Merge branch 'linus' into perfcounters/core

Conflicts:
	arch/x86/include/asm/kmap_types.h
	include/linux/mm.h

	include/asm-generic/kmap_types.h

Merge reason: We crossed changes with kmap_types.h cleanups in mainline.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

207 files changed, 9132 insertions, 1622 deletions

diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index 4db89e98535d..82ec6a3c0500 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -47,7 +47,7 @@
 
 /* Current ACPICA subsystem version in YYYYMMDD format */
 
-#define ACPI_CA_VERSION                 0x20090320
+#define ACPI_CA_VERSION                 0x20090521
 
 #include "actypes.h"
 #include "actbl.h"
@@ -201,6 +201,8 @@ acpi_evaluate_object_typed(acpi_handle object,
 acpi_status
 acpi_get_object_info(acpi_handle handle, struct acpi_buffer *return_buffer);
 
+acpi_status acpi_install_method(u8 *buffer);
+
 acpi_status
 acpi_get_next_object(acpi_object_type type,
                      acpi_handle parent,
@@ -375,7 +377,7 @@ acpi_status acpi_leave_sleep_state_prep(u8 sleep_state);
 acpi_status acpi_leave_sleep_state(u8 sleep_state);
 
 /*
- * Debug output
+ * Error/Warning output
  */
 void ACPI_INTERNAL_VAR_XFACE
 acpi_error(const char *module_name,
@@ -394,6 +396,9 @@ void ACPI_INTERNAL_VAR_XFACE
 acpi_info(const char *module_name,
           u32 line_number, const char *format, ...) ACPI_PRINTF_LIKE(3);
 
+/*
+ * Debug output
+ */
 #ifdef ACPI_DEBUG_OUTPUT
 
 void ACPI_INTERNAL_VAR_XFACE
diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
index f555d927f7c0..37ba576d06e8 100644
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -429,20 +429,12 @@ typedef unsigned long long acpi_integer;
 
 /* Data manipulation */
 
-#define ACPI_LOWORD(l)                  ((u16)(u32)(l))
-#define ACPI_HIWORD(l)                  ((u16)((((u32)(l)) >> 16) & 0xFFFF))
-#define ACPI_LOBYTE(l)                  ((u8)(u16)(l))
-#define ACPI_HIBYTE(l)                  ((u8)((((u16)(l)) >> 8) & 0xFF))
-
-/* Full 64-bit integer must be available on both 32-bit and 64-bit platforms */
-
-struct acpi_integer_overlay {
-        u32 lo_dword;
-        u32 hi_dword;
-};
-
-#define ACPI_LODWORD(integer)           (ACPI_CAST_PTR (struct acpi_integer_overlay, &integer)->lo_dword)
-#define ACPI_HIDWORD(integer)           (ACPI_CAST_PTR (struct acpi_integer_overlay, &integer)->hi_dword)
+#define ACPI_LOBYTE(integer)            ((u8)   (u16)(integer))
+#define ACPI_HIBYTE(integer)            ((u8) (((u16)(integer)) >> 8))
+#define ACPI_LOWORD(integer)            ((u16)  (u32)(integer))
+#define ACPI_HIWORD(integer)            ((u16)(((u32)(integer)) >> 16))
+#define ACPI_LODWORD(integer64)         ((u32)  (u64)(integer64))
+#define ACPI_HIDWORD(integer64)         ((u32)(((u64)(integer64)) >> 32))
 
 #define ACPI_SET_BIT(target,bit)        ((target) |= (bit))
 #define ACPI_CLEAR_BIT(target,bit)      ((target) &= ~(bit))
diff --git a/include/acpi/platform/acgcc.h b/include/acpi/platform/acgcc.h
index 8e2cdc57b197..935c5d7fc86e 100644
--- a/include/acpi/platform/acgcc.h
+++ b/include/acpi/platform/acgcc.h
@@ -62,4 +62,8 @@
  */
 #define ACPI_UNUSED_VAR __attribute__ ((unused))
 
+#ifdef _ANSI
+#define inline
+#endif
+
 #endif                          /* __ACGCC_H__ */
diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h
index 6d49b2a498c4..fcb8e4b159b1 100644
--- a/include/acpi/platform/aclinux.h
+++ b/include/acpi/platform/aclinux.h
@@ -1,11 +1,11 @@
 /******************************************************************************
  *
- * Name: aclinux.h - OS specific defines, etc.
+ * Name: aclinux.h - OS specific defines, etc. for Linux
  *
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2008, Intel Corp.
+ * Copyright (C) 2000 - 2009, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -44,10 +44,13 @@
 #ifndef __ACLINUX_H__
 #define __ACLINUX_H__
 
+/* Common (in-kernel/user-space) ACPICA configuration */
+
 #define ACPI_USE_SYSTEM_CLIBRARY
 #define ACPI_USE_DO_WHILE_0
 #define ACPI_MUTEX_TYPE             ACPI_BINARY_SEMAPHORE
 
+
 #ifdef __KERNEL__
 
 #include <linux/string.h>
@@ -63,15 +66,18 @@
 #include <linux/spinlock_types.h>
 #include <asm/current.h>
 
-/* Host-dependent types and defines */
+/* Host-dependent types and defines for in-kernel ACPICA */
 
 #define ACPI_MACHINE_WIDTH          BITS_PER_LONG
-#define acpi_cache_t                        struct kmem_cache
-#define acpi_spinlock                   spinlock_t *
 #define ACPI_EXPORT_SYMBOL(symbol)  EXPORT_SYMBOL(symbol);
 #define strtoul                     simple_strtoul
 
-#else                           /* !__KERNEL__ */
+#define acpi_cache_t                        struct kmem_cache
+#define acpi_spinlock                       spinlock_t *
+#define acpi_cpu_flags                      unsigned long
+#define acpi_thread_id                      struct task_struct *
+
+#else /* !__KERNEL__ */
 
 #include <stdarg.h>
 #include <string.h>
@@ -79,6 +85,11 @@
 #include <ctype.h>
 #include <unistd.h>
 
+/* Host-dependent types and defines for user-space ACPICA */
+
+#define ACPI_FLUSH_CPU_CACHE()
+#define acpi_thread_id                      pthread_t
+
 #if defined(__ia64__) || defined(__x86_64__)
 #define ACPI_MACHINE_WIDTH          64
 #define COMPILER_DEPENDENT_INT64    long
@@ -94,17 +105,17 @@
 #define __cdecl
 #endif
 
-#define ACPI_FLUSH_CPU_CACHE()
-#endif                          /* __KERNEL__ */
+#endif /* __KERNEL__ */
 
 /* Linux uses GCC */
 
 #include "acgcc.h"
 
-#define acpi_cpu_flags unsigned long
-
-#define acpi_thread_id struct task_struct *
 
+#ifdef __KERNEL__
+/*
+ * Overrides for in-kernel ACPICA
+ */
 static inline acpi_thread_id acpi_os_get_thread_id(void)
 {
         return current;
@@ -119,30 +130,32 @@ static inline acpi_thread_id acpi_os_get_thread_id(void)
 #include <acpi/actypes.h>
 static inline void *acpi_os_allocate(acpi_size size)
 {
-        return kmalloc(size, irqs_disabled()? GFP_ATOMIC : GFP_KERNEL);
+        return kmalloc(size, irqs_disabled() ? GFP_ATOMIC : GFP_KERNEL);
 }
+
 static inline void *acpi_os_allocate_zeroed(acpi_size size)
 {
-        return kzalloc(size, irqs_disabled()? GFP_ATOMIC : GFP_KERNEL);
+        return kzalloc(size, irqs_disabled() ? GFP_ATOMIC : GFP_KERNEL);
 }
 
 static inline void *acpi_os_acquire_object(acpi_cache_t * cache)
 {
         return kmem_cache_zalloc(cache,
-                                 irqs_disabled()? GFP_ATOMIC : GFP_KERNEL);
+                irqs_disabled() ? GFP_ATOMIC : GFP_KERNEL);
 }
 
-#define ACPI_ALLOCATE(a)        acpi_os_allocate(a)
-#define ACPI_ALLOCATE_ZEROED(a) acpi_os_allocate_zeroed(a)
-#define ACPI_FREE(a)            kfree(a)
+#define ACPI_ALLOCATE(a)        acpi_os_allocate(a)
+#define ACPI_ALLOCATE_ZEROED(a) acpi_os_allocate_zeroed(a)
+#define ACPI_FREE(a)            kfree(a)
 
-/*
- * We need to show where it is safe to preempt execution of ACPICA
- */
-#define ACPI_PREEMPTION_POINT()         \
-        do {                            \
-                if (!irqs_disabled())   \
-                        cond_resched(); \
+/* Used within ACPICA to show where it is safe to preempt execution */
+
+#define ACPI_PREEMPTION_POINT() \
+        do { \
+                if (!irqs_disabled()) \
+                        cond_resched(); \
         } while (0)
 
-#endif                          /* __ACLINUX_H__ */
+#endif /* __KERNEL__ */
+
+#endif /* __ACLINUX_H__ */
diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
new file mode 100644
index 000000000000..b18ce4f9ee3d
--- /dev/null
+++ b/include/asm-generic/atomic64.h
@@ -0,0 +1,42 @@
+/*
+ * Generic implementation of 64-bit atomics using spinlocks,
+ * useful on processors that don't have 64-bit atomic instructions.
+ *
+ * Copyright © 2009 Paul Mackerras, IBM Corp. <paulus@au1.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#ifndef _ASM_GENERIC_ATOMIC64_H
+#define _ASM_GENERIC_ATOMIC64_H
+
+typedef struct {
+        long long counter;
+} atomic64_t;
+
+#define ATOMIC64_INIT(i)        { (i) }
+
+extern long long atomic64_read(const atomic64_t *v);
+extern void      atomic64_set(atomic64_t *v, long long i);
+extern void      atomic64_add(long long a, atomic64_t *v);
+extern long long atomic64_add_return(long long a, atomic64_t *v);
+extern void      atomic64_sub(long long a, atomic64_t *v);
+extern long long atomic64_sub_return(long long a, atomic64_t *v);
+extern long long atomic64_dec_if_positive(atomic64_t *v);
+extern long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n);
+extern long long atomic64_xchg(atomic64_t *v, long long new);
+extern int       atomic64_add_unless(atomic64_t *v, long long a, long long u);
+
+#define atomic64_add_negative(a, v)     (atomic64_add_return((a), (v)) < 0)
+#define atomic64_inc(v)                 atomic64_add(1LL, (v))
+#define atomic64_inc_return(v)          atomic64_add_return(1LL, (v))
+#define atomic64_inc_and_test(v)        (atomic64_inc_return(v) == 0)
+#define atomic64_sub_and_test(a, v)     (atomic64_sub_return((a), (v)) == 0)
+#define atomic64_dec(v)                 atomic64_sub(1LL, (v))
+#define atomic64_dec_return(v)          atomic64_sub_return(1LL, (v))
+#define atomic64_dec_and_test(v)        (atomic64_dec_return((v)) == 0)
+#define atomic64_inc_not_zero(v)        atomic64_add_unless((v), 1LL, 0LL)
+
+#endif  /*  _ASM_GENERIC_ATOMIC64_H  */
diff --git a/include/asm-generic/errno.h b/include/asm-generic/errno.h
index e8852c092fea..28cc03bf19e6 100644
--- a/include/asm-generic/errno.h
+++ b/include/asm-generic/errno.h
@@ -106,4 +106,6 @@
 #define EOWNERDEAD      130     /* Owner died */
 #define ENOTRECOVERABLE 131     /* State not recoverable */
 
+#define ERFKILL         132     /* Operation not possible due to RF-kill */
+
 #endif
diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
index 58c33055c304..eddbce0f9fb9 100644
--- a/include/asm-generic/kmap_types.h
+++ b/include/asm-generic/kmap_types.h
@@ -1,7 +1,7 @@
 #ifndef _ASM_GENERIC_KMAP_TYPES_H
 #define _ASM_GENERIC_KMAP_TYPES_H
 
-#ifdef CONFIG_DEBUG_HIGHMEM
+#ifdef __WITH_KM_FENCE
 # define D(n) __KM_FENCE_##n ,
 #else
 # define D(n)
@@ -24,7 +24,10 @@ D(12)	KM_SOFTIRQ1,
 D(13)   KM_SYNC_ICACHE,
 D(14)   KM_SYNC_DCACHE,
 D(15)   KM_UML_USERCOPY, /* UML specific, for copy_*_user - used in do_op_one_page */
-D(16)   KM_TYPE_NR
+D(16)   KM_IRQ_PTE,
+D(17)   KM_NMI,
+D(18)   KM_NMI_PTE,
+D(19)   KM_TYPE_NR
 };
 
 #undef D
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index f1736ca7922c..6bdba10fef4a 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -1,4 +1,57 @@
-#include <linux/section-names.h>
+/*
+ * Helper macros to support writing architecture specific
+ * linker scripts.
+ *
+ * A minimal linker scripts has following content:
+ * [This is a sample, architectures may have special requiriements]
+ *
+ * OUTPUT_FORMAT(...)
+ * OUTPUT_ARCH(...)
+ * ENTRY(...)
+ * SECTIONS
+ * {
+ *      . = START;
+ *      __init_begin = .;
+ *      HEAD_TEXT_SECTION
+ *      INIT_TEXT_SECTION(PAGE_SIZE)
+ *      INIT_DATA_SECTION(...)
+ *      PERCPU(PAGE_SIZE)
+ *      __init_end = .;
+ *
+ *      _stext = .;
+ *      TEXT_SECTION = 0
+ *      _etext = .;
+ *
+ *      _sdata = .;
+ *      RO_DATA_SECTION(PAGE_SIZE)
+ *      RW_DATA_SECTION(...)
+ *      _edata = .;
+ *
+ *      EXCEPTION_TABLE(...)
+ *      NOTES
+ *
+ *      __bss_start = .;
+ *      BSS_SECTION(0, 0)
+ *      __bss_stop = .;
+ *      _end = .;
+ *
+ *      /DISCARD/ : {
+ *              EXIT_TEXT
+ *              EXIT_DATA
+ *              EXIT_CALL
+ *      }
+ *      STABS_DEBUG
+ *      DWARF_DEBUG
+ * }
+ *
+ * [__init_begin, __init_end] is the init section that may be freed after init
+ * [_stext, _etext] is the text section
+ * [_sdata, _edata] is the data section
+ *
+ * Some of the included output section have their own set of constants.
+ * Examples are: [__initramfs_start, __initramfs_end] for initramfs and
+ *               [__nosave_begin, __nosave_end] for the nosave data
+ */
 
 #ifndef LOAD_OFFSET
 #define LOAD_OFFSET 0
@@ -116,7 +169,36 @@
         FTRACE_EVENTS()                                                 \
         TRACE_SYSCALLS()
 
-#define RO_DATA(align)                                                  \
+/*
+ * Data section helpers
+ */
+#define NOSAVE_DATA                                                     \
+        . = ALIGN(PAGE_SIZE);                                           \
+        VMLINUX_SYMBOL(__nosave_begin) = .;                             \
+        *(.data.nosave)                                                 \
+        . = ALIGN(PAGE_SIZE);                                           \
+        VMLINUX_SYMBOL(__nosave_end) = .;
+
+#define PAGE_ALIGNED_DATA(page_align)                                   \
+        . = ALIGN(page_align);                                          \
+        *(.data.page_aligned)
+
+#define READ_MOSTLY_DATA(align)                                         \
+        . = ALIGN(align);                                               \
+        *(.data.read_mostly)
+
+#define CACHELINE_ALIGNED_DATA(align)                                   \
+        . = ALIGN(align);                                               \
+        *(.data.cacheline_aligned)
+
+#define INIT_TASK(align)                                                \
+        . = ALIGN(align);                                               \
+        *(.data.init_task)
+
+/*
+ * Read only Data
+ */
+#define RO_DATA_SECTION(align)                                          \
         . = ALIGN((align));                                             \
         .rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {           \
                 VMLINUX_SYMBOL(__start_rodata) = .;                     \
@@ -270,9 +352,10 @@
         }                                                               \
         . = ALIGN((align));
 
-/* RODATA provided for backward compatibility.
+/* RODATA & RO_DATA provided for backward compatibility.
  * All archs are supposed to use RO_DATA() */
-#define RODATA RO_DATA(4096)
+#define RODATA          RO_DATA_SECTION(4096)
+#define RO_DATA(align)  RO_DATA_SECTION(align)
 
 #define SECURITY_INIT                                                   \
         .security_initcall.init : AT(ADDR(.security_initcall.init) - LOAD_OFFSET) { \
@@ -330,16 +413,42 @@
 #endif
 
 /* Section used for early init (in .S files) */
-#define HEAD_TEXT  *(HEAD_TEXT_SECTION)
+#define HEAD_TEXT  *(.head.text)
+
+#define HEAD_TEXT_SECTION                                                       \
+        .head.text : AT(ADDR(.head.text) - LOAD_OFFSET) {               \
+                HEAD_TEXT                                               \
+        }
+
+/*
+ * Exception table
+ */
+#define EXCEPTION_TABLE(align)                                          \
+        . = ALIGN(align);                                               \
+        __ex_table : AT(ADDR(__ex_table) - LOAD_OFFSET) {               \
+                VMLINUX_SYMBOL(__start___ex_table) = .;                 \
+                *(__ex_table)                                           \
+                VMLINUX_SYMBOL(__stop___ex_table) = .;                  \
+        }
+
+/*
+ * Init task
+ */
+#define INIT_TASK_DATA(align)                                           \
+        . = ALIGN(align);                                               \
+        .data.init_task : {                                             \
+                INIT_TASK                                               \
+        }
 
 /* init and exit section handling */
 #define INIT_DATA                                                       \
         *(.init.data)                                                   \
         DEV_DISCARD(init.data)                                          \
-        DEV_DISCARD(init.rodata)                                        \
         CPU_DISCARD(init.data)                                          \
-        CPU_DISCARD(init.rodata)                                        \
         MEM_DISCARD(init.data)                                          \
+        *(.init.rodata)                                                 \
+        DEV_DISCARD(init.rodata)                                        \
+        CPU_DISCARD(init.rodata)                                        \
         MEM_DISCARD(init.rodata)
 
 #define INIT_TEXT                                                       \
@@ -363,9 +472,35 @@
         CPU_DISCARD(exit.text)                                          \
         MEM_DISCARD(exit.text)
 
-                /* DWARF debug sections.
-                Symbols in the DWARF debugging sections are relative to
-                the beginning of the section so we begin them at 0.  */
+#define EXIT_CALL                                                       \
+        *(.exitcall.exit)
+
+/*
+ * bss (Block Started by Symbol) - uninitialized data
+ * zeroed during startup
+ */
+#define SBSS                                                            \
+        .sbss : AT(ADDR(.sbss) - LOAD_OFFSET) {                         \
+                *(.sbss)                                                \
+                *(.scommon)                                             \
+        }
+
+#define BSS(bss_align)                                                  \
+        . = ALIGN(bss_align);                                           \
+        .bss : AT(ADDR(.bss) - LOAD_OFFSET) {                           \
+                VMLINUX_SYMBOL(__bss_start) = .;                        \
+                *(.bss.page_aligned)                                    \
+                *(.dynbss)                                              \
+                *(.bss)                                                 \
+                *(COMMON)                                               \
+                VMLINUX_SYMBOL(__bss_stop) = .;                         \
+        }
+
+/*
+ * DWARF debug sections.
+ * Symbols in the DWARF debugging sections are relative to
+ * the beginning of the section so we begin them at 0.
+ */
 #define DWARF_DEBUG                                                     \
                 /* DWARF 1 */                                           \
                 .debug          0 : { *(.debug) }                       \
@@ -432,6 +567,12 @@
                 VMLINUX_SYMBOL(__stop_notes) = .;                       \
         }
 
+#define INIT_SETUP(initsetup_align)                                     \
+                . = ALIGN(initsetup_align);                             \
+                VMLINUX_SYMBOL(__setup_start) = .;                      \
+                *(.init.setup)                                          \
+                VMLINUX_SYMBOL(__setup_end) = .;
+
 #define INITCALLS                                                       \
         *(.initcallearly.init)                                          \
         VMLINUX_SYMBOL(__early_initcall_end) = .;                       \
@@ -453,6 +594,31 @@
         *(.initcall7.init)                                              \
         *(.initcall7s.init)
 
+#define INIT_CALLS                                                      \
+                VMLINUX_SYMBOL(__initcall_start) = .;                   \
+                INITCALLS                                               \
+                VMLINUX_SYMBOL(__initcall_end) = .;
+
+#define CON_INITCALL                                                    \
+                VMLINUX_SYMBOL(__con_initcall_start) = .;               \
+                *(.con_initcall.init)                                   \
+                VMLINUX_SYMBOL(__con_initcall_end) = .;
+
+#define SECURITY_INITCALL                                               \
+                VMLINUX_SYMBOL(__security_initcall_start) = .;          \
+                *(.security_initcall.init)                              \
+                VMLINUX_SYMBOL(__security_initcall_end) = .;
+
+#ifdef CONFIG_BLK_DEV_INITRD
+#define INIT_RAM_FS                                                     \
+        . = ALIGN(PAGE_SIZE);                                           \
+        VMLINUX_SYMBOL(__initramfs_start) = .;                          \
+        *(.init.ramfs)                                                  \
+        VMLINUX_SYMBOL(__initramfs_end) = .;
+#else
+#define INITRAMFS
+#endif
+
 /**
  * PERCPU_VADDR - define output section for percpu area
  * @vaddr: explicit base address (optional)
@@ -509,3 +675,58 @@
                 *(.data.percpu.shared_aligned)                          \
                 VMLINUX_SYMBOL(__per_cpu_end) = .;                      \
         }
+
+
+/*
+ * Definition of the high level *_SECTION macros
+ * They will fit only a subset of the architectures
+ */
+
+
+/*
+ * Writeable data.
+ * All sections are combined in a single .data section.
+ * The sections following CONSTRUCTORS are arranged so their
+ * typical alignment matches.
+ * A cacheline is typical/always less than a PAGE_SIZE so
+ * the sections that has this restriction (or similar)
+ * is located before the ones requiring PAGE_SIZE alignment.
+ * NOSAVE_DATA starts and ends with a PAGE_SIZE alignment which
+ * matches the requirment of PAGE_ALIGNED_DATA.
+ *
+ * use 0 as page_align if page_aligned data is not used */
+#define RW_DATA_SECTION(cacheline, nosave, pagealigned, inittask)       \
+        . = ALIGN(PAGE_SIZE);                                           \
+        .data : AT(ADDR(.data) - LOAD_OFFSET) {                         \
+                INIT_TASK(inittask)                                     \
+                CACHELINE_ALIGNED_DATA(cacheline)                       \
+                READ_MOSTLY_DATA(cacheline)                             \
+                DATA_DATA                                               \
+                CONSTRUCTORS                                            \
+                NOSAVE_DATA(nosave)                                     \
+                PAGE_ALIGNED_DATA(pagealigned)                          \
+        }
+
+#define INIT_TEXT_SECTION(inittext_align)                               \
+        . = ALIGN(inittext_align);                                      \
+        .init.text : AT(ADDR(.init.text) - LOAD_OFFSET) {               \
+                VMLINUX_SYMBOL(_sinittext) = .;                         \
+                INIT_TEXT                                               \
+                VMLINUX_SYMBOL(_einittext) = .;                         \
+        }
+
+#define INIT_DATA_SECTION(initsetup_align)                              \
+        .init.data : AT(ADDR(.init.data) - LOAD_OFFSET) {               \
+                INIT_DATA                                               \
+                INIT_SETUP(initsetup_align)                             \
+                INIT_CALLS                                              \
+                CON_INITCALL                                            \
+                SECURITY_INITCALL                                       \
+                INIT_RAM_FS                                             \
+        }
+
+#define BSS_SECTION(sbss_align, bss_align)                              \
+        SBSS                                                            \
+        BSS(bss_align)                                                  \
+        . = ALIGN(4);
+
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index f8634ab53b8f..45c18672b093 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -254,8 +254,8 @@
         {0x1002, 0x940A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R600|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x940B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R600|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x940F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R600|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x94A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x94A1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94A1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94B1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94B3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x94B5, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
@@ -273,8 +273,8 @@
         {0x1002, 0x9456, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x945A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x945B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x9460, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x9462, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9460, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9462, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x946A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x946B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x947A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index fe3e3a4b4aed..41862e9a4c20 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -496,6 +496,16 @@ typedef struct {
 #define DRM_RADEON_SETPARAM   0x19
 #define DRM_RADEON_SURF_ALLOC 0x1a
 #define DRM_RADEON_SURF_FREE  0x1b
+/* KMS ioctl */
+#define DRM_RADEON_GEM_INFO             0x1c
+#define DRM_RADEON_GEM_CREATE           0x1d
+#define DRM_RADEON_GEM_MMAP             0x1e
+#define DRM_RADEON_GEM_PREAD            0x21
+#define DRM_RADEON_GEM_PWRITE           0x22
+#define DRM_RADEON_GEM_SET_DOMAIN       0x23
+#define DRM_RADEON_GEM_WAIT_IDLE        0x24
+#define DRM_RADEON_CS                   0x26
+#define DRM_RADEON_INFO                 0x27
 
 #define DRM_IOCTL_RADEON_CP_INIT    DRM_IOW( DRM_COMMAND_BASE + DRM_RADEON_CP_INIT, drm_radeon_init_t)
 #define DRM_IOCTL_RADEON_CP_START   DRM_IO(  DRM_COMMAND_BASE + DRM_RADEON_CP_START)
@@ -524,6 +534,17 @@ typedef struct {
 #define DRM_IOCTL_RADEON_SETPARAM   DRM_IOW( DRM_COMMAND_BASE + DRM_RADEON_SETPARAM, drm_radeon_setparam_t)
 #define DRM_IOCTL_RADEON_SURF_ALLOC DRM_IOW( DRM_COMMAND_BASE + DRM_RADEON_SURF_ALLOC, drm_radeon_surface_alloc_t)
 #define DRM_IOCTL_RADEON_SURF_FREE  DRM_IOW( DRM_COMMAND_BASE + DRM_RADEON_SURF_FREE, drm_radeon_surface_free_t)
+/* KMS */
+#define DRM_IOCTL_RADEON_GEM_INFO       DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_INFO, struct drm_radeon_gem_info)
+#define DRM_IOCTL_RADEON_GEM_CREATE     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_CREATE, struct drm_radeon_gem_create)
+#define DRM_IOCTL_RADEON_GEM_MMAP       DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_MMAP, struct drm_radeon_gem_mmap)
+#define DRM_IOCTL_RADEON_GEM_PREAD      DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_PREAD, struct drm_radeon_gem_pread)
+#define DRM_IOCTL_RADEON_GEM_PWRITE     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_PWRITE, struct drm_radeon_gem_pwrite)
+#define DRM_IOCTL_RADEON_GEM_SET_DOMAIN DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_SET_DOMAIN, struct drm_radeon_gem_set_domain)
+#define DRM_IOCTL_RADEON_GEM_WAIT_IDLE  DRM_IOW(DRM_COMMAND_BASE + DRM_RADEON_GEM_WAIT_IDLE, struct drm_radeon_gem_wait_idle)
+#define DRM_IOCTL_RADEON_CS             DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_CS, struct drm_radeon_cs)
+#define DRM_IOCTL_RADEON_INFO           DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_INFO, struct drm_radeon_info)
+
 
 typedef struct drm_radeon_init {
         enum {
@@ -682,6 +703,7 @@ typedef struct drm_radeon_indirect {
 #define RADEON_PARAM_VBLANK_CRTC           13   /* VBLANK CRTC */
 #define RADEON_PARAM_FB_LOCATION           14   /* FB location */
 #define RADEON_PARAM_NUM_GB_PIPES          15   /* num GB pipes */
+#define RADEON_PARAM_DEVICE_ID             16
 
 typedef struct drm_radeon_getparam {
         int param;
@@ -751,4 +773,112 @@ typedef struct drm_radeon_surface_free {
 #define DRM_RADEON_VBLANK_CRTC1         1
 #define DRM_RADEON_VBLANK_CRTC2         2
 
+/*
+ * Kernel modesetting world below.
+ */
+#define RADEON_GEM_DOMAIN_CPU           0x1
+#define RADEON_GEM_DOMAIN_GTT           0x2
+#define RADEON_GEM_DOMAIN_VRAM          0x4
+
+struct drm_radeon_gem_info {
+        uint64_t        gart_size;
+        uint64_t        vram_size;
+        uint64_t        vram_visible;
+};
+
+#define RADEON_GEM_NO_BACKING_STORE 1
+
+struct drm_radeon_gem_create {
+        uint64_t        size;
+        uint64_t        alignment;
+        uint32_t        handle;
+        uint32_t        initial_domain;
+        uint32_t        flags;
+};
+
+struct drm_radeon_gem_mmap {
+        uint32_t        handle;
+        uint32_t        pad;
+        uint64_t        offset;
+        uint64_t        size;
+        uint64_t        addr_ptr;
+};
+
+struct drm_radeon_gem_set_domain {
+        uint32_t        handle;
+        uint32_t        read_domains;
+        uint32_t        write_domain;
+};
+
+struct drm_radeon_gem_wait_idle {
+        uint32_t        handle;
+        uint32_t        pad;
+};
+
+struct drm_radeon_gem_busy {
+        uint32_t        handle;
+        uint32_t        busy;
+};
+
+struct drm_radeon_gem_pread {
+        /** Handle for the object being read. */
+        uint32_t handle;
+        uint32_t pad;
+        /** Offset into the object to read from */
+        uint64_t offset;
+        /** Length of data to read */
+        uint64_t size;
+        /** Pointer to write the data into. */
+        /* void *, but pointers are not 32/64 compatible */
+        uint64_t data_ptr;
+};
+
+struct drm_radeon_gem_pwrite {
+        /** Handle for the object being written to. */
+        uint32_t handle;
+        uint32_t pad;
+        /** Offset into the object to write to */
+        uint64_t offset;
+        /** Length of data to write */
+        uint64_t size;
+        /** Pointer to read the data from. */
+        /* void *, but pointers are not 32/64 compatible */
+        uint64_t data_ptr;
+};
+
+#define RADEON_CHUNK_ID_RELOCS  0x01
+#define RADEON_CHUNK_ID_IB      0x02
+
+struct drm_radeon_cs_chunk {
+        uint32_t                chunk_id;
+        uint32_t                length_dw;
+        uint64_t                chunk_data;
+};
+
+struct drm_radeon_cs_reloc {
+        uint32_t                handle;
+        uint32_t                read_domains;
+        uint32_t                write_domain;
+        uint32_t                flags;
+};
+
+struct drm_radeon_cs {
+        uint32_t                num_chunks;
+        uint32_t                cs_id;
+        /* this points to uint64_t * which point to cs chunks */
+        uint64_t                chunks;
+        /* updates to the limits after this CS ioctl */
+        uint64_t                gart_limit;
+        uint64_t                vram_limit;
+};
+
+#define RADEON_INFO_DEVICE_ID           0x00
+#define RADEON_INFO_NUM_GB_PIPES        0x01
+
+struct drm_radeon_info {
+        uint32_t                request;
+        uint32_t                pad;
+        uint64_t                value;
+};
+
 #endif
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
new file mode 100644
index 000000000000..cd22ab4b495c
--- /dev/null
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -0,0 +1,618 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thellstrom-at-vmware-dot-com>
+ */
+
+#ifndef _TTM_BO_API_H_
+#define _TTM_BO_API_H_
+
+#include "drm_hashtab.h"
+#include <linux/kref.h>
+#include <linux/list.h>
+#include <linux/wait.h>
+#include <linux/mutex.h>
+#include <linux/mm.h>
+#include <linux/rbtree.h>
+#include <linux/bitmap.h>
+
+struct ttm_bo_device;
+
+struct drm_mm_node;
+
+/**
+ * struct ttm_mem_reg
+ *
+ * @mm_node: Memory manager node.
+ * @size: Requested size of memory region.
+ * @num_pages: Actual size of memory region in pages.
+ * @page_alignment: Page alignment.
+ * @placement: Placement flags.
+ *
+ * Structure indicating the placement and space resources used by a
+ * buffer object.
+ */
+
+struct ttm_mem_reg {
+        struct drm_mm_node *mm_node;
+        unsigned long size;
+        unsigned long num_pages;
+        uint32_t page_alignment;
+        uint32_t mem_type;
+        uint32_t placement;
+};
+
+/**
+ * enum ttm_bo_type
+ *
+ * @ttm_bo_type_device: These are 'normal' buffers that can
+ * be mmapped by user space. Each of these bos occupy a slot in the
+ * device address space, that can be used for normal vm operations.
+ *
+ * @ttm_bo_type_user: These are user-space memory areas that are made
+ * available to the GPU by mapping the buffer pages into the GPU aperture
+ * space. These buffers cannot be mmaped from the device address space.
+ *
+ * @ttm_bo_type_kernel: These buffers are like ttm_bo_type_device buffers,
+ * but they cannot be accessed from user-space. For kernel-only use.
+ */
+
+enum ttm_bo_type {
+        ttm_bo_type_device,
+        ttm_bo_type_user,
+        ttm_bo_type_kernel
+};
+
+struct ttm_tt;
+
+/**
+ * struct ttm_buffer_object
+ *
+ * @bdev: Pointer to the buffer object device structure.
+ * @buffer_start: The virtual user-space start address of ttm_bo_type_user
+ * buffers.
+ * @type: The bo type.
+ * @destroy: Destruction function. If NULL, kfree is used.
+ * @num_pages: Actual number of pages.
+ * @addr_space_offset: Address space offset.
+ * @acc_size: Accounted size for this object.
+ * @kref: Reference count of this buffer object. When this refcount reaches
+ * zero, the object is put on the delayed delete list.
+ * @list_kref: List reference count of this buffer object. This member is
+ * used to avoid destruction while the buffer object is still on a list.
+ * Lru lists may keep one refcount, the delayed delete list, and kref != 0
+ * keeps one refcount. When this refcount reaches zero,
+ * the object is destroyed.
+ * @event_queue: Queue for processes waiting on buffer object status change.
+ * @lock: spinlock protecting mostly synchronization members.
+ * @proposed_placement: Proposed placement for the buffer. Changed only by the
+ * creator prior to validation as opposed to bo->mem.proposed_flags which is
+ * changed by the implementation prior to a buffer move if it wants to outsmart
+ * the buffer creator / user. This latter happens, for example, at eviction.
+ * @mem: structure describing current placement.
+ * @persistant_swap_storage: Usually the swap storage is deleted for buffers
+ * pinned in physical memory. If this behaviour is not desired, this member
+ * holds a pointer to a persistant shmem object.
+ * @ttm: TTM structure holding system pages.
+ * @evicted: Whether the object was evicted without user-space knowing.
+ * @cpu_writes: For synchronization. Number of cpu writers.
+ * @lru: List head for the lru list.
+ * @ddestroy: List head for the delayed destroy list.
+ * @swap: List head for swap LRU list.
+ * @val_seq: Sequence of the validation holding the @reserved lock.
+ * Used to avoid starvation when many processes compete to validate the
+ * buffer. This member is protected by the bo_device::lru_lock.
+ * @seq_valid: The value of @val_seq is valid. This value is protected by
+ * the bo_device::lru_lock.
+ * @reserved: Deadlock-free lock used for synchronization state transitions.
+ * @sync_obj_arg: Opaque argument to synchronization object function.
+ * @sync_obj: Pointer to a synchronization object.
+ * @priv_flags: Flags describing buffer object internal state.
+ * @vm_rb: Rb node for the vm rb tree.
+ * @vm_node: Address space manager node.
+ * @offset: The current GPU offset, which can have different meanings
+ * depending on the memory type. For SYSTEM type memory, it should be 0.
+ * @cur_placement: Hint of current placement.
+ *
+ * Base class for TTM buffer object, that deals with data placement and CPU
+ * mappings. GPU mappings are really up to the driver, but for simpler GPUs
+ * the driver can usually use the placement offset @offset directly as the
+ * GPU virtual address. For drivers implementing multiple
+ * GPU memory manager contexts, the driver should manage the address space
+ * in these contexts separately and use these objects to get the correct
+ * placement and caching for these GPU maps. This makes it possible to use
+ * these objects for even quite elaborate memory management schemes.
+ * The destroy member, the API visibility of this object makes it possible
+ * to derive driver specific types.
+ */
+
+struct ttm_buffer_object {
+        /**
+         * Members constant at init.
+         */
+
+        struct ttm_bo_device *bdev;
+        unsigned long buffer_start;
+        enum ttm_bo_type type;
+        void (*destroy) (struct ttm_buffer_object *);
+        unsigned long num_pages;
+        uint64_t addr_space_offset;
+        size_t acc_size;
+
+        /**
+        * Members not needing protection.
+        */
+
+        struct kref kref;
+        struct kref list_kref;
+        wait_queue_head_t event_queue;
+        spinlock_t lock;
+
+        /**
+         * Members protected by the bo::reserved lock.
+         */
+
+        uint32_t proposed_placement;
+        struct ttm_mem_reg mem;
+        struct file *persistant_swap_storage;
+        struct ttm_tt *ttm;
+        bool evicted;
+
+        /**
+         * Members protected by the bo::reserved lock only when written to.
+         */
+
+        atomic_t cpu_writers;
+
+        /**
+         * Members protected by the bdev::lru_lock.
+         */
+
+        struct list_head lru;
+        struct list_head ddestroy;
+        struct list_head swap;
+        uint32_t val_seq;
+        bool seq_valid;
+
+        /**
+         * Members protected by the bdev::lru_lock
+         * only when written to.
+         */
+
+        atomic_t reserved;
+
+
+        /**
+         * Members protected by the bo::lock
+         */
+
+        void *sync_obj_arg;
+        void *sync_obj;
+        unsigned long priv_flags;
+
+        /**
+         * Members protected by the bdev::vm_lock
+         */
+
+        struct rb_node vm_rb;
+        struct drm_mm_node *vm_node;
+
+
+        /**
+         * Special members that are protected by the reserve lock
+         * and the bo::lock when written to. Can be read with
+         * either of these locks held.
+         */
+
+        unsigned long offset;
+        uint32_t cur_placement;
+};
+
+/**
+ * struct ttm_bo_kmap_obj
+ *
+ * @virtual: The current kernel virtual address.
+ * @page: The page when kmap'ing a single page.
+ * @bo_kmap_type: Type of bo_kmap.
+ *
+ * Object describing a kernel mapping. Since a TTM bo may be located
+ * in various memory types with various caching policies, the
+ * mapping can either be an ioremap, a vmap, a kmap or part of a
+ * premapped region.
+ */
+
+struct ttm_bo_kmap_obj {
+        void *virtual;
+        struct page *page;
+        enum {
+                ttm_bo_map_iomap,
+                ttm_bo_map_vmap,
+                ttm_bo_map_kmap,
+                ttm_bo_map_premapped,
+        } bo_kmap_type;
+};
+
+/**
+ * ttm_bo_reference - reference a struct ttm_buffer_object
+ *
+ * @bo: The buffer object.
+ *
+ * Returns a refcounted pointer to a buffer object.
+ */
+
+static inline struct ttm_buffer_object *
+ttm_bo_reference(struct ttm_buffer_object *bo)
+{
+        kref_get(&bo->kref);
+        return bo;
+}
+
+/**
+ * ttm_bo_wait - wait for buffer idle.
+ *
+ * @bo:  The buffer object.
+ * @interruptible:  Use interruptible wait.
+ * @no_wait:  Return immediately if buffer is busy.
+ *
+ * This function must be called with the bo::mutex held, and makes
+ * sure any previous rendering to the buffer is completed.
+ * Note: It might be necessary to block validations before the
+ * wait by reserving the buffer.
+ * Returns -EBUSY if no_wait is true and the buffer is busy.
+ * Returns -ERESTART if interrupted by a signal.
+ */
+extern int ttm_bo_wait(struct ttm_buffer_object *bo, bool lazy,
+                       bool interruptible, bool no_wait);
+/**
+ * ttm_buffer_object_validate
+ *
+ * @bo: The buffer object.
+ * @proposed_placement: Proposed_placement for the buffer object.
+ * @interruptible: Sleep interruptible if sleeping.
+ * @no_wait: Return immediately if the buffer is busy.
+ *
+ * Changes placement and caching policy of the buffer object
+ * according to bo::proposed_flags.
+ * Returns
+ * -EINVAL on invalid proposed_flags.
+ * -ENOMEM on out-of-memory condition.
+ * -EBUSY if no_wait is true and buffer busy.
+ * -ERESTART if interrupted by a signal.
+ */
+extern int ttm_buffer_object_validate(struct ttm_buffer_object *bo,
+                                      uint32_t proposed_placement,
+                                      bool interruptible, bool no_wait);
+/**
+ * ttm_bo_unref
+ *
+ * @bo: The buffer object.
+ *
+ * Unreference and clear a pointer to a buffer object.
+ */
+extern void ttm_bo_unref(struct ttm_buffer_object **bo);
+
+/**
+ * ttm_bo_synccpu_write_grab
+ *
+ * @bo: The buffer object:
+ * @no_wait: Return immediately if buffer is busy.
+ *
+ * Synchronizes a buffer object for CPU RW access. This means
+ * blocking command submission that affects the buffer and
+ * waiting for buffer idle. This lock is recursive.
+ * Returns
+ * -EBUSY if the buffer is busy and no_wait is true.
+ * -ERESTART if interrupted by a signal.
+ */
+
+extern int
+ttm_bo_synccpu_write_grab(struct ttm_buffer_object *bo, bool no_wait);
+/**
+ * ttm_bo_synccpu_write_release:
+ *
+ * @bo : The buffer object.
+ *
+ * Releases a synccpu lock.
+ */
+extern void ttm_bo_synccpu_write_release(struct ttm_buffer_object *bo);
+
+/**
+ * ttm_buffer_object_init
+ *
+ * @bdev: Pointer to a ttm_bo_device struct.
+ * @bo: Pointer to a ttm_buffer_object to be initialized.
+ * @size: Requested size of buffer object.
+ * @type: Requested type of buffer object.
+ * @flags: Initial placement flags.
+ * @page_alignment: Data alignment in pages.
+ * @buffer_start: Virtual address of user space data backing a
+ * user buffer object.
+ * @interruptible: If needing to sleep to wait for GPU resources,
+ * sleep interruptible.
+ * @persistant_swap_storage: Usually the swap storage is deleted for buffers
+ * pinned in physical memory. If this behaviour is not desired, this member
+ * holds a pointer to a persistant shmem object. Typically, this would
+ * point to the shmem object backing a GEM object if TTM is used to back a
+ * GEM user interface.
+ * @acc_size: Accounted size for this object.
+ * @destroy: Destroy function. Use NULL for kfree().
+ *
+ * This function initializes a pre-allocated struct ttm_buffer_object.
+ * As this object may be part of a larger structure, this function,
+ * together with the @destroy function,
+ * enables driver-specific objects derived from a ttm_buffer_object.
+ * On successful return, the object kref and list_kref are set to 1.
+ * Returns
+ * -ENOMEM: Out of memory.
+ * -EINVAL: Invalid placement flags.
+ * -ERESTART: Interrupted by signal while sleeping waiting for resources.
+ */
+
+extern int ttm_buffer_object_init(struct ttm_bo_device *bdev,
+                                  struct ttm_buffer_object *bo,
+                                  unsigned long size,
+                                  enum ttm_bo_type type,
+                                  uint32_t flags,
+                                  uint32_t page_alignment,
+                                  unsigned long buffer_start,
+                                  bool interrubtible,
+                                  struct file *persistant_swap_storage,
+                                  size_t acc_size,
+                                  void (*destroy) (struct ttm_buffer_object *));
+/**
+ * ttm_bo_synccpu_object_init
+ *
+ * @bdev: Pointer to a ttm_bo_device struct.
+ * @bo: Pointer to a ttm_buffer_object to be initialized.
+ * @size: Requested size of buffer object.
+ * @type: Requested type of buffer object.
+ * @flags: Initial placement flags.
+ * @page_alignment: Data alignment in pages.
+ * @buffer_start: Virtual address of user space data backing a
+ * user buffer object.
+ * @interruptible: If needing to sleep while waiting for GPU resources,
+ * sleep interruptible.
+ * @persistant_swap_storage: Usually the swap storage is deleted for buffers
+ * pinned in physical memory. If this behaviour is not desired, this member
+ * holds a pointer to a persistant shmem object. Typically, this would
+ * point to the shmem object backing a GEM object if TTM is used to back a
+ * GEM user interface.
+ * @p_bo: On successful completion *p_bo points to the created object.
+ *
+ * This function allocates a ttm_buffer_object, and then calls
+ * ttm_buffer_object_init on that object.
+ * The destroy function is set to kfree().
+ * Returns
+ * -ENOMEM: Out of memory.
+ * -EINVAL: Invalid placement flags.
+ * -ERESTART: Interrupted by signal while waiting for resources.
+ */
+
+extern int ttm_buffer_object_create(struct ttm_bo_device *bdev,
+                                    unsigned long size,
+                                    enum ttm_bo_type type,
+                                    uint32_t flags,
+                                    uint32_t page_alignment,
+                                    unsigned long buffer_start,
+                                    bool interruptible,
+                                    struct file *persistant_swap_storage,
+                                    struct ttm_buffer_object **p_bo);
+
+/**
+ * ttm_bo_check_placement
+ *
+ * @bo: the buffer object.
+ * @set_flags: placement flags to set.
+ * @clr_flags: placement flags to clear.
+ *
+ * Performs minimal validity checking on an intended change of
+ * placement flags.
+ * Returns
+ * -EINVAL: Intended change is invalid or not allowed.
+ */
+
+extern int ttm_bo_check_placement(struct ttm_buffer_object *bo,
+                                  uint32_t set_flags, uint32_t clr_flags);
+
+/**
+ * ttm_bo_init_mm
+ *
+ * @bdev: Pointer to a ttm_bo_device struct.
+ * @mem_type: The memory type.
+ * @p_offset: offset for managed area in pages.
+ * @p_size: size managed area in pages.
+ *
+ * Initialize a manager for a given memory type.
+ * Note: if part of driver firstopen, it must be protected from a
+ * potentially racing lastclose.
+ * Returns:
+ * -EINVAL: invalid size or memory type.
+ * -ENOMEM: Not enough memory.
+ * May also return driver-specified errors.
+ */
+
+extern int ttm_bo_init_mm(struct ttm_bo_device *bdev, unsigned type,
+                          unsigned long p_offset, unsigned long p_size);
+/**
+ * ttm_bo_clean_mm
+ *
+ * @bdev: Pointer to a ttm_bo_device struct.
+ * @mem_type: The memory type.
+ *
+ * Take down a manager for a given memory type after first walking
+ * the LRU list to evict any buffers left alive.
+ *
+ * Normally, this function is part of lastclose() or unload(), and at that
+ * point there shouldn't be any buffers left created by user-space, since
+ * there should've been removed by the file descriptor release() method.
+ * However, before this function is run, make sure to signal all sync objects,
+ * and verify that the delayed delete queue is empty. The driver must also
+ * make sure that there are no NO_EVICT buffers present in this memory type
+ * when the call is made.
+ *
+ * If this function is part of a VT switch, the caller must make sure that
+ * there are no appications currently validating buffers before this
+ * function is called. The caller can do that by first taking the
+ * struct ttm_bo_device::ttm_lock in write mode.
+ *
+ * Returns:
+ * -EINVAL: invalid or uninitialized memory type.
+ * -EBUSY: There are still buffers left in this memory type.
+ */
+
+extern int ttm_bo_clean_mm(struct ttm_bo_device *bdev, unsigned mem_type);
+
+/**
+ * ttm_bo_evict_mm
+ *
+ * @bdev: Pointer to a ttm_bo_device struct.
+ * @mem_type: The memory type.
+ *
+ * Evicts all buffers on the lru list of the memory type.
+ * This is normally part of a VT switch or an
+ * out-of-memory-space-due-to-fragmentation handler.
+ * The caller must make sure that there are no other processes
+ * currently validating buffers, and can do that by taking the
+ * struct ttm_bo_device::ttm_lock in write mode.
+ *
+ * Returns:
+ * -EINVAL: Invalid or uninitialized memory type.
+ * -ERESTART: The call was interrupted by a signal while waiting to
+ * evict a buffer.
+ */
+
+extern int ttm_bo_evict_mm(struct ttm_bo_device *bdev, unsigned mem_type);
+
+/**
+ * ttm_kmap_obj_virtual
+ *
+ * @map: A struct ttm_bo_kmap_obj returned from ttm_bo_kmap.
+ * @is_iomem: Pointer to an integer that on return indicates 1 if the
+ * virtual map is io memory, 0 if normal memory.
+ *
+ * Returns the virtual address of a buffer object area mapped by ttm_bo_kmap.
+ * If *is_iomem is 1 on return, the virtual address points to an io memory area,
+ * that should strictly be accessed by the iowriteXX() and similar functions.
+ */
+
+static inline void *ttm_kmap_obj_virtual(struct ttm_bo_kmap_obj *map,
+                                         bool *is_iomem)
+{
+        *is_iomem = (map->bo_kmap_type == ttm_bo_map_iomap ||
+                     map->bo_kmap_type == ttm_bo_map_premapped);
+        return map->virtual;
+}
+
+/**
+ * ttm_bo_kmap
+ *
+ * @bo: The buffer object.
+ * @start_page: The first page to map.
+ * @num_pages: Number of pages to map.
+ * @map: pointer to a struct ttm_bo_kmap_obj representing the map.
+ *
+ * Sets up a kernel virtual mapping, using ioremap, vmap or kmap to the
+ * data in the buffer object. The ttm_kmap_obj_virtual function can then be
+ * used to obtain a virtual address to the data.
+ *
+ * Returns
+ * -ENOMEM: Out of memory.
+ * -EINVAL: Invalid range.
+ */
+
+extern int ttm_bo_kmap(struct ttm_buffer_object *bo, unsigned long start_page,
+                       unsigned long num_pages, struct ttm_bo_kmap_obj *map);
+
+/**
+ * ttm_bo_kunmap
+ *
+ * @map: Object describing the map to unmap.
+ *
+ * Unmaps a kernel map set up by ttm_bo_kmap.
+ */
+
+extern void ttm_bo_kunmap(struct ttm_bo_kmap_obj *map);
+
+#if 0
+#endif
+
+/**
+ * ttm_fbdev_mmap - mmap fbdev memory backed by a ttm buffer object.
+ *
+ * @vma:       vma as input from the fbdev mmap method.
+ * @bo:        The bo backing the address space. The address space will
+ * have the same size as the bo, and start at offset 0.
+ *
+ * This function is intended to be called by the fbdev mmap method
+ * if the fbdev address space is to be backed by a bo.
+ */
+
+extern int ttm_fbdev_mmap(struct vm_area_struct *vma,
+                          struct ttm_buffer_object *bo);
+
+/**
+ * ttm_bo_mmap - mmap out of the ttm device address space.
+ *
+ * @filp:      filp as input from the mmap method.
+ * @vma:       vma as input from the mmap method.
+ * @bdev:      Pointer to the ttm_bo_device with the address space manager.
+ *
+ * This function is intended to be called by the device mmap method.
+ * if the device address space is to be backed by the bo manager.
+ */
+
+extern int ttm_bo_mmap(struct file *filp, struct vm_area_struct *vma,
+                       struct ttm_bo_device *bdev);
+
+/**
+ * ttm_bo_io
+ *
+ * @bdev:      Pointer to the struct ttm_bo_device.
+ * @filp:      Pointer to the struct file attempting to read / write.
+ * @wbuf:      User-space pointer to address of buffer to write. NULL on read.
+ * @rbuf:      User-space pointer to address of buffer to read into.
+ * Null on write.
+ * @count:     Number of bytes to read / write.
+ * @f_pos:     Pointer to current file position.
+ * @write:     1 for read, 0 for write.
+ *
+ * This function implements read / write into ttm buffer objects, and is
+ * intended to
+ * be called from the fops::read and fops::write method.
+ * Returns:
+ * See man (2) write, man(2) read. In particular,
+ * the function may return -EINTR if
+ * interrupted by a signal.
+ */
+
+extern ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
+                         const char __user *wbuf, char __user *rbuf,
+                         size_t count, loff_t *f_pos, bool write);
+
+extern void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
+
+#endif
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
new file mode 100644
index 000000000000..62ed733c52a2
--- /dev/null
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -0,0 +1,867 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2009 Vmware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thellstrom-at-vmware-dot-com>
+ */
+#ifndef _TTM_BO_DRIVER_H_
+#define _TTM_BO_DRIVER_H_
+
+#include "ttm/ttm_bo_api.h"
+#include "ttm/ttm_memory.h"
+#include "drm_mm.h"
+#include "linux/workqueue.h"
+#include "linux/fs.h"
+#include "linux/spinlock.h"
+
+struct ttm_backend;
+
+struct ttm_backend_func {
+        /**
+         * struct ttm_backend_func member populate
+         *
+         * @backend: Pointer to a struct ttm_backend.
+         * @num_pages: Number of pages to populate.
+         * @pages: Array of pointers to ttm pages.
+         * @dummy_read_page: Page to be used instead of NULL pages in the
+         * array @pages.
+         *
+         * Populate the backend with ttm pages. Depending on the backend,
+         * it may or may not copy the @pages array.
+         */
+        int (*populate) (struct ttm_backend *backend,
+                         unsigned long num_pages, struct page **pages,
+                         struct page *dummy_read_page);
+        /**
+         * struct ttm_backend_func member clear
+         *
+         * @backend: Pointer to a struct ttm_backend.
+         *
+         * This is an "unpopulate" function. Release all resources
+         * allocated with populate.
+         */
+        void (*clear) (struct ttm_backend *backend);
+
+        /**
+         * struct ttm_backend_func member bind
+         *
+         * @backend: Pointer to a struct ttm_backend.
+         * @bo_mem: Pointer to a struct ttm_mem_reg describing the
+         * memory type and location for binding.
+         *
+         * Bind the backend pages into the aperture in the location
+         * indicated by @bo_mem. This function should be able to handle
+         * differences between aperture- and system page sizes.
+         */
+        int (*bind) (struct ttm_backend *backend, struct ttm_mem_reg *bo_mem);
+
+        /**
+         * struct ttm_backend_func member unbind
+         *
+         * @backend: Pointer to a struct ttm_backend.
+         *
+         * Unbind previously bound backend pages. This function should be
+         * able to handle differences between aperture- and system page sizes.
+         */
+        int (*unbind) (struct ttm_backend *backend);
+
+        /**
+         * struct ttm_backend_func member destroy
+         *
+         * @backend: Pointer to a struct ttm_backend.
+         *
+         * Destroy the backend.
+         */
+        void (*destroy) (struct ttm_backend *backend);
+};
+
+/**
+ * struct ttm_backend
+ *
+ * @bdev: Pointer to a struct ttm_bo_device.
+ * @flags: For driver use.
+ * @func: Pointer to a struct ttm_backend_func that describes
+ * the backend methods.
+ *
+ */
+
+struct ttm_backend {
+        struct ttm_bo_device *bdev;
+        uint32_t flags;
+        struct ttm_backend_func *func;
+};
+
+#define TTM_PAGE_FLAG_VMALLOC         (1 << 0)
+#define TTM_PAGE_FLAG_USER            (1 << 1)
+#define TTM_PAGE_FLAG_USER_DIRTY      (1 << 2)
+#define TTM_PAGE_FLAG_WRITE           (1 << 3)
+#define TTM_PAGE_FLAG_SWAPPED         (1 << 4)
+#define TTM_PAGE_FLAG_PERSISTANT_SWAP (1 << 5)
+#define TTM_PAGE_FLAG_ZERO_ALLOC      (1 << 6)
+
+enum ttm_caching_state {
+        tt_uncached,
+        tt_wc,
+        tt_cached
+};
+
+/**
+ * struct ttm_tt
+ *
+ * @dummy_read_page: Page to map where the ttm_tt page array contains a NULL
+ * pointer.
+ * @pages: Array of pages backing the data.
+ * @first_himem_page: Himem pages are put last in the page array, which
+ * enables us to run caching attribute changes on only the first part
+ * of the page array containing lomem pages. This is the index of the
+ * first himem page.
+ * @last_lomem_page: Index of the last lomem page in the page array.
+ * @num_pages: Number of pages in the page array.
+ * @bdev: Pointer to the current struct ttm_bo_device.
+ * @be: Pointer to the ttm backend.
+ * @tsk: The task for user ttm.
+ * @start: virtual address for user ttm.
+ * @swap_storage: Pointer to shmem struct file for swap storage.
+ * @caching_state: The current caching state of the pages.
+ * @state: The current binding state of the pages.
+ *
+ * This is a structure holding the pages, caching- and aperture binding
+ * status for a buffer object that isn't backed by fixed (VRAM / AGP)
+ * memory.
+ */
+
+struct ttm_tt {
+        struct page *dummy_read_page;
+        struct page **pages;
+        long first_himem_page;
+        long last_lomem_page;
+        uint32_t page_flags;
+        unsigned long num_pages;
+        struct ttm_bo_device *bdev;
+        struct ttm_backend *be;
+        struct task_struct *tsk;
+        unsigned long start;
+        struct file *swap_storage;
+        enum ttm_caching_state caching_state;
+        enum {
+                tt_bound,
+                tt_unbound,
+                tt_unpopulated,
+        } state;
+};
+
+#define TTM_MEMTYPE_FLAG_FIXED         (1 << 0) /* Fixed (on-card) PCI memory */
+#define TTM_MEMTYPE_FLAG_MAPPABLE      (1 << 1) /* Memory mappable */
+#define TTM_MEMTYPE_FLAG_NEEDS_IOREMAP (1 << 2) /* Fixed memory needs ioremap
+                                                   before kernel access. */
+#define TTM_MEMTYPE_FLAG_CMA           (1 << 3) /* Can't map aperture */
+
+/**
+ * struct ttm_mem_type_manager
+ *
+ * @has_type: The memory type has been initialized.
+ * @use_type: The memory type is enabled.
+ * @flags: TTM_MEMTYPE_XX flags identifying the traits of the memory
+ * managed by this memory type.
+ * @gpu_offset: If used, the GPU offset of the first managed page of
+ * fixed memory or the first managed location in an aperture.
+ * @io_offset: The io_offset of the first managed page of IO memory or
+ * the first managed location in an aperture. For TTM_MEMTYPE_FLAG_CMA
+ * memory, this should be set to NULL.
+ * @io_size: The size of a managed IO region (fixed memory or aperture).
+ * @io_addr: Virtual kernel address if the io region is pre-mapped. For
+ * TTM_MEMTYPE_FLAG_NEEDS_IOREMAP there is no pre-mapped io map and
+ * @io_addr should be set to NULL.
+ * @size: Size of the managed region.
+ * @available_caching: A mask of available caching types, TTM_PL_FLAG_XX,
+ * as defined in ttm_placement_common.h
+ * @default_caching: The default caching policy used for a buffer object
+ * placed in this memory type if the user doesn't provide one.
+ * @manager: The range manager used for this memory type. FIXME: If the aperture
+ * has a page size different from the underlying system, the granularity
+ * of this manager should take care of this. But the range allocating code
+ * in ttm_bo.c needs to be modified for this.
+ * @lru: The lru list for this memory type.
+ *
+ * This structure is used to identify and manage memory types for a device.
+ * It's set up by the ttm_bo_driver::init_mem_type method.
+ */
+
+struct ttm_mem_type_manager {
+
+        /*
+         * No protection. Constant from start.
+         */
+
+        bool has_type;
+        bool use_type;
+        uint32_t flags;
+        unsigned long gpu_offset;
+        unsigned long io_offset;
+        unsigned long io_size;
+        void *io_addr;
+        uint64_t size;
+        uint32_t available_caching;
+        uint32_t default_caching;
+
+        /*
+         * Protected by the bdev->lru_lock.
+         * TODO: Consider one lru_lock per ttm_mem_type_manager.
+         * Plays ill with list removal, though.
+         */
+
+        struct drm_mm manager;
+        struct list_head lru;
+};
+
+/**
+ * struct ttm_bo_driver
+ *
+ * @mem_type_prio: Priority array of memory types to place a buffer object in
+ * if it fits without evicting buffers from any of these memory types.
+ * @mem_busy_prio: Priority array of memory types to place a buffer object in
+ * if it needs to evict buffers to make room.
+ * @num_mem_type_prio: Number of elements in the @mem_type_prio array.
+ * @num_mem_busy_prio: Number of elements in the @num_mem_busy_prio array.
+ * @create_ttm_backend_entry: Callback to create a struct ttm_backend.
+ * @invalidate_caches: Callback to invalidate read caches when a buffer object
+ * has been evicted.
+ * @init_mem_type: Callback to initialize a struct ttm_mem_type_manager
+ * structure.
+ * @evict_flags: Callback to obtain placement flags when a buffer is evicted.
+ * @move: Callback for a driver to hook in accelerated functions to
+ * move a buffer.
+ * If set to NULL, a potentially slow memcpy() move is used.
+ * @sync_obj_signaled: See ttm_fence_api.h
+ * @sync_obj_wait: See ttm_fence_api.h
+ * @sync_obj_flush: See ttm_fence_api.h
+ * @sync_obj_unref: See ttm_fence_api.h
+ * @sync_obj_ref: See ttm_fence_api.h
+ */
+
+struct ttm_bo_driver {
+        const uint32_t *mem_type_prio;
+        const uint32_t *mem_busy_prio;
+        uint32_t num_mem_type_prio;
+        uint32_t num_mem_busy_prio;
+
+        /**
+         * struct ttm_bo_driver member create_ttm_backend_entry
+         *
+         * @bdev: The buffer object device.
+         *
+         * Create a driver specific struct ttm_backend.
+         */
+
+        struct ttm_backend *(*create_ttm_backend_entry)
+         (struct ttm_bo_device *bdev);
+
+        /**
+         * struct ttm_bo_driver member invalidate_caches
+         *
+         * @bdev: the buffer object device.
+         * @flags: new placement of the rebound buffer object.
+         *
+         * A previosly evicted buffer has been rebound in a
+         * potentially new location. Tell the driver that it might
+         * consider invalidating read (texture) caches on the next command
+         * submission as a consequence.
+         */
+
+        int (*invalidate_caches) (struct ttm_bo_device *bdev, uint32_t flags);
+        int (*init_mem_type) (struct ttm_bo_device *bdev, uint32_t type,
+                              struct ttm_mem_type_manager *man);
+        /**
+         * struct ttm_bo_driver member evict_flags:
+         *
+         * @bo: the buffer object to be evicted
+         *
+         * Return the bo flags for a buffer which is not mapped to the hardware.
+         * These will be placed in proposed_flags so that when the move is
+         * finished, they'll end up in bo->mem.flags
+         */
+
+         uint32_t(*evict_flags) (struct ttm_buffer_object *bo);
+        /**
+         * struct ttm_bo_driver member move:
+         *
+         * @bo: the buffer to move
+         * @evict: whether this motion is evicting the buffer from
+         * the graphics address space
+         * @interruptible: Use interruptible sleeps if possible when sleeping.
+         * @no_wait: whether this should give up and return -EBUSY
+         * if this move would require sleeping
+         * @new_mem: the new memory region receiving the buffer
+         *
+         * Move a buffer between two memory regions.
+         */
+        int (*move) (struct ttm_buffer_object *bo,
+                     bool evict, bool interruptible,
+                     bool no_wait, struct ttm_mem_reg *new_mem);
+
+        /**
+         * struct ttm_bo_driver_member verify_access
+         *
+         * @bo: Pointer to a buffer object.
+         * @filp: Pointer to a struct file trying to access the object.
+         *
+         * Called from the map / write / read methods to verify that the
+         * caller is permitted to access the buffer object.
+         * This member may be set to NULL, which will refuse this kind of
+         * access for all buffer objects.
+         * This function should return 0 if access is granted, -EPERM otherwise.
+         */
+        int (*verify_access) (struct ttm_buffer_object *bo,
+                              struct file *filp);
+
+        /**
+         * In case a driver writer dislikes the TTM fence objects,
+         * the driver writer can replace those with sync objects of
+         * his / her own. If it turns out that no driver writer is
+         * using these. I suggest we remove these hooks and plug in
+         * fences directly. The bo driver needs the following functionality:
+         * See the corresponding functions in the fence object API
+         * documentation.
+         */
+
+        bool (*sync_obj_signaled) (void *sync_obj, void *sync_arg);
+        int (*sync_obj_wait) (void *sync_obj, void *sync_arg,
+                              bool lazy, bool interruptible);
+        int (*sync_obj_flush) (void *sync_obj, void *sync_arg);
+        void (*sync_obj_unref) (void **sync_obj);
+        void *(*sync_obj_ref) (void *sync_obj);
+};
+
+#define TTM_NUM_MEM_TYPES 8
+
+#define TTM_BO_PRIV_FLAG_MOVING  0      /* Buffer object is moving and needs
+                                           idling before CPU mapping */
+#define TTM_BO_PRIV_FLAG_MAX 1
+/**
+ * struct ttm_bo_device - Buffer object driver device-specific data.
+ *
+ * @mem_glob: Pointer to a struct ttm_mem_global object for accounting.
+ * @driver: Pointer to a struct ttm_bo_driver struct setup by the driver.
+ * @count: Current number of buffer object.
+ * @pages: Current number of pinned pages.
+ * @dummy_read_page: Pointer to a dummy page used for mapping requests
+ * of unpopulated pages.
+ * @shrink: A shrink callback object used for buffre object swap.
+ * @ttm_bo_extra_size: Extra size (sizeof(struct ttm_buffer_object) excluded)
+ * used by a buffer object. This is excluding page arrays and backing pages.
+ * @ttm_bo_size: This is @ttm_bo_extra_size + sizeof(struct ttm_buffer_object).
+ * @man: An array of mem_type_managers.
+ * @addr_space_mm: Range manager for the device address space.
+ * lru_lock: Spinlock that protects the buffer+device lru lists and
+ * ddestroy lists.
+ * @nice_mode: Try nicely to wait for buffer idle when cleaning a manager.
+ * If a GPU lockup has been detected, this is forced to 0.
+ * @dev_mapping: A pointer to the struct address_space representing the
+ * device address space.
+ * @wq: Work queue structure for the delayed delete workqueue.
+ *
+ */
+
+struct ttm_bo_device {
+
+        /*
+         * Constant after bo device init / atomic.
+         */
+
+        struct ttm_mem_global *mem_glob;
+        struct ttm_bo_driver *driver;
+        struct page *dummy_read_page;
+        struct ttm_mem_shrink shrink;
+
+        size_t ttm_bo_extra_size;
+        size_t ttm_bo_size;
+
+        rwlock_t vm_lock;
+        /*
+         * Protected by the vm lock.
+         */
+        struct ttm_mem_type_manager man[TTM_NUM_MEM_TYPES];
+        struct rb_root addr_space_rb;
+        struct drm_mm addr_space_mm;
+
+        /*
+         * Might want to change this to one lock per manager.
+         */
+        spinlock_t lru_lock;
+        /*
+         * Protected by the lru lock.
+         */
+        struct list_head ddestroy;
+        struct list_head swap_lru;
+
+        /*
+         * Protected by load / firstopen / lastclose /unload sync.
+         */
+
+        bool nice_mode;
+        struct address_space *dev_mapping;
+
+        /*
+         * Internal protection.
+         */
+
+        struct delayed_work wq;
+};
+
+/**
+ * ttm_flag_masked
+ *
+ * @old: Pointer to the result and original value.
+ * @new: New value of bits.
+ * @mask: Mask of bits to change.
+ *
+ * Convenience function to change a number of bits identified by a mask.
+ */
+
+static inline uint32_t
+ttm_flag_masked(uint32_t *old, uint32_t new, uint32_t mask)
+{
+        *old ^= (*old ^ new) & mask;
+        return *old;
+}
+
+/**
+ * ttm_tt_create
+ *
+ * @bdev: pointer to a struct ttm_bo_device:
+ * @size: Size of the data needed backing.
+ * @page_flags: Page flags as identified by TTM_PAGE_FLAG_XX flags.
+ * @dummy_read_page: See struct ttm_bo_device.
+ *
+ * Create a struct ttm_tt to back data with system memory pages.
+ * No pages are actually allocated.
+ * Returns:
+ * NULL: Out of memory.
+ */
+extern struct ttm_tt *ttm_tt_create(struct ttm_bo_device *bdev,
+                                    unsigned long size,
+                                    uint32_t page_flags,
+                                    struct page *dummy_read_page);
+
+/**
+ * ttm_tt_set_user:
+ *
+ * @ttm: The struct ttm_tt to populate.
+ * @tsk: A struct task_struct for which @start is a valid user-space address.
+ * @start: A valid user-space address.
+ * @num_pages: Size in pages of the user memory area.
+ *
+ * Populate a struct ttm_tt with a user-space memory area after first pinning
+ * the pages backing it.
+ * Returns:
+ * !0: Error.
+ */
+
+extern int ttm_tt_set_user(struct ttm_tt *ttm,
+                           struct task_struct *tsk,
+                           unsigned long start, unsigned long num_pages);
+
+/**
+ * ttm_ttm_bind:
+ *
+ * @ttm: The struct ttm_tt containing backing pages.
+ * @bo_mem: The struct ttm_mem_reg identifying the binding location.
+ *
+ * Bind the pages of @ttm to an aperture location identified by @bo_mem
+ */
+extern int ttm_tt_bind(struct ttm_tt *ttm, struct ttm_mem_reg *bo_mem);
+
+/**
+ * ttm_ttm_destroy:
+ *
+ * @ttm: The struct ttm_tt.
+ *
+ * Unbind, unpopulate and destroy a struct ttm_tt.
+ */
+extern void ttm_tt_destroy(struct ttm_tt *ttm);
+
+/**
+ * ttm_ttm_unbind:
+ *
+ * @ttm: The struct ttm_tt.
+ *
+ * Unbind a struct ttm_tt.
+ */
+extern void ttm_tt_unbind(struct ttm_tt *ttm);
+
+/**
+ * ttm_ttm_destroy:
+ *
+ * @ttm: The struct ttm_tt.
+ * @index: Index of the desired page.
+ *
+ * Return a pointer to the struct page backing @ttm at page
+ * index @index. If the page is unpopulated, one will be allocated to
+ * populate that index.
+ *
+ * Returns:
+ * NULL on OOM.
+ */
+extern struct page *ttm_tt_get_page(struct ttm_tt *ttm, int index);
+
+/**
+ * ttm_tt_cache_flush:
+ *
+ * @pages: An array of pointers to struct page:s to flush.
+ * @num_pages: Number of pages to flush.
+ *
+ * Flush the data of the indicated pages from the cpu caches.
+ * This is used when changing caching attributes of the pages from
+ * cache-coherent.
+ */
+extern void ttm_tt_cache_flush(struct page *pages[], unsigned long num_pages);
+
+/**
+ * ttm_tt_set_placement_caching:
+ *
+ * @ttm A struct ttm_tt the backing pages of which will change caching policy.
+ * @placement: Flag indicating the desired caching policy.
+ *
+ * This function will change caching policy of any default kernel mappings of
+ * the pages backing @ttm. If changing from cached to uncached or
+ * write-combined,
+ * all CPU caches will first be flushed to make sure the data of the pages
+ * hit RAM. This function may be very costly as it involves global TLB
+ * and cache flushes and potential page splitting / combining.
+ */
+extern int ttm_tt_set_placement_caching(struct ttm_tt *ttm, uint32_t placement);
+extern int ttm_tt_swapout(struct ttm_tt *ttm,
+                          struct file *persistant_swap_storage);
+
+/*
+ * ttm_bo.c
+ */
+
+/**
+ * ttm_mem_reg_is_pci
+ *
+ * @bdev: Pointer to a struct ttm_bo_device.
+ * @mem: A valid struct ttm_mem_reg.
+ *
+ * Returns true if the memory described by @mem is PCI memory,
+ * false otherwise.
+ */
+extern bool ttm_mem_reg_is_pci(struct ttm_bo_device *bdev,
+                                   struct ttm_mem_reg *mem);
+
+/**
+ * ttm_bo_mem_space
+ *
+ * @bo: Pointer to a struct ttm_buffer_object. the data of which
+ * we want to allocate space for.
+ * @proposed_placement: Proposed new placement for the buffer object.
+ * @mem: A struct ttm_mem_reg.
+ * @interruptible: Sleep interruptible when sliping.
+ * @no_wait: Don't sleep waiting for space to become available.
+ *
+ * Allocate memory space for the buffer object pointed to by @bo, using
+ * the placement flags in @mem, potentially evicting other idle buffer objects.
+ * This function may sleep while waiting for space to become available.
+ * Returns:
+ * -EBUSY: No space available (only if no_wait == 1).
+ * -ENOMEM: Could not allocate memory for the buffer object, either due to
+ * fragmentation or concurrent allocators.
+ * -ERESTART: An interruptible sleep was interrupted by a signal.
+ */
+extern int ttm_bo_mem_space(struct ttm_buffer_object *bo,
+                            uint32_t proposed_placement,
+                            struct ttm_mem_reg *mem,
+                            bool interruptible, bool no_wait);
+/**
+ * ttm_bo_wait_for_cpu
+ *
+ * @bo: Pointer to a struct ttm_buffer_object.
+ * @no_wait: Don't sleep while waiting.
+ *
+ * Wait until a buffer object is no longer sync'ed for CPU access.
+ * Returns:
+ * -EBUSY: Buffer object was sync'ed for CPU access. (only if no_wait == 1).
+ * -ERESTART: An interruptible sleep was interrupted by a signal.
+ */
+
+extern int ttm_bo_wait_cpu(struct ttm_buffer_object *bo, bool no_wait);
+
+/**
+ * ttm_bo_pci_offset - Get the PCI offset for the buffer object memory.
+ *
+ * @bo Pointer to a struct ttm_buffer_object.
+ * @bus_base On return the base of the PCI region
+ * @bus_offset On return the byte offset into the PCI region
+ * @bus_size On return the byte size of the buffer object or zero if
+ * the buffer object memory is not accessible through a PCI region.
+ *
+ * Returns:
+ * -EINVAL if the buffer object is currently not mappable.
+ * 0 otherwise.
+ */
+
+extern int ttm_bo_pci_offset(struct ttm_bo_device *bdev,
+                             struct ttm_mem_reg *mem,
+                             unsigned long *bus_base,
+                             unsigned long *bus_offset,
+                             unsigned long *bus_size);
+
+extern int ttm_bo_device_release(struct ttm_bo_device *bdev);
+
+/**
+ * ttm_bo_device_init
+ *
+ * @bdev: A pointer to a struct ttm_bo_device to initialize.
+ * @mem_global: A pointer to an initialized struct ttm_mem_global.
+ * @driver: A pointer to a struct ttm_bo_driver set up by the caller.
+ * @file_page_offset: Offset into the device address space that is available
+ * for buffer data. This ensures compatibility with other users of the
+ * address space.
+ *
+ * Initializes a struct ttm_bo_device:
+ * Returns:
+ * !0: Failure.
+ */
+extern int ttm_bo_device_init(struct ttm_bo_device *bdev,
+                              struct ttm_mem_global *mem_glob,
+                              struct ttm_bo_driver *driver,
+                              uint64_t file_page_offset);
+
+/**
+ * ttm_bo_reserve:
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ * @interruptible: Sleep interruptible if waiting.
+ * @no_wait: Don't sleep while trying to reserve, rather return -EBUSY.
+ * @use_sequence: If @bo is already reserved, Only sleep waiting for
+ * it to become unreserved if @sequence < (@bo)->sequence.
+ *
+ * Locks a buffer object for validation. (Or prevents other processes from
+ * locking it for validation) and removes it from lru lists, while taking
+ * a number of measures to prevent deadlocks.
+ *
+ * Deadlocks may occur when two processes try to reserve multiple buffers in
+ * different order, either by will or as a result of a buffer being evicted
+ * to make room for a buffer already reserved. (Buffers are reserved before
+ * they are evicted). The following algorithm prevents such deadlocks from
+ * occuring:
+ * 1) Buffers are reserved with the lru spinlock held. Upon successful
+ * reservation they are removed from the lru list. This stops a reserved buffer
+ * from being evicted. However the lru spinlock is released between the time
+ * a buffer is selected for eviction and the time it is reserved.
+ * Therefore a check is made when a buffer is reserved for eviction, that it
+ * is still the first buffer in the lru list, before it is removed from the
+ * list. @check_lru == 1 forces this check. If it fails, the function returns
+ * -EINVAL, and the caller should then choose a new buffer to evict and repeat
+ * the procedure.
+ * 2) Processes attempting to reserve multiple buffers other than for eviction,
+ * (typically execbuf), should first obtain a unique 32-bit
+ * validation sequence number,
+ * and call this function with @use_sequence == 1 and @sequence == the unique
+ * sequence number. If upon call of this function, the buffer object is already
+ * reserved, the validation sequence is checked against the validation
+ * sequence of the process currently reserving the buffer,
+ * and if the current validation sequence is greater than that of the process
+ * holding the reservation, the function returns -EAGAIN. Otherwise it sleeps
+ * waiting for the buffer to become unreserved, after which it retries
+ * reserving.
+ * The caller should, when receiving an -EAGAIN error
+ * release all its buffer reservations, wait for @bo to become unreserved, and
+ * then rerun the validation with the same validation sequence. This procedure
+ * will always guarantee that the process with the lowest validation sequence
+ * will eventually succeed, preventing both deadlocks and starvation.
+ *
+ * Returns:
+ * -EAGAIN: The reservation may cause a deadlock.
+ * Release all buffer reservations, wait for @bo to become unreserved and
+ * try again. (only if use_sequence == 1).
+ * -ERESTART: A wait for the buffer to become unreserved was interrupted by
+ * a signal. Release all buffer reservations and return to user-space.
+ */
+extern int ttm_bo_reserve(struct ttm_buffer_object *bo,
+                          bool interruptible,
+                          bool no_wait, bool use_sequence, uint32_t sequence);
+
+/**
+ * ttm_bo_unreserve
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ *
+ * Unreserve a previous reservation of @bo.
+ */
+extern void ttm_bo_unreserve(struct ttm_buffer_object *bo);
+
+/**
+ * ttm_bo_wait_unreserved
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ *
+ * Wait for a struct ttm_buffer_object to become unreserved.
+ * This is typically used in the execbuf code to relax cpu-usage when
+ * a potential deadlock condition backoff.
+ */
+extern int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo,
+                                  bool interruptible);
+
+/**
+ * ttm_bo_block_reservation
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ * @interruptible: Use interruptible sleep when waiting.
+ * @no_wait: Don't sleep, but rather return -EBUSY.
+ *
+ * Block reservation for validation by simply reserving the buffer.
+ * This is intended for single buffer use only without eviction,
+ * and thus needs no deadlock protection.
+ *
+ * Returns:
+ * -EBUSY: If no_wait == 1 and the buffer is already reserved.
+ * -ERESTART: If interruptible == 1 and the process received a signal
+ * while sleeping.
+ */
+extern int ttm_bo_block_reservation(struct ttm_buffer_object *bo,
+                                    bool interruptible, bool no_wait);
+
+/**
+ * ttm_bo_unblock_reservation
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ *
+ * Unblocks reservation leaving lru lists untouched.
+ */
+extern void ttm_bo_unblock_reservation(struct ttm_buffer_object *bo);
+
+/*
+ * ttm_bo_util.c
+ */
+
+/**
+ * ttm_bo_move_ttm
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ * @evict: 1: This is an eviction. Don't try to pipeline.
+ * @no_wait: Never sleep, but rather return with -EBUSY.
+ * @new_mem: struct ttm_mem_reg indicating where to move.
+ *
+ * Optimized move function for a buffer object with both old and
+ * new placement backed by a TTM. The function will, if successful,
+ * free any old aperture space, and set (@new_mem)->mm_node to NULL,
+ * and update the (@bo)->mem placement flags. If unsuccessful, the old
+ * data remains untouched, and it's up to the caller to free the
+ * memory space indicated by @new_mem.
+ * Returns:
+ * !0: Failure.
+ */
+
+extern int ttm_bo_move_ttm(struct ttm_buffer_object *bo,
+                           bool evict, bool no_wait,
+                           struct ttm_mem_reg *new_mem);
+
+/**
+ * ttm_bo_move_memcpy
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ * @evict: 1: This is an eviction. Don't try to pipeline.
+ * @no_wait: Never sleep, but rather return with -EBUSY.
+ * @new_mem: struct ttm_mem_reg indicating where to move.
+ *
+ * Fallback move function for a mappable buffer object in mappable memory.
+ * The function will, if successful,
+ * free any old aperture space, and set (@new_mem)->mm_node to NULL,
+ * and update the (@bo)->mem placement flags. If unsuccessful, the old
+ * data remains untouched, and it's up to the caller to free the
+ * memory space indicated by @new_mem.
+ * Returns:
+ * !0: Failure.
+ */
+
+extern int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
+                              bool evict,
+                              bool no_wait, struct ttm_mem_reg *new_mem);
+
+/**
+ * ttm_bo_free_old_node
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ *
+ * Utility function to free an old placement after a successful move.
+ */
+extern void ttm_bo_free_old_node(struct ttm_buffer_object *bo);
+
+/**
+ * ttm_bo_move_accel_cleanup.
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ * @sync_obj: A sync object that signals when moving is complete.
+ * @sync_obj_arg: An argument to pass to the sync object idle / wait
+ * functions.
+ * @evict: This is an evict move. Don't return until the buffer is idle.
+ * @no_wait: Never sleep, but rather return with -EBUSY.
+ * @new_mem: struct ttm_mem_reg indicating where to move.
+ *
+ * Accelerated move function to be called when an accelerated move
+ * has been scheduled. The function will create a new temporary buffer object
+ * representing the old placement, and put the sync object on both buffer
+ * objects. After that the newly created buffer object is unref'd to be
+ * destroyed when the move is complete. This will help pipeline
+ * buffer moves.
+ */
+
+extern int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
+                                     void *sync_obj,
+                                     void *sync_obj_arg,
+                                     bool evict, bool no_wait,
+                                     struct ttm_mem_reg *new_mem);
+/**
+ * ttm_io_prot
+ *
+ * @c_state: Caching state.
+ * @tmp: Page protection flag for a normal, cached mapping.
+ *
+ * Utility function that returns the pgprot_t that should be used for
+ * setting up a PTE with the caching model indicated by @c_state.
+ */
+extern pgprot_t ttm_io_prot(enum ttm_caching_state c_state, pgprot_t tmp);
+
+#if (defined(CONFIG_AGP) || (defined(CONFIG_AGP_MODULE) && defined(MODULE)))
+#define TTM_HAS_AGP
+#include <linux/agp_backend.h>
+
+/**
+ * ttm_agp_backend_init
+ *
+ * @bdev: Pointer to a struct ttm_bo_device.
+ * @bridge: The agp bridge this device is sitting on.
+ *
+ * Create a TTM backend that uses the indicated AGP bridge as an aperture
+ * for TT memory. This function uses the linux agpgart interface to
+ * bind and unbind memory backing a ttm_tt.
+ */
+extern struct ttm_backend *ttm_agp_backend_init(struct ttm_bo_device *bdev,
+                                                struct agp_bridge_data *bridge);
+#endif
+
+#endif
diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
new file mode 100644
index 000000000000..d8b8f042c4f1
--- /dev/null
+++ b/include/drm/ttm/ttm_memory.h
@@ -0,0 +1,153 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#ifndef TTM_MEMORY_H
+#define TTM_MEMORY_H
+
+#include <linux/workqueue.h>
+#include <linux/spinlock.h>
+#include <linux/wait.h>
+#include <linux/errno.h>
+
+/**
+ * struct ttm_mem_shrink - callback to shrink TTM memory usage.
+ *
+ * @do_shrink: The callback function.
+ *
+ * Arguments to the do_shrink functions are intended to be passed using
+ * inheritance. That is, the argument class derives from struct ttm_mem_srink,
+ * and can be accessed using container_of().
+ */
+
+struct ttm_mem_shrink {
+        int (*do_shrink) (struct ttm_mem_shrink *);
+};
+
+/**
+ * struct ttm_mem_global - Global memory accounting structure.
+ *
+ * @shrink: A single callback to shrink TTM memory usage. Extend this
+ * to a linked list to be able to handle multiple callbacks when needed.
+ * @swap_queue: A workqueue to handle shrinking in low memory situations. We
+ * need a separate workqueue since it will spend a lot of time waiting
+ * for the GPU, and this will otherwise block other workqueue tasks(?)
+ * At this point we use only a single-threaded workqueue.
+ * @work: The workqueue callback for the shrink queue.
+ * @queue: Wait queue for processes suspended waiting for memory.
+ * @lock: Lock to protect the @shrink - and the memory accounting members,
+ * that is, essentially the whole structure with some exceptions.
+ * @emer_memory: Lowmem memory limit available for root.
+ * @max_memory: Lowmem memory limit available for non-root.
+ * @swap_limit: Lowmem memory limit where the shrink workqueue kicks in.
+ * @used_memory: Currently used lowmem memory.
+ * @used_total_memory: Currently used total (lowmem + highmem) memory.
+ * @total_memory_swap_limit: Total memory limit where the shrink workqueue
+ * kicks in.
+ * @max_total_memory: Total memory available to non-root processes.
+ * @emer_total_memory: Total memory available to root processes.
+ *
+ * Note that this structure is not per device. It should be global for all
+ * graphics devices.
+ */
+
+struct ttm_mem_global {
+        struct ttm_mem_shrink *shrink;
+        struct workqueue_struct *swap_queue;
+        struct work_struct work;
+        wait_queue_head_t queue;
+        spinlock_t lock;
+        uint64_t emer_memory;
+        uint64_t max_memory;
+        uint64_t swap_limit;
+        uint64_t used_memory;
+        uint64_t used_total_memory;
+        uint64_t total_memory_swap_limit;
+        uint64_t max_total_memory;
+        uint64_t emer_total_memory;
+};
+
+/**
+ * ttm_mem_init_shrink - initialize a struct ttm_mem_shrink object
+ *
+ * @shrink: The object to initialize.
+ * @func: The callback function.
+ */
+
+static inline void ttm_mem_init_shrink(struct ttm_mem_shrink *shrink,
+                                       int (*func) (struct ttm_mem_shrink *))
+{
+        shrink->do_shrink = func;
+}
+
+/**
+ * ttm_mem_register_shrink - register a struct ttm_mem_shrink object.
+ *
+ * @glob: The struct ttm_mem_global object to register with.
+ * @shrink: An initialized struct ttm_mem_shrink object to register.
+ *
+ * Returns:
+ * -EBUSY: There's already a callback registered. (May change).
+ */
+
+static inline int ttm_mem_register_shrink(struct ttm_mem_global *glob,
+                                          struct ttm_mem_shrink *shrink)
+{
+        spin_lock(&glob->lock);
+        if (glob->shrink != NULL) {
+                spin_unlock(&glob->lock);
+                return -EBUSY;
+        }
+        glob->shrink = shrink;
+        spin_unlock(&glob->lock);
+        return 0;
+}
+
+/**
+ * ttm_mem_unregister_shrink - unregister a struct ttm_mem_shrink object.
+ *
+ * @glob: The struct ttm_mem_global object to unregister from.
+ * @shrink: A previously registert struct ttm_mem_shrink object.
+ *
+ */
+
+static inline void ttm_mem_unregister_shrink(struct ttm_mem_global *glob,
+                                             struct ttm_mem_shrink *shrink)
+{
+        spin_lock(&glob->lock);
+        BUG_ON(glob->shrink != shrink);
+        glob->shrink = NULL;
+        spin_unlock(&glob->lock);
+}
+
+extern int ttm_mem_global_init(struct ttm_mem_global *glob);
+extern void ttm_mem_global_release(struct ttm_mem_global *glob);
+extern int ttm_mem_global_alloc(struct ttm_mem_global *glob, uint64_t memory,
+                                bool no_wait, bool interruptible, bool himem);
+extern void ttm_mem_global_free(struct ttm_mem_global *glob,
+                                uint64_t amount, bool himem);
+extern size_t ttm_round_pot(size_t size);
+#endif
diff --git a/include/drm/ttm/ttm_module.h b/include/drm/ttm/ttm_module.h
new file mode 100644
index 000000000000..889a4c7958ae
--- /dev/null
+++ b/include/drm/ttm/ttm_module.h
@@ -0,0 +1,58 @@
+/**************************************************************************
+ *
+ * Copyright 2008-2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thellstrom-at-vmware-dot-com>
+ */
+
+#ifndef _TTM_MODULE_H_
+#define _TTM_MODULE_H_
+
+#include <linux/kernel.h>
+
+#define TTM_PFX "[TTM]"
+
+enum ttm_global_types {
+        TTM_GLOBAL_TTM_MEM = 0,
+        TTM_GLOBAL_TTM_BO,
+        TTM_GLOBAL_TTM_OBJECT,
+        TTM_GLOBAL_NUM
+};
+
+struct ttm_global_reference {
+        enum ttm_global_types global_type;
+        size_t size;
+        void *object;
+        int (*init) (struct ttm_global_reference *);
+        void (*release) (struct ttm_global_reference *);
+};
+
+extern void ttm_global_init(void);
+extern void ttm_global_release(void);
+extern int ttm_global_item_ref(struct ttm_global_reference *ref);
+extern void ttm_global_item_unref(struct ttm_global_reference *ref);
+
+#endif /* _TTM_MODULE_H_ */
diff --git a/include/drm/ttm/ttm_placement.h b/include/drm/ttm/ttm_placement.h
new file mode 100644
index 000000000000..c84ff153a564
--- /dev/null
+++ b/include/drm/ttm/ttm_placement.h
@@ -0,0 +1,92 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thellstrom-at-vmware-dot-com>
+ */
+
+#ifndef _TTM_PLACEMENT_H_
+#define _TTM_PLACEMENT_H_
+/*
+ * Memory regions for data placement.
+ */
+
+#define TTM_PL_SYSTEM           0
+#define TTM_PL_TT               1
+#define TTM_PL_VRAM             2
+#define TTM_PL_PRIV0            3
+#define TTM_PL_PRIV1            4
+#define TTM_PL_PRIV2            5
+#define TTM_PL_PRIV3            6
+#define TTM_PL_PRIV4            7
+#define TTM_PL_PRIV5            8
+#define TTM_PL_SWAPPED          15
+
+#define TTM_PL_FLAG_SYSTEM      (1 << TTM_PL_SYSTEM)
+#define TTM_PL_FLAG_TT          (1 << TTM_PL_TT)
+#define TTM_PL_FLAG_VRAM        (1 << TTM_PL_VRAM)
+#define TTM_PL_FLAG_PRIV0       (1 << TTM_PL_PRIV0)
+#define TTM_PL_FLAG_PRIV1       (1 << TTM_PL_PRIV1)
+#define TTM_PL_FLAG_PRIV2       (1 << TTM_PL_PRIV2)
+#define TTM_PL_FLAG_PRIV3       (1 << TTM_PL_PRIV3)
+#define TTM_PL_FLAG_PRIV4       (1 << TTM_PL_PRIV4)
+#define TTM_PL_FLAG_PRIV5       (1 << TTM_PL_PRIV5)
+#define TTM_PL_FLAG_SWAPPED     (1 << TTM_PL_SWAPPED)
+#define TTM_PL_MASK_MEM         0x0000FFFF
+
+/*
+ * Other flags that affects data placement.
+ * TTM_PL_FLAG_CACHED indicates cache-coherent mappings
+ * if available.
+ * TTM_PL_FLAG_SHARED means that another application may
+ * reference the buffer.
+ * TTM_PL_FLAG_NO_EVICT means that the buffer may never
+ * be evicted to make room for other buffers.
+ */
+
+#define TTM_PL_FLAG_CACHED      (1 << 16)
+#define TTM_PL_FLAG_UNCACHED    (1 << 17)
+#define TTM_PL_FLAG_WC          (1 << 18)
+#define TTM_PL_FLAG_SHARED      (1 << 20)
+#define TTM_PL_FLAG_NO_EVICT    (1 << 21)
+
+#define TTM_PL_MASK_CACHING     (TTM_PL_FLAG_CACHED | \
+                                 TTM_PL_FLAG_UNCACHED | \
+                                 TTM_PL_FLAG_WC)
+
+#define TTM_PL_MASK_MEMTYPE     (TTM_PL_MASK_MEM | TTM_PL_MASK_CACHING)
+
+/*
+ * Access flags to be used for CPU- and GPU- mappings.
+ * The idea is that the TTM synchronization mechanism will
+ * allow concurrent READ access and exclusive write access.
+ * Currently GPU- and CPU accesses are exclusive.
+ */
+
+#define TTM_ACCESS_READ         (1 << 0)
+#define TTM_ACCESS_WRITE        (1 << 1)
+
+#endif
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index b3afd2219ad2..a2df7030d49d 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -311,6 +311,7 @@ unifdef-y += ppp-comp.h
 unifdef-y += ptrace.h
 unifdef-y += quota.h
 unifdef-y += random.h
+unifdef-y += rfkill.h
 unifdef-y += irqnr.h
 unifdef-y += reboot.h
 unifdef-y += reiserfs_fs.h
diff --git a/include/linux/amba/pl022.h b/include/linux/amba/pl022.h
new file mode 100644
index 000000000000..dcad0ffd1755
--- /dev/null
+++ b/include/linux/amba/pl022.h
@@ -0,0 +1,264 @@
+/*
+ * include/linux/amba/pl022.h
+ *
+ * Copyright (C) 2008-2009 ST-Ericsson AB
+ * Copyright (C) 2006 STMicroelectronics Pvt. Ltd.
+ *
+ * Author: Linus Walleij <linus.walleij@stericsson.com>
+ *
+ * Initial version inspired by:
+ *      linux-2.6.17-rc3-mm1/drivers/spi/pxa2xx_spi.c
+ * Initial adoption to PL022 by:
+ *      Sachin Verma <sachin.verma@st.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef _SSP_PL022_H
+#define _SSP_PL022_H
+
+#include <linux/device.h>
+
+/**
+ * whether SSP is in loopback mode or not
+ */
+enum ssp_loopback {
+        LOOPBACK_DISABLED,
+        LOOPBACK_ENABLED
+};
+
+/**
+ * enum ssp_interface - interfaces allowed for this SSP Controller
+ * @SSP_INTERFACE_MOTOROLA_SPI: Motorola Interface
+ * @SSP_INTERFACE_TI_SYNC_SERIAL: Texas Instrument Synchronous Serial
+ * interface
+ * @SSP_INTERFACE_NATIONAL_MICROWIRE: National Semiconductor Microwire
+ * interface
+ * @SSP_INTERFACE_UNIDIRECTIONAL: Unidirectional interface (STn8810
+ * &STn8815 only)
+ */
+enum ssp_interface {
+        SSP_INTERFACE_MOTOROLA_SPI,
+        SSP_INTERFACE_TI_SYNC_SERIAL,
+        SSP_INTERFACE_NATIONAL_MICROWIRE,
+        SSP_INTERFACE_UNIDIRECTIONAL
+};
+
+/**
+ * enum ssp_hierarchy - whether SSP is configured as Master or Slave
+ */
+enum ssp_hierarchy {
+        SSP_MASTER,
+        SSP_SLAVE
+};
+
+/**
+ * enum ssp_clock_params - clock parameters, to set SSP clock at a
+ * desired freq
+ */
+struct ssp_clock_params {
+        u8 cpsdvsr; /* value from 2 to 254 (even only!) */
+        u8 scr;     /* value from 0 to 255 */
+};
+
+/**
+ * enum ssp_rx_endian - endianess of Rx FIFO Data
+ */
+enum ssp_rx_endian {
+        SSP_RX_MSB,
+        SSP_RX_LSB
+};
+
+/**
+ * enum ssp_tx_endian - endianess of Tx FIFO Data
+ */
+enum ssp_tx_endian {
+        SSP_TX_MSB,
+        SSP_TX_LSB
+};
+
+/**
+ * enum ssp_data_size - number of bits in one data element
+ */
+enum ssp_data_size {
+        SSP_DATA_BITS_4 = 0x03, SSP_DATA_BITS_5, SSP_DATA_BITS_6,
+        SSP_DATA_BITS_7, SSP_DATA_BITS_8, SSP_DATA_BITS_9,
+        SSP_DATA_BITS_10, SSP_DATA_BITS_11, SSP_DATA_BITS_12,
+        SSP_DATA_BITS_13, SSP_DATA_BITS_14, SSP_DATA_BITS_15,
+        SSP_DATA_BITS_16, SSP_DATA_BITS_17, SSP_DATA_BITS_18,
+        SSP_DATA_BITS_19, SSP_DATA_BITS_20, SSP_DATA_BITS_21,
+        SSP_DATA_BITS_22, SSP_DATA_BITS_23, SSP_DATA_BITS_24,
+        SSP_DATA_BITS_25, SSP_DATA_BITS_26, SSP_DATA_BITS_27,
+        SSP_DATA_BITS_28, SSP_DATA_BITS_29, SSP_DATA_BITS_30,
+        SSP_DATA_BITS_31, SSP_DATA_BITS_32
+};
+
+/**
+ * enum ssp_mode - SSP mode of operation (Communication modes)
+ */
+enum ssp_mode {
+        INTERRUPT_TRANSFER,
+        POLLING_TRANSFER,
+        DMA_TRANSFER
+};
+
+/**
+ * enum ssp_rx_level_trig - receive FIFO watermark level which triggers
+ * IT: Interrupt fires when _N_ or more elements in RX FIFO.
+ */
+enum ssp_rx_level_trig {
+        SSP_RX_1_OR_MORE_ELEM,
+        SSP_RX_4_OR_MORE_ELEM,
+        SSP_RX_8_OR_MORE_ELEM,
+        SSP_RX_16_OR_MORE_ELEM,
+        SSP_RX_32_OR_MORE_ELEM
+};
+
+/**
+ * Transmit FIFO watermark level which triggers (IT Interrupt fires
+ * when _N_ or more empty locations in TX FIFO)
+ */
+enum ssp_tx_level_trig {
+        SSP_TX_1_OR_MORE_EMPTY_LOC,
+        SSP_TX_4_OR_MORE_EMPTY_LOC,
+        SSP_TX_8_OR_MORE_EMPTY_LOC,
+        SSP_TX_16_OR_MORE_EMPTY_LOC,
+        SSP_TX_32_OR_MORE_EMPTY_LOC
+};
+
+/**
+ * enum SPI Clock Phase - clock phase (Motorola SPI interface only)
+ * @SSP_CLK_RISING_EDGE: Receive data on rising edge
+ * @SSP_CLK_FALLING_EDGE: Receive data on falling edge
+ */
+enum ssp_spi_clk_phase {
+        SSP_CLK_RISING_EDGE,
+        SSP_CLK_FALLING_EDGE
+};
+
+/**
+ * enum SPI Clock Polarity - clock polarity (Motorola SPI interface only)
+ * @SSP_CLK_POL_IDLE_LOW: Low inactive level
+ * @SSP_CLK_POL_IDLE_HIGH: High inactive level
+ */
+enum ssp_spi_clk_pol {
+        SSP_CLK_POL_IDLE_LOW,
+        SSP_CLK_POL_IDLE_HIGH
+};
+
+/**
+ * Microwire Conrol Lengths Command size in microwire format
+ */
+enum ssp_microwire_ctrl_len {
+        SSP_BITS_4 = 0x03, SSP_BITS_5, SSP_BITS_6,
+        SSP_BITS_7, SSP_BITS_8, SSP_BITS_9,
+        SSP_BITS_10, SSP_BITS_11, SSP_BITS_12,
+        SSP_BITS_13, SSP_BITS_14, SSP_BITS_15,
+        SSP_BITS_16, SSP_BITS_17, SSP_BITS_18,
+        SSP_BITS_19, SSP_BITS_20, SSP_BITS_21,
+        SSP_BITS_22, SSP_BITS_23, SSP_BITS_24,
+        SSP_BITS_25, SSP_BITS_26, SSP_BITS_27,
+        SSP_BITS_28, SSP_BITS_29, SSP_BITS_30,
+        SSP_BITS_31, SSP_BITS_32
+};
+
+/**
+ * enum Microwire Wait State
+ * @SSP_MWIRE_WAIT_ZERO: No wait state inserted after last command bit
+ * @SSP_MWIRE_WAIT_ONE: One wait state inserted after last command bit
+ */
+enum ssp_microwire_wait_state {
+        SSP_MWIRE_WAIT_ZERO,
+        SSP_MWIRE_WAIT_ONE
+};
+
+/**
+ * enum Microwire - whether Full/Half Duplex
+ * @SSP_MICROWIRE_CHANNEL_FULL_DUPLEX: SSPTXD becomes bi-directional,
+ *     SSPRXD not used
+ * @SSP_MICROWIRE_CHANNEL_HALF_DUPLEX: SSPTXD is an output, SSPRXD is
+ *     an input.
+ */
+enum ssp_duplex {
+        SSP_MICROWIRE_CHANNEL_FULL_DUPLEX,
+        SSP_MICROWIRE_CHANNEL_HALF_DUPLEX
+};
+
+/**
+ * CHIP select/deselect commands
+ */
+enum ssp_chip_select {
+        SSP_CHIP_SELECT,
+        SSP_CHIP_DESELECT
+};
+
+
+/**
+ * struct pl022_ssp_master - device.platform_data for SPI controller devices.
+ * @num_chipselect: chipselects are used to distinguish individual
+ *     SPI slaves, and are numbered from zero to num_chipselects - 1.
+ *     each slave has a chipselect signal, but it's common that not
+ *     every chipselect is connected to a slave.
+ * @enable_dma: if true enables DMA driven transfers.
+ */
+struct pl022_ssp_controller {
+        u16 bus_id;
+        u8 num_chipselect;
+        u8 enable_dma:1;
+};
+
+/**
+ * struct ssp_config_chip - spi_board_info.controller_data for SPI
+ * slave devices, copied to spi_device.controller_data.
+ *
+ * @lbm: used for test purpose to internally connect RX and TX
+ * @iface: Interface type(Motorola, TI, Microwire, Universal)
+ * @hierarchy: sets whether interface is master or slave
+ * @slave_tx_disable: SSPTXD is disconnected (in slave mode only)
+ * @clk_freq: Tune freq parameters of SSP(when in master mode)
+ * @endian_rx: Endianess of Data in Rx FIFO
+ * @endian_tx: Endianess of Data in Tx FIFO
+ * @data_size: Width of data element(4 to 32 bits)
+ * @com_mode: communication mode: polling, Interrupt or DMA
+ * @rx_lev_trig: Rx FIFO watermark level (for IT & DMA mode)
+ * @tx_lev_trig: Tx FIFO watermark level (for IT & DMA mode)
+ * @clk_phase: Motorola SPI interface Clock phase
+ * @clk_pol: Motorola SPI interface Clock polarity
+ * @ctrl_len: Microwire interface: Control length
+ * @wait_state: Microwire interface: Wait state
+ * @duplex: Microwire interface: Full/Half duplex
+ * @cs_control: function pointer to board-specific function to
+ * assert/deassert I/O port to control HW generation of devices chip-select.
+ * @dma_xfer_type: Type of DMA xfer (Mem-to-periph or Periph-to-Periph)
+ * @dma_config: DMA configuration for SSP controller and peripheral
+ */
+struct pl022_config_chip {
+        struct device *dev;
+        enum ssp_loopback lbm;
+        enum ssp_interface iface;
+        enum ssp_hierarchy hierarchy;
+        bool slave_tx_disable;
+        struct ssp_clock_params clk_freq;
+        enum ssp_rx_endian endian_rx;
+        enum ssp_tx_endian endian_tx;
+        enum ssp_data_size data_size;
+        enum ssp_mode com_mode;
+        enum ssp_rx_level_trig rx_lev_trig;
+        enum ssp_tx_level_trig tx_lev_trig;
+        enum ssp_spi_clk_phase clk_phase;
+        enum ssp_spi_clk_pol clk_pol;
+        enum ssp_microwire_ctrl_len ctrl_len;
+        enum ssp_microwire_wait_state wait_state;
+        enum ssp_duplex duplex;
+        void (*cs_control) (u32 control);
+};
+
+#endif /* _SSP_PL022_H */
diff --git a/include/linux/amba/serial.h b/include/linux/amba/serial.h
index 64a982ea5d5f..5a5a7fd62490 100644
--- a/include/linux/amba/serial.h
+++ b/include/linux/amba/serial.h
@@ -114,6 +114,9 @@
 #define UART011_IFLS_TX4_8      (2 << 0)
 #define UART011_IFLS_TX6_8      (3 << 0)
 #define UART011_IFLS_TX7_8      (4 << 0)
+/* special values for ST vendor with deeper fifo */
+#define UART011_IFLS_RX_HALF    (5 << 3)
+#define UART011_IFLS_TX_HALF    (5 << 0)
 
