231 files changed, 7000 insertions, 2009 deletions

diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index 1b09300810e6..22d497ee6ef9 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -62,6 +62,7 @@ extern u32 acpi_current_gpe_count;
 extern struct acpi_table_fadt acpi_gbl_FADT;
 extern u8 acpi_gbl_system_awake_and_running;
 extern u8 acpi_gbl_reduced_hardware;    /* ACPI 5.0 */
+extern u8 acpi_gbl_osi_data;
 
 /* Runtime configuration of debug print levels */
 
diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
index a64adcc29ae5..22b03c9286e9 100644
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -1144,4 +1144,19 @@ struct acpi_memory_list {
 #endif
 };
 
+/* Definitions for _OSI support */
+
+#define ACPI_OSI_WIN_2000               0x01
+#define ACPI_OSI_WIN_XP                 0x02
+#define ACPI_OSI_WIN_XP_SP1             0x03
+#define ACPI_OSI_WINSRV_2003            0x04
+#define ACPI_OSI_WIN_XP_SP2             0x05
+#define ACPI_OSI_WINSRV_2003_SP1        0x06
+#define ACPI_OSI_WIN_VISTA              0x07
+#define ACPI_OSI_WINSRV_2008            0x08
+#define ACPI_OSI_WIN_VISTA_SP1          0x09
+#define ACPI_OSI_WIN_VISTA_SP2          0x0A
+#define ACPI_OSI_WIN_7                  0x0B
+#define ACPI_OSI_WIN_8                  0x0C
+
 #endif                          /* __ACTYPES_H__ */
diff --git a/include/acpi/video.h b/include/acpi/video.h
index 61109f2609fc..b26dc4fb7ba8 100644
--- a/include/acpi/video.h
+++ b/include/acpi/video.h
@@ -17,12 +17,21 @@ struct acpi_device;
 #define ACPI_VIDEO_DISPLAY_LEGACY_TV      0x0200
 
 #if (defined CONFIG_ACPI_VIDEO || defined CONFIG_ACPI_VIDEO_MODULE)
-extern int acpi_video_register(void);
+extern int __acpi_video_register(bool backlight_quirks);
+static inline int acpi_video_register(void)
+{
+        return __acpi_video_register(false);
+}
+static inline int acpi_video_register_with_quirks(void)
+{
+        return __acpi_video_register(true);
+}
 extern void acpi_video_unregister(void);
 extern int acpi_video_get_edid(struct acpi_device *device, int type,
                                int device_id, void **edid);
 #else
 static inline int acpi_video_register(void) { return 0; }
+static inline int acpi_video_register_with_quirks(void) { return 0; }
 static inline void acpi_video_unregister(void) { return; }
 static inline int acpi_video_get_edid(struct acpi_device *device, int type,
                                       int device_id, void **edid)
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 63d17ee9eb48..12083dc862a9 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -55,16 +55,13 @@
 #include <linux/mm.h>
 #include <linux/cdev.h>
 #include <linux/mutex.h>
+#include <linux/io.h>
 #include <linux/slab.h>
 #if defined(__alpha__) || defined(__powerpc__)
 #include <asm/pgtable.h>        /* For pte_wrprotect */
 #endif
-#include <asm/io.h>
 #include <asm/mman.h>
 #include <asm/uaccess.h>
-#ifdef CONFIG_MTRR
-#include <asm/mtrr.h>
-#endif
 #if defined(CONFIG_AGP) || defined(CONFIG_AGP_MODULE)
 #include <linux/types.h>
 #include <linux/agp_backend.h>
@@ -933,12 +930,15 @@ struct drm_driver {
                                 struct dma_buf *dma_buf);
         /* low-level interface used by drm_gem_prime_{import,export} */
         int (*gem_prime_pin)(struct drm_gem_object *obj);
+        void (*gem_prime_unpin)(struct drm_gem_object *obj);
         struct sg_table *(*gem_prime_get_sg_table)(struct drm_gem_object *obj);
         struct drm_gem_object *(*gem_prime_import_sg_table)(
                                 struct drm_device *dev, size_t size,
                                 struct sg_table *sgt);
         void *(*gem_prime_vmap)(struct drm_gem_object *obj);
         void (*gem_prime_vunmap)(struct drm_gem_object *obj, void *vaddr);
+        int (*gem_prime_mmap)(struct drm_gem_object *obj,
+                                struct vm_area_struct *vma);
 
         /* vga arb irq handler */
         void (*vgaarb_irq)(struct drm_device *dev, bool state);
@@ -1250,37 +1250,8 @@ static inline int drm_core_has_MTRR(struct drm_device *dev)
 {
         return drm_core_check_feature(dev, DRIVER_USE_MTRR);
 }
-
-#define DRM_MTRR_WC             MTRR_TYPE_WRCOMB
-
-static inline int drm_mtrr_add(unsigned long offset, unsigned long size,
-                               unsigned int flags)
-{
-        return mtrr_add(offset, size, flags, 1);
-}
-
-static inline int drm_mtrr_del(int handle, unsigned long offset,
-                               unsigned long size, unsigned int flags)
-{
-        return mtrr_del(handle, offset, size);
-}
-
 #else
 #define drm_core_has_MTRR(dev) (0)
-
-#define DRM_MTRR_WC             0
-
-static inline int drm_mtrr_add(unsigned long offset, unsigned long size,
-                               unsigned int flags)
-{
-        return 0;
-}
-
-static inline int drm_mtrr_del(int handle, unsigned long offset,
-                               unsigned long size, unsigned int flags)
-{
-        return 0;
-}
 #endif
 
 static inline void drm_device_set_unplugged(struct drm_device *dev)
@@ -1630,7 +1601,6 @@ extern void drm_sysfs_destroy(void);
 extern int drm_sysfs_device_add(struct drm_minor *minor);
 extern void drm_sysfs_hotplug_event(struct drm_device *dev);
 extern void drm_sysfs_device_remove(struct drm_minor *minor);
-extern char *drm_get_connector_status_name(enum drm_connector_status status);
 extern int drm_sysfs_connector_add(struct drm_connector *connector);
 extern void drm_sysfs_connector_remove(struct drm_connector *connector);
 
@@ -1648,6 +1618,8 @@ int drm_gem_private_object_init(struct drm_device *dev,
 void drm_gem_object_handle_free(struct drm_gem_object *obj);
 void drm_gem_vm_open(struct vm_area_struct *vma);
 void drm_gem_vm_close(struct vm_area_struct *vma);
+int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size,
+                     struct vm_area_struct *vma);
 int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma);
 
 #include <drm/drm_global.h>
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index adb3f9b625f6..fa12a2fa4293 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -339,6 +339,9 @@ struct drm_crtc_funcs {
         /* cursor controls */
         int (*cursor_set)(struct drm_crtc *crtc, struct drm_file *file_priv,
                           uint32_t handle, uint32_t width, uint32_t height);
+        int (*cursor_set2)(struct drm_crtc *crtc, struct drm_file *file_priv,
+                           uint32_t handle, uint32_t width, uint32_t height,
+                           int32_t hot_x, int32_t hot_y);
         int (*cursor_move)(struct drm_crtc *crtc, int x, int y);
 
         /* Set gamma on the CRTC */
@@ -409,6 +412,10 @@ struct drm_crtc {
         /* framebuffer the connector is currently bound to */
         struct drm_framebuffer *fb;
 
+        /* Temporary tracking of the old fb while a modeset is ongoing. Used
+         * by drm_mode_set_config_internal to implement correct refcounting. */
+        struct drm_framebuffer *old_fb;
+
         bool enabled;
 
         /* Requested mode from modesetting. */
@@ -654,11 +661,7 @@ struct drm_plane_funcs {
  * @format_count: number of formats supported
  * @crtc: currently bound CRTC
  * @fb: currently bound fb
- * @gamma_size: size of gamma table
- * @gamma_store: gamma correction table
- * @enabled: enabled flag
  * @funcs: helper functions
- * @helper_private: storage for drver layer
  * @properties: property tracking for this plane
  */
 struct drm_plane {
@@ -674,14 +677,7 @@ struct drm_plane {
         struct drm_crtc *crtc;
         struct drm_framebuffer *fb;
 
-        /* CRTC gamma size for reporting to userspace */
-        uint32_t gamma_size;
-        uint16_t *gamma_store;
-
-        bool enabled;
-
         const struct drm_plane_funcs *funcs;
-        void *helper_private;
 
         struct drm_object_properties properties;
 };
@@ -894,15 +890,17 @@ extern int drm_plane_init(struct drm_device *dev,
                           const uint32_t *formats, uint32_t format_count,
                           bool priv);
 extern void drm_plane_cleanup(struct drm_plane *plane);
+extern void drm_plane_force_disable(struct drm_plane *plane);
 
 extern void drm_encoder_cleanup(struct drm_encoder *encoder);
 
-extern char *drm_get_connector_name(struct drm_connector *connector);
-extern char *drm_get_dpms_name(int val);
-extern char *drm_get_dvi_i_subconnector_name(int val);
-extern char *drm_get_dvi_i_select_name(int val);
-extern char *drm_get_tv_subconnector_name(int val);
-extern char *drm_get_tv_select_name(int val);
+extern const char *drm_get_connector_name(const struct drm_connector *connector);
+extern const char *drm_get_connector_status_name(enum drm_connector_status status);
+extern const char *drm_get_dpms_name(int val);
+extern const char *drm_get_dvi_i_subconnector_name(int val);
+extern const char *drm_get_dvi_i_select_name(int val);
+extern const char *drm_get_tv_subconnector_name(int val);
+extern const char *drm_get_tv_select_name(int val);
 extern void drm_fb_release(struct drm_file *file_priv);
 extern int drm_mode_group_init_legacy_group(struct drm_device *dev, struct drm_mode_group *group);
 extern bool drm_probe_ddc(struct i2c_adapter *adapter);
@@ -994,7 +992,7 @@ extern int drm_mode_create_tv_properties(struct drm_device *dev, int num_formats
 extern int drm_mode_create_scaling_mode_property(struct drm_device *dev);
 extern int drm_mode_create_dithering_property(struct drm_device *dev);
 extern int drm_mode_create_dirty_info_property(struct drm_device *dev);
-extern char *drm_get_encoder_name(struct drm_encoder *encoder);
+extern const char *drm_get_encoder_name(const struct drm_encoder *encoder);
 
 extern int drm_mode_connector_attach_encoder(struct drm_connector *connector,
                                              struct drm_encoder *encoder);
@@ -1022,6 +1020,8 @@ extern int drm_mode_setplane(struct drm_device *dev,
                                void *data, struct drm_file *file_priv);
 extern int drm_mode_cursor_ioctl(struct drm_device *dev,
                                 void *data, struct drm_file *file_priv);
+extern int drm_mode_cursor2_ioctl(struct drm_device *dev,
+                                void *data, struct drm_file *file_priv);
 extern int drm_mode_addfb(struct drm_device *dev,
                           void *data, struct drm_file *file_priv);
 extern int drm_mode_addfb2(struct drm_device *dev,
@@ -1094,5 +1094,6 @@ extern int drm_format_num_planes(uint32_t format);
 extern int drm_format_plane_cpp(uint32_t format, int plane);
 extern int drm_format_horz_chroma_subsampling(uint32_t format);
 extern int drm_format_vert_chroma_subsampling(uint32_t format);
+extern const char *drm_get_format_name(uint32_t format);
 
 #endif /* __DRM_CRTC_H__ */
diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
index 0ead502e17d2..f5e1168c7647 100644
--- a/include/drm/drm_fixed.h
+++ b/include/drm/drm_fixed.h
@@ -20,10 +20,13 @@
  * OTHER DEALINGS IN THE SOFTWARE.
  *
  * Authors: Dave Airlie
+ *          Christian König
  */
 #ifndef DRM_FIXED_H
 #define DRM_FIXED_H
 
+#include <linux/math64.h>
+
 typedef union dfixed {
         u32 full;
 } fixed20_12;
@@ -65,4 +68,95 @@ static inline u32 dfixed_div(fixed20_12 A, fixed20_12 B)
         tmp /= 2;
         return lower_32_bits(tmp);
 }
+
+#define DRM_FIXED_POINT         32
+#define DRM_FIXED_ONE           (1ULL << DRM_FIXED_POINT)
+#define DRM_FIXED_DECIMAL_MASK  (DRM_FIXED_ONE - 1)
+#define DRM_FIXED_DIGITS_MASK   (~DRM_FIXED_DECIMAL_MASK)
+
+static inline s64 drm_int2fixp(int a)
+{
+        return ((s64)a) << DRM_FIXED_POINT;
+}
+
+static inline int drm_fixp2int(int64_t a)
+{
+        return ((s64)a) >> DRM_FIXED_POINT;
+}
+
+static inline s64 drm_fixp_msbset(int64_t a)
+{
+        unsigned shift, sign = (a >> 63) & 1;
+
+        for (shift = 62; shift > 0; --shift)
+                if ((a >> shift) != sign)
+                        return shift;
+
+        return 0;
+}
+
+static inline s64 drm_fixp_mul(s64 a, s64 b)
+{
+        unsigned shift = drm_fixp_msbset(a) + drm_fixp_msbset(b);
+        s64 result;
+
+        if (shift > 63) {
+                shift = shift - 63;
+                a >>= shift >> 1;
+                b >>= shift >> 1;
+        } else
+                shift = 0;
+
+        result = a * b;
+
+        if (shift > DRM_FIXED_POINT)
+                return result << (shift - DRM_FIXED_POINT);
+
+        if (shift < DRM_FIXED_POINT)
+                return result >> (DRM_FIXED_POINT - shift);
+
+        return result;
+}
+
+static inline s64 drm_fixp_div(s64 a, s64 b)
+{
+        unsigned shift = 63 - drm_fixp_msbset(a);
+        s64 result;
+
+        a <<= shift;
+
+        if (shift < DRM_FIXED_POINT)
+                b >>= (DRM_FIXED_POINT - shift);
+
+        result = div64_s64(a, b);
+
+        if (shift > DRM_FIXED_POINT)
+                return result >> (shift - DRM_FIXED_POINT);
+
+        return result;
+}
+
+static inline s64 drm_fixp_exp(s64 x)
+{
+        s64 tolerance = div64_s64(DRM_FIXED_ONE, 1000000);
+        s64 sum = DRM_FIXED_ONE, term, y = x;
+        u64 count = 1;
+
+        if (x < 0)
+                y = -1 * x;
+
+        term = y;
+
+        while (term >= tolerance) {
+                sum = sum + term;
+                count = count + 1;
+                term = drm_fixp_mul(term, div64_s64(y, count));
+        }
+
+        if (x < 0)
+                sum = drm_fixp_div(1, sum);
+
+        return sum;
+}
+
 #endif
diff --git a/include/drm/drm_gem_cma_helper.h b/include/drm/drm_gem_cma_helper.h
index 63397ced9254..c34f27f80bcc 100644
--- a/include/drm/drm_gem_cma_helper.h
+++ b/include/drm/drm_gem_cma_helper.h
@@ -4,6 +4,9 @@
 struct drm_gem_cma_object {
         struct drm_gem_object base;
         dma_addr_t paddr;
+        struct sg_table *sgt;
+
+        /* For objects with DMA memory allocated by GEM CMA */
         void *vaddr;
 };
 
