ * in its cache, and so does the tp->rcv_nxt update on CPU2 side.  The CPU1
+ * could then endup calling schedule and sleep forever if there are no more
+ * data on the socket.
+ *
+ * The sk_has_sleeper is always called right after a call to read_lock, so we
+ * can use smp_mb__after_lock barrier.
+ */
+static inline int sk_has_sleeper(struct sock *sk)
+{
+        /*
+         * We need to be sure we are in sync with the
+         * add_wait_queue modifications to the wait queue.
+         *
+         * This memory barrier is paired in the sock_poll_wait.
+         */
+        smp_mb__after_lock();
+        return sk->sk_sleep && waitqueue_active(sk->sk_sleep);
+}
+
+/**
+ * sock_poll_wait - place memory barrier behind the poll_wait call.
+ * @filp:           file
+ * @wait_address:   socket wait queue
+ * @p:              poll_table
+ *
+ * See the comments in the sk_has_sleeper function.
+ */
+static inline void sock_poll_wait(struct file *filp,
+                wait_queue_head_t *wait_address, poll_table *p)
+{
+        if (p && wait_address) {
+                poll_wait(filp, wait_address, p);
+                /*
+                 * We need to be sure we are in sync with the
+                 * socket flags modification.
+                 *
+                 * This memory barrier is paired in the sk_has_sleeper.
+                */
+                smp_mb();
+        }
+}
+
 /*
  *      Queue a received datagram if it will fit. Stream and sequenced
  *      protocols can't normally use this as they need to fit buffers in
@@ -1252,6 +1327,7 @@ static inline int sk_has_allocations(const struct sock *sk)
 
 static inline void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 {
+        skb_orphan(skb);
         skb->sk = sk;
         skb->destructor = sock_wfree;
         /*
@@ -1264,6 +1340,7 @@ static inline void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 
 static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
 {
+        skb_orphan(skb);
         skb->sk = sk;
         skb->destructor = sock_rfree;
         atomic_add(skb->truesize, &sk->sk_rmem_alloc);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 19f4150f4d4d..88af84306471 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1425,6 +1425,11 @@ struct tcp_request_sock_ops {
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_md5sig_key   *(*md5_lookup) (struct sock *sk,
                                                 struct request_sock *req);
+        int                     (*calc_md5_hash) (char *location,
+                                                  struct tcp_md5sig_key *md5,
+                                                  struct sock *sk,
+                                                  struct request_sock *req,
+                                                  struct sk_buff *skb);
 #endif
 };
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 736bca450886..9e3a3f4c1f60 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1274,7 +1274,7 @@ struct xfrm_tunnel {
 struct xfrm6_tunnel {
         int (*handler)(struct sk_buff *skb);
         int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                           int type, int code, int offset, __be32 info);
+                           u8 type, u8 code, int offset, __be32 info);
         struct xfrm6_tunnel *next;
         int priority;
 };
diff --git a/include/trace/events/block.h b/include/trace/events/block.h
index d6b05f42dd44..9a74b468a229 100644
--- a/include/trace/events/block.h
+++ b/include/trace/events/block.h
@@ -1,3 +1,6 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM block
+
 #if !defined(_TRACE_BLOCK_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_BLOCK_H
 
@@ -5,9 +8,6 @@
 #include <linux/blkdev.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM block
-
 TRACE_EVENT(block_rq_abort,
 
         TP_PROTO(struct request_queue *q, struct request *rq),
diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
index acf4cc9cd36d..7d8b5bc74185 100644
--- a/include/trace/events/ext4.h
+++ b/include/trace/events/ext4.h
@@ -1,9 +1,9 @@
-#if !defined(_TRACE_EXT4_H) || defined(TRACE_HEADER_MULTI_READ)
-#define _TRACE_EXT4_H
-
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM ext4
 
+#if !defined(_TRACE_EXT4_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_EXT4_H
+
 #include <linux/writeback.h>
 #include "../../../fs/ext4/ext4.h"
 #include "../../../fs/ext4/mballoc.h"
@@ -34,7 +34,8 @@ TRACE_EVENT(ext4_free_inode,
 
         TP_printk("dev %s ino %lu mode %d uid %u gid %u blocks %llu",
                   jbd2_dev_to_name(__entry->dev), __entry->ino, __entry->mode,
-                  __entry->uid, __entry->gid, __entry->blocks)
+                  __entry->uid, __entry->gid,
+                  (unsigned long long) __entry->blocks)
 );
 
 TRACE_EVENT(ext4_request_inode,
@@ -189,7 +190,7 @@ TRACE_EVENT(ext4_journalled_write_end,
                   __entry->copied)
 );
 