 #define UART011_OEIM            (1 << 10)       /* overrun error interrupt mask */
 #define UART011_BEIM            (1 << 9)        /* break error interrupt mask */
diff --git a/include/linux/atmel-mci.h b/include/linux/atmel-mci.h
index 2f1f95737acb..57b1846a3c87 100644
--- a/include/linux/atmel-mci.h
+++ b/include/linux/atmel-mci.h
@@ -10,6 +10,7 @@
  * @bus_width: Number of data lines wired up the slot
  * @detect_pin: GPIO pin wired to the card detect switch
  * @wp_pin: GPIO pin wired to the write protect sensor
+ * @detect_is_active_high: The state of the detect pin when it is active
  *
  * If a given slot is not present on the board, @bus_width should be
  * set to 0. The other fields are ignored in this case.
@@ -24,6 +25,7 @@ struct mci_slot_pdata {
         unsigned int            bus_width;
         int                     detect_pin;
         int                     wp_pin;
+        bool                    detect_is_active_high;
 };
 
 /**
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 12737be58601..2a04eb54c0dd 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -590,6 +590,11 @@ static inline void bio_list_merge_head(struct bio_list *bl,
         bl->head = bl2->head;
 }
 
+static inline struct bio *bio_list_peek(struct bio_list *bl)
+{
+        return bl->head;
+}
+
 static inline struct bio *bio_list_pop(struct bio_list *bl)
 {
         struct bio *bio = bl->head;
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0b1a6cae9de1..8963d9149b5f 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -926,6 +926,7 @@ extern void blk_queue_alignment_offset(struct request_queue *q,
                                        unsigned int alignment);
 extern void blk_queue_io_min(struct request_queue *q, unsigned int min);
 extern void blk_queue_io_opt(struct request_queue *q, unsigned int opt);
+extern void blk_set_default_limits(struct queue_limits *lim);
 extern int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
                             sector_t offset);
 extern void disk_stack_limits(struct gendisk *disk, struct block_device *bdev,
diff --git a/include/linux/bug.h b/include/linux/bug.h
index 54398d2c6d8d..d276b5510c83 100644
--- a/include/linux/bug.h
+++ b/include/linux/bug.h
@@ -1,7 +1,6 @@
 #ifndef _LINUX_BUG_H
 #define _LINUX_BUG_H
 
-#include <linux/module.h>
 #include <asm/bug.h>
 
 enum bug_trap_type {
@@ -24,10 +23,6 @@ const struct bug_entry *find_bug(unsigned long bugaddr);
 
 enum bug_trap_type report_bug(unsigned long bug_addr, struct pt_regs *regs);
 
-int  module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
-                         struct module *);
-void module_bug_cleanup(struct module *);
-
 /* These are defined by the architecture */
 int is_valid_bugaddr(unsigned long addr);
 
@@ -38,13 +33,6 @@ static inline enum bug_trap_type report_bug(unsigned long bug_addr,
 {
         return BUG_TRAP_TYPE_BUG;
 }
-static inline int  module_bug_finalize(const Elf_Ehdr *hdr,
-                                        const Elf_Shdr *sechdrs,
-                                        struct module *mod)
-{
-        return 0;
-}
-static inline void module_bug_cleanup(struct module *mod) {}
 
 #endif  /* CONFIG_GENERIC_BUG */
 #endif  /* _LINUX_BUG_H */
diff --git a/include/linux/c2port.h b/include/linux/c2port.h
index 7b5a2388ba67..2a5cd867c365 100644
--- a/include/linux/c2port.h
+++ b/include/linux/c2port.h
@@ -10,6 +10,7 @@
  */
 
 #include <linux/device.h>
+#include <linux/kmemcheck.h>
 
 #define C2PORT_NAME_LEN                 32
 
@@ -20,8 +21,10 @@
 /* Main struct */
 struct c2port_ops;
 struct c2port_device {
+        kmemcheck_bitfield_begin(flags);
         unsigned int access:1;
         unsigned int flash_access:1;
+        kmemcheck_bitfield_end(flags);
 
         int id;
         char name[C2PORT_NAME_LEN];
diff --git a/include/linux/can/Kbuild b/include/linux/can/Kbuild
index eff898aac02b..8cb05aae661c 100644
--- a/include/linux/can/Kbuild
+++ b/include/linux/can/Kbuild
@@ -1,3 +1,4 @@
 header-y += raw.h
 header-y += bcm.h
 header-y += error.h
+header-y += netlink.h
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
new file mode 100644
index 000000000000..4a37a56f6cdd
--- /dev/null
+++ b/include/linux/can/dev.h
@@ -0,0 +1,70 @@
+/*
+ * linux/can/dev.h
+ *
+ * Definitions for the CAN network device driver interface
+ *
+ * Copyright (C) 2006 Andrey Volkov <avolkov@varma-el.com>
+ *               Varma Electronics Oy
+ *
+ * Copyright (C) 2008 Wolfgang Grandegger <wg@grandegger.com>
+ *
+ * Send feedback to <socketcan-users@lists.berlios.de>
+ */
+
+#ifndef CAN_DEV_H
+#define CAN_DEV_H
+
+#include <linux/can/netlink.h>
+#include <linux/can/error.h>
+
+/*
+ * CAN mode
+ */
+enum can_mode {
+        CAN_MODE_STOP = 0,
+        CAN_MODE_START,
+        CAN_MODE_SLEEP
+};
+
+/*
+ * CAN common private data
+ */
+#define CAN_ECHO_SKB_MAX  4
+
+struct can_priv {
+        struct can_device_stats can_stats;
+
+        struct can_bittiming bittiming;
+        struct can_bittiming_const *bittiming_const;
+        struct can_clock clock;
+
+        enum can_state state;
+        u32 ctrlmode;
+
+        int restart_ms;
+        struct timer_list restart_timer;
+
+        struct sk_buff *echo_skb[CAN_ECHO_SKB_MAX];
+
+        int (*do_set_bittiming)(struct net_device *dev);
+        int (*do_set_mode)(struct net_device *dev, enum can_mode mode);
+        int (*do_get_state)(const struct net_device *dev,
+                            enum can_state *state);
+};
+
+struct net_device *alloc_candev(int sizeof_priv);
+void free_candev(struct net_device *dev);
+
+int open_candev(struct net_device *dev);
+void close_candev(struct net_device *dev);
+
+int register_candev(struct net_device *dev);
+void unregister_candev(struct net_device *dev);
+
+int can_restart_now(struct net_device *dev);
+void can_bus_off(struct net_device *dev);
+
+void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, int idx);
+void can_get_echo_skb(struct net_device *dev, int idx);
+
+#endif /* CAN_DEV_H */
diff --git a/include/linux/can/netlink.h b/include/linux/can/netlink.h
new file mode 100644
index 000000000000..9ecbb7871c0e
--- /dev/null
+++ b/include/linux/can/netlink.h
@@ -0,0 +1,113 @@
+/*
+ * linux/can/netlink.h
+ *
+ * Definitions for the CAN netlink interface
+ *
+ * Copyright (c) 2009 Wolfgang Grandegger <wg@grandegger.com>
+ *
+ * Send feedback to <socketcan-users@lists.berlios.de>
+ *
+ */
+
+#ifndef CAN_NETLINK_H
+#define CAN_NETLINK_H
+
+#include <linux/types.h>
+
+/*
+ * CAN bit-timing parameters
+ *
+ * For futher information, please read chapter "8 BIT TIMING
+ * REQUIREMENTS" of the "Bosch CAN Specification version 2.0"
+ * at http://www.semiconductors.bosch.de/pdf/can2spec.pdf.
+ */
+struct can_bittiming {
+        __u32 bitrate;          /* Bit-rate in bits/second */
+        __u32 sample_point;     /* Sample point in one-tenth of a percent */
+        __u32 tq;               /* Time quanta (TQ) in nanoseconds */
+        __u32 prop_seg;         /* Propagation segment in TQs */
+        __u32 phase_seg1;       /* Phase buffer segment 1 in TQs */
+        __u32 phase_seg2;       /* Phase buffer segment 2 in TQs */
+        __u32 sjw;              /* Synchronisation jump width in TQs */
+        __u32 brp;              /* Bit-rate prescaler */
+};
+
+/*
+ * CAN harware-dependent bit-timing constant
+ *
+ * Used for calculating and checking bit-timing parameters
+ */
+struct can_bittiming_const {
+        char name[16];          /* Name of the CAN controller hardware */
+        __u32 tseg1_min;        /* Time segement 1 = prop_seg + phase_seg1 */
+        __u32 tseg1_max;
+        __u32 tseg2_min;        /* Time segement 2 = phase_seg2 */
+        __u32 tseg2_max;
+        __u32 sjw_max;          /* Synchronisation jump width */
+        __u32 brp_min;          /* Bit-rate prescaler */
+        __u32 brp_max;
+        __u32 brp_inc;
+};
+
+/*
+ * CAN clock parameters
+ */
+struct can_clock {
+        __u32 freq;             /* CAN system clock frequency in Hz */
+};
+
+/*
+ * CAN operational and error states
+ */
+enum can_state {
+        CAN_STATE_ERROR_ACTIVE = 0,     /* RX/TX error count < 96 */
+        CAN_STATE_ERROR_WARNING,        /* RX/TX error count < 128 */
+        CAN_STATE_ERROR_PASSIVE,        /* RX/TX error count < 256 */
+        CAN_STATE_BUS_OFF,              /* RX/TX error count >= 256 */
+        CAN_STATE_STOPPED,              /* Device is stopped */
+        CAN_STATE_SLEEPING,             /* Device is sleeping */
+        CAN_STATE_MAX
+};
+
+/*
+ * CAN controller mode
+ */
+struct can_ctrlmode {
+        __u32 mask;
+        __u32 flags;
+};
+
+#define CAN_CTRLMODE_LOOPBACK   0x1     /* Loopback mode */
+#define CAN_CTRLMODE_LISTENONLY 0x2     /* Listen-only mode */
+#define CAN_CTRLMODE_3_SAMPLES  0x4     /* Triple sampling mode */
+
+/*
+ * CAN device statistics
+ */
+struct can_device_stats {
+        __u32 bus_error;        /* Bus errors */
+        __u32 error_warning;    /* Changes to error warning state */
+        __u32 error_passive;    /* Changes to error passive state */
+        __u32 bus_off;          /* Changes to bus off state */
+        __u32 arbitration_lost; /* Arbitration lost errors */
+        __u32 restarts;         /* CAN controller re-starts */
+};
+
+/*
+ * CAN netlink interface
+ */
+enum {
+        IFLA_CAN_UNSPEC,
+        IFLA_CAN_BITTIMING,
+        IFLA_CAN_BITTIMING_CONST,
+        IFLA_CAN_CLOCK,
+        IFLA_CAN_STATE,
+        IFLA_CAN_CTRLMODE,
+        IFLA_CAN_RESTART_MS,
+        IFLA_CAN_RESTART,
+        __IFLA_CAN_MAX
+};
+
+#define IFLA_CAN_MAX    (__IFLA_CAN_MAX - 1)
+
+#endif /* CAN_NETLINK_H */
diff --git a/include/linux/can/platform/sja1000.h b/include/linux/can/platform/sja1000.h
new file mode 100644
index 000000000000..01ee2aeb048d
--- /dev/null
+++ b/include/linux/can/platform/sja1000.h
@@ -0,0 +1,35 @@
+#ifndef _CAN_PLATFORM_SJA1000_H_
+#define _CAN_PLATFORM_SJA1000_H_
+
+/* clock divider register */
+#define CDR_CLKOUT_MASK 0x07
+#define CDR_CLK_OFF     0x08 /* Clock off (CLKOUT pin) */
+#define CDR_RXINPEN     0x20 /* TX1 output is RX irq output */
+#define CDR_CBP         0x40 /* CAN input comparator bypass */
+#define CDR_PELICAN     0x80 /* PeliCAN mode */
+
+/* output control register */
+#define OCR_MODE_BIPHASE  0x00
+#define OCR_MODE_TEST     0x01
+#define OCR_MODE_NORMAL   0x02
+#define OCR_MODE_CLOCK    0x03
+#define OCR_MODE_MASK     0x07
+#define OCR_TX0_INVERT    0x04
+#define OCR_TX0_PULLDOWN  0x08
+#define OCR_TX0_PULLUP    0x10
+#define OCR_TX0_PUSHPULL  0x18
+#define OCR_TX1_INVERT    0x20
+#define OCR_TX1_PULLDOWN  0x40
+#define OCR_TX1_PULLUP    0x80
+#define OCR_TX1_PUSHPULL  0xc0
+#define OCR_TX_MASK       0xfc
+#define OCR_TX_SHIFT      2
+
+struct sja1000_platform_data {
+        u32 clock;      /* CAN bus oscillator frequency in Hz */
+
+        u8 ocr;         /* output control register */
+        u8 cdr;         /* clock divider register */
+};
+
+#endif  /* !_CAN_PLATFORM_SJA1000_H_ */
diff --git a/include/linux/cb710.h b/include/linux/cb710.h
new file mode 100644
index 000000000000..63bc9a4d2926
--- /dev/null
+++ b/include/linux/cb710.h
@@ -0,0 +1,231 @@
+/*
+ *  cb710/cb710.h
+ *
+ *  Copyright by Michał Mirosław, 2008-2009
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef LINUX_CB710_DRIVER_H
+#define LINUX_CB710_DRIVER_H
+
+#include <linux/io.h>
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/pci.h>
+#include <linux/platform_device.h>
+#include <linux/mmc/host.h>
+
+struct cb710_slot;
+
+typedef int (*cb710_irq_handler_t)(struct cb710_slot *);
+
+/* per-virtual-slot structure */
+struct cb710_slot {
+        struct platform_device  pdev;
+        void __iomem            *iobase;
+        cb710_irq_handler_t     irq_handler;
+};
+
+/* per-device structure */
+struct cb710_chip {
+        struct pci_dev          *pdev;
+        void __iomem            *iobase;
+        unsigned                platform_id;
+#ifdef CONFIG_CB710_DEBUG_ASSUMPTIONS
+        atomic_t                slot_refs_count;
+#endif
+        unsigned                slot_mask;
+        unsigned                slots;
+        spinlock_t              irq_lock;
+        struct cb710_slot       slot[0];
+};
+
+/* NOTE: cb710_chip.slots is modified only during device init/exit and
+ * they are all serialized wrt themselves */
+
+/* cb710_chip.slot_mask values */
+#define CB710_SLOT_MMC          1
+#define CB710_SLOT_MS           2
+#define CB710_SLOT_SM           4
+
+/* slot port accessors - so the logic is more clear in the code */
+#define CB710_PORT_ACCESSORS(t) \
+static inline void cb710_write_port_##t(struct cb710_slot *slot,        \
+        unsigned port, u##t value)                                      \
+{                                                                       \
+        iowrite##t(value, slot->iobase + port);                         \
+}                                                                       \
+                                                                        \
+static inline u##t cb710_read_port_##t(struct cb710_slot *slot,         \
+        unsigned port)                                                  \
+{                                                                       \
+        return ioread##t(slot->iobase + port);                          \
+}                                                                       \
+                                                                        \
+static inline void cb710_modify_port_##t(struct cb710_slot *slot,       \
+        unsigned port, u##t set, u##t clear)                            \
+{                                                                       \
+        iowrite##t(                                                     \
+                (ioread##t(slot->iobase + port) & ~clear)|set,          \
+                slot->iobase + port);                                   \
+}
+
+CB710_PORT_ACCESSORS(8)
+CB710_PORT_ACCESSORS(16)
+CB710_PORT_ACCESSORS(32)
+
+void cb710_pci_update_config_reg(struct pci_dev *pdev,
+        int reg, uint32_t and, uint32_t xor);
+void cb710_set_irq_handler(struct cb710_slot *slot,
+        cb710_irq_handler_t handler);
+
+/* some device struct walking */
+
+static inline struct cb710_slot *cb710_pdev_to_slot(
+        struct platform_device *pdev)
+{
+        return container_of(pdev, struct cb710_slot, pdev);
+}
+
+static inline struct cb710_chip *cb710_slot_to_chip(struct cb710_slot *slot)
+{
+        return dev_get_drvdata(slot->pdev.dev.parent);
+}
+
+static inline struct device *cb710_slot_dev(struct cb710_slot *slot)
+{
+        return &slot->pdev.dev;
+}
+
+static inline struct device *cb710_chip_dev(struct cb710_chip *chip)
+{
+        return &chip->pdev->dev;
+}
+
+/* debugging aids */
+
+#ifdef CONFIG_CB710_DEBUG
+void cb710_dump_regs(struct cb710_chip *chip, unsigned dump);
+#else
+#define cb710_dump_regs(c, d) do {} while (0)
+#endif
+
+#define CB710_DUMP_REGS_MMC     0x0F
+#define CB710_DUMP_REGS_MS      0x30
+#define CB710_DUMP_REGS_SM      0xC0
+#define CB710_DUMP_REGS_ALL     0xFF
+#define CB710_DUMP_REGS_MASK    0xFF
+
+#define CB710_DUMP_ACCESS_8     0x100
+#define CB710_DUMP_ACCESS_16    0x200
+#define CB710_DUMP_ACCESS_32    0x400
+#define CB710_DUMP_ACCESS_ALL   0x700
+#define CB710_DUMP_ACCESS_MASK  0x700
+
+#endif /* LINUX_CB710_DRIVER_H */
+/*
+ *  cb710/sgbuf2.h
+ *
+ *  Copyright by Michał Mirosław, 2008-2009
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef LINUX_CB710_SG_H
+#define LINUX_CB710_SG_H
+
+#include <linux/highmem.h>
+#include <linux/scatterlist.h>
+
+/**
+ * cb710_sg_miter_stop_writing - stop mapping iteration after writing
+ * @miter: sg mapping iter to be stopped
+ *
+ * Description:
+ *   Stops mapping iterator @miter.  @miter should have been started
+ *   started using sg_miter_start().  A stopped iteration can be
+ *   resumed by calling sg_miter_next() on it.  This is useful when
+ *   resources (kmap) need to be released during iteration.
+ *
+ *   This is a convenience wrapper that will be optimized out for arches
+ *   that don't need flush_kernel_dcache_page().
+ *
+ * Context:
+ *   IRQ disabled if the SG_MITER_ATOMIC is set.  Don't care otherwise.
+ */
+static inline void cb710_sg_miter_stop_writing(struct sg_mapping_iter *miter)
+{
+        if (miter->page)
+                flush_kernel_dcache_page(miter->page);
+        sg_miter_stop(miter);
+}
+
+/*
+ * 32-bit PIO mapping sg iterator
+ *
+ * Hides scatterlist access issues - fragment boundaries, alignment, page
+ * mapping - for drivers using 32-bit-word-at-a-time-PIO (ie. PCI devices
+ * without DMA support).
+ *
+ * Best-case reading (transfer from device):
+ *   sg_miter_start();
+ *   cb710_sg_dwiter_write_from_io();
+ *   cb710_sg_miter_stop_writing();
+ *
+ * Best-case writing (transfer to device):
+ *   sg_miter_start();
+ *   cb710_sg_dwiter_read_to_io();
+ *   sg_miter_stop();
+ */
+
+uint32_t cb710_sg_dwiter_read_next_block(struct sg_mapping_iter *miter);
+void cb710_sg_dwiter_write_next_block(struct sg_mapping_iter *miter, uint32_t data);
+
+/**
+ * cb710_sg_dwiter_write_from_io - transfer data to mapped buffer from 32-bit IO port
+ * @miter: sg mapping iter
+ * @port: PIO port - IO or MMIO address
+ * @count: number of 32-bit words to transfer
+ *
+ * Description:
+ *   Reads @count 32-bit words from register @port and stores it in
+ *   buffer iterated by @miter.  Data that would overflow the buffer
+ *   is silently ignored.  Iterator is advanced by 4*@count bytes
+ *   or to the buffer's end whichever is closer.
+ *
+ * Context:
+ *   IRQ disabled if the SG_MITER_ATOMIC is set.  Don't care otherwise.
+ */
+static inline void cb710_sg_dwiter_write_from_io(struct sg_mapping_iter *miter,
+        void __iomem *port, size_t count)
+{
+        while (count-- > 0)
+                cb710_sg_dwiter_write_next_block(miter, ioread32(port));
+}
+
+/**
+ * cb710_sg_dwiter_read_to_io - transfer data to 32-bit IO port from mapped buffer
+ * @miter: sg mapping iter
+ * @port: PIO port - IO or MMIO address
+ * @count: number of 32-bit words to transfer
+ *
+ * Description:
+ *   Writes @count 32-bit words to register @port from buffer iterated
+ *   through @miter.  If buffer ends before @count words are written
+ *   missing data is replaced by zeroes. @miter is advanced by 4*@count
+ *   bytes or to the buffer's end whichever is closer.
+ *
+ * Context:
+ *   IRQ disabled if the SG_MITER_ATOMIC is set.  Don't care otherwise.
+ */
+static inline void cb710_sg_dwiter_read_to_io(struct sg_mapping_iter *miter,
+        void __iomem *port, size_t count)
+{
+        while (count-- > 0)
+                iowrite32(cb710_sg_dwiter_read_next_block(miter), port);
+}
+
+#endif /* LINUX_CB710_SG_H */
diff --git a/include/linux/clk.h b/include/linux/clk.h
index 1db9bbf444a3..1d37f42ac294 100644
--- a/include/linux/clk.h
+++ b/include/linux/clk.h
@@ -142,4 +142,17 @@ struct clk *clk_get_parent(struct clk *clk);
  */
 struct clk *clk_get_sys(const char *dev_id, const char *con_id);
 
+/**
+ * clk_add_alias - add a new clock alias
+ * @alias: name for clock alias
+ * @alias_dev_name: device name
+ * @id: platform specific clock name
+ * @dev: device
+ *
+ * Allows using generic clock names for drivers by adding a new alias.
+ * Assumes clkdev, see clkdev.h for more info.
+ */
+int clk_add_alias(const char *alias, const char *alias_dev_name, char *id,
+                        struct device *dev);
+
 #endif
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index 3a1dbba4d3ae..20a100fe2b4f 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -143,3 +143,12 @@ extern void clockevents_notify(unsigned long reason, void *arg);
 #endif
 
 #endif
+
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
+extern ktime_t clockevents_get_next_event(int cpu);
+#else
+static inline ktime_t clockevents_get_next_event(int cpu)
+{
+        return (ktime_t) { .tv64 = KTIME_MAX };
+}
+#endif
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index 05ea1dd7d681..a5740fc4d04b 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -18,7 +18,6 @@
 
 extern int number_of_cpusets;   /* How many cpusets are defined in system? */
 
-extern int cpuset_init_early(void);
 extern int cpuset_init(void);
 extern void cpuset_init_smp(void);
 extern void cpuset_cpus_allowed(struct task_struct *p, struct cpumask *mask);
@@ -27,7 +26,6 @@ extern void cpuset_cpus_allowed_locked(struct task_struct *p,
 extern nodemask_t cpuset_mems_allowed(struct task_struct *p);
 #define cpuset_current_mems_allowed (current->mems_allowed)
 void cpuset_init_current_mems_allowed(void);
-void cpuset_update_task_memory_state(void);
 int cpuset_nodemask_valid_mems_allowed(nodemask_t *nodemask);
 
 extern int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask);
@@ -92,9 +90,13 @@ extern void rebuild_sched_domains(void);
 
 extern void cpuset_print_task_mems_allowed(struct task_struct *p);
 
+static inline void set_mems_allowed(nodemask_t nodemask)
+{
+        current->mems_allowed = nodemask;
+}
+
 #else /* !CONFIG_CPUSETS */
 
-static inline int cpuset_init_early(void) { return 0; }
 static inline int cpuset_init(void) { return 0; }
 static inline void cpuset_init_smp(void) {}
 
@@ -116,7 +118,6 @@ static inline nodemask_t cpuset_mems_allowed(struct task_struct *p)
 
 #define cpuset_current_mems_allowed (node_states[N_HIGH_MEMORY])
 static inline void cpuset_init_current_mems_allowed(void) {}
-static inline void cpuset_update_task_memory_state(void) {}
 
 static inline int cpuset_nodemask_valid_mems_allowed(nodemask_t *nodemask)
 {
@@ -188,6 +189,10 @@ static inline void cpuset_print_task_mems_allowed(struct task_struct *p)
 {
 }
 
+static inline void set_mems_allowed(nodemask_t nodemask)
+{
+}
+
 #endif /* !CONFIG_CPUSETS */
 
 #endif /* _LINUX_CPUSET_H */
diff --git a/include/linux/device.h b/include/linux/device.h
index a4a7b10aaa48..ed4e39f2c423 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -114,6 +114,8 @@ extern int bus_unregister_notifier(struct bus_type *bus,
 #define BUS_NOTIFY_BOUND_DRIVER         0x00000003 /* driver bound to device */
 #define BUS_NOTIFY_UNBIND_DRIVER        0x00000004 /* driver about to be
                                                       unbound */
+#define BUS_NOTIFY_UNBOUND_DRIVER       0x00000005 /* driver is unbound
+                                                      from the device */
 
 extern struct kset *bus_get_kset(struct bus_type *bus);
 extern struct klist *bus_get_device_klist(struct bus_type *bus);
@@ -192,6 +194,7 @@ struct class {
         struct kobject                  *dev_kobj;
 
         int (*dev_uevent)(struct device *dev, struct kobj_uevent_env *env);
+        char *(*nodename)(struct device *dev);
 
         void (*class_release)(struct class *class);
         void (*dev_release)(struct device *dev);
@@ -287,6 +290,7 @@ struct device_type {
         const char *name;
         struct attribute_group **groups;
         int (*uevent)(struct device *dev, struct kobj_uevent_env *env);
+        char *(*nodename)(struct device *dev);
         void (*release)(struct device *dev);
 
         struct dev_pm_ops *pm;
@@ -486,6 +490,7 @@ extern struct device *device_find_child(struct device *dev, void *data,
 extern int device_rename(struct device *dev, char *new_name);
 extern int device_move(struct device *dev, struct device *new_parent,
                        enum dpm_order dpm_order);
+extern const char *device_get_nodename(struct device *dev, const char **tmp);
 
 /*
  * Root device objects for grouping under /sys/devices
diff --git a/include/linux/eisa.h b/include/linux/eisa.h
index e61c0be2a459..6925249a5ac6 100644
--- a/include/linux/eisa.h
+++ b/include/linux/eisa.h
@@ -78,12 +78,12 @@ static inline void eisa_driver_unregister (struct eisa_driver *edrv) { }
 /* Mimics pci.h... */
 static inline void *eisa_get_drvdata (struct eisa_device *edev)
 {
-        return edev->dev.driver_data;
+        return dev_get_drvdata(&edev->dev);
 }
 
 static inline void eisa_set_drvdata (struct eisa_device *edev, void *data)
 {
-        edev->dev.driver_data = data;
+        dev_set_drvdata(&edev->dev, data);
 }
 
 /* The EISA root device. There's rumours about machines with multiple
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index a1f17abba7dc..3d7a6687d247 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -182,6 +182,33 @@ static inline unsigned compare_ether_addr_64bits(const u8 addr1[6+2],
         return compare_ether_addr(addr1, addr2);
 #endif
 }
+
+/**
+ * is_etherdev_addr - Tell if given Ethernet address belongs to the device.
+ * @dev: Pointer to a device structure
+ * @addr: Pointer to a six-byte array containing the Ethernet address
+ *
+ * Compare passed address with all addresses of the device. Return true if the
+ * address if one of the device addresses.
+ *
+ * Note that this function calls compare_ether_addr_64bits() so take care of
+ * the right padding.
+ */
+static inline bool is_etherdev_addr(const struct net_device *dev,
+                                    const u8 addr[6 + 2])
+{
+        struct netdev_hw_addr *ha;
+        int res = 1;
+
+        rcu_read_lock();
+        for_each_dev_addr(dev, ha) {
+                res = compare_ether_addr_64bits(addr, ha->addr);
+                if (!res)
+                        break;
+        }
+        rcu_read_unlock();
+        return !res;
+}
 #endif  /* __KERNEL__ */
 
 /**
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 131b127b70f8..9b660bd2e2b3 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -26,11 +26,14 @@ struct ethtool_cmd {
         __u8    phy_address;
         __u8    transceiver;    /* Which transceiver to use */
         __u8    autoneg;        /* Enable or disable autonegotiation */
+        __u8    mdio_support;
         __u32   maxtxpkt;       /* Tx pkts before generating tx int */
         __u32   maxrxpkt;       /* Rx pkts before generating rx int */
         __u16   speed_hi;
-        __u16   reserved2;
-        __u32   reserved[3];
+        __u8    eth_tp_mdix;
+        __u8    reserved2;
+        __u32   lp_advertising; /* Features the link partner advertises */
+        __u32   reserved[2];
 };
 
 static inline void ethtool_cmd_speed_set(struct ethtool_cmd *ep,
@@ -563,6 +566,11 @@ struct ethtool_ops {
 #define SUPPORTED_Pause                 (1 << 13)
 #define SUPPORTED_Asym_Pause            (1 << 14)
 #define SUPPORTED_2500baseX_Full        (1 << 15)
+#define SUPPORTED_Backplane             (1 << 16)
+#define SUPPORTED_1000baseKX_Full       (1 << 17)
+#define SUPPORTED_10000baseKX4_Full     (1 << 18)
+#define SUPPORTED_10000baseKR_Full      (1 << 19)
+#define SUPPORTED_10000baseR_FEC        (1 << 20)
 
 /* Indicates what features are advertised by the interface. */
 #define ADVERTISED_10baseT_Half         (1 << 0)
@@ -581,6 +589,11 @@ struct ethtool_ops {
 #define ADVERTISED_Pause                (1 << 13)
 #define ADVERTISED_Asym_Pause           (1 << 14)
 #define ADVERTISED_2500baseX_Full       (1 << 15)
+#define ADVERTISED_Backplane            (1 << 16)
+#define ADVERTISED_1000baseKX_Full      (1 << 17)
+#define ADVERTISED_10000baseKX4_Full    (1 << 18)
+#define ADVERTISED_10000baseKR_Full     (1 << 19)
+#define ADVERTISED_10000baseR_FEC       (1 << 20)
 
 /* The following are all involved in forcing a particular link
  * mode for the device for setting things.  When getting the
@@ -605,6 +618,7 @@ struct ethtool_ops {
 #define PORT_MII                0x02
 #define PORT_FIBRE              0x03
 #define PORT_BNC                0x04
+#define PORT_OTHER              0xff
 
 /* Which transceiver to use. */
 #define XCVR_INTERNAL           0x00
@@ -619,6 +633,11 @@ struct ethtool_ops {
 #define AUTONEG_DISABLE         0x00
 #define AUTONEG_ENABLE          0x01
 
+/* Mode MDI or MDI-X */
+#define ETH_TP_MDI_INVALID      0x00
+#define ETH_TP_MDI              0x01
+#define ETH_TP_MDI_X            0x02
+
 /* Wake-On-Lan options. */
 #define WAKE_PHY                (1 << 0)
 #define WAKE_UCAST              (1 << 1)
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 330c4b1bfcaa..dd68358996b7 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -677,6 +677,9 @@ struct fb_ops {
         /* get capability given var */
         void (*fb_get_caps)(struct fb_info *info, struct fb_blit_caps *caps,
                             struct fb_var_screeninfo *var);
+
+        /* teardown any resources to do with this framebuffer */
+        void (*fb_destroy)(struct fb_info *info);
 };
 
 #ifdef CONFIG_FB_TILEBLITTING
@@ -786,6 +789,8 @@ struct fb_tile_ops {
 #define FBINFO_MISC_USEREVENT          0x10000 /* event request
                                                   from userspace */
 #define FBINFO_MISC_TILEBLITTING       0x20000 /* use tile blitting */
+#define FBINFO_MISC_FIRMWARE           0x40000 /* a replaceable firmware
+                                                  inited framebuffer */
 
 /* A driver may set this flag to indicate that it does want a set_par to be
  * called every time when fbcon_switch is executed. The advantage is that with
@@ -854,7 +859,12 @@ struct fb_info {
         u32 state;                      /* Hardware state i.e suspend */
         void *fbcon_par;                /* fbcon use-only private area */
         /* From here on everything is device dependent */
-        void *par;      
+        void *par;
+        /* we need the PCI or similiar aperture base/size not
+           smem_start/size as smem_start may just be an object
+           allocated inside the aperture so may not actually overlap */
+        resource_size_t aperture_base;
+        resource_size_t aperture_size;
 };
 
 #ifdef MODULE
@@ -893,7 +903,7 @@ struct fb_info {
 #define fb_writeq sbus_writeq
 #define fb_memset sbus_memset_io
 
-#elif defined(__i386__) || defined(__alpha__) || defined(__x86_64__) || defined(__hppa__) || defined(__sh__) || defined(__powerpc__) || defined(__avr32__)
+#elif defined(__i386__) || defined(__alpha__) || defined(__x86_64__) || defined(__hppa__) || defined(__sh__) || defined(__powerpc__) || defined(__avr32__) || defined(__bfin__)
 
 #define fb_readb __raw_readb
 #define fb_readw __raw_readw
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
new file mode 100644
index 000000000000..e584b7215e8b
--- /dev/null
+++ b/include/linux/firewire.h
@@ -0,0 +1,358 @@
+#ifndef _LINUX_FIREWIRE_H
+#define _LINUX_FIREWIRE_H
+
+#include <linux/completion.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/kref.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
+#include <linux/sysfs.h>
+#include <linux/timer.h>
+#include <linux/types.h>
+#include <linux/workqueue.h>
+
+#include <asm/atomic.h>
+#include <asm/byteorder.h>
+
+#define fw_notify(s, args...) printk(KERN_NOTICE KBUILD_MODNAME ": " s, ## args)
+#define fw_error(s, args...) printk(KERN_ERR KBUILD_MODNAME ": " s, ## args)
+
+static inline void fw_memcpy_from_be32(void *_dst, void *_src, size_t size)
+{
+        u32    *dst = _dst;
+        __be32 *src = _src;
+        int i;
+
+        for (i = 0; i < size / 4; i++)
+                dst[i] = be32_to_cpu(src[i]);
+}
+
+static inline void fw_memcpy_to_be32(void *_dst, void *_src, size_t size)
+{
+        fw_memcpy_from_be32(_dst, _src, size);
+}
+#define CSR_REGISTER_BASE               0xfffff0000000ULL
+
+/* register offsets are relative to CSR_REGISTER_BASE */
+#define CSR_STATE_CLEAR                 0x0
+#define CSR_STATE_SET                   0x4
+#define CSR_NODE_IDS                    0x8
+#define CSR_RESET_START                 0xc
+#define CSR_SPLIT_TIMEOUT_HI            0x18
+#define CSR_SPLIT_TIMEOUT_LO            0x1c
+#define CSR_CYCLE_TIME                  0x200
+#define CSR_BUS_TIME                    0x204
+#define CSR_BUSY_TIMEOUT                0x210
+#define CSR_BUS_MANAGER_ID              0x21c
+#define CSR_BANDWIDTH_AVAILABLE         0x220
+#define CSR_CHANNELS_AVAILABLE          0x224
+#define CSR_CHANNELS_AVAILABLE_HI       0x224
+#define CSR_CHANNELS_AVAILABLE_LO       0x228
+#define CSR_BROADCAST_CHANNEL           0x234
+#define CSR_CONFIG_ROM                  0x400
+#define CSR_CONFIG_ROM_END              0x800
+#define CSR_FCP_COMMAND                 0xB00
+#define CSR_FCP_RESPONSE                0xD00
+#define CSR_FCP_END                     0xF00
+#define CSR_TOPOLOGY_MAP                0x1000
+#define CSR_TOPOLOGY_MAP_END            0x1400
+#define CSR_SPEED_MAP                   0x2000
+#define CSR_SPEED_MAP_END               0x3000
+
+#define CSR_OFFSET              0x40
+#define CSR_LEAF                0x80
+#define CSR_DIRECTORY           0xc0
+
+#define CSR_DESCRIPTOR          0x01
+#define CSR_VENDOR              0x03
+#define CSR_HARDWARE_VERSION    0x04
+#define CSR_NODE_CAPABILITIES   0x0c
+#define CSR_UNIT                0x11
+#define CSR_SPECIFIER_ID        0x12
+#define CSR_VERSION             0x13
+#define CSR_DEPENDENT_INFO      0x14
+#define CSR_MODEL               0x17
+#define CSR_INSTANCE            0x18
+#define CSR_DIRECTORY_ID        0x20
+
+struct fw_csr_iterator {
+        u32 *p;
+        u32 *end;
+};
+
+void fw_csr_iterator_init(struct fw_csr_iterator *ci, u32 *p);
+int fw_csr_iterator_next(struct fw_csr_iterator *ci, int *key, int *value);
+
+extern struct bus_type fw_bus_type;
+
+struct fw_card_driver;
+struct fw_node;
+
+struct fw_card {
+        const struct fw_card_driver *driver;
+        struct device *device;
+        struct kref kref;
+        struct completion done;
+
+        int node_id;
+        int generation;
+        int current_tlabel;
+        u64 tlabel_mask;
+        struct list_head transaction_list;
+        struct timer_list flush_timer;
+        unsigned long reset_jiffies;
+
+        unsigned long long guid;
+        unsigned max_receive;
+        int link_speed;
+        int config_rom_generation;
+
+        spinlock_t lock; /* Take this lock when handling the lists in
+                          * this struct. */
+        struct fw_node *local_node;
+        struct fw_node *root_node;
+        struct fw_node *irm_node;
+        u8 color; /* must be u8 to match the definition in struct fw_node */
+        int gap_count;
+        bool beta_repeaters_present;
+
+        int index;
+
+        struct list_head link;
+
+        /* Work struct for BM duties. */
+        struct delayed_work work;
+        int bm_retries;
+        int bm_generation;
+
+        bool broadcast_channel_allocated;
+        u32 broadcast_channel;
+        u32 topology_map[(CSR_TOPOLOGY_MAP_END - CSR_TOPOLOGY_MAP) / 4];
+};
+
+static inline struct fw_card *fw_card_get(struct fw_card *card)
+{
+        kref_get(&card->kref);
+
+        return card;
+}
+
+void fw_card_release(struct kref *kref);
+
+static inline void fw_card_put(struct fw_card *card)
+{
+        kref_put(&card->kref, fw_card_release);
+}
+
+struct fw_attribute_group {
+        struct attribute_group *groups[2];
+        struct attribute_group group;
+        struct attribute *attrs[12];
+};
+
+enum fw_device_state {
+        FW_DEVICE_INITIALIZING,
+        FW_DEVICE_RUNNING,
+        FW_DEVICE_GONE,
+        FW_DEVICE_SHUTDOWN,
+};
+
+/*
+ * Note, fw_device.generation always has to be read before fw_device.node_id.
+ * Use SMP memory barriers to ensure this.  Otherwise requests will be sent
+ * to an outdated node_id if the generation was updated in the meantime due
+ * to a bus reset.
+ *
+ * Likewise, fw-core will take care to update .node_id before .generation so
+ * that whenever fw_device.generation is current WRT the actual bus generation,
+ * fw_device.node_id is guaranteed to be current too.
+ *
+ * The same applies to fw_device.card->node_id vs. fw_device.generation.
+ *
+ * fw_device.config_rom and fw_device.config_rom_length may be accessed during
+ * the lifetime of any fw_unit belonging to the fw_device, before device_del()
+ * was called on the last fw_unit.  Alternatively, they may be accessed while
+ * holding fw_device_rwsem.
+ */
+struct fw_device {
+        atomic_t state;
+        struct fw_node *node;
+        int node_id;
+        int generation;
+        unsigned max_speed;
+        struct fw_card *card;
+        struct device device;
+
+        struct mutex client_list_mutex;
+        struct list_head client_list;
+
+        u32 *config_rom;
+        size_t config_rom_length;
+        int config_rom_retries;
+        unsigned is_local:1;
+        unsigned max_rec:4;
+        unsigned cmc:1;
+        unsigned irmc:1;
+        unsigned bc_implemented:2;
+
+        struct delayed_work work;
+        struct fw_attribute_group attribute_group;
+};
+
+static inline struct fw_device *fw_device(struct device *dev)
+{
+        return container_of(dev, struct fw_device, device);
+}
+
+static inline int fw_device_is_shutdown(struct fw_device *device)
+{
+        return atomic_read(&device->state) == FW_DEVICE_SHUTDOWN;
+}
+
+static inline struct fw_device *fw_device_get(struct fw_device *device)
+{
+        get_device(&device->device);
+
+        return device;
+}
+
+static inline void fw_device_put(struct fw_device *device)
+{
+        put_device(&device->device);
+}
+
+int fw_device_enable_phys_dma(struct fw_device *device);
+
+/*
+ * fw_unit.directory must not be accessed after device_del(&fw_unit.device).
+ */
+struct fw_unit {
+        struct device device;
+        u32 *directory;
+        struct fw_attribute_group attribute_group;
+};
+
+static inline struct fw_unit *fw_unit(struct device *dev)
+{
+        return container_of(dev, struct fw_unit, device);
+}
+
+static inline struct fw_unit *fw_unit_get(struct fw_unit *unit)
+{
+        get_device(&unit->device);
+
+        return unit;
+}
+
+static inline void fw_unit_put(struct fw_unit *unit)
+{
+        put_device(&unit->device);
+}
+
+static inline struct fw_device *fw_parent_device(struct fw_unit *unit)
+{
+        return fw_device(unit->device.parent);
+}
+
+struct ieee1394_device_id;
+
+struct fw_driver {
+        struct device_driver driver;
+        /* Called when the parent device sits through a bus reset. */
+        void (*update)(struct fw_unit *unit);
+        const struct ieee1394_device_id *id_table;
+};
+
+struct fw_packet;
+struct fw_request;
+
+typedef void (*fw_packet_callback_t)(struct fw_packet *packet,
+                                     struct fw_card *card, int status);
+typedef void (*fw_transaction_callback_t)(struct fw_card *card, int rcode,
+                                          void *data, size_t length,
+                                          void *callback_data);
+/*
+ * Important note:  The callback must guarantee that either fw_send_response()
+ * or kfree() is called on the @request.
+ */
+typedef void (*fw_address_callback_t)(struct fw_card *card,
+                                      struct fw_request *request,
+                                      int tcode, int destination, int source,
+                                      int generation, int speed,
+                                      unsigned long long offset,
+                                      void *data, size_t length,
+                                      void *callback_data);
+
+struct fw_packet {
+        int speed;
+        int generation;
+        u32 header[4];
+        size_t header_length;
+        void *payload;
+        size_t payload_length;
+        dma_addr_t payload_bus;
+        u32 timestamp;
+
+        /*
+         * This callback is called when the packet transmission has
+         * completed; for successful transmission, the status code is
+         * the ack received from the destination, otherwise it's a
+         * negative errno: ENOMEM, ESTALE, ETIMEDOUT, ENODEV, EIO.
+         * The callback can be called from tasklet context and thus
+         * must never block.
+         */
+        fw_packet_callback_t callback;
+        int ack;
+        struct list_head link;
+        void *driver_data;
+};
+
+struct fw_transaction {
+        int node_id; /* The generation is implied; it is always the current. */
+        int tlabel;
+        int timestamp;
+        struct list_head link;
+
+        struct fw_packet packet;
+
+        /*
+         * The data passed to the callback is valid only during the
+         * callback.
+         */
+        fw_transaction_callback_t callback;
+        void *callback_data;
+};
+
+struct fw_address_handler {
+        u64 offset;
+        size_t length;
+        fw_address_callback_t address_callback;
+        void *callback_data;
+        struct list_head link;
+};
+
+struct fw_address_region {
+        u64 start;
+        u64 end;
+};
+
+extern const struct fw_address_region fw_high_memory_region;
+
+int fw_core_add_address_handler(struct fw_address_handler *handler,
+                                const struct fw_address_region *region);
+void fw_core_remove_address_handler(struct fw_address_handler *handler);
+void fw_send_response(struct fw_card *card,
+                      struct fw_request *request, int rcode);
+void fw_send_request(struct fw_card *card, struct fw_transaction *t,
+                     int tcode, int destination_id, int generation, int speed,
+                     unsigned long long offset, void *payload, size_t length,
+                     fw_transaction_callback_t callback, void *callback_data);
+int fw_cancel_transaction(struct fw_card *card,
+                          struct fw_transaction *transaction);
+int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
+                       int generation, int speed, unsigned long long offset,
+                       void *payload, size_t length);
+
+#endif /* _LINUX_FIREWIRE_H */
diff --git a/include/linux/firmware-map.h b/include/linux/firmware-map.h
index cca686b39123..875451f1373a 100644
--- a/include/linux/firmware-map.h
+++ b/include/linux/firmware-map.h
@@ -24,21 +24,17 @@
  */
 #ifdef CONFIG_FIRMWARE_MEMMAP
 
-int firmware_map_add(resource_size_t start, resource_size_t end,
-                     const char *type);
-int firmware_map_add_early(resource_size_t start, resource_size_t end,
-                           const char *type);
+int firmware_map_add(u64 start, u64 end, const char *type);
+int firmware_map_add_early(u64 start, u64 end, const char *type);
 
 #else /* CONFIG_FIRMWARE_MEMMAP */
 
-static inline int firmware_map_add(resource_size_t start, resource_size_t end,
-                                   const char *type)
+static inline int firmware_map_add(u64 start, u64 end, const char *type)
 {
         return 0;
 }
 