@@ -45,4 +48,13 @@ extern const struct vm_operations_struct drm_gem_cma_vm_ops;
 void drm_gem_cma_describe(struct drm_gem_cma_object *obj, struct seq_file *m);
 #endif
 
+struct sg_table *drm_gem_cma_prime_get_sg_table(struct drm_gem_object *obj);
+struct drm_gem_object *
+drm_gem_cma_prime_import_sg_table(struct drm_device *dev, size_t size,
+                                  struct sg_table *sgt);
+int drm_gem_cma_prime_mmap(struct drm_gem_object *obj,
+                           struct vm_area_struct *vma);
+void *drm_gem_cma_prime_vmap(struct drm_gem_object *obj);
+void drm_gem_cma_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
+
 #endif /* __DRM_GEM_CMA_HELPER_H__ */
diff --git a/include/drm/drm_mm.h b/include/drm/drm_mm.h
index 88591ef8fa24..4d06edb56d5f 100644
--- a/include/drm/drm_mm.h
+++ b/include/drm/drm_mm.h
@@ -177,17 +177,6 @@ static inline struct drm_mm_node *drm_mm_get_block_range(
         return drm_mm_get_block_range_generic(parent, size, alignment, 0,
                                               start, end, 0);
 }
-static inline struct drm_mm_node *drm_mm_get_color_block_range(
-                                                struct drm_mm_node *parent,
-                                                unsigned long size,
-                                                unsigned alignment,
-                                                unsigned long color,
-                                                unsigned long start,
-                                                unsigned long end)
-{
-        return drm_mm_get_block_range_generic(parent, size, alignment, color,
-                                              start, end, 0);
-}
 static inline struct drm_mm_node *drm_mm_get_block_atomic_range(
                                                 struct drm_mm_node *parent,
                                                 unsigned long size,
@@ -255,29 +244,10 @@ static inline  struct drm_mm_node *drm_mm_search_free_in_range(
         return drm_mm_search_free_in_range_generic(mm, size, alignment, 0,
                                                    start, end, best_match);
 }
-static inline struct drm_mm_node *drm_mm_search_free_color(const struct drm_mm *mm,
-                                                           unsigned long size,
-                                                           unsigned alignment,
-                                                           unsigned long color,
-                                                           bool best_match)
-{
-        return drm_mm_search_free_generic(mm,size, alignment, color, best_match);
-}
-static inline  struct drm_mm_node *drm_mm_search_free_in_range_color(
-                                                const struct drm_mm *mm,
-                                                unsigned long size,
-                                                unsigned alignment,
-                                                unsigned long color,
-                                                unsigned long start,
-                                                unsigned long end,
-                                                bool best_match)
-{
-        return drm_mm_search_free_in_range_generic(mm, size, alignment, color,
-                                                   start, end, best_match);
-}
-extern int drm_mm_init(struct drm_mm *mm,
-                       unsigned long start,
-                       unsigned long size);
+
+extern void drm_mm_init(struct drm_mm *mm,
+                        unsigned long start,
+                        unsigned long size);
 extern void drm_mm_takedown(struct drm_mm *mm);
 extern int drm_mm_clean(struct drm_mm *mm);
 extern int drm_mm_pre_get(struct drm_mm *mm);
diff --git a/include/drm/drm_os_linux.h b/include/drm/drm_os_linux.h
index 675ddf4b441f..815fafc6b4ad 100644
--- a/include/drm/drm_os_linux.h
+++ b/include/drm/drm_os_linux.h
@@ -65,22 +65,6 @@ struct no_agp_kern {
 #define DRM_AGP_KERN            struct no_agp_kern
 #endif
 
-#if !(__OS_HAS_MTRR)
-static __inline__ int mtrr_add(unsigned long base, unsigned long size,
-                               unsigned int type, char increment)
-{
-        return -ENODEV;
-}
-
-static __inline__ int mtrr_del(int reg, unsigned long base, unsigned long size)
-{
-        return -ENODEV;
-}
-
-#define MTRR_TYPE_WRCOMB     1
-
-#endif
-
 /** Other copying of data to kernel space */
 #define DRM_COPY_FROM_USER(arg1, arg2, arg3)            \
         copy_from_user(arg1, arg2, arg3)
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index bb1bc485390b..34efaf64cc87 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -152,6 +152,14 @@
         {0x1002, 0x6621, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6623, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6631, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6640, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6641, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6650, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6651, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6658, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x665c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x665d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6660, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6663, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6664, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
@@ -580,6 +588,22 @@
         {0x1002, 0x9808, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9809, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x980A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9830, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9831, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9832, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9833, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9834, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9835, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9836, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9837, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9838, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9839, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x983a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x983b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x983c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x983d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x983e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x983f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9900, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9901, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9903, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
diff --git a/include/drm/drm_rect.h b/include/drm/drm_rect.h
new file mode 100644
index 000000000000..d1286297567b
--- /dev/null
+++ b/include/drm/drm_rect.h
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2011-2013 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef DRM_RECT_H
+#define DRM_RECT_H
+
+/**
+ * DOC: rect utils
+ *
+ * Utility functions to help manage rectangular areas for
+ * clipping, scaling, etc. calculations.
+ */
+
+/**
+ * struct drm_rect - two dimensional rectangle
+ * @x1: horizontal starting coordinate (inclusive)
+ * @x2: horizontal ending coordinate (exclusive)
+ * @y1: vertical starting coordinate (inclusive)
+ * @y2: vertical ending coordinate (exclusive)
+ */
+struct drm_rect {
+        int x1, y1, x2, y2;
+};
+
+/**
+ * drm_rect_adjust_size - adjust the size of the rectangle
+ * @r: rectangle to be adjusted
+ * @dw: horizontal adjustment
+ * @dh: vertical adjustment
+ *
+ * Change the size of rectangle @r by @dw in the horizontal direction,
+ * and by @dh in the vertical direction, while keeping the center
+ * of @r stationary.
+ *
+ * Positive @dw and @dh increase the size, negative values decrease it.
+ */
+static inline void drm_rect_adjust_size(struct drm_rect *r, int dw, int dh)
+{
+        r->x1 -= dw >> 1;
+        r->y1 -= dh >> 1;
+        r->x2 += (dw + 1) >> 1;
+        r->y2 += (dh + 1) >> 1;
+}
+
+/**
+ * drm_rect_translate - translate the rectangle
+ * @r: rectangle to be tranlated
+ * @dx: horizontal translation
+ * @dy: vertical translation
+ *
+ * Move rectangle @r by @dx in the horizontal direction,
+ * and by @dy in the vertical direction.
+ */
+static inline void drm_rect_translate(struct drm_rect *r, int dx, int dy)
+{
+        r->x1 += dx;
+        r->y1 += dy;
+        r->x2 += dx;
+        r->y2 += dy;
+}
+
+/**
+ * drm_rect_downscale - downscale a rectangle
+ * @r: rectangle to be downscaled
+ * @horz: horizontal downscale factor
+ * @vert: vertical downscale factor
+ *
+ * Divide the coordinates of rectangle @r by @horz and @vert.
+ */
+static inline void drm_rect_downscale(struct drm_rect *r, int horz, int vert)
+{
+        r->x1 /= horz;
+        r->y1 /= vert;
+        r->x2 /= horz;
+        r->y2 /= vert;
+}
+
+/**
+ * drm_rect_width - determine the rectangle width
+ * @r: rectangle whose width is returned
+ *
+ * RETURNS:
+ * The width of the rectangle.
+ */
+static inline int drm_rect_width(const struct drm_rect *r)
+{
+        return r->x2 - r->x1;
+}
+
+/**
+ * drm_rect_height - determine the rectangle height
+ * @r: rectangle whose height is returned
+ *
+ * RETURNS:
+ * The height of the rectangle.
+ */
+static inline int drm_rect_height(const struct drm_rect *r)
+{
+        return r->y2 - r->y1;
+}
+
+/**
+ * drm_rect_visible - determine if the the rectangle is visible
+ * @r: rectangle whose visibility is returned
+ *
+ * RETURNS:
+ * %true if the rectangle is visible, %false otherwise.
+ */
+static inline bool drm_rect_visible(const struct drm_rect *r)
+{
+        return drm_rect_width(r) > 0 && drm_rect_height(r) > 0;
+}
+
+/**
+ * drm_rect_equals - determine if two rectangles are equal
+ * @r1: first rectangle
+ * @r2: second rectangle
+ *
+ * RETURNS:
+ * %true if the rectangles are equal, %false otherwise.
+ */
+static inline bool drm_rect_equals(const struct drm_rect *r1,
+                                   const struct drm_rect *r2)
+{
+        return r1->x1 == r2->x1 && r1->x2 == r2->x2 &&
+                r1->y1 == r2->y1 && r1->y2 == r2->y2;
+}
+
+bool drm_rect_intersect(struct drm_rect *r, const struct drm_rect *clip);
+bool drm_rect_clip_scaled(struct drm_rect *src, struct drm_rect *dst,
+                          const struct drm_rect *clip,
+                          int hscale, int vscale);
+int drm_rect_calc_hscale(const struct drm_rect *src,
+                         const struct drm_rect *dst,
+                         int min_hscale, int max_hscale);
+int drm_rect_calc_vscale(const struct drm_rect *src,
+                         const struct drm_rect *dst,
+                         int min_vscale, int max_vscale);
+int drm_rect_calc_hscale_relaxed(struct drm_rect *src,
+                                 struct drm_rect *dst,
+                                 int min_hscale, int max_hscale);
+int drm_rect_calc_vscale_relaxed(struct drm_rect *src,
+                                 struct drm_rect *dst,
+                                 int min_vscale, int max_vscale);
+void drm_rect_debug_print(const struct drm_rect *r, bool fixed_point);
+
+#endif
diff --git a/include/drm/i915_powerwell.h b/include/drm/i915_powerwell.h
new file mode 100644
index 000000000000..cfdc884405b7
--- /dev/null
+++ b/include/drm/i915_powerwell.h
@@ -0,0 +1,36 @@
+/**************************************************************************
+ *
+ * Copyright 2013 Intel Inc.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ *
+ **************************************************************************/
+
+#ifndef _I915_POWERWELL_H_
+#define _I915_POWERWELL_H_
+
+/* For use by hda_i915 driver */
+extern void i915_request_power_well(void);
+extern void i915_release_power_well(void);
+
+#endif                          /* _I915_POWERWELL_H_ */
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index 3cb5d848fb66..8a6aa56ece52 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -39,6 +39,7 @@
 #include <linux/mm.h>
 #include <linux/rbtree.h>
 #include <linux/bitmap.h>
+#include <linux/reservation.h>
 
 struct ttm_bo_device;
 
@@ -153,7 +154,6 @@ struct ttm_tt;
  * Lru lists may keep one refcount, the delayed delete list, and kref != 0
  * keeps one refcount. When this refcount reaches zero,
  * the object is destroyed.
- * @event_queue: Queue for processes waiting on buffer object status change.
  * @mem: structure describing current placement.
  * @persistent_swap_storage: Usually the swap storage is deleted for buffers
  * pinned in physical memory. If this behaviour is not desired, this member
@@ -164,12 +164,6 @@ struct ttm_tt;
  * @lru: List head for the lru list.
  * @ddestroy: List head for the delayed destroy list.
  * @swap: List head for swap LRU list.
- * @val_seq: Sequence of the validation holding the @reserved lock.
- * Used to avoid starvation when many processes compete to validate the
- * buffer. This member is protected by the bo_device::lru_lock.
- * @seq_valid: The value of @val_seq is valid. This value is protected by
- * the bo_device::lru_lock.
- * @reserved: Deadlock-free lock used for synchronization state transitions.
  * @sync_obj: Pointer to a synchronization object.
  * @priv_flags: Flags describing buffer object internal state.
  * @vm_rb: Rb node for the vm rb tree.
@@ -209,10 +203,9 @@ struct ttm_buffer_object {
 
         struct kref kref;
         struct kref list_kref;
-        wait_queue_head_t event_queue;
 
         /**
-         * Members protected by the bo::reserved lock.
+         * Members protected by the bo::resv::reserved lock.
          */
 
         struct ttm_mem_reg mem;
@@ -234,15 +227,6 @@ struct ttm_buffer_object {
         struct list_head ddestroy;
         struct list_head swap;
         struct list_head io_reserve_lru;
-        uint32_t val_seq;
-        bool seq_valid;
-
-        /**
-         * Members protected by the bdev::lru_lock
-         * only when written to.
-         */
-
-        atomic_t reserved;
 
         /**
          * Members protected by struct buffer_object_device::fence_lock
@@ -272,6 +256,9 @@ struct ttm_buffer_object {
         uint32_t cur_placement;
 
         struct sg_table *sg;
+
+        struct reservation_object *resv;
+        struct reservation_object ttm_resv;
 };
 
 /**
@@ -725,18 +712,4 @@ extern ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
 
 extern void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
 
-/**
- * ttm_bo_is_reserved - return an indication if a ttm buffer object is reserved
- *
- * @bo:     The buffer object to check.
- *
- * This function returns an indication if a bo is reserved or not, and should
- * only be used to print an error when it is not from incorrect api usage, since
- * there's no guarantee that it is the caller that is holding the reservation.
- */
-static inline bool ttm_bo_is_reserved(struct ttm_buffer_object *bo)
-{
-        return atomic_read(&bo->reserved);
-}
-
 #endif
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 9c8dca79808e..984fc2d571a1 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -33,11 +33,13 @@
 #include <ttm/ttm_bo_api.h>
 #include <ttm/ttm_memory.h>
 #include <ttm/ttm_module.h>
+#include <ttm/ttm_placement.h>
 #include <drm/drm_mm.h>
 #include <drm/drm_global.h>
 #include <linux/workqueue.h>
 #include <linux/fs.h>
 #include <linux/spinlock.h>
+#include <linux/reservation.h>
 
 struct ttm_backend_func {
         /**
@@ -771,6 +773,55 @@ extern int ttm_mem_io_lock(struct ttm_mem_type_manager *man,
                            bool interruptible);
 extern void ttm_mem_io_unlock(struct ttm_mem_type_manager *man);
 