-TRACE_EVENT(ext4_da_writepage,
+TRACE_EVENT(ext4_writepage,
         TP_PROTO(struct inode *inode, struct page *page),
 
         TP_ARGS(inode, page),
@@ -341,49 +342,6 @@ TRACE_EVENT(ext4_da_write_end,
                   __entry->copied)
 );
 
-TRACE_EVENT(ext4_normal_writepage,
-        TP_PROTO(struct inode *inode, struct page *page),
-
-        TP_ARGS(inode, page),
-
-        TP_STRUCT__entry(
-                __field(        dev_t,  dev                     )
-                __field(        ino_t,  ino                     )
-                __field(        pgoff_t, index                  )
-        ),
-
-        TP_fast_assign(
-                __entry->dev    = inode->i_sb->s_dev;
-                __entry->ino    = inode->i_ino;
-                __entry->index  = page->index;
-        ),
-
-        TP_printk("dev %s ino %lu page_index %lu",
-                  jbd2_dev_to_name(__entry->dev), __entry->ino, __entry->index)
-);
-
-TRACE_EVENT(ext4_journalled_writepage,
-        TP_PROTO(struct inode *inode, struct page *page),
-
-        TP_ARGS(inode, page),
-
-        TP_STRUCT__entry(
-                __field(        dev_t,  dev                     )
-                __field(        ino_t,  ino                     )
-                __field(        pgoff_t, index                  )
-
-        ),
-
-        TP_fast_assign(
-                __entry->dev    = inode->i_sb->s_dev;
-                __entry->ino    = inode->i_ino;
-                __entry->index  = page->index;
-        ),
-
-        TP_printk("dev %s ino %lu page_index %lu",
-                  jbd2_dev_to_name(__entry->dev), __entry->ino, __entry->index)
-);
-
 TRACE_EVENT(ext4_discard_blocks,
         TP_PROTO(struct super_block *sb, unsigned long long blk,
                         unsigned long long count),
diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
index b0c7ede55eb1..1cb0c3aa11e6 100644
--- a/include/trace/events/irq.h
+++ b/include/trace/events/irq.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM irq
+
 #if !defined(_TRACE_IRQ_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_IRQ_H
 
 #include <linux/tracepoint.h>
 #include <linux/interrupt.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM irq
-
 #define softirq_name(sirq) { sirq##_SOFTIRQ, #sirq }
 #define show_softirq_name(val)                  \
         __print_symbolic(val,                   \
diff --git a/include/trace/events/jbd2.h b/include/trace/events/jbd2.h
index 845b0b4b48fd..10813fa0c8d0 100644
--- a/include/trace/events/jbd2.h
+++ b/include/trace/events/jbd2.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM jbd2
+
 #if !defined(_TRACE_JBD2_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_JBD2_H
 
 #include <linux/jbd2.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM jbd2
-
 TRACE_EVENT(jbd2_checkpoint,
 
         TP_PROTO(journal_t *journal, int result),
diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
index 9baba50d6512..1493c541f9c4 100644
--- a/include/trace/events/kmem.h
+++ b/include/trace/events/kmem.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM kmem
+
 #if !defined(_TRACE_KMEM_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_KMEM_H
 
 #include <linux/types.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM kmem
-
 /*
  * The order of these masks is important. Matching masks will be seen
  * first and the left over flags will end up showing by themselves.
diff --git a/include/trace/events/lockdep.h b/include/trace/events/lockdep.h
index 0e956c9dfd7e..bcf1d209a00d 100644
--- a/include/trace/events/lockdep.h
+++ b/include/trace/events/lockdep.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM lockdep
+
 #if !defined(_TRACE_LOCKDEP_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_LOCKDEP_H
 
 #include <linux/lockdep.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM lockdep
-
 #ifdef CONFIG_LOCKDEP
 
 TRACE_EVENT(lock_acquire,
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index 24ab5bcff7b2..8949bb7eb082 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM sched
+
 #if !defined(_TRACE_SCHED_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_SCHED_H
 
 #include <linux/sched.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM sched
-
 /*
  * Tracepoint for calling kthread_stop, performed to end a kthread:
  */
diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
index 1e8fabb57c06..e499863b9669 100644
--- a/include/trace/events/skb.h
+++ b/include/trace/events/skb.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM skb
+
 #if !defined(_TRACE_SKB_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_SKB_H
 
 #include <linux/skbuff.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM skb
-
 /*
  * Tracepoint for free an sk_buff:
  */
diff --git a/include/trace/events/workqueue.h b/include/trace/events/workqueue.h
index 035f1bff288e..fcfd9a1e4b96 100644
--- a/include/trace/events/workqueue.h
+++ b/include/trace/events/workqueue.h
@@ -1,3 +1,6 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM workqueue
+
 #if !defined(_TRACE_WORKQUEUE_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_WORKQUEUE_H
 