-static inline int firmware_map_add_early(resource_size_t start,
-                                         resource_size_t end, const char *type)
+static inline int firmware_map_add_early(u64 start, u64 end, const char *type)
 {
         return 0;
 }
diff --git a/include/linux/firmware.h b/include/linux/firmware.h
index c8ecf5b2a207..d31544628436 100644
--- a/include/linux/firmware.h
+++ b/include/linux/firmware.h
@@ -5,7 +5,6 @@
 #include <linux/types.h>
 #include <linux/compiler.h>
 
-#define FIRMWARE_NAME_MAX 30 
 #define FW_ACTION_NOHOTPLUG 0
 #define FW_ACTION_HOTPLUG 1
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index ede84fa7da5d..74a57938c880 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -879,7 +879,7 @@ struct file_ra_state {
                                            there are only # of pages ahead */
 
         unsigned int ra_pages;          /* Maximum readahead window */
-        int mmap_miss;                  /* Cache miss stat for mmap accesses */
+        unsigned int mmap_miss;         /* Cache miss stat for mmap accesses */
         loff_t prev_pos;                /* Cache last read() position */
 };
 
@@ -1919,8 +1919,9 @@ extern void __init vfs_caches_init(unsigned long);
 
 extern struct kmem_cache *names_cachep;
 
-#define __getname()     kmem_cache_alloc(names_cachep, GFP_KERNEL)
-#define __putname(name) kmem_cache_free(names_cachep, (void *)(name))
+#define __getname_gfp(gfp)      kmem_cache_alloc(names_cachep, (gfp))
+#define __getname()             __getname_gfp(GFP_KERNEL)
+#define __putname(name)         kmem_cache_free(names_cachep, (void *)(name))
 #ifndef CONFIG_AUDITSYSCALL
 #define putname(name)   __putname(name)
 #else
@@ -2036,9 +2037,6 @@ extern int __invalidate_device(struct block_device *);
 extern int invalidate_partition(struct gendisk *, int);
 #endif
 extern int invalidate_inodes(struct super_block *);
-unsigned long __invalidate_mapping_pages(struct address_space *mapping,
-                                        pgoff_t start, pgoff_t end,
-                                        bool be_atomic);
 unsigned long invalidate_mapping_pages(struct address_space *mapping,
                                         pgoff_t start, pgoff_t end);
 
diff --git a/include/linux/fs_enet_pd.h b/include/linux/fs_enet_pd.h
index 8300cab30f9a..51b793466ff3 100644
--- a/include/linux/fs_enet_pd.h
+++ b/include/linux/fs_enet_pd.h
@@ -17,6 +17,7 @@
 #define FS_ENET_PD_H
 
 #include <linux/string.h>
+#include <linux/of_mdio.h>
 #include <asm/types.h>
 
 #define FS_ENET_NAME    "fs_enet"
@@ -130,10 +131,7 @@ struct fs_platform_info {
         
         u32 device_flags;
 
-        int phy_addr;           /* the phy address (-1 no phy) */
-        char bus_id[16];
-        int phy_irq;            /* the phy irq (if it exists)  */
-
+        struct device_node *phy_node;
         const struct fs_mii_bus_info *bus_info;
 
         int rx_ring, tx_ring;   /* number of buffers on rx     */
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 7cbd38d363a2..45fc320a53c6 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -142,7 +142,7 @@ struct gendisk {
                                          * disks that can't be partitioned. */
 
         char disk_name[DISK_NAME_LEN];  /* name of major driver */
-
+        char *(*nodename)(struct gendisk *gd);
         /* Array of pointers to partitions indexed by partno.
          * Protected with matching bdev lock but stat and other
          * non-critical accesses use RCU.  Always access through
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 3760e7c5de02..cfdb35d71bca 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -5,6 +5,7 @@
 #include <linux/stddef.h>
 #include <linux/linkage.h>
 #include <linux/topology.h>
+#include <linux/mmdebug.h>
 
 struct vm_area_struct;
 
@@ -20,7 +21,8 @@ struct vm_area_struct;
 #define __GFP_DMA       ((__force gfp_t)0x01u)
 #define __GFP_HIGHMEM   ((__force gfp_t)0x02u)
 #define __GFP_DMA32     ((__force gfp_t)0x04u)
-
+#define __GFP_MOVABLE   ((__force gfp_t)0x08u)  /* Page is movable */
+#define GFP_ZONEMASK    (__GFP_DMA|__GFP_HIGHMEM|__GFP_DMA32|__GFP_MOVABLE)
 /*
  * Action modifiers - doesn't change the zoning
  *
@@ -50,9 +52,20 @@ struct vm_area_struct;
 #define __GFP_HARDWALL   ((__force gfp_t)0x20000u) /* Enforce hardwall cpuset memory allocs */
 #define __GFP_THISNODE  ((__force gfp_t)0x40000u)/* No fallback, no policies */
 #define __GFP_RECLAIMABLE ((__force gfp_t)0x80000u) /* Page is reclaimable */
-#define __GFP_MOVABLE   ((__force gfp_t)0x100000u)  /* Page is movable */
 
-#define __GFP_BITS_SHIFT 21     /* Room for 21 __GFP_FOO bits */
+#ifdef CONFIG_KMEMCHECK
+#define __GFP_NOTRACK   ((__force gfp_t)0x200000u)  /* Don't track with kmemcheck */
+#else
+#define __GFP_NOTRACK   ((__force gfp_t)0)
+#endif
+
+/*
+ * This may seem redundant, but it's a way of annotating false positives vs.
+ * allocations that simply cannot be supported (e.g. page tables).
+ */
+#define __GFP_NOTRACK_FALSE_POSITIVE (__GFP_NOTRACK)
+
+#define __GFP_BITS_SHIFT 22     /* Room for 22 __GFP_FOO bits */
 #define __GFP_BITS_MASK ((__force gfp_t)((1 << __GFP_BITS_SHIFT) - 1))
 
 /* This equals 0, but use constants in case they ever change */
@@ -115,24 +128,105 @@ static inline int allocflags_to_migratetype(gfp_t gfp_flags)
                 ((gfp_flags & __GFP_RECLAIMABLE) != 0);
 }
 
-static inline enum zone_type gfp_zone(gfp_t flags)
-{
+#ifdef CONFIG_HIGHMEM
+#define OPT_ZONE_HIGHMEM ZONE_HIGHMEM
+#else
+#define OPT_ZONE_HIGHMEM ZONE_NORMAL
+#endif
+
 #ifdef CONFIG_ZONE_DMA
-        if (flags & __GFP_DMA)
-                return ZONE_DMA;
+#define OPT_ZONE_DMA ZONE_DMA
+#else
+#define OPT_ZONE_DMA ZONE_NORMAL
 #endif
+
 #ifdef CONFIG_ZONE_DMA32
-        if (flags & __GFP_DMA32)
-                return ZONE_DMA32;
+#define OPT_ZONE_DMA32 ZONE_DMA32
+#else
+#define OPT_ZONE_DMA32 ZONE_NORMAL
 #endif
-        if ((flags & (__GFP_HIGHMEM | __GFP_MOVABLE)) ==
-                        (__GFP_HIGHMEM | __GFP_MOVABLE))
-                return ZONE_MOVABLE;
-#ifdef CONFIG_HIGHMEM
-        if (flags & __GFP_HIGHMEM)
-                return ZONE_HIGHMEM;
+
+/*
+ * GFP_ZONE_TABLE is a word size bitstring that is used for looking up the
+ * zone to use given the lowest 4 bits of gfp_t. Entries are ZONE_SHIFT long
+ * and there are 16 of them to cover all possible combinations of
+ * __GFP_DMA, __GFP_DMA32, __GFP_MOVABLE and __GFP_HIGHMEM
+ *
+ * The zone fallback order is MOVABLE=>HIGHMEM=>NORMAL=>DMA32=>DMA.
+ * But GFP_MOVABLE is not only a zone specifier but also an allocation
+ * policy. Therefore __GFP_MOVABLE plus another zone selector is valid.
+ * Only 1bit of the lowest 3 bit (DMA,DMA32,HIGHMEM) can be set to "1".
+ *
+ *       bit       result
+ *       =================
+ *       0x0    => NORMAL
+ *       0x1    => DMA or NORMAL
+ *       0x2    => HIGHMEM or NORMAL
+ *       0x3    => BAD (DMA+HIGHMEM)
+ *       0x4    => DMA32 or DMA or NORMAL
+ *       0x5    => BAD (DMA+DMA32)
+ *       0x6    => BAD (HIGHMEM+DMA32)
+ *       0x7    => BAD (HIGHMEM+DMA32+DMA)
+ *       0x8    => NORMAL (MOVABLE+0)
+ *       0x9    => DMA or NORMAL (MOVABLE+DMA)
+ *       0xa    => MOVABLE (Movable is valid only if HIGHMEM is set too)
+ *       0xb    => BAD (MOVABLE+HIGHMEM+DMA)
+ *       0xc    => DMA32 (MOVABLE+HIGHMEM+DMA32)
+ *       0xd    => BAD (MOVABLE+DMA32+DMA)
+ *       0xe    => BAD (MOVABLE+DMA32+HIGHMEM)
+ *       0xf    => BAD (MOVABLE+DMA32+HIGHMEM+DMA)
+ *
+ * ZONES_SHIFT must be <= 2 on 32 bit platforms.
+ */
+
+#if 16 * ZONES_SHIFT > BITS_PER_LONG
+#error ZONES_SHIFT too large to create GFP_ZONE_TABLE integer
+#endif
+
+#define GFP_ZONE_TABLE ( \
+        (ZONE_NORMAL << 0 * ZONES_SHIFT)                                \
+        | (OPT_ZONE_DMA << __GFP_DMA * ZONES_SHIFT)                     \
+        | (OPT_ZONE_HIGHMEM << __GFP_HIGHMEM * ZONES_SHIFT)             \
+        | (OPT_ZONE_DMA32 << __GFP_DMA32 * ZONES_SHIFT)                 \
+        | (ZONE_NORMAL << __GFP_MOVABLE * ZONES_SHIFT)                  \
+        | (OPT_ZONE_DMA << (__GFP_MOVABLE | __GFP_DMA) * ZONES_SHIFT)   \
+        | (ZONE_MOVABLE << (__GFP_MOVABLE | __GFP_HIGHMEM) * ZONES_SHIFT)\
+        | (OPT_ZONE_DMA32 << (__GFP_MOVABLE | __GFP_DMA32) * ZONES_SHIFT)\
+)
+
+/*
+ * GFP_ZONE_BAD is a bitmap for all combination of __GFP_DMA, __GFP_DMA32
+ * __GFP_HIGHMEM and __GFP_MOVABLE that are not permitted. One flag per
+ * entry starting with bit 0. Bit is set if the combination is not
+ * allowed.
+ */
+#define GFP_ZONE_BAD ( \
+        1 << (__GFP_DMA | __GFP_HIGHMEM)                                \
+        | 1 << (__GFP_DMA | __GFP_DMA32)                                \
+        | 1 << (__GFP_DMA32 | __GFP_HIGHMEM)                            \
+        | 1 << (__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM)                \
+        | 1 << (__GFP_MOVABLE | __GFP_HIGHMEM | __GFP_DMA)              \
+        | 1 << (__GFP_MOVABLE | __GFP_DMA32 | __GFP_DMA)                \
+        | 1 << (__GFP_MOVABLE | __GFP_DMA32 | __GFP_HIGHMEM)            \
+        | 1 << (__GFP_MOVABLE | __GFP_DMA32 | __GFP_DMA | __GFP_HIGHMEM)\
+)
+
+static inline enum zone_type gfp_zone(gfp_t flags)
+{
+        enum zone_type z;
+        int bit = flags & GFP_ZONEMASK;
+
+        z = (GFP_ZONE_TABLE >> (bit * ZONES_SHIFT)) &
+                                         ((1 << ZONES_SHIFT) - 1);
+
+        if (__builtin_constant_p(bit))
+                BUILD_BUG_ON((GFP_ZONE_BAD >> bit) & 1);
+        else {
+#ifdef CONFIG_DEBUG_VM
+                BUG_ON((GFP_ZONE_BAD >> bit) & 1);
 #endif
-        return ZONE_NORMAL;
+        }
+        return z;
 }
 
 /*
@@ -172,30 +266,19 @@ static inline void arch_alloc_page(struct page *page, int order) { }
 #endif
 
 struct page *
-__alloc_pages_internal(gfp_t gfp_mask, unsigned int order,
+__alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
                        struct zonelist *zonelist, nodemask_t *nodemask);
 
 static inline struct page *
 __alloc_pages(gfp_t gfp_mask, unsigned int order,
                 struct zonelist *zonelist)
 {
-        return __alloc_pages_internal(gfp_mask, order, zonelist, NULL);
+        return __alloc_pages_nodemask(gfp_mask, order, zonelist, NULL);
 }
 
-static inline struct page *
-__alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
-                struct zonelist *zonelist, nodemask_t *nodemask)
-{
-        return __alloc_pages_internal(gfp_mask, order, zonelist, nodemask);
-}
-
-
 static inline struct page *alloc_pages_node(int nid, gfp_t gfp_mask,
                                                 unsigned int order)
 {
-        if (unlikely(order >= MAX_ORDER))
-                return NULL;
-
         /* Unknown node is current node */
         if (nid < 0)
                 nid = numa_node_id();
@@ -203,15 +286,20 @@ static inline struct page *alloc_pages_node(int nid, gfp_t gfp_mask,
         return __alloc_pages(gfp_mask, order, node_zonelist(nid, gfp_mask));
 }
 
+static inline struct page *alloc_pages_exact_node(int nid, gfp_t gfp_mask,
+                                                unsigned int order)
+{
+        VM_BUG_ON(nid < 0 || nid >= MAX_NUMNODES);
+
+        return __alloc_pages(gfp_mask, order, node_zonelist(nid, gfp_mask));
+}
+
 #ifdef CONFIG_NUMA
 extern struct page *alloc_pages_current(gfp_t gfp_mask, unsigned order);
 
 static inline struct page *
 alloc_pages(gfp_t gfp_mask, unsigned int order)
 {
-        if (unlikely(order >= MAX_ORDER))
-                return NULL;
-
         return alloc_pages_current(gfp_mask, order);
 }
 extern struct page *alloc_page_vma(gfp_t gfp_mask,
@@ -248,4 +336,16 @@ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp);
 void drain_all_pages(void);
 void drain_local_pages(void *dummy);
 
+extern bool oom_killer_disabled;
+
+static inline void oom_killer_disable(void)
+{
+        oom_killer_disabled = true;
+}
+
+static inline void oom_killer_enable(void)
+{
+        oom_killer_disabled = false;
+}
+
 #endif /* __LINUX_GFP_H */
diff --git a/include/linux/hid.h b/include/linux/hid.h
index a72876e43589..53489fd4d700 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -238,6 +238,42 @@ struct hid_item {
 #define HID_GD_RIGHT            0x00010092
 #define HID_GD_LEFT             0x00010093
 
+#define HID_DG_DIGITIZER        0x000d0001
+#define HID_DG_PEN              0x000d0002
+#define HID_DG_LIGHTPEN         0x000d0003
+#define HID_DG_TOUCHSCREEN      0x000d0004
+#define HID_DG_TOUCHPAD         0x000d0005
+#define HID_DG_STYLUS           0x000d0020
+#define HID_DG_PUCK             0x000d0021
+#define HID_DG_FINGER           0x000d0022
+#define HID_DG_TIPPRESSURE      0x000d0030
+#define HID_DG_BARRELPRESSURE   0x000d0031
+#define HID_DG_INRANGE          0x000d0032
+#define HID_DG_TOUCH            0x000d0033
+#define HID_DG_UNTOUCH          0x000d0034
+#define HID_DG_TAP              0x000d0035
+#define HID_DG_TABLETFUNCTIONKEY        0x000d0039
+#define HID_DG_PROGRAMCHANGEKEY 0x000d003a
+#define HID_DG_INVERT           0x000d003c
+#define HID_DG_TIPSWITCH        0x000d0042
+#define HID_DG_TIPSWITCH2       0x000d0043
+#define HID_DG_BARRELSWITCH     0x000d0044
+#define HID_DG_ERASER           0x000d0045
+#define HID_DG_TABLETPICK       0x000d0046
+/*
+ * as of May 20, 2009 the usages below are not yet in the official USB spec
+ * but are being pushed by Microsft as described in their paper "Digitizer
+ * Drivers for Windows Touch and Pen-Based Computers"
+ */
+#define HID_DG_CONFIDENCE       0x000d0047
+#define HID_DG_WIDTH            0x000d0048
+#define HID_DG_HEIGHT           0x000d0049
+#define HID_DG_CONTACTID        0x000d0051
+#define HID_DG_INPUTMODE        0x000d0052
+#define HID_DG_DEVICEINDEX      0x000d0053
+#define HID_DG_CONTACTCOUNT     0x000d0054
+#define HID_DG_CONTACTMAX       0x000d0055
+
 /*
  * HID report types --- Ouch! HID spec says 1 2 3!
  */
diff --git a/include/linux/highmem.h b/include/linux/highmem.h
index 1fcb7126a01f..211ff4497269 100644
--- a/include/linux/highmem.h
+++ b/include/linux/highmem.h
@@ -55,7 +55,9 @@ static inline void *kmap(struct page *page)
         return page_address(page);
 }
 
-#define kunmap(page) do { (void) (page); } while (0)
+static inline void kunmap(struct page *page)
+{
+}
 
 static inline void *kmap_atomic(struct page *page, enum km_type idx)
 {
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 0d2f7c8a33d6..7400900de94a 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -30,8 +30,11 @@ struct hrtimer_cpu_base;
  * Mode arguments of xxx_hrtimer functions:
  */
 enum hrtimer_mode {
-        HRTIMER_MODE_ABS,       /* Time value is absolute */
-        HRTIMER_MODE_REL,       /* Time value is relative to now */
+        HRTIMER_MODE_ABS = 0x0,         /* Time value is absolute */
+        HRTIMER_MODE_REL = 0x1,         /* Time value is relative to now */
+        HRTIMER_MODE_PINNED = 0x02,     /* Timer is bound to CPU */
+        HRTIMER_MODE_ABS_PINNED = 0x02,
+        HRTIMER_MODE_REL_PINNED = 0x03,
 };
 
 /*
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 03be7f29ca01..a05a5ef33391 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -11,6 +11,8 @@
 
 struct ctl_table;
 
+int PageHuge(struct page *page);
+
 static inline int is_vm_hugetlb_page(struct vm_area_struct *vma)
 {
         return vma->vm_flags & VM_HUGETLB;
@@ -61,6 +63,11 @@ void hugetlb_change_protection(struct vm_area_struct *vma,
 
 #else /* !CONFIG_HUGETLB_PAGE */
 
+static inline int PageHuge(struct page *page)
+{
+        return 0;
+}
+
 static inline int is_vm_hugetlb_page(struct vm_area_struct *vma)
 {
         return 0;
diff --git a/include/linux/i2c-ocores.h b/include/linux/i2c-ocores.h
index 8ed591b0887e..4d5e57ff6614 100644
--- a/include/linux/i2c-ocores.h
+++ b/include/linux/i2c-ocores.h
@@ -14,6 +14,8 @@
 struct ocores_i2c_platform_data {
         u32 regstep;   /* distance between registers */
         u32 clock_khz; /* input clock in kHz */
+        u8 num_devices; /* number of devices in the devices list */
+        struct i2c_board_info const *devices; /* devices connected to the bus */
 };
 
 #endif /* _LINUX_I2C_OCORES_H */
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 4b501b48ce86..a9173d5434d1 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -493,6 +493,7 @@ struct ieee80211s_hdr {
 /* Mesh flags */
 #define MESH_FLAGS_AE_A4        0x1
 #define MESH_FLAGS_AE_A5_A6     0x2
+#define MESH_FLAGS_AE           0x3
 #define MESH_FLAGS_PS_DEEP      0x4
 
 /**
@@ -540,10 +541,10 @@ struct ieee80211_tim_ie {
         u8 dtim_period;
         u8 bitmap_ctrl;
         /* variable size: 1 - 251 bytes */
-        u8 virtual_map[0];
+        u8 virtual_map[1];
 } __attribute__ ((packed));
 
-#define WLAN_SA_QUERY_TR_ID_LEN 16
+#define WLAN_SA_QUERY_TR_ID_LEN 2
 
 struct ieee80211_mgmt {
         __le16 frame_control;
@@ -1068,8 +1069,12 @@ enum ieee80211_category {
         WLAN_CATEGORY_DLS = 2,
         WLAN_CATEGORY_BACK = 3,
         WLAN_CATEGORY_PUBLIC = 4,
+        WLAN_CATEGORY_HT = 7,
         WLAN_CATEGORY_SA_QUERY = 8,
+        WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION = 9,
         WLAN_CATEGORY_WMM = 17,
+        WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
+        WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
 };
 
 /* SPECTRUM_MGMT action code */
@@ -1081,6 +1086,15 @@ enum ieee80211_spectrum_mgmt_actioncode {
         WLAN_ACTION_SPCT_CHL_SWITCH = 4,
 };
 
+/* Security key length */
+enum ieee80211_key_len {
+        WLAN_KEY_LEN_WEP40 = 5,
+        WLAN_KEY_LEN_WEP104 = 13,
+        WLAN_KEY_LEN_CCMP = 16,
+        WLAN_KEY_LEN_TKIP = 32,
+        WLAN_KEY_LEN_AES_CMAC = 16,
+};
+
 /*
  * IEEE 802.11-2007 7.3.2.9 Country information element
  *
@@ -1261,7 +1275,9 @@ static inline bool ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
                 if (ieee80211_has_protected(hdr->frame_control))
                         return true;
                 category = ((u8 *) hdr) + 24;
-                return *category != WLAN_CATEGORY_PUBLIC;
+                return *category != WLAN_CATEGORY_PUBLIC &&
+                        *category != WLAN_CATEGORY_HT &&
+                        *category != WLAN_CATEGORY_VENDOR_SPECIFIC;
         }
 
         return false;
@@ -1383,4 +1399,43 @@ static inline int ieee80211_freq_to_ofdm_chan(int s_freq, int freq)
                 return -1;
 }
 
+/**
+ * ieee80211_tu_to_usec - convert time units (TU) to microseconds
+ * @tu: the TUs
+ */
+static inline unsigned long ieee80211_tu_to_usec(unsigned long tu)
+{
+        return 1024 * tu;
+}
+
+/**
+ * ieee80211_check_tim - check if AID bit is set in TIM
+ * @tim: the TIM IE
+ * @tim_len: length of the TIM IE
+ * @aid: the AID to look for
+ */
+static inline bool ieee80211_check_tim(struct ieee80211_tim_ie *tim,
+                                       u8 tim_len, u16 aid)
+{
+        u8 mask;
+        u8 index, indexn1, indexn2;
+
+        if (unlikely(!tim || tim_len < sizeof(*tim)))
+                return false;
+
+        aid &= 0x3fff;
+        index = aid / 8;
+        mask  = 1 << (aid & 7);
+
+        indexn1 = tim->bitmap_ctrl & 0xfe;
+        indexn2 = tim_len + indexn1 - 4;
+
+        if (index < indexn1 || index > indexn2)
+                return false;
+
+        index -= indexn1;
+
+        return !!(tim->virtual_map[index] & mask);
+}
+
 #endif /* LINUX_IEEE80211_H */
diff --git a/include/linux/if.h b/include/linux/if.h
index 1108f3e099e3..b9a6229f3be7 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -67,6 +67,9 @@
 #define IFF_ISATAP      0x80            /* ISATAP interface (RFC4214)   */
 #define IFF_MASTER_ARPMON 0x100         /* bonding master, ARP mon in use */
 #define IFF_WAN_HDLC    0x200           /* WAN HDLC device              */
+#define IFF_XMIT_DST_RELEASE 0x400      /* dev_hard_start_xmit() is allowed to
+                                         * release skb->dst
+                                         */
 
 #define IF_GET_IFACE    0x0001          /* for querying only */
 #define IF_GET_PROTO    0x0002
diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
index 5ff89809a581..b554300ef8bf 100644
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -86,6 +86,8 @@
 #define ARPHRD_IEEE80211 801            /* IEEE 802.11                  */
 #define ARPHRD_IEEE80211_PRISM 802      /* IEEE 802.11 + Prism2 header  */
 #define ARPHRD_IEEE80211_RADIOTAP 803   /* IEEE 802.11 + radiotap header */
+#define ARPHRD_IEEE802154         804
+#define ARPHRD_IEEE802154_PHY     805
 
 #define ARPHRD_PHONET   820             /* PhoNet media type            */
 #define ARPHRD_PHONET_PIPE 821          /* PhoNet pipe header           */
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index 60e8934d10b5..ae3a1871413d 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -107,6 +107,7 @@
 #define ETH_P_DSA       0x001B          /* Distributed Switch Arch.     */
 #define ETH_P_TRAILER   0x001C          /* Trailer switch tagging       */
 #define ETH_P_PHONET    0x00F5          /* Nokia Phonet frames          */
+#define ETH_P_IEEE802154 0x00F6         /* IEEE802.15.4 frame           */
 
 /*
  *      This is an Ethernet frame header.
diff --git a/include/linux/if_packet.h b/include/linux/if_packet.h
index 18db0668065a..dea7d6b7cf98 100644
--- a/include/linux/if_packet.h
+++ b/include/linux/if_packet.h
@@ -46,6 +46,8 @@ struct sockaddr_ll
 #define PACKET_VERSION                  10
 #define PACKET_HDRLEN                   11
 #define PACKET_RESERVE                  12
+#define PACKET_TX_RING                  13
+#define PACKET_LOSS                     14
 
 struct tpacket_stats
 {
@@ -63,14 +65,22 @@ struct tpacket_auxdata
         __u16           tp_vlan_tci;
 };
 
+/* Rx ring - header status */
+#define TP_STATUS_KERNEL        0x0
+#define TP_STATUS_USER          0x1
+#define TP_STATUS_COPY          0x2
+#define TP_STATUS_LOSING        0x4
+#define TP_STATUS_CSUMNOTREADY  0x8
+
+/* Tx ring - header status */
+#define TP_STATUS_AVAILABLE     0x0
+#define TP_STATUS_SEND_REQUEST  0x1
+#define TP_STATUS_SENDING       0x2
+#define TP_STATUS_WRONG_FORMAT  0x4
+
 struct tpacket_hdr
 {
         unsigned long   tp_status;
-#define TP_STATUS_KERNEL        0
-#define TP_STATUS_USER          1
-#define TP_STATUS_COPY          2
-#define TP_STATUS_LOSING        4
-#define TP_STATUS_CSUMNOTREADY  8
         unsigned int    tp_len;
         unsigned int    tp_snaplen;
         unsigned short  tp_mac;
@@ -135,5 +145,6 @@ struct packet_mreq
 #define PACKET_MR_MULTICAST     0
 #define PACKET_MR_PROMISC       1
 #define PACKET_MR_ALLMULTI      2
+#define PACKET_MR_UNICAST       3
 
 #endif
diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
index 049d6c9428db..915ba5789f0e 100644
--- a/include/linux/if_tun.h
+++ b/include/linux/if_tun.h
@@ -55,6 +55,7 @@
 #define IFF_NO_PI       0x1000
 #define IFF_ONE_QUEUE   0x2000
 #define IFF_VNET_HDR    0x4000
+#define IFF_TUN_EXCL    0x8000
 
 /* Features for GSO (TUNSETOFFLOAD). */
 #define TUN_F_CSUM      0x01    /* You can hand me unchecksummed packets. */
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 5a9aae4adb44..5eb9b0f857e0 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -44,7 +44,7 @@ struct ip_tunnel_prl {
         __u16                   flags;
         __u16                   __reserved;
         __u32                   datalen;
-        __u32                   __reserved2;
+        __u32                   rs_delay;
         /* data follows */
 };
 
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index e1ff5b14310e..7ff9af1d0f05 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -118,8 +118,7 @@ extern int vlan_hwaccel_do_receive(struct sk_buff *skb);
 extern int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
                             unsigned int vlan_tci, struct sk_buff *skb);
 extern int vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
-                          unsigned int vlan_tci,
-                          struct napi_gro_fraginfo *info);
+                          unsigned int vlan_tci);
 
 #else
 static inline struct net_device *vlan_dev_real_dev(const struct net_device *dev)
@@ -154,8 +153,7 @@ static inline int vlan_gro_receive(struct napi_struct *napi,
 }
 
 static inline int vlan_gro_frags(struct napi_struct *napi,
-                                 struct vlan_group *grp, unsigned int vlan_tci,
-                                 struct napi_gro_fraginfo *info)
+                                 struct vlan_group *grp, unsigned int vlan_tci)
 {
         return NET_RX_DROP;
 }
diff --git a/include/linux/in.h b/include/linux/in.h
index d60122a3a088..cf196da04ec9 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -107,6 +107,7 @@ struct in_addr {
 #define MCAST_JOIN_SOURCE_GROUP         46
 #define MCAST_LEAVE_SOURCE_GROUP        47
 #define MCAST_MSFILTER                  48
+#define IP_MULTICAST_ALL                49
 
 #define MCAST_EXCLUDE   0
 #define MCAST_INCLUDE   1
diff --git a/include/linux/init.h b/include/linux/init.h
index 0e06c176f185..8c2c9989626d 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -2,8 +2,6 @@
 #define _LINUX_INIT_H
 
 #include <linux/compiler.h>
-#include <linux/section-names.h>
-#include <linux/stringify.h>
 
 /* These macros are used to mark some functions or 
  * initialized data (doesn't apply to uninitialized data)
@@ -31,7 +29,7 @@
  * sign followed by value, e.g.:
  *
  * static int init_variable __initdata = 0;
- * static char linux_logo[] __initdata = { 0x32, 0x36, ... };
+ * static const char linux_logo[] __initconst = { 0x32, 0x36, ... };
  *
  * Don't forget to initialize data not at file scope, i.e. within a function,
  * as gcc otherwise puts the data into the bss section and not into the init
@@ -101,7 +99,7 @@
 #define __memexitconst   __section(.memexit.rodata)
 
 /* For assembly routines */
-#define __HEAD          .section        __stringify(HEAD_TEXT_SECTION),"ax"
+#define __HEAD          .section        ".head.text","ax"
 #define __INIT          .section        ".init.text","ax"
 #define __FINIT         .previous
 
@@ -225,7 +223,8 @@ struct obs_kernel_param {
  * obs_kernel_param "array" too far apart in .init.setup.
  */
 #define __setup_param(str, unique_id, fn, early)                        \
-        static char __setup_str_##unique_id[] __initdata __aligned(1) = str; \
+        static const char __setup_str_##unique_id[] __initconst \
+                __aligned(1) = str; \
         static struct obs_kernel_param __setup_##unique_id      \
                 __used __section(.init.setup)                   \
                 __attribute__((aligned((sizeof(long)))))        \
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index 28b1f30601b5..5368fbdc7801 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -15,18 +15,6 @@
 extern struct files_struct init_files;
 extern struct fs_struct init_fs;
 
-#define INIT_MM(name) \
-{                                                               \
-        .mm_rb          = RB_ROOT,                              \
-        .pgd            = swapper_pg_dir,                       \
-        .mm_users       = ATOMIC_INIT(2),                       \
-        .mm_count       = ATOMIC_INIT(1),                       \
-        .mmap_sem       = __RWSEM_INITIALIZER(name.mmap_sem),   \
-        .page_table_lock =  __SPIN_LOCK_UNLOCKED(name.page_table_lock), \
-        .mmlist         = LIST_HEAD_INIT(name.mmlist),          \
-        .cpu_vm_mask    = CPU_MASK_ALL,                         \
-}
-
 #define INIT_SIGNALS(sig) {                                             \
         .count          = ATOMIC_INIT(1),                               \
         .wait_chldexit  = __WAIT_QUEUE_HEAD_INITIALIZER(sig.wait_chldexit),\
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index c41e812e9d5e..2721f07e9354 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -472,6 +472,20 @@ static inline void tasklet_hi_schedule(struct tasklet_struct *t)
                 __tasklet_hi_schedule(t);
 }
 
+extern void __tasklet_hi_schedule_first(struct tasklet_struct *t);
+
+/*
+ * This version avoids touching any other tasklets. Needed for kmemcheck
+ * in order not to take any page faults while enqueueing this tasklet;
+ * consider VERY carefully whether you really need this or
+ * tasklet_hi_schedule()...
+ */
+static inline void tasklet_hi_schedule_first(struct tasklet_struct *t)
+{
+        if (!test_and_set_bit(TASKLET_STATE_SCHED, &t->state))
+                __tasklet_hi_schedule_first(t);
+}
+
 
 static inline void tasklet_disable_nosync(struct tasklet_struct *t)
 {
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 476d9464ac82..c662efa68289 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -169,6 +169,12 @@ struct ipv6_devconf {
         __s32           accept_dad;
         void            *sysctl;
 };
+
+struct ipv6_params {
+        __s32 disable_ipv6;
+        __s32 autoconf;
+};
+extern struct ipv6_params ipv6_defaults;
 #endif
 
 /* index values for the variables in ipv6_devconf */
diff --git a/include/linux/isdn/capilli.h b/include/linux/isdn/capilli.h
index 35e9b0fd014b..7acb87a44872 100644
--- a/include/linux/isdn/capilli.h
+++ b/include/linux/isdn/capilli.h
@@ -79,7 +79,7 @@ int attach_capi_ctr(struct capi_ctr *);
 int detach_capi_ctr(struct capi_ctr *);
 
 void capi_ctr_ready(struct capi_ctr * card);
-void capi_ctr_reseted(struct capi_ctr * card);
+void capi_ctr_down(struct capi_ctr * card);
 void capi_ctr_suspend_output(struct capi_ctr * card);
 void capi_ctr_resume_output(struct capi_ctr * card);
 void capi_ctr_handle_message(struct capi_ctr * card, u16 appl, struct sk_buff *skb);
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 883cd44ff765..c5a71c38a95f 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -97,12 +97,14 @@ extern const char linux_proc_banner[];
 #define KERN_INFO       "<6>"   /* informational                        */
 #define KERN_DEBUG      "<7>"   /* debug-level messages                 */
 
+/* Use the default kernel loglevel */
+#define KERN_DEFAULT    "<d>"
 /*
  * Annotation for a "continued" line of log printout (only done after a
  * line that had no enclosing \n). Only to be used by core/arch code
  * during early bootup (a continued line is not SMP-safe otherwise).
  */
-#define KERN_CONT       ""
+#define KERN_CONT       "<c>"
 
 extern int console_printk[];
 
@@ -406,7 +408,7 @@ static inline char *pack_hex_byte(char *buf, u8 byte)
  *
  * Use tracing_on/tracing_off when you want to quickly turn on or off
  * tracing. It simply enables or disables the recording of the trace events.
- * This also corresponds to the user space debugfs/tracing/tracing_on
+ * This also corresponds to the user space /sys/kernel/debug/tracing/tracing_on
  * file, which gives a means for the kernel and userspace to interact.
  * Place a tracing_off() in the kernel where you want tracing to end.
  * From user space, examine the trace, and then echo 1 > tracing_on
diff --git a/include/linux/keyboard.h b/include/linux/keyboard.h
index a3c984d780f0..33a63f62d57f 100644
--- a/include/linux/keyboard.h
+++ b/include/linux/keyboard.h
@@ -56,6 +56,7 @@ extern int unregister_keyboard_notifier(struct notifier_block *nb);
 #define KT_ASCII        9
 #define KT_LOCK         10
 #define KT_SLOCK        12
+#define KT_DEAD2        13
 #define KT_BRL          14
 
 #define K(t,v)          (((t)<<8)|(v))
diff --git a/include/linux/kmemcheck.h b/include/linux/kmemcheck.h
new file mode 100644
index 000000000000..47b39b7c7e84
--- /dev/null
+++ b/include/linux/kmemcheck.h
@@ -0,0 +1,153 @@
+#ifndef LINUX_KMEMCHECK_H
+#define LINUX_KMEMCHECK_H
+
+#include <linux/mm_types.h>
+#include <linux/types.h>
+
+#ifdef CONFIG_KMEMCHECK
+extern int kmemcheck_enabled;
+
+/* The slab-related functions. */
+void kmemcheck_alloc_shadow(struct page *page, int order, gfp_t flags, int node);
+void kmemcheck_free_shadow(struct page *page, int order);
+void kmemcheck_slab_alloc(struct kmem_cache *s, gfp_t gfpflags, void *object,
+                          size_t size);
+void kmemcheck_slab_free(struct kmem_cache *s, void *object, size_t size);
+
+void kmemcheck_pagealloc_alloc(struct page *p, unsigned int order,
+                               gfp_t gfpflags);
+
+void kmemcheck_show_pages(struct page *p, unsigned int n);
+void kmemcheck_hide_pages(struct page *p, unsigned int n);
+
+bool kmemcheck_page_is_tracked(struct page *p);
+
+void kmemcheck_mark_unallocated(void *address, unsigned int n);
+void kmemcheck_mark_uninitialized(void *address, unsigned int n);
+void kmemcheck_mark_initialized(void *address, unsigned int n);
+void kmemcheck_mark_freed(void *address, unsigned int n);
+
+void kmemcheck_mark_unallocated_pages(struct page *p, unsigned int n);
+void kmemcheck_mark_uninitialized_pages(struct page *p, unsigned int n);
+void kmemcheck_mark_initialized_pages(struct page *p, unsigned int n);
+
+int kmemcheck_show_addr(unsigned long address);
+int kmemcheck_hide_addr(unsigned long address);
+
+#else
+#define kmemcheck_enabled 0
+
+static inline void
+kmemcheck_alloc_shadow(struct page *page, int order, gfp_t flags, int node)
+{
+}
+
+static inline void
+kmemcheck_free_shadow(struct page *page, int order)
+{
+}
+
+static inline void
+kmemcheck_slab_alloc(struct kmem_cache *s, gfp_t gfpflags, void *object,
+                     size_t size)
+{
+}
+
+static inline void kmemcheck_slab_free(struct kmem_cache *s, void *object,
+                                       size_t size)
+{
+}
+
+static inline void kmemcheck_pagealloc_alloc(struct page *p,
+        unsigned int order, gfp_t gfpflags)
+{
+}
+
+static inline bool kmemcheck_page_is_tracked(struct page *p)
+{
+        return false;
+}
+
+static inline void kmemcheck_mark_unallocated(void *address, unsigned int n)
+{
+}
+
+static inline void kmemcheck_mark_uninitialized(void *address, unsigned int n)
+{
+}
+
+static inline void kmemcheck_mark_initialized(void *address, unsigned int n)
+{
+}
+
+static inline void kmemcheck_mark_freed(void *address, unsigned int n)
+{
+}
+
+static inline void kmemcheck_mark_unallocated_pages(struct page *p,
+                                                    unsigned int n)
+{
+}
+
+static inline void kmemcheck_mark_uninitialized_pages(struct page *p,
+                                                      unsigned int n)
+{
+}
+
+static inline void kmemcheck_mark_initialized_pages(struct page *p,
+                                                    unsigned int n)
+{
+}
+
+#endif /* CONFIG_KMEMCHECK */
+
+/*
+ * Bitfield annotations
+ *
+ * How to use: If you have a struct using bitfields, for example
+ *
+ *     struct a {
+ *             int x:8, y:8;
+ *     };
+ *
+ * then this should be rewritten as
+ *
+ *     struct a {
+ *             kmemcheck_bitfield_begin(flags);
+ *             int x:8, y:8;
+ *             kmemcheck_bitfield_end(flags);
+ *     };
+ *
+ * Now the "flags_begin" and "flags_end" members may be used to refer to the
+ * beginning and end, respectively, of the bitfield (and things like
+ * &x.flags_begin is allowed). As soon as the struct is allocated, the bit-
+ * fields should be annotated:
+ *
+ *     struct a *a = kmalloc(sizeof(struct a), GFP_KERNEL);
+ *     kmemcheck_annotate_bitfield(a, flags);
+ *
+ * Note: We provide the same definitions for both kmemcheck and non-
+ * kmemcheck kernels. This makes it harder to introduce accidental errors. It
+ * is also allowed to pass NULL pointers to kmemcheck_annotate_bitfield().
+ */
+#define kmemcheck_bitfield_begin(name)  \
+        int name##_begin[0];
+
+#define kmemcheck_bitfield_end(name)    \
+        int name##_end[0];
+
+#define kmemcheck_annotate_bitfield(ptr, name)                          \
+        do if (ptr) {                                                   \
+                int _n = (long) &((ptr)->name##_end)                    \
+                        - (long) &((ptr)->name##_begin);                \
+                BUILD_BUG_ON(_n < 0);                                   \
+                                                                        \
+                kmemcheck_mark_initialized(&((ptr)->name##_begin), _n); \
+        } while (0)
+
+#define kmemcheck_annotate_variable(var)                                \
+        do {                                                            \
+                kmemcheck_mark_initialized(&(var), sizeof(var));        \
+        } while (0)                                                     \
+
+#endif /* LINUX_KMEMCHECK_H */
diff --git a/include/linux/linux_logo.h b/include/linux/linux_logo.h
index 08a92969c76e..ca5bd91d12e1 100644
--- a/include/linux/linux_logo.h
+++ b/include/linux/linux_logo.h
@@ -32,6 +32,22 @@ struct linux_logo {
         const unsigned char *data;
 };
 
+extern const struct linux_logo logo_linux_mono;
+extern const struct linux_logo logo_linux_vga16;
+extern const struct linux_logo logo_linux_clut224;
+extern const struct linux_logo logo_blackfin_vga16;
+extern const struct linux_logo logo_blackfin_clut224;
+extern const struct linux_logo logo_dec_clut224;
+extern const struct linux_logo logo_mac_clut224;
+extern const struct linux_logo logo_parisc_clut224;
+extern const struct linux_logo logo_sgi_clut224;
+extern const struct linux_logo logo_sun_clut224;
+extern const struct linux_logo logo_superh_mono;
+extern const struct linux_logo logo_superh_vga16;
+extern const struct linux_logo logo_superh_clut224;
+extern const struct linux_logo logo_m32r_clut224;
+extern const struct linux_logo logo_spe_clut224;
+
 extern const struct linux_logo *fb_find_logo(int depth);
 #ifdef CONFIG_FB_LOGO_EXTRA
 extern void fb_append_extra_logo(const struct linux_logo *logo,
diff --git a/include/linux/lis3lv02d.h b/include/linux/lis3lv02d.h
new file mode 100644
index 000000000000..ad651f4e45ac
--- /dev/null
+++ b/include/linux/lis3lv02d.h
@@ -0,0 +1,39 @@
+#ifndef __LIS3LV02D_H_
+#define __LIS3LV02D_H_
+
+struct lis3lv02d_platform_data {
+        /* please note: the 'click' feature is only supported for
+         * LIS[32]02DL variants of the chip and will be ignored for
+         * others */
+#define LIS3_CLICK_SINGLE_X     (1 << 0)
+#define LIS3_CLICK_DOUBLE_X     (1 << 1)
+#define LIS3_CLICK_SINGLE_Y     (1 << 2)
+#define LIS3_CLICK_DOUBLE_Y     (1 << 3)
+#define LIS3_CLICK_SINGLE_Z     (1 << 4)
+#define LIS3_CLICK_DOUBLE_Z     (1 << 5)
+        unsigned char click_flags;
+        unsigned char click_thresh_x;
+        unsigned char click_thresh_y;
+        unsigned char click_thresh_z;
+        unsigned char click_time_limit;
+        unsigned char click_latency;
+        unsigned char click_window;
+
+#define LIS3_IRQ1_DISABLE       (0 << 0)
+#define LIS3_IRQ1_FF_WU_1       (1 << 0)
+#define LIS3_IRQ1_FF_WU_2       (2 << 0)
+#define LIS3_IRQ1_FF_WU_12      (3 << 0)
+#define LIS3_IRQ1_DATA_READY    (4 << 0)
+#define LIS3_IRQ1_CLICK         (7 << 0)
+#define LIS3_IRQ2_DISABLE       (0 << 3)
+#define LIS3_IRQ2_FF_WU_1       (1 << 3)
+#define LIS3_IRQ2_FF_WU_2       (2 << 3)
+#define LIS3_IRQ2_FF_WU_12      (3 << 3)
+#define LIS3_IRQ2_DATA_READY    (4 << 3)
+#define LIS3_IRQ2_CLICK         (7 << 3)
+#define LIS3_IRQ_OPEN_DRAIN     (1 << 6)
+#define LIS3_IRQ_ACTIVE_HIGH    (1 << 7)
+        unsigned char irq_cfg;
+};
+
+#endif /* __LIS3LV02D_H_ */
diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
index 93150ecf3ea4..5d10ae364b5e 100644
--- a/include/linux/list_nulls.h
+++ b/include/linux/list_nulls.h
@@ -56,6 +56,18 @@ static inline int hlist_nulls_empty(const struct hlist_nulls_head *h)
         return is_a_nulls(h->first);
 }
 
+static inline void hlist_nulls_add_head(struct hlist_nulls_node *n,
+                                        struct hlist_nulls_head *h)
+{
+        struct hlist_nulls_node *first = h->first;
+
+        n->next = first;
+        n->pprev = &h->first;
+        h->first = n;
+        if (!is_a_nulls(first))
+                first->pprev = &n->next;
+}
+
 static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
 {
         struct hlist_nulls_node *next = n->next;
@@ -65,6 +77,12 @@ static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
                 next->pprev = pprev;
 }
 
+static inline void hlist_nulls_del(struct hlist_nulls_node *n)
+{
+        __hlist_nulls_del(n);
+        n->pprev = LIST_POISON2;
+}
+
 /**
  * hlist_nulls_for_each_entry   - iterate over list of given type
  * @tpos:       the type * to use as a loop cursor.
diff --git a/include/linux/mISDNdsp.h b/include/linux/mISDNdsp.h
index 6b71d2dce508..41d1eeb9b3bd 100644
--- a/include/linux/mISDNdsp.h
+++ b/include/linux/mISDNdsp.h
@@ -12,7 +12,8 @@ struct mISDN_dsp_element {
         void    *(*new)(const char *arg);
         void    (*free)(void *p);
         void    (*process_tx)(void *p, unsigned char *data, int len);
-        void    (*process_rx)(void *p, unsigned char *data, int len);
+        void    (*process_rx)(void *p, unsigned char *data, int len,
+                        unsigned int txlen);
         int     num_args;
         struct mISDN_dsp_element_arg
                 *args;
@@ -24,6 +25,7 @@ extern void mISDN_dsp_element_unregister(struct mISDN_dsp_element *elem);
 struct dsp_features {
         int     hfc_id; /* unique id to identify the chip (or -1) */
         int     hfc_dtmf; /* set if HFCmulti card supports dtmf */
+        int     hfc_conf; /* set if HFCmulti card supports conferences */
         int     hfc_loops; /* set if card supports tone loops */
         int     hfc_echocanhw; /* set if card supports echocancelation*/
         int     pcm_id; /* unique id to identify the pcm bus (or -1) */
diff --git a/include/linux/mISDNhw.h b/include/linux/mISDNhw.h
index 97ffdc1d3442..7f9831da847f 100644
--- a/include/linux/mISDNhw.h
+++ b/include/linux/mISDNhw.h
@@ -89,11 +89,6 @@ struct dchannel {
         void                    (*phfunc) (struct dchannel *);
         u_int                   state;
         void                    *l1;
-        /* HW access */
-        u_char                  (*read_reg) (void *, u_char);
-        void                    (*write_reg) (void *, u_char, u_char);
-        void                    (*read_fifo) (void *, u_char *, int);
-        void                    (*write_fifo) (void *, u_char *, int);
         void                    *hw;
         int                     slot;   /* multiport card channel slot */
         struct timer_list       timer;
@@ -151,11 +146,6 @@ struct bchannel {
         u_long                  Flags;
         struct work_struct      workq;
         u_int                   state;
-        /* HW access */
-        u_char                  (*read_reg) (void *, u_char);
-        void                    (*write_reg) (void *, u_char, u_char);
-        void                    (*read_fifo) (void *, u_char *, int);
-        void                    (*write_fifo) (void *, u_char *, int);
         void                    *hw;
         int                     slot;   /* multiport card channel slot */
         struct timer_list       timer;
@@ -185,7 +175,7 @@ extern int	dchannel_senddata(struct dchannel *, struct sk_buff *);
 extern int      bchannel_senddata(struct bchannel *, struct sk_buff *);
 extern void     recv_Dchannel(struct dchannel *);
 extern void     recv_Echannel(struct dchannel *, struct dchannel *);
-extern void     recv_Bchannel(struct bchannel *);
+extern void     recv_Bchannel(struct bchannel *, unsigned int id);
 extern void     recv_Dchannel_skb(struct dchannel *, struct sk_buff *);
 extern void     recv_Bchannel_skb(struct bchannel *, struct sk_buff *);
 extern void     confirm_Bsend(struct bchannel *bch);
diff --git a/include/linux/mISDNif.h b/include/linux/mISDNif.h
index 5da3d95b27f1..45100b39a7cf 100644
--- a/include/linux/mISDNif.h
+++ b/include/linux/mISDNif.h
@@ -229,6 +229,7 @@
 #define OPTION_L2_PTP           2
 #define OPTION_L2_FIXEDTEI      3
 #define OPTION_L2_CLEANUP       4
+#define OPTION_L1_HOLD          5
 
 /* should be in sync with linux/kobject.h:KOBJ_NAME_LEN */
 #define MISDN_MAX_IDLEN         20
@@ -291,19 +292,19 @@ struct mISDN_devrename {
 
 /* MPH_INFORMATION_REQ payload */
 struct ph_info_ch {
-        __u32 protocol;
-        __u64 Flags;
+        __u32 protocol;
+        __u64 Flags;
 };
 
 struct ph_info_dch {
-        struct ph_info_ch ch;
-        __u16 state;
-        __u16 num_bch;
+        struct ph_info_ch ch;
+        __u16 state;
+        __u16 num_bch;
 };
 
 struct ph_info {
-        struct ph_info_dch dch;
-        struct ph_info_ch  bch[];
+        struct ph_info_dch dch;
+        struct ph_info_ch  bch[];
 };
 
 /* timer device ioctl */
@@ -317,6 +318,7 @@ struct ph_info {
 #define IMCTRLREQ       _IOR('I', 69, int)
 #define IMCLEAR_L2      _IOR('I', 70, int)
 #define IMSETDEVNAME    _IOR('I', 71, struct mISDN_devrename)
+#define IMHOLD_L1       _IOR('I', 72, int)
 
 static inline int
 test_channelmap(u_int nr, u_char *map)
@@ -362,7 +364,8 @@ clear_channelmap(u_int nr, u_char *map)
 #define MISDN_CTRL_HFC_RECEIVE_ON       0x4006
 #define MISDN_CTRL_HFC_ECHOCAN_ON       0x4007
 #define MISDN_CTRL_HFC_ECHOCAN_OFF      0x4008
-
+#define MISDN_CTRL_HFC_WD_INIT          0x4009
+#define MISDN_CTRL_HFC_WD_RESET         0x400A
 
 /* socket options */
 #define MISDN_TIME_STAMP                0x0001
diff --git a/include/linux/major.h b/include/linux/major.h
index 058ec15dd060..6a8ca98c9a96 100644
--- a/include/linux/major.h
+++ b/include/linux/major.h
@@ -145,6 +145,7 @@
 #define UNIX98_PTY_MAJOR_COUNT  8
 #define UNIX98_PTY_SLAVE_MAJOR  (UNIX98_PTY_MASTER_MAJOR+UNIX98_PTY_MAJOR_COUNT)
 
+#define DRBD_MAJOR              147
 #define RTF_MAJOR               150
 #define RAW_MAJOR               162
 
diff --git a/include/linux/mdio.h b/include/linux/mdio.h
new file mode 100644
index 000000000000..cfdf1df2875e
--- /dev/null
+++ b/include/linux/mdio.h
@@ -0,0 +1,356 @@
+/*
+ * linux/mdio.h: definitions for MDIO (clause 45) transceivers
+ * Copyright 2006-2009 Solarflare Communications Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation, incorporated herein by reference.
+ */
+
+#ifndef __LINUX_MDIO_H__
+#define __LINUX_MDIO_H__
+
+#include <linux/mii.h>
+
+/* MDIO Manageable Devices (MMDs). */
+#define MDIO_MMD_PMAPMD         1       /* Physical Medium Attachment/
+                                         * Physical Medium Dependent */
+#define MDIO_MMD_WIS            2       /* WAN Interface Sublayer */
+#define MDIO_MMD_PCS            3       /* Physical Coding Sublayer */
+#define MDIO_MMD_PHYXS          4       /* PHY Extender Sublayer */
+#define MDIO_MMD_DTEXS          5       /* DTE Extender Sublayer */
+#define MDIO_MMD_TC             6       /* Transmission Convergence */
+#define MDIO_MMD_AN             7       /* Auto-Negotiation */
+#define MDIO_MMD_C22EXT         29      /* Clause 22 extension */
+#define MDIO_MMD_VEND1          30      /* Vendor specific 1 */
+#define MDIO_MMD_VEND2          31      /* Vendor specific 2 */
+
+/* Generic MDIO registers. */
+#define MDIO_CTRL1              MII_BMCR
+#define MDIO_STAT1              MII_BMSR
+#define MDIO_DEVID1             MII_PHYSID1
+#define MDIO_DEVID2             MII_PHYSID2
+#define MDIO_SPEED              4       /* Speed ability */
+#define MDIO_DEVS1              5       /* Devices in package */
+#define MDIO_DEVS2              6
+#define MDIO_CTRL2              7       /* 10G control 2 */
+#define MDIO_STAT2              8       /* 10G status 2 */
+#define MDIO_PMA_TXDIS          9       /* 10G PMA/PMD transmit disable */
+#define MDIO_PMA_RXDET          10      /* 10G PMA/PMD receive signal detect */
+#define MDIO_PMA_EXTABLE        11      /* 10G PMA/PMD extended ability */
+#define MDIO_PKGID1             14      /* Package identifier */
+#define MDIO_PKGID2             15
+#define MDIO_AN_ADVERTISE       16      /* AN advertising (base page) */
+#define MDIO_AN_LPA             19      /* AN LP abilities (base page) */
+#define MDIO_PHYXS_LNSTAT       24      /* PHY XGXS lane state */
+
+/* Media-dependent registers. */
+#define MDIO_PMA_10GBT_SWAPPOL  130     /* 10GBASE-T pair swap & polarity */
+#define MDIO_PMA_10GBT_TXPWR    131     /* 10GBASE-T TX power control */
+#define MDIO_PMA_10GBT_SNR      133     /* 10GBASE-T SNR margin, lane A.
+                                         * Lanes B-D are numbered 134-136. */
+#define MDIO_PMA_10GBR_FECABLE  170     /* 10GBASE-R FEC ability */
+#define MDIO_PCS_10GBX_STAT1    24      /* 10GBASE-X PCS status 1 */
+#define MDIO_PCS_10GBRT_STAT1   32      /* 10GBASE-R/-T PCS status 1 */
+#define MDIO_PCS_10GBRT_STAT2   33      /* 10GBASE-R/-T PCS status 2 */
+#define MDIO_AN_10GBT_CTRL      32      /* 10GBASE-T auto-negotiation control */
+#define MDIO_AN_10GBT_STAT      33      /* 10GBASE-T auto-negotiation status */
+
+/* LASI (Link Alarm Status Interrupt) registers, defined by XENPAK MSA. */
+#define MDIO_PMA_LASI_RXCTRL    0x9000  /* RX_ALARM control */
+#define MDIO_PMA_LASI_TXCTRL    0x9001  /* TX_ALARM control */
+#define MDIO_PMA_LASI_CTRL      0x9002  /* LASI control */
+#define MDIO_PMA_LASI_RXSTAT    0x9003  /* RX_ALARM status */
+#define MDIO_PMA_LASI_TXSTAT    0x9004  /* TX_ALARM status */
+#define MDIO_PMA_LASI_STAT      0x9005  /* LASI status */
+
+/* Control register 1. */
+/* Enable extended speed selection */
+#define MDIO_CTRL1_SPEEDSELEXT          (BMCR_SPEED1000 | BMCR_SPEED100)
+/* All speed selection bits */
+#define MDIO_CTRL1_SPEEDSEL             (MDIO_CTRL1_SPEEDSELEXT | 0x003c)
+#define MDIO_CTRL1_FULLDPLX             BMCR_FULLDPLX
+#define MDIO_CTRL1_LPOWER               BMCR_PDOWN
+#define MDIO_CTRL1_RESET                BMCR_RESET
+#define MDIO_PMA_CTRL1_LOOPBACK         0x0001
+#define MDIO_PMA_CTRL1_SPEED1000        BMCR_SPEED1000
+#define MDIO_PMA_CTRL1_SPEED100         BMCR_SPEED100
+#define MDIO_PCS_CTRL1_LOOPBACK         BMCR_LOOPBACK
+#define MDIO_PHYXS_CTRL1_LOOPBACK       BMCR_LOOPBACK
+#define MDIO_AN_CTRL1_RESTART           BMCR_ANRESTART
+#define MDIO_AN_CTRL1_ENABLE            BMCR_ANENABLE
+#define MDIO_AN_CTRL1_XNP               0x2000  /* Enable extended next page */
+
+/* 10 Gb/s */
+#define MDIO_CTRL1_SPEED10G             (MDIO_CTRL1_SPEEDSELEXT | 0x00)
+/* 10PASS-TS/2BASE-TL */
+#define MDIO_CTRL1_SPEED10P2B           (MDIO_CTRL1_SPEEDSELEXT | 0x04)
+
+/* Status register 1. */
+#define MDIO_STAT1_LPOWERABLE           0x0002  /* Low-power ability */
+#define MDIO_STAT1_LSTATUS              BMSR_LSTATUS
+#define MDIO_STAT1_FAULT                0x0080  /* Fault */
+#define MDIO_AN_STAT1_LPABLE            0x0001  /* Link partner AN ability */
+#define MDIO_AN_STAT1_ABLE              BMSR_ANEGCAPABLE
+#define MDIO_AN_STAT1_RFAULT            BMSR_RFAULT
+#define MDIO_AN_STAT1_COMPLETE          BMSR_ANEGCOMPLETE
+#define MDIO_AN_STAT1_PAGE              0x0040  /* Page received */
+#define MDIO_AN_STAT1_XNP               0x0080  /* Extended next page status */
+
+/* Speed register. */
+#define MDIO_SPEED_10G                  0x0001  /* 10G capable */
+#define MDIO_PMA_SPEED_2B               0x0002  /* 2BASE-TL capable */
+#define MDIO_PMA_SPEED_10P              0x0004  /* 10PASS-TS capable */
+#define MDIO_PMA_SPEED_1000             0x0010  /* 1000M capable */
+#define MDIO_PMA_SPEED_100              0x0020  /* 100M capable */
+#define MDIO_PMA_SPEED_10               0x0040  /* 10M capable */
+#define MDIO_PCS_SPEED_10P2B            0x0002  /* 10PASS-TS/2BASE-TL capable */
+
+/* Device present registers. */
+#define MDIO_DEVS_PRESENT(devad)        (1 << (devad))
+#define MDIO_DEVS_PMAPMD                MDIO_DEVS_PRESENT(MDIO_MMD_PMAPMD)
+#define MDIO_DEVS_WIS                   MDIO_DEVS_PRESENT(MDIO_MMD_WIS)
+#define MDIO_DEVS_PCS                   MDIO_DEVS_PRESENT(MDIO_MMD_PCS)
+#define MDIO_DEVS_PHYXS                 MDIO_DEVS_PRESENT(MDIO_MMD_PHYXS)
+#define MDIO_DEVS_DTEXS                 MDIO_DEVS_PRESENT(MDIO_MMD_DTEXS)
+#define MDIO_DEVS_TC                    MDIO_DEVS_PRESENT(MDIO_MMD_TC)
+#define MDIO_DEVS_AN                    MDIO_DEVS_PRESENT(MDIO_MMD_AN)
+#define MDIO_DEVS_C22EXT                MDIO_DEVS_PRESENT(MDIO_MMD_C22EXT)
+
+/* Control register 2. */
+#define MDIO_PMA_CTRL2_TYPE             0x000f  /* PMA/PMD type selection */
+#define MDIO_PMA_CTRL2_10GBCX4          0x0000  /* 10GBASE-CX4 type */
+#define MDIO_PMA_CTRL2_10GBEW           0x0001  /* 10GBASE-EW type */
+#define MDIO_PMA_CTRL2_10GBLW           0x0002  /* 10GBASE-LW type */
+#define MDIO_PMA_CTRL2_10GBSW           0x0003  /* 10GBASE-SW type */
+#define MDIO_PMA_CTRL2_10GBLX4          0x0004  /* 10GBASE-LX4 type */
+#define MDIO_PMA_CTRL2_10GBER           0x0005  /* 10GBASE-ER type */
+#define MDIO_PMA_CTRL2_10GBLR           0x0006  /* 10GBASE-LR type */
+#define MDIO_PMA_CTRL2_10GBSR           0x0007  /* 10GBASE-SR type */
+#define MDIO_PMA_CTRL2_10GBLRM          0x0008  /* 10GBASE-LRM type */
+#define MDIO_PMA_CTRL2_10GBT            0x0009  /* 10GBASE-T type */
+#define MDIO_PMA_CTRL2_10GBKX4          0x000a  /* 10GBASE-KX4 type */
+#define MDIO_PMA_CTRL2_10GBKR           0x000b  /* 10GBASE-KR type */
+#define MDIO_PMA_CTRL2_1000BT           0x000c  /* 1000BASE-T type */
+#define MDIO_PMA_CTRL2_1000BKX          0x000d  /* 1000BASE-KX type */
+#define MDIO_PMA_CTRL2_100BTX           0x000e  /* 100BASE-TX type */
+#define MDIO_PMA_CTRL2_10BT             0x000f  /* 10BASE-T type */
+#define MDIO_PCS_CTRL2_TYPE             0x0003  /* PCS type selection */
+#define MDIO_PCS_CTRL2_10GBR            0x0000  /* 10GBASE-R type */
+#define MDIO_PCS_CTRL2_10GBX            0x0001  /* 10GBASE-X type */
+#define MDIO_PCS_CTRL2_10GBW            0x0002  /* 10GBASE-W type */
+#define MDIO_PCS_CTRL2_10GBT            0x0003  /* 10GBASE-T type */
+
+/* Status register 2. */
+#define MDIO_STAT2_RXFAULT              0x0400  /* Receive fault */
+#define MDIO_STAT2_TXFAULT              0x0800  /* Transmit fault */
+#define MDIO_STAT2_DEVPRST              0xc000  /* Device present */
+#define MDIO_STAT2_DEVPRST_VAL          0x8000  /* Device present value */
+#define MDIO_PMA_STAT2_LBABLE           0x0001  /* PMA loopback ability */
+#define MDIO_PMA_STAT2_10GBEW           0x0002  /* 10GBASE-EW ability */
+#define MDIO_PMA_STAT2_10GBLW           0x0004  /* 10GBASE-LW ability */
+#define MDIO_PMA_STAT2_10GBSW           0x0008  /* 10GBASE-SW ability */
+#define MDIO_PMA_STAT2_10GBLX4          0x0010  /* 10GBASE-LX4 ability */
+#define MDIO_PMA_STAT2_10GBER           0x0020  /* 10GBASE-ER ability */
+#define MDIO_PMA_STAT2_10GBLR           0x0040  /* 10GBASE-LR ability */
+#define MDIO_PMA_STAT2_10GBSR           0x0080  /* 10GBASE-SR ability */
+#define MDIO_PMD_STAT2_TXDISAB          0x0100  /* PMD TX disable ability */
+#define MDIO_PMA_STAT2_EXTABLE          0x0200  /* Extended abilities */
+#define MDIO_PMA_STAT2_RXFLTABLE        0x1000  /* Receive fault ability */
+#define MDIO_PMA_STAT2_TXFLTABLE        0x2000  /* Transmit fault ability */
+#define MDIO_PCS_STAT2_10GBR            0x0001  /* 10GBASE-R capable */
+#define MDIO_PCS_STAT2_10GBX            0x0002  /* 10GBASE-X capable */
+#define MDIO_PCS_STAT2_10GBW            0x0004  /* 10GBASE-W capable */
+#define MDIO_PCS_STAT2_RXFLTABLE        0x1000  /* Receive fault ability */
+#define MDIO_PCS_STAT2_TXFLTABLE        0x2000  /* Transmit fault ability */
+
+/* Transmit disable register. */
+#define MDIO_PMD_TXDIS_GLOBAL           0x0001  /* Global PMD TX disable */
+#define MDIO_PMD_TXDIS_0                0x0002  /* PMD TX disable 0 */
+#define MDIO_PMD_TXDIS_1                0x0004  /* PMD TX disable 1 */
+#define MDIO_PMD_TXDIS_2                0x0008  /* PMD TX disable 2 */
+#define MDIO_PMD_TXDIS_3                0x0010  /* PMD TX disable 3 */
+
+/* Receive signal detect register. */
+#define MDIO_PMD_RXDET_GLOBAL           0x0001  /* Global PMD RX signal detect */
+#define MDIO_PMD_RXDET_0                0x0002  /* PMD RX signal detect 0 */
+#define MDIO_PMD_RXDET_1                0x0004  /* PMD RX signal detect 1 */
+#define MDIO_PMD_RXDET_2                0x0008  /* PMD RX signal detect 2 */
+#define MDIO_PMD_RXDET_3                0x0010  /* PMD RX signal detect 3 */
+
+/* Extended abilities register. */
+#define MDIO_PMA_EXTABLE_10GCX4         0x0001  /* 10GBASE-CX4 ability */
+#define MDIO_PMA_EXTABLE_10GBLRM        0x0002  /* 10GBASE-LRM ability */
+#define MDIO_PMA_EXTABLE_10GBT          0x0004  /* 10GBASE-T ability */
+#define MDIO_PMA_EXTABLE_10GBKX4        0x0008  /* 10GBASE-KX4 ability */
+#define MDIO_PMA_EXTABLE_10GBKR         0x0010  /* 10GBASE-KR ability */
+#define MDIO_PMA_EXTABLE_1000BT         0x0020  /* 1000BASE-T ability */
+#define MDIO_PMA_EXTABLE_1000BKX        0x0040  /* 1000BASE-KX ability */
+#define MDIO_PMA_EXTABLE_100BTX         0x0080  /* 100BASE-TX ability */
+#define MDIO_PMA_EXTABLE_10BT           0x0100  /* 10BASE-T ability */
+
+/* PHY XGXS lane state register. */
+#define MDIO_PHYXS_LNSTAT_SYNC0         0x0001
+#define MDIO_PHYXS_LNSTAT_SYNC1         0x0002
+#define MDIO_PHYXS_LNSTAT_SYNC2         0x0004
+#define MDIO_PHYXS_LNSTAT_SYNC3         0x0008
+#define MDIO_PHYXS_LNSTAT_ALIGN         0x1000
+
+/* PMA 10GBASE-T pair swap & polarity */
+#define MDIO_PMA_10GBT_SWAPPOL_ABNX     0x0001  /* Pair A/B uncrossed */
+#define MDIO_PMA_10GBT_SWAPPOL_CDNX     0x0002  /* Pair C/D uncrossed */
+#define MDIO_PMA_10GBT_SWAPPOL_AREV     0x0100  /* Pair A polarity reversed */
+#define MDIO_PMA_10GBT_SWAPPOL_BREV     0x0200  /* Pair B polarity reversed */
+#define MDIO_PMA_10GBT_SWAPPOL_CREV     0x0400  /* Pair C polarity reversed */
+#define MDIO_PMA_10GBT_SWAPPOL_DREV     0x0800  /* Pair D polarity reversed */
+
+/* PMA 10GBASE-T TX power register. */
+#define MDIO_PMA_10GBT_TXPWR_SHORT      0x0001  /* Short-reach mode */
+
+/* PMA 10GBASE-T SNR registers. */
+/* Value is SNR margin in dB, clamped to range [-127, 127], plus 0x8000. */
+#define MDIO_PMA_10GBT_SNR_BIAS         0x8000
+#define MDIO_PMA_10GBT_SNR_MAX          127
+
+/* PMA 10GBASE-R FEC ability register. */
+#define MDIO_PMA_10GBR_FECABLE_ABLE     0x0001  /* FEC ability */
+#define MDIO_PMA_10GBR_FECABLE_ERRABLE  0x0002  /* FEC error indic. ability */
+
+/* PCS 10GBASE-R/-T status register 1. */
+#define MDIO_PCS_10GBRT_STAT1_BLKLK     0x0001  /* Block lock attained */
+
+/* PCS 10GBASE-R/-T status register 2. */
+#define MDIO_PCS_10GBRT_STAT2_ERR       0x00ff
+#define MDIO_PCS_10GBRT_STAT2_BER       0x3f00
+
+/* AN 10GBASE-T control register. */
+#define MDIO_AN_10GBT_CTRL_ADV10G       0x1000  /* Advertise 10GBASE-T */
+
+/* AN 10GBASE-T status register. */
+#define MDIO_AN_10GBT_STAT_LPTRR        0x0200  /* LP training reset req. */
+#define MDIO_AN_10GBT_STAT_LPLTABLE     0x0400  /* LP loop timing ability */
+#define MDIO_AN_10GBT_STAT_LP10G        0x0800  /* LP is 10GBT capable */
+#define MDIO_AN_10GBT_STAT_REMOK        0x1000  /* Remote OK */
+#define MDIO_AN_10GBT_STAT_LOCOK        0x2000  /* Local OK */
+#define MDIO_AN_10GBT_STAT_MS           0x4000  /* Master/slave config */
+#define MDIO_AN_10GBT_STAT_MSFLT        0x8000  /* Master/slave config fault */
+
+/* LASI RX_ALARM control/status registers. */
+#define MDIO_PMA_LASI_RX_PHYXSLFLT      0x0001  /* PHY XS RX local fault */
+#define MDIO_PMA_LASI_RX_PCSLFLT        0x0008  /* PCS RX local fault */
+#define MDIO_PMA_LASI_RX_PMALFLT        0x0010  /* PMA/PMD RX local fault */
+#define MDIO_PMA_LASI_RX_OPTICPOWERFLT  0x0020  /* RX optical power fault */
+#define MDIO_PMA_LASI_RX_WISLFLT        0x0200  /* WIS local fault */
+
+/* LASI TX_ALARM control/status registers. */
+#define MDIO_PMA_LASI_TX_PHYXSLFLT      0x0001  /* PHY XS TX local fault */
+#define MDIO_PMA_LASI_TX_PCSLFLT        0x0008  /* PCS TX local fault */
+#define MDIO_PMA_LASI_TX_PMALFLT        0x0010  /* PMA/PMD TX local fault */
+#define MDIO_PMA_LASI_TX_LASERPOWERFLT  0x0080  /* Laser output power fault */
+#define MDIO_PMA_LASI_TX_LASERTEMPFLT   0x0100  /* Laser temperature fault */
+#define MDIO_PMA_LASI_TX_LASERBICURRFLT 0x0200  /* Laser bias current fault */
+
+/* LASI control/status registers. */
+#define MDIO_PMA_LASI_LSALARM           0x0001  /* LS_ALARM enable/status */
+#define MDIO_PMA_LASI_TXALARM           0x0002  /* TX_ALARM enable/status */
+#define MDIO_PMA_LASI_RXALARM           0x0004  /* RX_ALARM enable/status */
+
+/* Mapping between MDIO PRTAD/DEVAD and mii_ioctl_data::phy_id */
+
+#define MDIO_PHY_ID_C45                 0x8000
+#define MDIO_PHY_ID_PRTAD               0x03e0
+#define MDIO_PHY_ID_DEVAD               0x001f
+#define MDIO_PHY_ID_C45_MASK                                            \
+        (MDIO_PHY_ID_C45 | MDIO_PHY_ID_PRTAD | MDIO_PHY_ID_DEVAD)
+
+static inline __u16 mdio_phy_id_c45(int prtad, int devad)
+{
+        return MDIO_PHY_ID_C45 | (prtad << 5) | devad;
+}
+
+static inline bool mdio_phy_id_is_c45(int phy_id)
+{
+        return (phy_id & MDIO_PHY_ID_C45) && !(phy_id & ~MDIO_PHY_ID_C45_MASK);
+}
+
+static inline __u16 mdio_phy_id_prtad(int phy_id)
+{
+        return (phy_id & MDIO_PHY_ID_PRTAD) >> 5;
+}
+
+static inline __u16 mdio_phy_id_devad(int phy_id)
+{
+        return phy_id & MDIO_PHY_ID_DEVAD;
+}
+
+#define MDIO_SUPPORTS_C22               1
+#define MDIO_SUPPORTS_C45               2
+
+#ifdef __KERNEL__ 
+
+/**
+ * struct mdio_if_info - Ethernet controller MDIO interface
+ * @prtad: PRTAD of the PHY (%MDIO_PRTAD_NONE if not present/unknown)
+ * @mmds: Mask of MMDs expected to be present in the PHY.  This must be
+ *      non-zero unless @prtad = %MDIO_PRTAD_NONE.
+ * @mode_support: MDIO modes supported.  If %MDIO_SUPPORTS_C22 is set then
+ *      MII register access will be passed through with @devad =
+ *      %MDIO_DEVAD_NONE.  If %MDIO_EMULATE_C22 is set then access to
+ *      commonly used clause 22 registers will be translated into
+ *      clause 45 registers.
+ * @dev: Net device structure
+ * @mdio_read: Register read function; returns value or negative error code
+ * @mdio_write: Register write function; returns 0 or negative error code
+ */
+struct mdio_if_info {
+        int prtad;
+        u32 __bitwise mmds;
+        unsigned mode_support;
+
+        struct net_device *dev;
+        int (*mdio_read)(struct net_device *dev, int prtad, int devad,
+                         u16 addr);
+        int (*mdio_write)(struct net_device *dev, int prtad, int devad,
+                          u16 addr, u16 val);
+};
+
+#define MDIO_PRTAD_NONE                 (-1)
+#define MDIO_DEVAD_NONE                 (-1)
+#define MDIO_EMULATE_C22                4
+
+struct ethtool_cmd;
+struct ethtool_pauseparam;
+extern int mdio45_probe(struct mdio_if_info *mdio, int prtad);
+extern int mdio_set_flag(const struct mdio_if_info *mdio,
+                         int prtad, int devad, u16 addr, int mask,
+                         bool sense);
+extern int mdio45_links_ok(const struct mdio_if_info *mdio, u32 mmds);
+extern int mdio45_nway_restart(const struct mdio_if_info *mdio);
+extern void mdio45_ethtool_gset_npage(const struct mdio_if_info *mdio,
+                                      struct ethtool_cmd *ecmd,
+                                      u32 npage_adv, u32 npage_lpa);
+extern void
+mdio45_ethtool_spauseparam_an(const struct mdio_if_info *mdio,
+                              const struct ethtool_pauseparam *ecmd);
+
+/**
+ * mdio45_ethtool_gset - get settings for ETHTOOL_GSET
+ * @mdio: MDIO interface
+ * @ecmd: Ethtool request structure
+ *
+ * Since the CSRs for auto-negotiation using next pages are not fully
+ * standardised, this function does not attempt to decode them.  Use
+ * mdio45_ethtool_gset_npage() to specify advertisement bits from next
+ * pages.
+ */
+static inline void mdio45_ethtool_gset(const struct mdio_if_info *mdio,
+                                       struct ethtool_cmd *ecmd)
+{
+        mdio45_ethtool_gset_npage(mdio, ecmd, 0, 0);
+}
+
+extern int mdio_mii_ioctl(const struct mdio_if_info *mdio,
+                          struct mii_ioctl_data *mii_data, int cmd);
+
+#endif /* __KERNEL__ */
+#endif /* __LINUX_MDIO_H__ */
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 25b9ca93d232..45add35dda1b 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -94,6 +94,7 @@ extern void mem_cgroup_note_reclaim_priority(struct mem_cgroup *mem,
 extern void mem_cgroup_record_reclaim_priority(struct mem_cgroup *mem,
                                                         int priority);
 int mem_cgroup_inactive_anon_is_low(struct mem_cgroup *memcg);
+int mem_cgroup_inactive_file_is_low(struct mem_cgroup *memcg);
 unsigned long mem_cgroup_zone_nr_pages(struct mem_cgroup *memcg,
                                        struct zone *zone,
                                        enum lru_list lru);
@@ -239,6 +240,12 @@ mem_cgroup_inactive_anon_is_low(struct mem_cgroup *memcg)
         return 1;
 }
 