+extern void ttm_bo_del_sub_from_lru(struct ttm_buffer_object *bo);
+extern void ttm_bo_add_to_lru(struct ttm_buffer_object *bo);
+
+/**
+ * ttm_bo_reserve_nolru:
+ *
+ * @bo: A pointer to a struct ttm_buffer_object.
+ * @interruptible: Sleep interruptible if waiting.
+ * @no_wait: Don't sleep while trying to reserve, rather return -EBUSY.
+ * @use_ticket: If @bo is already reserved, Only sleep waiting for
+ * it to become unreserved if @ticket->stamp is older.
+ *
+ * Will not remove reserved buffers from the lru lists.
+ * Otherwise identical to ttm_bo_reserve.
+ *
+ * Returns:
+ * -EDEADLK: The reservation may cause a deadlock.
+ * Release all buffer reservations, wait for @bo to become unreserved and
+ * try again. (only if use_sequence == 1).
+ * -ERESTARTSYS: A wait for the buffer to become unreserved was interrupted by
+ * a signal. Release all buffer reservations and return to user-space.
+ * -EBUSY: The function needed to sleep, but @no_wait was true
+ * -EALREADY: Bo already reserved using @ticket. This error code will only
+ * be returned if @use_ticket is set to true.
+ */
+static inline int ttm_bo_reserve_nolru(struct ttm_buffer_object *bo,
+                                       bool interruptible,
+                                       bool no_wait, bool use_ticket,
+                                       struct ww_acquire_ctx *ticket)
+{
+        int ret = 0;
+
+        if (no_wait) {
+                bool success;
+                if (WARN_ON(ticket))
+                        return -EBUSY;
+
+                success = ww_mutex_trylock(&bo->resv->lock);
+                return success ? 0 : -EBUSY;
+        }
+
+        if (interruptible)
+                ret = ww_mutex_lock_interruptible(&bo->resv->lock, ticket);
+        else
+                ret = ww_mutex_lock(&bo->resv->lock, ticket);
+        if (ret == -EINTR)
+                return -ERESTARTSYS;
+        return ret;
+}
 
 /**
  * ttm_bo_reserve:
@@ -778,8 +829,8 @@ extern void ttm_mem_io_unlock(struct ttm_mem_type_manager *man);
  * @bo: A pointer to a struct ttm_buffer_object.
  * @interruptible: Sleep interruptible if waiting.
  * @no_wait: Don't sleep while trying to reserve, rather return -EBUSY.
- * @use_sequence: If @bo is already reserved, Only sleep waiting for
- * it to become unreserved if @sequence < (@bo)->sequence.
+ * @use_ticket: If @bo is already reserved, Only sleep waiting for
+ * it to become unreserved if @ticket->stamp is older.
  *
  * Locks a buffer object for validation. (Or prevents other processes from
  * locking it for validation) and removes it from lru lists, while taking
@@ -793,7 +844,7 @@ extern void ttm_mem_io_unlock(struct ttm_mem_type_manager *man);
  * Processes attempting to reserve multiple buffers other than for eviction,
  * (typically execbuf), should first obtain a unique 32-bit
  * validation sequence number,
- * and call this function with @use_sequence == 1 and @sequence == the unique
+ * and call this function with @use_ticket == 1 and @ticket->stamp == the unique
  * sequence number. If upon call of this function, the buffer object is already
  * reserved, the validation sequence is checked against the validation
  * sequence of the process currently reserving the buffer,
@@ -808,36 +859,31 @@ extern void ttm_mem_io_unlock(struct ttm_mem_type_manager *man);
  * will eventually succeed, preventing both deadlocks and starvation.
  *
  * Returns:
- * -EAGAIN: The reservation may cause a deadlock.
+ * -EDEADLK: The reservation may cause a deadlock.
  * Release all buffer reservations, wait for @bo to become unreserved and
  * try again. (only if use_sequence == 1).
  * -ERESTARTSYS: A wait for the buffer to become unreserved was interrupted by
  * a signal. Release all buffer reservations and return to user-space.
  * -EBUSY: The function needed to sleep, but @no_wait was true
- * -EDEADLK: Bo already reserved using @sequence. This error code will only
- * be returned if @use_sequence is set to true.
+ * -EALREADY: Bo already reserved using @ticket. This error code will only
+ * be returned if @use_ticket is set to true.
  */
-extern int ttm_bo_reserve(struct ttm_buffer_object *bo,
-                          bool interruptible,
-                          bool no_wait, bool use_sequence, uint32_t sequence);
+static inline int ttm_bo_reserve(struct ttm_buffer_object *bo,
+                                 bool interruptible,
+                                 bool no_wait, bool use_ticket,
+                                 struct ww_acquire_ctx *ticket)
+{
+        int ret;
 
-/**
- * ttm_bo_reserve_slowpath_nolru:
- * @bo: A pointer to a struct ttm_buffer_object.
- * @interruptible: Sleep interruptible if waiting.
- * @sequence: Set (@bo)->sequence to this value after lock
- *
- * This is called after ttm_bo_reserve returns -EAGAIN and we backed off
- * from all our other reservations. Because there are no other reservations
- * held by us, this function cannot deadlock any more.
- *
- * Will not remove reserved buffers from the lru lists.
- * Otherwise identical to ttm_bo_reserve_slowpath.
- */
-extern int ttm_bo_reserve_slowpath_nolru(struct ttm_buffer_object *bo,
-                                         bool interruptible,
-                                         uint32_t sequence);
+        WARN_ON(!atomic_read(&bo->kref.refcount));
 
+        ret = ttm_bo_reserve_nolru(bo, interruptible, no_wait, use_ticket,
+                                    ticket);
+        if (likely(ret == 0))
+                ttm_bo_del_sub_from_lru(bo);
+
+        return ret;
+}
 
 /**
  * ttm_bo_reserve_slowpath:
@@ -849,54 +895,57 @@ extern int ttm_bo_reserve_slowpath_nolru(struct ttm_buffer_object *bo,
  * from all our other reservations. Because there are no other reservations
  * held by us, this function cannot deadlock any more.
  */
-extern int ttm_bo_reserve_slowpath(struct ttm_buffer_object *bo,
-                                   bool interruptible, uint32_t sequence);
+static inline int ttm_bo_reserve_slowpath(struct ttm_buffer_object *bo,
+                                          bool interruptible,
+                                          struct ww_acquire_ctx *ticket)
+{
+        int ret = 0;
 
-/**
- * ttm_bo_reserve_nolru:
- *
- * @bo: A pointer to a struct ttm_buffer_object.
- * @interruptible: Sleep interruptible if waiting.
- * @no_wait: Don't sleep while trying to reserve, rather return -EBUSY.
- * @use_sequence: If @bo is already reserved, Only sleep waiting for
- * it to become unreserved if @sequence < (@bo)->sequence.
- *
- * Will not remove reserved buffers from the lru lists.
- * Otherwise identical to ttm_bo_reserve.
- *
- * Returns:
- * -EAGAIN: The reservation may cause a deadlock.
- * Release all buffer reservations, wait for @bo to become unreserved and
- * try again. (only if use_sequence == 1).
- * -ERESTARTSYS: A wait for the buffer to become unreserved was interrupted by
- * a signal. Release all buffer reservations and return to user-space.
- * -EBUSY: The function needed to sleep, but @no_wait was true
- * -EDEADLK: Bo already reserved using @sequence. This error code will only
- * be returned if @use_sequence is set to true.
- */
-extern int ttm_bo_reserve_nolru(struct ttm_buffer_object *bo,
-                                 bool interruptible,
-                                 bool no_wait, bool use_sequence,
-                                 uint32_t sequence);
+        WARN_ON(!atomic_read(&bo->kref.refcount));
+
+        if (interruptible)
+                ret = ww_mutex_lock_slow_interruptible(&bo->resv->lock,
+                                                       ticket);
+        else
+                ww_mutex_lock_slow(&bo->resv->lock, ticket);
+
+        if (likely(ret == 0))
+                ttm_bo_del_sub_from_lru(bo);
+        else if (ret == -EINTR)
+                ret = -ERESTARTSYS;
+
+        return ret;
+}
 
 /**
- * ttm_bo_unreserve
- *
+ * ttm_bo_unreserve_ticket
  * @bo: A pointer to a struct ttm_buffer_object.
+ * @ticket: ww_acquire_ctx used for reserving
  *
- * Unreserve a previous reservation of @bo.
+ * Unreserve a previous reservation of @bo made with @ticket.
  */
-extern void ttm_bo_unreserve(struct ttm_buffer_object *bo);
+static inline void ttm_bo_unreserve_ticket(struct ttm_buffer_object *bo,
+                                           struct ww_acquire_ctx *t)
+{
+        if (!(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
+                spin_lock(&bo->glob->lru_lock);
+                ttm_bo_add_to_lru(bo);
+                spin_unlock(&bo->glob->lru_lock);
+        }
+        ww_mutex_unlock(&bo->resv->lock);
+}
 
 /**
- * ttm_bo_unreserve_locked
+ * ttm_bo_unreserve
  *
  * @bo: A pointer to a struct ttm_buffer_object.
  *
  * Unreserve a previous reservation of @bo.
- * Needs to be called with struct ttm_bo_global::lru_lock held.
  */
-extern void ttm_bo_unreserve_locked(struct ttm_buffer_object *bo);
+static inline void ttm_bo_unreserve(struct ttm_buffer_object *bo)
+{
+        ttm_bo_unreserve_ticket(bo, NULL);
+}
 
 /*
  * ttm_bo_util.c
diff --git a/include/drm/ttm/ttm_execbuf_util.h b/include/drm/ttm/ttm_execbuf_util.h
index 547e19f06e57..ec8a1d306510 100644
--- a/include/drm/ttm/ttm_execbuf_util.h
+++ b/include/drm/ttm/ttm_execbuf_util.h
@@ -57,17 +57,20 @@ struct ttm_validate_buffer {
 /**
  * function ttm_eu_backoff_reservation
  *
+ * @ticket:   ww_acquire_ctx from reserve call
  * @list:     thread private list of ttm_validate_buffer structs.
  *
  * Undoes all buffer validation reservations for bos pointed to by
  * the list entries.
  */
 
-extern void ttm_eu_backoff_reservation(struct list_head *list);
+extern void ttm_eu_backoff_reservation(struct ww_acquire_ctx *ticket,
+                                       struct list_head *list);
 
 /**
  * function ttm_eu_reserve_buffers
  *
+ * @ticket:  [out] ww_acquire_ctx returned by call.
  * @list:    thread private list of ttm_validate_buffer structs.
  *
  * Tries to reserve bos pointed to by the list entries for validation.
@@ -90,11 +93,13 @@ extern void ttm_eu_backoff_reservation(struct list_head *list);
  * has failed.
  */
 
-extern int ttm_eu_reserve_buffers(struct list_head *list);
+extern int ttm_eu_reserve_buffers(struct ww_acquire_ctx *ticket,
+                                  struct list_head *list);
 
 /**
  * function ttm_eu_fence_buffer_objects.
  *
+ * @ticket:      ww_acquire_ctx from reserve call
  * @list:        thread private list of ttm_validate_buffer structs.
  * @sync_obj:    The new sync object for the buffers.
  *
@@ -104,6 +109,7 @@ extern int ttm_eu_reserve_buffers(struct list_head *list);
  *
  */
 
-extern void ttm_eu_fence_buffer_objects(struct list_head *list, void *sync_obj);
+extern void ttm_eu_fence_buffer_objects(struct ww_acquire_ctx *ticket,
+                                        struct list_head *list, void *sync_obj);
 
 #endif
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 353ba256f368..6ad72f92469c 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -191,6 +191,7 @@ extern bool wmi_has_guid(const char *guid);
 #define ACPI_VIDEO_BACKLIGHT_DMI_VIDEO                  0x0200
 #define ACPI_VIDEO_OUTPUT_SWITCHING_DMI_VENDOR          0x0400
 #define ACPI_VIDEO_OUTPUT_SWITCHING_DMI_VIDEO           0x0800
+#define ACPI_VIDEO_SKIP_BACKLIGHT                       0x1000
 
 #if defined(CONFIG_ACPI_VIDEO) || defined(CONFIG_ACPI_VIDEO_MODULE)
 
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 2e34db82a643..622fc505d3e1 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -144,6 +144,7 @@ struct bcma_host_ops {
 
 /* Chip IDs of PCIe devices */
 #define BCMA_CHIP_ID_BCM4313    0x4313
+#define BCMA_CHIP_ID_BCM43142   43142
 #define BCMA_CHIP_ID_BCM43224   43224
 #define  BCMA_PKG_ID_BCM43224_FAB_CSM   0x8
 #define  BCMA_PKG_ID_BCM43224_FAB_SMIC  0xa
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index b8b09eac60a4..c49e1a159e6e 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -330,6 +330,8 @@
 #define BCMA_CC_PMU_CAP                 0x0604 /* PMU capabilities */
 #define  BCMA_CC_PMU_CAP_REVISION       0x000000FF /* Revision mask */
 #define BCMA_CC_PMU_STAT                0x0608 /* PMU status */
+#define  BCMA_CC_PMU_STAT_EXT_LPO_AVAIL 0x00000100
+#define  BCMA_CC_PMU_STAT_WDRESET       0x00000080
 #define  BCMA_CC_PMU_STAT_INTPEND       0x00000040 /* Interrupt pending */
 #define  BCMA_CC_PMU_STAT_SBCLKST       0x00000030 /* Backplane clock status? */
 #define  BCMA_CC_PMU_STAT_HAVEALP       0x00000008 /* ALP available */
@@ -355,6 +357,11 @@
 #define BCMA_CC_REGCTL_DATA             0x065C
 #define BCMA_CC_PLLCTL_ADDR             0x0660
 #define BCMA_CC_PLLCTL_DATA             0x0664
+#define BCMA_CC_PMU_STRAPOPT            0x0668 /* (corerev >= 28) */
+#define BCMA_CC_PMU_XTAL_FREQ           0x066C /* (pmurev >= 10) */
+#define  BCMA_CC_PMU_XTAL_FREQ_ILPCTL_MASK      0x00001FFF
+#define  BCMA_CC_PMU_XTAL_FREQ_MEASURE_MASK     0x80000000
+#define  BCMA_CC_PMU_XTAL_FREQ_MEASURE_SHIFT    31
 #define BCMA_CC_SPROM                   0x0800 /* SPROM beginning */
 /* NAND flash MLC controller registers (corerev >= 38) */
 #define BCMA_CC_NAND_REVISION           0x0C00
@@ -435,6 +442,23 @@
 #define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_MASK  0x00000007
 #define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_SHIFT 0
 