@@ -5,9 +8,6 @@
 #include <linux/sched.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM workqueue
-
 TRACE_EVENT(workqueue_insertion,
 
         TP_PROTO(struct task_struct *wq_thread, struct work_struct *work),
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 1867553c61e5..f64fbaae781a 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -144,6 +144,9 @@
 #undef TP_fast_assign
 #define TP_fast_assign(args...) args
 
+#undef TP_perf_assign
+#define TP_perf_assign(args...)
+
 #undef TRACE_EVENT
 #define TRACE_EVENT(call, proto, args, tstruct, func, print)            \
 static int                                                              \
@@ -345,6 +348,56 @@ static inline int ftrace_get_offsets_##call(				\
 
 #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
 
+#ifdef CONFIG_EVENT_PROFILE
+
+/*
+ * Generate the functions needed for tracepoint perf_counter support.
+ *
+ * NOTE: The insertion profile callback (ftrace_profile_<call>) is defined later
+ *
+ * static int ftrace_profile_enable_<call>(struct ftrace_event_call *event_call)
+ * {
+ *      int ret = 0;
+ *
+ *      if (!atomic_inc_return(&event_call->profile_count))
+ *              ret = register_trace_<call>(ftrace_profile_<call>);
+ *
+ *      return ret;
+ * }
+ *
+ * static void ftrace_profile_disable_<call>(struct ftrace_event_call *event_call)
+ * {
+ *      if (atomic_add_negative(-1, &event->call->profile_count))
+ *              unregister_trace_<call>(ftrace_profile_<call>);
+ * }
+ *
+ */
+
+#undef TRACE_EVENT
+#define TRACE_EVENT(call, proto, args, tstruct, assign, print)          \
+                                                                        \
+static void ftrace_profile_##call(proto);                               \
+                                                                        \
+static int ftrace_profile_enable_##call(struct ftrace_event_call *event_call) \
+{                                                                       \
+        int ret = 0;                                                    \
+                                                                        \
+        if (!atomic_inc_return(&event_call->profile_count))             \
+                ret = register_trace_##call(ftrace_profile_##call);     \
+                                                                        \
+        return ret;                                                     \
+}                                                                       \
+                                                                        \
+static void ftrace_profile_disable_##call(struct ftrace_event_call *event_call)\
+{                                                                       \
+        if (atomic_add_negative(-1, &event_call->profile_count))        \
+                unregister_trace_##call(ftrace_profile_##call);         \
+}
+
+#include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
+
+#endif
+
 /*
  * Stage 4 of the trace events.
  *
@@ -447,28 +500,6 @@ static inline int ftrace_get_offsets_##call(				\
 #define TP_FMT(fmt, args...)    fmt "\n", ##args
 
 #ifdef CONFIG_EVENT_PROFILE
-#define _TRACE_PROFILE(call, proto, args)                               \
-static void ftrace_profile_##call(proto)                                \
-{                                                                       \
-        extern void perf_tpcounter_event(int);                          \
-        perf_tpcounter_event(event_##call.id);                          \
-}                                                                       \
-                                                                        \
-static int ftrace_profile_enable_##call(struct ftrace_event_call *event_call) \
-{                                                                       \
-        int ret = 0;                                                    \
-                                                                        \
-        if (!atomic_inc_return(&event_call->profile_count))             \
-                ret = register_trace_##call(ftrace_profile_##call);     \
-                                                                        \
-        return ret;                                                     \
-}                                                                       \
-                                                                        \
-static void ftrace_profile_disable_##call(struct ftrace_event_call *event_call)\
-{                                                                       \
-        if (atomic_add_negative(-1, &event_call->profile_count))        \
-                unregister_trace_##call(ftrace_profile_##call);         \
-}
 
 #define _TRACE_PROFILE_INIT(call)                                       \
         .profile_count = ATOMIC_INIT(-1),                               \
@@ -476,7 +507,6 @@ static void ftrace_profile_disable_##call(struct ftrace_event_call *event_call)\
         .profile_disable = ftrace_profile_disable_##call,
 
 #else
-#define _TRACE_PROFILE(call, proto, args)
 #define _TRACE_PROFILE_INIT(call)
 #endif
 
@@ -502,7 +532,6 @@ static void ftrace_profile_disable_##call(struct ftrace_event_call *event_call)\
 