+static inline int
+mem_cgroup_inactive_file_is_low(struct mem_cgroup *memcg)
+{
+        return 1;
+}
+
 static inline unsigned long
 mem_cgroup_zone_nr_pages(struct mem_cgroup *memcg, struct zone *zone,
                          enum lru_list lru)
diff --git a/include/linux/mfd/tmio.h b/include/linux/mfd/tmio.h
index 516d955ab8a1..c377118884e6 100644
--- a/include/linux/mfd/tmio.h
+++ b/include/linux/mfd/tmio.h
@@ -19,6 +19,13 @@
         } while (0)
 
 /*
+ * data for the MMC controller
+ */
+struct tmio_mmc_data {
+        unsigned int            hclk;
+};
+
+/*
  * data for the NAND controller
  */
 struct tmio_nand_data {
diff --git a/include/linux/mg_disk.h b/include/linux/mg_disk.h
new file mode 100644
index 000000000000..e11f4d9f1c2e
--- /dev/null
+++ b/include/linux/mg_disk.h
@@ -0,0 +1,45 @@
+/*
+ *  include/linux/mg_disk.c
+ *
+ *  Private data for mflash platform driver
+ *
+ * (c) 2008 mGine Co.,LTD
+ * (c) 2008 unsik Kim <donari75@gmail.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ */
+
+#ifndef __MG_DISK_H__
+#define __MG_DISK_H__
+
+/* name for platform device */
+#define MG_DEV_NAME "mg_disk"
+
+/* names of GPIO resource */
+#define MG_RST_PIN      "mg_rst"
+/* except MG_BOOT_DEV, reset-out pin should be assigned */
+#define MG_RSTOUT_PIN   "mg_rstout"
+
+/* device attribution */
+/* use mflash as boot device */
+#define MG_BOOT_DEV             (1 << 0)
+/* use mflash as storage device */
+#define MG_STORAGE_DEV          (1 << 1)
+/* same as MG_STORAGE_DEV, but bootloader already done reset sequence */
+#define MG_STORAGE_DEV_SKIP_RST (1 << 2)
+
+/* private driver data */
+struct mg_drv_data {
+        /* disk resource */
+        u32 use_polling;
+
+        /* device attribution */
+        u32 dev_attr;
+
+        /* internally used */
+        void *host;
+};
+
+#endif
diff --git a/include/linux/mii.h b/include/linux/mii.h
index ad748588faf1..359fba880274 100644
--- a/include/linux/mii.h
+++ b/include/linux/mii.h
@@ -240,6 +240,22 @@ static inline unsigned int mii_duplex (unsigned int duplex_lock,
 }
 
 /**
+ * mii_advertise_flowctrl - get flow control advertisement flags
+ * @cap: Flow control capabilities (FLOW_CTRL_RX, FLOW_CTRL_TX or both)
+ */
+static inline u16 mii_advertise_flowctrl(int cap)
+{
+        u16 adv = 0;
+
+        if (cap & FLOW_CTRL_RX)
+                adv = ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM;
+        if (cap & FLOW_CTRL_TX)
+                adv ^= ADVERTISE_PAUSE_ASYM;
+
+        return adv;
+}
+
+/**
  * mii_resolve_flowctrl_fdx
  * @lcladv: value of MII ADVERTISE register
  * @rmtadv: value of MII LPA register
@@ -250,18 +266,12 @@ static inline u8 mii_resolve_flowctrl_fdx(u16 lcladv, u16 rmtadv)
 {
         u8 cap = 0;
 
-        if (lcladv & ADVERTISE_PAUSE_CAP) {
-                if (lcladv & ADVERTISE_PAUSE_ASYM) {
-                        if (rmtadv & LPA_PAUSE_CAP)
-                                cap = FLOW_CTRL_TX | FLOW_CTRL_RX;
-                        else if (rmtadv & LPA_PAUSE_ASYM)
-                                cap = FLOW_CTRL_RX;
-                } else {
-                        if (rmtadv & LPA_PAUSE_CAP)
-                                cap = FLOW_CTRL_TX | FLOW_CTRL_RX;
-                }
-        } else if (lcladv & ADVERTISE_PAUSE_ASYM) {
-                if ((rmtadv & LPA_PAUSE_CAP) && (rmtadv & LPA_PAUSE_ASYM))
+        if (lcladv & rmtadv & ADVERTISE_PAUSE_CAP) {
+                cap = FLOW_CTRL_TX | FLOW_CTRL_RX;
+        } else if (lcladv & rmtadv & ADVERTISE_PAUSE_ASYM) {
+                if (lcladv & ADVERTISE_PAUSE_CAP)
+                        cap = FLOW_CTRL_RX;
+                else if (rmtadv & ADVERTISE_PAUSE_CAP)
                         cap = FLOW_CTRL_TX;
         }
 
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index beb6ec99cfef..052117744629 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -41,6 +41,7 @@ struct miscdevice  {
         struct list_head list;
         struct device *parent;
         struct device *this_device;
+        const char *devnode;
 };
 
 extern int misc_register(struct miscdevice * misc);
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 3aff8a6a389e..ce7cc6c7bcbb 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -210,6 +210,7 @@ struct mlx4_caps {
         int                     num_comp_vectors;
         int                     num_mpts;
         int                     num_mtt_segs;
+        int                     mtts_per_seg;
         int                     fmr_reserved_mtts;
         int                     reserved_mtts;
         int                     reserved_mrws;
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index bf8f11982dae..9f29d86e5dc9 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -165,6 +165,7 @@ enum {
         MLX4_WQE_CTRL_IP_CSUM           = 1 << 4,
         MLX4_WQE_CTRL_TCP_UDP_CSUM      = 1 << 5,
         MLX4_WQE_CTRL_INS_VLAN          = 1 << 6,
+        MLX4_WQE_CTRL_STRONG_ORDER      = 1 << 7,
 };
 
 struct mlx4_wqe_ctrl_seg {
diff --git a/include/linux/mm.h b/include/linux/mm.h
index b457bc047ab1..cf260d848eb9 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -7,7 +7,6 @@
 
 #include <linux/gfp.h>
 #include <linux/list.h>
-#include <linux/mmdebug.h>
 #include <linux/mmzone.h>
 #include <linux/rbtree.h>
 #include <linux/prio_tree.h>
@@ -725,7 +724,7 @@ static inline int shmem_lock(struct file *file, int lock,
         return 0;
 }
 #endif
-struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags);
+struct file *shmem_file_setup(const char *name, loff_t size, unsigned long flags);
 
 int shmem_zero_setup(struct vm_area_struct *);
 
@@ -793,6 +792,8 @@ int copy_page_range(struct mm_struct *dst, struct mm_struct *src,
                         struct vm_area_struct *vma);
 void unmap_mapping_range(struct address_space *mapping,
                 loff_t const holebegin, loff_t const holelen, int even_cows);
+int follow_pfn(struct vm_area_struct *vma, unsigned long address,
+        unsigned long *pfn);
 int follow_phys(struct vm_area_struct *vma, unsigned long address,
                 unsigned int flags, unsigned long *prot, resource_size_t *phys);
 int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
@@ -824,8 +825,11 @@ static inline int handle_mm_fault(struct mm_struct *mm,
 extern int make_pages_present(unsigned long addr, unsigned long end);
 extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write);
 
-int get_user_pages(struct task_struct *tsk, struct mm_struct *mm, unsigned long start,
-                int len, int write, int force, struct page **pages, struct vm_area_struct **vmas);
+int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+                        unsigned long start, int len, int write, int force,
+                        struct page **pages, struct vm_area_struct **vmas);
+int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+                        struct page **pages);
 
 extern int try_to_release_page(struct page * page, gfp_t gfp_mask);
 extern void do_invalidatepage(struct page *page, unsigned long offset);
@@ -850,19 +854,6 @@ extern int mprotect_fixup(struct vm_area_struct *vma,
                           unsigned long end, unsigned long newflags);
 
 /*
- * get_user_pages_fast provides equivalent functionality to get_user_pages,
- * operating on current and current->mm (force=0 and doesn't return any vmas).
- *
- * get_user_pages_fast may take mmap_sem and page tables, so no assumptions
- * can be made about locking. get_user_pages_fast is to be implemented in a
- * way that is advantageous (vs get_user_pages()) when the user memory area is
- * already faulted in and present in ptes. However if the pages have to be
- * faulted in, it may turn out to be slightly slower).
- */
-int get_user_pages_fast(unsigned long start, int nr_pages, int write,
-                        struct page **pages);
-
-/*
  * doesn't attempt to fault and will return short.
  */
 int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
@@ -1067,7 +1058,8 @@ extern int __meminit __early_pfn_to_nid(unsigned long pfn);
 extern void set_dma_reserve(unsigned long new_dma_reserve);
 extern void memmap_init_zone(unsigned long, int, unsigned long,
                                 unsigned long, enum memmap_context);
-extern void setup_per_zone_pages_min(void);
+extern void setup_per_zone_wmarks(void);
+extern void calculate_zone_inactive_ratio(struct zone *zone);
 extern void mem_init(void);
 extern void __init mmap_init(void);
 extern void show_mem(void);
@@ -1184,8 +1176,6 @@ void task_dirty_inc(struct task_struct *tsk);
 #define VM_MAX_READAHEAD        128     /* kbytes */
 #define VM_MIN_READAHEAD        16      /* kbytes (includes current page) */
 
-int do_page_cache_readahead(struct address_space *mapping, struct file *filp,
-                        pgoff_t offset, unsigned long nr_to_read);
 int force_page_cache_readahead(struct address_space *mapping, struct file *filp,
                         pgoff_t offset, unsigned long nr_to_read);
 
@@ -1203,6 +1193,9 @@ void page_cache_async_readahead(struct address_space *mapping,
                                 unsigned long size);
 
 unsigned long max_sane_readahead(unsigned long nr);
+unsigned long ra_submit(struct file_ra_state *ra,
+                        struct address_space *mapping,
+                        struct file *filp);
 
 /* Do stack extension */
 extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 0e80e26ecf21..7acc8439d9b3 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -98,6 +98,14 @@ struct page {
 #ifdef CONFIG_WANT_PAGE_DEBUG_FLAGS
         unsigned long debug_flags;      /* Use atomic bitops on this */
 #endif
+
+#ifdef CONFIG_KMEMCHECK
+        /*
+         * kmemcheck wants to track the status of each byte in a page; this
+         * is a pointer to such a status block. NULL if not tracked.
+         */
+        void *shadow;
+#endif
 };
 
 /*
@@ -232,6 +240,8 @@ struct mm_struct {
 
         unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
 
+        s8 oom_adj;     /* OOM kill score adjustment (bit shift) */
+
         cpumask_t cpu_vm_mask;
 
         /* Architecture-specific MM context */
diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index ea1bf5ba092f..39751c8cde9c 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -25,5 +25,15 @@
 
 #define SDIO_VENDOR_ID_MARVELL                  0x02df
 #define SDIO_DEVICE_ID_MARVELL_LIBERTAS         0x9103
+#define SDIO_DEVICE_ID_MARVELL_8688WLAN         0x9104
+#define SDIO_DEVICE_ID_MARVELL_8688BT           0x9105
+
+#define SDIO_VENDOR_ID_SIANO                    0x039a
+#define SDIO_DEVICE_ID_SIANO_NOVA_B0            0x0201
+#define SDIO_DEVICE_ID_SIANO_NICE               0x0202
+#define SDIO_DEVICE_ID_SIANO_VEGA_A0            0x0300
+#define SDIO_DEVICE_ID_SIANO_VENICE             0x0301
+#define SDIO_DEVICE_ID_SIANO_NOVA_A0            0x1100
+#define SDIO_DEVICE_ID_SIANO_STELLAR            0x5347
 
 #endif
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index a47c879e1304..889598537370 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -50,9 +50,6 @@ extern int page_group_by_mobility_disabled;
 
 static inline int get_pageblock_migratetype(struct page *page)
 {
-        if (unlikely(page_group_by_mobility_disabled))
-                return MIGRATE_UNMOVABLE;
-
         return get_pageblock_flags_group(page, PB_migrate, PB_migrate_end);
 }
 
@@ -86,13 +83,8 @@ enum zone_stat_item {
         NR_ACTIVE_ANON,         /*  "     "     "   "       "         */
         NR_INACTIVE_FILE,       /*  "     "     "   "       "         */
         NR_ACTIVE_FILE,         /*  "     "     "   "       "         */
-#ifdef CONFIG_UNEVICTABLE_LRU
         NR_UNEVICTABLE,         /*  "     "     "   "       "         */
         NR_MLOCK,               /* mlock()ed pages found and moved off LRU */
-#else
-        NR_UNEVICTABLE = NR_ACTIVE_FILE, /* avoid compiler errors in dead code */
-        NR_MLOCK = NR_ACTIVE_FILE,
-#endif
         NR_ANON_PAGES,  /* Mapped anonymous pages */
         NR_FILE_MAPPED, /* pagecache pages mapped into pagetables.
                            only modified from process context */
@@ -135,11 +127,7 @@ enum lru_list {
         LRU_ACTIVE_ANON = LRU_BASE + LRU_ACTIVE,
         LRU_INACTIVE_FILE = LRU_BASE + LRU_FILE,
         LRU_ACTIVE_FILE = LRU_BASE + LRU_FILE + LRU_ACTIVE,
-#ifdef CONFIG_UNEVICTABLE_LRU
         LRU_UNEVICTABLE,
-#else
-        LRU_UNEVICTABLE = LRU_ACTIVE_FILE, /* avoid compiler errors in dead code */
-#endif
         NR_LRU_LISTS
 };
 
@@ -159,13 +147,20 @@ static inline int is_active_lru(enum lru_list l)
 
 static inline int is_unevictable_lru(enum lru_list l)
 {
-#ifdef CONFIG_UNEVICTABLE_LRU
         return (l == LRU_UNEVICTABLE);
-#else
-        return 0;
-#endif
 }
 
+enum zone_watermarks {
+        WMARK_MIN,
+        WMARK_LOW,
+        WMARK_HIGH,
+        NR_WMARK
+};
+
+#define min_wmark_pages(z) (z->watermark[WMARK_MIN])
+#define low_wmark_pages(z) (z->watermark[WMARK_LOW])
+#define high_wmark_pages(z) (z->watermark[WMARK_HIGH])
+
 struct per_cpu_pages {
         int count;              /* number of pages in the list */
         int high;               /* high watermark, emptying needed */
@@ -278,7 +273,10 @@ struct zone_reclaim_stat {
 
 struct zone {
         /* Fields commonly accessed by the page allocator */
-        unsigned long           pages_min, pages_low, pages_high;
+
+        /* zone watermarks, access with *_wmark_pages(zone) macros */
+        unsigned long watermark[NR_WMARK];
+
         /*
          * We don't know if the memory that we're going to allocate will be freeable
          * or/and it will be released eventually, so to avoid totally wasting several
@@ -323,9 +321,9 @@ struct zone {
 
         /* Fields commonly accessed by the page reclaim scanner */
         spinlock_t              lru_lock;       
-        struct {
+        struct zone_lru {
                 struct list_head list;
-                unsigned long nr_scan;
+                unsigned long nr_saved_scan;    /* accumulated for batching */
         } lru[NR_LRU_LISTS];
 
         struct zone_reclaim_stat reclaim_stat;
diff --git a/include/linux/module.h b/include/linux/module.h
index a7bc6e7b43a7..505f20dcc1c7 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -697,4 +697,21 @@ static inline void module_remove_modinfo_attrs(struct module *mod)
 
 #define __MODULE_STRING(x) __stringify(x)
 
+
+#ifdef CONFIG_GENERIC_BUG
+int  module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
+                         struct module *);
+void module_bug_cleanup(struct module *);
+
+#else   /* !CONFIG_GENERIC_BUG */
+
+static inline int  module_bug_finalize(const Elf_Ehdr *hdr,
+                                        const Elf_Shdr *sechdrs,
+                                        struct module *mod)
+{
+        return 0;
+}
+static inline void module_bug_cleanup(struct module *mod) {}
+#endif  /* CONFIG_GENERIC_BUG */
+
 #endif /* _LINUX_MODULE_H */
diff --git a/include/linux/net_dropmon.h b/include/linux/net_dropmon.h
index 0e2e100c44a2..3ceb0cc1bc78 100644
--- a/include/linux/net_dropmon.h
+++ b/include/linux/net_dropmon.h
@@ -3,12 +3,20 @@
 
 #include <linux/types.h>
 #include <linux/netlink.h>
+#include <linux/types.h>
 
 struct net_dm_drop_point {
         __u8 pc[8];
         __u32 count;
 };
 
+#define is_drop_point_hw(x) do {\
+        int ____i, ____j;\
+        for (____i = 0; ____i < 8; i ____i++)\
+                ____j |= x[____i];\
+        ____j;\
+} while (0)
+
 #define NET_DM_CFG_VERSION  0
 #define NET_DM_CFG_ALERT_COUNT  1
 #define NET_DM_CFG_ALERT_DELAY 2
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5a96a1a406e9..9ea8d6dfe540 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -39,9 +39,11 @@
 
 #include <linux/device.h>
 #include <linux/percpu.h>
+#include <linux/rculist.h>
 #include <linux/dmaengine.h>
 #include <linux/workqueue.h>
 
+#include <linux/ethtool.h>
 #include <net/net_namespace.h>
 #include <net/dsa.h>
 #ifdef CONFIG_DCB
@@ -49,7 +51,6 @@
 #endif
 
 struct vlan_group;
-struct ethtool_ops;
 struct netpoll_info;
 /* 802.11 specific */
 struct wireless_dev;
@@ -210,6 +211,19 @@ struct dev_addr_list
 #define dmi_users       da_users
 #define dmi_gusers      da_gusers
 
+struct netdev_hw_addr {
+        struct list_head        list;
+        unsigned char           addr[MAX_ADDR_LEN];
+        unsigned char           type;
+#define NETDEV_HW_ADDR_T_LAN            1
+#define NETDEV_HW_ADDR_T_SAN            2
+#define NETDEV_HW_ADDR_T_SLAVE          3
+#define NETDEV_HW_ADDR_T_UNICAST        4
+        int                     refcount;
+        bool                    synced;
+        struct rcu_head         rcu_head;
+};
+
 struct hh_cache
 {
         struct hh_cache *hh_next;       /* Next entry                        */
@@ -447,12 +461,25 @@ enum netdev_queue_state_t
 };
 
 struct netdev_queue {
+/*
+ * read mostly part
+ */
         struct net_device       *dev;
         struct Qdisc            *qdisc;
         unsigned long           state;
-        spinlock_t              _xmit_lock;
-        int                     xmit_lock_owner;
         struct Qdisc            *qdisc_sleeping;
+/*
+ * write mostly part
+ */
+        spinlock_t              _xmit_lock ____cacheline_aligned_in_smp;
+        int                     xmit_lock_owner;
+        /*
+         * please use this field instead of dev->trans_start
+         */
+        unsigned long           trans_start;
+        unsigned long           tx_bytes;
+        unsigned long           tx_packets;
+        unsigned long           tx_dropped;
 } ____cacheline_aligned_in_smp;
 
 
@@ -670,7 +697,9 @@ struct net_device
 #define NETIF_F_GRO             16384   /* Generic receive offload */
 #define NETIF_F_LRO             32768   /* large receive offload */
 
+/* the GSO_MASK reserves bits 16 through 23 */
 #define NETIF_F_FCOE_CRC        (1 << 24) /* FCoE CRC32 */
+#define NETIF_F_SCTP_CSUM       (1 << 25) /* SCTP checksum offload */
 
         /* Segmentation offload features */
 #define NETIF_F_GSO_SHIFT       16
@@ -747,10 +776,11 @@ struct net_device
         unsigned char           addr_len;       /* hardware address length      */
         unsigned short          dev_id;         /* for shared network cards */
 
-        spinlock_t              addr_list_lock;
-        struct dev_addr_list    *uc_list;       /* Secondary unicast mac addresses */
+        struct list_head        uc_list;        /* Secondary unicast mac
+                                                   addresses */
         int                     uc_count;       /* Number of installed ucasts   */
         int                     uc_promisc;
+        spinlock_t              addr_list_lock;
         struct dev_addr_list    *mc_list;       /* Multicast mac addresses      */
         int                     mc_count;       /* Number of installed mcasts   */
         unsigned int            promiscuity;
@@ -776,8 +806,11 @@ struct net_device
  */
         unsigned long           last_rx;        /* Time of last Rx      */
         /* Interface address info used in eth_type_trans() */
-        unsigned char           dev_addr[MAX_ADDR_LEN]; /* hw address, (before bcast
-                                                           because most packets are unicast) */
+        unsigned char           *dev_addr;      /* hw address, (before bcast
+                                                   because most packets are
+                                                   unicast) */
+
+        struct list_head        dev_addr_list; /* list of device hw addresses */
 
         unsigned char           broadcast[MAX_ADDR_LEN];        /* hw bcast add */
 
@@ -797,6 +830,11 @@ struct net_device
  * One part is mostly used on xmit path (device)
  */
         /* These may be needed for future network-power-down code. */
+
+        /*
+         * trans_start here is expensive for high speed devices on SMP,
+         * please use netdev_queue->trans_start instead.
+         */
         unsigned long           trans_start;    /* Time (in jiffies) of last Tx */
 
         int                     watchdog_timeo; /* used by dev_watchdog() */
@@ -867,49 +905,10 @@ struct net_device
         /* max exchange id for FCoE LRO by ddp */
         unsigned int            fcoe_ddp_xid;
 #endif
-
-#ifdef CONFIG_COMPAT_NET_DEV_OPS
-        struct {
-                int                     (*init)(struct net_device *dev);
-                void                    (*uninit)(struct net_device *dev);
-                int                     (*open)(struct net_device *dev);
-                int                     (*stop)(struct net_device *dev);
-                int                     (*hard_start_xmit) (struct sk_buff *skb,
-                                                            struct net_device *dev);
-                u16                     (*select_queue)(struct net_device *dev,
-                                                        struct sk_buff *skb);
-                void                    (*change_rx_flags)(struct net_device *dev,
-                                                           int flags);
-                void                    (*set_rx_mode)(struct net_device *dev);
-                void                    (*set_multicast_list)(struct net_device *dev);
-                int                     (*set_mac_address)(struct net_device *dev,
-                                                           void *addr);
-                int                     (*validate_addr)(struct net_device *dev);
-                int                     (*do_ioctl)(struct net_device *dev,
-                                                    struct ifreq *ifr, int cmd);
-                int                     (*set_config)(struct net_device *dev,
-                                                      struct ifmap *map);
-                int                     (*change_mtu)(struct net_device *dev, int new_mtu);
-                int                     (*neigh_setup)(struct net_device *dev,
-                                                       struct neigh_parms *);
-                void                    (*tx_timeout) (struct net_device *dev);
-                struct net_device_stats* (*get_stats)(struct net_device *dev);
-                void                    (*vlan_rx_register)(struct net_device *dev,
-                                                            struct vlan_group *grp);
-                void                    (*vlan_rx_add_vid)(struct net_device *dev,
-                                                           unsigned short vid);
-                void                    (*vlan_rx_kill_vid)(struct net_device *dev,
-                                                            unsigned short vid);
-#ifdef CONFIG_NET_POLL_CONTROLLER
-                void                    (*poll_controller)(struct net_device *dev);
-#endif
-        };
-#endif
 };
 #define to_net_dev(d) container_of(d, struct net_device, dev)
 
 #define NETDEV_ALIGN            32
-#define NETDEV_ALIGN_CONST      (NETDEV_ALIGN - 1)
 
 static inline
 struct netdev_queue *netdev_get_tx_queue(const struct net_device *dev,
@@ -980,9 +979,7 @@ static inline bool netdev_uses_trailer_tags(struct net_device *dev)
  */
 static inline void *netdev_priv(const struct net_device *dev)
 {
-        return (char *)dev + ((sizeof(struct net_device)
-                               + NETDEV_ALIGN_CONST)
-                              & ~NETDEV_ALIGN_CONST);
+        return (char *)dev + ALIGN(sizeof(struct net_device), NETDEV_ALIGN);
 }
 
 /* Set the sysfs physical device reference for the network logical device
@@ -1012,6 +1009,12 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi,
 void netif_napi_del(struct napi_struct *napi);
 
 struct napi_gro_cb {
+        /* Virtual address of skb_shinfo(skb)->frags[0].page + offset. */
+        void *frag0;
+
+        /* Length of frag0. */
+        unsigned int frag0_len;
+
         /* This indicates where we are processing relative to skb->data. */
         int data_offset;
 
@@ -1047,14 +1050,6 @@ struct packet_type {
         struct list_head        list;
 };
 
-struct napi_gro_fraginfo {
-        skb_frag_t frags[MAX_SKB_FRAGS];
-        unsigned int nr_frags;
-        unsigned int ip_summed;
-        unsigned int len;
-        __wsum csum;
-};
-
 #include <linux/interrupt.h>
 #include <linux/notifier.h>
 
@@ -1119,9 +1114,9 @@ extern int		dev_restart(struct net_device *dev);
 #ifdef CONFIG_NETPOLL_TRAP
 extern int              netpoll_trap(void);
 #endif
-extern void           *skb_gro_header(struct sk_buff *skb, unsigned int hlen);
 extern int             skb_gro_receive(struct sk_buff **head,
                                        struct sk_buff *skb);
+extern void            skb_gro_reset_offset(struct sk_buff *skb);
 
 static inline unsigned int skb_gro_offset(const struct sk_buff *skb)
 {
@@ -1138,16 +1133,34 @@ static inline void skb_gro_pull(struct sk_buff *skb, unsigned int len)
         NAPI_GRO_CB(skb)->data_offset += len;
 }
 
-static inline void skb_gro_reset_offset(struct sk_buff *skb)
+static inline void *skb_gro_header_fast(struct sk_buff *skb,
+                                        unsigned int offset)
 {
-        NAPI_GRO_CB(skb)->data_offset = 0;
+        return NAPI_GRO_CB(skb)->frag0 + offset;
+}
+
+static inline int skb_gro_header_hard(struct sk_buff *skb, unsigned int hlen)
+{
+        return NAPI_GRO_CB(skb)->frag0_len < hlen;
+}
+
+static inline void *skb_gro_header_slow(struct sk_buff *skb, unsigned int hlen,
+                                        unsigned int offset)
+{
+        NAPI_GRO_CB(skb)->frag0 = NULL;
+        NAPI_GRO_CB(skb)->frag0_len = 0;
+        return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
 }
 
 static inline void *skb_gro_mac_header(struct sk_buff *skb)
 {
-        return skb_mac_header(skb) < skb->data ? skb_mac_header(skb) :
-               page_address(skb_shinfo(skb)->frags[0].page) +
-               skb_shinfo(skb)->frags[0].page_offset;
+        return NAPI_GRO_CB(skb)->frag0 ?: skb_mac_header(skb);
+}
+
+static inline void *skb_gro_network_header(struct sk_buff *skb)
+{
+        return (NAPI_GRO_CB(skb)->frag0 ?: skb->data) +
+               skb_network_offset(skb);
 }
 
 static inline int dev_hard_header(struct sk_buff *skb, struct net_device *dev,
@@ -1442,12 +1455,18 @@ extern int		napi_gro_receive(struct napi_struct *napi,
                                          struct sk_buff *skb);
 extern void             napi_reuse_skb(struct napi_struct *napi,
                                        struct sk_buff *skb);
-extern struct sk_buff * napi_fraginfo_skb(struct napi_struct *napi,
-                                          struct napi_gro_fraginfo *info);
+extern struct sk_buff * napi_get_frags(struct napi_struct *napi);
 extern int              napi_frags_finish(struct napi_struct *napi,
                                           struct sk_buff *skb, int ret);
-extern int              napi_gro_frags(struct napi_struct *napi,
-                                       struct napi_gro_fraginfo *info);
+extern struct sk_buff * napi_frags_skb(struct napi_struct *napi);
+extern int              napi_gro_frags(struct napi_struct *napi);
+
+static inline void napi_free_frags(struct napi_struct *napi)
+{
+        kfree_skb(napi->skb);
+        napi->skb = NULL;
+}
+
 extern void             netif_nit_deliver(struct sk_buff *skb);
 extern int              dev_valid_name(const char *name);
 extern int              dev_ioctl(struct net *net, unsigned int cmd, void __user *);
@@ -1514,6 +1533,8 @@ static inline int netif_carrier_ok(const struct net_device *dev)
         return !test_bit(__LINK_STATE_NOCARRIER, &dev->state);
 }
 
+extern unsigned long dev_trans_start(struct net_device *dev);
+
 extern void __netdev_watchdog_up(struct net_device *dev);
 
 extern void netif_carrier_on(struct net_device *dev);
@@ -1671,6 +1692,12 @@ static inline void __netif_tx_unlock_bh(struct netdev_queue *txq)
         spin_unlock_bh(&txq->_xmit_lock);
 }
 
+static inline void txq_trans_update(struct netdev_queue *txq)
+{
+        if (txq->xmit_lock_owner != -1)
+                txq->trans_start = jiffies;
+}
+
 /**
  *      netif_tx_lock - grab network device transmit lock
  *      @dev: network device
@@ -1778,6 +1805,13 @@ static inline void netif_addr_unlock_bh(struct net_device *dev)
         spin_unlock_bh(&dev->addr_list_lock);
 }
 
+/*
+ * dev_addr_list walker. Should be used only for read access. Call with
+ * rcu_read_lock held.
+ */
+#define for_each_dev_addr(dev, ha) \
+                list_for_each_entry_rcu(ha, &dev->dev_addr_list, list)
+
 /* These functions live elsewhere (drivers/net/net_init.c, but related) */
 
 extern void             ether_setup(struct net_device *dev);
@@ -1790,11 +1824,24 @@ extern struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
         alloc_netdev_mq(sizeof_priv, name, setup, 1)
 extern int              register_netdev(struct net_device *dev);
 extern void             unregister_netdev(struct net_device *dev);
+
+/* Functions used for device addresses handling */
+extern int dev_addr_add(struct net_device *dev, unsigned char *addr,
+                        unsigned char addr_type);
+extern int dev_addr_del(struct net_device *dev, unsigned char *addr,
+                        unsigned char addr_type);
+extern int dev_addr_add_multiple(struct net_device *to_dev,
+                                 struct net_device *from_dev,
+                                 unsigned char addr_type);
+extern int dev_addr_del_multiple(struct net_device *to_dev,
+                                 struct net_device *from_dev,
+                                 unsigned char addr_type);
+
 /* Functions used for secondary unicast and multicast support */
 extern void             dev_set_rx_mode(struct net_device *dev);
 extern void             __dev_set_rx_mode(struct net_device *dev);
-extern int              dev_unicast_delete(struct net_device *dev, void *addr, int alen);
-extern int              dev_unicast_add(struct net_device *dev, void *addr, int alen);
+extern int              dev_unicast_delete(struct net_device *dev, void *addr);
+extern int              dev_unicast_add(struct net_device *dev, void *addr);
 extern int              dev_unicast_sync(struct net_device *to, struct net_device *from);
 extern void             dev_unicast_unsync(struct net_device *to, struct net_device *from);
 extern int              dev_mc_delete(struct net_device *dev, void *addr, int alen, int all);
@@ -1856,15 +1903,14 @@ static inline int net_gso_ok(int features, int gso_type)
 
 static inline int skb_gso_ok(struct sk_buff *skb, int features)
 {
-        return net_gso_ok(features, skb_shinfo(skb)->gso_type);
+        return net_gso_ok(features, skb_shinfo(skb)->gso_type) &&
+               (!skb_has_frags(skb) || (features & NETIF_F_FRAGLIST));
 }
 
 static inline int netif_needs_gso(struct net_device *dev, struct sk_buff *skb)
 {
         return skb_is_gso(skb) &&
                (!skb_gso_ok(skb, dev->features) ||
-                (skb_shinfo(skb)->frag_list &&
-                 !(dev->features & NETIF_F_FRAGLIST)) ||
                 unlikely(skb->ip_summed != CHECKSUM_PARTIAL));
 }
 
@@ -1874,6 +1920,16 @@ static inline void netif_set_gso_max_size(struct net_device *dev,
         dev->gso_max_size = size;
 }
 
+static inline void skb_bond_set_mac_by_master(struct sk_buff *skb,
+                                              struct net_device *master)
+{
+        if (skb->pkt_type == PACKET_HOST) {
+                u16 *dest = (u16 *) eth_hdr(skb)->h_dest;
+
+                memcpy(dest, master->dev_addr, ETH_ALEN);
+        }
+}
+
 /* On bonding slaves other than the currently active slave, suppress
  * duplicates except for 802.3ad ETH_P_SLOW, alb non-mcast/bcast, and
  * ARP on active-backup slaves with arp_validate enabled.
@@ -1887,6 +1943,14 @@ static inline int skb_bond_should_drop(struct sk_buff *skb)
                 if (master->priv_flags & IFF_MASTER_ARPMON)
                         dev->last_rx = jiffies;
 
+                if ((master->priv_flags & IFF_MASTER_ALB) && master->br_port) {
+                        /* Do address unmangle. The local destination address
+                         * will be always the one master has. Provides the right
+                         * functionality in a bridge.
+                         */
+                        skb_bond_set_mac_by_master(skb, master);
+                }
+
                 if (dev->priv_flags & IFF_SLAVE_INACTIVE) {
                         if ((dev->priv_flags & IFF_SLAVE_NEEDARP) &&
                             skb->protocol == __cpu_to_be16(ETH_P_ARP))
@@ -1908,6 +1972,28 @@ static inline int skb_bond_should_drop(struct sk_buff *skb)
 }
 
 extern struct pernet_operations __net_initdata loopback_net_ops;
+
+static inline int dev_ethtool_get_settings(struct net_device *dev,
+                                           struct ethtool_cmd *cmd)
+{
+        if (!dev->ethtool_ops || !dev->ethtool_ops->get_settings)
+                return -EOPNOTSUPP;
+        return dev->ethtool_ops->get_settings(dev, cmd);
+}
+
+static inline u32 dev_ethtool_get_rx_csum(struct net_device *dev)
+{
+        if (!dev->ethtool_ops || !dev->ethtool_ops->get_rx_csum)
+                return 0;
+        return dev->ethtool_ops->get_rx_csum(dev);
+}
+
+static inline u32 dev_ethtool_get_flags(struct net_device *dev)
+{
+        if (!dev->ethtool_ops || !dev->ethtool_ops->get_flags)
+                return 0;
+        return dev->ethtool_ops->get_flags(dev);
+}
 #endif /* __KERNEL__ */
 
-#endif  /* _LINUX_DEV_H */
+#endif  /* _LINUX_NETDEVICE_H */
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index af9d2fb97212..2aea50399c0b 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -33,6 +33,7 @@ header-y += xt_limit.h
 header-y += xt_mac.h
 header-y += xt_mark.h
 header-y += xt_multiport.h
+header-y += xt_osf.h
 header-y += xt_owner.h
 header-y += xt_pkttype.h
 header-y += xt_quota.h
diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h
index 885cbe282260..a8248ee422b7 100644
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -75,75 +75,6 @@ enum ip_conntrack_status {
         IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
 };
 
-/* Connection tracking event bits */
-enum ip_conntrack_events
-{
-        /* New conntrack */
-        IPCT_NEW_BIT = 0,
-        IPCT_NEW = (1 << IPCT_NEW_BIT),
-
-        /* Expected connection */
-        IPCT_RELATED_BIT = 1,
-        IPCT_RELATED = (1 << IPCT_RELATED_BIT),
-
-        /* Destroyed conntrack */
-        IPCT_DESTROY_BIT = 2,
-        IPCT_DESTROY = (1 << IPCT_DESTROY_BIT),
-
-        /* Timer has been refreshed */
-        IPCT_REFRESH_BIT = 3,
-        IPCT_REFRESH = (1 << IPCT_REFRESH_BIT),
-
-        /* Status has changed */
-        IPCT_STATUS_BIT = 4,
-        IPCT_STATUS = (1 << IPCT_STATUS_BIT),
-
-        /* Update of protocol info */
-        IPCT_PROTOINFO_BIT = 5,
-        IPCT_PROTOINFO = (1 << IPCT_PROTOINFO_BIT),
-
-        /* Volatile protocol info */
-        IPCT_PROTOINFO_VOLATILE_BIT = 6,
-        IPCT_PROTOINFO_VOLATILE = (1 << IPCT_PROTOINFO_VOLATILE_BIT),
-
-        /* New helper for conntrack */
-        IPCT_HELPER_BIT = 7,
-        IPCT_HELPER = (1 << IPCT_HELPER_BIT),
-
-        /* Update of helper info */
-        IPCT_HELPINFO_BIT = 8,
-        IPCT_HELPINFO = (1 << IPCT_HELPINFO_BIT),
-
-        /* Volatile helper info */
-        IPCT_HELPINFO_VOLATILE_BIT = 9,
-        IPCT_HELPINFO_VOLATILE = (1 << IPCT_HELPINFO_VOLATILE_BIT),
-
-        /* NAT info */
-        IPCT_NATINFO_BIT = 10,
-        IPCT_NATINFO = (1 << IPCT_NATINFO_BIT),
-
-        /* Counter highest bit has been set, unused */
-        IPCT_COUNTER_FILLING_BIT = 11,
-        IPCT_COUNTER_FILLING = (1 << IPCT_COUNTER_FILLING_BIT),
-
-        /* Mark is set */
-        IPCT_MARK_BIT = 12,
-        IPCT_MARK = (1 << IPCT_MARK_BIT),
-
-        /* NAT sequence adjustment */
-        IPCT_NATSEQADJ_BIT = 13,
-        IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT),
-
-        /* Secmark is set */
-        IPCT_SECMARK_BIT = 14,
-        IPCT_SECMARK = (1 << IPCT_SECMARK_BIT),
-};
-
-enum ip_conntrack_expect_events {
-        IPEXP_NEW_BIT = 0,
-        IPEXP_NEW = (1 << IPEXP_NEW_BIT),
-};
-
 #ifdef __KERNEL__
 struct ip_conntrack_stat
 {
diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h
index b2f384d42611..4352feed2377 100644
--- a/include/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/linux/netfilter/nf_conntrack_tcp.h
@@ -15,7 +15,8 @@ enum tcp_conntrack {
         TCP_CONNTRACK_LAST_ACK,
         TCP_CONNTRACK_TIME_WAIT,
         TCP_CONNTRACK_CLOSE,
-        TCP_CONNTRACK_LISTEN,
+        TCP_CONNTRACK_LISTEN,   /* obsolete */
+#define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
         TCP_CONNTRACK_MAX,
         TCP_CONNTRACK_IGNORE
 };
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index c600083cbdf5..bff4d5741d98 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -46,7 +46,8 @@ struct nfgenmsg {
 #define NFNL_SUBSYS_CTNETLINK_EXP       2
 #define NFNL_SUBSYS_QUEUE               3
 #define NFNL_SUBSYS_ULOG                4
-#define NFNL_SUBSYS_COUNT               5
+#define NFNL_SUBSYS_OSF                 5
+#define NFNL_SUBSYS_COUNT               6
 
 #ifdef __KERNEL__
 
@@ -75,7 +76,7 @@ extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
 
 extern int nfnetlink_has_listeners(unsigned int group);
 extern int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, 
-                          int echo);
+                          int echo, gfp_t flags);
 extern void nfnetlink_set_err(u32 pid, u32 group, int error);
 extern int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags);
 
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h
index 1a865e48b8eb..ed4ef8d0b11b 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -101,6 +101,7 @@ enum ctattr_protoinfo_dccp {
         CTA_PROTOINFO_DCCP_UNSPEC,
         CTA_PROTOINFO_DCCP_STATE,
         CTA_PROTOINFO_DCCP_ROLE,
+        CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ,
         __CTA_PROTOINFO_DCCP_MAX,
 };
 #define CTA_PROTOINFO_DCCP_MAX (__CTA_PROTOINFO_DCCP_MAX - 1)
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index c9efe039dc57..1030b7593898 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -184,9 +184,10 @@ struct xt_counters_info
  * @matchinfo:  per-match data
  * @fragoff:    packet is a fragment, this is the data offset
  * @thoff:      position of transport header relative to skb->data
- * @hotdrop:    drop packet if we had inspection problems
+ * @hook:       hook number given packet came from
  * @family:     Actual NFPROTO_* through which the function is invoked
  *              (helpful when match->family == NFPROTO_UNSPEC)
+ * @hotdrop:    drop packet if we had inspection problems
  */
 struct xt_match_param {
         const struct net_device *in, *out;
@@ -194,8 +195,9 @@ struct xt_match_param {
         const void *matchinfo;
         int fragoff;
         unsigned int thoff;
-        bool *hotdrop;
+        unsigned int hooknum;
         u_int8_t family;
+        bool *hotdrop;
 };
 
 /**
diff --git a/include/linux/netfilter/xt_NFQUEUE.h b/include/linux/netfilter/xt_NFQUEUE.h
index 982a89f78272..2584f4a777de 100644
--- a/include/linux/netfilter/xt_NFQUEUE.h
+++ b/include/linux/netfilter/xt_NFQUEUE.h
@@ -15,4 +15,9 @@ struct xt_NFQ_info {
         __u16 queuenum;
 };
 
+struct xt_NFQ_info_v1 {
+        __u16 queuenum;
+        __u16 queues_total;
+};
+
 #endif /* _XT_NFQ_TARGET_H */
diff --git a/include/linux/netfilter/xt_osf.h b/include/linux/netfilter/xt_osf.h
new file mode 100644
index 000000000000..fd2272e0959a
--- /dev/null
+++ b/include/linux/netfilter/xt_osf.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (c) 2003+ Evgeniy Polyakov <johnpol@2ka.mxt.ru>
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _XT_OSF_H
+#define _XT_OSF_H
+
+#define MAXGENRELEN             32
+
+#define XT_OSF_GENRE            (1<<0)
+#define XT_OSF_TTL              (1<<1)
+#define XT_OSF_LOG              (1<<2)
+#define XT_OSF_INVERT           (1<<3)
+
+#define XT_OSF_LOGLEVEL_ALL     0       /* log all matched fingerprints */
+#define XT_OSF_LOGLEVEL_FIRST   1       /* log only the first matced fingerprint */
+#define XT_OSF_LOGLEVEL_ALL_KNOWN       2 /* do not log unknown packets */
+
+#define XT_OSF_TTL_TRUE         0       /* True ip and fingerprint TTL comparison */
+#define XT_OSF_TTL_LESS         1       /* Check if ip TTL is less than fingerprint one */
+#define XT_OSF_TTL_NOCHECK      2       /* Do not compare ip and fingerprint TTL at all */
+
+struct xt_osf_info {
+        char                    genre[MAXGENRELEN];
+        __u32                   len;
+        __u32                   flags;
+        __u32                   loglevel;
+        __u32                   ttl;
+};
+
+/*
+ * Wildcard MSS (kind of).
+ * It is used to implement a state machine for the different wildcard values
+ * of the MSS and window sizes.
+ */
+struct xt_osf_wc {
+        __u32                   wc;
+        __u32                   val;
+};
+
+/*
+ * This struct represents IANA options
+ * http://www.iana.org/assignments/tcp-parameters
+ */
+struct xt_osf_opt {
+        __u16                   kind, length;
+        struct xt_osf_wc        wc;
+};
+
+struct xt_osf_user_finger {
+        struct xt_osf_wc        wss;
+
+        __u8                    ttl, df;
+        __u16                   ss, mss;
+        __u16                   opt_num;
+
+        char                    genre[MAXGENRELEN];
+        char                    version[MAXGENRELEN];
+        char                    subtype[MAXGENRELEN];
+
+        /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
+        struct xt_osf_opt       opt[MAX_IPOPTLEN];
+};
+
+struct xt_osf_nlmsg {
+        struct xt_osf_user_finger       f;
+        struct iphdr            ip;
+        struct tcphdr           tcp;
+};
+
+/* Defines for IANA option kinds */
+
+enum iana_options {
+        OSFOPT_EOL = 0,         /* End of options */
+        OSFOPT_NOP,             /* NOP */
+        OSFOPT_MSS,             /* Maximum segment size */
+        OSFOPT_WSO,             /* Window scale option */
+        OSFOPT_SACKP,           /* SACK permitted */
+        OSFOPT_SACK,            /* SACK */
+        OSFOPT_ECHO,
+        OSFOPT_ECHOREPLY,
+        OSFOPT_TS,              /* Timestamp option */
+        OSFOPT_POCP,            /* Partial Order Connection Permitted */
+        OSFOPT_POSP,            /* Partial Order Service Profile */
+
+        /* Others are not used in the current OSF */
+        OSFOPT_EMPTY = 255,
+};
+
+/*
+ * Initial window size option state machine: multiple of mss, mtu or
+ * plain numeric value. Can also be made as plain numeric value which
+ * is not a multiple of specified value.
+ */
+enum xt_osf_window_size_options {
+        OSF_WSS_PLAIN   = 0,
+        OSF_WSS_MSS,
+        OSF_WSS_MTU,
+        OSF_WSS_MODULO,
+        OSF_WSS_MAX,
+};
+
+/*
+ * Add/remove fingerprint from the kernel.
+ */
+enum xt_osf_msg_types {
+        OSF_MSG_ADD,
+        OSF_MSG_REMOVE,
+        OSF_MSG_MAX,
+};
+
+enum xt_osf_attr_type {
+        OSF_ATTR_UNSPEC,
+        OSF_ATTR_FINGER,
+        OSF_ATTR_MAX,
+};
+
+#endif                          /* _XT_OSF_H */
diff --git a/include/linux/netfilter/xt_socket.h b/include/linux/netfilter/xt_socket.h
new file mode 100644
index 000000000000..6f475b8ff34b
--- /dev/null
+++ b/include/linux/netfilter/xt_socket.h
@@ -0,0 +1,12 @@
+#ifndef _XT_SOCKET_H
+#define _XT_SOCKET_H
+
+enum {
+        XT_SOCKET_TRANSPARENT = 1 << 0,
+};
+
+struct xt_socket_mtinfo1 {
+        __u8 flags;
+};
+
+#endif /* _XT_SOCKET_H */
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index cbe8ce3bf486..dbea93b694e5 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -7,7 +7,7 @@
  * Copyright 2008 Michael Wu <flamingice@sourmilk.net>
  * Copyright 2008 Luis Carlos Cobo <luisca@cozybit.com>
  * Copyright 2008 Michael Buesch <mb@bu3sch.de>
- * Copyright 2008 Luis R. Rodriguez <lrodriguez@atheros.com>
+ * Copyright 2008, 2009 Luis R. Rodriguez <lrodriguez@atheros.com>
  * Copyright 2008 Jouni Malinen <jouni.malinen@atheros.com>
  * Copyright 2008 Colin McCabe <colin@cozybit.com>
  *
@@ -25,6 +25,8 @@
  *
  */
 
+#include <linux/types.h>
+
 /**
  * DOC: Station handling
  *
@@ -46,8 +48,10 @@
  *      to get a list of all present wiphys.
  * @NL80211_CMD_SET_WIPHY: set wiphy parameters, needs %NL80211_ATTR_WIPHY or
  *      %NL80211_ATTR_IFINDEX; can be used to set %NL80211_ATTR_WIPHY_NAME,
- *      %NL80211_ATTR_WIPHY_TXQ_PARAMS, %NL80211_ATTR_WIPHY_FREQ, and/or
- *      %NL80211_ATTR_WIPHY_CHANNEL_TYPE.
+ *      %NL80211_ATTR_WIPHY_TXQ_PARAMS, %NL80211_ATTR_WIPHY_FREQ,
+ *      %NL80211_ATTR_WIPHY_CHANNEL_TYPE, %NL80211_ATTR_WIPHY_RETRY_SHORT,
+ *      %NL80211_ATTR_WIPHY_RETRY_LONG, %NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
+ *      and/or %NL80211_ATTR_WIPHY_RTS_THRESHOLD.
  * @NL80211_CMD_NEW_WIPHY: Newly created wiphy, response to get request
  *      or rename notification. Has attributes %NL80211_ATTR_WIPHY and
  *      %NL80211_ATTR_WIPHY_NAME.
@@ -75,8 +79,8 @@
  * @NL80211_CMD_SET_KEY: Set key attributes %NL80211_ATTR_KEY_DEFAULT,
  *      %NL80211_ATTR_KEY_DEFAULT_MGMT, or %NL80211_ATTR_KEY_THRESHOLD.
  * @NL80211_CMD_NEW_KEY: add a key with given %NL80211_ATTR_KEY_DATA,
- *      %NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC and %NL80211_ATTR_KEY_CIPHER
- *      attributes.
+ *      %NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC, %NL80211_ATTR_KEY_CIPHER,
+ *      and %NL80211_ATTR_KEY_SEQ attributes.
  * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
  *      or %NL80211_ATTR_MAC.
  *
@@ -166,6 +170,22 @@
  *      set (%NL80211_ATTR_REG_TYPE), if the type of regulatory domain is
  *      %NL80211_REG_TYPE_COUNTRY the alpha2 to which we have moved on
  *      to (%NL80211_ATTR_REG_ALPHA2).
+ * @NL80211_CMD_REG_BEACON_HINT: indicates to userspace that an AP beacon
+ *      has been found while world roaming thus enabling active scan or
+ *      any mode of operation that initiates TX (beacons) on a channel
+ *      where we would not have been able to do either before. As an example
+ *      if you are world roaming (regulatory domain set to world or if your
+ *      driver is using a custom world roaming regulatory domain) and while
+ *      doing a passive scan on the 5 GHz band you find an AP there (if not
+ *      on a DFS channel) you will now be able to actively scan for that AP
+ *      or use AP mode on your card on that same channel. Note that this will
+ *      never be used for channels 1-11 on the 2 GHz band as they are always
+ *      enabled world wide. This beacon hint is only sent if your device had
+ *      either disabled active scanning or beaconing on a channel. We send to
+ *      userspace the wiphy on which we removed a restriction from
+ *      (%NL80211_ATTR_WIPHY) and the channel on which this occurred
+ *      before (%NL80211_ATTR_FREQ_BEFORE) and after (%NL80211_ATTR_FREQ_AFTER)
+ *      the beacon hint was processed.
  *
  * @NL80211_CMD_AUTHENTICATE: authentication request and notification.
  *      This command is used both as a command (request to authenticate) and
@@ -185,8 +205,12 @@
  *      frame, i.e., it was for the local STA and was received in correct
  *      state. This is similar to MLME-AUTHENTICATE.confirm primitive in the
  *      MLME SAP interface (kernel providing MLME, userspace SME). The
- *      included NL80211_ATTR_FRAME attribute contains the management frame
- *      (including both the header and frame body, but not FCS).
+ *      included %NL80211_ATTR_FRAME attribute contains the management frame
+ *      (including both the header and frame body, but not FCS). This event is
+ *      also used to indicate if the authentication attempt timed out. In that
+ *      case the %NL80211_ATTR_FRAME attribute is replaced with a
+ *      %NL80211_ATTR_TIMED_OUT flag (and %NL80211_ATTR_MAC to indicate which
+ *      pending authentication timed out).
  * @NL80211_CMD_ASSOCIATE: association request and notification; like
  *      NL80211_CMD_AUTHENTICATE but for Association and Reassociation
  *      (similar to MLME-ASSOCIATE.request, MLME-REASSOCIATE.request,
@@ -199,6 +223,25 @@
  *      NL80211_CMD_AUTHENTICATE but for Disassociation frames (similar to
  *      MLME-DISASSOCIATE.request and MLME-DISASSOCIATE.indication primitives).
  *
+ * @NL80211_CMD_MICHAEL_MIC_FAILURE: notification of a locally detected Michael
+ *      MIC (part of TKIP) failure; sent on the "mlme" multicast group; the
+ *      event includes %NL80211_ATTR_MAC to describe the source MAC address of
+ *      the frame with invalid MIC, %NL80211_ATTR_KEY_TYPE to show the key
+ *      type, %NL80211_ATTR_KEY_IDX to indicate the key identifier, and
+ *      %NL80211_ATTR_KEY_SEQ to indicate the TSC value of the frame; this
+ *      event matches with MLME-MICHAELMICFAILURE.indication() primitive
+ *
+ * @NL80211_CMD_JOIN_IBSS: Join a new IBSS -- given at least an SSID and a
+ *      FREQ attribute (for the initial frequency if no peer can be found)
+ *      and optionally a MAC (as BSSID) and FREQ_FIXED attribute if those
+ *      should be fixed rather than automatically determined. Can only be
+ *      executed on a network interface that is UP, and fixed BSSID/FREQ
+ *      may be rejected. Another optional parameter is the beacon interval,
+ *      given in the %NL80211_ATTR_BEACON_INTERVAL attribute, which if not
+ *      given defaults to 100 TU (102.4ms).
+ * @NL80211_CMD_LEAVE_IBSS: Leave the IBSS -- no special arguments, the IBSS is
+ *      determined by the network interface.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -260,6 +303,13 @@ enum nl80211_commands {
         NL80211_CMD_DEAUTHENTICATE,
         NL80211_CMD_DISASSOCIATE,
 
+        NL80211_CMD_MICHAEL_MIC_FAILURE,
+
+        NL80211_CMD_REG_BEACON_HINT,
+
+        NL80211_CMD_JOIN_IBSS,
+        NL80211_CMD_LEAVE_IBSS,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -278,6 +328,7 @@ enum nl80211_commands {
 #define NL80211_CMD_ASSOCIATE NL80211_CMD_ASSOCIATE
 #define NL80211_CMD_DEAUTHENTICATE NL80211_CMD_DEAUTHENTICATE
 #define NL80211_CMD_DISASSOCIATE NL80211_CMD_DISASSOCIATE
+#define NL80211_CMD_REG_BEACON_HINT NL80211_CMD_REG_BEACON_HINT
 
 /**
  * enum nl80211_attrs - nl80211 netlink attributes
@@ -296,6 +347,18 @@ enum nl80211_commands {
  *      NL80211_CHAN_HT20 = HT20 only
  *      NL80211_CHAN_HT40MINUS = secondary channel is below the primary channel
  *      NL80211_CHAN_HT40PLUS = secondary channel is above the primary channel
+ * @NL80211_ATTR_WIPHY_RETRY_SHORT: TX retry limit for frames whose length is
+ *      less than or equal to the RTS threshold; allowed range: 1..255;
+ *      dot11ShortRetryLimit; u8
+ * @NL80211_ATTR_WIPHY_RETRY_LONG: TX retry limit for frames whose length is
+ *      greater than the RTS threshold; allowed range: 1..255;
+ *      dot11ShortLongLimit; u8
+ * @NL80211_ATTR_WIPHY_FRAG_THRESHOLD: fragmentation threshold, i.e., maximum
+ *      length in octets for frames; allowed range: 256..8000, disable
+ *      fragmentation with (u32)-1; dot11FragmentationThreshold; u32
+ * @NL80211_ATTR_WIPHY_RTS_THRESHOLD: RTS threshold (TX frames with length
+ *      larger than or equal to this use RTS/CTS handshake); allowed range:
+ *      0..65536, disable with (u32)-1; dot11RTSThreshold; u32
  *
  * @NL80211_ATTR_IFINDEX: network interface index of the device to operate on
  * @NL80211_ATTR_IFNAME: network interface name
@@ -319,7 +382,7 @@ enum nl80211_commands {
  *
  * @NL80211_ATTR_STA_AID: Association ID for the station (u16)
  * @NL80211_ATTR_STA_FLAGS: flags, nested element with NLA_FLAG attributes of
- *      &enum nl80211_sta_flags.
+ *      &enum nl80211_sta_flags (deprecated, use %NL80211_ATTR_STA_FLAGS2)
  * @NL80211_ATTR_STA_LISTEN_INTERVAL: listen interval as defined by
  *      IEEE 802.11 7.3.1.6 (u16).
  * @NL80211_ATTR_STA_SUPPORTED_RATES: supported rates, array of supported
@@ -380,6 +443,8 @@ enum nl80211_commands {
  *
  * @NL80211_ATTR_MAX_NUM_SCAN_SSIDS: number of SSIDs you can scan with
  *      a single scan request, a wiphy attribute.
+ * @NL80211_ATTR_MAX_SCAN_IE_LEN: maximum length of information elements
+ *      that can be added to a scan request
  *
  * @NL80211_ATTR_SCAN_FREQUENCIES: nested attribute with frequencies (in MHz)
  * @NL80211_ATTR_SCAN_SSIDS: nested attribute with SSIDs, leave out for passive
@@ -408,6 +473,44 @@ enum nl80211_commands {
  * @NL80211_ATTR_REASON_CODE: ReasonCode for %NL80211_CMD_DEAUTHENTICATE and
  *      %NL80211_CMD_DISASSOCIATE, u16
  *
+ * @NL80211_ATTR_KEY_TYPE: Key Type, see &enum nl80211_key_type, represented as
+ *      a u32
+ *
+ * @NL80211_ATTR_FREQ_BEFORE: A channel which has suffered a regulatory change
+ *      due to considerations from a beacon hint. This attribute reflects
+ *      the state of the channel _before_ the beacon hint processing. This
+ *      attributes consists of a nested attribute containing
+ *      NL80211_FREQUENCY_ATTR_*
+ * @NL80211_ATTR_FREQ_AFTER: A channel which has suffered a regulatory change
+ *      due to considerations from a beacon hint. This attribute reflects
+ *      the state of the channel _after_ the beacon hint processing. This
+ *      attributes consists of a nested attribute containing
+ *      NL80211_FREQUENCY_ATTR_*
+ *
+ * @NL80211_ATTR_CIPHER_SUITES: a set of u32 values indicating the supported
+ *      cipher suites
+ *
+ * @NL80211_ATTR_FREQ_FIXED: a flag indicating the IBSS should not try to look
+ *      for other networks on different channels
+ *
+ * @NL80211_ATTR_TIMED_OUT: a flag indicating than an operation timed out; this
+ *      is used, e.g., with %NL80211_CMD_AUTHENTICATE event
+ *
+ * @NL80211_ATTR_USE_MFP: Whether management frame protection (IEEE 802.11w) is
+ *      used for the association (&enum nl80211_mfp, represented as a u32);
+ *      this attribute can be used
+ *      with %NL80211_CMD_ASSOCIATE request
+ *
+ * @NL80211_ATTR_STA_FLAGS2: Attribute containing a
+ *      &struct nl80211_sta_flag_update.
+ *
+ * @NL80211_ATTR_CONTROL_PORT: A flag indicating whether user space controls
+ *      IEEE 802.1X port, i.e., sets/clears %NL80211_STA_FLAG_AUTHORIZED, in
+ *      station mode. If the flag is included in %NL80211_CMD_ASSOCIATE
+ *      request, the driver will assume that the port is unauthorized until
+ *      authorized by user space. Otherwise, port is marked authorized by
+ *      default in station mode.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -492,6 +595,30 @@ enum nl80211_attrs {
         NL80211_ATTR_AUTH_TYPE,
         NL80211_ATTR_REASON_CODE,
 
+        NL80211_ATTR_KEY_TYPE,
+
+        NL80211_ATTR_MAX_SCAN_IE_LEN,
+        NL80211_ATTR_CIPHER_SUITES,
+
+        NL80211_ATTR_FREQ_BEFORE,
+        NL80211_ATTR_FREQ_AFTER,
+
+        NL80211_ATTR_FREQ_FIXED,
+
+
+        NL80211_ATTR_WIPHY_RETRY_SHORT,
+        NL80211_ATTR_WIPHY_RETRY_LONG,
+        NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
+        NL80211_ATTR_WIPHY_RTS_THRESHOLD,
+
+        NL80211_ATTR_TIMED_OUT,
+
+        NL80211_ATTR_USE_MFP,
+
+        NL80211_ATTR_STA_FLAGS2,
+
+        NL80211_ATTR_CONTROL_PORT,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -581,6 +708,18 @@ enum nl80211_sta_flags {
 };
 
 /**
+ * struct nl80211_sta_flag_update - station flags mask/set
+ * @mask: mask of station flags to set
+ * @set: which values to set them to
+ *
+ * Both mask and set contain bits as per &enum nl80211_sta_flags.
+ */
+struct nl80211_sta_flag_update {
+        __u32 mask;
+        __u32 set;
+} __attribute__((packed));
+
+/**
  * enum nl80211_rate_info - bitrate information
  *
  * These attribute types are used with %NL80211_STA_INFO_TXRATE
@@ -1062,4 +1201,27 @@ enum nl80211_auth_type {
         NL80211_AUTHTYPE_FT,
         NL80211_AUTHTYPE_NETWORK_EAP,
 };
+
+/**
+ * enum nl80211_key_type - Key Type
+ * @NL80211_KEYTYPE_GROUP: Group (broadcast/multicast) key
+ * @NL80211_KEYTYPE_PAIRWISE: Pairwise (unicast/individual) key
+ * @NL80211_KEYTYPE_PEERKEY: PeerKey (DLS)
+ */
+enum nl80211_key_type {
+        NL80211_KEYTYPE_GROUP,
+        NL80211_KEYTYPE_PAIRWISE,
+        NL80211_KEYTYPE_PEERKEY,
+};
+
+/**
+ * enum nl80211_mfp - Management frame protection state
+ * @NL80211_MFP_NO: Management frame protection not used
+ * @NL80211_MFP_REQUIRED: Management frame protection required
+ */
+enum nl80211_mfp {
+        NL80211_MFP_NO,
+        NL80211_MFP_REQUIRED,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/nl802154.h b/include/linux/nl802154.h
new file mode 100644
index 000000000000..2cda00ccfcca
--- /dev/null
+++ b/include/linux/nl802154.h
@@ -0,0 +1,119 @@
+/*
+ * nl802154.h
+ *
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef NL802154_H
+#define NL802154_H
+
+#define IEEE802154_NL_NAME "802.15.4 MAC"
+#define IEEE802154_MCAST_COORD_NAME "coordinator"
+#define IEEE802154_MCAST_BEACON_NAME "beacon"
+
+enum {
+        __IEEE802154_ATTR_INVALID,
+
+        IEEE802154_ATTR_DEV_NAME,
+        IEEE802154_ATTR_DEV_INDEX,
+
+        IEEE802154_ATTR_STATUS,
+
+        IEEE802154_ATTR_SHORT_ADDR,
+        IEEE802154_ATTR_HW_ADDR,
+        IEEE802154_ATTR_PAN_ID,
+
+        IEEE802154_ATTR_CHANNEL,
+
+        IEEE802154_ATTR_COORD_SHORT_ADDR,
+        IEEE802154_ATTR_COORD_HW_ADDR,
+        IEEE802154_ATTR_COORD_PAN_ID,
+
+        IEEE802154_ATTR_SRC_SHORT_ADDR,
+        IEEE802154_ATTR_SRC_HW_ADDR,
+        IEEE802154_ATTR_SRC_PAN_ID,
+
+        IEEE802154_ATTR_DEST_SHORT_ADDR,
+        IEEE802154_ATTR_DEST_HW_ADDR,
+        IEEE802154_ATTR_DEST_PAN_ID,
+
+        IEEE802154_ATTR_CAPABILITY,
+        IEEE802154_ATTR_REASON,
+        IEEE802154_ATTR_SCAN_TYPE,
+        IEEE802154_ATTR_CHANNELS,
+        IEEE802154_ATTR_DURATION,
+        IEEE802154_ATTR_ED_LIST,
+        IEEE802154_ATTR_BCN_ORD,
+        IEEE802154_ATTR_SF_ORD,
+        IEEE802154_ATTR_PAN_COORD,
+        IEEE802154_ATTR_BAT_EXT,
+        IEEE802154_ATTR_COORD_REALIGN,
+        IEEE802154_ATTR_SEC,
+
+        __IEEE802154_ATTR_MAX,
+};
+
+#define IEEE802154_ATTR_MAX (__IEEE802154_ATTR_MAX - 1)
+
+extern struct nla_policy ieee802154_policy[];
+
+/* commands */
+/* REQ should be responded with CONF
+ * and INDIC with RESP
+ */
+enum {
+        __IEEE802154_COMMAND_INVALID,
+
+        IEEE802154_ASSOCIATE_REQ,
+        IEEE802154_ASSOCIATE_CONF,
+        IEEE802154_DISASSOCIATE_REQ,
+        IEEE802154_DISASSOCIATE_CONF,
+        IEEE802154_GET_REQ,
+        IEEE802154_GET_CONF,
+        IEEE802154_RESET_REQ,
+        IEEE802154_RESET_CONF,
+        IEEE802154_SCAN_REQ,
+        IEEE802154_SCAN_CONF,
+        IEEE802154_SET_REQ,
+        IEEE802154_SET_CONF,
+        IEEE802154_START_REQ,
+        IEEE802154_START_CONF,
+        IEEE802154_SYNC_REQ,
+        IEEE802154_POLL_REQ,
+        IEEE802154_POLL_CONF,
+
+        IEEE802154_ASSOCIATE_INDIC,
+        IEEE802154_ASSOCIATE_RESP,
+        IEEE802154_DISASSOCIATE_INDIC,
+        IEEE802154_BEACON_NOTIFY_INDIC,
+        IEEE802154_ORPHAN_INDIC,
+        IEEE802154_ORPHAN_RESP,
+        IEEE802154_COMM_STATUS_INDIC,
+        IEEE802154_SYNC_LOSS_INDIC,
+
+        IEEE802154_GTS_REQ, /* Not supported yet */
+        IEEE802154_GTS_INDIC, /* Not supported yet */
+        IEEE802154_GTS_CONF, /* Not supported yet */
+        IEEE802154_RX_ENABLE_REQ, /* Not supported yet */
+        IEEE802154_RX_ENABLE_CONF, /* Not supported yet */
+
+        __IEEE802154_CMD_MAX,
+};
+
+#define IEEE802154_CMD_MAX (__IEEE802154_CMD_MAX - 1)
+
+#endif
diff --git a/include/linux/nls.h b/include/linux/nls.h
index 52b1a76c1b43..d47beef08dfd 100644
--- a/include/linux/nls.h
+++ b/include/linux/nls.h
@@ -3,8 +3,23 @@
 
 #include <linux/init.h>
 
-/* unicode character */
-typedef __u16 wchar_t;
+/* Unicode has changed over the years.  Unicode code points no longer
+ * fit into 16 bits; as of Unicode 5 valid code points range from 0
+ * to 0x10ffff (17 planes, where each plane holds 65536 code points).
+ *
+ * The original decision to represent Unicode characters as 16-bit
+ * wchar_t values is now outdated.  But plane 0 still includes the
+ * most commonly used characters, so we will retain it.  The newer
+ * 32-bit unicode_t type can be used when it is necessary to
+ * represent the full Unicode character set.
+ */
+
+/* Plane-0 Unicode character */
+typedef u16 wchar_t;
+#define MAX_WCHAR_T     0xffff
+
+/* Arbitrary Unicode character */
+typedef u32 unicode_t;
 
 struct nls_table {
         const char *charset;
@@ -21,6 +36,13 @@ struct nls_table {
 /* this value hold the maximum octet of charset */
 #define NLS_MAX_CHARSET_SIZE 6 /* for UTF-8 */
 
+/* Byte order for UTF-16 strings */
+enum utf16_endian {
+        UTF16_HOST_ENDIAN,
+        UTF16_LITTLE_ENDIAN,
+        UTF16_BIG_ENDIAN
+};
+
 /* nls.c */
 extern int register_nls(struct nls_table *);
 extern int unregister_nls(struct nls_table *);
@@ -28,10 +50,11 @@ extern struct nls_table *load_nls(char *);
 extern void unload_nls(struct nls_table *);
 extern struct nls_table *load_nls_default(void);
 
-extern int utf8_mbtowc(wchar_t *, const __u8 *, int);
-extern int utf8_mbstowcs(wchar_t *, const __u8 *, int);
-extern int utf8_wctomb(__u8 *, wchar_t, int);
-extern int utf8_wcstombs(__u8 *, const wchar_t *, int);
+extern int utf8_to_utf32(const u8 *s, int len, unicode_t *pu);
+extern int utf32_to_utf8(unicode_t u, u8 *s, int maxlen);
+extern int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs);
+extern int utf16s_to_utf8s(const wchar_t *pwcs, int len,
+                enum utf16_endian endian, u8 *s, int maxlen);
 
 static inline unsigned char nls_tolower(struct nls_table *t, unsigned char c)
 {
diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
index 848025cd7087..829b94b156f2 100644
--- a/include/linux/nodemask.h
+++ b/include/linux/nodemask.h
@@ -408,6 +408,19 @@ static inline int num_node_state(enum node_states state)
 #define next_online_node(nid)   next_node((nid), node_states[N_ONLINE])
 
 extern int nr_node_ids;
+extern int nr_online_nodes;
+
+static inline void node_set_online(int nid)
+{
+        node_set_state(nid, N_ONLINE);
+        nr_online_nodes = num_node_state(N_ONLINE);
+}
+
+static inline void node_set_offline(int nid)
+{
+        node_clear_state(nid, N_ONLINE);
+        nr_online_nodes = num_node_state(N_ONLINE);
+}
 #else
 
 static inline int node_state(int node, enum node_states state)
@@ -434,7 +447,10 @@ static inline int num_node_state(enum node_states state)
 #define first_online_node       0
 #define next_online_node(nid)   (MAX_NUMNODES)
 #define nr_node_ids             1
+#define nr_online_nodes         1
 
+#define node_set_online(node)      node_set_state((node), N_ONLINE)
+#define node_set_offline(node)     node_clear_state((node), N_ONLINE)
 #endif
 
 #define node_online_map         node_states[N_ONLINE]
@@ -454,9 +470,6 @@ static inline int num_node_state(enum node_states state)
 #define node_online(node)       node_state((node), N_ONLINE)
 #define node_possible(node)     node_state((node), N_POSSIBLE)
 
-#define node_set_online(node)      node_set_state((node), N_ONLINE)
-#define node_set_offline(node)     node_clear_state((node), N_ONLINE)
-
 #define for_each_node(node)        for_each_node_state(node, N_POSSIBLE)
 #define for_each_online_node(node) for_each_node_state(node, N_ONLINE)
 
diff --git a/include/linux/notifier.h b/include/linux/notifier.h
index b86fa2ffca0c..81bc252dc8ac 100644
--- a/include/linux/notifier.h
+++ b/include/linux/notifier.h
@@ -198,6 +198,7 @@ static inline int notifier_to_errno(int ret)
 #define NETDEV_CHANGENAME       0x000A
 #define NETDEV_FEAT_CHANGE      0x000B
 #define NETDEV_BONDING_FAILOVER 0x000C
+#define NETDEV_PRE_UP           0x000D
 
 #define SYS_DOWN        0x0001  /* Notify of system down */
 #define SYS_RESTART     SYS_DOWN
diff --git a/include/linux/of.h b/include/linux/of.h
index 6a7efa242f5e..7be2d1043c16 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -77,6 +77,9 @@ extern int of_n_size_cells(struct device_node *np);
 extern const struct of_device_id *of_match_node(
         const struct of_device_id *matches, const struct device_node *node);
 extern int of_modalias_node(struct device_node *node, char *modalias, int len);
+extern struct device_node *of_parse_phandle(struct device_node *np,
+                                            const char *phandle_name,
+                                            int index);
 extern int of_parse_phandles_with_args(struct device_node *np,
         const char *list_name, const char *cells_name, int index,
         struct device_node **out_node, const void **out_args);
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
new file mode 100644
index 000000000000..c9663c690303
--- /dev/null
+++ b/include/linux/of_mdio.h
@@ -0,0 +1,22 @@
+/*
+ * OF helpers for the MDIO (Ethernet PHY) API
+ *
+ * Copyright (c) 2009 Secret Lab Technologies, Ltd.
+ *
+ * This file is released under the GPLv2
+ */
+
+#ifndef __LINUX_OF_MDIO_H
+#define __LINUX_OF_MDIO_H
+
+#include <linux/phy.h>
+#include <linux/of.h>
+
+extern int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np);
+extern struct phy_device *of_phy_find_device(struct device_node *phy_np);
+extern struct phy_device *of_phy_connect(struct net_device *dev,
+                                         struct device_node *phy_np,
+                                         void (*hndlr)(struct net_device *),
+                                         u32 flags, phy_interface_t iface);
+
+#endif /* __LINUX_OF_MDIO_H */
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 62214c7d2d93..d6792f88a176 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -95,9 +95,7 @@ enum pageflags {
         PG_reclaim,             /* To be reclaimed asap */
         PG_buddy,               /* Page is free, on buddy lists */
         PG_swapbacked,          /* Page is backed by RAM/swap */
-#ifdef CONFIG_UNEVICTABLE_LRU
         PG_unevictable,         /* Page is "unevictable"  */
-#endif
 #ifdef CONFIG_HAVE_MLOCKED_PAGE_BIT
         PG_mlocked,             /* Page is vma mlocked */
 #endif
@@ -248,14 +246,8 @@ PAGEFLAG_FALSE(SwapCache)
         SETPAGEFLAG_NOOP(SwapCache) CLEARPAGEFLAG_NOOP(SwapCache)
 #endif
 
-#ifdef CONFIG_UNEVICTABLE_LRU
 PAGEFLAG(Unevictable, unevictable) __CLEARPAGEFLAG(Unevictable, unevictable)
         TESTCLEARFLAG(Unevictable, unevictable)
-#else
-PAGEFLAG_FALSE(Unevictable) TESTCLEARFLAG_FALSE(Unevictable)
-        SETPAGEFLAG_NOOP(Unevictable) CLEARPAGEFLAG_NOOP(Unevictable)
-        __CLEARPAGEFLAG_NOOP(Unevictable)
-#endif
 
 #ifdef CONFIG_HAVE_MLOCKED_PAGE_BIT
 #define MLOCK_PAGES 1
@@ -382,12 +374,6 @@ static inline void __ClearPageTail(struct page *page)
 
 #endif /* !PAGEFLAGS_EXTENDED */
 
-#ifdef CONFIG_UNEVICTABLE_LRU
-#define __PG_UNEVICTABLE        (1 << PG_unevictable)
-#else
-#define __PG_UNEVICTABLE        0
-#endif
-
 #ifdef CONFIG_HAVE_MLOCKED_PAGE_BIT
 #define __PG_MLOCKED            (1 << PG_mlocked)
 #else
@@ -403,7 +389,7 @@ static inline void __ClearPageTail(struct page *page)
          1 << PG_private | 1 << PG_private_2 | \
          1 << PG_buddy   | 1 << PG_writeback | 1 << PG_reserved | \
          1 << PG_slab    | 1 << PG_swapcache | 1 << PG_active | \
-         __PG_UNEVICTABLE | __PG_MLOCKED)
+         1 << PG_unevictable | __PG_MLOCKED)
 