+/* PMU rev 15 */
+#define BCMA_CC_PMU15_PLL_PLLCTL0       0
+#define  BCMA_CC_PMU15_PLL_PC0_CLKSEL_MASK      0x00000003
+#define  BCMA_CC_PMU15_PLL_PC0_CLKSEL_SHIFT     0
+#define  BCMA_CC_PMU15_PLL_PC0_FREQTGT_MASK     0x003FFFFC
+#define  BCMA_CC_PMU15_PLL_PC0_FREQTGT_SHIFT    2
+#define  BCMA_CC_PMU15_PLL_PC0_PRESCALE_MASK    0x00C00000
+#define  BCMA_CC_PMU15_PLL_PC0_PRESCALE_SHIFT   22
+#define  BCMA_CC_PMU15_PLL_PC0_KPCTRL_MASK      0x07000000
+#define  BCMA_CC_PMU15_PLL_PC0_KPCTRL_SHIFT     24
+#define  BCMA_CC_PMU15_PLL_PC0_FCNTCTRL_MASK    0x38000000
+#define  BCMA_CC_PMU15_PLL_PC0_FCNTCTRL_SHIFT   27
+#define  BCMA_CC_PMU15_PLL_PC0_FDCMODE_MASK     0x40000000
+#define  BCMA_CC_PMU15_PLL_PC0_FDCMODE_SHIFT    30
+#define  BCMA_CC_PMU15_PLL_PC0_CTRLBIAS_MASK    0x80000000
+#define  BCMA_CC_PMU15_PLL_PC0_CTRLBIAS_SHIFT   31
+
 /* ALP clock on pre-PMU chips */
 #define BCMA_CC_PMU_ALP_CLOCK           20000000
 /* HT clock for systems with PMU-enabled chipcommon */
@@ -507,6 +531,37 @@
 #define BCMA_CHIPCTL_5357_I2S_PINS_ENABLE       BIT(18)
 #define BCMA_CHIPCTL_5357_I2CSPI_PINS_ENABLE    BIT(19)
 
+#define BCMA_RES_4314_LPLDO_PU                  BIT(0)
+#define BCMA_RES_4314_PMU_SLEEP_DIS             BIT(1)
+#define BCMA_RES_4314_PMU_BG_PU                 BIT(2)
+#define BCMA_RES_4314_CBUCK_LPOM_PU             BIT(3)
+#define BCMA_RES_4314_CBUCK_PFM_PU              BIT(4)
+#define BCMA_RES_4314_CLDO_PU                   BIT(5)
+#define BCMA_RES_4314_LPLDO2_LVM                BIT(6)
+#define BCMA_RES_4314_WL_PMU_PU                 BIT(7)
+#define BCMA_RES_4314_LNLDO_PU                  BIT(8)
+#define BCMA_RES_4314_LDO3P3_PU                 BIT(9)
+#define BCMA_RES_4314_OTP_PU                    BIT(10)
+#define BCMA_RES_4314_XTAL_PU                   BIT(11)
+#define BCMA_RES_4314_WL_PWRSW_PU               BIT(12)
+#define BCMA_RES_4314_LQ_AVAIL                  BIT(13)
+#define BCMA_RES_4314_LOGIC_RET                 BIT(14)
+#define BCMA_RES_4314_MEM_SLEEP                 BIT(15)
+#define BCMA_RES_4314_MACPHY_RET                BIT(16)
+#define BCMA_RES_4314_WL_CORE_READY             BIT(17)
+#define BCMA_RES_4314_ILP_REQ                   BIT(18)
+#define BCMA_RES_4314_ALP_AVAIL                 BIT(19)
+#define BCMA_RES_4314_MISC_PWRSW_PU             BIT(20)
+#define BCMA_RES_4314_SYNTH_PWRSW_PU            BIT(21)
+#define BCMA_RES_4314_RX_PWRSW_PU               BIT(22)
+#define BCMA_RES_4314_RADIO_PU                  BIT(23)
+#define BCMA_RES_4314_VCO_LDO_PU                BIT(24)
+#define BCMA_RES_4314_AFE_LDO_PU                BIT(25)
+#define BCMA_RES_4314_RX_LDO_PU                 BIT(26)
+#define BCMA_RES_4314_TX_LDO_PU                 BIT(27)
+#define BCMA_RES_4314_HT_AVAIL                  BIT(28)
+#define BCMA_RES_4314_MACPHY_CLK_AVAIL          BIT(29)
+
 /* Data for the PMU, if available.
  * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
  */
diff --git a/include/linux/bio.h b/include/linux/bio.h
index ef24466d8f82..ec48bac5b039 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -97,11 +97,11 @@ static inline void *bio_data(struct bio *bio)
  * permanent PIO fall back, user is probably better off disabling highmem
  * I/O completely on that queue (see ide-dma for example)
  */
-#define __bio_kmap_atomic(bio, idx, kmtype)                             \
+#define __bio_kmap_atomic(bio, idx)                             \
         (kmap_atomic(bio_iovec_idx((bio), (idx))->bv_page) +    \
                 bio_iovec_idx((bio), (idx))->bv_offset)
 
-#define __bio_kunmap_atomic(addr, kmtype) kunmap_atomic(addr)
+#define __bio_kunmap_atomic(addr) kunmap_atomic(addr)
 
 /*
  * merge helpers etc
diff --git a/include/linux/can/platform/flexcan.h b/include/linux/can/platform/flexcan.h
deleted file mode 100644
index 72b713ab57e9..000000000000
--- a/include/linux/can/platform/flexcan.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) 2010 Marc Kleine-Budde <kernel@pengutronix.de>
- *
- * This file is released under the GPLv2
- *
- */
-
-#ifndef __CAN_PLATFORM_FLEXCAN_H
-#define __CAN_PLATFORM_FLEXCAN_H
-
-/**
- * struct flexcan_platform_data - flex CAN controller platform data
- * @transceiver_enable:         - called to power on/off the transceiver
- *
- */
-struct flexcan_platform_data {
-        void (*transceiver_switch)(int enable);
-};
-
-#endif /* __CAN_PLATFORM_FLEXCAN_H */
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 21cfaff7e002..e9ac882868c0 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -278,6 +278,8 @@ enum {
          *
          * - memcg: use_hierarchy is on by default and the cgroup file for
          *   the flag is not created.
+         *
+         * - blkcg: blk-throttle becomes properly hierarchical.
          */
         CGRP_ROOT_SANE_BEHAVIOR = (1 << 0),
 
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 944f283f01c4..ab0eade73039 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -114,7 +114,7 @@ enum {
 /* Need to know about CPUs going up/down? */
 #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE)
 #define cpu_notifier(fn, pri) {                                 \
-        static struct notifier_block fn##_nb __cpuinitdata =    \
+        static struct notifier_block fn##_nb =                  \
                 { .notifier_call = fn, .priority = pri };       \
         register_cpu_notifier(&fn##_nb);                        \
 }
diff --git a/include/linux/cpu_cooling.h b/include/linux/cpu_cooling.h
index 282e27028418..a5d52eea8232 100644
--- a/include/linux/cpu_cooling.h
+++ b/include/linux/cpu_cooling.h
@@ -41,7 +41,7 @@ cpufreq_cooling_register(const struct cpumask *clip_cpus);
  */
 void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev);
 
-unsigned long cpufreq_cooling_get_level(unsigned int, unsigned int);
+unsigned long cpufreq_cooling_get_level(unsigned int cpu, unsigned int freq);
 #else /* !CONFIG_CPU_THERMAL */
 static inline struct thermal_cooling_device *
 cpufreq_cooling_register(const struct cpumask *clip_cpus)
@@ -54,7 +54,7 @@ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
         return;
 }
 static inline
-unsigned long cpufreq_cooling_get_level(unsigned int, unsigned int)
+unsigned long cpufreq_cooling_get_level(unsigned int cpu, unsigned int freq)
 {
         return THERMAL_CSTATE_INVALID;
 }
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 4d7390bc1727..90d5a15120d5 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -119,7 +119,7 @@ struct cpufreq_policy {
 
         struct kobject          kobj;
         struct completion       kobj_unregister;
-        bool                    transition_ongoing; /* Tracks transition status */
+        int                     transition_ongoing; /* Tracks transition status */
 };
 
 #define CPUFREQ_ADJUST                  (0)
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 3092df3614ae..b90337c9d468 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -324,7 +324,7 @@ static inline int __d_rcu_to_refcount(struct dentry *dentry, unsigned seq)
         return ret;
 }
 
-static inline unsigned d_count(struct dentry *dentry)
+static inline unsigned d_count(const struct dentry *dentry)
 {
         return dentry->d_count;
 }
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 3cd32478f2fd..e151d4c9298d 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -446,9 +446,9 @@ int __must_check dm_set_target_max_io_len(struct dm_target *ti, sector_t len);
 /*
  * Table reference counting.
  */
-struct dm_table *dm_get_live_table(struct mapped_device *md);
-void dm_table_get(struct dm_table *t);
-void dm_table_put(struct dm_table *t);
+struct dm_table *dm_get_live_table(struct mapped_device *md, int *srcu_idx);
+void dm_put_live_table(struct mapped_device *md, int srcu_idx);
+void dm_sync_table(struct mapped_device *md);
 
 /*
  * Queries
diff --git a/include/linux/device.h b/include/linux/device.h
index bcf8c0d4cd98..22b546a58591 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -47,7 +47,11 @@ struct bus_attribute {
 };
 
 #define BUS_ATTR(_name, _mode, _show, _store)   \
-struct bus_attribute bus_attr_##_name = __ATTR(_name, _mode, _show, _store)
+        struct bus_attribute bus_attr_##_name = __ATTR(_name, _mode, _show, _store)
+#define BUS_ATTR_RW(_name) \
+        struct bus_attribute bus_attr_##_name = __ATTR_RW(_name)
+#define BUS_ATTR_RO(_name) \
+        struct bus_attribute bus_attr_##_name = __ATTR_RO(_name)
 
 extern int __must_check bus_create_file(struct bus_type *,
                                         struct bus_attribute *);
@@ -261,9 +265,12 @@ struct driver_attribute {
                          size_t count);
 };
 
-#define DRIVER_ATTR(_name, _mode, _show, _store)        \
-struct driver_attribute driver_attr_##_name =           \
-        __ATTR(_name, _mode, _show, _store)
+#define DRIVER_ATTR(_name, _mode, _show, _store) \
+        struct driver_attribute driver_attr_##_name = __ATTR(_name, _mode, _show, _store)
+#define DRIVER_ATTR_RW(_name) \
+        struct driver_attribute driver_attr_##_name = __ATTR_RW(_name)
+#define DRIVER_ATTR_RO(_name) \
+        struct driver_attribute driver_attr_##_name = __ATTR_RO(_name)
 
 extern int __must_check driver_create_file(struct device_driver *driver,
                                         const struct driver_attribute *attr);
@@ -313,6 +320,7 @@ int subsys_virtual_register(struct bus_type *subsys,
  * @name:       Name of the class.
  * @owner:      The module owner.
  * @class_attrs: Default attributes of this class.
+ * @dev_groups: Default attributes of the devices that belong to the class.
  * @dev_attrs:  Default attributes of the devices belong to the class.
  * @dev_bin_attrs: Default binary attributes of the devices belong to the class.
  * @dev_kobj:   The kobject that represents this class and links it into the hierarchy.
@@ -342,7 +350,8 @@ struct class {
         struct module           *owner;
 
         struct class_attribute          *class_attrs;
-        struct device_attribute         *dev_attrs;
+        struct device_attribute         *dev_attrs;     /* use dev_groups instead */
+        const struct attribute_group    **dev_groups;
         struct bin_attribute            *dev_bin_attrs;
         struct kobject                  *dev_kobj;
 
@@ -414,8 +423,12 @@ struct class_attribute {
                                  const struct class_attribute *attr);
 };
 
-#define CLASS_ATTR(_name, _mode, _show, _store)                 \
-struct class_attribute class_attr_##_name = __ATTR(_name, _mode, _show, _store)
+#define CLASS_ATTR(_name, _mode, _show, _store) \
+        struct class_attribute class_attr_##_name = __ATTR(_name, _mode, _show, _store)
+#define CLASS_ATTR_RW(_name) \
+        struct class_attribute class_attr_##_name = __ATTR_RW(_name)
+#define CLASS_ATTR_RO(_name) \
+        struct class_attribute class_attr_##_name = __ATTR_RO(_name)
 
 extern int __must_check class_create_file(struct class *class,
                                           const struct class_attribute *attr);
@@ -423,7 +436,6 @@ extern void class_remove_file(struct class *class,
                               const struct class_attribute *attr);
 
 /* Simple class attribute that is just a static string */
-
 struct class_attribute_string {
         struct class_attribute attr;
         char *str;
@@ -512,6 +524,10 @@ ssize_t device_store_bool(struct device *dev, struct device_attribute *attr,
 
 #define DEVICE_ATTR(_name, _mode, _show, _store) \
         struct device_attribute dev_attr_##_name = __ATTR(_name, _mode, _show, _store)
+#define DEVICE_ATTR_RW(_name) \
+        struct device_attribute dev_attr_##_name = __ATTR_RW(_name)
+#define DEVICE_ATTR_RO(_name) \
+        struct device_attribute dev_attr_##_name = __ATTR_RO(_name)
 #define DEVICE_ULONG_ATTR(_name, _mode, _var) \
         struct dev_ext_attribute dev_attr_##_name = \
                 { __ATTR(_name, _mode, device_show_ulong, device_store_ulong), &(_var) }
@@ -924,6 +940,11 @@ extern __printf(5, 6)
 struct device *device_create(struct class *cls, struct device *parent,
                              dev_t devt, void *drvdata,
                              const char *fmt, ...);
+extern __printf(6, 7)
+struct device *device_create_with_groups(struct class *cls,
+                             struct device *parent, dev_t devt, void *drvdata,
+                             const struct attribute_group **groups,
+                             const char *fmt, ...);
 extern void device_destroy(struct class *cls, dev_t devt);
 
 /*
diff --git a/include/linux/drbd.h b/include/linux/drbd.h
index 1b4d4ee1168f..de7d74ab3de6 100644
--- a/include/linux/drbd.h
+++ b/include/linux/drbd.h
@@ -177,7 +177,11 @@ enum drbd_ret_code {
         ERR_NEED_APV_100        = 163,
         ERR_NEED_ALLOW_TWO_PRI  = 164,
         ERR_MD_UNCLEAN          = 165,
-
+        ERR_MD_LAYOUT_CONNECTED = 166,
+        ERR_MD_LAYOUT_TOO_BIG   = 167,
+        ERR_MD_LAYOUT_TOO_SMALL = 168,
+        ERR_MD_LAYOUT_NO_FIT    = 169,
+        ERR_IMPLICIT_SHRINK     = 170,
         /* insert new ones above this line */
         AFTER_LAST_ERR_CODE
 };
diff --git a/include/linux/drbd_genl.h b/include/linux/drbd_genl.h
index d0d8fac8a6e4..e8c44572b8cb 100644
--- a/include/linux/drbd_genl.h
+++ b/include/linux/drbd_genl.h
@@ -181,6 +181,8 @@ GENL_struct(DRBD_NLA_RESIZE_PARMS, 7, resize_parms,
         __u64_field(1, DRBD_GENLA_F_MANDATORY,  resize_size)
         __flg_field(2, DRBD_GENLA_F_MANDATORY,  resize_force)
         __flg_field(3, DRBD_GENLA_F_MANDATORY,  no_resync)
+        __u32_field_def(4, 0 /* OPTIONAL */, al_stripes, DRBD_AL_STRIPES_DEF)
+        __u32_field_def(5, 0 /* OPTIONAL */, al_stripe_size, DRBD_AL_STRIPE_SIZE_DEF)
 )
 