 #undef TRACE_EVENT
 #define TRACE_EVENT(call, proto, args, tstruct, assign, print)          \
-_TRACE_PROFILE(call, PARAMS(proto), PARAMS(args))                       \
                                                                         \
 static struct ftrace_event_call event_##call;                           \
                                                                         \
@@ -586,6 +615,110 @@ __attribute__((section("_ftrace_events"))) event_##call = {		\
 
 #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
 
-#undef _TRACE_PROFILE
+/*
+ * Define the insertion callback to profile events
+ *
+ * The job is very similar to ftrace_raw_event_<call> except that we don't
+ * insert in the ring buffer but in a perf counter.
+ *
+ * static void ftrace_profile_<call>(proto)
+ * {
+ *      struct ftrace_data_offsets_<call> __maybe_unused __data_offsets;
+ *      struct ftrace_event_call *event_call = &event_<call>;
+ *      extern void perf_tpcounter_event(int, u64, u64, void *, int);
+ *      struct ftrace_raw_##call *entry;
+ *      u64 __addr = 0, __count = 1;
+ *      unsigned long irq_flags;
+ *      int __entry_size;
+ *      int __data_size;
+ *      int pc;
+ *
+ *      local_save_flags(irq_flags);
+ *      pc = preempt_count();
+ *
+ *      __data_size = ftrace_get_offsets_<call>(&__data_offsets, args);
+ *
+ *      // Below we want to get the aligned size by taking into account
+ *      // the u32 field that will later store the buffer size
+ *      __entry_size = ALIGN(__data_size + sizeof(*entry) + sizeof(u32),
+ *                           sizeof(u64));
+ *      __entry_size -= sizeof(u32);
+ *
+ *      do {
+ *              char raw_data[__entry_size]; <- allocate our sample in the stack
+ *              struct trace_entry *ent;
+ *
+ *              zero dead bytes from alignment to avoid stack leak to userspace:
+ *
+ *              *(u64 *)(&raw_data[__entry_size - sizeof(u64)]) = 0ULL;
+ *              entry = (struct ftrace_raw_<call> *)raw_data;
+ *              ent = &entry->ent;
+ *              tracing_generic_entry_update(ent, irq_flags, pc);
+ *              ent->type = event_call->id;
+ *
+ *              <tstruct> <- do some jobs with dynamic arrays
+ *
+ *              <assign>  <- affect our values
+ *
+ *              perf_tpcounter_event(event_call->id, __addr, __count, entry,
+ *                           __entry_size);  <- submit them to perf counter
+ *      } while (0);
+ *
+ * }
+ */
+
+#ifdef CONFIG_EVENT_PROFILE
+
+#undef __perf_addr
+#define __perf_addr(a) __addr = (a)
+
+#undef __perf_count
+#define __perf_count(c) __count = (c)
+
+#undef TRACE_EVENT
+#define TRACE_EVENT(call, proto, args, tstruct, assign, print)          \
+static void ftrace_profile_##call(proto)                                \
+{                                                                       \
+        struct ftrace_data_offsets_##call __maybe_unused __data_offsets;\
+        struct ftrace_event_call *event_call = &event_##call;           \
+        extern void perf_tpcounter_event(int, u64, u64, void *, int);   \
+        struct ftrace_raw_##call *entry;                                \
+        u64 __addr = 0, __count = 1;                                    \
+        unsigned long irq_flags;                                        \
+        int __entry_size;                                               \
+        int __data_size;                                                \
+        int pc;                                                         \
+                                                                        \
+        local_save_flags(irq_flags);                                    \
+        pc = preempt_count();                                           \
+                                                                        \
+        __data_size = ftrace_get_offsets_##call(&__data_offsets, args); \
+        __entry_size = ALIGN(__data_size + sizeof(*entry) + sizeof(u32),\
+                             sizeof(u64));                              \
+        __entry_size -= sizeof(u32);                                    \
+                                                                        \
+        do {                                                            \
+                char raw_data[__entry_size];                            \
+                struct trace_entry *ent;                                \
+                                                                        \
+                *(u64 *)(&raw_data[__entry_size - sizeof(u64)]) = 0ULL; \
+                entry = (struct ftrace_raw_##call *)raw_data;           \
+                ent = &entry->ent;                                      \
+                tracing_generic_entry_update(ent, irq_flags, pc);       \
+                ent->type = event_call->id;                             \
+                                                                        \
+                tstruct                                                 \
+                                                                        \
+                { assign; }                                             \
+                                                                        \
+                perf_tpcounter_event(event_call->id, __addr, __count, entry,\
+                             __entry_size);                             \
+        } while (0);                                                    \
+                                                                        \
+}
+
+#include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
+#endif /* CONFIG_EVENT_PROFILE */
+
 #undef _TRACE_PROFILE_INIT