 /*
  * Flags checked when a page is prepped for return by the page allocator.
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 34da5230faab..aec3252afcf5 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -22,9 +22,7 @@ enum mapping_flags {
         AS_EIO          = __GFP_BITS_SHIFT + 0, /* IO error on async write */
         AS_ENOSPC       = __GFP_BITS_SHIFT + 1, /* ENOSPC on async write */
         AS_MM_ALL_LOCKS = __GFP_BITS_SHIFT + 2, /* under mm_take_all_locks() */
-#ifdef CONFIG_UNEVICTABLE_LRU
         AS_UNEVICTABLE  = __GFP_BITS_SHIFT + 3, /* e.g., ramdisk, SHM_LOCK */
-#endif
 };
 
 static inline void mapping_set_error(struct address_space *mapping, int error)
@@ -37,8 +35,6 @@ static inline void mapping_set_error(struct address_space *mapping, int error)
         }
 }
 
-#ifdef CONFIG_UNEVICTABLE_LRU
-
 static inline void mapping_set_unevictable(struct address_space *mapping)
 {
         set_bit(AS_UNEVICTABLE, &mapping->flags);
@@ -55,14 +51,6 @@ static inline int mapping_unevictable(struct address_space *mapping)
                 return test_bit(AS_UNEVICTABLE, &mapping->flags);
         return !!mapping;
 }
-#else
-static inline void mapping_set_unevictable(struct address_space *mapping) { }
-static inline void mapping_clear_unevictable(struct address_space *mapping) { }
-static inline int mapping_unevictable(struct address_space *mapping)
-{
-        return 0;
-}
-#endif
 
 static inline gfp_t mapping_gfp_mask(struct address_space * mapping)
 {
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 72698d89e767..8e366bb0705f 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -124,6 +124,14 @@ typedef int __bitwise pci_power_t;
 #define PCI_UNKNOWN     ((pci_power_t __force) 5)
 #define PCI_POWER_ERROR ((pci_power_t __force) -1)
 
+/* Remember to update this when the list above changes! */
+extern const char *pci_power_names[];
+
+static inline const char *pci_power_name(pci_power_t state)
+{
+        return pci_power_names[1 + (int) state];
+}
+
 #define PCI_PM_D2_DELAY 200
 #define PCI_PM_D3_WAIT  10
 #define PCI_PM_BUS_WAIT 50
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 19f8e6d1a4d2..a3b000365795 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -104,6 +104,7 @@
 #define PCI_CLASS_SERIAL_USB_UHCI       0x0c0300
 #define PCI_CLASS_SERIAL_USB_OHCI       0x0c0310
 #define PCI_CLASS_SERIAL_USB_EHCI       0x0c0320
+#define PCI_CLASS_SERIAL_USB_XHCI       0x0c0330
 #define PCI_CLASS_SERIAL_FIBER          0x0c04
 #define PCI_CLASS_SERIAL_SMBUS          0x0c05
 
@@ -1067,8 +1068,6 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SMBUS 0x0034
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_IDE   0x0035
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA  0x0036
-#define PCI_DEVICE_ID_NVIDIA_NVENET_10          0x0037
-#define PCI_DEVICE_ID_NVIDIA_NVENET_11          0x0038
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA2 0x003e
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_6800_ULTRA 0x0040
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_6800       0x0041
@@ -1079,21 +1078,16 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_IDE   0x0053
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_SATA  0x0054
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_SATA2 0x0055
-#define PCI_DEVICE_ID_NVIDIA_NVENET_8           0x0056
-#define PCI_DEVICE_ID_NVIDIA_NVENET_9           0x0057
 #define PCI_DEVICE_ID_NVIDIA_CK804_AUDIO        0x0059
 #define PCI_DEVICE_ID_NVIDIA_CK804_PCIE         0x005d
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2_SMBUS      0x0064
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2_IDE        0x0065
-#define PCI_DEVICE_ID_NVIDIA_NVENET_2           0x0066
 #define PCI_DEVICE_ID_NVIDIA_MCP2_MODEM         0x0069
 #define PCI_DEVICE_ID_NVIDIA_MCP2_AUDIO         0x006a
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_SMBUS     0x0084
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_IDE       0x0085
-#define PCI_DEVICE_ID_NVIDIA_NVENET_4           0x0086
 #define PCI_DEVICE_ID_NVIDIA_MCP2S_MODEM        0x0089
 #define PCI_DEVICE_ID_NVIDIA_CK8_AUDIO          0x008a
-#define PCI_DEVICE_ID_NVIDIA_NVENET_5           0x008c
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_SATA      0x008e
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_7800_GT   0x0090
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_7800_GTX   0x0091
@@ -1109,15 +1103,12 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3            0x00d1
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3_SMBUS      0x00d4
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3_IDE        0x00d5
-#define PCI_DEVICE_ID_NVIDIA_NVENET_3           0x00d6
 #define PCI_DEVICE_ID_NVIDIA_MCP3_MODEM         0x00d9
 #define PCI_DEVICE_ID_NVIDIA_MCP3_AUDIO         0x00da
-#define PCI_DEVICE_ID_NVIDIA_NVENET_7           0x00df
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S           0x00e1
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_SATA      0x00e3
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_SMBUS     0x00e4
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_IDE       0x00e5
-#define PCI_DEVICE_ID_NVIDIA_NVENET_6           0x00e6
 #define PCI_DEVICE_ID_NVIDIA_CK8S_AUDIO         0x00ea
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_SATA2     0x00ee
 #define PCIE_DEVICE_ID_NVIDIA_GEFORCE_6800_ALT1 0x00f0
@@ -1177,7 +1168,6 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_SMBUS       0x01b4
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_IDE         0x01bc
 #define PCI_DEVICE_ID_NVIDIA_MCP1_MODEM         0x01c1
-#define PCI_DEVICE_ID_NVIDIA_NVENET_1           0x01c3
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2            0x01e0
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE3           0x0200
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE3_1         0x0201
@@ -1200,8 +1190,6 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_IDE   0x036E
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA  0x037E
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2 0x037F
-#define PCI_DEVICE_ID_NVIDIA_NVENET_12          0x0268
-#define PCI_DEVICE_ID_NVIDIA_NVENET_13          0x0269
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_TI_4800   0x0280
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_TI_4800_8X    0x0281
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_TI_4800SE     0x0282
@@ -1248,46 +1236,21 @@
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_FX_GO5700_2    0x0348
 #define PCI_DEVICE_ID_NVIDIA_QUADRO_FX_GO1000       0x034C
 #define PCI_DEVICE_ID_NVIDIA_QUADRO_FX_1100         0x034E
-#define PCI_DEVICE_ID_NVIDIA_NVENET_14              0x0372
 #define PCI_DEVICE_ID_NVIDIA_NVENET_15              0x0373
-#define PCI_DEVICE_ID_NVIDIA_NVENET_16              0x03E5
-#define PCI_DEVICE_ID_NVIDIA_NVENET_17              0x03E6
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA      0x03E7
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SMBUS     0x03EB
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_IDE       0x03EC
-#define PCI_DEVICE_ID_NVIDIA_NVENET_18              0x03EE
-#define PCI_DEVICE_ID_NVIDIA_NVENET_19              0x03EF
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2     0x03F6
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3     0x03F7
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP65_SMBUS     0x0446
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP65_IDE       0x0448
-#define PCI_DEVICE_ID_NVIDIA_NVENET_20              0x0450
-#define PCI_DEVICE_ID_NVIDIA_NVENET_21              0x0451
-#define PCI_DEVICE_ID_NVIDIA_NVENET_22              0x0452
-#define PCI_DEVICE_ID_NVIDIA_NVENET_23              0x0453
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_SMBUS     0x0542
-#define PCI_DEVICE_ID_NVIDIA_NVENET_24              0x054C
-#define PCI_DEVICE_ID_NVIDIA_NVENET_25              0x054D
-#define PCI_DEVICE_ID_NVIDIA_NVENET_26              0x054E
-#define PCI_DEVICE_ID_NVIDIA_NVENET_27              0x054F
-#define PCI_DEVICE_ID_NVIDIA_NVENET_28              0x07DC
-#define PCI_DEVICE_ID_NVIDIA_NVENET_29              0x07DD
-#define PCI_DEVICE_ID_NVIDIA_NVENET_30              0x07DE
-#define PCI_DEVICE_ID_NVIDIA_NVENET_31              0x07DF
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_IDE       0x0560
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_IDE       0x056C
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP78S_SMBUS    0x0752
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE       0x0759
-#define PCI_DEVICE_ID_NVIDIA_NVENET_32              0x0760
-#define PCI_DEVICE_ID_NVIDIA_NVENET_33              0x0761
-#define PCI_DEVICE_ID_NVIDIA_NVENET_34              0x0762
-#define PCI_DEVICE_ID_NVIDIA_NVENET_35              0x0763
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_SMBUS     0x07D8
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS     0x0AA2
-#define PCI_DEVICE_ID_NVIDIA_NVENET_36              0x0AB0
-#define PCI_DEVICE_ID_NVIDIA_NVENET_37              0x0AB1
-#define PCI_DEVICE_ID_NVIDIA_NVENET_38              0x0AB2
-#define PCI_DEVICE_ID_NVIDIA_NVENET_39              0x0AB3
 
 #define PCI_VENDOR_ID_IMS               0x10e0
 #define PCI_DEVICE_ID_IMS_TT128         0x9128
@@ -1926,6 +1889,8 @@
 #define PCI_SUBDEVICE_ID_CCD_SWYX4S     0xB540
 #define PCI_SUBDEVICE_ID_CCD_JH4S20     0xB550
 #define PCI_SUBDEVICE_ID_CCD_IOB8ST_1   0xB552
+#define PCI_SUBDEVICE_ID_CCD_JHSE1      0xB553
+#define PCI_SUBDEVICE_ID_CCD_JH8S       0xB55B
 #define PCI_SUBDEVICE_ID_CCD_BN4S       0xB560
 #define PCI_SUBDEVICE_ID_CCD_BN8S       0xB562
 #define PCI_SUBDEVICE_ID_CCD_BNE1       0xB563
@@ -2127,6 +2092,7 @@
 #define PCI_VENDOR_ID_MAINPINE          0x1522
 #define PCI_DEVICE_ID_MAINPINE_PBRIDGE  0x0100
 #define PCI_VENDOR_ID_ENE               0x1524
+#define PCI_DEVICE_ID_ENE_CB710_FLASH   0x0510
 #define PCI_DEVICE_ID_ENE_CB712_SD      0x0550
 #define PCI_DEVICE_ID_ENE_CB712_SD_2    0x0551
 #define PCI_DEVICE_ID_ENE_CB714_SD      0x0750
@@ -2288,6 +2254,8 @@
 #define PCI_DEVICE_ID_MPC8547E          0x0018
 #define PCI_DEVICE_ID_MPC8545E          0x0019
 #define PCI_DEVICE_ID_MPC8545           0x001a
+#define PCI_DEVICE_ID_MPC8569E          0x0061
+#define PCI_DEVICE_ID_MPC8569           0x0060
 #define PCI_DEVICE_ID_MPC8568E          0x0020
 #define PCI_DEVICE_ID_MPC8568           0x0021
 #define PCI_DEVICE_ID_MPC8567E          0x0022
@@ -2300,6 +2268,8 @@
 #define PCI_DEVICE_ID_MPC8572           0x0041
 #define PCI_DEVICE_ID_MPC8536E          0x0050
 #define PCI_DEVICE_ID_MPC8536           0x0051
+#define PCI_DEVICE_ID_P2020E            0x0070
+#define PCI_DEVICE_ID_P2020             0x0071
 #define PCI_DEVICE_ID_MPC8641           0x7010
 #define PCI_DEVICE_ID_MPC8641D          0x7011
 #define PCI_DEVICE_ID_MPC8610           0x7018
@@ -2327,6 +2297,8 @@
 
 #define PCI_VENDOR_ID_QMI               0x1a32
 
+#define PCI_VENDOR_ID_AZWAVE            0x1a3b
+
 #define PCI_VENDOR_ID_TEKRAM            0x1de1
 #define PCI_DEVICE_ID_TEKRAM_DC290      0xdc29
 
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 97e40cb6b588..b1368b8f6572 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -79,7 +79,7 @@ typedef enum {
  * Need to be a little smaller than phydev->dev.bus_id to leave room
  * for the ":%02x"
  */
-#define MII_BUS_ID_SIZE (BUS_ID_SIZE - 3)
+#define MII_BUS_ID_SIZE (20 - 3)
 
 /*
  * The Bus class for PHYs.  Devices which provide access to
@@ -407,7 +407,7 @@ struct phy_driver {
 /* A Structure for boards to register fixups with the PHY Lib */
 struct phy_fixup {
         struct list_head list;
-        char bus_id[BUS_ID_SIZE];
+        char bus_id[20];
         u32 phy_uid;
         u32 phy_uid_mask;
         int (*run)(struct phy_device *phydev);
@@ -444,10 +444,16 @@ static inline int phy_write(struct phy_device *phydev, u16 regnum, u16 val)
 
 int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id);
 struct phy_device* get_phy_device(struct mii_bus *bus, int addr);
+int phy_device_register(struct phy_device *phy);
 int phy_clear_interrupt(struct phy_device *phydev);
 int phy_config_interrupt(struct phy_device *phydev, u32 interrupts);
+int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
+                u32 flags, phy_interface_t interface);
 struct phy_device * phy_attach(struct net_device *dev,
                 const char *bus_id, u32 flags, phy_interface_t interface);
+int phy_connect_direct(struct net_device *dev, struct phy_device *phydev,
+                void (*handler)(struct net_device *), u32 flags,
+                phy_interface_t interface);
 struct phy_device * phy_connect(struct net_device *dev, const char *bus_id,
                 void (*handler)(struct net_device *), u32 flags,
                 phy_interface_t interface);
diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
index b67bb5d7b221..8dc5123b6305 100644
--- a/include/linux/platform_device.h
+++ b/include/linux/platform_device.h
@@ -36,8 +36,8 @@ extern struct device platform_bus;
 
 extern struct resource *platform_get_resource(struct platform_device *, unsigned int, unsigned int);
 extern int platform_get_irq(struct platform_device *, unsigned int);
-extern struct resource *platform_get_resource_byname(struct platform_device *, unsigned int, char *);
-extern int platform_get_irq_byname(struct platform_device *, char *);
+extern struct resource *platform_get_resource_byname(struct platform_device *, unsigned int, const char *);
+extern int platform_get_irq_byname(struct platform_device *, const char *);
 extern int platform_add_devices(struct platform_device **, int);
 
 extern struct platform_device *platform_device_register_simple(const char *, int id,
diff --git a/include/linux/poll.h b/include/linux/poll.h
index 8c24ef8d9976..fa287f25138d 100644
--- a/include/linux/poll.h
+++ b/include/linux/poll.h
@@ -32,6 +32,7 @@ typedef void (*poll_queue_proc)(struct file *, wait_queue_head_t *, struct poll_
 
 typedef struct poll_table_struct {
         poll_queue_proc qproc;
+        unsigned long key;
 } poll_table;
 
 static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address, poll_table *p)
@@ -43,10 +44,12 @@ static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_addres
 static inline void init_poll_funcptr(poll_table *pt, poll_queue_proc qproc)
 {
         pt->qproc = qproc;
+        pt->key   = ~0UL; /* all events enabled */
 }
 
 struct poll_table_entry {
         struct file *filp;
+        unsigned long key;
         wait_queue_t wait;
         wait_queue_head_t *wait_address;
 };
diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
index 355f6e80db0d..c5da74918096 100644
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -167,6 +167,8 @@ radix_tree_gang_lookup_slot(struct radix_tree_root *root, void ***results,
                         unsigned long first_index, unsigned int max_items);
 unsigned long radix_tree_next_hole(struct radix_tree_root *root,
                                 unsigned long index, unsigned long max_scan);
+unsigned long radix_tree_prev_hole(struct radix_tree_root *root,
+                                unsigned long index, unsigned long max_scan);
 int radix_tree_preload(gfp_t gfp_mask);
 void radix_tree_init(void);
 void *radix_tree_tag_set(struct radix_tree_root *root,
diff --git a/include/linux/regulator/lp3971.h b/include/linux/regulator/lp3971.h
new file mode 100644
index 000000000000..61401649fe7d
--- /dev/null
+++ b/include/linux/regulator/lp3971.h
@@ -0,0 +1,51 @@
+/*
+ * National Semiconductors LP3971 PMIC chip client interface
+ *
+ *  Copyright (C) 2009 Samsung Electronics
+ *  Author: Marek Szyprowski <m.szyprowski@samsung.com>
+ *
+ * Based on wm8400.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef __LINUX_REGULATOR_LP3971_H
+#define __LINUX_REGULATOR_LP3971_H
+
+#include <linux/regulator/machine.h>
+
+#define LP3971_LDO1  0
+#define LP3971_LDO2  1
+#define LP3971_LDO3  2
+#define LP3971_LDO4  3
+#define LP3971_LDO5  4
+
+#define LP3971_DCDC1 5
+#define LP3971_DCDC2 6
+#define LP3971_DCDC3 7
+
+#define LP3971_NUM_REGULATORS 8
+
+struct lp3971_regulator_subdev {
+        int id;
+        struct regulator_init_data *initdata;
+};
+
+struct lp3971_platform_data {
+        int num_regulators;
+        struct lp3971_regulator_subdev *regulators;
+};
+
+#endif
diff --git a/include/linux/regulator/max1586.h b/include/linux/regulator/max1586.h
new file mode 100644
index 000000000000..44563192bf16
--- /dev/null
+++ b/include/linux/regulator/max1586.h
@@ -0,0 +1,63 @@
+/*
+ * max1586.h  --  Voltage regulation for the Maxim 1586
+ *
+ * Copyright (C) 2008 Robert Jarzmik
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#ifndef REGULATOR_MAX1586
+#define REGULATOR_MAX1586
+
+#include <linux/regulator/machine.h>
+
+#define MAX1586_V3 0
+#define MAX1586_V6 1
+
+/* precalculated values for v3_gain */
+#define MAX1586_GAIN_NO_R24   1000000  /* 700000 .. 1475000 mV */
+#define MAX1586_GAIN_R24_3k32 1051098  /* 735768 .. 1550369 mV */
+#define MAX1586_GAIN_R24_5k11 1078648  /* 755053 .. 1591005 mV */
+#define MAX1586_GAIN_R24_7k5  1115432  /* 780802 .. 1645262 mV */
+
+/**
+ * max1586_subdev_data - regulator data
+ * @id: regulator Id (either MAX1586_V3 or MAX1586_V6)
+ * @name: regulator cute name (example for V3: "vcc_core")
+ * @platform_data: regulator init data (contraints, supplies, ...)
+ */
+struct max1586_subdev_data {
+        int                             id;
+        char                            *name;
+        struct regulator_init_data      *platform_data;
+};
+
+/**
+ * max1586_platform_data - platform data for max1586
+ * @num_subdevs: number of regultors used (may be 1 or 2)
+ * @subdevs: regulator used
+ *           At most, there will be a regulator for V3 and one for V6 voltages.
+ * @v3_gain: gain on the V3 voltage output multiplied by 1e6.
+ *           This can be calculated as ((1 + R24/R25 + R24/185.5kOhm) * 1e6)
+ *           for an external resistor configuration as described in the
+ *           data sheet (R25=100kOhm).
+ */
+struct max1586_platform_data {
+        int num_subdevs;
+        struct max1586_subdev_data *subdevs;
+        int v3_gain;
+};
+
+#endif
diff --git a/include/linux/regulator/userspace-consumer.h b/include/linux/regulator/userspace-consumer.h
new file mode 100644
index 000000000000..b4554ce9d4bb
--- /dev/null
+++ b/include/linux/regulator/userspace-consumer.h
@@ -0,0 +1,25 @@
+#ifndef __REGULATOR_PLATFORM_CONSUMER_H_
+#define __REGULATOR_PLATFORM_CONSUMER_H_
+
+struct regulator_consumer_supply;
+
+/**
+ * struct regulator_userspace_consumer_data - line consumer
+ * initialisation data.
+ *
+ * @name: Name for the consumer line
+ * @num_supplies: Number of supplies feeding the line
+ * @supplies: Supplies configuration.
+ * @init_on: Set if the regulators supplying the line should be
+ *           enabled during initialisation
+ */
+struct regulator_userspace_consumer_data {
+        const char *name;
+
+        int num_supplies;
+        struct regulator_bulk_data *supplies;
+
+        bool init_on;
+};
+
+#endif /* __REGULATOR_PLATFORM_CONSUMER_H_ */
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index 164332cbb77c..16e39c7a67fc 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -4,6 +4,7 @@
 /*
  * Copyright (C) 2006 - 2007 Ivo van Doorn
  * Copyright (C) 2007 Dmitry Torokhov
+ * Copyright 2009 Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -22,131 +23,331 @@
  */
 
 #include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/list.h>
-#include <linux/mutex.h>
-#include <linux/device.h>
-#include <linux/leds.h>
+
+/* define userspace visible states */
+#define RFKILL_STATE_SOFT_BLOCKED       0
+#define RFKILL_STATE_UNBLOCKED          1
+#define RFKILL_STATE_HARD_BLOCKED       2
 
 /**
  * enum rfkill_type - type of rfkill switch.
- * RFKILL_TYPE_WLAN: switch is on a 802.11 wireless network device.
- * RFKILL_TYPE_BLUETOOTH: switch is on a bluetooth device.
- * RFKILL_TYPE_UWB: switch is on a ultra wideband device.
- * RFKILL_TYPE_WIMAX: switch is on a WiMAX device.
- * RFKILL_TYPE_WWAN: switch is on a wireless WAN device.
+ *
+ * @RFKILL_TYPE_ALL: toggles all switches (userspace only)
+ * @RFKILL_TYPE_WLAN: switch is on a 802.11 wireless network device.
+ * @RFKILL_TYPE_BLUETOOTH: switch is on a bluetooth device.
+ * @RFKILL_TYPE_UWB: switch is on a ultra wideband device.
+ * @RFKILL_TYPE_WIMAX: switch is on a WiMAX device.
+ * @RFKILL_TYPE_WWAN: switch is on a wireless WAN device.
+ * @NUM_RFKILL_TYPES: number of defined rfkill types
  */
 enum rfkill_type {
-        RFKILL_TYPE_WLAN ,
+        RFKILL_TYPE_ALL = 0,
+        RFKILL_TYPE_WLAN,
         RFKILL_TYPE_BLUETOOTH,
         RFKILL_TYPE_UWB,
         RFKILL_TYPE_WIMAX,
         RFKILL_TYPE_WWAN,
-        RFKILL_TYPE_MAX,
+        NUM_RFKILL_TYPES,
 };
 
-enum rfkill_state {
-        RFKILL_STATE_SOFT_BLOCKED = 0,  /* Radio output blocked */
-        RFKILL_STATE_UNBLOCKED    = 1,  /* Radio output allowed */
-        RFKILL_STATE_HARD_BLOCKED = 2,  /* Output blocked, non-overrideable */
-        RFKILL_STATE_MAX,               /* marker for last valid state */
+/**
+ * enum rfkill_operation - operation types
+ * @RFKILL_OP_ADD: a device was added
+ * @RFKILL_OP_DEL: a device was removed
+ * @RFKILL_OP_CHANGE: a device's state changed -- userspace changes one device
+ * @RFKILL_OP_CHANGE_ALL: userspace changes all devices (of a type, or all)
+ */
+enum rfkill_operation {
+        RFKILL_OP_ADD = 0,
+        RFKILL_OP_DEL,
+        RFKILL_OP_CHANGE,
+        RFKILL_OP_CHANGE_ALL,
 };
 
-/*
- * These are DEPRECATED, drivers using them should be verified to
- * comply with the rfkill usage guidelines in Documentation/rfkill.txt
- * and then converted to use the new names for rfkill_state
- */
-#define RFKILL_STATE_OFF RFKILL_STATE_SOFT_BLOCKED
-#define RFKILL_STATE_ON  RFKILL_STATE_UNBLOCKED
-
-/**
- * struct rfkill - rfkill control structure.
- * @name: Name of the switch.
- * @type: Radio type which the button controls, the value stored
- *      here should be a value from enum rfkill_type.
- * @state: State of the switch, "UNBLOCKED" means radio can operate.
- * @user_claim_unsupported: Whether the hardware supports exclusive
- *      RF-kill control by userspace. Set this before registering.
- * @user_claim: Set when the switch is controlled exlusively by userspace.
- * @mutex: Guards switch state transitions.  It serializes callbacks
- *      and also protects the state.
- * @data: Pointer to the RF button drivers private data which will be
- *      passed along when toggling radio state.
- * @toggle_radio(): Mandatory handler to control state of the radio.
- *      only RFKILL_STATE_SOFT_BLOCKED and RFKILL_STATE_UNBLOCKED are
- *      valid parameters.
- * @get_state(): handler to read current radio state from hardware,
- *      may be called from atomic context, should return 0 on success.
- *      Either this handler OR judicious use of rfkill_force_state() is
- *      MANDATORY for any driver capable of RFKILL_STATE_HARD_BLOCKED.
- * @led_trigger: A LED trigger for this button's LED.
- * @dev: Device structure integrating the switch into device tree.
- * @node: Used to place switch into list of all switches known to the
- *      the system.
- *
- * This structure represents a RF switch located on a network device.
- */
-struct rfkill {
-        const char *name;
-        enum rfkill_type type;
-
-        bool user_claim_unsupported;
-        bool user_claim;
-
-        /* the mutex serializes callbacks and also protects
-         * the state */
-        struct mutex mutex;
-        enum rfkill_state state;
-        void *data;
-        int (*toggle_radio)(void *data, enum rfkill_state state);
-        int (*get_state)(void *data, enum rfkill_state *state);
+/**
+ * struct rfkill_event - events for userspace on /dev/rfkill
+ * @idx: index of dev rfkill
+ * @type: type of the rfkill struct
+ * @op: operation code
+ * @hard: hard state (0/1)
+ * @soft: soft state (0/1)
+ *
+ * Structure used for userspace communication on /dev/rfkill,
+ * used for events from the kernel and control to the kernel.
+ */
+struct rfkill_event {
+        __u32 idx;
+        __u8  type;
+        __u8  op;
+        __u8  soft, hard;
+} __packed;
 
-#ifdef CONFIG_RFKILL_LEDS
-        struct led_trigger led_trigger;
-#endif
+/* ioctl for turning off rfkill-input (if present) */
+#define RFKILL_IOC_MAGIC        'R'
+#define RFKILL_IOC_NOINPUT      1
+#define RFKILL_IOCTL_NOINPUT    _IO(RFKILL_IOC_MAGIC, RFKILL_IOC_NOINPUT)
+
+/* and that's all userspace gets */
+#ifdef __KERNEL__
+/* don't allow anyone to use these in the kernel */
+enum rfkill_user_states {
+        RFKILL_USER_STATE_SOFT_BLOCKED  = RFKILL_STATE_SOFT_BLOCKED,
+        RFKILL_USER_STATE_UNBLOCKED     = RFKILL_STATE_UNBLOCKED,
+        RFKILL_USER_STATE_HARD_BLOCKED  = RFKILL_STATE_HARD_BLOCKED,
+};
+#undef RFKILL_STATE_SOFT_BLOCKED
+#undef RFKILL_STATE_UNBLOCKED
+#undef RFKILL_STATE_HARD_BLOCKED
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/device.h>
+#include <linux/leds.h>
+#include <linux/err.h>
+
+/* this is opaque */
+struct rfkill;
 
-        struct device dev;
-        struct list_head node;
-        enum rfkill_state state_for_resume;
+/**
+ * struct rfkill_ops - rfkill driver methods
+ *
+ * @poll: poll the rfkill block state(s) -- only assign this method
+ *      when you need polling. When called, simply call one of the
+ *      rfkill_set{,_hw,_sw}_state family of functions. If the hw
+ *      is getting unblocked you need to take into account the return
+ *      value of those functions to make sure the software block is
+ *      properly used.
+ * @query: query the rfkill block state(s) and call exactly one of the
+ *      rfkill_set{,_hw,_sw}_state family of functions. Assign this
+ *      method if input events can cause hardware state changes to make
+ *      the rfkill core query your driver before setting a requested
+ *      block.
+ * @set_block: turn the transmitter on (blocked == false) or off
+ *      (blocked == true) -- ignore and return 0 when hard blocked.
+ *      This callback must be assigned.
+ */
+struct rfkill_ops {
+        void    (*poll)(struct rfkill *rfkill, void *data);
+        void    (*query)(struct rfkill *rfkill, void *data);
+        int     (*set_block)(void *data, bool blocked);
 };
-#define to_rfkill(d)    container_of(d, struct rfkill, dev)
 
-struct rfkill * __must_check rfkill_allocate(struct device *parent,
-                                             enum rfkill_type type);
-void rfkill_free(struct rfkill *rfkill);
+#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
+/**
+ * rfkill_alloc - allocate rfkill structure
+ * @name: name of the struct -- the string is not copied internally
+ * @parent: device that has rf switch on it
+ * @type: type of the switch (RFKILL_TYPE_*)
+ * @ops: rfkill methods
+ * @ops_data: data passed to each method
+ *
+ * This function should be called by the transmitter driver to allocate an
+ * rfkill structure. Returns %NULL on failure.
+ */
+struct rfkill * __must_check rfkill_alloc(const char *name,
+                                          struct device *parent,
+                                          const enum rfkill_type type,
+                                          const struct rfkill_ops *ops,
+                                          void *ops_data);
+
+/**
+ * rfkill_register - Register a rfkill structure.
+ * @rfkill: rfkill structure to be registered
+ *
+ * This function should be called by the transmitter driver to register
+ * the rfkill structure. Before calling this function the driver needs
+ * to be ready to service method calls from rfkill.
+ *
+ * If the software blocked state is not set before registration,
+ * set_block will be called to initialize it to a default value.
+ *
+ * If the hardware blocked state is not set before registration,
+ * it is assumed to be unblocked.
+ */
 int __must_check rfkill_register(struct rfkill *rfkill);
+
+/**
+ * rfkill_pause_polling(struct rfkill *rfkill)
+ *
+ * Pause polling -- say transmitter is off for other reasons.
+ * NOTE: not necessary for suspend/resume -- in that case the
+ * core stops polling anyway
+ */
+void rfkill_pause_polling(struct rfkill *rfkill);
+
+/**
+ * rfkill_resume_polling(struct rfkill *rfkill)
+ *
+ * Pause polling -- say transmitter is off for other reasons.
+ * NOTE: not necessary for suspend/resume -- in that case the
+ * core stops polling anyway
+ */
+void rfkill_resume_polling(struct rfkill *rfkill);
+
+
+/**
+ * rfkill_unregister - Unregister a rfkill structure.
+ * @rfkill: rfkill structure to be unregistered
+ *
+ * This function should be called by the network driver during device
+ * teardown to destroy rfkill structure. Until it returns, the driver
+ * needs to be able to service method calls.
+ */
 void rfkill_unregister(struct rfkill *rfkill);
 
-int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state);
-int rfkill_set_default(enum rfkill_type type, enum rfkill_state state);
+/**
+ * rfkill_destroy - free rfkill structure
+ * @rfkill: rfkill structure to be destroyed
+ *
+ * Destroys the rfkill structure.
+ */
+void rfkill_destroy(struct rfkill *rfkill);
+
+/**
+ * rfkill_set_hw_state - Set the internal rfkill hardware block state
+ * @rfkill: pointer to the rfkill class to modify.
+ * @state: the current hardware block state to set
+ *
+ * rfkill drivers that get events when the hard-blocked state changes
+ * use this function to notify the rfkill core (and through that also
+ * userspace) of the current state.  They should also use this after
+ * resume if the state could have changed.
+ *
+ * You need not (but may) call this function if poll_state is assigned.
+ *
+ * This function can be called in any context, even from within rfkill
+ * callbacks.
+ *
+ * The function returns the combined block state (true if transmitter
+ * should be blocked) so that drivers need not keep track of the soft
+ * block state -- which they might not be able to.
+ */
+bool __must_check rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
+
+/**
+ * rfkill_set_sw_state - Set the internal rfkill software block state
+ * @rfkill: pointer to the rfkill class to modify.
+ * @state: the current software block state to set
+ *
+ * rfkill drivers that get events when the soft-blocked state changes
+ * (yes, some platforms directly act on input but allow changing again)
+ * use this function to notify the rfkill core (and through that also
+ * userspace) of the current state.  It is not necessary to notify on
+ * resume; since hibernation can always change the soft-blocked state,
+ * the rfkill core will unconditionally restore the previous state.
+ *
+ * This function can be called in any context, even from within rfkill
+ * callbacks.
+ *
+ * The function returns the combined block state (true if transmitter
+ * should be blocked).
+ */
+bool rfkill_set_sw_state(struct rfkill *rfkill, bool blocked);
+
+/**
+ * rfkill_set_states - Set the internal rfkill block states
+ * @rfkill: pointer to the rfkill class to modify.
+ * @sw: the current software block state to set
+ * @hw: the current hardware block state to set
+ *
+ * This function can be called in any context, even from within rfkill
+ * callbacks.
+ */
+void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw);
 
 /**
- * rfkill_state_complement - return complementar state
- * @state: state to return the complement of
+ * rfkill_blocked - query rfkill block
  *
- * Returns RFKILL_STATE_SOFT_BLOCKED if @state is RFKILL_STATE_UNBLOCKED,
- * returns RFKILL_STATE_UNBLOCKED otherwise.
+ * @rfkill: rfkill struct to query
  */
-static inline enum rfkill_state rfkill_state_complement(enum rfkill_state state)
+bool rfkill_blocked(struct rfkill *rfkill);
+#else /* !RFKILL */
+static inline struct rfkill * __must_check
+rfkill_alloc(const char *name,
+             struct device *parent,
+             const enum rfkill_type type,
+             const struct rfkill_ops *ops,
+             void *ops_data)
+{
+        return ERR_PTR(-ENODEV);
+}
+
+static inline int __must_check rfkill_register(struct rfkill *rfkill)
+{
+        if (rfkill == ERR_PTR(-ENODEV))
+                return 0;
+        return -EINVAL;
+}
+
+static inline void rfkill_pause_polling(struct rfkill *rfkill)
+{
+}
+
+static inline void rfkill_resume_polling(struct rfkill *rfkill)
+{
+}
+
+static inline void rfkill_unregister(struct rfkill *rfkill)
+{
+}
+
+static inline void rfkill_destroy(struct rfkill *rfkill)
+{
+}
+
+static inline bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked)
+{
+        return blocked;
+}
+
+static inline bool rfkill_set_sw_state(struct rfkill *rfkill, bool blocked)
 {
-        return (state == RFKILL_STATE_UNBLOCKED) ?
-                RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
+        return blocked;
 }
 
+static inline void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
+{
+}
+
+static inline bool rfkill_blocked(struct rfkill *rfkill)
+{
+        return false;
+}
+#endif /* RFKILL || RFKILL_MODULE */
+
+
+#ifdef CONFIG_RFKILL_LEDS
 /**
- * rfkill_get_led_name - Get the LED trigger name for the button's LED.
+ * rfkill_get_led_trigger_name - Get the LED trigger name for the button's LED.
  * This function might return a NULL pointer if registering of the
- * LED trigger failed.
- * Use this as "default_trigger" for the LED.
+ * LED trigger failed. Use this as "default_trigger" for the LED.
  */
-static inline char *rfkill_get_led_name(struct rfkill *rfkill)
-{
-#ifdef CONFIG_RFKILL_LEDS
-        return (char *)(rfkill->led_trigger.name);
+const char *rfkill_get_led_trigger_name(struct rfkill *rfkill);
+
+/**
+ * rfkill_set_led_trigger_name -- set the LED trigger name
+ * @rfkill: rfkill struct
+ * @name: LED trigger name
+ *
+ * This function sets the LED trigger name of the radio LED
+ * trigger that rfkill creates. It is optional, but if called
+ * must be called before rfkill_register() to be effective.
+ */
+void rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name);
 #else
+static inline const char *rfkill_get_led_trigger_name(struct rfkill *rfkill)
+{
         return NULL;
-#endif
 }
 
+static inline void
+rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name)
+{
+}
+#endif
+
+#endif /* __KERNEL__ */
+
 #endif /* RFKILL_H */
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 8670f1575fe1..29f8599e6bea 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -1,6 +1,7 @@
 #ifndef _LINUX_RING_BUFFER_H
 #define _LINUX_RING_BUFFER_H
 
+#include <linux/kmemcheck.h>
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 
@@ -11,7 +12,10 @@ struct ring_buffer_iter;
  * Don't refer to this struct directly, use functions below.
  */
 struct ring_buffer_event {
+        kmemcheck_bitfield_begin(bitfield);
         u32             type_len:5, time_delta:27;
+        kmemcheck_bitfield_end(bitfield);
+
         u32             array[];
 };
 
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index b35bc0e19cd9..216d024f830d 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -83,7 +83,8 @@ static inline void page_dup_rmap(struct page *page, struct vm_area_struct *vma,
 /*
  * Called from mm/vmscan.c to handle paging out
  */
-int page_referenced(struct page *, int is_locked, struct mem_cgroup *cnt);
+int page_referenced(struct page *, int is_locked,
+                        struct mem_cgroup *cnt, unsigned long *vm_flags);
 int try_to_unmap(struct page *, int ignore_refs);
 
 /*
@@ -105,18 +106,11 @@ unsigned long page_address_in_vma(struct page *, struct vm_area_struct *);
  */
 int page_mkclean(struct page *);
 
-#ifdef CONFIG_UNEVICTABLE_LRU
 /*
  * called in munlock()/munmap() path to check for other vmas holding
  * the page mlocked.
  */
 int try_to_munlock(struct page *);
-#else
-static inline int try_to_munlock(struct page *page)
-{
-        return 0;       /* a.k.a. SWAP_SUCCESS */
-}
-#endif
 
 #else   /* !CONFIG_MMU */
 
@@ -124,7 +118,7 @@ static inline int try_to_munlock(struct page *page)
 #define anon_vma_prepare(vma)   (0)
 #define anon_vma_link(vma)      do {} while (0)
 
-#define page_referenced(page,l,cnt) TestClearPageReferenced(page)
+#define page_referenced(page, locked, cnt, flags) TestClearPageReferenced(page)
 #define try_to_unmap(page, refs) SWAP_FAIL
 
 static inline int page_mkclean(struct page *page)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4896fdfec913..02042e7f2196 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -261,6 +261,7 @@ extern void task_rq_unlock_wait(struct task_struct *p);
 extern cpumask_var_t nohz_cpu_mask;
 #if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ)
 extern int select_nohz_load_balancer(int cpu);
+extern int get_nohz_load_balancer(void);
 #else
 static inline int select_nohz_load_balancer(int cpu)
 {
@@ -673,7 +674,7 @@ struct user_struct {
         struct task_group *tg;
 #ifdef CONFIG_SYSFS
         struct kobject kobj;
-        struct work_struct work;
+        struct delayed_work work;
 #endif
 #endif
 
@@ -1177,7 +1178,6 @@ struct task_struct {
          * a short time
          */
         unsigned char fpu_counter;
-        s8 oomkilladj; /* OOM kill score adjustment (bit shift). */
 #ifdef CONFIG_BLK_DEV_IO_TRACE
         unsigned int btrace_seq;
 #endif
@@ -1317,7 +1317,8 @@ struct task_struct {
 /* Thread group tracking */
         u32 parent_exec_id;
         u32 self_exec_id;
-/* Protection of (de-)allocation: mm, files, fs, tty, keyrings */
+/* Protection of (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed,
+ * mempolicy */
         spinlock_t alloc_lock;
 
 #ifdef CONFIG_GENERIC_HARDIRQS
@@ -1385,8 +1386,7 @@ struct task_struct {
         cputime_t acct_timexpd; /* stime + utime since last update */
 #endif
 #ifdef CONFIG_CPUSETS
-        nodemask_t mems_allowed;
-        int cpuset_mems_generation;
+        nodemask_t mems_allowed;        /* Protected by alloc_lock */
         int cpuset_mem_spread_rotor;
 #endif
 #ifdef CONFIG_CGROUPS
@@ -1409,7 +1409,7 @@ struct task_struct {
         struct list_head perf_counter_list;
 #endif
 #ifdef CONFIG_NUMA
-        struct mempolicy *mempolicy;
+        struct mempolicy *mempolicy;    /* Protected by alloc_lock */
         short il_next;
 #endif
         atomic_t fs_excl;       /* holding fs exclusive resources */
@@ -1796,11 +1796,23 @@ extern unsigned int sysctl_sched_child_runs_first;
 extern unsigned int sysctl_sched_features;
 extern unsigned int sysctl_sched_migration_cost;
 extern unsigned int sysctl_sched_nr_migrate;
+extern unsigned int sysctl_timer_migration;
 
 int sched_nr_latency_handler(struct ctl_table *table, int write,
                 struct file *file, void __user *buffer, size_t *length,
                 loff_t *ppos);
 #endif
+#ifdef CONFIG_SCHED_DEBUG
+static inline unsigned int get_sysctl_timer_migration(void)
+{
+        return sysctl_timer_migration;
+}
+#else
+static inline unsigned int get_sysctl_timer_migration(void)
+{
+        return 1;
+}
+#endif
 extern unsigned int sysctl_sched_rt_period;
 extern int sysctl_sched_rt_runtime;
 
@@ -2212,6 +2224,12 @@ static inline int test_tsk_need_resched(struct task_struct *tsk)
         return unlikely(test_tsk_thread_flag(tsk,TIF_NEED_RESCHED));
 }
 
+static inline int restart_syscall(void)
+{
+        set_tsk_thread_flag(current, TIF_SIGPENDING);
+        return -ERESTARTNOINTR;
+}
+
 static inline int signal_pending(struct task_struct *p)
 {
         return unlikely(test_tsk_thread_flag(p,TIF_SIGPENDING));
diff --git a/include/linux/sctp.h b/include/linux/sctp.h
index c2731bfe04d8..b464b9d3d242 100644
--- a/include/linux/sctp.h
+++ b/include/linux/sctp.h
@@ -487,17 +487,17 @@ typedef enum {
          *
          * Value          Cause Code
          * ---------      ----------------
-         * 0x0100          Request to Delete Last Remaining IP Address.
-         * 0x0101          Operation Refused Due to Resource Shortage.
-         * 0x0102          Request to Delete Source IP Address.
-         * 0x0103          Association Aborted due to illegal ASCONF-ACK
-         * 0x0104          Request refused - no authorization.
+         * 0x00A0          Request to Delete Last Remaining IP Address.
+         * 0x00A1          Operation Refused Due to Resource Shortage.
+         * 0x00A2          Request to Delete Source IP Address.
+         * 0x00A3          Association Aborted due to illegal ASCONF-ACK
+         * 0x00A4          Request refused - no authorization.
          */
-        SCTP_ERROR_DEL_LAST_IP  = cpu_to_be16(0x0100),
-        SCTP_ERROR_RSRC_LOW     = cpu_to_be16(0x0101),
-        SCTP_ERROR_DEL_SRC_IP   = cpu_to_be16(0x0102),
-        SCTP_ERROR_ASCONF_ACK   = cpu_to_be16(0x0103),
-        SCTP_ERROR_REQ_REFUSED  = cpu_to_be16(0x0104),
+        SCTP_ERROR_DEL_LAST_IP  = cpu_to_be16(0x00A0),
+        SCTP_ERROR_RSRC_LOW     = cpu_to_be16(0x00A1),
+        SCTP_ERROR_DEL_SRC_IP   = cpu_to_be16(0x00A2),
+        SCTP_ERROR_ASCONF_ACK   = cpu_to_be16(0x00A3),
+        SCTP_ERROR_REQ_REFUSED  = cpu_to_be16(0x00A4),
 
         /* AUTH Section 4.  New Error Cause
          *
diff --git a/include/linux/section-names.h b/include/linux/section-names.h
deleted file mode 100644
index c956f4eb2adf..000000000000
--- a/include/linux/section-names.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __LINUX_SECTION_NAMES_H
-#define __LINUX_SECTION_NAMES_H
-
-#define HEAD_TEXT_SECTION .head.text
-
-#endif /* !__LINUX_SECTION_NAMES_H */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5fd389162f01..63ef24bc01d0 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -15,6 +15,7 @@
 #define _LINUX_SKBUFF_H
 
 #include <linux/kernel.h>
+#include <linux/kmemcheck.h>
 #include <linux/compiler.h>
 #include <linux/time.h>
 #include <linux/cache.h>
@@ -189,20 +190,23 @@ struct skb_shared_info {
         atomic_t        dataref;
         unsigned short  nr_frags;
         unsigned short  gso_size;
+#ifdef CONFIG_HAS_DMA
+        dma_addr_t      dma_head;
+#endif
         /* Warning: this field is not always filled in (UFO)! */
         unsigned short  gso_segs;
         unsigned short  gso_type;
         __be32          ip6_frag_id;
         union skb_shared_tx tx_flags;
-#ifdef CONFIG_HAS_DMA
-        unsigned int    num_dma_maps;
-#endif
         struct sk_buff  *frag_list;
         struct skb_shared_hwtstamps hwtstamps;
         skb_frag_t      frags[MAX_SKB_FRAGS];
 #ifdef CONFIG_HAS_DMA
-        dma_addr_t      dma_maps[MAX_SKB_FRAGS + 1];
+        dma_addr_t      dma_maps[MAX_SKB_FRAGS];
 #endif
+        /* Intermediate layers must ensure that destructor_arg
+         * remains valid until skb destructor */
+        void *          destructor_arg;
 };
 
 /* We divide dataref into two halves.  The higher 16 bits hold references
@@ -301,9 +305,6 @@ typedef unsigned char *sk_buff_data_t;
  *      @tc_verd: traffic control verdict
  *      @ndisc_nodetype: router type (from link layer)
  *      @do_not_encrypt: set to prevent encryption of this frame
- *      @requeue: set to indicate that the wireless core should attempt
- *              a software retry on this frame if we failed to
- *              receive an ACK for it
  *      @dma_cookie: a cookie to one of several possible DMA operations
  *              done by skb DMA functions
  *      @secmark: security marking
@@ -319,10 +320,7 @@ struct sk_buff {
         ktime_t                 tstamp;
         struct net_device       *dev;
 
-        union {
-                struct  dst_entry       *dst;
-                struct  rtable          *rtable;
-        };
+        unsigned long           _skb_dst;
 #ifdef CONFIG_XFRM
         struct  sec_path        *sp;
 #endif
@@ -346,6 +344,7 @@ struct sk_buff {
                 };
         };
         __u32                   priority;
+        kmemcheck_bitfield_begin(flags1);
         __u8                    local_df:1,
                                 cloned:1,
                                 ip_summed:2,
@@ -356,6 +355,7 @@ struct sk_buff {
                                 ipvs_property:1,
                                 peeked:1,
                                 nf_trace:1;
+        kmemcheck_bitfield_end(flags1);
         __be16                  protocol;
 
         void                    (*destructor)(struct sk_buff *skb);
@@ -375,13 +375,16 @@ struct sk_buff {
         __u16                   tc_verd;        /* traffic control verdict */
 #endif
 #endif
+
+        kmemcheck_bitfield_begin(flags2);
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
         __u8                    ndisc_nodetype:2;
 #endif
 #if defined(CONFIG_MAC80211) || defined(CONFIG_MAC80211_MODULE)
         __u8                    do_not_encrypt:1;
-        __u8                    requeue:1;
 #endif
+        kmemcheck_bitfield_end(flags2);
+
         /* 0/13/14 bit hole */
 
 #ifdef CONFIG_NET_DMA
@@ -423,6 +426,21 @@ extern void skb_dma_unmap(struct device *dev, struct sk_buff *skb,
                           enum dma_data_direction dir);
 #endif
 
+static inline struct dst_entry *skb_dst(const struct sk_buff *skb)
+{
+        return (struct dst_entry *)skb->_skb_dst;
+}
+
+static inline void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)
+{
+        skb->_skb_dst = (unsigned long)dst;
+}
+
+static inline struct rtable *skb_rtable(const struct sk_buff *skb)
+{
+        return (struct rtable *)skb_dst(skb);
+}
+
 extern void kfree_skb(struct sk_buff *skb);
 extern void consume_skb(struct sk_buff *skb);
 extern void            __kfree_skb(struct sk_buff *skb);
@@ -1062,7 +1080,7 @@ extern void skb_add_rx_frag(struct sk_buff *skb, int i, struct page *page,
                             int off, int size);
 
 #define SKB_PAGE_ASSERT(skb)    BUG_ON(skb_shinfo(skb)->nr_frags)
-#define SKB_FRAG_ASSERT(skb)    BUG_ON(skb_shinfo(skb)->frag_list)
+#define SKB_FRAG_ASSERT(skb)    BUG_ON(skb_has_frags(skb))
 #define SKB_LINEAR_ASSERT(skb)  BUG_ON(skb_is_nonlinear(skb))
 
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
@@ -1701,6 +1719,25 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len)
                      skb = skb->prev)
 
 
+static inline bool skb_has_frags(const struct sk_buff *skb)
+{
+        return skb_shinfo(skb)->frag_list != NULL;
+}
+
+static inline void skb_frag_list_init(struct sk_buff *skb)
+{
+        skb_shinfo(skb)->frag_list = NULL;
+}
+
+static inline void skb_frag_add_head(struct sk_buff *skb, struct sk_buff *frag)
+{
+        frag->next = skb_shinfo(skb)->frag_list;
+        skb_shinfo(skb)->frag_list = frag;
+}
+
+#define skb_walk_frags(skb, iter)       \
+        for (iter = skb_shinfo(skb)->frag_list; iter; iter = iter->next)
+
 extern struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
                                            int *peeked, int *err);
 extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
@@ -1715,8 +1752,14 @@ extern int	       skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
                                                         struct iovec *iov);
 extern int             skb_copy_datagram_from_iovec(struct sk_buff *skb,
                                                     int offset,
-                                                    struct iovec *from,
+                                                    const struct iovec *from,
+                                                    int from_offset,
                                                     int len);
+extern int             skb_copy_datagram_const_iovec(const struct sk_buff *from,
+                                                     int offset,
+                                                     const struct iovec *to,
+                                                     int to_offset,
+                                                     int size);
 extern void            skb_free_datagram(struct sock *sk, struct sk_buff *skb);
 extern int             skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
                                          unsigned int flags);
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 219b8fb4651d..2da8372519f5 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -64,6 +64,13 @@
 
 #define SLAB_NOLEAKTRACE        0x00800000UL    /* Avoid kmemleak tracing */
 
+/* Don't track use of uninitialized memory */
+#ifdef CONFIG_KMEMCHECK
+# define SLAB_NOTRACK           0x01000000UL
+#else
+# define SLAB_NOTRACK           0x00000000UL
+#endif
+
 /* The following flags affect the page allocator grouping pages by mobility */
 #define SLAB_RECLAIM_ACCOUNT    0x00020000UL            /* Objects are reclaimable */
 #define SLAB_TEMPORARY          SLAB_RECLAIM_ACCOUNT    /* Objects are short-lived */
diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
index 713f841ecaa9..850d057500de 100644
--- a/include/linux/slab_def.h
+++ b/include/linux/slab_def.h
@@ -16,6 +16,87 @@
 #include <linux/compiler.h>
 #include <linux/kmemtrace.h>
 
+/*
+ * struct kmem_cache
+ *
+ * manages a cache.
+ */
+
+struct kmem_cache {
+/* 1) per-cpu data, touched during every alloc/free */
+        struct array_cache *array[NR_CPUS];
+/* 2) Cache tunables. Protected by cache_chain_mutex */
+        unsigned int batchcount;
+        unsigned int limit;
+        unsigned int shared;
+
+        unsigned int buffer_size;
+        u32 reciprocal_buffer_size;
+/* 3) touched by every alloc & free from the backend */
+
+        unsigned int flags;             /* constant flags */
+        unsigned int num;               /* # of objs per slab */
+
+/* 4) cache_grow/shrink */
+        /* order of pgs per slab (2^n) */
+        unsigned int gfporder;
+
+        /* force GFP flags, e.g. GFP_DMA */
+        gfp_t gfpflags;
+
+        size_t colour;                  /* cache colouring range */
+        unsigned int colour_off;        /* colour offset */
+        struct kmem_cache *slabp_cache;
+        unsigned int slab_size;
+        unsigned int dflags;            /* dynamic flags */
+
+        /* constructor func */
+        void (*ctor)(void *obj);
+
+/* 5) cache creation/removal */
+        const char *name;
+        struct list_head next;
+
+/* 6) statistics */
+#ifdef CONFIG_DEBUG_SLAB
+        unsigned long num_active;
+        unsigned long num_allocations;
+        unsigned long high_mark;
+        unsigned long grown;
+        unsigned long reaped;
+        unsigned long errors;
+        unsigned long max_freeable;
+        unsigned long node_allocs;
+        unsigned long node_frees;
+        unsigned long node_overflow;
+        atomic_t allochit;
+        atomic_t allocmiss;
+        atomic_t freehit;
+        atomic_t freemiss;
+
+        /*
+         * If debugging is enabled, then the allocator can add additional
+         * fields and/or padding to every object. buffer_size contains the total
+         * object size including these internal fields, the following two
+         * variables contain the offset to the user object and its size.
+         */
+        int obj_offset;
+        int obj_size;
+#endif /* CONFIG_DEBUG_SLAB */
+
+        /*
+         * We put nodelists[] at the end of kmem_cache, because we want to size
+         * this array to nr_node_ids slots instead of MAX_NUMNODES
+         * (see kmem_cache_init())
+         * We still use [MAX_NUMNODES] and not [1] or [0] because cache_cache
+         * is statically defined, so we reserve the max number of nodes.
+         */
+        struct kmem_list3 *nodelists[MAX_NUMNODES];
+        /*
+         * Do not add fields after nodelists[]
+         */
+};
+
 /* Size description struct for general caches. */
 struct cache_sizes {
         size_t                  cs_size;
diff --git a/include/linux/smp.h b/include/linux/smp.h
index a69db820eed6..9e3d8af09207 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -177,7 +177,6 @@ static inline void init_call_single_data(void)
 
 #define get_cpu()               ({ preempt_disable(); smp_processor_id(); })
 #define put_cpu()               preempt_enable()
-#define put_cpu_no_resched()    preempt_enable_no_resched()
 
 /*
  * Callback to arch code if there's nosmp or maxcpus=0 on the
diff --git a/include/linux/smsc911x.h b/include/linux/smsc911x.h
index b32725075d71..5241e4fb4eca 100644
--- a/include/linux/smsc911x.h
+++ b/include/linux/smsc911x.h
@@ -47,4 +47,14 @@ struct smsc911x_platform_config {
 #define SMSC911X_FORCE_EXTERNAL_PHY             (BIT(3))
 #define SMSC911X_SAVE_MAC_ADDRESS               (BIT(4))
 
+/*
+ * SMSC911X_SWAP_FIFO:
+ * Enables software byte swap for fifo data. Should only be used as a
+ * "last resort" in the case of big endian mode on boards with incorrectly
+ * routed data bus to older devices such as LAN9118. Newer devices such as
+ * LAN9221 can handle this in hardware, there are registers to control
+ * this swapping but the driver doesn't currently use them.
+ */
+#define SMSC911X_SWAP_FIFO                      (BIT(5))
+
 #endif /* __LINUX_SMSC911X_H__ */
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index aee3f1e1d1ce..0f953fe40413 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -18,7 +18,7 @@
 enum
 {
         IPSTATS_MIB_NUM = 0,
-        IPSTATS_MIB_INRECEIVES,                 /* InReceives */
+        IPSTATS_MIB_INPKTS,                     /* InReceives */
         IPSTATS_MIB_INHDRERRORS,                /* InHdrErrors */
         IPSTATS_MIB_INTOOBIGERRORS,             /* InTooBigErrors */
         IPSTATS_MIB_INNOROUTES,                 /* InNoRoutes */
@@ -28,7 +28,7 @@ enum
         IPSTATS_MIB_INDISCARDS,                 /* InDiscards */
         IPSTATS_MIB_INDELIVERS,                 /* InDelivers */
         IPSTATS_MIB_OUTFORWDATAGRAMS,           /* OutForwDatagrams */
-        IPSTATS_MIB_OUTREQUESTS,                /* OutRequests */
+        IPSTATS_MIB_OUTPKTS,                    /* OutRequests */
         IPSTATS_MIB_OUTDISCARDS,                /* OutDiscards */
         IPSTATS_MIB_OUTNOROUTES,                /* OutNoRoutes */
         IPSTATS_MIB_REASMTIMEOUT,               /* ReasmTimeout */
@@ -42,6 +42,12 @@ enum
         IPSTATS_MIB_OUTMCASTPKTS,               /* OutMcastPkts */
         IPSTATS_MIB_INBCASTPKTS,                /* InBcastPkts */
         IPSTATS_MIB_OUTBCASTPKTS,               /* OutBcastPkts */
+        IPSTATS_MIB_INOCTETS,                   /* InOctets */
+        IPSTATS_MIB_OUTOCTETS,                  /* OutOctets */
+        IPSTATS_MIB_INMCASTOCTETS,              /* InMcastOctets */
+        IPSTATS_MIB_OUTMCASTOCTETS,             /* OutMcastOctets */
+        IPSTATS_MIB_INBCASTOCTETS,              /* InBcastOctets */
+        IPSTATS_MIB_OUTBCASTOCTETS,             /* OutBcastOctets */
         __IPSTATS_MIB_MAX
 };
 
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 421afb4d29b0..3b461dffe244 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -194,7 +194,8 @@ struct ucred {
 #define AF_RXRPC        33      /* RxRPC sockets                */
 #define AF_ISDN         34      /* mISDN sockets                */
 #define AF_PHONET       35      /* Phonet sockets               */
-#define AF_MAX          36      /* For now.. */
+#define AF_IEEE802154   36      /* IEEE802154 sockets           */
+#define AF_MAX          37      /* For now.. */
 
 /* Protocol families, same as address families. */
 #define PF_UNSPEC       AF_UNSPEC
@@ -233,6 +234,7 @@ struct ucred {
 #define PF_RXRPC        AF_RXRPC
 #define PF_ISDN         AF_ISDN
 #define PF_PHONET       AF_PHONET
+#define PF_IEEE802154   AF_IEEE802154
 #define PF_MAX          AF_MAX
 
 /* Maximum queue length specifiable by listen.  */
@@ -303,14 +305,15 @@ struct ucred {
 #define SOL_BLUETOOTH   274
 #define SOL_PNPIPE      275
 #define SOL_RDS         276
+#define SOL_IUCV        277
 
 /* IPX options */
 #define IPX_TYPE        1
 
 #ifdef __KERNEL__
 extern int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len);
-extern int memcpy_fromiovecend(unsigned char *kdata, struct iovec *iov, 
-                                int offset, int len);
+extern int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+                               int offset, int len);
 extern int csum_partial_copy_fromiovecend(unsigned char *kdata, 
                                           struct iovec *iov, 
                                           int offset, 
@@ -318,6 +321,8 @@ extern int csum_partial_copy_fromiovecend(unsigned char *kdata,
 
 extern int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode);
 extern int memcpy_toiovec(struct iovec *v, unsigned char *kdata, int len);
+extern int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
+                             int offset, int len);
 extern int move_addr_to_user(struct sockaddr *kaddr, int klen, void __user *uaddr, int __user *ulen);
 extern int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr *kaddr);
 extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
diff --git a/include/linux/spi/libertas_spi.h b/include/linux/spi/libertas_spi.h
index 79506f5f9e67..1b5d5384fcd3 100644
--- a/include/linux/spi/libertas_spi.h
+++ b/include/linux/spi/libertas_spi.h
@@ -22,9 +22,6 @@ struct libertas_spi_platform_data {
          * speed, you may want to use 0 here. */
         u16 use_dummy_writes;
 
-        /* GPIO number to use as chip select */
-        u16 gpio_cs;
-
         /* Board specific setup/teardown */
         int (*setup)(struct spi_device *spi);
         int (*teardown)(struct spi_device *spi);
diff --git a/include/linux/spi/wl12xx.h b/include/linux/spi/wl12xx.h
new file mode 100644
index 000000000000..11430cab2aad
--- /dev/null
+++ b/include/linux/spi/wl12xx.h
@@ -0,0 +1,31 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef _LINUX_SPI_WL12XX_H
+#define _LINUX_SPI_WL12XX_H
+
+struct wl12xx_platform_data {
+        void (*set_power)(bool enable);
+};
+
+#endif
diff --git a/include/linux/stacktrace.h b/include/linux/stacktrace.h
index 1a8cecc4f38c..51efbef38fb0 100644
--- a/include/linux/stacktrace.h
+++ b/include/linux/stacktrace.h
@@ -4,6 +4,8 @@
 struct task_struct;
 
 #ifdef CONFIG_STACKTRACE
+struct task_struct;
+
 struct stack_trace {
         unsigned int nr_entries, max_entries;
         unsigned long *entries;
@@ -11,6 +13,7 @@ struct stack_trace {
 };
 
 extern void save_stack_trace(struct stack_trace *trace);
+extern void save_stack_trace_bp(struct stack_trace *trace, unsigned long bp);
 extern void save_stack_trace_tsk(struct task_struct *tsk,
                                 struct stack_trace *trace);
 
diff --git a/include/linux/swap.h b/include/linux/swap.h
index d476aad3ff57..0cedf31af0b0 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -129,9 +129,10 @@ enum {
 
 #define SWAP_CLUSTER_MAX 32
 
-#define SWAP_MAP_MAX    0x7fff
-#define SWAP_MAP_BAD    0x8000
-
+#define SWAP_MAP_MAX    0x7ffe
+#define SWAP_MAP_BAD    0x7fff
+#define SWAP_HAS_CACHE  0x8000          /* There is a swap cache of entry. */
+#define SWAP_COUNT_MASK (~SWAP_HAS_CACHE)
 /*
  * The in-memory structure used to track swap areas.
  */
@@ -235,7 +236,6 @@ static inline int zone_reclaim(struct zone *z, gfp_t mask, unsigned int order)
 }
 #endif
 
-#ifdef CONFIG_UNEVICTABLE_LRU
 extern int page_evictable(struct page *page, struct vm_area_struct *vma);
 extern void scan_mapping_unevictable_pages(struct address_space *);
 
@@ -244,24 +244,6 @@ extern int scan_unevictable_handler(struct ctl_table *, int, struct file *,
                                         void __user *, size_t *, loff_t *);
 extern int scan_unevictable_register_node(struct node *node);
 extern void scan_unevictable_unregister_node(struct node *node);
-#else
-static inline int page_evictable(struct page *page,
-                                                struct vm_area_struct *vma)
-{
-        return 1;
-}
-
-static inline void scan_mapping_unevictable_pages(struct address_space *mapping)
-{
-}
-
-static inline int scan_unevictable_register_node(struct node *node)
-{
-        return 0;
-}
-
-static inline void scan_unevictable_unregister_node(struct node *node) { }
-#endif
 
 extern int kswapd_run(int nid);
 
@@ -274,7 +256,7 @@ extern void swap_unplug_io_fn(struct backing_dev_info *, struct page *);
 
 #ifdef CONFIG_SWAP
 /* linux/mm/page_io.c */
-extern int swap_readpage(struct file *, struct page *);
+extern int swap_readpage(struct page *);
 extern int swap_writepage(struct page *page, struct writeback_control *wbc);
 extern void end_swap_bio_read(struct bio *bio, int err);
 
@@ -300,9 +282,11 @@ extern long total_swap_pages;
 extern void si_swapinfo(struct sysinfo *);
 extern swp_entry_t get_swap_page(void);
 extern swp_entry_t get_swap_page_of_type(int);
-extern int swap_duplicate(swp_entry_t);
+extern void swap_duplicate(swp_entry_t);
+extern int swapcache_prepare(swp_entry_t);
 extern int valid_swaphandles(swp_entry_t, unsigned long *);
 extern void swap_free(swp_entry_t);
+extern void swapcache_free(swp_entry_t, struct page *page);
 extern int free_swap_and_cache(swp_entry_t);
 extern int swap_type_of(dev_t, sector_t, struct block_device **);
 extern unsigned int count_swap_pages(int, int);
@@ -370,12 +354,20 @@ static inline void show_swap_cache_info(void)
 }
 
 #define free_swap_and_cache(swp)        is_migration_entry(swp)
-#define swap_duplicate(swp)             is_migration_entry(swp)
+#define swapcache_prepare(swp)          is_migration_entry(swp)
+
+static inline void swap_duplicate(swp_entry_t swp)
+{
+}
 
 static inline void swap_free(swp_entry_t swp)
 {
 }
 
+static inline void swapcache_free(swp_entry_t swp, struct page *page)
+{
+}
+
 static inline struct page *swapin_readahead(swp_entry_t swp, gfp_t gfp_mask,
                         struct vm_area_struct *vma, unsigned long addr)
 {
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 418d90f5effe..fa4242cdade8 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -434,6 +434,7 @@ asmlinkage long sys_fcntl(unsigned int fd, unsigned int cmd, unsigned long arg);
 asmlinkage long sys_fcntl64(unsigned int fd,
                                 unsigned int cmd, unsigned long arg);
 #endif
+asmlinkage long sys_pipe(int __user *fildes);
 asmlinkage long sys_pipe2(int __user *fildes, int flags);
 asmlinkage long sys_dup(unsigned int fildes);
 asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd);
@@ -751,8 +752,6 @@ asmlinkage long sys_pselect6(int, fd_set __user *, fd_set __user *,
 asmlinkage long sys_ppoll(struct pollfd __user *, unsigned int,
                           struct timespec __user *, const sigset_t __user *,
                           size_t);
-asmlinkage long sys_pipe2(int __user *, int);
-asmlinkage long sys_pipe(int __user *);
 
 int kernel_execve(const char *filename, char *const argv[], char *const envp[]);
 
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 9d5078bd23a3..8afac76cd748 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -377,7 +377,7 @@ struct tcp_sock {
         unsigned int            keepalive_time;   /* time before keep alive takes place */
         unsigned int            keepalive_intvl;  /* time interval between keep alive probes */
 
-        unsigned long last_synq_overflow; 
+        int                     linger2;
 
 /* Receiver side RTT estimation */
         struct {
@@ -406,8 +406,6 @@ struct tcp_sock {
 /* TCP MD5 Signagure Option information */
         struct tcp_md5sig_info  *md5sig_info;
 #endif
-
-        int                     linger2;
 };
 
 static inline struct tcp_sock *tcp_sk(const struct sock *sk)
diff --git a/include/linux/tick.h b/include/linux/tick.h
index 469b82d88b3b..0482229c07db 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -97,10 +97,12 @@ extern void tick_clock_notify(void);
 extern int tick_check_oneshot_change(int allow_nohz);
 extern struct tick_sched *tick_get_tick_sched(int cpu);
 extern void tick_check_idle(int cpu);
+extern int tick_oneshot_mode_active(void);
 # else
 static inline void tick_clock_notify(void) { }
 static inline int tick_check_oneshot_change(int allow_nohz) { return 0; }
 static inline void tick_check_idle(int cpu) { }
+static inline int tick_oneshot_mode_active(void) { return 0; }
 # endif
 
 #else /* CONFIG_GENERIC_CLOCKEVENTS */
@@ -109,6 +111,7 @@ static inline void tick_cancel_sched_timer(int cpu) { }
 static inline void tick_clock_notify(void) { }
 static inline int tick_check_oneshot_change(int allow_nohz) { return 0; }
 static inline void tick_check_idle(int cpu) { }
+static inline int tick_oneshot_mode_active(void) { return 0; }
 #endif /* !CONFIG_GENERIC_CLOCKEVENTS */
 
 # ifdef CONFIG_NO_HZ
diff --git a/include/linux/timer.h b/include/linux/timer.h
index 6cdb6f3331f1..ccf882eed8f8 100644
--- a/include/linux/timer.h
+++ b/include/linux/timer.h
@@ -163,7 +163,10 @@ extern void add_timer_on(struct timer_list *timer, int cpu);
 extern int del_timer(struct timer_list * timer);
 extern int mod_timer(struct timer_list *timer, unsigned long expires);
 extern int mod_timer_pending(struct timer_list *timer, unsigned long expires);
+extern int mod_timer_pinned(struct timer_list *timer, unsigned long expires);
 
+#define TIMER_NOT_PINNED        0
+#define TIMER_PINNED            1
 /*
  * The jiffies value which is added to now, when there is no timer
  * in the timer wheel:
diff --git a/include/linux/timex.h b/include/linux/timex.h
index aa3475fcff64..e6967d10d9e5 100644
--- a/include/linux/timex.h
+++ b/include/linux/timex.h
@@ -170,17 +170,37 @@ struct timex {
 #include <asm/timex.h>
 
 /*
- * SHIFT_KG and SHIFT_KF establish the damping of the PLL and are chosen
- * for a slightly underdamped convergence characteristic. SHIFT_KH
- * establishes the damping of the FLL and is chosen by wisdom and black
- * art.
+ * SHIFT_PLL is used as a dampening factor to define how much we
+ * adjust the frequency correction for a given offset in PLL mode.
+ * It also used in dampening the offset correction, to define how
+ * much of the current value in time_offset we correct for each
+ * second. Changing this value changes the stiffness of the ntp
+ * adjustment code. A lower value makes it more flexible, reducing
+ * NTP convergence time. A higher value makes it stiffer, increasing
+ * convergence time, but making the clock more stable.
  *
- * MAXTC establishes the maximum time constant of the PLL. With the
- * SHIFT_KG and SHIFT_KF values given and a time constant range from
- * zero to MAXTC, the PLL will converge in 15 minutes to 16 hours,
- * respectively.
+ * In David Mills' nanokernel reference implementation SHIFT_PLL is 4.
+ * However this seems to increase convergence time much too long.
+ *
+ * https://lists.ntp.org/pipermail/hackers/2008-January/003487.html
+ *
+ * In the above mailing list discussion, it seems the value of 4
+ * was appropriate for other Unix systems with HZ=100, and that
+ * SHIFT_PLL should be decreased as HZ increases. However, Linux's
+ * clock steering implementation is HZ independent.
+ *
+ * Through experimentation, a SHIFT_PLL value of 2 was found to allow
+ * for fast convergence (very similar to the NTPv3 code used prior to
+ * v2.6.19), with good clock stability.
+ *
+ *
+ * SHIFT_FLL is used as a dampening factor to define how much we
+ * adjust the frequency correction for a given offset in FLL mode.
+ * In David Mills' nanokernel reference implementation SHIFT_FLL is 2.
+ *
+ * MAXTC establishes the maximum time constant of the PLL.
  */
-#define SHIFT_PLL       4       /* PLL frequency factor (shift) */
+#define SHIFT_PLL       2       /* PLL frequency factor (shift) */
 #define SHIFT_FLL       2       /* FLL frequency factor (shift) */
 #define MAXTC           10      /* maximum time constant (shift) */
 
@@ -192,10 +212,10 @@ struct timex {
 #define SHIFT_USEC 16           /* frequency offset scale (shift) */
 #define PPM_SCALE ((s64)NSEC_PER_USEC << (NTP_SCALE_SHIFT - SHIFT_USEC))
 #define PPM_SCALE_INV_SHIFT 19
-#define PPM_SCALE_INV ((1ll << (PPM_SCALE_INV_SHIFT + NTP_SCALE_SHIFT)) / \
+#define PPM_SCALE_INV ((1LL << (PPM_SCALE_INV_SHIFT + NTP_SCALE_SHIFT)) / \
                        PPM_SCALE + 1)
 
-#define MAXPHASE 500000000l     /* max phase error (ns) */
+#define MAXPHASE 500000000L     /* max phase error (ns) */
 #define MAXFREQ 500000          /* max frequency error (ns/s) */
 #define MAXFREQ_SCALED ((s64)MAXFREQ << NTP_SCALE_SHIFT)
 #define MINSEC 256              /* min interval between updates (s) */
@@ -260,6 +280,9 @@ extern int do_adjtimex(struct timex *);
 
 int read_current_timer(unsigned long *timer_val);
 
+/* The clock frequency of the i8253/i8254 PIT */
+#define PIT_TICK_RATE 1193182ul
+
 #endif /* KERNEL */
 
 #endif /* LINUX_TIMEX_H */
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 14df7e635d43..b9dc4ca0246f 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -198,7 +198,7 @@ static inline void tracepoint_synchronize_unregister(void)
  *      * This is how the trace record is structured and will
  *      * be saved into the ring buffer. These are the fields
  *      * that will be exposed to user-space in
- *      * /debug/tracing/events/<*>/format.
+ *      * /sys/kernel/debug/tracing/events/<*>/format.
  *      *
  *      * The declared 'local variable' is called '__entry'
  *      *
@@ -258,7 +258,7 @@ static inline void tracepoint_synchronize_unregister(void)
  * tracepoint callback (this is used by programmatic plugins and
  * can also by used by generic instrumentation like SystemTap), and
  * it is also used to expose a structured trace record in
- * /debug/tracing/events/.
+ * /sys/kernel/debug/tracing/events/.
  */
 
 #define TRACE_EVENT(name, proto, args, struct, assign, print)   \
diff --git a/include/linux/ultrasound.h b/include/linux/ultrasound.h
index 6b7703e75cec..71339dc531c5 100644
--- a/include/linux/ultrasound.h
+++ b/include/linux/ultrasound.h
@@ -34,7 +34,7 @@
  *              _GUS_VOICEOFF   - Stops voice (no parameters)
  *              _GUS_VOICEFADE  - Stops the voice smoothly.
  *              _GUS_VOICEMODE  - Alters the voice mode, don't start or stop voice (P1=voice mode)
- *              _GUS_VOICEBALA  - Sets voice balence (P1, 0=left, 7=middle and 15=right, default 7)
+ *              _GUS_VOICEBALA  - Sets voice balance (P1, 0=left, 7=middle and 15=right, default 7)
  *              _GUS_VOICEFREQ  - Sets voice (sample) playback frequency (P1=Hz)
  *              _GUS_VOICEVOL   - Sets voice volume (P1=volume, 0xfff=max, 0xeff=half, 0x000=off)
  *              _GUS_VOICEVOL2  - Sets voice volume (P1=volume, 0xfff=max, 0xeff=half, 0x000=off)
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 3aa2cd1f8d08..84929e914034 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -36,6 +36,7 @@ struct wusb_dev;
  *  - configs have one (often) or more interfaces;
  *  - interfaces have one (usually) or more settings;
  *  - each interface setting has zero or (usually) more endpoints.
+ *  - a SuperSpeed endpoint has a companion descriptor
  *
  * And there might be other descriptors mixed in with those.
  *
@@ -44,6 +45,19 @@ struct wusb_dev;
 
 struct ep_device;
 