 GENL_struct(DRBD_NLA_STATE_INFO, 8, state_info,
diff --git a/include/linux/drbd_limits.h b/include/linux/drbd_limits.h
index 1fedf2b17cc8..17e50bb00521 100644
--- a/include/linux/drbd_limits.h
+++ b/include/linux/drbd_limits.h
@@ -215,4 +215,13 @@
 #define DRBD_ALWAYS_ASBP_DEF    0
 #define DRBD_USE_RLE_DEF        1
 
+#define DRBD_AL_STRIPES_MIN     1
+#define DRBD_AL_STRIPES_MAX     1024
+#define DRBD_AL_STRIPES_DEF     1
+#define DRBD_AL_STRIPES_SCALE   '1'
+
+#define DRBD_AL_STRIPE_SIZE_MIN   4
+#define DRBD_AL_STRIPE_SIZE_MAX   16777216
+#define DRBD_AL_STRIPE_SIZE_DEF   32
+#define DRBD_AL_STRIPE_SIZE_SCALE 'k' /* kilobytes */
 #endif
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index acd0312d46fb..306dd8cd0b6f 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -7,6 +7,7 @@
 #ifdef CONFIG_BLOCK
 
 struct io_cq;
+struct elevator_type;
 
 typedef int (elevator_merge_fn) (struct request_queue *, struct request **,
                                  struct bio *);
@@ -35,7 +36,8 @@ typedef void (elevator_put_req_fn) (struct request *);
 typedef void (elevator_activate_req_fn) (struct request_queue *, struct request *);
 typedef void (elevator_deactivate_req_fn) (struct request_queue *, struct request *);
 
-typedef int (elevator_init_fn) (struct request_queue *);
+typedef int (elevator_init_fn) (struct request_queue *,
+                                struct elevator_type *e);
 typedef void (elevator_exit_fn) (struct elevator_queue *);
 
 struct elevator_ops
@@ -155,6 +157,8 @@ extern int elevator_init(struct request_queue *, char *);
 extern void elevator_exit(struct elevator_queue *);
 extern int elevator_change(struct request_queue *, const char *);
 extern bool elv_rq_merge_ok(struct request *, struct bio *);
+extern struct elevator_queue *elevator_alloc(struct request_queue *,
+                                        struct elevator_type *);
 
 /*
  * Helper functions.
diff --git a/include/linux/fb.h b/include/linux/fb.h
index d49c60f5aa4c..ffac70aab3e9 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -624,7 +624,7 @@ extern void fb_pad_aligned_buffer(u8 *dst, u32 d_pitch, u8 *src, u32 s_pitch, u3
 extern void fb_set_suspend(struct fb_info *info, int state);
 extern int fb_get_color_depth(struct fb_var_screeninfo *var,
                               struct fb_fix_screeninfo *fix);
-extern int fb_get_options(char *name, char **option);
+extern int fb_get_options(const char *name, char **option);
 extern int fb_new_modelist(struct fb_info *info);
 
 extern struct fb_info *registered_fb[FB_MAX];
diff --git a/include/linux/filter.h b/include/linux/filter.h
index f65f5a69db8f..a6ac84871d6d 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -59,10 +59,10 @@ extern void bpf_jit_free(struct sk_filter *fp);
 static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
                                 u32 pass, void *image)
 {
-        pr_err("flen=%u proglen=%u pass=%u image=%p\n",
+        pr_err("flen=%u proglen=%u pass=%u image=%pK\n",
                flen, proglen, pass, image);
         if (image)
-                print_hex_dump(KERN_ERR, "JIT code: ", DUMP_PREFIX_ADDRESS,
+                print_hex_dump(KERN_ERR, "JIT code: ", DUMP_PREFIX_OFFSET,
                                16, 1, image, proglen, false);
 }
 #define SK_RUN_FILTER(FILTER, SKB) (*FILTER->bpf_func)(SKB, FILTER->insns)
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index 191501afd7fb..3b0e820375ab 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -251,8 +251,10 @@ struct ieee1394_device_id;
 
 struct fw_driver {
         struct device_driver driver;
+        int (*probe)(struct fw_unit *unit, const struct ieee1394_device_id *id);
         /* Called when the parent device sits through a bus reset. */
         void (*update)(struct fw_unit *unit);
+        void (*remove)(struct fw_unit *unit);
         const struct ieee1394_device_id *id_table;
 };
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index a35b10e9a680..981874773e85 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -10,6 +10,7 @@
 #include <linux/stat.h>
 #include <linux/cache.h>
 #include <linux/list.h>
+#include <linux/llist.h>
 #include <linux/radix-tree.h>
 #include <linux/rbtree.h>
 #include <linux/init.h>
@@ -768,6 +769,7 @@ struct file {
          */
         union {
                 struct list_head        fu_list;
+                struct llist_node       fu_llist;
                 struct rcu_head         fu_rcuhead;
         } f_u;
         struct path             f_path;
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 99d0fbcbaf79..9f15c0064c50 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -566,10 +566,6 @@ static inline ssize_t ftrace_filter_write(struct file *file, const char __user *
                             size_t cnt, loff_t *ppos) { return -ENODEV; }
 static inline ssize_t ftrace_notrace_write(struct file *file, const char __user *ubuf,
                              size_t cnt, loff_t *ppos) { return -ENODEV; }
-static inline loff_t ftrace_regex_lseek(struct file *file, loff_t offset, int whence)
-{
-        return -ENODEV;
-}
 static inline int
 ftrace_regex_release(struct inode *inode, struct file *file) { return -ENODEV; }
 #endif /* CONFIG_DYNAMIC_FTRACE */
@@ -828,10 +824,15 @@ enum ftrace_dump_mode;
 
 extern enum ftrace_dump_mode ftrace_dump_on_oops;
 
+extern void disable_trace_on_warning(void);
+extern int __disable_trace_on_warning;
+
 #ifdef CONFIG_PREEMPT
 #define INIT_TRACE_RECURSION            .trace_recursion = 0,
 #endif
 
+#else /* CONFIG_TRACING */
+static inline void  disable_trace_on_warning(void) { }
 #endif /* CONFIG_TRACING */
 
 #ifndef INIT_TRACE_RECURSION
diff --git a/include/linux/i2c/twl.h b/include/linux/i2c/twl.h
index 488debbef895..81cbbdb96aae 100644
--- a/include/linux/i2c/twl.h
+++ b/include/linux/i2c/twl.h
@@ -658,7 +658,6 @@ struct twl4030_power_data {
         bool use_poweroff;      /* Board is wired for TWL poweroff */
 };
 
-extern void twl4030_power_init(struct twl4030_power_data *triton2_scripts);
 extern int twl4030_remove_script(u8 flags);
 extern void twl4030_power_off(void);
 
@@ -726,7 +725,7 @@ struct twl4030_platform_data {
         struct regulator_init_data              *clk32kg;
         struct regulator_init_data              *v1v8;
         struct regulator_init_data              *v2v1;
-        /* TWL6025 LDO regulators */
+        /* TWL6032 LDO regulators */
         struct regulator_init_data              *ldo1;
         struct regulator_init_data              *ldo2;
         struct regulator_init_data              *ldo3;
@@ -736,7 +735,7 @@ struct twl4030_platform_data {
         struct regulator_init_data              *ldo7;
         struct regulator_init_data              *ldoln;
         struct regulator_init_data              *ldousb;
-        /* TWL6025 DCDC regulators */
+        /* TWL6032 DCDC regulators */
         struct regulator_init_data              *smps3;
         struct regulator_init_data              *smps4;
         struct regulator_init_data              *vio6025;
@@ -753,7 +752,7 @@ struct twl_regulator_driver_data {
 #define TPS_SUBSET              BIT(1)  /* tps659[23]0 have fewer LDOs */
 #define TWL5031                 BIT(2)  /* twl5031 has different registers */
 #define TWL6030_CLASS           BIT(3)  /* TWL6030 class */
-#define TWL6025_SUBCLASS        BIT(4)  /* TWL6025 has changed registers */
+#define TWL6032_SUBCLASS        BIT(4)  /* TWL6032 has changed registers */
 #define TWL4030_ALLOW_UNSUPPORTED BIT(5) /* Some voltages are possible
                                           * but not officially supported.
                                           * This flag is necessary to
@@ -840,20 +839,20 @@ static inline int twl4030charger_usb_en(int enable) { return 0; }
 #define TWL6030_REG_CLK32KG     48
 
 /* LDOs on 6025 have different names */
-#define TWL6025_REG_LDO2        49
-#define TWL6025_REG_LDO4        50
-#define TWL6025_REG_LDO3        51
-#define TWL6025_REG_LDO5        52
-#define TWL6025_REG_LDO1        53
-#define TWL6025_REG_LDO7        54
-#define TWL6025_REG_LDO6        55
-#define TWL6025_REG_LDOLN       56
-#define TWL6025_REG_LDOUSB      57
+#define TWL6032_REG_LDO2        49
+#define TWL6032_REG_LDO4        50
+#define TWL6032_REG_LDO3        51
+#define TWL6032_REG_LDO5        52
+#define TWL6032_REG_LDO1        53
+#define TWL6032_REG_LDO7        54
+#define TWL6032_REG_LDO6        55
+#define TWL6032_REG_LDOLN       56
+#define TWL6032_REG_LDOUSB      57
 
 /* 6025 DCDC supplies */
-#define TWL6025_REG_SMPS3       58
-#define TWL6025_REG_SMPS4       59
-#define TWL6025_REG_VIO         60
+#define TWL6032_REG_SMPS3       58
+#define TWL6032_REG_SMPS4       59
+#define TWL6032_REG_VIO         60
 
 
 #endif /* End of __TWL4030_H */
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 06b0ed0154a4..b0dc87a2a376 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -146,6 +146,7 @@ static inline u16 ieee80211_sn_sub(u16 sn1, u16 sn2)
 #define IEEE80211_MAX_RTS_THRESHOLD     2353
 #define IEEE80211_MAX_AID               2007
 #define IEEE80211_MAX_TIM_LEN           251
+#define IEEE80211_MAX_MESH_PEERINGS     63
 /* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
    6.2.1.1.2.
 
@@ -1829,6 +1830,15 @@ enum ieee80211_key_len {
         WLAN_KEY_LEN_AES_CMAC = 16,
 };
 
+#define IEEE80211_WEP_IV_LEN            4
+#define IEEE80211_WEP_ICV_LEN           4
+#define IEEE80211_CCMP_HDR_LEN          8
+#define IEEE80211_CCMP_MIC_LEN          8
+#define IEEE80211_CCMP_PN_LEN           6
+#define IEEE80211_TKIP_IV_LEN           8
+#define IEEE80211_TKIP_ICV_LEN          4
+#define IEEE80211_CMAC_PN_LEN           6
+
 /* Public action codes */
 enum ieee80211_pub_actioncode {
         WLAN_PUB_ACTION_EXT_CHANSW_ANN = 4,
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index c3f817c3eb45..a86784dec3d3 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -12,5 +12,6 @@ struct ifla_vf_info {
         __u32 qos;
         __u32 tx_rate;
         __u32 spoofchk;
+        __u32 linkstate;
 };
 #endif /* _LINUX_IF_LINK_H */
diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index 84dde1dd1da4..ddd33fd5904d 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -8,7 +8,7 @@
 #include <net/netlink.h>
 #include <linux/u64_stats_sync.h>
 
-#if defined(CONFIG_MACVTAP) || defined(CONFIG_MACVTAP_MODULE)
+#if IS_ENABLED(CONFIG_MACVTAP)
 struct socket *macvtap_get_socket(struct file *);
 #else
 #include <linux/err.h>
@@ -50,7 +50,7 @@ struct macvlan_pcpu_stats {
  * Maximum times a macvtap device can be opened. This can be used to
  * configure the number of receive queue, e.g. for multiqueue virtio.
  */
-#define MAX_MACVTAP_QUEUES      (NR_CPUS < 16 ? NR_CPUS : 16)
+#define MAX_MACVTAP_QUEUES      16
 
 #define MACVLAN_MC_FILTER_BITS  8
 #define MACVLAN_MC_FILTER_SZ    (1 << MACVLAN_MC_FILTER_BITS)
@@ -65,12 +65,18 @@ struct macvlan_dev {
 
         DECLARE_BITMAP(mc_filter, MACVLAN_MC_FILTER_SZ);
 
+        netdev_features_t       set_features;
         enum macvlan_mode       mode;
         u16                     flags;
         int (*receive)(struct sk_buff *skb);
         int (*forward)(struct net_device *dev, struct sk_buff *skb);
-        struct macvtap_queue    *taps[MAX_MACVTAP_QUEUES];
+        /* This array tracks active taps. */
+        struct macvtap_queue    __rcu *taps[MAX_MACVTAP_QUEUES];
+        /* This list tracks all taps (both enabled and disabled) */
+        struct list_head        queue_list;
         int                     numvtaps;
+        int                     numqueues;
+        netdev_features_t       tap_features;
         int                     minor;
 };
 
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 16fae6436d0e..f6156f91eb1c 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -69,6 +69,7 @@ struct team_port {
         s32 priority; /* lower number ~ higher priority */
         u16 queue_id;
         struct list_head qom_list; /* node in queue override mapping list */
+        struct rcu_head rcu;
         long mode_priv[0];
 };
 
@@ -228,6 +229,16 @@ static inline struct team_port *team_get_port_by_index(struct team *team,
                         return port;
         return NULL;
 }
+
+static inline int team_num_to_port_index(struct team *team, int num)
+{
+        int en_port_count = ACCESS_ONCE(team->en_port_count);
+
+        if (unlikely(!en_port_count))
+                return 0;
+        return num % en_port_count;
+}
+
 static inline struct team_port *team_get_port_by_index_rcu(struct team *team,
                                                            int port_index)
 {
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 637fa71de0c7..715c343f7c00 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -79,9 +79,8 @@ static inline int is_vlan_dev(struct net_device *dev)
 }
 
 #define vlan_tx_tag_present(__skb)      ((__skb)->vlan_tci & VLAN_TAG_PRESENT)
-#define vlan_tx_nonzero_tag_present(__skb) \
-        (vlan_tx_tag_present(__skb) && ((__skb)->vlan_tci & VLAN_VID_MASK))
 #define vlan_tx_tag_get(__skb)          ((__skb)->vlan_tci & ~VLAN_TAG_PRESENT)
+#define vlan_tx_tag_get_id(__skb)       ((__skb)->vlan_tci & VLAN_VID_MASK)
 
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
 
@@ -243,8 +242,6 @@ static inline struct sk_buff *__vlan_hwaccel_put_tag(struct sk_buff *skb,
         return skb;
 }
 
-#define HAVE_VLAN_PUT_TAG
-
 /**
  * vlan_put_tag - inserts VLAN tag according to device features
  * @skb: skbuff to tag
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index 7f2bf1518480..e3362b5f13e8 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -84,6 +84,7 @@ struct ip_mc_list {
                 struct ip_mc_list *next;
                 struct ip_mc_list __rcu *next_rcu;
         };
+        struct ip_mc_list __rcu *next_hash;
         struct timer_list       timer;
         int                     users;
         atomic_t                refcnt;
diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h
index 8d171f427632..3d35b7023591 100644
--- a/include/linux/iio/iio.h
+++ b/include/linux/iio/iio.h
@@ -211,8 +211,8 @@ struct iio_chan_spec {
 static inline bool iio_channel_has_info(const struct iio_chan_spec *chan,
         enum iio_chan_info_enum type)
 {
-        return (chan->info_mask_separate & type) |
-               (chan->info_mask_shared_by_type & type);
+        return (chan->info_mask_separate & BIT(type)) |
+               (chan->info_mask_shared_by_type & BIT(type));
 }
 
 #define IIO_ST(si, rb, sb, sh)                                          \
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index ea1e3b863890..b99cd23f3474 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -50,12 +50,17 @@ struct ipv4_devconf {
         DECLARE_BITMAP(state, IPV4_DEVCONF_MAX);
 };
 
+#define MC_HASH_SZ_LOG 9
+
 struct in_device {
         struct net_device       *dev;
         atomic_t                refcnt;
         int                     dead;
         struct in_ifaddr        *ifa_list;      /* IP ifaddr chain              */
+
         struct ip_mc_list __rcu *mc_list;       /* IP multicast filter chain    */
+        struct ip_mc_list __rcu * __rcu *mc_hash;
+
         int                     mc_count;       /* Number of installed mcasts   */
         spinlock_t              mc_tomb_lock;
         struct ip_mc_list       *mc_tomb;
diff --git a/include/linux/input/ti_am335x_tsc.h b/include/linux/input/ti_am335x_tsc.h
deleted file mode 100644
index 49269a2aa329..000000000000
--- a/include/linux/input/ti_am335x_tsc.h
+++ /dev/null
@@ -1,23 +0,0 @@
-#ifndef __LINUX_TI_AM335X_TSC_H
-#define __LINUX_TI_AM335X_TSC_H
-
-/**
- * struct tsc_data      Touchscreen wire configuration
- * @wires:              Wires refer to application modes
- *                      i.e. 4/5/8 wire touchscreen support
- *                      on the platform.
- * @x_plate_resistance: X plate resistance.
- * @steps_to_configure: The sequencer supports a total of
- *                      16 programmable steps.
- *                      A step configured to read a single
- *                      co-ordinate value, can be applied
- *                      more number of times for better results.
- */
-
-struct tsc_data {
-        int wires;
-        int x_plate_resistance;
-        int steps_to_configure;
-};
-
-#endif
diff --git a/include/linux/io.h b/include/linux/io.h
index 069e4075f872..f4f42faec686 100644
--- a/include/linux/io.h
+++ b/include/linux/io.h
@@ -76,4 +76,29 @@ void devm_ioremap_release(struct device *dev, void *res);
 #define arch_has_dev_port()     (1)
 #endif
 
+/*
+ * Some systems (x86 without PAT) have a somewhat reliable way to mark a
+ * physical address range such that uncached mappings will actually
+ * end up write-combining.  This facility should be used in conjunction
+ * with pgprot_writecombine, ioremap-wc, or set_memory_wc, since it has
+ * no effect if the per-page mechanisms are functional.
+ * (On x86 without PAT, these functions manipulate MTRRs.)
+ *
+ * arch_phys_del_wc(0) or arch_phys_del_wc(any error code) is guaranteed
+ * to have no effect.
+ */
+#ifndef arch_phys_wc_add
+static inline int __must_check arch_phys_wc_add(unsigned long base,
+                                                unsigned long size)
+{
+        return 0;  /* It worked (i.e. did nothing). */
+}
+
+static inline void arch_phys_wc_del(int handle)
+{
+}
+
+#define arch_phys_wc_add arch_phys_wc_add
+#endif
+
 #endif /* _LINUX_IO_H */
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
index 8fb8edf12417..97ba4e78a37e 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
@@ -139,6 +139,10 @@ static inline u64 get_jiffies_64(void)
          ((__s64)(a) - (__s64)(b) >= 0))
 #define time_before_eq64(a,b)   time_after_eq64(b,a)
 
+#define time_in_range64(a, b, c) \
+        (time_after_eq64(a, b) && \
+         time_before_eq64(a, c))
+
 /*
  * These four macros compare jiffies and 'a' for convenience.
  */
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index fc66b301b648..debf208b7611 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -324,6 +324,11 @@ static inline ktime_t ktime_add_us(const ktime_t kt, const u64 usec)
         return ktime_add_ns(kt, usec * NSEC_PER_USEC);
 }
 
+static inline ktime_t ktime_add_ms(const ktime_t kt, const u64 msec)
+{
+        return ktime_add_ns(kt, msec * NSEC_PER_MSEC);
+}
+
 static inline ktime_t ktime_sub_us(const ktime_t kt, const u64 usec)
 {
         return ktime_sub_ns(kt, usec * NSEC_PER_USEC);
@@ -368,7 +373,15 @@ extern void ktime_get_ts(struct timespec *ts);
 static inline ktime_t ns_to_ktime(u64 ns)
 {
         static const ktime_t ktime_zero = { .tv64 = 0 };
+
         return ktime_add_ns(ktime_zero, ns);
 }
 
+static inline ktime_t ms_to_ktime(u64 ms)
+{
+        static const ktime_t ktime_zero = { .tv64 = 0 };
+
+        return ktime_add_ms(ktime_zero, ms);
+}
+
 #endif
diff --git a/include/linux/list.h b/include/linux/list.h
index b83e5657365a..f4d8a2f12a33 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -381,17 +381,6 @@ static inline void list_splice_tail_init(struct list_head *list,
         for (pos = (head)->next; pos != (head); pos = pos->next)
 
 /**
- * __list_for_each      -       iterate over a list
- * @pos:        the &struct list_head to use as a loop cursor.
- * @head:       the head for your list.
- *
- * This variant doesn't differ from list_for_each() any more.
- * We don't do prefetching in either case.
- */
-#define __list_for_each(pos, head) \
-        for (pos = (head)->next; pos != (head); pos = pos->next)
-
-/**
  * list_for_each_prev   -       iterate over a list backwards
  * @pos:        the &struct list_head to use as a loop cursor.
  * @head:       the head for your list.
diff --git a/include/linux/llist.h b/include/linux/llist.h
index a5199f6d0e82..cdaa7f023899 100644
--- a/include/linux/llist.h
+++ b/include/linux/llist.h
@@ -142,6 +142,9 @@ static inline struct llist_node *llist_next(struct llist_node *node)
         return node->next;
 }
 
+extern bool llist_add_batch(struct llist_node *new_first,
+                            struct llist_node *new_last,
+                            struct llist_head *head);
 /**
  * llist_add - add a new entry
  * @new:        new entry to be added
@@ -151,18 +154,7 @@ static inline struct llist_node *llist_next(struct llist_node *node)
  */
 static inline bool llist_add(struct llist_node *new, struct llist_head *head)
 {
-        struct llist_node *entry, *old_entry;
-
-        entry = head->first;
-        for (;;) {
-                old_entry = entry;
-                new->next = entry;
-                entry = cmpxchg(&head->first, old_entry, new);
-                if (entry == old_entry)
-                        break;
-        }
-
-        return old_entry == NULL;
+        return llist_add_batch(new, new, head);
 }
 
 /**
@@ -178,9 +170,6 @@ static inline struct llist_node *llist_del_all(struct llist_head *head)
         return xchg(&head->first, NULL);
 }
 
-extern bool llist_add_batch(struct llist_node *new_first,
-                            struct llist_node *new_last,
-                            struct llist_head *head);
 extern struct llist_node *llist_del_first(struct llist_head *head);
 
 #endif /* LLIST_H */
diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h
index dd3c34ebca9a..8e9a029e093d 100644
--- a/include/linux/marvell_phy.h
+++ b/include/linux/marvell_phy.h
@@ -14,6 +14,8 @@
 #define MARVELL_PHY_ID_88E1149R         0x01410e50
 #define MARVELL_PHY_ID_88E1240          0x01410e30
 #define MARVELL_PHY_ID_88E1318S         0x01410e90
+#define MARVELL_PHY_ID_88E1116R         0x01410e40
+#define MARVELL_PHY_ID_88E1510          0x01410dd0
 
 /* struct phy_device dev_flags definitions */
 #define MARVELL_PHY_M1145_FLAGS_RESISTANCE      0x00000001
diff --git a/include/linux/mfd/88pm80x.h b/include/linux/mfd/88pm80x.h
index e94537befabd..97cb283cc8e1 100644
--- a/include/linux/mfd/88pm80x.h
+++ b/include/linux/mfd/88pm80x.h
@@ -17,7 +17,6 @@
 #include <linux/regmap.h>
 #include <linux/atomic.h>
 
-#define PM80X_VERSION_MASK              (0xFF)  /* 80X chip ID mask */
 enum {
         CHIP_INVALID = 0,
         CHIP_PM800,
@@ -299,8 +298,7 @@ struct pm80x_chip {
         struct regmap *regmap;
         struct regmap_irq_chip *regmap_irq_chip;
         struct regmap_irq_chip_data *irq_data;
-        unsigned char version;
-        int id;
+        int type;
         int irq;
         int irq_mode;
         unsigned long wu_flag;
@@ -309,8 +307,14 @@ struct pm80x_chip {
 
 struct pm80x_platform_data {
         struct pm80x_rtc_pdata *rtc;
-        unsigned short power_page_addr; /* power page I2C address */
-        unsigned short gpadc_page_addr; /* gpadc page I2C address */
+        /*
+         * For the regulator not defined, set regulators[not_defined] to be
+         * NULL. num_regulators are the number of regulators supposed to be
+         * initialized. If all regulators are not defined, set num_regulators
+         * to be 0.
+         */
+        struct regulator_init_data *regulators[PM800_ID_RG_MAX];
+        unsigned int num_regulators;
         int irq_mode;           /* Clear interrupt by read/write(0/1) */
         int batt_det;           /* enable/disable */
         int (*plat_config)(struct pm80x_chip *chip,
@@ -363,7 +367,6 @@ static inline int pm80x_dev_resume(struct device *dev)
 }
 #endif
 
-extern int pm80x_init(struct i2c_client *client,
-                      const struct i2c_device_id *id);
+extern int pm80x_init(struct i2c_client *client);
 extern int pm80x_deinit(void);
 #endif /* __LINUX_MFD_88PM80X_H */
diff --git a/include/linux/mfd/abx500/ab8500.h b/include/linux/mfd/abx500/ab8500.h
index 0390d5943ed6..f4acd898dac9 100644
--- a/include/linux/mfd/abx500/ab8500.h
+++ b/include/linux/mfd/abx500/ab8500.h
@@ -291,6 +291,8 @@ enum ab8500_version {
 #define AB8540_INT_FSYNC2R              213
 #define AB8540_INT_BITCLK2F             214
 #define AB8540_INT_BITCLK2R             215
+/* ab8540_irq_regoffset[27] -> IT[Source|Latch|Mask]33 */
+#define AB8540_INT_RTC_1S               216
 
 /*
  * AB8500_AB9540_NR_IRQS is used when configuring the IRQ numbers for the
diff --git a/include/linux/mfd/arizona/core.h b/include/linux/mfd/arizona/core.h
index f797bb9b8b56..5cf8b91ce996 100644
--- a/include/linux/mfd/arizona/core.h
+++ b/include/linux/mfd/arizona/core.h
@@ -23,6 +23,7 @@
 enum arizona_type {
         WM5102 = 1,
         WM5110 = 2,
+        WM8997 = 3,
 };
 
 #define ARIZONA_IRQ_GP1                    0
@@ -121,5 +122,6 @@ int arizona_set_irq_wake(struct arizona *arizona, int irq, int on);
 
 int wm5102_patch(struct arizona *arizona);
 int wm5110_patch(struct arizona *arizona);
+int wm8997_patch(struct arizona *arizona);
 
 #endif
diff --git a/include/linux/mfd/davinci_voicecodec.h b/include/linux/mfd/davinci_voicecodec.h
index 7dd6524d2aac..13a1ee95a233 100644
--- a/include/linux/mfd/davinci_voicecodec.h
+++ b/include/linux/mfd/davinci_voicecodec.h
@@ -28,6 +28,8 @@
 #include <linux/mfd/core.h>
 #include <linux/platform_data/edma.h>
 
+#include <mach/hardware.h>
+
 /*
  * Register values.
  */
@@ -111,8 +113,6 @@ struct davinci_vc {
 
         /* Memory resources */
         void __iomem *base;
-        resource_size_t pbase;
-        size_t base_size;
 