+/* For SS devices */
+/**
+ * struct usb_host_ss_ep_comp - Valid for SuperSpeed devices only
+ * @desc: endpoint companion descriptor, wMaxPacketSize in native byteorder
+ * @extra: descriptors following this endpoint companion descriptor
+ * @extralen: how many bytes of "extra" are valid
+ */
+struct usb_host_ss_ep_comp {
+        struct usb_ss_ep_comp_descriptor        desc;
+        unsigned char                           *extra;   /* Extra descriptors */
+        int                                     extralen;
+};
+
 /**
  * struct usb_host_endpoint - host-side endpoint descriptor and queue
  * @desc: descriptor for this endpoint, wMaxPacketSize in native byteorder
@@ -51,6 +65,7 @@ struct ep_device;
  * @hcpriv: for use by HCD; typically holds hardware dma queue head (QH)
  *      with one or more transfer descriptors (TDs) per urb
  * @ep_dev: ep_device for sysfs info
+ * @ss_ep_comp: companion descriptor information for this endpoint
  * @extra: descriptors following this endpoint in the configuration
  * @extralen: how many bytes of "extra" are valid
  * @enabled: URBs may be submitted to this endpoint
@@ -63,6 +78,7 @@ struct usb_host_endpoint {
         struct list_head                urb_list;
         void                            *hcpriv;
         struct ep_device                *ep_dev;        /* For sysfs info */
+        struct usb_host_ss_ep_comp      *ss_ep_comp;    /* For SS devices */
 
         unsigned char *extra;   /* Extra descriptors */
         int extralen;
@@ -336,7 +352,6 @@ struct usb_bus {
 #ifdef CONFIG_USB_DEVICEFS
         struct dentry *usbfs_dentry;    /* usbfs dentry entry for the bus */
 #endif
-        struct device *dev;             /* device for this bus */
 
 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
         struct mon_bus *mon_bus;        /* non-null when associated */
@@ -363,6 +378,7 @@ struct usb_tt;
  * struct usb_device - kernel's representation of a USB device
  * @devnum: device number; address on a USB bus
  * @devpath: device ID string for use in messages (e.g., /port/...)
+ * @route: tree topology hex string for use with xHCI
  * @state: device state: configured, not attached, etc.
  * @speed: device speed: high/full/low (or error)
  * @tt: Transaction Translator info; used with low/full speed dev, highspeed hub
@@ -420,6 +436,7 @@ struct usb_tt;
  * @skip_sys_resume: skip the next system resume
  * @wusb_dev: if this is a Wireless USB device, link to the WUSB
  *      specific data for the device.
+ * @slot_id: Slot ID assigned by xHCI
  *
  * Notes:
  * Usbcore drivers should not set usbdev->state directly.  Instead use
@@ -428,6 +445,7 @@ struct usb_tt;
 struct usb_device {
         int             devnum;
         char            devpath [16];
+        u32             route;
         enum usb_device_state   state;
         enum usb_device_speed   speed;
 
@@ -503,6 +521,7 @@ struct usb_device {
         unsigned skip_sys_resume:1;
 #endif
         struct wusb_dev *wusb_dev;
+        int slot_id;
 };
 #define to_usb_device(d) container_of(d, struct usb_device, dev)
 
@@ -869,6 +888,8 @@ struct usb_driver {
  * struct usb_device_driver - identifies USB device driver to usbcore
  * @name: The driver name should be unique among USB drivers,
  *      and should normally be the same as the module name.
+ * @nodename: Callback to provide a naming hint for a possible
+ *      device node to create.
  * @probe: Called to see if the driver is willing to manage a particular
  *      device.  If it is, probe returns zero and uses dev_set_drvdata()
  *      to associate driver-specific data with the device.  If unwilling
@@ -912,6 +933,7 @@ extern struct bus_type usb_bus_type;
  */
 struct usb_class_driver {
         char *name;
+        char *(*nodename)(struct device *dev);
         const struct file_operations *fops;
         int minor_base;
 };
@@ -1041,7 +1063,9 @@ typedef void (*usb_complete_t)(struct urb *);
  * @setup_dma: For control transfers with URB_NO_SETUP_DMA_MAP set, the
  *      device driver has provided this DMA address for the setup packet.
  *      The host controller driver should use this in preference to
- *      setup_packet.
+ *      setup_packet, but the HCD may chose to ignore the address if it must
+ *      copy the setup packet into internal structures.  Therefore, setup_packet
+ *      must always point to a valid buffer.
  * @start_frame: Returns the initial frame for isochronous transfers.
  * @number_of_packets: Lists the number of ISO transfer buffers.
  * @interval: Specifies the polling interval for interrupt or isochronous
@@ -1177,6 +1201,8 @@ struct urb {
         unsigned int transfer_flags;    /* (in) URB_SHORT_NOT_OK | ...*/
         void *transfer_buffer;          /* (in) associated data buffer */
         dma_addr_t transfer_dma;        /* (in) dma addr for transfer_buffer */
+        struct usb_sg_request *sg;      /* (in) scatter gather buffer list */
+        int num_sgs;                    /* (in) number of entries in the sg list */
         u32 transfer_buffer_length;     /* (in) data buffer length */
         u32 actual_length;              /* (return) actual transfer length */
         unsigned char *setup_packet;    /* (in) setup packet (control only) */
@@ -1422,8 +1448,8 @@ struct usb_sg_request {
         int                     status;
         size_t                  bytes;
 
-        /*
-         * members below are private: to usbcore,
+        /* private:
+         * members below are private to usbcore,
          * and are not provided for driver access!
          */
         spinlock_t              lock;
@@ -1558,6 +1584,9 @@ extern void usb_unregister_notify(struct notifier_block *nb);
 #define err(format, arg...) printk(KERN_ERR KBUILD_MODNAME ": " \
         format "\n" , ## arg)
 
+/* debugfs stuff */
+extern struct dentry *usb_debug_root;
+
 #endif  /* __KERNEL__ */
 
 #endif
diff --git a/include/linux/usb/audio.h b/include/linux/usb/audio.h
index 8cb025fef634..b5744bc218ab 100644
--- a/include/linux/usb/audio.h
+++ b/include/linux/usb/audio.h
@@ -24,10 +24,75 @@
 #define USB_SUBCLASS_AUDIOCONTROL       0x01
 #define USB_SUBCLASS_AUDIOSTREAMING     0x02
 #define USB_SUBCLASS_MIDISTREAMING      0x03
+#define USB_SUBCLASS_VENDOR_SPEC        0xff
 
+/* A.5 Audio Class-Specific AC interface Descriptor Subtypes*/
+#define HEADER                          0x01
+#define INPUT_TERMINAL                  0x02
+#define OUTPUT_TERMINAL                 0x03
+#define MIXER_UNIT                      0x04
+#define SELECTOR_UNIT                   0x05
+#define FEATURE_UNIT                    0x06
+#define PROCESSING_UNIT                 0x07
+#define EXTENSION_UNIT                  0x08
+
+#define AS_GENERAL                      0x01
+#define FORMAT_TYPE                     0x02
+#define FORMAT_SPECIFIC                 0x03
+
+#define EP_GENERAL                      0x01
+
+#define MS_GENERAL                      0x01
+#define MIDI_IN_JACK                    0x02
+#define MIDI_OUT_JACK                   0x03
+
+/* endpoint attributes */
+#define EP_ATTR_MASK                    0x0c
+#define EP_ATTR_ASYNC                   0x04
+#define EP_ATTR_ADAPTIVE                0x08
+#define EP_ATTR_SYNC                    0x0c
+
+/* cs endpoint attributes */
+#define EP_CS_ATTR_SAMPLE_RATE          0x01
+#define EP_CS_ATTR_PITCH_CONTROL        0x02
+#define EP_CS_ATTR_FILL_MAX             0x80
+
+/* Audio Class specific Request Codes */
+#define USB_AUDIO_SET_INTF              0x21
+#define USB_AUDIO_SET_ENDPOINT          0x22
+#define USB_AUDIO_GET_INTF              0xa1
+#define USB_AUDIO_GET_ENDPOINT          0xa2
+
+#define SET_    0x00
+#define GET_    0x80
+
+#define _CUR    0x1
+#define _MIN    0x2
+#define _MAX    0x3
+#define _RES    0x4
+#define _MEM    0x5
+
+#define SET_CUR         (SET_ | _CUR)
+#define GET_CUR         (GET_ | _CUR)
+#define SET_MIN         (SET_ | _MIN)
+#define GET_MIN         (GET_ | _MIN)
+#define SET_MAX         (SET_ | _MAX)
+#define GET_MAX         (GET_ | _MAX)
+#define SET_RES         (SET_ | _RES)
+#define GET_RES         (GET_ | _RES)
+#define SET_MEM         (SET_ | _MEM)
+#define GET_MEM         (GET_ | _MEM)
+
+#define GET_STAT        0xff
+
+#define USB_AC_TERMINAL_UNDEFINED       0x100
+#define USB_AC_TERMINAL_STREAMING       0x101
+#define USB_AC_TERMINAL_VENDOR_SPEC     0x1FF
+
+/* Terminal Control Selectors */
 /* 4.3.2  Class-Specific AC Interface Descriptor */
 struct usb_ac_header_descriptor {
-        __u8  bLength;                  /* 8+n */
+        __u8  bLength;                  /* 8 + n */
         __u8  bDescriptorType;          /* USB_DT_CS_INTERFACE */
         __u8  bDescriptorSubtype;       /* USB_MS_HEADER */
         __le16 bcdADC;                  /* 0x0100 */
@@ -36,7 +101,7 @@ struct usb_ac_header_descriptor {
         __u8  baInterfaceNr[];          /* [n] */
 } __attribute__ ((packed));
 
-#define USB_DT_AC_HEADER_SIZE(n)        (8+(n))
+#define USB_DT_AC_HEADER_SIZE(n)        (8 + (n))
 
 /* As above, but more useful for defining your own descriptors: */
 #define DECLARE_USB_AC_HEADER_DESCRIPTOR(n)                     \
@@ -50,4 +115,200 @@ struct usb_ac_header_descriptor_##n {				\
         __u8  baInterfaceNr[n];                                 \
 } __attribute__ ((packed))
 
+/* 4.3.2.1 Input Terminal Descriptor */
+struct usb_input_terminal_descriptor {
+        __u8  bLength;                  /* in bytes: 12 */
+        __u8  bDescriptorType;          /* CS_INTERFACE descriptor type */
+        __u8  bDescriptorSubtype;       /* INPUT_TERMINAL descriptor subtype */
+        __u8  bTerminalID;              /* Constant uniquely terminal ID */
+        __le16 wTerminalType;           /* USB Audio Terminal Types */
+        __u8  bAssocTerminal;           /* ID of the Output Terminal associated */
+        __u8  bNrChannels;              /* Number of logical output channels */
+        __le16 wChannelConfig;
+        __u8  iChannelNames;
+        __u8  iTerminal;
+} __attribute__ ((packed));
+
+#define USB_DT_AC_INPUT_TERMINAL_SIZE                   12
+
+#define USB_AC_INPUT_TERMINAL_UNDEFINED                 0x200
+#define USB_AC_INPUT_TERMINAL_MICROPHONE                0x201
+#define USB_AC_INPUT_TERMINAL_DESKTOP_MICROPHONE        0x202
+#define USB_AC_INPUT_TERMINAL_PERSONAL_MICROPHONE       0x203
+#define USB_AC_INPUT_TERMINAL_OMNI_DIR_MICROPHONE       0x204
+#define USB_AC_INPUT_TERMINAL_MICROPHONE_ARRAY          0x205
+#define USB_AC_INPUT_TERMINAL_PROC_MICROPHONE_ARRAY     0x206
+
+/* 4.3.2.2 Output Terminal Descriptor */
+struct usb_output_terminal_descriptor {
+        __u8  bLength;                  /* in bytes: 9 */
+        __u8  bDescriptorType;          /* CS_INTERFACE descriptor type */
+        __u8  bDescriptorSubtype;       /* OUTPUT_TERMINAL descriptor subtype */
+        __u8  bTerminalID;              /* Constant uniquely terminal ID */
+        __le16 wTerminalType;           /* USB Audio Terminal Types */
+        __u8  bAssocTerminal;           /* ID of the Input Terminal associated */
+        __u8  bSourceID;                /* ID of the connected Unit or Terminal*/
+        __u8  iTerminal;
+} __attribute__ ((packed));
+
+#define USB_DT_AC_OUTPUT_TERMINAL_SIZE                          9
+
+#define USB_AC_OUTPUT_TERMINAL_UNDEFINED                        0x300
+#define USB_AC_OUTPUT_TERMINAL_SPEAKER                          0x301
+#define USB_AC_OUTPUT_TERMINAL_HEADPHONES                       0x302
+#define USB_AC_OUTPUT_TERMINAL_HEAD_MOUNTED_DISPLAY_AUDIO       0x303
+#define USB_AC_OUTPUT_TERMINAL_DESKTOP_SPEAKER                  0x304
+#define USB_AC_OUTPUT_TERMINAL_ROOM_SPEAKER                     0x305
+#define USB_AC_OUTPUT_TERMINAL_COMMUNICATION_SPEAKER            0x306
+#define USB_AC_OUTPUT_TERMINAL_LOW_FREQ_EFFECTS_SPEAKER         0x307
+
+/* Set bControlSize = 2 as default setting */
+#define USB_DT_AC_FEATURE_UNIT_SIZE(ch)         (7 + ((ch) + 1) * 2)
+
+/* As above, but more useful for defining your own descriptors: */
+#define DECLARE_USB_AC_FEATURE_UNIT_DESCRIPTOR(ch)              \
+struct usb_ac_feature_unit_descriptor_##ch {                    \
+        __u8  bLength;                                          \
+        __u8  bDescriptorType;                                  \
+        __u8  bDescriptorSubtype;                               \
+        __u8  bUnitID;                                          \
+        __u8  bSourceID;                                        \
+        __u8  bControlSize;                                     \
+        __le16 bmaControls[ch + 1];                             \
+        __u8  iFeature;                                         \
+} __attribute__ ((packed))
+
+/* 4.5.2 Class-Specific AS Interface Descriptor */
+struct usb_as_header_descriptor {
+        __u8  bLength;                  /* in bytes: 7 */
+        __u8  bDescriptorType;          /* USB_DT_CS_INTERFACE */
+        __u8  bDescriptorSubtype;       /* AS_GENERAL */
+        __u8  bTerminalLink;            /* Terminal ID of connected Terminal */
+        __u8  bDelay;                   /* Delay introduced by the data path */
+        __le16 wFormatTag;              /* The Audio Data Format */
+} __attribute__ ((packed));
+
+#define USB_DT_AS_HEADER_SIZE           7
+
+#define USB_AS_AUDIO_FORMAT_TYPE_I_UNDEFINED    0x0
+#define USB_AS_AUDIO_FORMAT_TYPE_I_PCM          0x1
+#define USB_AS_AUDIO_FORMAT_TYPE_I_PCM8         0x2
+#define USB_AS_AUDIO_FORMAT_TYPE_I_IEEE_FLOAT   0x3
+#define USB_AS_AUDIO_FORMAT_TYPE_I_ALAW         0x4
+#define USB_AS_AUDIO_FORMAT_TYPE_I_MULAW        0x5
+
+struct usb_as_format_type_i_continuous_descriptor {
+        __u8  bLength;                  /* in bytes: 8 + (ns * 3) */
+        __u8  bDescriptorType;          /* USB_DT_CS_INTERFACE */
+        __u8  bDescriptorSubtype;       /* FORMAT_TYPE */
+        __u8  bFormatType;              /* FORMAT_TYPE_1 */
+        __u8  bNrChannels;              /* physical channels in the stream */
+        __u8  bSubframeSize;            /* */
+        __u8  bBitResolution;
+        __u8  bSamFreqType;
+        __u8  tLowerSamFreq[3];
+        __u8  tUpperSamFreq[3];
+} __attribute__ ((packed));
+
+#define USB_AS_FORMAT_TYPE_I_CONTINUOUS_DESC_SIZE       14
+
+struct usb_as_formate_type_i_discrete_descriptor {
+        __u8  bLength;                  /* in bytes: 8 + (ns * 3) */
+        __u8  bDescriptorType;          /* USB_DT_CS_INTERFACE */
+        __u8  bDescriptorSubtype;       /* FORMAT_TYPE */
+        __u8  bFormatType;              /* FORMAT_TYPE_1 */
+        __u8  bNrChannels;              /* physical channels in the stream */
+        __u8  bSubframeSize;            /* */
+        __u8  bBitResolution;
+        __u8  bSamFreqType;
+        __u8  tSamFreq[][3];
+} __attribute__ ((packed));
+
+#define DECLARE_USB_AS_FORMAT_TYPE_I_DISCRETE_DESC(n)           \
+struct usb_as_formate_type_i_discrete_descriptor_##n {          \
+        __u8  bLength;                                          \
+        __u8  bDescriptorType;                                  \
+        __u8  bDescriptorSubtype;                               \
+        __u8  bFormatType;                                      \
+        __u8  bNrChannels;                                      \
+        __u8  bSubframeSize;                                    \
+        __u8  bBitResolution;                                   \
+        __u8  bSamFreqType;                                     \
+        __u8  tSamFreq[n][3];                                   \
+} __attribute__ ((packed))
+
+#define USB_AS_FORMAT_TYPE_I_DISCRETE_DESC_SIZE(n)      (8 + (n * 3))
+
+#define USB_AS_FORMAT_TYPE_UNDEFINED    0x0
+#define USB_AS_FORMAT_TYPE_I            0x1
+#define USB_AS_FORMAT_TYPE_II           0x2
+#define USB_AS_FORMAT_TYPE_III          0x3
+
+#define USB_AS_ENDPOINT_ASYNC           (1 << 2)
+#define USB_AS_ENDPOINT_ADAPTIVE        (2 << 2)
+#define USB_AS_ENDPOINT_SYNC            (3 << 2)
+
+struct usb_as_iso_endpoint_descriptor {
+        __u8  bLength;                  /* in bytes: 7 */
+        __u8  bDescriptorType;          /* USB_DT_CS_ENDPOINT */
+        __u8  bDescriptorSubtype;       /* EP_GENERAL */
+        __u8  bmAttributes;
+        __u8  bLockDelayUnits;
+        __le16 wLockDelay;
+};
+#define USB_AS_ISO_ENDPOINT_DESC_SIZE   7
+
+#define FU_CONTROL_UNDEFINED            0x00
+#define MUTE_CONTROL                    0x01
+#define VOLUME_CONTROL                  0x02
+#define BASS_CONTROL                    0x03
+#define MID_CONTROL                     0x04
+#define TREBLE_CONTROL                  0x05
+#define GRAPHIC_EQUALIZER_CONTROL       0x06
+#define AUTOMATIC_GAIN_CONTROL          0x07
+#define DELAY_CONTROL                   0x08
+#define BASS_BOOST_CONTROL              0x09
+#define LOUDNESS_CONTROL                0x0a
+
+#define FU_MUTE         (1 << (MUTE_CONTROL - 1))
+#define FU_VOLUME       (1 << (VOLUME_CONTROL - 1))
+#define FU_BASS         (1 << (BASS_CONTROL - 1))
+#define FU_MID          (1 << (MID_CONTROL - 1))
+#define FU_TREBLE       (1 << (TREBLE_CONTROL - 1))
+#define FU_GRAPHIC_EQ   (1 << (GRAPHIC_EQUALIZER_CONTROL - 1))
+#define FU_AUTO_GAIN    (1 << (AUTOMATIC_GAIN_CONTROL - 1))
+#define FU_DELAY        (1 << (DELAY_CONTROL - 1))
+#define FU_BASS_BOOST   (1 << (BASS_BOOST_CONTROL - 1))
+#define FU_LOUDNESS     (1 << (LOUDNESS_CONTROL - 1))
+
+struct usb_audio_control {
+        struct list_head list;
+        const char *name;
+        u8 type;
+        int data[5];
+        int (*set)(struct usb_audio_control *con, u8 cmd, int value);
+        int (*get)(struct usb_audio_control *con, u8 cmd);
+};
+
+static inline int generic_set_cmd(struct usb_audio_control *con, u8 cmd, int value)
+{
+        con->data[cmd] = value;
+
+        return 0;
+}
+
+static inline int generic_get_cmd(struct usb_audio_control *con, u8 cmd)
+{
+        return con->data[cmd];
+}
+
+struct usb_audio_control_selector {
+        struct list_head list;
+        struct list_head control;
+        u8 id;
+        const char *name;
+        u8 type;
+        struct usb_descriptor_header *desc;
+};
+
 #endif /* __LINUX_USB_AUDIO_H */
diff --git a/include/linux/usb/ch9.h b/include/linux/usb/ch9.h
index b145119a90da..93223638f702 100644
--- a/include/linux/usb/ch9.h
+++ b/include/linux/usb/ch9.h
@@ -191,6 +191,8 @@ struct usb_ctrlrequest {
 #define USB_DT_WIRE_ADAPTER             0x21
 #define USB_DT_RPIPE                    0x22
 #define USB_DT_CS_RADIO_CONTROL         0x23
+/* From the USB 3.0 spec */
+#define USB_DT_SS_ENDPOINT_COMP         0x30
 
 /* Conventional codes for class-specific descriptors.  The convention is
  * defined in the USB "Common Class" Spec (3.11).  Individual class specs
@@ -535,6 +537,20 @@ static inline int usb_endpoint_is_isoc_out(
 
 /*-------------------------------------------------------------------------*/
 
+/* USB_DT_SS_ENDPOINT_COMP: SuperSpeed Endpoint Companion descriptor */
+struct usb_ss_ep_comp_descriptor {
+        __u8  bLength;
+        __u8  bDescriptorType;
+
+        __u8  bMaxBurst;
+        __u8  bmAttributes;
+        __u16 wBytesPerInterval;
+} __attribute__ ((packed));
+
+#define USB_DT_SS_EP_COMP_SIZE          6
+
+/*-------------------------------------------------------------------------*/
+
 /* USB_DT_DEVICE_QUALIFIER: Device Qualifier descriptor */
 struct usb_qualifier_descriptor {
         __u8  bLength;
@@ -752,6 +768,7 @@ enum usb_device_speed {
         USB_SPEED_LOW, USB_SPEED_FULL,          /* usb 1.1 */
         USB_SPEED_HIGH,                         /* usb 2.0 */
         USB_SPEED_VARIABLE,                     /* wireless (usb 2.5) */
+        USB_SPEED_SUPER,                        /* usb 3.0 */
 };
 
 enum usb_device_state {
diff --git a/include/linux/usb/composite.h b/include/linux/usb/composite.h
index acd7b0f06c8a..4f6bb3d2160e 100644
--- a/include/linux/usb/composite.h
+++ b/include/linux/usb/composite.h
@@ -124,6 +124,7 @@ struct usb_function {
         void                    (*suspend)(struct usb_function *);
         void                    (*resume)(struct usb_function *);
 
+        /* private: */
         /* internals */
         struct list_head                list;
 };
@@ -219,6 +220,7 @@ struct usb_configuration {
 
         struct usb_composite_dev        *cdev;
 
+        /* private: */
         /* internals */
         struct list_head        list;
         struct list_head        functions;
@@ -321,6 +323,7 @@ struct usb_composite_dev {
 
         struct usb_configuration        *config;
 
+        /* private: */
         /* internals */
         struct usb_device_descriptor    desc;
         struct list_head                configs;
diff --git a/include/linux/usb/langwell_otg.h b/include/linux/usb/langwell_otg.h
new file mode 100644
index 000000000000..e115ae6df1da
--- /dev/null
+++ b/include/linux/usb/langwell_otg.h
@@ -0,0 +1,177 @@
+/*
+ * Intel Langwell USB OTG transceiver driver
+ * Copyright (C) 2008, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef __LANGWELL_OTG_H__
+#define __LANGWELL_OTG_H__
+
+/* notify transceiver driver about OTG events */
+extern void langwell_update_transceiver(void);
+/* HCD register bus driver */
+extern int langwell_register_host(struct pci_driver *host_driver);
+/* HCD unregister bus driver */
+extern void langwell_unregister_host(struct pci_driver *host_driver);
+/* DCD register bus driver */
+extern int langwell_register_peripheral(struct pci_driver *client_driver);
+/* DCD unregister bus driver */
+extern void langwell_unregister_peripheral(struct pci_driver *client_driver);
+/* No silent failure, output warning message */
+extern void langwell_otg_nsf_msg(unsigned long message);
+
+#define CI_USBCMD               0x30
+#       define USBCMD_RST               BIT(1)
+#       define USBCMD_RS                BIT(0)
+#define CI_USBSTS               0x34
+#       define USBSTS_SLI               BIT(8)
+#       define USBSTS_URI               BIT(6)
+#       define USBSTS_PCI               BIT(2)
+#define CI_PORTSC1              0x74
+#       define PORTSC_PP                BIT(12)
+#       define PORTSC_LS                (BIT(11) | BIT(10))
+#       define PORTSC_SUSP              BIT(7)
+#       define PORTSC_CCS               BIT(0)
+#define CI_HOSTPC1              0xb4
+#       define HOSTPC1_PHCD             BIT(22)
+#define CI_OTGSC                0xf4
+#       define OTGSC_DPIE               BIT(30)
+#       define OTGSC_1MSE               BIT(29)
+#       define OTGSC_BSEIE              BIT(28)
+#       define OTGSC_BSVIE              BIT(27)
+#       define OTGSC_ASVIE              BIT(26)
+#       define OTGSC_AVVIE              BIT(25)
+#       define OTGSC_IDIE               BIT(24)
+#       define OTGSC_DPIS               BIT(22)
+#       define OTGSC_1MSS               BIT(21)
+#       define OTGSC_BSEIS              BIT(20)
+#       define OTGSC_BSVIS              BIT(19)
+#       define OTGSC_ASVIS              BIT(18)
+#       define OTGSC_AVVIS              BIT(17)
+#       define OTGSC_IDIS               BIT(16)
+#       define OTGSC_DPS                BIT(14)
+#       define OTGSC_1MST               BIT(13)
+#       define OTGSC_BSE                BIT(12)
+#       define OTGSC_BSV                BIT(11)
+#       define OTGSC_ASV                BIT(10)
+#       define OTGSC_AVV                BIT(9)
+#       define OTGSC_ID                 BIT(8)
+#       define OTGSC_HABA               BIT(7)
+#       define OTGSC_HADP               BIT(6)
+#       define OTGSC_IDPU               BIT(5)
+#       define OTGSC_DP                 BIT(4)
+#       define OTGSC_OT                 BIT(3)
+#       define OTGSC_HAAR               BIT(2)
+#       define OTGSC_VC                 BIT(1)
+#       define OTGSC_VD                 BIT(0)
+#       define OTGSC_INTEN_MASK         (0x7f << 24)
+#       define OTGSC_INTSTS_MASK        (0x7f << 16)
+#define CI_USBMODE              0xf8
+#       define USBMODE_CM               (BIT(1) | BIT(0))
+#       define USBMODE_IDLE             0
+#       define USBMODE_DEVICE           0x2
+#       define USBMODE_HOST             0x3
+
+#define INTR_DUMMY_MASK (USBSTS_SLI | USBSTS_URI | USBSTS_PCI)
+
+struct otg_hsm {
+        /* Input */
+        int a_bus_resume;
+        int a_bus_suspend;
+        int a_conn;
+        int a_sess_vld;
+        int a_srp_det;
+        int a_vbus_vld;
+        int b_bus_resume;
+        int b_bus_suspend;
+        int b_conn;
+        int b_se0_srp;
+        int b_sess_end;
+        int b_sess_vld;
+        int id;
+
+        /* Internal variables */
+        int a_set_b_hnp_en;
+        int b_srp_done;
+        int b_hnp_enable;
+
+        /* Timeout indicator for timers */
+        int a_wait_vrise_tmout;
+        int a_wait_bcon_tmout;
+        int a_aidl_bdis_tmout;
+        int b_ase0_brst_tmout;
+        int b_bus_suspend_tmout;
+        int b_srp_res_tmout;
+
+        /* Informative variables */
+        int a_bus_drop;
+        int a_bus_req;
+        int a_clr_err;
+        int a_suspend_req;
+        int b_bus_req;
+
+        /* Output */
+        int drv_vbus;
+        int loc_conn;
+        int loc_sof;
+
+        /* Others */
+        int b_bus_suspend_vld;
+};
+
+#define TA_WAIT_VRISE   100
+#define TA_WAIT_BCON    30000
+#define TA_AIDL_BDIS    15000
+#define TB_ASE0_BRST    5000
+#define TB_SE0_SRP      2
+#define TB_SRP_RES      100
+#define TB_BUS_SUSPEND  500
+
+struct langwell_otg_timer {
+        unsigned long expires;  /* Number of count increase to timeout */
+        unsigned long count;    /* Tick counter */
+        void (*function)(unsigned long);        /* Timeout function */
+        unsigned long data;     /* Data passed to function */
+        struct list_head list;
+};
+
+struct langwell_otg {
+        struct otg_transceiver  otg;
+        struct otg_hsm          hsm;
+        void __iomem            *regs;
+        unsigned                region;
+        struct pci_driver       *host_ops;
+        struct pci_driver       *client_ops;
+        struct pci_dev          *pdev;
+        struct work_struct      work;
+        struct workqueue_struct *qwork;
+        spinlock_t              lock;
+        spinlock_t              wq_lock;
+};
+
+static inline struct langwell_otg *otg_to_langwell(struct otg_transceiver *otg)
+{
+        return container_of(otg, struct langwell_otg, otg);
+}
+
+#ifdef DEBUG
+#define otg_dbg(fmt, args...) \
+        printk(KERN_DEBUG fmt , ## args)
+#else
+#define otg_dbg(fmt, args...) \
+        do { } while (0)
+#endif /* DEBUG */
+#endif /* __LANGWELL_OTG_H__ */
diff --git a/include/linux/usb/langwell_udc.h b/include/linux/usb/langwell_udc.h
new file mode 100644
index 000000000000..c949178a6530
--- /dev/null
+++ b/include/linux/usb/langwell_udc.h
@@ -0,0 +1,310 @@
+/*
+ * Intel Langwell USB Device Controller driver
+ * Copyright (C) 2008-2009, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef __LANGWELL_UDC_H
+#define __LANGWELL_UDC_H
+
+
+/* MACRO defines */
+#define CAP_REG_OFFSET          0x0
+#define OP_REG_OFFSET           0x28
+
+#define DMA_ADDR_INVALID        (~(dma_addr_t)0)
+
+#define DQH_ALIGNMENT           2048
+#define DTD_ALIGNMENT           64
+#define DMA_BOUNDARY            4096
+
+#define EP0_MAX_PKT_SIZE        64
+#define EP_DIR_IN               1
+#define EP_DIR_OUT              0
+
+#define FLUSH_TIMEOUT           1000
+#define RESET_TIMEOUT           1000
+#define SETUPSTAT_TIMEOUT       100
+#define PRIME_TIMEOUT           100
+
+
+/* device memory space registers */
+
+/* Capability Registers, BAR0 + CAP_REG_OFFSET */
+struct langwell_cap_regs {
+        /* offset: 0x0 */
+        u8      caplength;      /* offset of Operational Register */
+        u8      _reserved3;
+        u16     hciversion;     /* H: BCD encoding of host version */
+        u32     hcsparams;      /* H: host port steering logic capability */
+        u32     hccparams;      /* H: host multiple mode control capability */
+#define HCC_LEN BIT(17)         /* Link power management (LPM) capability */
+        u8      _reserved4[0x20-0xc];
+        /* offset: 0x20 */
+        u16     dciversion;     /* BCD encoding of device version */
+        u8      _reserved5[0x24-0x22];
+        u32     dccparams;      /* overall device controller capability */
+#define HOSTCAP BIT(8)          /* host capable */
+#define DEVCAP  BIT(7)          /* device capable */
+#define DEN(d)  \
+        (((d)>>0)&0x1f)         /* bits 4:0, device endpoint number */
+} __attribute__ ((packed));
+
+
+/* Operational Registers, BAR0 + OP_REG_OFFSET */
+struct langwell_op_regs {
+        /* offset: 0x28 */
+        u32     extsts;
+#define EXTS_TI1        BIT(4)  /* general purpose timer interrupt 1 */
+#define EXTS_TI1TI0     BIT(3)  /* general purpose timer interrupt 0 */
+#define EXTS_TI1UPI     BIT(2)  /* USB host periodic interrupt */
+#define EXTS_TI1UAI     BIT(1)  /* USB host asynchronous interrupt */
+#define EXTS_TI1NAKI    BIT(0)  /* NAK interrupt */
+        u32     extintr;
+#define EXTI_TIE1       BIT(4)  /* general purpose timer interrupt enable 1 */
+#define EXTI_TIE0       BIT(3)  /* general purpose timer interrupt enable 0 */
+#define EXTI_UPIE       BIT(2)  /* USB host periodic interrupt enable */
+#define EXTI_UAIE       BIT(1)  /* USB host asynchronous interrupt enable */
+#define EXTI_NAKE       BIT(0)  /* NAK interrupt enable */
+        /* offset: 0x30 */
+        u32     usbcmd;
+#define CMD_HIRD(u)     \
+        (((u)>>24)&0xf)         /* bits 27:24, host init resume duration */
+#define CMD_ITC(u)      \
+        (((u)>>16)&0xff)        /* bits 23:16, interrupt threshold control */
+#define CMD_PPE         BIT(15) /* per-port change events enable */
+#define CMD_ATDTW       BIT(14) /* add dTD tripwire */
+#define CMD_SUTW        BIT(13) /* setup tripwire */
+#define CMD_ASPE        BIT(11) /* asynchronous schedule park mode enable */
+#define CMD_FS2         BIT(10) /* frame list size */
+#define CMD_ASP1        BIT(9)  /* asynchronous schedule park mode count */
+#define CMD_ASP0        BIT(8)
+#define CMD_LR          BIT(7)  /* light host/device controller reset */
+#define CMD_IAA         BIT(6)  /* interrupt on async advance doorbell */
+#define CMD_ASE         BIT(5)  /* asynchronous schedule enable */
+#define CMD_PSE         BIT(4)  /* periodic schedule enable */
+#define CMD_FS1         BIT(3)
+#define CMD_FS0         BIT(2)
+#define CMD_RST         BIT(1)  /* controller reset */
+#define CMD_RUNSTOP     BIT(0)  /* run/stop */
+        u32     usbsts;
+#define STS_PPCI(u)     \
+        (((u)>>16)&0xffff)      /* bits 31:16, port-n change detect */
+#define STS_AS          BIT(15) /* asynchronous schedule status */
+#define STS_PS          BIT(14) /* periodic schedule status */
+#define STS_RCL         BIT(13) /* reclamation */
+#define STS_HCH         BIT(12) /* HC halted */
+#define STS_ULPII       BIT(10) /* ULPI interrupt */
+#define STS_SLI         BIT(8)  /* DC suspend */
+#define STS_SRI         BIT(7)  /* SOF received */
+#define STS_URI         BIT(6)  /* USB reset received */
+#define STS_AAI         BIT(5)  /* interrupt on async advance */
+#define STS_SEI         BIT(4)  /* system error */
+#define STS_FRI         BIT(3)  /* frame list rollover */
+#define STS_PCI         BIT(2)  /* port change detect */
+#define STS_UEI         BIT(1)  /* USB error interrupt */
+#define STS_UI          BIT(0)  /* USB interrupt */
+        u32     usbintr;
+/* bits 31:16, per-port interrupt enable */
+#define INTR_PPCE(u)    (((u)>>16)&0xffff)
+#define INTR_ULPIE      BIT(10) /* ULPI enable */
+#define INTR_SLE        BIT(8)  /* DC sleep/suspend enable */
+#define INTR_SRE        BIT(7)  /* SOF received enable */
+#define INTR_URE        BIT(6)  /* USB reset enable */
+#define INTR_AAE        BIT(5)  /* interrupt on async advance enable */
+#define INTR_SEE        BIT(4)  /* system error enable */
+#define INTR_FRE        BIT(3)  /* frame list rollover enable */
+#define INTR_PCE        BIT(2)  /* port change detect enable */
+#define INTR_UEE        BIT(1)  /* USB error interrupt enable */
+#define INTR_UE         BIT(0)  /* USB interrupt enable */
+        u32     frindex;        /* frame index */
+#define FRINDEX_MASK    (0x3fff << 0)
+        u32     ctrldssegment;  /* not used */
+        u32     deviceaddr;
+#define USBADR_SHIFT    25
+#define USBADR(d)       \
+        (((d)>>25)&0x7f)        /* bits 31:25, device address */
+#define USBADR_MASK     (0x7f << 25)
+#define USBADRA         BIT(24) /* device address advance */
+        u32     endpointlistaddr;/* endpoint list top memory address */
+/* bits 31:11, endpoint list pointer */
+#define EPBASE(d)       (((d)>>11)&0x1fffff)
+#define ENDPOINTLISTADDR_MASK   (0x1fffff << 11)
+        u32     ttctrl;         /* H: TT operatin, not used */
+        /* offset: 0x50 */
+        u32     burstsize;      /* burst size of data movement */
+#define TXPBURST(b)     \
+        (((b)>>8)&0xff)         /* bits 15:8, TX burst length */
+#define RXPBURST(b)     \
+        (((b)>>0)&0xff)         /* bits 7:0, RX burst length */
+        u32     txfilltuning;   /* TX tuning */
+        u32     txttfilltuning; /* H: TX TT tuning */
+        u32     ic_usb;         /* control the IC_USB FS/LS transceiver */
+        /* offset: 0x60 */
+        u32     ulpi_viewport;  /* indirect access to ULPI PHY */
+#define ULPIWU          BIT(31) /* ULPI wakeup */
+#define ULPIRUN         BIT(30) /* ULPI read/write run */
+#define ULPIRW          BIT(29) /* ULPI read/write control */
+#define ULPISS          BIT(27) /* ULPI sync state */
+#define ULPIPORT(u)     \
+        (((u)>>24)&7)           /* bits 26:24, ULPI port number */
+#define ULPIADDR(u)     \
+        (((u)>>16)&0xff)        /* bits 23:16, ULPI data address */
+#define ULPIDATRD(u)    \
+        (((u)>>8)&0xff)         /* bits 15:8, ULPI data read */
+#define ULPIDATWR(u)    \
+        (((u)>>0)&0xff)         /* bits 7:0, ULPI date write */
+        u8      _reserved6[0x70-0x64];
+        /* offset: 0x70 */
+        u32     configflag;     /* H: not used */
+        u32     portsc1;        /* port status */
+#define DA(p)   \
+        (((p)>>25)&0x7f)        /* bits 31:25, device address */
+#define PORTS_SSTS      (BIT(24) | BIT(23))     /* suspend status */
+#define PORTS_WKOC      BIT(22) /* wake on over-current enable */
+#define PORTS_WKDS      BIT(21) /* wake on disconnect enable */
+#define PORTS_WKCN      BIT(20) /* wake on connect enable */
+#define PORTS_PTC(p)    (((p)>>16)&0xf) /* bits 19:16, port test control */
+#define PORTS_PIC       (BIT(15) | BIT(14))     /* port indicator control */
+#define PORTS_PO        BIT(13) /* port owner */
+#define PORTS_PP        BIT(12) /* port power */
+#define PORTS_LS        (BIT(11) | BIT(10))     /* line status */
+#define PORTS_SLP       BIT(9)  /* suspend using L1 */
+#define PORTS_PR        BIT(8)  /* port reset */
+#define PORTS_SUSP      BIT(7)  /* suspend */
+#define PORTS_FPR       BIT(6)  /* force port resume */
+#define PORTS_OCC       BIT(5)  /* over-current change */
+#define PORTS_OCA       BIT(4)  /* over-current active */
+#define PORTS_PEC       BIT(3)  /* port enable/disable change */
+#define PORTS_PE        BIT(2)  /* port enable/disable */
+#define PORTS_CSC       BIT(1)  /* connect status change */
+#define PORTS_CCS       BIT(0)  /* current connect status */
+        u8      _reserved7[0xb4-0x78];
+        /* offset: 0xb4 */
+        u32     devlc;          /* control LPM and each USB port behavior */
+/* bits 31:29, parallel transceiver select */
+#define LPM_PTS(d)      (((d)>>29)&7)
+#define LPM_STS         BIT(28) /* serial transceiver select */
+#define LPM_PTW         BIT(27) /* parallel transceiver width */
+#define LPM_PSPD(d)     (((d)>>25)&3)   /* bits 26:25, port speed */
+#define LPM_PSPD_MASK   (BIT(26) | BIT(25))
+#define LPM_SPEED_FULL  0
+#define LPM_SPEED_LOW   1
+#define LPM_SPEED_HIGH  2
+#define LPM_SRT         BIT(24) /* shorten reset time */
+#define LPM_PFSC        BIT(23) /* port force full speed connect */
+#define LPM_PHCD        BIT(22) /* PHY low power suspend clock disable */
+#define LPM_STL         BIT(16) /* STALL reply to LPM token */
+#define LPM_BA(d)       \
+        (((d)>>1)&0x7ff)        /* bits 11:1, BmAttributes */
+#define LPM_NYT_ACK     BIT(0)  /* NYET/ACK reply to LPM token */
+        u8      _reserved8[0xf4-0xb8];
+        /* offset: 0xf4 */
+        u32     otgsc;          /* On-The-Go status and control */
+#define OTGSC_DPIE      BIT(30) /* data pulse interrupt enable */
+#define OTGSC_MSE       BIT(29) /* 1 ms timer interrupt enable */
+#define OTGSC_BSEIE     BIT(28) /* B session end interrupt enable */
+#define OTGSC_BSVIE     BIT(27) /* B session valid interrupt enable */
+#define OTGSC_ASVIE     BIT(26) /* A session valid interrupt enable */
+#define OTGSC_AVVIE     BIT(25) /* A VBUS valid interrupt enable */
+#define OTGSC_IDIE      BIT(24) /* USB ID interrupt enable */
+#define OTGSC_DPIS      BIT(22) /* data pulse interrupt status */
+#define OTGSC_MSS       BIT(21) /* 1 ms timer interrupt status */
+#define OTGSC_BSEIS     BIT(20) /* B session end interrupt status */
+#define OTGSC_BSVIS     BIT(19) /* B session valid interrupt status */
+#define OTGSC_ASVIS     BIT(18) /* A session valid interrupt status */
+#define OTGSC_AVVIS     BIT(17) /* A VBUS valid interrupt status */
+#define OTGSC_IDIS      BIT(16) /* USB ID interrupt status */
+#define OTGSC_DPS       BIT(14) /* data bus pulsing status */
+#define OTGSC_MST       BIT(13) /* 1 ms timer toggle */
+#define OTGSC_BSE       BIT(12) /* B session end */
+#define OTGSC_BSV       BIT(11) /* B session valid */
+#define OTGSC_ASV       BIT(10) /* A session valid */
+#define OTGSC_AVV       BIT(9)  /* A VBUS valid */
+#define OTGSC_USBID     BIT(8)  /* USB ID */
+#define OTGSC_HABA      BIT(7)  /* hw assist B-disconnect to A-connect */
+#define OTGSC_HADP      BIT(6)  /* hw assist data pulse */
+#define OTGSC_IDPU      BIT(5)  /* ID pullup */
+#define OTGSC_DP        BIT(4)  /* data pulsing */
+#define OTGSC_OT        BIT(3)  /* OTG termination */
+#define OTGSC_HAAR      BIT(2)  /* hw assist auto reset */
+#define OTGSC_VC        BIT(1)  /* VBUS charge */
+#define OTGSC_VD        BIT(0)  /* VBUS discharge */
+        u32     usbmode;
+#define MODE_VBPS       BIT(5)  /* R/W VBUS power select */
+#define MODE_SDIS       BIT(4)  /* R/W stream disable mode */
+#define MODE_SLOM       BIT(3)  /* R/W setup lockout mode */
+#define MODE_ENSE       BIT(2)  /* endian select */
+#define MODE_CM(u)      (((u)>>0)&3)    /* bits 1:0, controller mode */
+#define MODE_IDLE       0
+#define MODE_DEVICE     2
+#define MODE_HOST       3
+        u8      _reserved9[0x100-0xfc];
+        /* offset: 0x100 */
+        u32     endptnak;
+#define EPTN(e)         \
+        (((e)>>16)&0xffff)      /* bits 31:16, TX endpoint NAK */
+#define EPRN(e)         \
+        (((e)>>0)&0xffff)       /* bits 15:0, RX endpoint NAK */
+        u32     endptnaken;
+#define EPTNE(e)        \
+        (((e)>>16)&0xffff)      /* bits 31:16, TX endpoint NAK enable */
+#define EPRNE(e)        \
+        (((e)>>0)&0xffff)       /* bits 15:0, RX endpoint NAK enable */
+        u32     endptsetupstat;
+#define SETUPSTAT_MASK          (0xffff << 0)   /* bits 15:0 */
+#define EP0SETUPSTAT_MASK       1
+        u32     endptprime;
+/* bits 31:16, prime endpoint transmit buffer */
+#define PETB(e)         (((e)>>16)&0xffff)
+/* bits 15:0, prime endpoint receive buffer */
+#define PERB(e)         (((e)>>0)&0xffff)
+        /* offset: 0x110 */
+        u32     endptflush;
+/* bits 31:16, flush endpoint transmit buffer */
+#define FETB(e)         (((e)>>16)&0xffff)
+/* bits 15:0, flush endpoint receive buffer */
+#define FERB(e)         (((e)>>0)&0xffff)
+        u32     endptstat;
+/* bits 31:16, endpoint transmit buffer ready */
+#define ETBR(e)         (((e)>>16)&0xffff)
+/* bits 15:0, endpoint receive buffer ready */
+#define ERBR(e)         (((e)>>0)&0xffff)
+        u32     endptcomplete;
+/* bits 31:16, endpoint transmit complete event */
+#define ETCE(e)         (((e)>>16)&0xffff)
+/* bits 15:0, endpoint receive complete event */
+#define ERCE(e)         (((e)>>0)&0xffff)
+        /* offset: 0x11c */
+        u32     endptctrl[16];
+#define EPCTRL_TXE      BIT(23) /* TX endpoint enable */
+#define EPCTRL_TXR      BIT(22) /* TX data toggle reset */
+#define EPCTRL_TXI      BIT(21) /* TX data toggle inhibit */
+#define EPCTRL_TXT(e)   (((e)>>18)&3)   /* bits 19:18, TX endpoint type */
+#define EPCTRL_TXT_SHIFT        18
+#define EPCTRL_TXD      BIT(17) /* TX endpoint data source */
+#define EPCTRL_TXS      BIT(16) /* TX endpoint STALL */
+#define EPCTRL_RXE      BIT(7)  /* RX endpoint enable */
+#define EPCTRL_RXR      BIT(6)  /* RX data toggle reset */
+#define EPCTRL_RXI      BIT(5)  /* RX data toggle inhibit */
+#define EPCTRL_RXT(e)   (((e)>>2)&3)    /* bits 3:2, RX endpoint type */
+#define EPCTRL_RXT_SHIFT        2       /* bits 19:18, TX endpoint type */
+#define EPCTRL_RXD      BIT(1)  /* RX endpoint data sink */
+#define EPCTRL_RXS      BIT(0)  /* RX endpoint STALL */
+} __attribute__ ((packed));
+
+#endif /* __LANGWELL_UDC_H */
+
diff --git a/include/linux/usb/otg.h b/include/linux/usb/otg.h
index 1aaa826396a1..2443c0e7a80c 100644
--- a/include/linux/usb/otg.h
+++ b/include/linux/usb/otg.h
@@ -80,10 +80,10 @@ struct otg_transceiver {
 
 /* for board-specific init logic */
 extern int otg_set_transceiver(struct otg_transceiver *);
-#ifdef CONFIG_NOP_USB_XCEIV
+
+/* sometimes transceivers are accessed only through e.g. ULPI */
 extern void usb_nop_xceiv_register(void);
 extern void usb_nop_xceiv_unregister(void);
-#endif
 
 
 /* for usb host and peripheral controller drivers */
diff --git a/include/linux/usb/r8a66597.h b/include/linux/usb/r8a66597.h
new file mode 100644
index 000000000000..e9f0384fa20c
--- /dev/null
+++ b/include/linux/usb/r8a66597.h
@@ -0,0 +1,44 @@
+/*
+ * R8A66597 driver platform data
+ *
+ * Copyright (C) 2009  Renesas Solutions Corp.
+ *
+ * Author : Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef __LINUX_USB_R8A66597_H
+#define __LINUX_USB_R8A66597_H
+
+#define R8A66597_PLATDATA_XTAL_12MHZ    0x01
+#define R8A66597_PLATDATA_XTAL_24MHZ    0x02
+#define R8A66597_PLATDATA_XTAL_48MHZ    0x03
+
+struct r8a66597_platdata {
+        /* This ops can controll port power instead of DVSTCTR register. */
+        void (*port_power)(int port, int power);
+
+        /* (external controller only) set R8A66597_PLATDATA_XTAL_nnMHZ */
+        unsigned        xtal:2;
+
+        /* set one = 3.3V, set zero = 1.5V */
+        unsigned        vif:1;
+
+        /* set one = big endian, set zero = little endian */
+        unsigned        endian:1;
+};
+#endif
+
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index 8cdfed738fe4..44801d26a37a 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -15,6 +15,7 @@
 
 #include <linux/kref.h>
 #include <linux/mutex.h>
+#include <linux/sysrq.h>
 
 #define SERIAL_TTY_MAJOR        188     /* Nice legal number now */
 #define SERIAL_TTY_MINORS       254     /* loads of devices :) */
@@ -26,6 +27,13 @@
 /* parity check flag */
 #define RELEVANT_IFLAG(iflag)   (iflag & (IGNBRK|BRKINT|IGNPAR|PARMRK|INPCK))
 
+enum port_dev_state {
+        PORT_UNREGISTERED,
+        PORT_REGISTERING,
+        PORT_REGISTERED,
+        PORT_UNREGISTERING,
+};
+
 /**
  * usb_serial_port: structure for the specific ports of a device.
  * @serial: pointer back to the struct usb_serial owner of this port.
@@ -91,12 +99,17 @@ struct usb_serial_port {
         int                     write_urb_busy;
         __u8                    bulk_out_endpointAddress;
 
+        int                     tx_bytes_flight;
+        int                     urbs_in_flight;
+
         wait_queue_head_t       write_wait;
         struct work_struct      work;
         char                    throttled;
         char                    throttle_req;
         char                    console;
+        unsigned long           sysrq; /* sysrq timeout */
         struct device           dev;
+        enum port_dev_state     dev_state;
 };
 #define to_usb_serial_port(d) container_of(d, struct usb_serial_port, dev)
 
@@ -181,8 +194,10 @@ static inline void usb_set_serial_data(struct usb_serial *serial, void *data)
  *      This will be called when the struct usb_serial structure is fully set
  *      set up.  Do any local initialization of the device, or any private
  *      memory structure allocation at this point in time.
- * @shutdown: pointer to the driver's shutdown function.  This will be
- *      called when the device is removed from the system.
+ * @disconnect: pointer to the driver's disconnect function.  This will be
+ *      called when the device is unplugged or unbound from the driver.
+ * @release: pointer to the driver's release function.  This will be called
+ *      when the usb_serial data structure is about to be destroyed.
  * @usb_driver: pointer to the struct usb_driver that controls this
  *      device.  This is necessary to allow dynamic ids to be added to
  *      the driver from sysfs.
@@ -207,12 +222,14 @@ struct usb_serial_driver {
         struct device_driver    driver;
         struct usb_driver       *usb_driver;
         struct usb_dynids       dynids;
+        int                     max_in_flight_urbs;
 
         int (*probe)(struct usb_serial *serial, const struct usb_device_id *id);
         int (*attach)(struct usb_serial *serial);
         int (*calc_num_ports) (struct usb_serial *serial);
 
-        void (*shutdown)(struct usb_serial *serial);
+        void (*disconnect)(struct usb_serial *serial);
+        void (*release)(struct usb_serial *serial);
 
         int (*port_probe)(struct usb_serial_port *port);
         int (*port_remove)(struct usb_serial_port *port);
@@ -294,9 +311,16 @@ extern void usb_serial_generic_read_bulk_callback(struct urb *urb);
 extern void usb_serial_generic_write_bulk_callback(struct urb *urb);
 extern void usb_serial_generic_throttle(struct tty_struct *tty);
 extern void usb_serial_generic_unthrottle(struct tty_struct *tty);
-extern void usb_serial_generic_shutdown(struct usb_serial *serial);
+extern void usb_serial_generic_disconnect(struct usb_serial *serial);
+extern void usb_serial_generic_release(struct usb_serial *serial);
 extern int usb_serial_generic_register(int debug);
 extern void usb_serial_generic_deregister(void);
+extern void usb_serial_generic_resubmit_read_urb(struct usb_serial_port *port,
+                                                 gfp_t mem_flags);
+extern int usb_serial_handle_sysrq_char(struct usb_serial_port *port,
+                                        unsigned int ch);
+extern int usb_serial_handle_break(struct usb_serial_port *port);
+
 
 extern int usb_serial_bus_register(struct usb_serial_driver *device);
 extern void usb_serial_bus_deregister(struct usb_serial_driver *device);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 36fabb95c7d3..5d44059f6d63 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -183,6 +183,7 @@ extern void usbnet_tx_timeout (struct net_device *net);
 extern int usbnet_change_mtu (struct net_device *net, int new_mtu);
 
 extern int usbnet_get_endpoints(struct usbnet *, struct usb_interface *);
+extern int usbnet_get_ethernet_addr(struct usbnet *, int);
 extern void usbnet_defer_kevent (struct usbnet *, int);
 extern void usbnet_skb_return (struct usbnet *, struct sk_buff *);
 extern void usbnet_unlink_rx_urbs(struct usbnet *);
diff --git a/include/linux/utsname.h b/include/linux/utsname.h
index 11232676bfff..3656b300de3a 100644
--- a/include/linux/utsname.h
+++ b/include/linux/utsname.h
@@ -22,12 +22,12 @@ struct old_utsname {
 };
 
 struct new_utsname {
-        char sysname[65];
-        char nodename[65];
-        char release[65];
-        char version[65];
-        char machine[65];
-        char domainname[65];
+        char sysname[__NEW_UTS_LEN + 1];
+        char nodename[__NEW_UTS_LEN + 1];
+        char release[__NEW_UTS_LEN + 1];
+        char version[__NEW_UTS_LEN + 1];
+        char machine[__NEW_UTS_LEN + 1];
+        char domainname[__NEW_UTS_LEN + 1];
 };
 
 #ifdef __KERNEL__
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index ebb2ea6b4995..f24eceecc5a6 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -347,7 +347,8 @@ struct v4l2_pix_format {
 #define V4L2_PIX_FMT_MR97310A v4l2_fourcc('M', '3', '1', '0') /* compressed BGGR bayer */
 #define V4L2_PIX_FMT_SQ905C   v4l2_fourcc('9', '0', '5', 'C') /* compressed RGGB bayer */
 #define V4L2_PIX_FMT_PJPG     v4l2_fourcc('P', 'J', 'P', 'G') /* Pixart 73xx JPEG */
-#define V4L2_PIX_FMT_YVYU    v4l2_fourcc('Y', 'V', 'Y', 'U') /* 16  YVU 4:2:2     */
+#define V4L2_PIX_FMT_YVYU     v4l2_fourcc('Y', 'V', 'Y', 'U') /* 16 YVU 4:2:2 */
+#define V4L2_PIX_FMT_OV518    v4l2_fourcc('O', '5', '1', '8') /* ov518 JPEG */
 
 /*
  *      F O R M A T   E N U M E R A T I O N
diff --git a/include/linux/vlynq.h b/include/linux/vlynq.h
new file mode 100644
index 000000000000..8f6a95882b09
--- /dev/null
+++ b/include/linux/vlynq.h
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2006, 2007 Eugene Konev <ejka@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __VLYNQ_H__
+#define __VLYNQ_H__
+
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/types.h>
+
+#define VLYNQ_NUM_IRQS 32
+
+struct vlynq_mapping {
+        u32 size;
+        u32 offset;
+};
+
+enum vlynq_divisor {
+        vlynq_div_auto = 0,
+        vlynq_ldiv1,
+        vlynq_ldiv2,
+        vlynq_ldiv3,
+        vlynq_ldiv4,
+        vlynq_ldiv5,
+        vlynq_ldiv6,
+        vlynq_ldiv7,
+        vlynq_ldiv8,
+        vlynq_rdiv1,
+        vlynq_rdiv2,
+        vlynq_rdiv3,
+        vlynq_rdiv4,
+        vlynq_rdiv5,
+        vlynq_rdiv6,
+        vlynq_rdiv7,
+        vlynq_rdiv8,
+        vlynq_div_external
+};
+
+struct vlynq_device_id {
+        u32 id;
+        enum vlynq_divisor divisor;
+        unsigned long driver_data;
+};
+
+struct vlynq_regs;
+struct vlynq_device {
+        u32 id, dev_id;
+        int local_irq;
+        int remote_irq;
+        enum vlynq_divisor divisor;
+        u32 regs_start, regs_end;
+        u32 mem_start, mem_end;
+        u32 irq_start, irq_end;
+        int irq;
+        int enabled;
+        struct vlynq_regs *local;
+        struct vlynq_regs *remote;
+        struct device dev;
+};
+
+struct vlynq_driver {
+        char *name;
+        struct vlynq_device_id *id_table;
+        int (*probe)(struct vlynq_device *dev, struct vlynq_device_id *id);
+        void (*remove)(struct vlynq_device *dev);
+        struct device_driver driver;
+};
+
+struct plat_vlynq_ops {
+        int (*on)(struct vlynq_device *dev);
+        void (*off)(struct vlynq_device *dev);
+};
+
+static inline struct vlynq_driver *to_vlynq_driver(struct device_driver *drv)
+{
+        return container_of(drv, struct vlynq_driver, driver);
+}
+
+static inline struct vlynq_device *to_vlynq_device(struct device *device)
+{
+        return container_of(device, struct vlynq_device, dev);
+}
+
+extern struct bus_type vlynq_bus_type;
+
+extern int __vlynq_register_driver(struct vlynq_driver *driver,
+                                   struct module *owner);
+
+static inline int vlynq_register_driver(struct vlynq_driver *driver)
+{
+        return __vlynq_register_driver(driver, THIS_MODULE);
+}
+
+static inline void *vlynq_get_drvdata(struct vlynq_device *dev)
+{
+        return dev_get_drvdata(&dev->dev);
+}
+
+static inline void vlynq_set_drvdata(struct vlynq_device *dev, void *data)
+{
+        dev_set_drvdata(&dev->dev, data);
+}
+
+static inline u32 vlynq_mem_start(struct vlynq_device *dev)
+{
+        return dev->mem_start;
+}
+
+static inline u32 vlynq_mem_end(struct vlynq_device *dev)
+{
+        return dev->mem_end;
+}
+
+static inline u32 vlynq_mem_len(struct vlynq_device *dev)
+{
+        return dev->mem_end - dev->mem_start + 1;
+}
+
+static inline int vlynq_virq_to_irq(struct vlynq_device *dev, int virq)
+{
+        int irq = dev->irq_start + virq;
+        if ((irq < dev->irq_start) || (irq > dev->irq_end))
+                return -EINVAL;
+
+        return irq;
+}
+
+static inline int vlynq_irq_to_virq(struct vlynq_device *dev, int irq)
+{
+        if ((irq < dev->irq_start) || (irq > dev->irq_end))
+                return -EINVAL;
+
+        return irq - dev->irq_start;
+}
+
+extern void vlynq_unregister_driver(struct vlynq_driver *driver);
+extern int vlynq_enable_device(struct vlynq_device *dev);
+extern void vlynq_disable_device(struct vlynq_device *dev);
+extern int vlynq_set_local_mapping(struct vlynq_device *dev, u32 tx_offset,
+                                   struct vlynq_mapping *mapping);
+extern int vlynq_set_remote_mapping(struct vlynq_device *dev, u32 tx_offset,
+                                    struct vlynq_mapping *mapping);
+extern int vlynq_set_local_irq(struct vlynq_device *dev, int virq);
+extern int vlynq_set_remote_irq(struct vlynq_device *dev, int virq);
+
+#endif /* __VLYNQ_H__ */
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 524cd1b28ecb..81a97cf8f0a0 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -36,12 +36,14 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
                 FOR_ALL_ZONES(PGSTEAL),
                 FOR_ALL_ZONES(PGSCAN_KSWAPD),
                 FOR_ALL_ZONES(PGSCAN_DIRECT),
+#ifdef CONFIG_NUMA
+                PGSCAN_ZONE_RECLAIM_FAILED,
+#endif
                 PGINODESTEAL, SLABS_SCANNED, KSWAPD_STEAL, KSWAPD_INODESTEAL,
                 PAGEOUTRUN, ALLOCSTALL, PGROTATED,
 #ifdef CONFIG_HUGETLB_PAGE
                 HTLB_BUDDY_PGALLOC, HTLB_BUDDY_PGALLOC_FAIL,
 #endif
-#ifdef CONFIG_UNEVICTABLE_LRU
                 UNEVICTABLE_PGCULLED,   /* culled to noreclaim list */
                 UNEVICTABLE_PGSCANNED,  /* scanned for reclaimability */
                 UNEVICTABLE_PGRESCUED,  /* rescued from noreclaim list */
@@ -50,7 +52,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
                 UNEVICTABLE_PGCLEARED,  /* on COW, page truncate */
                 UNEVICTABLE_PGSTRANDED, /* unable to isolate on unlock */
                 UNEVICTABLE_MLOCKFREED,
-#endif
                 NR_VM_EVENT_ITEMS
 };
 
diff --git a/include/linux/wimax.h b/include/linux/wimax.h
index c89de7f4e5b9..4fdcc5635518 100644
--- a/include/linux/wimax.h
+++ b/include/linux/wimax.h
@@ -59,7 +59,7 @@ enum {
          * M - Major: change if removing or modifying an existing call.
          * m - minor: change when adding a new call
          */
-        WIMAX_GNL_VERSION = 00,
+        WIMAX_GNL_VERSION = 01,
         /* Generic NetLink attributes */
         WIMAX_GNL_ATTR_INVALID = 0x00,
         WIMAX_GNL_ATTR_MAX = 10,
@@ -78,6 +78,7 @@ enum {
         WIMAX_GNL_OP_RFKILL,    /* Run wimax_rfkill() */
         WIMAX_GNL_OP_RESET,     /* Run wimax_rfkill() */
         WIMAX_GNL_RE_STATE_CHANGE,      /* Report: status change */
+        WIMAX_GNL_OP_STATE_GET,         /* Request for current state */
 };
 
 
@@ -113,6 +114,10 @@ enum {
         WIMAX_GNL_RESET_IFIDX = 1,
 };
 
+/* Atributes for wimax_state_get() */
+enum {
+        WIMAX_GNL_STGET_IFIDX = 1,
+};
 
 /*
  * Attributes for the Report State Change
diff --git a/include/linux/wimax/i2400m.h b/include/linux/wimax/i2400m.h
index d5148a7889a6..433693ef2bb0 100644
--- a/include/linux/wimax/i2400m.h
+++ b/include/linux/wimax/i2400m.h
@@ -266,7 +266,7 @@ enum i2400m_ro_type {
 
 /* Misc constants */
 enum {
-        I2400M_PL_PAD = 16,     /* Payload data size alignment */
+        I2400M_PL_ALIGN = 16,   /* Payload data size alignment */
         I2400M_PL_SIZE_MAX = 0x3EFF,
         I2400M_MAX_PLS_IN_MSG = 60,
         /* protocol barkers: sync sequences; for notifications they
diff --git a/include/media/adv7343.h b/include/media/adv7343.h
new file mode 100644
index 000000000000..d6f8a4e1a1fc
--- /dev/null
+++ b/include/media/adv7343.h
@@ -0,0 +1,23 @@
+/*
+ * ADV7343 header file
+ *
+ * Copyright (C) 2009 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation version 2.
+ *
+ * This program is distributed .as is. WITHOUT ANY WARRANTY of any
+ * kind, whether express or implied; without even the implied warranty
+ * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef ADV7343_H
+#define ADV7343_H
+
+#define ADV7343_COMPOSITE_ID    (0)
+#define ADV7343_COMPONENT_ID    (1)
+#define ADV7343_SVIDEO_ID       (2)
+
+#endif                          /* End of #ifndef ADV7343_H */
diff --git a/include/media/ir-kbd-i2c.h b/include/media/ir-kbd-i2c.h
index 07963d705400..3ad4ed5402fb 100644
--- a/include/media/ir-kbd-i2c.h
+++ b/include/media/ir-kbd-i2c.h
@@ -7,7 +7,7 @@ struct IR_i2c;
 
 struct IR_i2c {
         IR_KEYTAB_TYPE         *ir_codes;
-        struct i2c_client      c;
+        struct i2c_client      *c;
         struct input_dev       *input;
         struct ir_input_state  ir;
 
@@ -15,7 +15,15 @@ struct IR_i2c {
         unsigned char          old;
 
         struct delayed_work    work;
+        char                   name[32];
         char                   phys[32];
         int                    (*get_key)(struct IR_i2c*, u32*, u32*);
 };
+
+/* Can be passed when instantiating an ir_video i2c device */
+struct IR_i2c_init_data {
+        IR_KEYTAB_TYPE         *ir_codes;
+        const char             *name;
+        int                    (*get_key)(struct IR_i2c*, u32*, u32*);
+};
 #endif
diff --git a/include/media/soc_camera.h b/include/media/soc_camera.h
index 37013688af44..23ecead35e7a 100644
--- a/include/media/soc_camera.h
+++ b/include/media/soc_camera.h
@@ -60,7 +60,7 @@ struct soc_camera_file {
 
 struct soc_camera_host {
         struct list_head list;
-        struct device dev;
+        struct device *dev;
         unsigned char nr;                               /* Host number */
         void *priv;
         const char *drv_name;
@@ -92,11 +92,16 @@ struct soc_camera_host_ops {
 #define SOCAM_SENSOR_INVERT_VSYNC       (1 << 3)
 #define SOCAM_SENSOR_INVERT_DATA        (1 << 4)
 
+struct i2c_board_info;
+
 struct soc_camera_link {
         /* Camera bus id, used to match a camera and a bus */
         int bus_id;
         /* Per camera SOCAM_SENSOR_* bus flags */
         unsigned long flags;
+        int i2c_adapter_id;
+        struct i2c_board_info *board_info;
+        const char *module_name;
         /* Optional callbacks to power on or off and reset the sensor */
         int (*power)(struct device *, int);
         int (*reset)(struct device *);
@@ -107,6 +112,7 @@ struct soc_camera_link {
          */
         int (*set_bus_param)(struct soc_camera_link *, unsigned long flags);
         unsigned long (*query_bus_param)(struct soc_camera_link *);
+        void (*free_bus)(struct soc_camera_link *);
 };
 
 static inline struct soc_camera_device *to_soc_camera_dev(struct device *dev)
@@ -116,7 +122,7 @@ static inline struct soc_camera_device *to_soc_camera_dev(struct device *dev)
 
 static inline struct soc_camera_host *to_soc_camera_host(struct device *dev)
 {
-        return container_of(dev, struct soc_camera_host, dev);
+        return dev_get_drvdata(dev);
 }
 
 extern int soc_camera_host_register(struct soc_camera_host *ici);
diff --git a/include/media/tuner.h b/include/media/tuner.h
index 7d4e2db78076..cbf97f45fbec 100644
--- a/include/media/tuner.h
+++ b/include/media/tuner.h
@@ -124,6 +124,8 @@
 #define TUNER_XC5000                    76      /* Xceive Silicon Tuner */
 #define TUNER_TCL_MF02GIP_5N            77      /* TCL MF02GIP_5N */
 #define TUNER_PHILIPS_FMD1216MEX_MK3    78
+#define TUNER_PHILIPS_FM1216MK5         79
+#define TUNER_PHILIPS_FQ1216LME_MK3     80      /* Active loopthrough, no FM */
 
 /* tv card specific */
 #define TDA9887_PRESENT                 (1<<0)
diff --git a/include/media/v4l2-chip-ident.h b/include/media/v4l2-chip-ident.h
index 1be461a29077..4d7e2272c42f 100644
--- a/include/media/v4l2-chip-ident.h
+++ b/include/media/v4l2-chip-ident.h
@@ -137,6 +137,12 @@ enum {
         /* module saa7191: just ident 7191 */
         V4L2_IDENT_SAA7191 = 7191,
 
+        /* module ths7303: just ident 7303 */
+        V4L2_IDENT_THS7303 = 7303,
+
+        /* module adv7343: just ident 7343 */
+        V4L2_IDENT_ADV7343 = 7343,
+
         /* module wm8739: just ident 8739 */
         V4L2_IDENT_WM8739 = 8739,
 
diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
index 0dd3e8e8653e..5d5d550e63ad 100644
--- a/include/media/v4l2-device.h
+++ b/include/media/v4l2-device.h
@@ -30,7 +30,7 @@
    basic V4L2 device-level support.
  */
 
-#define V4L2_DEVICE_NAME_SIZE (BUS_ID_SIZE + 16)
+#define V4L2_DEVICE_NAME_SIZE (20 + 16)
 
 struct v4l2_device {
         /* dev->driver_data points to this struct.
@@ -53,10 +53,31 @@ struct v4l2_device {
    dev may be NULL in rare cases (ISA devices). In that case you
    must fill in the v4l2_dev->name field before calling this function. */
 int __must_check v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev);
+
+/* Optional function to initialize the name field of struct v4l2_device using
+   the driver name and a driver-global atomic_t instance.
+   This function will increment the instance counter and returns the instance
+   value used in the name.
+
+   Example:
+
+   static atomic_t drv_instance = ATOMIC_INIT(0);
+
+   ...
+
+   instance = v4l2_device_set_name(&v4l2_dev, "foo", &drv_instance);
+
+   The first time this is called the name field will be set to foo0 and
+   this function returns 0. If the name ends with a digit (e.g. cx18),
+   then the name will be set to cx18-0 since cx180 looks really odd. */
+int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
+                                                atomic_t *instance);
+
 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
    Since the parent disappears this ensures that v4l2_dev doesn't have an
    invalid parent pointer. */
 void v4l2_device_disconnect(struct v4l2_device *v4l2_dev);
+
 /* Unregister all sub-devices and any other resources related to v4l2_dev. */
 void v4l2_device_unregister(struct v4l2_device *v4l2_dev);
 
diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h
index 17856081c809..a503e1cee78b 100644
--- a/include/media/v4l2-subdev.h
+++ b/include/media/v4l2-subdev.h
@@ -230,12 +230,16 @@ struct v4l2_subdev_ops {
 
 #define V4L2_SUBDEV_NAME_SIZE 32
 
+/* Set this flag if this subdev is a i2c device. */
+#define V4L2_SUBDEV_FL_IS_I2C (1U << 0)
+
 /* Each instance of a subdev driver should create this struct, either
    stand-alone or embedded in a larger struct.
  */
 struct v4l2_subdev {
         struct list_head list;
         struct module *owner;
+        u32 flags;
         struct v4l2_device *v4l2_dev;
         const struct v4l2_subdev_ops *ops;
         /* name must be unique */
@@ -264,6 +268,7 @@ static inline void v4l2_subdev_init(struct v4l2_subdev *sd,
         BUG_ON(!ops || !ops->core);
         sd->ops = ops;
         sd->v4l2_dev = NULL;
+        sd->flags = 0;
         sd->name[0] = '\0';
         sd->grp_id = 0;
         sd->priv = NULL;
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 3ad5390a4dd5..968166a45f86 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -81,12 +81,6 @@ enum {
         BT_CLOSED
 };
 
-/* Endianness conversions */
-#define htobs(a)        __cpu_to_le16(a)
-#define htobl(a)        __cpu_to_le32(a)
-#define btohs(a)        __le16_to_cpu(a)
-#define btohl(a)        __le32_to_cpu(a)
-
 /* BD Address */
 typedef struct {
         __u8 b[6];
@@ -171,15 +165,6 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk, unsigned long l
         return skb;
 }
 
-static inline int skb_frags_no(struct sk_buff *skb)
-{
-        register struct sk_buff *frag = skb_shinfo(skb)->frag_list;
-        register int n = 1;
-
-        for (; frag; frag=frag->next, n++);
-        return n;
-}
-
 int bt_err(__u16 code);
 
 extern int hci_sock_init(void);
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 73aead222b32..c4ca4228b083 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -137,6 +137,8 @@ struct hci_dev {
         struct device           *parent;
         struct device           dev;
 
+        struct rfkill           *rfkill;
+
         struct module           *owner;
 
         int (*open)(struct hci_dev *hdev);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index f566aa1f0a4c..e919fca1072a 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -26,8 +26,13 @@
 #define __L2CAP_H
 
 /* L2CAP defaults */
-#define L2CAP_DEFAULT_MTU       672
-#define L2CAP_DEFAULT_FLUSH_TO  0xFFFF
+#define L2CAP_DEFAULT_MTU               672
+#define L2CAP_DEFAULT_FLUSH_TO          0xffff
+#define L2CAP_DEFAULT_RX_WINDOW         1
+#define L2CAP_DEFAULT_MAX_RECEIVE       1
+#define L2CAP_DEFAULT_RETRANS_TO        300    /* 300 milliseconds */
+#define L2CAP_DEFAULT_MONITOR_TO        1000   /* 1 second */
+#define L2CAP_DEFAULT_MAX_RX_APDU       0xfff7
 
 #define L2CAP_CONN_TIMEOUT      (40000) /* 40 seconds */
 #define L2CAP_INFO_TIMEOUT      (4000)  /*  4 seconds */
@@ -64,17 +69,29 @@ struct l2cap_conninfo {
 #define L2CAP_LM_SECURE         0x0020
 
 /* L2CAP command codes */
-#define L2CAP_COMMAND_REJ 0x01
-#define L2CAP_CONN_REQ    0x02
-#define L2CAP_CONN_RSP    0x03
-#define L2CAP_CONF_REQ    0x04
-#define L2CAP_CONF_RSP    0x05
-#define L2CAP_DISCONN_REQ 0x06
-#define L2CAP_DISCONN_RSP 0x07
-#define L2CAP_ECHO_REQ    0x08
-#define L2CAP_ECHO_RSP    0x09
-#define L2CAP_INFO_REQ    0x0a
-#define L2CAP_INFO_RSP    0x0b
+#define L2CAP_COMMAND_REJ       0x01
+#define L2CAP_CONN_REQ          0x02
+#define L2CAP_CONN_RSP          0x03
+#define L2CAP_CONF_REQ          0x04
+#define L2CAP_CONF_RSP          0x05
+#define L2CAP_DISCONN_REQ       0x06
+#define L2CAP_DISCONN_RSP       0x07
+#define L2CAP_ECHO_REQ          0x08
+#define L2CAP_ECHO_RSP          0x09
+#define L2CAP_INFO_REQ          0x0a
+#define L2CAP_INFO_RSP          0x0b
+
+/* L2CAP feature mask */
+#define L2CAP_FEAT_FLOWCTL      0x00000001
+#define L2CAP_FEAT_RETRANS      0x00000002
+#define L2CAP_FEAT_ERTM         0x00000008
+#define L2CAP_FEAT_STREAMING    0x00000010
+#define L2CAP_FEAT_FCS          0x00000020
+#define L2CAP_FEAT_FIXED_CHAN   0x00000080
+
+/* L2CAP checksum option */
+#define L2CAP_FCS_NONE          0x00
+#define L2CAP_FCS_CRC16         0x01
 