         /* MFD cells */
         struct mfd_cell cells[DAVINCI_VC_CELLS];
diff --git a/include/linux/mfd/kempld.h b/include/linux/mfd/kempld.h
new file mode 100644
index 000000000000..b911ef3add03
--- /dev/null
+++ b/include/linux/mfd/kempld.h
@@ -0,0 +1,125 @@
+/*
+ * Kontron PLD driver definitions
+ *
+ * Copyright (c) 2010-2012 Kontron Europe GmbH
+ * Author: Michael Brunner <michael.brunner@kontron.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License 2 as published
+ * by the Free Software Foundation.
+ */
+
+#ifndef _LINUX_MFD_KEMPLD_H_
+#define _LINUX_MFD_KEMPLD_H_
+
+/* kempld register definitions */
+#define KEMPLD_IOINDEX                  0xa80
+#define KEMPLD_IODATA                   0xa81
+#define KEMPLD_MUTEX_KEY                0x80
+#define KEMPLD_VERSION                  0x00
+#define KEMPLD_VERSION_LSB              0x00
+#define KEMPLD_VERSION_MSB              0x01
+#define KEMPLD_VERSION_GET_MINOR(x)     (x & 0x1f)
+#define KEMPLD_VERSION_GET_MAJOR(x)     ((x >> 5) & 0x1f)
+#define KEMPLD_VERSION_GET_NUMBER(x)    ((x >> 10) & 0xf)
+#define KEMPLD_VERSION_GET_TYPE(x)      ((x >> 14) & 0x3)
+#define KEMPLD_BUILDNR                  0x02
+#define KEMPLD_BUILDNR_LSB              0x02
+#define KEMPLD_BUILDNR_MSB              0x03
+#define KEMPLD_FEATURE                  0x04
+#define KEMPLD_FEATURE_LSB              0x04
+#define KEMPLD_FEATURE_MSB              0x05
+#define KEMPLD_FEATURE_BIT_I2C          (1 << 0)
+#define KEMPLD_FEATURE_BIT_WATCHDOG     (1 << 1)
+#define KEMPLD_FEATURE_BIT_GPIO         (1 << 2)
+#define KEMPLD_FEATURE_MASK_UART        (7 << 3)
+#define KEMPLD_FEATURE_BIT_NMI          (1 << 8)
+#define KEMPLD_FEATURE_BIT_SMI          (1 << 9)
+#define KEMPLD_FEATURE_BIT_SCI          (1 << 10)
+#define KEMPLD_SPEC                     0x06
+#define KEMPLD_SPEC_GET_MINOR(x)        (x & 0x0f)
+#define KEMPLD_SPEC_GET_MAJOR(x)        ((x >> 4) & 0x0f)
+#define KEMPLD_IRQ_GPIO                 0x35
+#define KEMPLD_IRQ_I2C                  0x36
+#define KEMPLD_CFG                      0x37
+#define KEMPLD_CFG_GPIO_I2C_MUX         (1 << 0)
+#define KEMPLD_CFG_BIOS_WP              (1 << 7)
+
+#define KEMPLD_CLK                      33333333
+
+#define KEMPLD_TYPE_RELEASE             0x0
+#define KEMPLD_TYPE_DEBUG               0x1
+#define KEMPLD_TYPE_CUSTOM              0x2
+
+/**
+ * struct kempld_info - PLD device information structure
+ * @major:      PLD major revision
+ * @minor:      PLD minor revision
+ * @buildnr:    PLD build number
+ * @number:     PLD board specific index
+ * @type:       PLD type
+ * @spec_major: PLD FW specification major revision
+ * @spec_minor: PLD FW specification minor revision
+ */
+struct kempld_info {
+        unsigned int major;
+        unsigned int minor;
+        unsigned int buildnr;
+        unsigned int number;
+        unsigned int type;
+        unsigned int spec_major;
+        unsigned int spec_minor;
+};
+
+/**
+ * struct kempld_device_data - Internal representation of the PLD device
+ * @io_base:            Pointer to the IO memory
+ * @io_index:           Pointer to the IO index register
+ * @io_data:            Pointer to the IO data register
+ * @pld_clock:          PLD clock frequency
+ * @feature_mask:       PLD feature mask
+ * @dev:                Pointer to kernel device structure
+ * @info:               KEMPLD info structure
+ * @lock:               PLD mutex
+ */
+struct kempld_device_data {
+        void __iomem            *io_base;
+        void __iomem            *io_index;
+        void __iomem            *io_data;
+        u32                     pld_clock;
+        u32                     feature_mask;
+        struct device           *dev;
+        struct kempld_info      info;
+        struct mutex            lock;
+};
+
+/**
+ * struct kempld_platform_data - PLD hardware configuration structure
+ * @pld_clock:                  PLD clock frequency
+ * @gpio_base                   GPIO base pin number
+ * @ioresource:                 IO addresses of the PLD
+ * @get_mutex:                  PLD specific get_mutex callback
+ * @release_mutex:              PLD specific release_mutex callback
+ * @get_info:                   PLD specific get_info callback
+ * @register_cells:             PLD specific register_cells callback
+ */
+struct kempld_platform_data {
+        u32                             pld_clock;
+        int                             gpio_base;
+        struct resource                 *ioresource;
+        void (*get_hardware_mutex)      (struct kempld_device_data *);
+        void (*release_hardware_mutex)  (struct kempld_device_data *);
+        int (*get_info)                 (struct kempld_device_data *);
+        int (*register_cells)           (struct kempld_device_data *);
+};
+
+extern void kempld_get_mutex(struct kempld_device_data *pld);
+extern void kempld_release_mutex(struct kempld_device_data *pld);
+extern u8 kempld_read8(struct kempld_device_data *pld, u8 index);
+extern void kempld_write8(struct kempld_device_data *pld, u8 index, u8 data);
+extern u16 kempld_read16(struct kempld_device_data *pld, u8 index);
+extern void kempld_write16(struct kempld_device_data *pld, u8 index, u16 data);
+extern u32 kempld_read32(struct kempld_device_data *pld, u8 index);
+extern void kempld_write32(struct kempld_device_data *pld, u8 index, u32 data);
+
+#endif /* _LINUX_MFD_KEMPLD_H_ */
diff --git a/include/linux/mfd/max8998-private.h b/include/linux/mfd/max8998-private.h
index effa5d3b96ae..84844e0a5704 100644
--- a/include/linux/mfd/max8998-private.h
+++ b/include/linux/mfd/max8998-private.h
@@ -132,9 +132,12 @@ enum {
 
 #define MAX8998_ENRAMP                  (1 << 4)
 
+struct irq_domain;
+
 /**
  * struct max8998_dev - max8998 master device for sub-drivers
  * @dev: master device of the chip (can be used to access platform data)
+ * @pdata: platform data for the driver and subdrivers
  * @i2c: i2c client private data for regulator
  * @rtc: i2c client private data for rtc
  * @iolock: mutex for serializing io access
@@ -148,12 +151,14 @@ enum {
  */
 struct max8998_dev {
         struct device *dev;
+        struct max8998_platform_data *pdata;
         struct i2c_client *i2c;
         struct i2c_client *rtc;
         struct mutex iolock;
         struct mutex irqlock;
 
-        int irq_base;
+        unsigned int irq_base;
+        struct irq_domain *irq_domain;
         int irq;
         int ono;
         u8 irq_masks_cur[MAX8998_NUM_IRQ_REGS];
diff --git a/include/linux/mfd/max8998.h b/include/linux/mfd/max8998.h
index 6823548d0c0a..e3956a654cbc 100644
--- a/include/linux/mfd/max8998.h
+++ b/include/linux/mfd/max8998.h
@@ -58,10 +58,12 @@ enum {
  * max8998_regulator_data - regulator data
  * @id: regulator id
  * @initdata: regulator init data (contraints, supplies, ...)
+ * @reg_node: DT node of regulator (unused on non-DT platforms)
  */
 struct max8998_regulator_data {
         int                             id;
         struct regulator_init_data      *initdata;
+        struct device_node              *reg_node;
 };
 
 /**
@@ -73,12 +75,8 @@ struct max8998_regulator_data {
  * @buck_voltage_lock: Do NOT change the values of the following six
  *   registers set by buck?_voltage?. The voltage of BUCK1/2 cannot
  *   be other than the preset values.
- * @buck1_voltage1: BUCK1 DVS mode 1 voltage register
- * @buck1_voltage2: BUCK1 DVS mode 2 voltage register
- * @buck1_voltage3: BUCK1 DVS mode 3 voltage register
- * @buck1_voltage4: BUCK1 DVS mode 4 voltage register
- * @buck2_voltage1: BUCK2 DVS mode 1 voltage register
- * @buck2_voltage2: BUCK2 DVS mode 2 voltage register
+ * @buck1_voltage: BUCK1 DVS mode 1 voltage registers
+ * @buck2_voltage: BUCK2 DVS mode 2 voltage registers
  * @buck1_set1: BUCK1 gpio pin 1 to set output voltage
  * @buck1_set2: BUCK1 gpio pin 2 to set output voltage
  * @buck1_default_idx: Default for BUCK1 gpio pin 1, 2
@@ -100,15 +98,11 @@ struct max8998_regulator_data {
 struct max8998_platform_data {
         struct max8998_regulator_data   *regulators;
         int                             num_regulators;
-        int                             irq_base;
+        unsigned int                    irq_base;
         int                             ono;
         bool                            buck_voltage_lock;
-        int                             buck1_voltage1;
-        int                             buck1_voltage2;
-        int                             buck1_voltage3;
-        int                             buck1_voltage4;
-        int                             buck2_voltage1;
-        int                             buck2_voltage2;
+        int                             buck1_voltage[4];
+        int                             buck2_voltage[2];
         int                             buck1_set1;
         int                             buck1_set2;
         int                             buck1_default_idx;
diff --git a/include/linux/mfd/palmas.h b/include/linux/mfd/palmas.h
index 9b81b2bdc46b..1a8dd7afe084 100644
--- a/include/linux/mfd/palmas.h
+++ b/include/linux/mfd/palmas.h
@@ -34,6 +34,19 @@
                         ((a) == PALMAS_CHIP_ID))
 #define is_palmas_charger(a) ((a) == PALMAS_CHIP_CHARGER_ID)
 
+/**
+ * Palmas PMIC feature types
+ *
+ * PALMAS_PMIC_FEATURE_SMPS10_BOOST - used when the PMIC provides SMPS10_BOOST
+ *      regulator.
+ *
+ * PALMAS_PMIC_HAS(b, f) - macro to check if a bandgap device is capable of a
+ *      specific feature (above) or not. Return non-zero, if yes.
+ */
+#define PALMAS_PMIC_FEATURE_SMPS10_BOOST        BIT(0)
+#define PALMAS_PMIC_HAS(b, f)                   \
+                        ((b)->features & PALMAS_PMIC_FEATURE_ ## f)
+
 struct palmas_pmic;
 struct palmas_gpadc;
 struct palmas_resource;
@@ -54,6 +67,7 @@ struct palmas {
         /* Stored chip id */
         int id;
 
+        unsigned int features;
         /* IRQ Data */
         int irq;
         u32 irq_mask;
diff --git a/include/linux/mfd/rtsx_pci.h b/include/linux/mfd/rtsx_pci.h
index 86bc635f8385..7a9f7089435d 100644
--- a/include/linux/mfd/rtsx_pci.h
+++ b/include/linux/mfd/rtsx_pci.h
@@ -575,6 +575,7 @@
 
 #define CARD_PWR_CTL                    0xFD50
 #define CARD_CLK_SWITCH                 0xFD51
+#define RTL8411B_PACKAGE_MODE           0xFD51
 #define CARD_SHARE_MODE                 0xFD52
 #define CARD_DRIVE_SEL                  0xFD53
 #define CARD_STOP                       0xFD54
diff --git a/include/linux/mfd/samsung/core.h b/include/linux/mfd/samsung/core.h
index f0f4de3b4ccc..378ae8a04c6a 100644
--- a/include/linux/mfd/samsung/core.h
+++ b/include/linux/mfd/samsung/core.h
@@ -14,8 +14,6 @@
 #ifndef __LINUX_MFD_SEC_CORE_H
 #define __LINUX_MFD_SEC_CORE_H
 
-#define NUM_IRQ_REGS    4
-
 enum sec_device_type {
         S5M8751X,
         S5M8763X,
@@ -44,8 +42,6 @@ struct sec_pmic_dev {
         struct regmap *regmap;
         struct i2c_client *i2c;
         struct i2c_client *rtc;
-        struct mutex iolock;
-        struct mutex irqlock;
 
         int device_type;
         int irq_base;
@@ -53,8 +49,6 @@ struct sec_pmic_dev {
         struct regmap_irq_chip_data *irq_data;
 
         int ono;
-        u8 irq_masks_cur[NUM_IRQ_REGS];
-        u8 irq_masks_cache[NUM_IRQ_REGS];
         int type;
         bool wakeup;
 };
diff --git a/include/linux/mfd/samsung/s2mps11.h b/include/linux/mfd/samsung/s2mps11.h
index ad2252f239d7..4e94dc65f987 100644
--- a/include/linux/mfd/samsung/s2mps11.h
+++ b/include/linux/mfd/samsung/s2mps11.h
@@ -189,6 +189,7 @@ enum s2mps11_regulators {
 #define S2MPS11_ENABLE_SHIFT    0x06
 #define S2MPS11_LDO_N_VOLTAGES  (S2MPS11_LDO_VSEL_MASK + 1)
 #define S2MPS11_BUCK_N_VOLTAGES (S2MPS11_BUCK_VSEL_MASK + 1)
+#define S2MPS11_RAMP_DELAY      25000           /* uV/us */
 
 #define S2MPS11_PMIC_EN_SHIFT   6
 #define S2MPS11_REGULATOR_MAX (S2MPS11_REG_MAX - 3)
diff --git a/include/linux/mfd/ti_am335x_tscadc.h b/include/linux/mfd/ti_am335x_tscadc.h
index c79ad5d2f271..8d73fe29796a 100644
--- a/include/linux/mfd/ti_am335x_tscadc.h
+++ b/include/linux/mfd/ti_am335x_tscadc.h
@@ -30,8 +30,8 @@
 #define REG_IDLECONFIG          0x058
 #define REG_CHARGECONFIG        0x05C
 #define REG_CHARGEDELAY         0x060
-#define REG_STEPCONFIG(n)       (0x64 + ((n - 1) * 8))
-#define REG_STEPDELAY(n)        (0x68 + ((n - 1) * 8))
+#define REG_STEPCONFIG(n)       (0x64 + ((n) * 8))
+#define REG_STEPDELAY(n)        (0x68 + ((n) * 8))
 #define REG_FIFO0CNT            0xE4
 #define REG_FIFO0THR            0xE8
 #define REG_FIFO1CNT            0xF0
@@ -46,8 +46,6 @@
 /* Step Enable */
 #define STEPENB_MASK            (0x1FFFF << 0)
 #define STEPENB(val)            ((val) << 0)
-#define STPENB_STEPENB          STEPENB(0x1FFFF)
-#define STPENB_STEPENB_TC       STEPENB(0x1FFF)
 
 /* IRQ enable */
 #define IRQENB_HW_PEN           BIT(0)
@@ -73,8 +71,6 @@
 #define STEPCONFIG_INM_ADCREFM  STEPCONFIG_INM(8)
 #define STEPCONFIG_INP_MASK     (0xF << 19)
 #define STEPCONFIG_INP(val)     ((val) << 19)
-#define STEPCONFIG_INP_AN2      STEPCONFIG_INP(2)
-#define STEPCONFIG_INP_AN3      STEPCONFIG_INP(3)
 #define STEPCONFIG_INP_AN4      STEPCONFIG_INP(4)
 #define STEPCONFIG_INP_ADCREFM  STEPCONFIG_INP(8)
 #define STEPCONFIG_FIFO1        BIT(26)
@@ -96,7 +92,6 @@
 #define STEPCHARGE_INM_AN1      STEPCHARGE_INM(1)
 #define STEPCHARGE_INP_MASK     (0xF << 19)
 #define STEPCHARGE_INP(val)     ((val) << 19)
-#define STEPCHARGE_INP_AN1      STEPCHARGE_INP(1)
 #define STEPCHARGE_RFM_MASK     (3 << 23)
 #define STEPCHARGE_RFM(val)     ((val) << 23)
 #define STEPCHARGE_RFM_XNUR     STEPCHARGE_RFM(1)
@@ -125,22 +120,17 @@
 
 #define TSCADC_CELLS            2
 
-enum tscadc_cells {
-        TSC_CELL,
-        ADC_CELL,
-};
-
-struct mfd_tscadc_board {
-        struct tsc_data *tsc_init;
-        struct adc_data *adc_init;
-};
-
 struct ti_tscadc_dev {
         struct device *dev;
         struct regmap *regmap_tscadc;
         void __iomem *tscadc_base;
         int irq;
+        int used_cells; /* 1-2 */
+        int tsc_cell;   /* -1 if not used */
+        int adc_cell;   /* -1 if not used */
         struct mfd_cell cells[TSCADC_CELLS];
+        u32 reg_se_cache;
+        spinlock_t reg_lock;
 