 /* L2CAP structures */
 struct l2cap_hdr {
@@ -106,17 +123,23 @@ struct l2cap_conn_rsp {
         __le16     status;
 } __attribute__ ((packed));
 
+/* channel indentifier */
+#define L2CAP_CID_SIGNALING     0x0001
+#define L2CAP_CID_CONN_LESS     0x0002
+#define L2CAP_CID_DYN_START     0x0040
+#define L2CAP_CID_DYN_END       0xffff
+
 /* connect result */
-#define L2CAP_CR_SUCCESS    0x0000
-#define L2CAP_CR_PEND       0x0001
-#define L2CAP_CR_BAD_PSM    0x0002
-#define L2CAP_CR_SEC_BLOCK  0x0003
-#define L2CAP_CR_NO_MEM     0x0004
+#define L2CAP_CR_SUCCESS        0x0000
+#define L2CAP_CR_PEND           0x0001
+#define L2CAP_CR_BAD_PSM        0x0002
+#define L2CAP_CR_SEC_BLOCK      0x0003
+#define L2CAP_CR_NO_MEM         0x0004
 
 /* connect status */
-#define L2CAP_CS_NO_INFO      0x0000
-#define L2CAP_CS_AUTHEN_PEND  0x0001
-#define L2CAP_CS_AUTHOR_PEND  0x0002
+#define L2CAP_CS_NO_INFO        0x0000
+#define L2CAP_CS_AUTHEN_PEND    0x0001
+#define L2CAP_CS_AUTHOR_PEND    0x0002
 
 struct l2cap_conf_req {
         __le16     dcid;
@@ -143,10 +166,14 @@ struct l2cap_conf_opt {
 } __attribute__ ((packed));
 #define L2CAP_CONF_OPT_SIZE     2
 
+#define L2CAP_CONF_HINT         0x80
+#define L2CAP_CONF_MASK         0x7f
+
 #define L2CAP_CONF_MTU          0x01
 #define L2CAP_CONF_FLUSH_TO     0x02
 #define L2CAP_CONF_QOS          0x03
 #define L2CAP_CONF_RFC          0x04
+#define L2CAP_CONF_FCS          0x05
 
 #define L2CAP_CONF_MAX_SIZE     22
 
@@ -162,6 +189,8 @@ struct l2cap_conf_rfc {
 #define L2CAP_MODE_BASIC        0x00
 #define L2CAP_MODE_RETRANS      0x01
 #define L2CAP_MODE_FLOWCTL      0x02
+#define L2CAP_MODE_ERTM         0x03
+#define L2CAP_MODE_STREAM       0x04
 
 struct l2cap_disconn_req {
         __le16     dcid;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 5389afdc1297..1a21895b732b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1,71 +1,220 @@
 #ifndef __NET_CFG80211_H
 #define __NET_CFG80211_H
+/*
+ * 802.11 device and configuration interface
+ *
+ * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
 
+#include <linux/netdevice.h>
+#include <linux/debugfs.h>
+#include <linux/list.h>
 #include <linux/netlink.h>
 #include <linux/skbuff.h>
 #include <linux/nl80211.h>
 #include <linux/if_ether.h>
 #include <linux/ieee80211.h>
-#include <linux/wireless.h>
-#include <net/iw_handler.h>
-#include <net/genetlink.h>
+#include <net/regulatory.h>
+
 /* remove once we remove the wext stuff */
 #include <net/iw_handler.h>
+#include <linux/wireless.h>
+
 
 /*
- * 802.11 configuration in-kernel interface
+ * wireless hardware capability structures
+ */
+
+/**
+ * enum ieee80211_band - supported frequency bands
+ *
+ * The bands are assigned this way because the supported
+ * bitrates differ in these bands.
  *
- * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
+ * @IEEE80211_BAND_2GHZ: 2.4GHz ISM band
+ * @IEEE80211_BAND_5GHZ: around 5GHz band (4.9-5.7)
  */
+enum ieee80211_band {
+        IEEE80211_BAND_2GHZ,
+        IEEE80211_BAND_5GHZ,
+
+        /* keep last */
+        IEEE80211_NUM_BANDS
+};
 
 /**
- * struct vif_params - describes virtual interface parameters
- * @mesh_id: mesh ID to use
- * @mesh_id_len: length of the mesh ID
+ * enum ieee80211_channel_flags - channel flags
+ *
+ * Channel flags set by the regulatory control code.
+ *
+ * @IEEE80211_CHAN_DISABLED: This channel is disabled.
+ * @IEEE80211_CHAN_PASSIVE_SCAN: Only passive scanning is permitted
+ *      on this channel.
+ * @IEEE80211_CHAN_NO_IBSS: IBSS is not allowed on this channel.
+ * @IEEE80211_CHAN_RADAR: Radar detection is required on this channel.
+ * @IEEE80211_CHAN_NO_HT40PLUS: extension channel above this channel
+ *      is not permitted.
+ * @IEEE80211_CHAN_NO_HT40MINUS: extension channel below this channel
+ *      is not permitted.
  */
-struct vif_params {
-       u8 *mesh_id;
-       int mesh_id_len;
+enum ieee80211_channel_flags {
+        IEEE80211_CHAN_DISABLED         = 1<<0,
+        IEEE80211_CHAN_PASSIVE_SCAN     = 1<<1,
+        IEEE80211_CHAN_NO_IBSS          = 1<<2,
+        IEEE80211_CHAN_RADAR            = 1<<3,
+        IEEE80211_CHAN_NO_HT40PLUS      = 1<<4,
+        IEEE80211_CHAN_NO_HT40MINUS     = 1<<5,
 };
 
-/* Radiotap header iteration
- *   implemented in net/wireless/radiotap.c
- *   docs in Documentation/networking/radiotap-headers.txt
+#define IEEE80211_CHAN_NO_HT40 \
+        (IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS)
+
+/**
+ * struct ieee80211_channel - channel definition
+ *
+ * This structure describes a single channel for use
+ * with cfg80211.
+ *
+ * @center_freq: center frequency in MHz
+ * @max_bandwidth: maximum allowed bandwidth for this channel, in MHz
+ * @hw_value: hardware-specific value for the channel
+ * @flags: channel flags from &enum ieee80211_channel_flags.
+ * @orig_flags: channel flags at registration time, used by regulatory
+ *      code to support devices with additional restrictions
+ * @band: band this channel belongs to.
+ * @max_antenna_gain: maximum antenna gain in dBi
+ * @max_power: maximum transmission power (in dBm)
+ * @beacon_found: helper to regulatory code to indicate when a beacon
+ *      has been found on this channel. Use regulatory_hint_found_beacon()
+ *      to enable this, this is is useful only on 5 GHz band.
+ * @orig_mag: internal use
+ * @orig_mpwr: internal use
  */
+struct ieee80211_channel {
+        enum ieee80211_band band;
+        u16 center_freq;
+        u8 max_bandwidth;
+        u16 hw_value;
+        u32 flags;
+        int max_antenna_gain;
+        int max_power;
+        bool beacon_found;
+        u32 orig_flags;
+        int orig_mag, orig_mpwr;
+};
+
 /**
- * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args
- * @rtheader: pointer to the radiotap header we are walking through
- * @max_length: length of radiotap header in cpu byte ordering
- * @this_arg_index: IEEE80211_RADIOTAP_... index of current arg
- * @this_arg: pointer to current radiotap arg
- * @arg_index: internal next argument index
- * @arg: internal next argument pointer
- * @next_bitmap: internal pointer to next present u32
- * @bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
+ * enum ieee80211_rate_flags - rate flags
+ *
+ * Hardware/specification flags for rates. These are structured
+ * in a way that allows using the same bitrate structure for
+ * different bands/PHY modes.
+ *
+ * @IEEE80211_RATE_SHORT_PREAMBLE: Hardware can send with short
+ *      preamble on this bitrate; only relevant in 2.4GHz band and
+ *      with CCK rates.
+ * @IEEE80211_RATE_MANDATORY_A: This bitrate is a mandatory rate
+ *      when used with 802.11a (on the 5 GHz band); filled by the
+ *      core code when registering the wiphy.
+ * @IEEE80211_RATE_MANDATORY_B: This bitrate is a mandatory rate
+ *      when used with 802.11b (on the 2.4 GHz band); filled by the
+ *      core code when registering the wiphy.
+ * @IEEE80211_RATE_MANDATORY_G: This bitrate is a mandatory rate
+ *      when used with 802.11g (on the 2.4 GHz band); filled by the
+ *      core code when registering the wiphy.
+ * @IEEE80211_RATE_ERP_G: This is an ERP rate in 802.11g mode.
  */
+enum ieee80211_rate_flags {
+        IEEE80211_RATE_SHORT_PREAMBLE   = 1<<0,
+        IEEE80211_RATE_MANDATORY_A      = 1<<1,
+        IEEE80211_RATE_MANDATORY_B      = 1<<2,
+        IEEE80211_RATE_MANDATORY_G      = 1<<3,
+        IEEE80211_RATE_ERP_G            = 1<<4,
+};
 
-struct ieee80211_radiotap_iterator {
-        struct ieee80211_radiotap_header *rtheader;
-        int max_length;
-        int this_arg_index;
-        u8 *this_arg;
+/**
+ * struct ieee80211_rate - bitrate definition
+ *
+ * This structure describes a bitrate that an 802.11 PHY can
+ * operate with. The two values @hw_value and @hw_value_short
+ * are only for driver use when pointers to this structure are
+ * passed around.
+ *
+ * @flags: rate-specific flags
+ * @bitrate: bitrate in units of 100 Kbps
+ * @hw_value: driver/hardware value for this rate
+ * @hw_value_short: driver/hardware value for this rate when
+ *      short preamble is used
+ */
+struct ieee80211_rate {
+        u32 flags;
+        u16 bitrate;
+        u16 hw_value, hw_value_short;
+};
 
-        int arg_index;
-        u8 *arg;
-        __le32 *next_bitmap;
-        u32 bitmap_shifter;
+/**
+ * struct ieee80211_sta_ht_cap - STA's HT capabilities
+ *
+ * This structure describes most essential parameters needed
+ * to describe 802.11n HT capabilities for an STA.
+ *
+ * @ht_supported: is HT supported by the STA
+ * @cap: HT capabilities map as described in 802.11n spec
+ * @ampdu_factor: Maximum A-MPDU length factor
+ * @ampdu_density: Minimum A-MPDU spacing
+ * @mcs: Supported MCS rates
+ */
+struct ieee80211_sta_ht_cap {
+        u16 cap; /* use IEEE80211_HT_CAP_ */
+        bool ht_supported;
+        u8 ampdu_factor;
+        u8 ampdu_density;
+        struct ieee80211_mcs_info mcs;
 };
 
-extern int ieee80211_radiotap_iterator_init(
-   struct ieee80211_radiotap_iterator *iterator,
-   struct ieee80211_radiotap_header *radiotap_header,
-   int max_length);
+/**
+ * struct ieee80211_supported_band - frequency band definition
+ *
+ * This structure describes a frequency band a wiphy
+ * is able to operate in.
+ *
+ * @channels: Array of channels the hardware can operate in
+ *      in this band.
+ * @band: the band this structure represents
+ * @n_channels: Number of channels in @channels
+ * @bitrates: Array of bitrates the hardware can operate with
+ *      in this band. Must be sorted to give a valid "supported
+ *      rates" IE, i.e. CCK rates first, then OFDM.
+ * @n_bitrates: Number of bitrates in @bitrates
+ */
+struct ieee80211_supported_band {
+        struct ieee80211_channel *channels;
+        struct ieee80211_rate *bitrates;
+        enum ieee80211_band band;
+        int n_channels;
+        int n_bitrates;
+        struct ieee80211_sta_ht_cap ht_cap;
+};
 
-extern int ieee80211_radiotap_iterator_next(
-   struct ieee80211_radiotap_iterator *iterator);
+/*
+ * Wireless hardware/device configuration structures and methods
+ */
 
+/**
+ * struct vif_params - describes virtual interface parameters
+ * @mesh_id: mesh ID to use
+ * @mesh_id_len: length of the mesh ID
+ */
+struct vif_params {
+       u8 *mesh_id;
+       int mesh_id_len;
+};
 
- /**
+/**
  * struct key_params - key information
  *
  * Information about a key
@@ -106,27 +255,6 @@ struct beacon_parameters {
 };
 
 /**
- * enum station_flags - station flags
- *
- * Station capability flags. Note that these must be the bits
- * according to the nl80211 flags.
- *
- * @STATION_FLAG_CHANGED: station flags were changed
- * @STATION_FLAG_AUTHORIZED: station is authorized to send frames (802.1X)
- * @STATION_FLAG_SHORT_PREAMBLE: station is capable of receiving frames
- *      with short preambles
- * @STATION_FLAG_WME: station is WME/QoS capable
- * @STATION_FLAG_MFP: station uses management frame protection
- */
-enum station_flags {
-        STATION_FLAG_CHANGED            = 1<<0,
-        STATION_FLAG_AUTHORIZED         = 1<<NL80211_STA_FLAG_AUTHORIZED,
-        STATION_FLAG_SHORT_PREAMBLE     = 1<<NL80211_STA_FLAG_SHORT_PREAMBLE,
-        STATION_FLAG_WME                = 1<<NL80211_STA_FLAG_WME,
-        STATION_FLAG_MFP                = 1<<NL80211_STA_FLAG_MFP,
-};
-
-/**
  * enum plink_action - actions to perform in mesh peers
  *
  * @PLINK_ACTION_INVALID: action 0 is reserved
@@ -148,14 +276,17 @@ enum plink_actions {
  * @supported_rates: supported rates in IEEE 802.11 format
  *      (or NULL for no change)
  * @supported_rates_len: number of supported rates
- * @station_flags: station flags (see &enum station_flags)
+ * @sta_flags_mask: station flags that changed
+ *      (bitmask of BIT(NL80211_STA_FLAG_...))
+ * @sta_flags_set: station flags values
+ *      (bitmask of BIT(NL80211_STA_FLAG_...))
  * @listen_interval: listen interval or -1 for no change
  * @aid: AID or zero for no change
  */
 struct station_parameters {
         u8 *supported_rates;
         struct net_device *vlan;
-        u32 station_flags;
+        u32 sta_flags_mask, sta_flags_set;
         int listen_interval;
         u16 aid;
         u8 supported_rates_len;
@@ -348,92 +479,6 @@ struct bss_parameters {
         u8 basic_rates_len;
 };
 
-/**
- * enum environment_cap - Environment parsed from country IE
- * @ENVIRON_ANY: indicates country IE applies to both indoor and
- *      outdoor operation.
- * @ENVIRON_INDOOR: indicates country IE applies only to indoor operation
- * @ENVIRON_OUTDOOR: indicates country IE applies only to outdoor operation
- */
-enum environment_cap {
-        ENVIRON_ANY,
-        ENVIRON_INDOOR,
-        ENVIRON_OUTDOOR,
-};
-
-/**
- * struct regulatory_request - used to keep track of regulatory requests
- *
- * @wiphy_idx: this is set if this request's initiator is
- *      %REGDOM_SET_BY_COUNTRY_IE or %REGDOM_SET_BY_DRIVER. This
- *      can be used by the wireless core to deal with conflicts
- *      and potentially inform users of which devices specifically
- *      cased the conflicts.
- * @initiator: indicates who sent this request, could be any of
- *      of those set in nl80211_reg_initiator (%NL80211_REGDOM_SET_BY_*)
- * @alpha2: the ISO / IEC 3166 alpha2 country code of the requested
- *      regulatory domain. We have a few special codes:
- *      00 - World regulatory domain
- *      99 - built by driver but a specific alpha2 cannot be determined
- *      98 - result of an intersection between two regulatory domains
- * @intersect: indicates whether the wireless core should intersect
- *      the requested regulatory domain with the presently set regulatory
- *      domain.
- * @country_ie_checksum: checksum of the last processed and accepted
- *      country IE
- * @country_ie_env: lets us know if the AP is telling us we are outdoor,
- *      indoor, or if it doesn't matter
- * @list: used to insert into the reg_requests_list linked list
- */
-struct regulatory_request {
-        int wiphy_idx;
-        enum nl80211_reg_initiator initiator;
-        char alpha2[2];
-        bool intersect;
-        u32 country_ie_checksum;
-        enum environment_cap country_ie_env;
-        struct list_head list;
-};
-
-struct ieee80211_freq_range {
-        u32 start_freq_khz;
-        u32 end_freq_khz;
-        u32 max_bandwidth_khz;
-};
-
-struct ieee80211_power_rule {
-        u32 max_antenna_gain;
-        u32 max_eirp;
-};
-
-struct ieee80211_reg_rule {
-        struct ieee80211_freq_range freq_range;
-        struct ieee80211_power_rule power_rule;
-        u32 flags;
-};
-
-struct ieee80211_regdomain {
-        u32 n_reg_rules;
-        char alpha2[2];
-        struct ieee80211_reg_rule reg_rules[];
-};
-
-#define MHZ_TO_KHZ(freq) ((freq) * 1000)
-#define KHZ_TO_MHZ(freq) ((freq) / 1000)
-#define DBI_TO_MBI(gain) ((gain) * 100)
-#define MBI_TO_DBI(gain) ((gain) / 100)
-#define DBM_TO_MBM(gain) ((gain) * 100)
-#define MBM_TO_DBM(gain) ((gain) / 100)
-
-#define REG_RULE(start, end, bw, gain, eirp, reg_flags) { \
-        .freq_range.start_freq_khz = MHZ_TO_KHZ(start), \
-        .freq_range.end_freq_khz = MHZ_TO_KHZ(end), \
-        .freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw), \
-        .power_rule.max_antenna_gain = DBI_TO_MBI(gain), \
-        .power_rule.max_eirp = DBM_TO_MBM(eirp), \
-        .flags = reg_flags, \
-        }
-
 struct mesh_config {
         /* Timeouts in ms */
         /* Mesh plink management parameters */
@@ -504,7 +549,7 @@ struct cfg80211_scan_request {
         int n_ssids;
         struct ieee80211_channel **channels;
         u32 n_channels;
-        u8 *ie;
+        const u8 *ie;
         size_t ie_len;
 
         /* internal */
@@ -612,6 +657,11 @@ struct cfg80211_auth_request {
  * @ssid_len: Length of ssid in octets
  * @ie: Extra IEs to add to (Re)Association Request frame or %NULL
  * @ie_len: Length of ie buffer in octets
+ * @use_mfp: Use management frame protection (IEEE 802.11w) in this association
+ * @control_port: Whether user space controls IEEE 802.1X port, i.e.,
+ *      sets/clears %NL80211_STA_FLAG_AUTHORIZED. If true, the driver is
+ *      required to assume that the port is unauthorized until authorized by
+ *      user space. Otherwise, port is marked authorized by default.
  */
 struct cfg80211_assoc_request {
         struct ieee80211_channel *chan;
@@ -620,6 +670,8 @@ struct cfg80211_assoc_request {
         size_t ssid_len;
         const u8 *ie;
         size_t ie_len;
+        bool use_mfp;
+        bool control_port;
 };
 
 /**
@@ -659,6 +711,60 @@ struct cfg80211_disassoc_request {
 };
 
 /**
+ * struct cfg80211_ibss_params - IBSS parameters
+ *
+ * This structure defines the IBSS parameters for the join_ibss()
+ * method.
+ *
+ * @ssid: The SSID, will always be non-null.
+ * @ssid_len: The length of the SSID, will always be non-zero.
+ * @bssid: Fixed BSSID requested, maybe be %NULL, if set do not
+ *      search for IBSSs with a different BSSID.
+ * @channel: The channel to use if no IBSS can be found to join.
+ * @channel_fixed: The channel should be fixed -- do not search for
+ *      IBSSs to join on other channels.
+ * @ie: information element(s) to include in the beacon
+ * @ie_len: length of that
+ * @beacon_interval: beacon interval to use
+ */
+struct cfg80211_ibss_params {
+        u8 *ssid;
+        u8 *bssid;
+        struct ieee80211_channel *channel;
+        u8 *ie;
+        u8 ssid_len, ie_len;
+        u16 beacon_interval;
+        bool channel_fixed;
+};
+
+/**
+ * enum wiphy_params_flags - set_wiphy_params bitfield values
+ * WIPHY_PARAM_RETRY_SHORT: wiphy->retry_short has changed
+ * WIPHY_PARAM_RETRY_LONG: wiphy->retry_long has changed
+ * WIPHY_PARAM_FRAG_THRESHOLD: wiphy->frag_threshold has changed
+ * WIPHY_PARAM_RTS_THRESHOLD: wiphy->rts_threshold has changed
+ */
+enum wiphy_params_flags {
+        WIPHY_PARAM_RETRY_SHORT         = 1 << 0,
+        WIPHY_PARAM_RETRY_LONG          = 1 << 1,
+        WIPHY_PARAM_FRAG_THRESHOLD      = 1 << 2,
+        WIPHY_PARAM_RTS_THRESHOLD       = 1 << 3,
+};
+
+/**
+ * enum tx_power_setting - TX power adjustment
+ *
+ * @TX_POWER_AUTOMATIC: the dbm parameter is ignored
+ * @TX_POWER_LIMITED: limit TX power by the dbm parameter
+ * @TX_POWER_FIXED: fix TX power to the dbm parameter
+ */
+enum tx_power_setting {
+        TX_POWER_AUTOMATIC,
+        TX_POWER_LIMITED,
+        TX_POWER_FIXED,
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -688,10 +794,11 @@ struct cfg80211_disassoc_request {
  * @get_key: get information about the key with the given parameters.
  *      @mac_addr will be %NULL when requesting information for a group
  *      key. All pointers given to the @callback function need not be valid
- *      after it returns.
+ *      after it returns. This function should return an error if it is
+ *      not possible to retrieve the key, -ENOENT if it doesn't exist.
  *
  * @del_key: remove a key given the @mac_addr (%NULL for a group key)
- *      and @key_index
+ *      and @key_index, return -ENOENT if the key doesn't exist.
  *
  * @set_default_key: set the default key on an interface
  *
@@ -733,6 +840,23 @@ struct cfg80211_disassoc_request {
  * @assoc: Request to (re)associate with the specified peer
  * @deauth: Request to deauthenticate from the specified peer
  * @disassoc: Request to disassociate from the specified peer
+ *
+ * @join_ibss: Join the specified IBSS (or create if necessary). Once done, call
+ *      cfg80211_ibss_joined(), also call that function when changing BSSID due
+ *      to a merge.
+ * @leave_ibss: Leave the IBSS.
+ *
+ * @set_wiphy_params: Notify that wiphy parameters have changed;
+ *      @changed bitfield (see &enum wiphy_params_flags) describes which values
+ *      have changed. The actual parameter values are available in
+ *      struct wiphy. If returning an error, no value should be changed.
+ *
+ * @set_tx_power: set the transmit power according to the parameters
+ * @get_tx_power: store the current TX power into the dbm variable;
+ *      return 0 if successful
+ *
+ * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
+ *      functions to adjust rfkill hw state
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy);
@@ -747,13 +871,13 @@ struct cfg80211_ops {
                                        struct vif_params *params);
 
         int     (*add_key)(struct wiphy *wiphy, struct net_device *netdev,
-                           u8 key_index, u8 *mac_addr,
+                           u8 key_index, const u8 *mac_addr,
                            struct key_params *params);
         int     (*get_key)(struct wiphy *wiphy, struct net_device *netdev,
-                           u8 key_index, u8 *mac_addr, void *cookie,
+                           u8 key_index, const u8 *mac_addr, void *cookie,
                            void (*callback)(void *cookie, struct key_params*));
         int     (*del_key)(struct wiphy *wiphy, struct net_device *netdev,
-                           u8 key_index, u8 *mac_addr);
+                           u8 key_index, const u8 *mac_addr);
         int     (*set_default_key)(struct wiphy *wiphy,
                                    struct net_device *netdev,
                                    u8 key_index);
@@ -818,9 +942,473 @@ struct cfg80211_ops {
                           struct cfg80211_deauth_request *req);
         int     (*disassoc)(struct wiphy *wiphy, struct net_device *dev,
                             struct cfg80211_disassoc_request *req);
+
+        int     (*join_ibss)(struct wiphy *wiphy, struct net_device *dev,
+                             struct cfg80211_ibss_params *params);
+        int     (*leave_ibss)(struct wiphy *wiphy, struct net_device *dev);
+
+        int     (*set_wiphy_params)(struct wiphy *wiphy, u32 changed);
+
+        int     (*set_tx_power)(struct wiphy *wiphy,
+                                enum tx_power_setting type, int dbm);
+        int     (*get_tx_power)(struct wiphy *wiphy, int *dbm);
+
+        void    (*rfkill_poll)(struct wiphy *wiphy);
 };
 
-/* temporary wext handlers */
+/*
+ * wireless hardware and networking interfaces structures
+ * and registration/helper functions
+ */
+
+/**
+ * struct wiphy - wireless hardware description
+ * @idx: the wiphy index assigned to this item
+ * @class_dev: the class device representing /sys/class/ieee80211/<wiphy-name>
+ * @custom_regulatory: tells us the driver for this device
+ *      has its own custom regulatory domain and cannot identify the
+ *      ISO / IEC 3166 alpha2 it belongs to. When this is enabled
+ *      we will disregard the first regulatory hint (when the
+ *      initiator is %REGDOM_SET_BY_CORE).
+ * @strict_regulatory: tells us the driver for this device will ignore
+ *      regulatory domain settings until it gets its own regulatory domain
+ *      via its regulatory_hint(). After its gets its own regulatory domain
+ *      it will only allow further regulatory domain settings to further
+ *      enhance compliance. For example if channel 13 and 14 are disabled
+ *      by this regulatory domain no user regulatory domain can enable these
+ *      channels at a later time. This can be used for devices which do not
+ *      have calibration information gauranteed for frequencies or settings
+ *      outside of its regulatory domain.
+ * @reg_notifier: the driver's regulatory notification callback
+ * @regd: the driver's regulatory domain, if one was requested via
+ *      the regulatory_hint() API. This can be used by the driver
+ *      on the reg_notifier() if it chooses to ignore future
+ *      regulatory domain changes caused by other drivers.
+ * @signal_type: signal type reported in &struct cfg80211_bss.
+ * @cipher_suites: supported cipher suites
+ * @n_cipher_suites: number of supported cipher suites
+ * @retry_short: Retry limit for short frames (dot11ShortRetryLimit)
+ * @retry_long: Retry limit for long frames (dot11LongRetryLimit)
+ * @frag_threshold: Fragmentation threshold (dot11FragmentationThreshold);
+ *      -1 = fragmentation disabled, only odd values >= 256 used
+ * @rts_threshold: RTS threshold (dot11RTSThreshold); -1 = RTS/CTS disabled
+ */
+struct wiphy {
+        /* assign these fields before you register the wiphy */
+
+        /* permanent MAC address */
+        u8 perm_addr[ETH_ALEN];
+
+        /* Supported interface modes, OR together BIT(NL80211_IFTYPE_...) */
+        u16 interface_modes;
+
+        bool custom_regulatory;
+        bool strict_regulatory;
+
+        enum cfg80211_signal_type signal_type;
+
+        int bss_priv_size;
+        u8 max_scan_ssids;
+        u16 max_scan_ie_len;
+
+        int n_cipher_suites;
+        const u32 *cipher_suites;
+
+        u8 retry_short;
+        u8 retry_long;
+        u32 frag_threshold;
+        u32 rts_threshold;
+
+        /* If multiple wiphys are registered and you're handed e.g.
+         * a regular netdev with assigned ieee80211_ptr, you won't
+         * know whether it points to a wiphy your driver has registered
+         * or not. Assign this to something global to your driver to
+         * help determine whether you own this wiphy or not. */
+        const void *privid;
+
+        struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS];
+
+        /* Lets us get back the wiphy on the callback */
+        int (*reg_notifier)(struct wiphy *wiphy,
+                            struct regulatory_request *request);
+
+        /* fields below are read-only, assigned by cfg80211 */
+
+        const struct ieee80211_regdomain *regd;
+
+        /* the item in /sys/class/ieee80211/ points to this,
+         * you need use set_wiphy_dev() (see below) */
+        struct device dev;
+
+        /* dir in debugfs: ieee80211/<wiphyname> */
+        struct dentry *debugfsdir;
+
+        char priv[0] __attribute__((__aligned__(NETDEV_ALIGN)));
+};
+
+/**
+ * wiphy_priv - return priv from wiphy
+ *
+ * @wiphy: the wiphy whose priv pointer to return
+ */
+static inline void *wiphy_priv(struct wiphy *wiphy)
+{
+        BUG_ON(!wiphy);
+        return &wiphy->priv;
+}
+
+/**
+ * set_wiphy_dev - set device pointer for wiphy
+ *
+ * @wiphy: The wiphy whose device to bind
+ * @dev: The device to parent it to
+ */
+static inline void set_wiphy_dev(struct wiphy *wiphy, struct device *dev)
+{
+        wiphy->dev.parent = dev;
+}
+
+/**
+ * wiphy_dev - get wiphy dev pointer
+ *
+ * @wiphy: The wiphy whose device struct to look up
+ */
+static inline struct device *wiphy_dev(struct wiphy *wiphy)
+{
+        return wiphy->dev.parent;
+}
+
+/**
+ * wiphy_name - get wiphy name
+ *
+ * @wiphy: The wiphy whose name to return
+ */
+static inline const char *wiphy_name(struct wiphy *wiphy)
+{
+        return dev_name(&wiphy->dev);
+}
+
+/**
+ * wiphy_new - create a new wiphy for use with cfg80211
+ *
+ * @ops: The configuration operations for this device
+ * @sizeof_priv: The size of the private area to allocate
+ *
+ * Create a new wiphy and associate the given operations with it.
+ * @sizeof_priv bytes are allocated for private use.
+ *
+ * The returned pointer must be assigned to each netdev's
+ * ieee80211_ptr for proper operation.
+ */
+struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv);
+
+/**
+ * wiphy_register - register a wiphy with cfg80211
+ *
+ * @wiphy: The wiphy to register.
+ *
+ * Returns a non-negative wiphy index or a negative error code.
+ */
+extern int wiphy_register(struct wiphy *wiphy);
+
+/**
+ * wiphy_unregister - deregister a wiphy from cfg80211
+ *
+ * @wiphy: The wiphy to unregister.
+ *
+ * After this call, no more requests can be made with this priv
+ * pointer, but the call may sleep to wait for an outstanding
+ * request that is being handled.
+ */
+extern void wiphy_unregister(struct wiphy *wiphy);
+
+/**
+ * wiphy_free - free wiphy
+ *
+ * @wiphy: The wiphy to free
+ */
+extern void wiphy_free(struct wiphy *wiphy);
+
+/**
+ * struct wireless_dev - wireless per-netdev state
+ *
+ * This structure must be allocated by the driver/stack
+ * that uses the ieee80211_ptr field in struct net_device
+ * (this is intentional so it can be allocated along with
+ * the netdev.)
+ *
+ * @wiphy: pointer to hardware description
+ * @iftype: interface type
+ * @list: (private) Used to collect the interfaces
+ * @netdev: (private) Used to reference back to the netdev
+ * @current_bss: (private) Used by the internal configuration code
+ * @bssid: (private) Used by the internal configuration code
+ * @ssid: (private) Used by the internal configuration code
+ * @ssid_len: (private) Used by the internal configuration code
+ * @wext: (private) Used by the internal wireless extensions compat code
+ * @wext_bssid: (private) Used by the internal wireless extensions compat code
+ */
+struct wireless_dev {
+        struct wiphy *wiphy;
+        enum nl80211_iftype iftype;
+
+        /* private to the generic wireless code */
+        struct list_head list;
+        struct net_device *netdev;
+
+        /* currently used for IBSS - might be rearranged in the future */
+        struct cfg80211_bss *current_bss;
+        u8 bssid[ETH_ALEN];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 ssid_len;
+
+#ifdef CONFIG_WIRELESS_EXT
+        /* wext data */
+        struct {
+                struct cfg80211_ibss_params ibss;
+                u8 bssid[ETH_ALEN];
+                s8 default_key, default_mgmt_key;
+        } wext;
+#endif
+};
+
+/**
+ * wdev_priv - return wiphy priv from wireless_dev
+ *
+ * @wdev: The wireless device whose wiphy's priv pointer to return
+ */
+static inline void *wdev_priv(struct wireless_dev *wdev)
+{
+        BUG_ON(!wdev);
+        return wiphy_priv(wdev->wiphy);
+}
+
+/*
+ * Utility functions
+ */
+
+/**
+ * ieee80211_channel_to_frequency - convert channel number to frequency
+ */
+extern int ieee80211_channel_to_frequency(int chan);
+
+/**
+ * ieee80211_frequency_to_channel - convert frequency to channel number
+ */
+extern int ieee80211_frequency_to_channel(int freq);
+
+/*
+ * Name indirection necessary because the ieee80211 code also has
+ * a function named "ieee80211_get_channel", so if you include
+ * cfg80211's header file you get cfg80211's version, if you try
+ * to include both header files you'll (rightfully!) get a symbol
+ * clash.
+ */
+extern struct ieee80211_channel *__ieee80211_get_channel(struct wiphy *wiphy,
+                                                         int freq);
+/**
+ * ieee80211_get_channel - get channel struct from wiphy for specified frequency
+ */
+static inline struct ieee80211_channel *
+ieee80211_get_channel(struct wiphy *wiphy, int freq)
+{
+        return __ieee80211_get_channel(wiphy, freq);
+}
+
+/**
+ * ieee80211_get_response_rate - get basic rate for a given rate
+ *
+ * @sband: the band to look for rates in
+ * @basic_rates: bitmap of basic rates
+ * @bitrate: the bitrate for which to find the basic rate
+ *
+ * This function returns the basic rate corresponding to a given
+ * bitrate, that is the next lower bitrate contained in the basic
+ * rate map, which is, for this function, given as a bitmap of
+ * indices of rates in the band's bitrate table.
+ */
+struct ieee80211_rate *
+ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
+                            u32 basic_rates, int bitrate);
+
+/*
+ * Radiotap parsing functions -- for controlled injection support
+ *
+ * Implemented in net/wireless/radiotap.c
+ * Documentation in Documentation/networking/radiotap-headers.txt
+ */
+
+/**
+ * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args
+ * @rtheader: pointer to the radiotap header we are walking through
+ * @max_length: length of radiotap header in cpu byte ordering
+ * @this_arg_index: IEEE80211_RADIOTAP_... index of current arg
+ * @this_arg: pointer to current radiotap arg
+ * @arg_index: internal next argument index
+ * @arg: internal next argument pointer
+ * @next_bitmap: internal pointer to next present u32
+ * @bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
+ */
+
+struct ieee80211_radiotap_iterator {
+        struct ieee80211_radiotap_header *rtheader;
+        int max_length;
+        int this_arg_index;
+        u8 *this_arg;
+
+        int arg_index;
+        u8 *arg;
+        __le32 *next_bitmap;
+        u32 bitmap_shifter;
+};
+
+extern int ieee80211_radiotap_iterator_init(
+   struct ieee80211_radiotap_iterator *iterator,
+   struct ieee80211_radiotap_header *radiotap_header,
+   int max_length);
+
+extern int ieee80211_radiotap_iterator_next(
+   struct ieee80211_radiotap_iterator *iterator);
+
+extern const unsigned char rfc1042_header[6];
+extern const unsigned char bridge_tunnel_header[6];
+
+/**
+ * ieee80211_get_hdrlen_from_skb - get header length from data
+ *
+ * Given an skb with a raw 802.11 header at the data pointer this function
+ * returns the 802.11 header length in bytes (not including encryption
+ * headers). If the data in the sk_buff is too short to contain a valid 802.11
+ * header the function returns 0.
+ *
+ * @skb: the frame
+ */
+unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
+
+/**
+ * ieee80211_hdrlen - get header length in bytes from frame control
+ * @fc: frame control field in little-endian format
+ */
+unsigned int ieee80211_hdrlen(__le16 fc);
+
+/**
+ * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
+ * @skb: the 802.11 data frame
+ * @addr: the device MAC address
+ * @iftype: the virtual interface type
+ */
+int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
+                           enum nl80211_iftype iftype);
+
+/**
+ * ieee80211_data_from_8023 - convert an 802.3 frame to 802.11
+ * @skb: the 802.3 frame
+ * @addr: the device MAC address
+ * @iftype: the virtual interface type
+ * @bssid: the network bssid (used only for iftype STATION and ADHOC)
+ * @qos: build 802.11 QoS data frame
+ */
+int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
+                             enum nl80211_iftype iftype, u8 *bssid, bool qos);
+
+/**
+ * cfg80211_classify8021d - determine the 802.1p/1d tag for a data frame
+ * @skb: the data frame
+ */
+unsigned int cfg80211_classify8021d(struct sk_buff *skb);
+
+/*
+ * Regulatory helper functions for wiphys
+ */
+
+/**
+ * regulatory_hint - driver hint to the wireless core a regulatory domain
+ * @wiphy: the wireless device giving the hint (used only for reporting
+ *      conflicts)
+ * @alpha2: the ISO/IEC 3166 alpha2 the driver claims its regulatory domain
+ *      should be in. If @rd is set this should be NULL. Note that if you
+ *      set this to NULL you should still set rd->alpha2 to some accepted
+ *      alpha2.
+ *
+ * Wireless drivers can use this function to hint to the wireless core
+ * what it believes should be the current regulatory domain by
+ * giving it an ISO/IEC 3166 alpha2 country code it knows its regulatory
+ * domain should be in or by providing a completely build regulatory domain.
+ * If the driver provides an ISO/IEC 3166 alpha2 userspace will be queried
+ * for a regulatory domain structure for the respective country.
+ *
+ * The wiphy must have been registered to cfg80211 prior to this call.
+ * For cfg80211 drivers this means you must first use wiphy_register(),
+ * for mac80211 drivers you must first use ieee80211_register_hw().
+ *
+ * Drivers should check the return value, its possible you can get
+ * an -ENOMEM.
+ */
+extern int regulatory_hint(struct wiphy *wiphy, const char *alpha2);
+
+/**
+ * regulatory_hint_11d - hints a country IE as a regulatory domain
+ * @wiphy: the wireless device giving the hint (used only for reporting
+ *      conflicts)
+ * @country_ie: pointer to the country IE
+ * @country_ie_len: length of the country IE
+ *
+ * We will intersect the rd with the what CRDA tells us should apply
+ * for the alpha2 this country IE belongs to, this prevents APs from
+ * sending us incorrect or outdated information against a country.
+ */
+extern void regulatory_hint_11d(struct wiphy *wiphy,
+                                u8 *country_ie,
+                                u8 country_ie_len);
+/**
+ * wiphy_apply_custom_regulatory - apply a custom driver regulatory domain
+ * @wiphy: the wireless device we want to process the regulatory domain on
+ * @regd: the custom regulatory domain to use for this wiphy
+ *
+ * Drivers can sometimes have custom regulatory domains which do not apply
+ * to a specific country. Drivers can use this to apply such custom regulatory
+ * domains. This routine must be called prior to wiphy registration. The
+ * custom regulatory domain will be trusted completely and as such previous
+ * default channel settings will be disregarded. If no rule is found for a
+ * channel on the regulatory domain the channel will be disabled.
+ */
+extern void wiphy_apply_custom_regulatory(
+        struct wiphy *wiphy,
+        const struct ieee80211_regdomain *regd);
+
+/**
+ * freq_reg_info - get regulatory information for the given frequency
+ * @wiphy: the wiphy for which we want to process this rule for
+ * @center_freq: Frequency in KHz for which we want regulatory information for
+ * @desired_bw_khz: the desired max bandwidth you want to use per
+ *      channel. Note that this is still 20 MHz if you want to use HT40
+ *      as HT40 makes use of two channels for its 40 MHz width bandwidth.
+ *      If set to 0 we'll assume you want the standard 20 MHz.
+ * @reg_rule: the regulatory rule which we have for this frequency
+ *
+ * Use this function to get the regulatory rule for a specific frequency on
+ * a given wireless device. If the device has a specific regulatory domain
+ * it wants to follow we respect that unless a country IE has been received
+ * and processed already.
+ *
+ * Returns 0 if it was able to find a valid regulatory rule which does
+ * apply to the given center_freq otherwise it returns non-zero. It will
+ * also return -ERANGE if we determine the given center_freq does not even have
+ * a regulatory rule for a frequency range in the center_freq's band. See
+ * freq_in_rule_band() for our current definition of a band -- this is purely
+ * subjective and right now its 802.11 specific.
+ */
+extern int freq_reg_info(struct wiphy *wiphy,
+                         u32 center_freq,
+                         u32 desired_bw_khz,
+                         const struct ieee80211_reg_rule **reg_rule);
+
+/*
+ * Temporary wext handlers & helper functions
+ *
+ * In the future cfg80211 will simply assign the entire wext handler
+ * structure to netdevs it manages, but we're not there yet.
+ */
 int cfg80211_wext_giwname(struct net_device *dev,
                           struct iw_request_info *info,
                           char *name, char *extra);
@@ -834,9 +1422,72 @@ int cfg80211_wext_siwscan(struct net_device *dev,
 int cfg80211_wext_giwscan(struct net_device *dev,
                           struct iw_request_info *info,
                           struct iw_point *data, char *extra);
+int cfg80211_wext_siwmlme(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_point *data, char *extra);
 int cfg80211_wext_giwrange(struct net_device *dev,
                            struct iw_request_info *info,
                            struct iw_point *data, char *extra);
+int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_freq *freq, char *extra);
+int cfg80211_ibss_wext_giwfreq(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_freq *freq, char *extra);
+int cfg80211_ibss_wext_siwessid(struct net_device *dev,
+                                struct iw_request_info *info,
+                                struct iw_point *data, char *ssid);
+int cfg80211_ibss_wext_giwessid(struct net_device *dev,
+                                struct iw_request_info *info,
+                                struct iw_point *data, char *ssid);
+int cfg80211_ibss_wext_siwap(struct net_device *dev,
+                             struct iw_request_info *info,
+                             struct sockaddr *ap_addr, char *extra);
+int cfg80211_ibss_wext_giwap(struct net_device *dev,
+                             struct iw_request_info *info,
+                             struct sockaddr *ap_addr, char *extra);
+
+struct ieee80211_channel *cfg80211_wext_freq(struct wiphy *wiphy,
+                                             struct iw_freq *freq);
+
+int cfg80211_wext_siwrts(struct net_device *dev,
+                         struct iw_request_info *info,
+                         struct iw_param *rts, char *extra);
+int cfg80211_wext_giwrts(struct net_device *dev,
+                         struct iw_request_info *info,
+                         struct iw_param *rts, char *extra);
+int cfg80211_wext_siwfrag(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *frag, char *extra);
+int cfg80211_wext_giwfrag(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *frag, char *extra);
+int cfg80211_wext_siwretry(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *retry, char *extra);
+int cfg80211_wext_giwretry(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *retry, char *extra);
+int cfg80211_wext_siwencodeext(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_point *erq, char *extra);
+int cfg80211_wext_siwencode(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct iw_point *erq, char *keybuf);
+int cfg80211_wext_giwencode(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct iw_point *erq, char *keybuf);
+int cfg80211_wext_siwtxpower(struct net_device *dev,
+                             struct iw_request_info *info,
+                             union iwreq_data *data, char *keybuf);
+int cfg80211_wext_giwtxpower(struct net_device *dev,
+                             struct iw_request_info *info,
+                             union iwreq_data *data, char *keybuf);
+
+/*
+ * callbacks for asynchronous cfg80211 methods, notification
+ * functions and BSS handling helpers
+ */
 
 /**
  * cfg80211_scan_done - notify that scan finished
@@ -864,6 +1515,14 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
                           struct ieee80211_mgmt *mgmt, size_t len,
                           s32 signal, gfp_t gfp);
 
+struct cfg80211_bss*
+cfg80211_inform_bss(struct wiphy *wiphy,
+                    struct ieee80211_channel *channel,
+                    const u8 *bssid,
+                    u64 timestamp, u16 capability, u16 beacon_interval,
+                    const u8 *ie, size_t ielen,
+                    s32 signal, gfp_t gfp);
+
 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
                                       struct ieee80211_channel *channel,
                                       const u8 *bssid,
@@ -883,6 +1542,7 @@ struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
                                        const u8 *meshid, size_t meshidlen,
                                        const u8 *meshcfg);
 void cfg80211_put_bss(struct cfg80211_bss *bss);
+
 /**
  * cfg80211_unlink_bss - unlink BSS from internal data structures
  * @wiphy: the wiphy
@@ -902,44 +1562,62 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *bss);
  * @len: length of the frame data
  *
  * This function is called whenever an authentication has been processed in
- * station mode.
+ * station mode. The driver is required to call either this function or
+ * cfg80211_send_auth_timeout() to indicate the result of cfg80211_ops::auth()
+ * call.
  */
 void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
 
 /**
+ * cfg80211_send_auth_timeout - notification of timed out authentication
+ * @dev: network device
+ * @addr: The MAC address of the device with which the authentication timed out
+ */
+void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr);
+
+/**
  * cfg80211_send_rx_assoc - notification of processed association
  * @dev: network device
  * @buf: (re)association response frame (header + body)
  * @len: length of the frame data
  *
  * This function is called whenever a (re)association response has been
- * processed in station mode.
+ * processed in station mode. The driver is required to call either this
+ * function or cfg80211_send_assoc_timeout() to indicate the result of
+ * cfg80211_ops::assoc() call.
  */
 void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len);
 
 /**
- * cfg80211_send_rx_deauth - notification of processed deauthentication
+ * cfg80211_send_assoc_timeout - notification of timed out association
+ * @dev: network device
+ * @addr: The MAC address of the device with which the association timed out
+ */
+void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr);
+
+/**
+ * cfg80211_send_deauth - notification of processed deauthentication
  * @dev: network device
  * @buf: deauthentication frame (header + body)
  * @len: length of the frame data
  *
  * This function is called whenever deauthentication has been processed in
- * station mode.
+ * station mode. This includes both received deauthentication frames and
+ * locally generated ones.
  */
-void cfg80211_send_rx_deauth(struct net_device *dev, const u8 *buf,
-                             size_t len);
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len);
 
 /**
- * cfg80211_send_rx_disassoc - notification of processed disassociation
+ * cfg80211_send_disassoc - notification of processed disassociation
  * @dev: network device
  * @buf: disassociation response frame (header + body)
  * @len: length of the frame data
  *
  * This function is called whenever disassociation has been processed in
- * station mode.
+ * station mode. This includes both received disassociation frames and locally
+ * generated ones.
  */
-void cfg80211_send_rx_disassoc(struct net_device *dev, const u8 *buf,
-                               size_t len);
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len);
 
 /**
  * cfg80211_hold_bss - exclude bss from expiration
@@ -958,4 +1636,55 @@ void cfg80211_hold_bss(struct cfg80211_bss *bss);
  */
 void cfg80211_unhold_bss(struct cfg80211_bss *bss);
 
+/**
+ * cfg80211_michael_mic_failure - notification of Michael MIC failure (TKIP)
+ * @dev: network device
+ * @addr: The source MAC address of the frame
+ * @key_type: The key type that the received frame used
+ * @key_id: Key identifier (0..3)
+ * @tsc: The TSC value of the frame that generated the MIC failure (6 octets)
+ *
+ * This function is called whenever the local MAC detects a MIC failure in a
+ * received frame. This matches with MLME-MICHAELMICFAILURE.indication()
+ * primitive.
+ */
+void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
+                                  enum nl80211_key_type key_type, int key_id,
+                                  const u8 *tsc);
+
+/**
+ * cfg80211_ibss_joined - notify cfg80211 that device joined an IBSS
+ *
+ * @dev: network device
+ * @bssid: the BSSID of the IBSS joined
+ * @gfp: allocation flags
+ *
+ * This function notifies cfg80211 that the device joined an IBSS or
+ * switched to a different BSSID. Before this function can be called,
+ * either a beacon has to have been received from the IBSS, or one of
+ * the cfg80211_inform_bss{,_frame} functions must have been called
+ * with the locally generated beacon -- this guarantees that there is
+ * always a scan result for this IBSS. cfg80211 will handle the rest.
+ */
+void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
+
+/**
+ * wiphy_rfkill_set_hw_state - notify cfg80211 about hw block state
+ * @wiphy: the wiphy
+ * @blocked: block status
+ */
+void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked);
+
+/**
+ * wiphy_rfkill_start_polling - start polling rfkill
+ * @wiphy: the wiphy
+ */
+void wiphy_rfkill_start_polling(struct wiphy *wiphy);
+
+/**
+ * wiphy_rfkill_stop_polling - stop polling rfkill
+ * @wiphy: the wiphy
+ */
+void wiphy_rfkill_stop_polling(struct wiphy *wiphy);
+
 #endif /* __NET_CFG80211_H */
diff --git a/include/net/dst.h b/include/net/dst.h
index 6be3b082a070..7fc409c19b37 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -195,6 +195,12 @@ struct dst_entry * dst_clone(struct dst_entry * dst)
 }
 
 extern void dst_release(struct dst_entry *dst);
+static inline void skb_dst_drop(struct sk_buff *skb)
+{
+        if (skb->_skb_dst)
+                dst_release(skb_dst(skb));
+        skb->_skb_dst = 0UL;
+}
 
 /* Children define the path of the packet through the
  * Linux networking.  Thus, destinations are stackable.
@@ -246,7 +252,7 @@ static inline void dst_negative_advice(struct dst_entry **dst_p)
 
 static inline void dst_link_failure(struct sk_buff *skb)
 {
-        struct dst_entry * dst = skb->dst;
+        struct dst_entry *dst = skb_dst(skb);
         if (dst && dst->ops && dst->ops->link_failure)
                 dst->ops->link_failure(skb);
 }
@@ -265,13 +271,13 @@ static inline void dst_set_expires(struct dst_entry *dst, int timeout)
 /* Output packet to network from transport.  */
 static inline int dst_output(struct sk_buff *skb)
 {
-        return skb->dst->output(skb);
+        return skb_dst(skb)->output(skb);
 }
 
 /* Input packet from network to transport.  */
 static inline int dst_input(struct sk_buff *skb)
 {
-        return skb->dst->input(skb);
+        return skb_dst(skb)->input(skb);
 }
 
 static inline struct dst_entry *dst_check(struct dst_entry *dst, u32 cookie)
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index c2bb5cae6515..ca4b2e840078 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -48,14 +48,12 @@ struct fib_rules_ops
                                          struct flowi *, int);
         int                     (*configure)(struct fib_rule *,
                                              struct sk_buff *,
-                                             struct nlmsghdr *,
                                              struct fib_rule_hdr *,
                                              struct nlattr **);
         int                     (*compare)(struct fib_rule *,
                                            struct fib_rule_hdr *,
                                            struct nlattr **);
         int                     (*fill)(struct fib_rule *, struct sk_buff *,
-                                        struct nlmsghdr *,
                                         struct fib_rule_hdr *);
         u32                     (*default_pref)(struct fib_rules_ops *ops);
         size_t                  (*nlmsg_payload)(struct fib_rule *);
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 747c255d1df0..1b0e3ee4ddd8 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -88,6 +88,8 @@ struct genl_ops
 };
 
 extern int genl_register_family(struct genl_family *family);
+extern int genl_register_family_with_ops(struct genl_family *family,
+        struct genl_ops *ops, size_t n_ops);
 extern int genl_unregister_family(struct genl_family *family);
 extern int genl_register_ops(struct genl_family *, struct genl_ops *ops);
 extern int genl_unregister_ops(struct genl_family *, struct genl_ops *ops);
diff --git a/include/net/ieee802154/af_ieee802154.h b/include/net/ieee802154/af_ieee802154.h
new file mode 100644
index 000000000000..0d78605fb1a6
--- /dev/null
+++ b/include/net/ieee802154/af_ieee802154.h
@@ -0,0 +1,60 @@
+/*
+ * IEEE 802.15.4 inteface for userspace
+ *
+ * Copyright 2007, 2008 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Sergey Lapin <slapin@ossfans.org>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ */
+
+#ifndef _AF_IEEE802154_H
+#define _AF_IEEE802154_H
+
+#include <linux/socket.h> /* for sa_family_t */
+
+enum {
+        IEEE802154_ADDR_NONE = 0x0,
+        /* RESERVED = 0x01, */
+        IEEE802154_ADDR_SHORT = 0x2, /* 16-bit address + PANid */
+        IEEE802154_ADDR_LONG = 0x3, /* 64-bit address + PANid */
+};
+
+/* address length, octets */
+#define IEEE802154_ADDR_LEN     8
+
+struct ieee802154_addr {
+        int addr_type;
+        u16 pan_id;
+        union {
+                u8 hwaddr[IEEE802154_ADDR_LEN];
+                u16 short_addr;
+        };
+};
+
+#define IEEE802154_PANID_BROADCAST      0xffff
+#define IEEE802154_ADDR_BROADCAST       0xffff
+#define IEEE802154_ADDR_UNDEF           0xfffe
+
+struct sockaddr_ieee802154 {
+        sa_family_t family; /* AF_IEEE802154 */
+        struct ieee802154_addr addr;
+};
+
+/* master device */
+#define IEEE802154_SIOC_ADD_SLAVE               (SIOCDEVPRIVATE + 0)
+
+#endif
diff --git a/include/net/ieee802154/mac_def.h b/include/net/ieee802154/mac_def.h
new file mode 100644
index 000000000000..8cb684635650
--- /dev/null
+++ b/include/net/ieee802154/mac_def.h
@@ -0,0 +1,160 @@
+/*
+ * IEEE802.15.4-2003 specification
+ *
+ * Copyright (C) 2007, 2008 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Maxim Osipov <maxim.osipov@siemens.com>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ */
+
+#ifndef IEEE802154_MAC_DEF_H
+#define IEEE802154_MAC_DEF_H
+
+#define IEEE802154_FC_TYPE_BEACON       0x0     /* Frame is beacon */
+#define IEEE802154_FC_TYPE_DATA         0x1     /* Frame is data */
+#define IEEE802154_FC_TYPE_ACK          0x2     /* Frame is acknowledgment */
+#define IEEE802154_FC_TYPE_MAC_CMD      0x3     /* Frame is MAC command */
+
+#define IEEE802154_FC_TYPE_SHIFT                0
+#define IEEE802154_FC_TYPE_MASK         ((1 << 3) - 1)
+#define IEEE802154_FC_TYPE(x)           ((x & IEEE802154_FC_TYPE_MASK) >> IEEE802154_FC_TYPE_SHIFT)
+#define IEEE802154_FC_SET_TYPE(v, x)    do {    \
+        v = (((v) & ~IEEE802154_FC_TYPE_MASK) | \
+            (((x) << IEEE802154_FC_TYPE_SHIFT) & IEEE802154_FC_TYPE_MASK)); \
+        } while (0)
+
+#define IEEE802154_FC_SECEN             (1 << 3)
+#define IEEE802154_FC_FRPEND            (1 << 4)
+#define IEEE802154_FC_ACK_REQ           (1 << 5)
+#define IEEE802154_FC_INTRA_PAN         (1 << 6)
+
+#define IEEE802154_FC_SAMODE_SHIFT      14
+#define IEEE802154_FC_SAMODE_MASK       (3 << IEEE802154_FC_SAMODE_SHIFT)
+#define IEEE802154_FC_DAMODE_SHIFT      10
+#define IEEE802154_FC_DAMODE_MASK       (3 << IEEE802154_FC_DAMODE_SHIFT)
+
+#define IEEE802154_FC_SAMODE(x)         \
+        (((x) & IEEE802154_FC_SAMODE_MASK) >> IEEE802154_FC_SAMODE_SHIFT)
+
+#define IEEE802154_FC_DAMODE(x)         \
+        (((x) & IEEE802154_FC_DAMODE_MASK) >> IEEE802154_FC_DAMODE_SHIFT)
+
+
+/* MAC's Command Frames Identifiers */
+#define IEEE802154_CMD_ASSOCIATION_REQ          0x01
+#define IEEE802154_CMD_ASSOCIATION_RESP         0x02
+#define IEEE802154_CMD_DISASSOCIATION_NOTIFY    0x03
+#define IEEE802154_CMD_DATA_REQ                 0x04
+#define IEEE802154_CMD_PANID_CONFLICT_NOTIFY    0x05
+#define IEEE802154_CMD_ORPHAN_NOTIFY            0x06
+#define IEEE802154_CMD_BEACON_REQ               0x07
+#define IEEE802154_CMD_COORD_REALIGN_NOTIFY     0x08
+#define IEEE802154_CMD_GTS_REQ                  0x09
+
+/*
+ * The return values of MAC operations
+ */
+enum {
+        /*
+         * The requested operation was completed successfully.
+         * For a transmission request, this value indicates
+         * a successful transmission.
+         */
+        IEEE802154_SUCCESS = 0x0,
+
+        /* The beacon was lost following a synchronization request. */
+        IEEE802154_BEACON_LOSS = 0xe0,
+        /*
+         * A transmission could not take place due to activity on the
+         * channel, i.e., the CSMA-CA mechanism has failed.
+         */
+        IEEE802154_CHNL_ACCESS_FAIL = 0xe1,
+        /* The GTS request has been denied by the PAN coordinator. */
+        IEEE802154_DENINED = 0xe2,
+        /* The attempt to disable the transceiver has failed. */
+        IEEE802154_DISABLE_TRX_FAIL = 0xe3,
+        /*
+         * The received frame induces a failed security check according to
+         * the security suite.
+         */
+        IEEE802154_FAILED_SECURITY_CHECK = 0xe4,
+        /*
+         * The frame resulting from secure processing has a length that is
+         * greater than aMACMaxFrameSize.
+         */
+        IEEE802154_FRAME_TOO_LONG = 0xe5,
+        /*
+         * The requested GTS transmission failed because the specified GTS
+         * either did not have a transmit GTS direction or was not defined.
+         */
+        IEEE802154_INVALID_GTS = 0xe6,
+        /*
+         * A request to purge an MSDU from the transaction queue was made using
+         * an MSDU handle that was not found in the transaction table.
+         */
+        IEEE802154_INVALID_HANDLE = 0xe7,
+        /* A parameter in the primitive is out of the valid range.*/
+        IEEE802154_INVALID_PARAMETER = 0xe8,
+        /* No acknowledgment was received after aMaxFrameRetries. */
+        IEEE802154_NO_ACK = 0xe9,
+        /* A scan operation failed to find any network beacons.*/
+        IEEE802154_NO_BEACON = 0xea,
+        /* No response data were available following a request. */
+        IEEE802154_NO_DATA = 0xeb,
+        /* The operation failed because a short address was not allocated. */
+        IEEE802154_NO_SHORT_ADDRESS = 0xec,
+        /*
+         * A receiver enable request was unsuccessful because it could not be
+         * completed within the CAP.
+         */
+        IEEE802154_OUT_OF_CAP = 0xed,
+        /*
+         * A PAN identifier conflict has been detected and communicated to the
+         * PAN coordinator.
+         */
+        IEEE802154_PANID_CONFLICT = 0xee,
+        /* A coordinator realignment command has been received. */
+        IEEE802154_REALIGMENT = 0xef,
+        /* The transaction has expired and its information discarded. */
+        IEEE802154_TRANSACTION_EXPIRED = 0xf0,
+        /* There is no capacity to store the transaction. */
+        IEEE802154_TRANSACTION_OVERFLOW = 0xf1,
+        /*
+         * The transceiver was in the transmitter enabled state when the
+         * receiver was requested to be enabled.
+         */
+        IEEE802154_TX_ACTIVE = 0xf2,
+        /* The appropriate key is not available in the ACL. */
+        IEEE802154_UNAVAILABLE_KEY = 0xf3,
+        /*
+         * A SET/GET request was issued with the identifier of a PIB attribute
+         * that is not supported.
+         */
+        IEEE802154_UNSUPPORTED_ATTR = 0xf4,
+        /*
+         * A request to perform a scan operation failed because the MLME was
+         * in the process of performing a previously initiated scan operation.
+         */
+        IEEE802154_SCAN_IN_PROGRESS = 0xfc,
+};
+
+
+#endif
+
+
diff --git a/include/net/ieee802154/netdevice.h b/include/net/ieee802154/netdevice.h
new file mode 100644
index 000000000000..e2506af3e7c8
--- /dev/null
+++ b/include/net/ieee802154/netdevice.h
@@ -0,0 +1,115 @@
+/*
+ * An interface between IEEE802.15.4 device and rest of the kernel.
+ *
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Maxim Osipov <maxim.osipov@siemens.com>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ */
+
+#ifndef IEEE802154_NETDEVICE_H
+#define IEEE802154_NETDEVICE_H
+
+/*
+ * A control block of skb passed between the ARPHRD_IEEE802154 device
+ * and other stack parts.
+ */
+struct ieee802154_mac_cb {
+        u8 lqi;
+        struct ieee802154_addr sa;
+        struct ieee802154_addr da;
+        u8 flags;
+        u8 seq;
+};
+
+static inline struct ieee802154_mac_cb *mac_cb(struct sk_buff *skb)
+{
+        return (struct ieee802154_mac_cb *)skb->cb;
+}
+
+#define MAC_CB_FLAG_TYPEMASK            ((1 << 3) - 1)
+
+#define MAC_CB_FLAG_ACKREQ              (1 << 3)
+#define MAC_CB_FLAG_SECEN               (1 << 4)
+#define MAC_CB_FLAG_INTRAPAN            (1 << 5)
+
+static inline int mac_cb_is_ackreq(struct sk_buff *skb)
+{
+        return mac_cb(skb)->flags & MAC_CB_FLAG_ACKREQ;
+}
+
+static inline int mac_cb_is_secen(struct sk_buff *skb)
+{
+        return mac_cb(skb)->flags & MAC_CB_FLAG_SECEN;
+}
+
+static inline int mac_cb_is_intrapan(struct sk_buff *skb)
+{
+        return mac_cb(skb)->flags & MAC_CB_FLAG_INTRAPAN;
+}
+
+static inline int mac_cb_type(struct sk_buff *skb)
+{
+        return mac_cb(skb)->flags & MAC_CB_FLAG_TYPEMASK;
+}
+
+#define IEEE802154_MAC_SCAN_ED          0
+#define IEEE802154_MAC_SCAN_ACTIVE      1
+#define IEEE802154_MAC_SCAN_PASSIVE     2
+#define IEEE802154_MAC_SCAN_ORPHAN      3
+
+/*
+ * This should be located at net_device->ml_priv
+ */
+struct ieee802154_mlme_ops {
+        int (*assoc_req)(struct net_device *dev,
+                        struct ieee802154_addr *addr,
+                        u8 channel, u8 cap);
+        int (*assoc_resp)(struct net_device *dev,
+                        struct ieee802154_addr *addr,
+                        u16 short_addr, u8 status);
+        int (*disassoc_req)(struct net_device *dev,
+                        struct ieee802154_addr *addr,
+                        u8 reason);
+        int (*start_req)(struct net_device *dev,
+                        struct ieee802154_addr *addr,
+                        u8 channel, u8 bcn_ord, u8 sf_ord,
+                        u8 pan_coord, u8 blx, u8 coord_realign);
+        int (*scan_req)(struct net_device *dev,
+                        u8 type, u32 channels, u8 duration);
+
+        /*
+         * FIXME: these should become the part of PIB/MIB interface.
+         * However we still don't have IB interface of any kind
+         */
+        u16 (*get_pan_id)(struct net_device *dev);
+        u16 (*get_short_addr)(struct net_device *dev);
+        u8 (*get_dsn)(struct net_device *dev);
+        u8 (*get_bsn)(struct net_device *dev);
+};
+
+static inline struct ieee802154_mlme_ops *ieee802154_mlme_ops(
+                struct net_device *dev)
+{
+        return dev->ml_priv;
+}
+
+#endif
+
+
diff --git a/include/net/ieee802154/nl802154.h b/include/net/ieee802154/nl802154.h
new file mode 100644
index 000000000000..78efcdf52b59
--- /dev/null
+++ b/include/net/ieee802154/nl802154.h
@@ -0,0 +1,41 @@
+/*
+ * nl802154.h
+ *
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef IEEE802154_NL_H
+#define IEEE802154_NL_H
+
+struct net_device;
+struct ieee802154_addr;
+
+int ieee802154_nl_assoc_indic(struct net_device *dev,
+                struct ieee802154_addr *addr, u8 cap);
+int ieee802154_nl_assoc_confirm(struct net_device *dev,
+                u16 short_addr, u8 status);
+int ieee802154_nl_disassoc_indic(struct net_device *dev,
+                struct ieee802154_addr *addr, u8 reason);
+int ieee802154_nl_disassoc_confirm(struct net_device *dev,
+                u8 status);
+int ieee802154_nl_scan_confirm(struct net_device *dev,
+                u8 status, u8 scan_type, u32 unscanned,
+                u8 *edl/*, struct list_head *pan_desc_list */);
+int ieee802154_nl_beacon_indic(struct net_device *dev, u16 panid,
+                u16 coord_addr);
+
+#endif
diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h
index f74665d7bea8..22c73a77cd99 100644
--- a/include/net/inet6_hashtables.h
+++ b/include/net/inet6_hashtables.h
@@ -100,7 +100,7 @@ static inline struct sock *__inet6_lookup_skb(struct inet_hashinfo *hashinfo,
 
         if (unlikely(sk = skb_steal_sock(skb)))
                 return sk;
-        else return __inet6_lookup(dev_net(skb->dst->dev), hashinfo,
+        else return __inet6_lookup(dev_net(skb_dst(skb)->dev), hashinfo,
                                    &ipv6_hdr(skb)->saddr, sport,
                                    &ipv6_hdr(skb)->daddr, ntohs(dport),
                                    inet6_iif(skb));
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index a44e2248b2ef..d522dcf3031a 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -385,7 +385,7 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo,
         if (unlikely(sk = skb_steal_sock(skb)))
                 return sk;
         else
-                return __inet_lookup(dev_net(skb->dst->dev), hashinfo,
+                return __inet_lookup(dev_net(skb_dst(skb)->dev), hashinfo,
                                      iph->saddr, sport,
                                      iph->daddr, dport, inet_iif(skb));
 }
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index de0ecc71cf03..47004f35cc7e 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -17,6 +17,7 @@
 #define _INET_SOCK_H
 
 
+#include <linux/kmemcheck.h>
 #include <linux/string.h>
 #include <linux/types.h>
 #include <linux/jhash.h>
@@ -66,14 +67,16 @@ struct inet_request_sock {
         __be32                  loc_addr;
         __be32                  rmt_addr;
         __be16                  rmt_port;
-        u16                     snd_wscale : 4, 
-                                rcv_wscale : 4, 
+        kmemcheck_bitfield_begin(flags);
+        u16                     snd_wscale : 4,
+                                rcv_wscale : 4,
                                 tstamp_ok  : 1,
                                 sack_ok    : 1,
                                 wscale_ok  : 1,
                                 ecn_ok     : 1,
                                 acked      : 1,
                                 no_srccheck: 1;
+        kmemcheck_bitfield_end(flags);
         struct ip_options       *opt;
 };
 
@@ -130,7 +133,8 @@ struct inet_sock {
                                 freebind:1,
                                 hdrincl:1,
                                 mc_loop:1,
-                                transparent:1;
+                                transparent:1,
+                                mc_all:1;
         int                     mc_index;
         __be32                  mc_addr;
         struct ip_mc_socklist   *mc_list;
@@ -198,9 +202,12 @@ static inline int inet_sk_ehashfn(const struct sock *sk)
 static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops)
 {
         struct request_sock *req = reqsk_alloc(ops);
+        struct inet_request_sock *ireq = inet_rsk(req);
 
-        if (req != NULL)
-                inet_rsk(req)->opt = NULL;
+        if (req != NULL) {
+                kmemcheck_annotate_bitfield(ireq, flags);
+                ireq->opt = NULL;
+        }
 
         return req;
 }
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 4b8ece22b8e9..b63b80fac567 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -16,6 +16,7 @@
 #define _INET_TIMEWAIT_SOCK_
 
 
+#include <linux/kmemcheck.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/timer.h>
@@ -127,10 +128,12 @@ struct inet_timewait_sock {
         __be32                  tw_rcv_saddr;
         __be16                  tw_dport;
         __u16                   tw_num;
+        kmemcheck_bitfield_begin(flags);
         /* And these are ours. */
         __u8                    tw_ipv6only:1,
                                 tw_transparent:1;
-        /* 15 bits hole, try to pack */
+        /* 14 bits hole, try to pack */
+        kmemcheck_bitfield_end(flags);
         __u16                   tw_ipv6_offset;
         unsigned long           tw_ttd;
         struct inet_bind_bucket *tw_tb;
diff --git a/include/net/ip.h b/include/net/ip.h
index 4ac7577f98d0..72c36926c26d 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -168,7 +168,10 @@ struct ipv4_config
 extern struct ipv4_config ipv4_config;
 #define IP_INC_STATS(net, field)        SNMP_INC_STATS((net)->mib.ip_statistics, field)
 #define IP_INC_STATS_BH(net, field)     SNMP_INC_STATS_BH((net)->mib.ip_statistics, field)
+#define IP_ADD_STATS(net, field, val)   SNMP_ADD_STATS((net)->mib.ip_statistics, field, val)
 #define IP_ADD_STATS_BH(net, field, val) SNMP_ADD_STATS_BH((net)->mib.ip_statistics, field, val)
+#define IP_UPD_PO_STATS(net, field, val) SNMP_UPD_PO_STATS((net)->mib.ip_statistics, field, val)
+#define IP_UPD_PO_STATS_BH(net, field, val) SNMP_UPD_PO_STATS_BH((net)->mib.ip_statistics, field, val)
 #define NET_INC_STATS(net, field)       SNMP_INC_STATS((net)->mib.net_statistics, field)
 #define NET_INC_STATS_BH(net, field)    SNMP_INC_STATS_BH((net)->mib.net_statistics, field)
 #define NET_INC_STATS_USER(net, field)  SNMP_INC_STATS_USER((net)->mib.net_statistics, field)
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 5f53db7e4e57..0e1b8aebaff8 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -142,7 +142,7 @@ static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
 
 static inline int ipv6_unicast_destination(struct sk_buff *skb)
 {
-        struct rt6_info *rt = (struct rt6_info *) skb->dst;
+        struct rt6_info *rt = (struct rt6_info *) skb_dst(skb);
 
         return rt->rt6i_flags & RTF_LOCAL;
 }
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 8b12667f7a2b..ef91fe924ba4 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -124,14 +124,12 @@ struct fib_result_nl {
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
 
 #define FIB_RES_NH(res)         ((res).fi->fib_nh[(res).nh_sel])
-#define FIB_RES_RESET(res)      ((res).nh_sel = 0)
 
 #define FIB_TABLE_HASHSZ 2
 
 #else /* CONFIG_IP_ROUTE_MULTIPATH */
 
 #define FIB_RES_NH(res)         ((res).fi->fib_nh[0])
-#define FIB_RES_RESET(res)
 
 #define FIB_TABLE_HASHSZ 256
 
@@ -145,7 +143,6 @@ struct fib_result_nl {
 struct fib_table {
         struct hlist_node tb_hlist;
         u32             tb_id;
-        unsigned        tb_stamp;
         int             tb_default;
         int             (*tb_lookup)(struct fib_table *tb, const struct flowi *flp, struct fib_result *res);
         int             (*tb_insert)(struct fib_table *, struct fib_config *);
diff --git a/include/net/ipip.h b/include/net/ipip.h
index fdf9bd743705..5d3036fa1511 100644
--- a/include/net/ipip.h
+++ b/include/net/ipip.h
@@ -28,11 +28,18 @@ struct ip_tunnel
         unsigned int                    prl_count;      /* # of entries in PRL */
 };
 
+/* ISATAP: default interval between RS in secondy */
+#define IPTUNNEL_RS_DEFAULT_DELAY       (900)
+
 struct ip_tunnel_prl_entry
 {
         struct ip_tunnel_prl_entry      *next;
         __be32                          addr;
         u16                             flags;
+        unsigned long                   rs_delay;
+        struct timer_list               rs_timer;
+        struct ip_tunnel                *tunnel;
+        spinlock_t                      lock;
 };
 
 #define IPTUNNEL_XMIT() do {                                            \
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index c1f16fc49ade..f27fd83d67d8 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -126,15 +126,28 @@ extern struct ctl_path net_ipv6_ctl_path[];
         SNMP_ADD_STATS##modifier((net)->mib.statname##_statistics, (field), (val));\
 })
 
+#define _DEVUPD(net, statname, modifier, idev, field, val)              \
+({                                                                      \
+        struct inet6_dev *_idev = (idev);                               \
+        if (likely(_idev != NULL))                                      \
+                SNMP_UPD_PO_STATS##modifier((_idev)->stats.statname, field, (val)); \
+        SNMP_UPD_PO_STATS##modifier((net)->mib.statname##_statistics, field, (val));\
+})
+
 /* MIBs */
 
 #define IP6_INC_STATS(net, idev,field)          \
                 _DEVINC(net, ipv6, , idev, field)
 #define IP6_INC_STATS_BH(net, idev,field)       \
                 _DEVINC(net, ipv6, _BH, idev, field)
+#define IP6_ADD_STATS(net, idev,field,val)      \
+                _DEVADD(net, ipv6, , idev, field, val)
 #define IP6_ADD_STATS_BH(net, idev,field,val)   \
                 _DEVADD(net, ipv6, _BH, idev, field, val)
-
+#define IP6_UPD_PO_STATS(net, idev,field,val)   \
+                _DEVUPD(net, ipv6, , idev, field, val)
+#define IP6_UPD_PO_STATS_BH(net, idev,field,val)   \
+                _DEVUPD(net, ipv6, _BH, idev, field, val)
 #define ICMP6_INC_STATS(net, idev, field)       \
                 _DEVINC(net, icmpv6, , idev, field)
 #define ICMP6_INC_STATS_BH(net, idev, field)    \
diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
index 85f80eadfa35..21ee49ffcbaf 100644
--- a/include/net/iucv/af_iucv.h
+++ b/include/net/iucv/af_iucv.h
@@ -73,8 +73,17 @@ struct iucv_sock {
         struct sk_buff_head     backlog_skb_q;
         struct sock_msg_q       message_q;
         unsigned int            send_tag;
+        u8                      flags;
+        u16                     msglimit;
 };
 
+/* iucv socket options (SOL_IUCV) */
+#define SO_IPRMDATA_MSG 0x0080          /* send/recv IPRM_DATA msgs */
+#define SO_MSGLIMIT     0x1000          /* get/set IUCV MSGLIMIT */
+
+/* iucv related control messages (scm) */
+#define SCM_IUCV_TRGCLS 0x0001          /* target class control message */
+
 struct iucv_sock_list {
         struct hlist_head head;
         rwlock_t          lock;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 3b83a80e3fe0..c06104476973 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -19,7 +19,6 @@
 #include <linux/wireless.h>
 #include <linux/device.h>
 #include <linux/ieee80211.h>
-#include <net/wireless.h>
 #include <net/cfg80211.h>
 
 /**
@@ -74,22 +73,6 @@
  */
 
 /**
- * struct ieee80211_ht_bss_info - describing BSS's HT characteristics
- *
- * This structure describes most essential parameters needed
- * to describe 802.11n HT characteristics in a BSS.
- *
- * @primary_channel: channel number of primery channel
- * @bss_cap: 802.11n's general BSS capabilities (e.g. channel width)
- * @bss_op_mode: 802.11n's BSS operation modes (e.g. HT protection)
- */
-struct ieee80211_ht_bss_info {
-        u8 primary_channel;
-        u8 bss_cap;  /* use IEEE80211_HT_IE_CHA_ */
-        u8 bss_op_mode; /* use IEEE80211_HT_IE_ */
-};
-
-/**
  * enum ieee80211_max_queues - maximum number of queues
  *
  * @IEEE80211_MAX_QUEUES: Maximum number of regular device queues.
@@ -150,6 +133,13 @@ struct ieee80211_low_level_stats {
  * @BSS_CHANGED_ERP_SLOT: slot timing changed
  * @BSS_CHANGED_HT: 802.11n parameters changed
  * @BSS_CHANGED_BASIC_RATES: Basic rateset changed
+ * @BSS_CHANGED_BEACON_INT: Beacon interval changed
+ * @BSS_CHANGED_BSSID: BSSID changed, for whatever
+ *      reason (IBSS and managed mode)
+ * @BSS_CHANGED_BEACON: Beacon data changed, retrieve
+ *      new beacon (beaconing modes)
+ * @BSS_CHANGED_BEACON_ENABLED: Beaconing should be
+ *      enabled/disabled (beaconing modes)
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -158,14 +148,10 @@ enum ieee80211_bss_change {
         BSS_CHANGED_ERP_SLOT            = 1<<3,
         BSS_CHANGED_HT                  = 1<<4,
         BSS_CHANGED_BASIC_RATES         = 1<<5,
-};
-
-/**
- * struct ieee80211_bss_ht_conf - BSS's changing HT configuration
- * @operation_mode: HT operation mode (like in &struct ieee80211_ht_info)
- */
-struct ieee80211_bss_ht_conf {
-        u16 operation_mode;
+        BSS_CHANGED_BEACON_INT          = 1<<6,
+        BSS_CHANGED_BSSID               = 1<<7,
+        BSS_CHANGED_BEACON              = 1<<8,
+        BSS_CHANGED_BEACON_ENABLED      = 1<<9,
 };
 
 /**
@@ -187,12 +173,16 @@ struct ieee80211_bss_ht_conf {
  * @timestamp: beacon timestamp
  * @beacon_int: beacon interval
  * @assoc_capability: capabilities taken from assoc resp
- * @ht: BSS's HT configuration
  * @basic_rates: bitmap of basic rates, each bit stands for an
  *      index into the rate table configured by the driver in
  *      the current band.
+ * @bssid: The BSSID for this BSS
+ * @enable_beacon: whether beaconing should be enabled or not
+ * @ht_operation_mode: HT operation mode (like in &struct ieee80211_ht_info).
+ *      This field is only valid when the channel type is one of the HT types.
  */
 struct ieee80211_bss_conf {
+        const u8 *bssid;
         /* association related data */
         bool assoc;
         u16 aid;
@@ -200,12 +190,13 @@ struct ieee80211_bss_conf {
         bool use_cts_prot;
         bool use_short_preamble;
         bool use_short_slot;
+        bool enable_beacon;
         u8 dtim_period;
         u16 beacon_int;
         u16 assoc_capability;
         u64 timestamp;
         u32 basic_rates;
-        struct ieee80211_bss_ht_conf ht;
+        u16 ht_operation_mode;
 };
 
 /**
@@ -248,6 +239,8 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_INTFL_NEED_TXPROCESSING: completely internal to mac80211,
  *      used to indicate that a pending frame requires TX processing before
  *      it can be sent out.
+ * @IEEE80211_TX_INTFL_RETRIED: completely internal to mac80211,
+ *      used to indicate that a frame was already retried due to PS
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -265,6 +258,7 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_RATE_CTRL_PROBE        = BIT(12),
         IEEE80211_TX_INTFL_RCALGO               = BIT(13),
         IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
+        IEEE80211_TX_INTFL_RETRIED              = BIT(15),
 };
 
 /**
@@ -518,52 +512,76 @@ struct ieee80211_rx_status {
  * Flags to define PHY configuration options
  *
  * @IEEE80211_CONF_RADIOTAP: add radiotap header at receive time (if supported)
- * @IEEE80211_CONF_PS: Enable 802.11 power save mode
+ * @IEEE80211_CONF_PS: Enable 802.11 power save mode (managed mode only)
+ * @IEEE80211_CONF_IDLE: The device is running, but idle; if the flag is set
+ *      the driver should be prepared to handle configuration requests but
+ *      may turn the device off as much as possible. Typically, this flag will
+ *      be set when an interface is set UP but not associated or scanning, but
+ *      it can also be unset in that case when monitor interfaces are active.
  */
 enum ieee80211_conf_flags {
         IEEE80211_CONF_RADIOTAP         = (1<<0),
         IEEE80211_CONF_PS               = (1<<1),
+        IEEE80211_CONF_IDLE             = (1<<2),
 };
 
 
 /**
  * enum ieee80211_conf_changed - denotes which configuration changed
  *
- * @IEEE80211_CONF_CHANGE_RADIO_ENABLED: the value of radio_enabled changed
- * @IEEE80211_CONF_CHANGE_BEACON_INTERVAL: the beacon interval changed
+ * @_IEEE80211_CONF_CHANGE_RADIO_ENABLED: DEPRECATED
  * @IEEE80211_CONF_CHANGE_LISTEN_INTERVAL: the listen interval changed
  * @IEEE80211_CONF_CHANGE_RADIOTAP: the radiotap flag changed
- * @IEEE80211_CONF_CHANGE_PS: the PS flag changed
- * @IEEE80211_CONF_CHANGE_DYNPS_TIMEOUT: the dynamic PS timeout changed
+ * @IEEE80211_CONF_CHANGE_PS: the PS flag or dynamic PS timeout changed
  * @IEEE80211_CONF_CHANGE_POWER: the TX power changed
  * @IEEE80211_CONF_CHANGE_CHANNEL: the channel/channel_type changed
  * @IEEE80211_CONF_CHANGE_RETRY_LIMITS: retry limits changed
+ * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  */
 enum ieee80211_conf_changed {
-        IEEE80211_CONF_CHANGE_RADIO_ENABLED     = BIT(0),
-        IEEE80211_CONF_CHANGE_BEACON_INTERVAL   = BIT(1),
+        _IEEE80211_CONF_CHANGE_RADIO_ENABLED    = BIT(0),
         IEEE80211_CONF_CHANGE_LISTEN_INTERVAL   = BIT(2),
         IEEE80211_CONF_CHANGE_RADIOTAP          = BIT(3),
         IEEE80211_CONF_CHANGE_PS                = BIT(4),
-        IEEE80211_CONF_CHANGE_DYNPS_TIMEOUT     = BIT(5),
-        IEEE80211_CONF_CHANGE_POWER             = BIT(6),
-        IEEE80211_CONF_CHANGE_CHANNEL           = BIT(7),
-        IEEE80211_CONF_CHANGE_RETRY_LIMITS      = BIT(8),
+        IEEE80211_CONF_CHANGE_POWER             = BIT(5),
+        IEEE80211_CONF_CHANGE_CHANNEL           = BIT(6),
+        IEEE80211_CONF_CHANGE_RETRY_LIMITS      = BIT(7),
+        IEEE80211_CONF_CHANGE_IDLE              = BIT(8),
 };
 
+static inline __deprecated enum ieee80211_conf_changed
+__IEEE80211_CONF_CHANGE_RADIO_ENABLED(void)
+{
+        return _IEEE80211_CONF_CHANGE_RADIO_ENABLED;
+}
+#define IEEE80211_CONF_CHANGE_RADIO_ENABLED \
+        __IEEE80211_CONF_CHANGE_RADIO_ENABLED()
+
 /**
  * struct ieee80211_conf - configuration of the device
  *
  * This struct indicates how the driver shall configure the hardware.
  *
+ * @flags: configuration flags defined above
+ *
  * @radio_enabled: when zero, driver is required to switch off the radio.
- * @beacon_int: beacon interval (TODO make interface config)
+ * @beacon_int: DEPRECATED, DO NOT USE
+ *
  * @listen_interval: listen interval in units of beacon interval
- * @flags: configuration flags defined above
+ * @max_sleep_period: the maximum number of beacon intervals to sleep for
+ *      before checking the beacon for a TIM bit (managed mode only); this
+ *      value will be only achievable between DTIM frames, the hardware
+ *      needs to check for the multicast traffic bit in DTIM beacons.
+ *      This variable is valid only when the CONF_PS flag is set.
+ * @dynamic_ps_timeout: The dynamic powersave timeout (in ms), see the
+ *      powersave documentation below. This variable is valid only when
+ *      the CONF_PS flag is set.
+ *
  * @power_level: requested transmit power (in dBm)
- * @dynamic_ps_timeout: dynamic powersave timeout (in ms)
+ *
  * @channel: the channel to tune to
  * @channel_type: the channel (HT) type
+ *
  * @long_frame_max_tx_count: Maximum number of transmissions for a "long" frame
  *    (a frame not RTS protected), called "dot11LongRetryLimit" in 802.11,
  *    but actually means the number of transmissions not the number of retries
@@ -572,12 +590,13 @@ enum ieee80211_conf_changed {
  *    number of transmissions not the number of retries
  */
 struct ieee80211_conf {
-        int beacon_int;
+        int __deprecated beacon_int;
         u32 flags;
         int power_level, dynamic_ps_timeout;
+        int max_sleep_period;
 
         u16 listen_interval;
-        bool radio_enabled;
+        bool __deprecated radio_enabled;
 
         u8 long_frame_max_tx_count, short_frame_max_tx_count;
 
@@ -640,37 +659,6 @@ struct ieee80211_if_init_conf {
 };
 
 /**
- * enum ieee80211_if_conf_change - interface config change flags
- *
- * @IEEE80211_IFCC_BSSID: The BSSID changed.
- * @IEEE80211_IFCC_BEACON: The beacon for this interface changed
- *      (currently AP and MESH only), use ieee80211_beacon_get().
- * @IEEE80211_IFCC_BEACON_ENABLED: The enable_beacon value changed.
- */
-enum ieee80211_if_conf_change {
-        IEEE80211_IFCC_BSSID            = BIT(0),
-        IEEE80211_IFCC_BEACON           = BIT(1),
-        IEEE80211_IFCC_BEACON_ENABLED   = BIT(2),
-};
-
-/**
- * struct ieee80211_if_conf - configuration of an interface
- *
- * @changed: parameters that have changed, see &enum ieee80211_if_conf_change.
- * @bssid: BSSID of the network we are associated to/creating.
- * @enable_beacon: Indicates whether beacons can be sent.
- *      This is valid only for AP/IBSS/MESH modes.
- *
- * This structure is passed to the config_interface() callback of
- * &struct ieee80211_hw.
- */
-struct ieee80211_if_conf {
-        u32 changed;
-        const u8 *bssid;
-        bool enable_beacon;
-};
-
-/**
  * enum ieee80211_key_alg - key algorithm
  * @ALG_WEP: WEP40 or WEP104
  * @ALG_TKIP: TKIP
@@ -685,16 +673,6 @@ enum ieee80211_key_alg {
 };
 
 /**
- * enum ieee80211_key_len - key length
- * @LEN_WEP40: WEP 5-byte long key
- * @LEN_WEP104: WEP 13-byte long key
- */
-enum ieee80211_key_len {
-        LEN_WEP40 = 5,
-        LEN_WEP104 = 13,
-};
-
-/**
  * enum ieee80211_key_flags - key flags
  *
  * These flags are used for communication about keys between the driver
@@ -1109,11 +1087,9 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * need software support for parsing the TIM bitmap. This is also supported
  * by mac80211 by combining the %IEEE80211_HW_SUPPORTS_PS and
  * %IEEE80211_HW_PS_NULLFUNC_STACK flags. The hardware is of course still
- * required to pass up beacons. Additionally, in this case, mac80211 will
- * wake up the hardware when multicast traffic is announced in the beacon.
- *
- * FIXME: I don't think we can be fast enough in software when we want to
- *        receive multicast traffic?
+ * required to pass up beacons. The hardware is still required to handle
+ * waking up for multicast traffic; if it cannot the driver must handle that
+ * as best as it can, mac80211 is too slow.
  *
  * Dynamic powersave mode is an extension to normal powersave mode in which
  * the hardware stays awake for a user-specified period of time after sending
@@ -1134,11 +1110,53 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * way the host will only receive beacons where some relevant information
  * (for example ERP protection or WMM settings) have changed.
  *
- * Beacon filter support is informed with %IEEE80211_HW_BEACON_FILTER flag.
- * The driver needs to enable beacon filter support whenever power save is
- * enabled, that is %IEEE80211_CONF_PS is set. When power save is enabled,
- * the stack will not check for beacon miss at all and the driver needs to
- * notify about complete loss of beacons with ieee80211_beacon_loss().
+ * Beacon filter support is advertised with the %IEEE80211_HW_BEACON_FILTER
+ * hardware capability. The driver needs to enable beacon filter support
+ * whenever power save is enabled, that is %IEEE80211_CONF_PS is set. When
+ * power save is enabled, the stack will not check for beacon loss and the
+ * driver needs to notify about loss of beacons with ieee80211_beacon_loss().
+ *
+ * The time (or number of beacons missed) until the firmware notifies the
+ * driver of a beacon loss event (which in turn causes the driver to call
+ * ieee80211_beacon_loss()) should be configurable and will be controlled
+ * by mac80211 and the roaming algorithm in the future.
+ *
+ * Since there may be constantly changing information elements that nothing
+ * in the software stack cares about, we will, in the future, have mac80211
+ * tell the driver which information elements are interesting in the sense
+ * that we want to see changes in them. This will include
+ *  - a list of information element IDs
+ *  - a list of OUIs for the vendor information element
+ *
+ * Ideally, the hardware would filter out any beacons without changes in the
+ * requested elements, but if it cannot support that it may, at the expense
+ * of some efficiency, filter out only a subset. For example, if the device
+ * doesn't support checking for OUIs it should pass up all changes in all
+ * vendor information elements.
+ *
+ * Note that change, for the sake of simplification, also includes information
+ * elements appearing or disappearing from the beacon.
+ *
+ * Some hardware supports an "ignore list" instead, just make sure nothing
+ * that was requested is on the ignore list, and include commonly changing
+ * information element IDs in the ignore list, for example 11 (BSS load) and
+ * the various vendor-assigned IEs with unknown contents (128, 129, 133-136,
+ * 149, 150, 155, 156, 173, 176, 178, 179, 219); for forward compatibility
+ * it could also include some currently unused IDs.
+ *
+ *
+ * In addition to these capabilities, hardware should support notifying the
+ * host of changes in the beacon RSSI. This is relevant to implement roaming
+ * when no traffic is flowing (when traffic is flowing we see the RSSI of
+ * the received data packets). This can consist in notifying the host when
+ * the RSSI changes significantly or when it drops below or rises above
+ * configurable thresholds. In the future these thresholds will also be
+ * configured by mac80211 (which gets them from userspace) to implement
+ * them as the roaming algorithm requires.
+ *
+ * If the hardware cannot implement this, the driver should ask it to
+ * periodically pass beacon frames to the host so that software can do the
+ * signal strength threshold checking.
  */
 
 /**
@@ -1298,10 +1316,6 @@ enum ieee80211_ampdu_mlme_action {
  *      This function should never fail but returns a negative error code
  *      if it does.
  *
- * @config_interface: Handler for configuration requests related to interfaces
- *      (e.g. BSSID changes.)
- *      Returns a negative error code which will be seen in userspace.
- *
  * @bss_info_changed: Handler for configuration requests related to BSS
  *      parameters that may vary during BSS's lifespan, and may affect low
  *      level driver (e.g. assoc/disassoc status, erp parameters).
@@ -1330,11 +1344,14 @@ enum ieee80211_ampdu_mlme_action {
  *      the scan state machine in stack. The scan must honour the channel
  *      configuration done by the regulatory agent in the wiphy's
  *      registered bands. The hardware (or the driver) needs to make sure
- *      that power save is disabled. When the scan finishes,
- *      ieee80211_scan_completed() must be called; note that it also must
- *      be called when the scan cannot finish because the hardware is
- *      turned off! Anything else is a bug! Returns a negative error code
- *      which will be seen in userspace.
+ *      that power save is disabled.
+ *      The @req ie/ie_len members are rewritten by mac80211 to contain the
+ *      entire IEs after the SSID, so that drivers need not look at these
+ *      at all but just send them after the SSID -- mac80211 includes the
+ *      (extended) supported rates and HT information (where applicable).
+ *      When the scan finishes, ieee80211_scan_completed() must be called;
+ *      note that it also must be called when the scan cannot finish due to
+ *      any error unless this callback returned a negative error code.
  *
  * @sw_scan_start: Notifier function that is called just before a software scan
  *      is started. Can be NULL, if the driver doesn't need this notification.
@@ -1390,6 +1407,10 @@ enum ieee80211_ampdu_mlme_action {
  *      is the first frame we expect to perform the action on. Notice
  *      that TX/RX_STOP can pass NULL for this parameter.
  *      Returns a negative error code on failure.
+ *
+ * @rfkill_poll: Poll rfkill hardware state. If you need this, you also
+ *      need to set wiphy->rfkill_poll to %true before registration,
+ *      and need to call wiphy_rfkill_set_hw_state() in the callback.
  */
 struct ieee80211_ops {
         int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1400,9 +1421,6 @@ struct ieee80211_ops {
         void (*remove_interface)(struct ieee80211_hw *hw,
                                  struct ieee80211_if_init_conf *conf);
         int (*config)(struct ieee80211_hw *hw, u32 changed);
-        int (*config_interface)(struct ieee80211_hw *hw,
-                                struct ieee80211_vif *vif,
-                                struct ieee80211_if_conf *conf);
         void (*bss_info_changed)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *info,
@@ -1441,6 +1459,8 @@ struct ieee80211_ops {
         int (*ampdu_action)(struct ieee80211_hw *hw,
                             enum ieee80211_ampdu_mlme_action action,
                             struct ieee80211_sta *sta, u16 tid, u16 *ssn);
+
+        void (*rfkill_poll)(struct ieee80211_hw *hw);
 };
 
 /**
@@ -1572,6 +1592,20 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw);
  */
 void ieee80211_free_hw(struct ieee80211_hw *hw);
 
+/**
+ * ieee80211_restart_hw - restart hardware completely
+ *
+ * Call this function when the hardware was restarted for some reason
+ * (hardware error, ...) and the driver is unable to restore its state
+ * by itself. mac80211 assumes that at this point the driver/hardware
+ * is completely uninitialised and stopped, it starts the process by
+ * calling the ->start() operation. The driver will need to reset all
+ * internal state that it has prior to calling this function.
+ *
+ * @hw: the hardware to restart
+ */
+void ieee80211_restart_hw(struct ieee80211_hw *hw);
+
 /* trick to avoid symbol clashes with the ieee80211 subsystem */
 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                     struct ieee80211_rx_status *status);
@@ -1775,24 +1809,6 @@ struct sk_buff *
 ieee80211_get_buffered_bc(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 
 /**
- * ieee80211_get_hdrlen_from_skb - get header length from data
- *
- * Given an skb with a raw 802.11 header at the data pointer this function
- * returns the 802.11 header length in bytes (not including encryption
- * headers). If the data in the sk_buff is too short to contain a valid 802.11
- * header the function returns 0.
- *
- * @skb: the frame
- */
-unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
-
-/**
- * ieee80211_hdrlen - get header length in bytes from frame control
- * @fc: frame control field in little-endian format
- */
-unsigned int ieee80211_hdrlen(__le16 fc);
-
-/**
  * ieee80211_get_tkip_key - get a TKIP rc4 for skb
  *
  * This function computes a TKIP rc4 key for an skb. It computes
diff --git a/include/net/netfilter/ipv4/nf_conntrack_icmp.h b/include/net/netfilter/ipv4/nf_conntrack_icmp.h
deleted file mode 100644
index 3dd22cff23ec..000000000000
--- a/include/net/netfilter/ipv4/nf_conntrack_icmp.h
+++ /dev/null
@@ -1,11 +0,0 @@
-#ifndef _NF_CONNTRACK_ICMP_H
-#define _NF_CONNTRACK_ICMP_H
-/* ICMP tracking. */
-#include <asm/atomic.h>
-
-struct ip_ct_icmp
-{
-        /* Optimization: when number in == number out, forget immediately. */
-        atomic_t count;
-};
-#endif /* _NF_CONNTRACK_ICMP_H */
diff --git a/include/net/netfilter/ipv6/nf_conntrack_icmpv6.h b/include/net/netfilter/ipv6/nf_conntrack_icmpv6.h
index 86591afda29c..67edd50a398a 100644
--- a/include/net/netfilter/ipv6/nf_conntrack_icmpv6.h
+++ b/include/net/netfilter/ipv6/nf_conntrack_icmpv6.h
@@ -9,7 +9,6 @@
 
 #ifndef _NF_CONNTRACK_ICMPV6_H
 #define _NF_CONNTRACK_ICMPV6_H
-#include <asm/atomic.h>
 
 #ifndef ICMPV6_NI_QUERY
 #define ICMPV6_NI_QUERY 139
@@ -18,10 +17,4 @@
 #define ICMPV6_NI_REPLY 140
 #endif
 
-struct nf_ct_icmpv6
-{
-        /* Optimization: when number in == number out, forget immediately. */
-        atomic_t count;
-};
-
 #endif /* _NF_CONNTRACK_ICMPV6_H */
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 6c3f964de9e1..a632689b61b4 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -23,7 +23,6 @@
 #include <linux/netfilter/nf_conntrack_dccp.h>
 #include <linux/netfilter/nf_conntrack_sctp.h>
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
-#include <net/netfilter/ipv4/nf_conntrack_icmp.h>
 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
 
 #include <net/netfilter/nf_conntrack_tuple.h>
@@ -34,8 +33,6 @@ union nf_conntrack_proto {
         struct nf_ct_dccp dccp;
         struct ip_ct_sctp sctp;
         struct ip_ct_tcp tcp;
-        struct ip_ct_icmp icmp;
-        struct nf_ct_icmpv6 icmpv6;
         struct nf_ct_gre gre;
 };
 
@@ -96,6 +93,8 @@ struct nf_conn {
            plus 1 for any connection(s) we are `master' for */
         struct nf_conntrack ct_general;
 
+        spinlock_t lock;
+
         /* XXX should I move this to the tail ? - Y.K */
         /* These are my tuples; original and reply */
         struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
@@ -144,6 +143,8 @@ static inline u_int8_t nf_ct_protonum(const struct nf_conn *ct)
         return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
 }
 
+#define nf_ct_tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
+
 /* get master conntrack via master expectation */
 #define master_ct(conntr) (conntr->master)
 
@@ -200,8 +201,10 @@ extern struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple);
 
 extern void nf_conntrack_hash_insert(struct nf_conn *ct);
+extern void nf_ct_delete_from_lists(struct nf_conn *ct);
+extern void nf_ct_insert_dying_list(struct nf_conn *ct);
 
-extern void nf_conntrack_flush(struct net *net, u32 pid, int report);
+extern void nf_conntrack_flush_report(struct net *net, u32 pid, int report);
 
 extern bool nf_ct_get_tuplepr(const struct sk_buff *skb,
                               unsigned int nhoff, u_int16_t l3num,
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index 0ff0dc69ca4a..4f20d58e2ab7 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -6,17 +6,54 @@
 #define _NF_CONNTRACK_ECACHE_H
 #include <net/netfilter/nf_conntrack.h>
 
-#include <linux/notifier.h>
-#include <linux/interrupt.h>
 #include <net/net_namespace.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <linux/netfilter/nf_conntrack_common.h>
+#include <linux/netfilter/nf_conntrack_tuple_common.h>
+#include <net/netfilter/nf_conntrack_extend.h>
+
+/* Connection tracking event types */
+enum ip_conntrack_events
+{
+        IPCT_NEW                = 0,    /* new conntrack */
+        IPCT_RELATED            = 1,    /* related conntrack */
+        IPCT_DESTROY            = 2,    /* destroyed conntrack */
+        IPCT_STATUS             = 3,    /* status has changed */
+        IPCT_PROTOINFO          = 4,    /* protocol information has changed */
+        IPCT_HELPER             = 5,    /* new helper has been set */
+        IPCT_MARK               = 6,    /* new mark has been set */
+        IPCT_NATSEQADJ          = 7,    /* NAT is doing sequence adjustment */
+        IPCT_SECMARK            = 8,    /* new security mark has been set */
+};
+
+enum ip_conntrack_expect_events {
+        IPEXP_NEW               = 0,    /* new expectation */
+};
 
-#ifdef CONFIG_NF_CONNTRACK_EVENTS
 struct nf_conntrack_ecache {
-        struct nf_conn *ct;
-        unsigned int events;
+        unsigned long cache;            /* bitops want long */
+        unsigned long missed;           /* missed events */
+        u32 pid;                        /* netlink pid of destroyer */
+};
+
+static inline struct nf_conntrack_ecache *
+nf_ct_ecache_find(const struct nf_conn *ct)
+{
+        return nf_ct_ext_find(ct, NF_CT_EXT_ECACHE);
+}
+
+static inline struct nf_conntrack_ecache *
+nf_ct_ecache_ext_add(struct nf_conn *ct, gfp_t gfp)
+{
+        struct net *net = nf_ct_net(ct);
+
+        if (!net->ct.sysctl_events)
+                return NULL;
+
+        return nf_ct_ext_add(ct, NF_CT_EXT_ECACHE, gfp);
 };
 
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
 /* This structure is passed to event handler */
 struct nf_ct_event {
         struct nf_conn *ct;
@@ -24,47 +61,96 @@ struct nf_ct_event {
         int report;
 };
 
-extern struct atomic_notifier_head nf_conntrack_chain;
-extern int nf_conntrack_register_notifier(struct notifier_block *nb);
-extern int nf_conntrack_unregister_notifier(struct notifier_block *nb);
+struct nf_ct_event_notifier {
+        int (*fcn)(unsigned int events, struct nf_ct_event *item);
+};
+
+extern struct nf_ct_event_notifier *nf_conntrack_event_cb;
+extern int nf_conntrack_register_notifier(struct nf_ct_event_notifier *nb);
+extern void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *nb);
 
-extern void nf_ct_deliver_cached_events(const struct nf_conn *ct);
-extern void __nf_ct_event_cache_init(struct nf_conn *ct);
-extern void nf_ct_event_cache_flush(struct net *net);
+extern void nf_ct_deliver_cached_events(struct nf_conn *ct);
 
 static inline void
 nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
 {
+        struct nf_conntrack_ecache *e;
+
+        if (nf_conntrack_event_cb == NULL)
+                return;
+
+        e = nf_ct_ecache_find(ct);
+        if (e == NULL)
+                return;
+
+        set_bit(event, &e->cache);
+}
+
+static inline int
+nf_conntrack_eventmask_report(unsigned int eventmask,
+                              struct nf_conn *ct,
+                              u32 pid,
+                              int report)
+{
+        int ret = 0;
         struct net *net = nf_ct_net(ct);
-        struct nf_conntrack_ecache *ecache;
-
-        local_bh_disable();
-        ecache = per_cpu_ptr(net->ct.ecache, raw_smp_processor_id());
-        if (ct != ecache->ct)
-                __nf_ct_event_cache_init(ct);
-        ecache->events |= event;
-        local_bh_enable();
+        struct nf_ct_event_notifier *notify;
+        struct nf_conntrack_ecache *e;
+
+        rcu_read_lock();
+        notify = rcu_dereference(nf_conntrack_event_cb);
+        if (notify == NULL)
+                goto out_unlock;
+
+        if (!net->ct.sysctl_events)
+                goto out_unlock;
+
+        e = nf_ct_ecache_find(ct);
+        if (e == NULL)
+                goto out_unlock;
+
+        if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct)) {
+                struct nf_ct_event item = {
+                        .ct     = ct,
+                        .pid    = e->pid ? e->pid : pid,
+                        .report = report
+                };
+                /* This is a resent of a destroy event? If so, skip missed */
+                unsigned long missed = e->pid ? 0 : e->missed;
+
+                ret = notify->fcn(eventmask | missed, &item);
+                if (unlikely(ret < 0 || missed)) {
+                        spin_lock_bh(&ct->lock);
+                        if (ret < 0) {
+                                /* This is a destroy event that has been
+                                 * triggered by a process, we store the PID
+                                 * to include it in the retransmission. */
+                                if (eventmask & (1 << IPCT_DESTROY) &&
+                                    e->pid == 0 && pid != 0)
+                                        e->pid = pid;
+                                else
+                                        e->missed |= eventmask;
+                        } else
+                                e->missed &= ~missed;
+                        spin_unlock_bh(&ct->lock);
+                }
+        }
+out_unlock:
+        rcu_read_unlock();
+        return ret;
 }
 
-static inline void
-nf_conntrack_event_report(enum ip_conntrack_events event,
-                          struct nf_conn *ct,
-                          u32 pid,
-                          int report)
+static inline int
+nf_conntrack_event_report(enum ip_conntrack_events event, struct nf_conn *ct,
+                          u32 pid, int report)
 {
-        struct nf_ct_event item = {
-                .ct     = ct,
-                .pid    = pid,
-                .report = report
-        };
-        if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
-                atomic_notifier_call_chain(&nf_conntrack_chain, event, &item);
+        return nf_conntrack_eventmask_report(1 << event, ct, pid, report);
 }
 
-static inline void
+static inline int
 nf_conntrack_event(enum ip_conntrack_events event, struct nf_conn *ct)
 {
-        nf_conntrack_event_report(event, ct, 0, 0);
+        return nf_conntrack_eventmask_report(1 << event, ct, 0, 0);
 }
 
 struct nf_exp_event {
@@ -73,9 +159,13 @@ struct nf_exp_event {
         int report;
 };
 
-extern struct atomic_notifier_head nf_ct_expect_chain;
-extern int nf_ct_expect_register_notifier(struct notifier_block *nb);
-extern int nf_ct_expect_unregister_notifier(struct notifier_block *nb);
+struct nf_exp_event_notifier {
+        int (*fcn)(unsigned int events, struct nf_exp_event *item);
+};
+
+extern struct nf_exp_event_notifier *nf_expect_event_cb;
+extern int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *nb);
+extern void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *nb);
 
 static inline void
 nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
@@ -83,12 +173,27 @@ nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
                           u32 pid,
                           int report)
 {
-        struct nf_exp_event item = {
-                .exp    = exp,
-                .pid    = pid,
-                .report = report
-        };
-        atomic_notifier_call_chain(&nf_ct_expect_chain, event, &item);
+        struct net *net = nf_ct_exp_net(exp);
+        struct nf_exp_event_notifier *notify;
+
+        rcu_read_lock();
+        notify = rcu_dereference(nf_expect_event_cb);
+        if (notify == NULL)
+                goto out_unlock;
+
+        if (!net->ct.sysctl_events)
+                goto out_unlock;
+
+        {
+                struct nf_exp_event item = {
+                        .exp    = exp,
+                        .pid    = pid,
+                        .report = report
+                };
+                notify->fcn(1 << event, &item);
+        }
+out_unlock:
+        rcu_read_unlock();
 }
 
 static inline void
@@ -105,12 +210,16 @@ extern void nf_conntrack_ecache_fini(struct net *net);
 
 static inline void nf_conntrack_event_cache(enum ip_conntrack_events event,
                                             struct nf_conn *ct) {}
-static inline void nf_conntrack_event(enum ip_conntrack_events event,
-                                      struct nf_conn *ct) {}
-static inline void nf_conntrack_event_report(enum ip_conntrack_events event,
-                                             struct nf_conn *ct,
-                                             u32 pid,
-                                             int report) {}
+static inline int nf_conntrack_eventmask_report(unsigned int eventmask,
+                                                struct nf_conn *ct,
+                                                u32 pid,
+                                                int report) { return 0; }
+static inline int nf_conntrack_event(enum ip_conntrack_events event,
+                                     struct nf_conn *ct) { return 0; }
+static inline int nf_conntrack_event_report(enum ip_conntrack_events event,
+                                            struct nf_conn *ct,
+                                            u32 pid,
+                                            int report) { return 0; }
 static inline void nf_ct_deliver_cached_events(const struct nf_conn *ct) {}
 static inline void nf_ct_expect_event(enum ip_conntrack_expect_events event,
                                       struct nf_conntrack_expect *exp) {}
@@ -118,7 +227,6 @@ static inline void nf_ct_expect_event_report(enum ip_conntrack_expect_events e,
                                              struct nf_conntrack_expect *exp,
                                              u32 pid,
                                              int report) {}
-static inline void nf_ct_event_cache_flush(struct net *net) {}
 
 static inline int nf_conntrack_ecache_init(struct net *net)
 {
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index da8ee52613a5..7f8fc5d123c5 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -8,12 +8,14 @@ enum nf_ct_ext_id
         NF_CT_EXT_HELPER,
         NF_CT_EXT_NAT,
         NF_CT_EXT_ACCT,
+        NF_CT_EXT_ECACHE,
         NF_CT_EXT_NUM,
 };
 
 #define NF_CT_EXT_HELPER_TYPE struct nf_conn_help
 #define NF_CT_EXT_NAT_TYPE struct nf_conn_nat
 #define NF_CT_EXT_ACCT_TYPE struct nf_conn_counter
+#define NF_CT_EXT_ECACHE_TYPE struct nf_conntrack_ecache
 
 /* Extensions: optional stuff which isn't permanently in struct. */
 struct nf_ct_ext {
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index ee2a4b369a04..1b7068000927 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -50,6 +50,8 @@ extern struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp);
 
 extern int __nf_ct_try_assign_helper(struct nf_conn *ct, gfp_t flags);
 
+extern void nf_ct_helper_destroy(struct nf_conn *ct);
+
 static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
 {
         return nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index ba32ed7bdabe..3767fb41e541 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -59,11 +59,11 @@ struct nf_conntrack_l4proto
                            const struct nf_conntrack_tuple *);
 
         /* Print out the private part of the conntrack. */
-        int (*print_conntrack)(struct seq_file *s, const struct nf_conn *);
+        int (*print_conntrack)(struct seq_file *s, struct nf_conn *);
 
         /* convert protoinfo to nfnetink attributes */
         int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla,
-                         const struct nf_conn *ct);
+                         struct nf_conn *ct);
         /* Calculate protoinfo nlattr size */
         int (*nlattr_size)(void);
 
diff --git a/include/net/netlink.h b/include/net/netlink.h
index eddb50289d6d..007bdb07dabb 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -940,6 +940,15 @@ static inline u64 nla_get_u64(const struct nlattr *nla)
 }
 
 /**
+ * nla_get_be64 - return payload of __be64 attribute
+ * @nla: __be64 netlink attribute
+ */
+static inline __be64 nla_get_be64(const struct nlattr *nla)
+{
+        return *(__be64 *) nla_data(nla);
+}
+
+/**
  * nla_get_flag - return payload of flag attribute
  * @nla: flag netlink attribute
  */
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index 9dc58402bc09..ba1ba0c5efd1 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -14,16 +14,17 @@ struct netns_ct {
         struct hlist_nulls_head *hash;
         struct hlist_head       *expect_hash;
         struct hlist_nulls_head unconfirmed;
+        struct hlist_nulls_head dying;
         struct ip_conntrack_stat *stat;
-#ifdef CONFIG_NF_CONNTRACK_EVENTS
-        struct nf_conntrack_ecache *ecache;
-#endif
+        int                     sysctl_events;
+        unsigned int            sysctl_events_retry_timeout;
         int                     sysctl_acct;
         int                     sysctl_checksum;
         unsigned int            sysctl_log_invalid; /* Log invalid packets */
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header *sysctl_header;
         struct ctl_table_header *acct_sysctl_header;
+        struct ctl_table_header *event_sysctl_header;
 #endif
         int                     hash_vmalloc;
         int                     expect_vmalloc;
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index e37fe3129c17..82a3191375f5 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -41,16 +41,17 @@ static inline void *qdisc_priv(struct Qdisc *q)
 typedef u64     psched_time_t;
 typedef long    psched_tdiff_t;
 
-/* Avoid doing 64 bit divide by 1000 */
-#define PSCHED_US2NS(x)                 ((s64)(x) << 10)
-#define PSCHED_NS2US(x)                 ((x) >> 10)
+/* Avoid doing 64 bit divide */
+#define PSCHED_SHIFT                    6
+#define PSCHED_TICKS2NS(x)              ((s64)(x) << PSCHED_SHIFT)
+#define PSCHED_NS2TICKS(x)              ((x) >> PSCHED_SHIFT)
 
-#define PSCHED_TICKS_PER_SEC            PSCHED_NS2US(NSEC_PER_SEC)
+#define PSCHED_TICKS_PER_SEC            PSCHED_NS2TICKS(NSEC_PER_SEC)
 #define PSCHED_PASTPERFECT              0
 
 static inline psched_time_t psched_get_time(void)
 {
-        return PSCHED_NS2US(ktime_to_ns(ktime_get()));
+        return PSCHED_NS2TICKS(ktime_to_ns(ktime_get()));
 }
 
 static inline psched_tdiff_t
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
new file mode 100644
index 000000000000..47995b81c5d7
--- /dev/null
+++ b/include/net/regulatory.h
@@ -0,0 +1,101 @@
+#ifndef __NET_REGULATORY_H
+#define __NET_REGULATORY_H
+/*
+ * regulatory support structures
+ *
+ * Copyright 2008-2009  Luis R. Rodriguez <lrodriguez@atheros.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+
+/**
+ * enum environment_cap - Environment parsed from country IE
+ * @ENVIRON_ANY: indicates country IE applies to both indoor and
+ *      outdoor operation.
+ * @ENVIRON_INDOOR: indicates country IE applies only to indoor operation
+ * @ENVIRON_OUTDOOR: indicates country IE applies only to outdoor operation
+ */
+enum environment_cap {
+        ENVIRON_ANY,
+        ENVIRON_INDOOR,
+        ENVIRON_OUTDOOR,
+};
+
+/**
+ * struct regulatory_request - used to keep track of regulatory requests
+ *
+ * @wiphy_idx: this is set if this request's initiator is
+ *      %REGDOM_SET_BY_COUNTRY_IE or %REGDOM_SET_BY_DRIVER. This
+ *      can be used by the wireless core to deal with conflicts
+ *      and potentially inform users of which devices specifically
+ *      cased the conflicts.
+ * @initiator: indicates who sent this request, could be any of
+ *      of those set in nl80211_reg_initiator (%NL80211_REGDOM_SET_BY_*)
+ * @alpha2: the ISO / IEC 3166 alpha2 country code of the requested
+ *      regulatory domain. We have a few special codes:
+ *      00 - World regulatory domain
+ *      99 - built by driver but a specific alpha2 cannot be determined
+ *      98 - result of an intersection between two regulatory domains
+ * @intersect: indicates whether the wireless core should intersect
+ *      the requested regulatory domain with the presently set regulatory
+ *      domain.
+ * @country_ie_checksum: checksum of the last processed and accepted
+ *      country IE
+ * @country_ie_env: lets us know if the AP is telling us we are outdoor,
+ *      indoor, or if it doesn't matter
+ * @list: used to insert into the reg_requests_list linked list
+ */
+struct regulatory_request {
+        int wiphy_idx;
+        enum nl80211_reg_initiator initiator;
+        char alpha2[2];
+        bool intersect;
+        u32 country_ie_checksum;
+        enum environment_cap country_ie_env;
+        struct list_head list;
+};
+
+struct ieee80211_freq_range {
+        u32 start_freq_khz;
+        u32 end_freq_khz;
+        u32 max_bandwidth_khz;
+};
+
+struct ieee80211_power_rule {
+        u32 max_antenna_gain;
+        u32 max_eirp;
+};
+
+struct ieee80211_reg_rule {
+        struct ieee80211_freq_range freq_range;
+        struct ieee80211_power_rule power_rule;
+        u32 flags;
+};
+
+struct ieee80211_regdomain {
+        u32 n_reg_rules;
+        char alpha2[2];
+        struct ieee80211_reg_rule reg_rules[];
+};
+
+#define MHZ_TO_KHZ(freq) ((freq) * 1000)
+#define KHZ_TO_MHZ(freq) ((freq) / 1000)
+#define DBI_TO_MBI(gain) ((gain) * 100)
+#define MBI_TO_DBI(gain) ((gain) / 100)
+#define DBM_TO_MBM(gain) ((gain) * 100)
+#define MBM_TO_DBM(gain) ((gain) / 100)
+
+#define REG_RULE(start, end, bw, gain, eirp, reg_flags) \
+{                                                       \
+        .freq_range.start_freq_khz = MHZ_TO_KHZ(start), \
+        .freq_range.end_freq_khz = MHZ_TO_KHZ(end),     \
+        .freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw), \
+        .power_rule.max_antenna_gain = DBI_TO_MBI(gain),\
+        .power_rule.max_eirp = DBM_TO_MBM(eirp),        \
+        .flags = reg_flags,                             \
+}
+
+#endif
diff --git a/include/net/route.h b/include/net/route.h
index 4e8cae0e5841..40f6346ef496 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -210,7 +210,7 @@ static inline struct inet_peer *rt_get_peer(struct rtable *rt)
 
 static inline int inet_iif(const struct sk_buff *skb)
 {
-        return skb->rtable->rt_iif;
+        return skb_rtable(skb)->rt_iif;
 }
 
 #endif  /* _ROUTE_H */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 23f08fe1d50a..edfcacf3250e 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1939,10 +1939,8 @@ void sctp_association_free(struct sctp_association *);
 void sctp_association_put(struct sctp_association *);
 void sctp_association_hold(struct sctp_association *);
 
-struct sctp_transport *sctp_assoc_choose_init_transport(
-        struct sctp_association *);
-struct sctp_transport *sctp_assoc_choose_shutdown_transport(
-        struct sctp_association *);
+struct sctp_transport *sctp_assoc_choose_alter_transport(
+        struct sctp_association *, struct sctp_transport *);
 void sctp_assoc_update_retran_path(struct sctp_association *);
 struct sctp_transport *sctp_assoc_lookup_paddr(const struct sctp_association *,
                                           const union sctp_addr *);
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index b259fc5798fb..1580c04f68bc 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -147,6 +147,8 @@ enum sctp_optname {
 #define SCTP_GET_LOCAL_ADDRS    SCTP_GET_LOCAL_ADDRS
         SCTP_SOCKOPT_CONNECTX, /* CONNECTX requests. */
 #define SCTP_SOCKOPT_CONNECTX   SCTP_SOCKOPT_CONNECTX
+        SCTP_SOCKOPT_CONNECTX3, /* CONNECTX requests. (new implementation) */
+#define SCTP_SOCKOPT_CONNECTX3  SCTP_SOCKOPT_CONNECTX3
 };
 
 /*
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 57c93628695f..8c842e06bec8 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -153,6 +153,11 @@ struct linux_xfrm_mib {
                 per_cpu_ptr(mib[!in_softirq()], get_cpu())->mibs[field]--; \
                 put_cpu(); \
         } while (0)
+#define SNMP_ADD_STATS(mib, field, addend)      \
+        do { \
+                per_cpu_ptr(mib[!in_softirq()], get_cpu())->mibs[field] += addend; \
+                put_cpu(); \
+        } while (0)
 #define SNMP_ADD_STATS_BH(mib, field, addend)   \
         (per_cpu_ptr(mib[0], raw_smp_processor_id())->mibs[field] += addend)
 #define SNMP_ADD_STATS_USER(mib, field, addend)         \
@@ -160,5 +165,17 @@ struct linux_xfrm_mib {
                 per_cpu_ptr(mib[1], get_cpu())->mibs[field] += addend; \
                 put_cpu(); \
         } while (0)
-
+#define SNMP_UPD_PO_STATS(mib, basefield, addend)       \
+        do { \
+                __typeof__(mib[0]) ptr = per_cpu_ptr(mib[!in_softirq()], get_cpu());\
+                ptr->mibs[basefield##PKTS]++; \
+                ptr->mibs[basefield##OCTETS] += addend;\
+                put_cpu(); \
+        } while (0)
+#define SNMP_UPD_PO_STATS_BH(mib, basefield, addend)    \
+        do { \
+                __typeof__(mib[0]) ptr = per_cpu_ptr(mib[!in_softirq()], raw_smp_processor_id());\
+                ptr->mibs[basefield##PKTS]++; \
+                ptr->mibs[basefield##OCTETS] += addend;\
+        } while (0)
 #endif
diff --git a/include/net/sock.h b/include/net/sock.h
index 4bb1ff9fd15b..95bd3fd75f94 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -218,9 +218,11 @@ struct sock {
 #define sk_hash                 __sk_common.skc_hash
 #define sk_prot                 __sk_common.skc_prot
 #define sk_net                  __sk_common.skc_net
+        kmemcheck_bitfield_begin(flags);
         unsigned char           sk_shutdown : 2,
                                 sk_no_check : 2,
                                 sk_userlocks : 4;
+        kmemcheck_bitfield_end(flags);
         unsigned char           sk_protocol;
         unsigned short          sk_type;
         int                     sk_rcvbuf;
@@ -1217,9 +1219,13 @@ static inline int skb_copy_to_page(struct sock *sk, char __user *from,
 
 static inline void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 {
-        sock_hold(sk);
         skb->sk = sk;
         skb->destructor = sock_wfree;
+        /*
+         * We used to take a refcount on sk, but following operation
+         * is enough to guarantee sk_free() wont free this sock until
+         * all in-flight packets are completed
+         */
         atomic_add(skb->truesize, &sk->sk_wmem_alloc);
 }
 
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 646dbe3962ea..19f4150f4d4d 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -266,6 +266,19 @@ static inline int tcp_too_many_orphans(struct sock *sk, int num)
                  atomic_read(&tcp_memory_allocated) > sysctl_tcp_mem[2]);
 }
 
+/* syncookies: remember time of last synqueue overflow */
+static inline void tcp_synq_overflow(struct sock *sk)
+{
+        tcp_sk(sk)->rx_opt.ts_recent_stamp = jiffies;
+}
+
+/* syncookies: no recent synqueue overflow on this listening socket? */
+static inline int tcp_synq_no_recent_overflow(const struct sock *sk)
+{
+        unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp;
+        return time_after(jiffies, last_overflow + TCP_TIMEOUT_INIT);
+}
+
 extern struct proto tcp_prot;
 
 #define TCP_INC_STATS(net, field)       SNMP_INC_STATS((net)->mib.tcp_statistics, field)
@@ -889,30 +902,32 @@ static inline int tcp_prequeue(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        if (!sysctl_tcp_low_latency && tp->ucopy.task) {
-                __skb_queue_tail(&tp->ucopy.prequeue, skb);
-                tp->ucopy.memory += skb->truesize;
-                if (tp->ucopy.memory > sk->sk_rcvbuf) {
-                        struct sk_buff *skb1;
-
-                        BUG_ON(sock_owned_by_user(sk));
-
-                        while ((skb1 = __skb_dequeue(&tp->ucopy.prequeue)) != NULL) {
-                                sk_backlog_rcv(sk, skb1);
-                                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPPREQUEUEDROPPED);
-                        }
-
-                        tp->ucopy.memory = 0;
-                } else if (skb_queue_len(&tp->ucopy.prequeue) == 1) {
-                        wake_up_interruptible(sk->sk_sleep);
-                        if (!inet_csk_ack_scheduled(sk))
-                                inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-                                                          (3 * tcp_rto_min(sk)) / 4,
-                                                          TCP_RTO_MAX);
+        if (sysctl_tcp_low_latency || !tp->ucopy.task)
+                return 0;
+
+        __skb_queue_tail(&tp->ucopy.prequeue, skb);
+        tp->ucopy.memory += skb->truesize;
+        if (tp->ucopy.memory > sk->sk_rcvbuf) {
+                struct sk_buff *skb1;
+
+                BUG_ON(sock_owned_by_user(sk));
+
+                while ((skb1 = __skb_dequeue(&tp->ucopy.prequeue)) != NULL) {
+                        sk_backlog_rcv(sk, skb1);
+                        NET_INC_STATS_BH(sock_net(sk),
+                                         LINUX_MIB_TCPPREQUEUEDROPPED);
                 }
-                return 1;
+
+                tp->ucopy.memory = 0;
+        } else if (skb_queue_len(&tp->ucopy.prequeue) == 1) {
+                wake_up_interruptible_poll(sk->sk_sleep,
+                                           POLLIN | POLLRDNORM | POLLRDBAND);
+                if (!inet_csk_ack_scheduled(sk))
+                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
+                                                  (3 * tcp_rto_min(sk)) / 4,
+                                                  TCP_RTO_MAX);
         }
-        return 0;
+        return 1;
 }
 
 
diff --git a/include/net/wimax.h b/include/net/wimax.h
index 6b3824edb39e..2af7bf839f23 100644
--- a/include/net/wimax.h
+++ b/include/net/wimax.h
@@ -253,7 +253,6 @@
 struct net_device;
 struct genl_info;
 struct wimax_dev;
-struct input_dev;
 
 /**
  * struct wimax_dev - Generic WiMAX device
@@ -293,8 +292,8 @@ struct input_dev;
  *     See wimax_reset()'s documentation.
  *
  * @name: [fill] A way to identify this device. We need to register a
- *     name with many subsystems (input for RFKILL, workqueue
- *     creation, etc). We can't use the network device name as that
+ *     name with many subsystems (rfkill, workqueue creation, etc).
+ *     We can't use the network device name as that
  *     might change and in some instances we don't know it yet (until
  *     we don't call register_netdev()). So we generate an unique one
  *     using the driver name and device bus id, place it here and use
@@ -316,9 +315,6 @@ struct input_dev;
  *
  * @rfkill: [private] integration into the RF-Kill infrastructure.
  *
- * @rfkill_input: [private] virtual input device to process the
- *     hardware RF Kill switches.
- *
  * @rf_sw: [private] State of the software radio switch (OFF/ON)
  *
  * @rf_hw: [private] State of the hardware radio switch (OFF/ON)
diff --git a/include/net/wireless.h b/include/net/wireless.h
deleted file mode 100644
index 64a76208580c..000000000000
--- a/include/net/wireless.h
+++ /dev/null
@@ -1,472 +0,0 @@
-#ifndef __NET_WIRELESS_H
-#define __NET_WIRELESS_H
-
-/*
- * 802.11 device management
- *
- * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
- */
-
-#include <linux/netdevice.h>
-#include <linux/debugfs.h>
-#include <linux/list.h>
-#include <linux/ieee80211.h>
-#include <net/cfg80211.h>
-
-/**
- * enum ieee80211_band - supported frequency bands
- *
- * The bands are assigned this way because the supported
- * bitrates differ in these bands.
- *
- * @IEEE80211_BAND_2GHZ: 2.4GHz ISM band
- * @IEEE80211_BAND_5GHZ: around 5GHz band (4.9-5.7)
- */
-enum ieee80211_band {
-        IEEE80211_BAND_2GHZ,
-        IEEE80211_BAND_5GHZ,
-
-        /* keep last */
-        IEEE80211_NUM_BANDS
-};
-
-/**
- * enum ieee80211_channel_flags - channel flags
- *
- * Channel flags set by the regulatory control code.
- *
- * @IEEE80211_CHAN_DISABLED: This channel is disabled.
- * @IEEE80211_CHAN_PASSIVE_SCAN: Only passive scanning is permitted
- *      on this channel.
- * @IEEE80211_CHAN_NO_IBSS: IBSS is not allowed on this channel.
- * @IEEE80211_CHAN_RADAR: Radar detection is required on this channel.
- * @IEEE80211_CHAN_NO_FAT_ABOVE: extension channel above this channel
- *      is not permitted.
- * @IEEE80211_CHAN_NO_FAT_BELOW: extension channel below this channel
- *      is not permitted.
- */
-enum ieee80211_channel_flags {
-        IEEE80211_CHAN_DISABLED         = 1<<0,
-        IEEE80211_CHAN_PASSIVE_SCAN     = 1<<1,
-        IEEE80211_CHAN_NO_IBSS          = 1<<2,
-        IEEE80211_CHAN_RADAR            = 1<<3,
-        IEEE80211_CHAN_NO_FAT_ABOVE     = 1<<4,
-        IEEE80211_CHAN_NO_FAT_BELOW     = 1<<5,
-};
-
-/**
- * struct ieee80211_channel - channel definition
- *
- * This structure describes a single channel for use
- * with cfg80211.
- *
- * @center_freq: center frequency in MHz
- * @max_bandwidth: maximum allowed bandwidth for this channel, in MHz
- * @hw_value: hardware-specific value for the channel
- * @flags: channel flags from &enum ieee80211_channel_flags.
- * @orig_flags: channel flags at registration time, used by regulatory
- *      code to support devices with additional restrictions
- * @band: band this channel belongs to.
- * @max_antenna_gain: maximum antenna gain in dBi
- * @max_power: maximum transmission power (in dBm)
- * @beacon_found: helper to regulatory code to indicate when a beacon
- *      has been found on this channel. Use regulatory_hint_found_beacon()
- *      to enable this, this is is useful only on 5 GHz band.
- * @orig_mag: internal use
- * @orig_mpwr: internal use
- */
-struct ieee80211_channel {
-        enum ieee80211_band band;
-        u16 center_freq;
-        u8 max_bandwidth;
-        u16 hw_value;
-        u32 flags;
-        int max_antenna_gain;
-        int max_power;
-        bool beacon_found;
-        u32 orig_flags;
-        int orig_mag, orig_mpwr;
-};
-
-/**
- * enum ieee80211_rate_flags - rate flags
- *
- * Hardware/specification flags for rates. These are structured
- * in a way that allows using the same bitrate structure for
- * different bands/PHY modes.
- *
- * @IEEE80211_RATE_SHORT_PREAMBLE: Hardware can send with short
- *      preamble on this bitrate; only relevant in 2.4GHz band and
- *      with CCK rates.
- * @IEEE80211_RATE_MANDATORY_A: This bitrate is a mandatory rate
- *      when used with 802.11a (on the 5 GHz band); filled by the
- *      core code when registering the wiphy.
- * @IEEE80211_RATE_MANDATORY_B: This bitrate is a mandatory rate
- *      when used with 802.11b (on the 2.4 GHz band); filled by the
- *      core code when registering the wiphy.
- * @IEEE80211_RATE_MANDATORY_G: This bitrate is a mandatory rate
- *      when used with 802.11g (on the 2.4 GHz band); filled by the
- *      core code when registering the wiphy.
- * @IEEE80211_RATE_ERP_G: This is an ERP rate in 802.11g mode.
- */
-enum ieee80211_rate_flags {
-        IEEE80211_RATE_SHORT_PREAMBLE   = 1<<0,
-        IEEE80211_RATE_MANDATORY_A      = 1<<1,
-        IEEE80211_RATE_MANDATORY_B      = 1<<2,
-        IEEE80211_RATE_MANDATORY_G      = 1<<3,
-        IEEE80211_RATE_ERP_G            = 1<<4,
-};
-
-/**
- * struct ieee80211_rate - bitrate definition
- *
- * This structure describes a bitrate that an 802.11 PHY can
- * operate with. The two values @hw_value and @hw_value_short
- * are only for driver use when pointers to this structure are
- * passed around.
- *
- * @flags: rate-specific flags
- * @bitrate: bitrate in units of 100 Kbps
- * @hw_value: driver/hardware value for this rate
- * @hw_value_short: driver/hardware value for this rate when
- *      short preamble is used
- */
-struct ieee80211_rate {
-        u32 flags;
-        u16 bitrate;
-        u16 hw_value, hw_value_short;
-};
-
-/**
- * struct ieee80211_sta_ht_cap - STA's HT capabilities
- *
- * This structure describes most essential parameters needed
- * to describe 802.11n HT capabilities for an STA.
- *
- * @ht_supported: is HT supported by the STA
- * @cap: HT capabilities map as described in 802.11n spec
- * @ampdu_factor: Maximum A-MPDU length factor
- * @ampdu_density: Minimum A-MPDU spacing
- * @mcs: Supported MCS rates
- */
-struct ieee80211_sta_ht_cap {
-        u16 cap; /* use IEEE80211_HT_CAP_ */
-        bool ht_supported;
-        u8 ampdu_factor;
-        u8 ampdu_density;
-        struct ieee80211_mcs_info mcs;
-};
-
-/**
- * struct ieee80211_supported_band - frequency band definition
- *
- * This structure describes a frequency band a wiphy
- * is able to operate in.
- *
- * @channels: Array of channels the hardware can operate in
- *      in this band.
- * @band: the band this structure represents
- * @n_channels: Number of channels in @channels
- * @bitrates: Array of bitrates the hardware can operate with
- *      in this band. Must be sorted to give a valid "supported
- *      rates" IE, i.e. CCK rates first, then OFDM.
- * @n_bitrates: Number of bitrates in @bitrates
- */
-struct ieee80211_supported_band {
-        struct ieee80211_channel *channels;
-        struct ieee80211_rate *bitrates;
-        enum ieee80211_band band;
-        int n_channels;
-        int n_bitrates;
-        struct ieee80211_sta_ht_cap ht_cap;
-};
-
-/**
- * struct wiphy - wireless hardware description
- * @idx: the wiphy index assigned to this item
- * @class_dev: the class device representing /sys/class/ieee80211/<wiphy-name>
- * @custom_regulatory: tells us the driver for this device
- *      has its own custom regulatory domain and cannot identify the
- *      ISO / IEC 3166 alpha2 it belongs to. When this is enabled
- *      we will disregard the first regulatory hint (when the
- *      initiator is %REGDOM_SET_BY_CORE).
- * @strict_regulatory: tells us the driver for this device will ignore
- *      regulatory domain settings until it gets its own regulatory domain
- *      via its regulatory_hint(). After its gets its own regulatory domain
- *      it will only allow further regulatory domain settings to further
- *      enhance compliance. For example if channel 13 and 14 are disabled
- *      by this regulatory domain no user regulatory domain can enable these
- *      channels at a later time. This can be used for devices which do not
- *      have calibration information gauranteed for frequencies or settings
- *      outside of its regulatory domain.
- * @reg_notifier: the driver's regulatory notification callback
- * @regd: the driver's regulatory domain, if one was requested via
- *      the regulatory_hint() API. This can be used by the driver
- *      on the reg_notifier() if it chooses to ignore future
- *      regulatory domain changes caused by other drivers.
- * @signal_type: signal type reported in &struct cfg80211_bss.
- */
-struct wiphy {
-        /* assign these fields before you register the wiphy */
-
-        /* permanent MAC address */
-        u8 perm_addr[ETH_ALEN];
-
-        /* Supported interface modes, OR together BIT(NL80211_IFTYPE_...) */
-        u16 interface_modes;
-
-        bool custom_regulatory;
-        bool strict_regulatory;
-
-        enum cfg80211_signal_type signal_type;
-
-        int bss_priv_size;
-        u8 max_scan_ssids;
-
-        /* If multiple wiphys are registered and you're handed e.g.
-         * a regular netdev with assigned ieee80211_ptr, you won't
-         * know whether it points to a wiphy your driver has registered
-         * or not. Assign this to something global to your driver to
-         * help determine whether you own this wiphy or not. */
-        void *privid;
-
-        struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS];
-
-        /* Lets us get back the wiphy on the callback */
-        int (*reg_notifier)(struct wiphy *wiphy,
-                            struct regulatory_request *request);
-
-        /* fields below are read-only, assigned by cfg80211 */
-
-        const struct ieee80211_regdomain *regd;
-
-        /* the item in /sys/class/ieee80211/ points to this,
-         * you need use set_wiphy_dev() (see below) */
-        struct device dev;
-
-        /* dir in debugfs: ieee80211/<wiphyname> */
-        struct dentry *debugfsdir;
-
-        char priv[0] __attribute__((__aligned__(NETDEV_ALIGN)));
-};
-
-/** struct wireless_dev - wireless per-netdev state
- *
- * This structure must be allocated by the driver/stack
- * that uses the ieee80211_ptr field in struct net_device
- * (this is intentional so it can be allocated along with
- * the netdev.)
- *
- * @wiphy: pointer to hardware description
- * @iftype: interface type
- */
-struct wireless_dev {
-        struct wiphy *wiphy;
-        enum nl80211_iftype iftype;
-
-        /* private to the generic wireless code */
-        struct list_head list;
-        struct net_device *netdev;
-};
-
-/**
- * wiphy_priv - return priv from wiphy
- */
-static inline void *wiphy_priv(struct wiphy *wiphy)
-{
-        BUG_ON(!wiphy);
-        return &wiphy->priv;
-}
-
-/**
- * set_wiphy_dev - set device pointer for wiphy
- */
-static inline void set_wiphy_dev(struct wiphy *wiphy, struct device *dev)
-{
-        wiphy->dev.parent = dev;
-}
-
-/**
- * wiphy_dev - get wiphy dev pointer
- */
-static inline struct device *wiphy_dev(struct wiphy *wiphy)
-{
-        return wiphy->dev.parent;
-}
-
-/**
- * wiphy_name - get wiphy name
- */
-static inline const char *wiphy_name(struct wiphy *wiphy)
-{
-        return dev_name(&wiphy->dev);
-}
-
-/**
- * wdev_priv - return wiphy priv from wireless_dev
- */
-static inline void *wdev_priv(struct wireless_dev *wdev)
-{
-        BUG_ON(!wdev);
-        return wiphy_priv(wdev->wiphy);
-}
-
-/**
- * wiphy_new - create a new wiphy for use with cfg80211
- *
- * create a new wiphy and associate the given operations with it.
- * @sizeof_priv bytes are allocated for private use.
- *
- * the returned pointer must be assigned to each netdev's
- * ieee80211_ptr for proper operation.
- */
-struct wiphy *wiphy_new(struct cfg80211_ops *ops, int sizeof_priv);
-
-/**
- * wiphy_register - register a wiphy with cfg80211
- *
- * register the given wiphy
- *
- * Returns a non-negative wiphy index or a negative error code.
- */
-extern int wiphy_register(struct wiphy *wiphy);
-
-/**
- * wiphy_unregister - deregister a wiphy from cfg80211
- *
- * unregister a device with the given priv pointer.
- * After this call, no more requests can be made with this priv
- * pointer, but the call may sleep to wait for an outstanding
- * request that is being handled.
- */
-extern void wiphy_unregister(struct wiphy *wiphy);
-
-/**
- * wiphy_free - free wiphy
- */
-extern void wiphy_free(struct wiphy *wiphy);
-
-/**
- * ieee80211_channel_to_frequency - convert channel number to frequency
- */
-extern int ieee80211_channel_to_frequency(int chan);
-
-/**
- * ieee80211_frequency_to_channel - convert frequency to channel number
- */
-extern int ieee80211_frequency_to_channel(int freq);
-
-/*
- * Name indirection necessary because the ieee80211 code also has
- * a function named "ieee80211_get_channel", so if you include
- * cfg80211's header file you get cfg80211's version, if you try
- * to include both header files you'll (rightfully!) get a symbol
- * clash.
- */
-extern struct ieee80211_channel *__ieee80211_get_channel(struct wiphy *wiphy,
-                                                         int freq);
-/**
- * ieee80211_get_channel - get channel struct from wiphy for specified frequency
- */
-static inline struct ieee80211_channel *
-ieee80211_get_channel(struct wiphy *wiphy, int freq)
-{
-        return __ieee80211_get_channel(wiphy, freq);
-}
-
-/**
- * ieee80211_get_response_rate - get basic rate for a given rate
- *
- * @sband: the band to look for rates in
- * @basic_rates: bitmap of basic rates
- * @bitrate: the bitrate for which to find the basic rate
- *
- * This function returns the basic rate corresponding to a given
- * bitrate, that is the next lower bitrate contained in the basic
- * rate map, which is, for this function, given as a bitmap of
- * indices of rates in the band's bitrate table.
- */
-struct ieee80211_rate *
-ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
-                            u32 basic_rates, int bitrate);
-
-/**
- * regulatory_hint - driver hint to the wireless core a regulatory domain
- * @wiphy: the wireless device giving the hint (used only for reporting
- *      conflicts)
- * @alpha2: the ISO/IEC 3166 alpha2 the driver claims its regulatory domain
- *      should be in. If @rd is set this should be NULL. Note that if you
- *      set this to NULL you should still set rd->alpha2 to some accepted
- *      alpha2.
- *
- * Wireless drivers can use this function to hint to the wireless core
- * what it believes should be the current regulatory domain by
- * giving it an ISO/IEC 3166 alpha2 country code it knows its regulatory
- * domain should be in or by providing a completely build regulatory domain.
- * If the driver provides an ISO/IEC 3166 alpha2 userspace will be queried
- * for a regulatory domain structure for the respective country.
- *
- * The wiphy must have been registered to cfg80211 prior to this call.
- * For cfg80211 drivers this means you must first use wiphy_register(),
- * for mac80211 drivers you must first use ieee80211_register_hw().
- *
- * Drivers should check the return value, its possible you can get
- * an -ENOMEM.
- */
-extern int regulatory_hint(struct wiphy *wiphy, const char *alpha2);
-
-/**
- * regulatory_hint_11d - hints a country IE as a regulatory domain
- * @wiphy: the wireless device giving the hint (used only for reporting
- *      conflicts)
- * @country_ie: pointer to the country IE
- * @country_ie_len: length of the country IE
- *
- * We will intersect the rd with the what CRDA tells us should apply
- * for the alpha2 this country IE belongs to, this prevents APs from
- * sending us incorrect or outdated information against a country.
- */
-extern void regulatory_hint_11d(struct wiphy *wiphy,
-                                u8 *country_ie,
-                                u8 country_ie_len);
-/**
- * wiphy_apply_custom_regulatory - apply a custom driver regulatory domain
- * @wiphy: the wireless device we want to process the regulatory domain on
- * @regd: the custom regulatory domain to use for this wiphy
- *
- * Drivers can sometimes have custom regulatory domains which do not apply
- * to a specific country. Drivers can use this to apply such custom regulatory
- * domains. This routine must be called prior to wiphy registration. The
- * custom regulatory domain will be trusted completely and as such previous
- * default channel settings will be disregarded. If no rule is found for a
- * channel on the regulatory domain the channel will be disabled.
- */
-extern void wiphy_apply_custom_regulatory(
-        struct wiphy *wiphy,
-        const struct ieee80211_regdomain *regd);
-
-/**
- * freq_reg_info - get regulatory information for the given frequency
- * @wiphy: the wiphy for which we want to process this rule for
- * @center_freq: Frequency in KHz for which we want regulatory information for
- * @bandwidth: the bandwidth requirement you have in KHz, if you do not have one
- *      you can set this to 0. If this frequency is allowed we then set
- *      this value to the maximum allowed bandwidth.
- * @reg_rule: the regulatory rule which we have for this frequency
- *
- * Use this function to get the regulatory rule for a specific frequency on
- * a given wireless device. If the device has a specific regulatory domain
- * it wants to follow we respect that unless a country IE has been received
- * and processed already.
- *
- * Returns 0 if it was able to find a valid regulatory rule which does
- * apply to the given center_freq otherwise it returns non-zero. It will
- * also return -ERANGE if we determine the given center_freq does not even have
- * a regulatory rule for a frequency range in the center_freq's band. See
- * freq_in_rule_band() for our current definition of a band -- this is purely
- * subjective and right now its 802.11 specific.
- */
-extern int freq_reg_info(struct wiphy *wiphy, u32 center_freq, u32 *bandwidth,
-                         const struct ieee80211_reg_rule **reg_rule);
-
-#endif /* __NET_WIRELESS_H */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 2e9f5c0018ae..736bca450886 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -994,7 +994,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir,
                 return __xfrm_policy_check(sk, ndir, skb, family);
 
         return  (!net->xfrm.policy_count[dir] && !skb->sp) ||
-                (skb->dst->flags & DST_NOPOLICY) ||
+                (skb_dst(skb)->flags & DST_NOPOLICY) ||
                 __xfrm_policy_check(sk, ndir, skb, family);
 }
 
@@ -1048,7 +1048,7 @@ static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
         struct net *net = dev_net(skb->dev);
 
         return  !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
-                (skb->dst->flags & DST_NOXFRM) ||
+                (skb_dst(skb)->flags & DST_NOXFRM) ||
                 __xfrm_route_forward(skb, family);
 }
 
diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h
index 666cc131732e..b2410605b740 100644
--- a/include/scsi/libfcoe.h
+++ b/include/scsi/libfcoe.h
@@ -73,6 +73,7 @@ enum fip_state {
  * @link:       current link status for libfc.
  * @last_link:  last link state reported to libfc.
  * @map_dest:   use the FC_MAP mode for destination MAC addresses.
+ * @spma:       supports SPMA server-provided MACs mode
  * @dest_addr:  MAC address of the selected FC forwarder.
  * @ctl_src_addr: the native MAC address of our local port.
  * @data_src_addr: the assigned MAC address for the local port after FLOGI.
@@ -104,6 +105,7 @@ struct fcoe_ctlr {
         u8 link;
         u8 last_link;
         u8 map_dest;
+        u8 spma;
         u8 dest_addr[ETH_ALEN];
         u8 ctl_src_addr[ETH_ALEN];
         u8 data_src_addr[ETH_ALEN];
diff --git a/include/trace/events/napi.h b/include/trace/events/napi.h
new file mode 100644
index 000000000000..a8989c4547e7
--- /dev/null
+++ b/include/trace/events/napi.h
@@ -0,0 +1,11 @@
+#ifndef _TRACE_NAPI_H_
+#define _TRACE_NAPI_H_
+
+#include <linux/netdevice.h>
+#include <linux/tracepoint.h>
+
+DECLARE_TRACE(napi_poll,
+        TP_PROTO(struct napi_struct *napi),
+        TP_ARGS(napi));
+
+#endif
diff --git a/include/video/pxa168fb.h b/include/video/pxa168fb.h
new file mode 100644
index 000000000000..b5cc72fe0461
--- /dev/null
+++ b/include/video/pxa168fb.h
@@ -0,0 +1,127 @@
+/*
+ * linux/arch/arm/mach-mmp/include/mach/pxa168fb.h
+ *
+ *  Copyright (C) 2009 Marvell International Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __ASM_MACH_PXA168FB_H
+#define __ASM_MACH_PXA168FB_H
+
+#include <linux/fb.h>
+#include <linux/interrupt.h>
+
+/* Dumb interface */
+#define PIN_MODE_DUMB_24                0
+#define PIN_MODE_DUMB_18_SPI            1
+#define PIN_MODE_DUMB_18_GPIO           2
+#define PIN_MODE_DUMB_16_SPI            3
+#define PIN_MODE_DUMB_16_GPIO           4
+#define PIN_MODE_DUMB_12_SPI_GPIO       5
+#define PIN_MODE_SMART_18_SPI           6
+#define PIN_MODE_SMART_16_SPI           7
+#define PIN_MODE_SMART_8_SPI_GPIO       8
+
+/* Dumb interface pin allocation */
+#define DUMB_MODE_RGB565                0
+#define DUMB_MODE_RGB565_UPPER          1
+#define DUMB_MODE_RGB666                2
+#define DUMB_MODE_RGB666_UPPER          3
+#define DUMB_MODE_RGB444                4
+#define DUMB_MODE_RGB444_UPPER          5
+#define DUMB_MODE_RGB888                6
+
+/* default fb buffer size WVGA-32bits */
+#define DEFAULT_FB_SIZE (800 * 480 * 4)
+
+/*
+ * Buffer pixel format
+ * bit0 is for rb swap.
+ * bit12 is for Y UorV swap
+ */
+#define PIX_FMT_RGB565          0
+#define PIX_FMT_BGR565          1
+#define PIX_FMT_RGB1555         2
+#define PIX_FMT_BGR1555         3
+#define PIX_FMT_RGB888PACK      4
+#define PIX_FMT_BGR888PACK      5
+#define PIX_FMT_RGB888UNPACK    6
+#define PIX_FMT_BGR888UNPACK    7
+#define PIX_FMT_RGBA888         8
+#define PIX_FMT_BGRA888         9
+#define PIX_FMT_YUV422PACK      10
+#define PIX_FMT_YVU422PACK      11
+#define PIX_FMT_YUV422PLANAR    12
+#define PIX_FMT_YVU422PLANAR    13
+#define PIX_FMT_YUV420PLANAR    14
+#define PIX_FMT_YVU420PLANAR    15
+#define PIX_FMT_PSEUDOCOLOR     20
+#define PIX_FMT_UYVY422PACK     (0x1000|PIX_FMT_YUV422PACK)
+
+/*
+ * PXA LCD controller private state.
+ */
+struct pxa168fb_info {
+        struct device           *dev;
+        struct clk              *clk;
+        struct fb_info          *info;
+
+        void __iomem            *reg_base;
+        dma_addr_t              fb_start_dma;
+        u32                     pseudo_palette[16];
+
+        int                     pix_fmt;
+        unsigned                is_blanked:1;
+        unsigned                panel_rbswap:1;
+        unsigned                active:1;
+};
+
+/*
+ * PXA fb machine information
+ */
+struct pxa168fb_mach_info {
+        char    id[16];
+
+        int             num_modes;
+        struct fb_videomode *modes;
+
+        /*
+         * Pix_fmt
+         */
+        unsigned        pix_fmt;
+
+        /*
+         * I/O pin allocation.
+         */
+        unsigned        io_pin_allocation_mode:4;
+
+        /*
+         * Dumb panel -- assignment of R/G/B component info to the 24
+         * available external data lanes.
+         */
+        unsigned        dumb_mode:4;
+        unsigned        panel_rgb_reverse_lanes:1;
+
+        /*
+         * Dumb panel -- GPIO output data.
+         */
+        unsigned        gpio_output_mask:8;
+        unsigned        gpio_output_data:8;
+
+        /*
+         * Dumb panel -- configurable output signal polarity.
+         */
+        unsigned        invert_composite_blank:1;
+        unsigned        invert_pix_val_ena:1;
+        unsigned        invert_pixclock:1;
+        unsigned        invert_vsync:1;
+        unsigned        invert_hsync:1;
+        unsigned        panel_rbswap:1;
+        unsigned        active:1;
+        unsigned        enable_lcd:1;
+};
+
+#endif /* __ASM_MACH_PXA168FB_H */
diff --git a/include/video/s1d13xxxfb.h b/include/video/s1d13xxxfb.h
index c3b2a2aa7140..f0736cff2ca3 100644
--- a/include/video/s1d13xxxfb.h
+++ b/include/video/s1d13xxxfb.h
@@ -136,6 +136,15 @@
 #define S1DREG_DELAYOFF                 0xFFFE
 #define S1DREG_DELAYON                  0xFFFF
 
+#define BBLT_FIFO_EMPTY                 0x00
+#define BBLT_FIFO_NOT_EMPTY             0x40
+#define BBLT_FIFO_NOT_FULL              0x30
+#define BBLT_FIFO_HALF_FULL             0x20
+#define BBLT_FIFO_FULL                  0x10
+
+#define BBLT_SOLID_FILL                 0x0c
+
+
 /* Note: all above defines should go in separate header files
    when implementing other S1D13xxx chip support. */