         /* tsc device */
         struct titsc *tsc;
@@ -149,4 +139,15 @@ struct ti_tscadc_dev {
         struct adc_device *adc;
 };
 
+static inline struct ti_tscadc_dev *ti_tscadc_dev_get(struct platform_device *p)
+{
+        struct ti_tscadc_dev **tscadc_dev = p->dev.platform_data;
+
+        return *tscadc_dev;
+}
+
+void am335x_tsc_se_update(struct ti_tscadc_dev *tsadc);
+void am335x_tsc_se_set(struct ti_tscadc_dev *tsadc, u32 val);
+void am335x_tsc_se_clr(struct ti_tscadc_dev *tsadc, u32 val);
+
 #endif
diff --git a/include/linux/mfd/tmio.h b/include/linux/mfd/tmio.h
index 99bf3e665997..ce3511326f80 100644
--- a/include/linux/mfd/tmio.h
+++ b/include/linux/mfd/tmio.h
@@ -81,10 +81,15 @@ int tmio_core_mmc_resume(void __iomem *cnf, int shift, unsigned long base);
 void tmio_core_mmc_pwr(void __iomem *cnf, int shift, int state);
 void tmio_core_mmc_clk_div(void __iomem *cnf, int shift, int state);
 
+struct dma_chan;
+
 struct tmio_mmc_dma {
         void *chan_priv_tx;
         void *chan_priv_rx;
+        int slave_id_tx;
+        int slave_id_rx;
         int alignment_shift;
+        bool (*filter)(struct dma_chan *chan, void *arg);
 };
 
 struct tmio_mmc_host;
diff --git a/include/linux/mfd/wm8994/core.h b/include/linux/mfd/wm8994/core.h
index ae5c249530b4..40854ac0ba3d 100644
--- a/include/linux/mfd/wm8994/core.h
+++ b/include/linux/mfd/wm8994/core.h
@@ -29,6 +29,7 @@ enum wm8994_type {
 
 struct regulator_dev;
 struct regulator_bulk_data;
+struct irq_domain;
 
 #define WM8994_NUM_GPIO_REGS 11
 #define WM8994_NUM_LDO_REGS   2
@@ -73,6 +74,7 @@ struct wm8994 {
 
         int irq;
         struct regmap_irq_chip_data *irq_data;
+        struct irq_domain *edge_irq;
 
         /* Used over suspend/resume */
         bool suspended;
diff --git a/include/linux/mfd/wm8994/pdata.h b/include/linux/mfd/wm8994/pdata.h
index b5046f6313a9..90c60524a496 100644
--- a/include/linux/mfd/wm8994/pdata.h
+++ b/include/linux/mfd/wm8994/pdata.h
@@ -228,6 +228,11 @@ struct wm8994_pdata {
          * lines is mastered.
          */
         int max_channels_clocked[WM8994_NUM_AIF];
+
+        /**
+         * GPIO for the IRQ pin if host only supports edge triggering
+         */
+        int irq_gpio;
 };
 
 #endif
diff --git a/include/linux/mlx4/cmd.h b/include/linux/mlx4/cmd.h
index adf6e0648f20..bb1c8096a7eb 100644
--- a/include/linux/mlx4/cmd.h
+++ b/include/linux/mlx4/cmd.h
@@ -111,6 +111,7 @@ enum {
         MLX4_CMD_INIT2INIT_QP    = 0x2d,
         MLX4_CMD_SUSPEND_QP      = 0x32,
         MLX4_CMD_UNSUSPEND_QP    = 0x33,
+        MLX4_CMD_UPDATE_QP       = 0x61,
         /* special QP and management commands */
         MLX4_CMD_CONF_SPECIAL_QP = 0x23,
         MLX4_CMD_MAD_IFC         = 0x24,
@@ -237,7 +238,7 @@ int mlx4_set_vf_mac(struct mlx4_dev *dev, int port, int vf, u64 mac);
 int mlx4_set_vf_vlan(struct mlx4_dev *dev, int port, int vf, u16 vlan, u8 qos);
 int mlx4_set_vf_spoofchk(struct mlx4_dev *dev, int port, int vf, bool setting);
 int mlx4_get_vf_config(struct mlx4_dev *dev, int port, int vf, struct ifla_vf_info *ivf);
-
+int mlx4_set_vf_link_state(struct mlx4_dev *dev, int port, int vf, int link_state);
 
 #define MLX4_COMM_GET_IF_REV(cmd_chan_ver) (u8)((cmd_chan_ver) >> 8)
 
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index a51b0134ce18..52c23a892bab 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -157,7 +157,8 @@ enum {
         MLX4_DEV_CAP_FLAGS2_REASSIGN_MAC_EN     = 1LL <<  4,
         MLX4_DEV_CAP_FLAG2_TS                   = 1LL <<  5,
         MLX4_DEV_CAP_FLAG2_VLAN_CONTROL         = 1LL <<  6,
-        MLX4_DEV_CAP_FLAG2_FSM                  = 1LL <<  7
+        MLX4_DEV_CAP_FLAG2_FSM                  = 1LL <<  7,
+        MLX4_DEV_CAP_FLAG2_UPDATE_QP            = 1LL <<  8
 };
 
 enum {
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index 352eec9df1b8..262deac02c9e 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -152,6 +152,8 @@ enum { /* fl */
 };
 enum { /* vlan_control */
         MLX4_VLAN_CTRL_ETH_TX_BLOCK_TAGGED      = 1 << 6,
+        MLX4_VLAN_CTRL_ETH_TX_BLOCK_PRIO_TAGGED = 1 << 5, /* 802.1p priority tag */
+        MLX4_VLAN_CTRL_ETH_TX_BLOCK_UNTAGGED    = 1 << 4,
         MLX4_VLAN_CTRL_ETH_RX_BLOCK_TAGGED      = 1 << 2,
         MLX4_VLAN_CTRL_ETH_RX_BLOCK_PRIO_TAGGED = 1 << 1, /* 802.1p priority tag */
         MLX4_VLAN_CTRL_ETH_RX_BLOCK_UNTAGGED    = 1 << 0
@@ -206,6 +208,40 @@ struct mlx4_qp_context {
         u32                     reserved5[10];
 };
 
+struct mlx4_update_qp_context {
+        __be64                  qp_mask;
+        __be64                  primary_addr_path_mask;
+        __be64                  secondary_addr_path_mask;
+        u64                     reserved1;
+        struct mlx4_qp_context  qp_context;
+        u64                     reserved2[58];
+};
+
+enum {
+        MLX4_UPD_QP_MASK_PM_STATE       = 32,
+        MLX4_UPD_QP_MASK_VSD            = 33,
+};
+
+enum {
+        MLX4_UPD_QP_PATH_MASK_PKEY_INDEX                = 0 + 32,
+        MLX4_UPD_QP_PATH_MASK_FSM                       = 1 + 32,
+        MLX4_UPD_QP_PATH_MASK_MAC_INDEX                 = 2 + 32,
+        MLX4_UPD_QP_PATH_MASK_FVL                       = 3 + 32,
+        MLX4_UPD_QP_PATH_MASK_CV                        = 4 + 32,
+        MLX4_UPD_QP_PATH_MASK_VLAN_INDEX                = 5 + 32,
+        MLX4_UPD_QP_PATH_MASK_ETH_HIDE_CQE_VLAN         = 6 + 32,
+        MLX4_UPD_QP_PATH_MASK_ETH_TX_BLOCK_UNTAGGED     = 7 + 32,
+        MLX4_UPD_QP_PATH_MASK_ETH_TX_BLOCK_1P           = 8 + 32,
+        MLX4_UPD_QP_PATH_MASK_ETH_TX_BLOCK_TAGGED       = 9 + 32,
+        MLX4_UPD_QP_PATH_MASK_ETH_RX_BLOCK_UNTAGGED     = 10 + 32,
+        MLX4_UPD_QP_PATH_MASK_ETH_RX_BLOCK_1P           = 11 + 32,
+        MLX4_UPD_QP_PATH_MASK_ETH_RX_BLOCK_TAGGED       = 12 + 32,
+        MLX4_UPD_QP_PATH_MASK_FEUP                      = 13 + 32,
+        MLX4_UPD_QP_PATH_MASK_SCHED_QUEUE               = 14 + 32,
+        MLX4_UPD_QP_PATH_MASK_IF_COUNTER_INDEX          = 15 + 32,
+        MLX4_UPD_QP_PATH_MASK_FVL_RX                    = 16 + 32,
+};
+
 enum { /* param3 */
         MLX4_STRIP_VLAN = 1 << 30
 };
diff --git a/include/linux/mlx5/cmd.h b/include/linux/mlx5/cmd.h
new file mode 100644
index 000000000000..2826a4b6071e
--- /dev/null
+++ b/include/linux/mlx5/cmd.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2013, Mellanox Technologies inc.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef MLX5_CMD_H
+#define MLX5_CMD_H
+
+#include <linux/types.h>
+
+struct manage_pages_layout {
+        u64     ptr;
+        u32     reserved;
+        u16     num_entries;
+        u16     func_id;
+};
+
+
+struct mlx5_cmd_alloc_uar_imm_out {
+        u32     rsvd[3];
+        u32     uarn;
+};
+
+#endif /* MLX5_CMD_H */
diff --git a/include/linux/mlx5/cq.h b/include/linux/mlx5/cq.h
new file mode 100644
index 000000000000..3db67f73d96d
--- /dev/null
+++ b/include/linux/mlx5/cq.h
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2013, Mellanox Technologies inc.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef MLX5_CORE_CQ_H
+#define MLX5_CORE_CQ_H
+
+#include <rdma/ib_verbs.h>
+#include <linux/mlx5/driver.h>
+
+
+struct mlx5_core_cq {
+        u32                     cqn;
+        int                     cqe_sz;
+        __be32                 *set_ci_db;
+        __be32                 *arm_db;
+        atomic_t                refcount;
+        struct completion       free;
+        unsigned                vector;
+        int                     irqn;
+        void (*comp)            (struct mlx5_core_cq *);
+        void (*event)           (struct mlx5_core_cq *, enum mlx5_event);
+        struct mlx5_uar        *uar;
+        u32                     cons_index;
+        unsigned                arm_sn;
+        struct mlx5_rsc_debug   *dbg;
+        int                     pid;
+};
+
+
+enum {
+        MLX5_CQE_SYNDROME_LOCAL_LENGTH_ERR              = 0x01,
+        MLX5_CQE_SYNDROME_LOCAL_QP_OP_ERR               = 0x02,
+        MLX5_CQE_SYNDROME_LOCAL_PROT_ERR                = 0x04,
+        MLX5_CQE_SYNDROME_WR_FLUSH_ERR                  = 0x05,
+        MLX5_CQE_SYNDROME_MW_BIND_ERR                   = 0x06,
+        MLX5_CQE_SYNDROME_BAD_RESP_ERR                  = 0x10,
+        MLX5_CQE_SYNDROME_LOCAL_ACCESS_ERR              = 0x11,
+        MLX5_CQE_SYNDROME_REMOTE_INVAL_REQ_ERR          = 0x12,
+        MLX5_CQE_SYNDROME_REMOTE_ACCESS_ERR             = 0x13,
+        MLX5_CQE_SYNDROME_REMOTE_OP_ERR                 = 0x14,
+        MLX5_CQE_SYNDROME_TRANSPORT_RETRY_EXC_ERR       = 0x15,
+        MLX5_CQE_SYNDROME_RNR_RETRY_EXC_ERR             = 0x16,
+        MLX5_CQE_SYNDROME_REMOTE_ABORTED_ERR            = 0x22,
+};
+
+enum {
+        MLX5_CQE_OWNER_MASK     = 1,
+        MLX5_CQE_REQ            = 0,
+        MLX5_CQE_RESP_WR_IMM    = 1,
+        MLX5_CQE_RESP_SEND      = 2,
+        MLX5_CQE_RESP_SEND_IMM  = 3,
+        MLX5_CQE_RESP_SEND_INV  = 4,
+        MLX5_CQE_RESIZE_CQ      = 0xff, /* TBD */
+        MLX5_CQE_REQ_ERR        = 13,
+        MLX5_CQE_RESP_ERR       = 14,
+};
+
+enum {
+        MLX5_CQ_MODIFY_RESEIZE = 0,
+        MLX5_CQ_MODIFY_MODER = 1,
+        MLX5_CQ_MODIFY_MAPPING = 2,
+};
+
+struct mlx5_cq_modify_params {
+        int     type;
+        union {
+                struct {
+                        u32     page_offset;
+                        u8      log_cq_size;
+                } resize;
+
+                struct {
+                } moder;
+
+                struct {
+                } mapping;
+        } params;
+};
+
+enum {
+        CQE_SIZE_64 = 0,
+        CQE_SIZE_128 = 1,
+};
+
+static inline int cqe_sz_to_mlx_sz(u8 size)
+{
+        return size == 64 ? CQE_SIZE_64 : CQE_SIZE_128;
+}
+
+static inline void mlx5_cq_set_ci(struct mlx5_core_cq *cq)
+{
+        *cq->set_ci_db = cpu_to_be32(cq->cons_index & 0xffffff);
+}
+
+enum {
+        MLX5_CQ_DB_REQ_NOT_SOL          = 1 << 24,
+        MLX5_CQ_DB_REQ_NOT              = 0 << 24
+};
+
+static inline void mlx5_cq_arm(struct mlx5_core_cq *cq, u32 cmd,
+                               void __iomem *uar_page,
+                               spinlock_t *doorbell_lock)
+{
+        __be32 doorbell[2];
+        u32 sn;
+        u32 ci;
+
+        sn = cq->arm_sn & 3;
+        ci = cq->cons_index & 0xffffff;
+
+        *cq->arm_db = cpu_to_be32(sn << 28 | cmd | ci);
+
+        /* Make sure that the doorbell record in host memory is
+         * written before ringing the doorbell via PCI MMIO.
+         */
+        wmb();
+
+        doorbell[0] = cpu_to_be32(sn << 28 | cmd | ci);
+        doorbell[1] = cpu_to_be32(cq->cqn);
+
+        mlx5_write64(doorbell, uar_page + MLX5_CQ_DOORBELL, doorbell_lock);
+}
+
+int mlx5_init_cq_table(struct mlx5_core_dev *dev);
+void mlx5_cleanup_cq_table(struct mlx5_core_dev *dev);
+int mlx5_core_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq,
+                        struct mlx5_create_cq_mbox_in *in, int inlen);
+int mlx5_core_destroy_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq);
+int mlx5_core_query_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq,
+                       struct mlx5_query_cq_mbox_out *out);
+int mlx5_core_modify_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq,
+                        int type, struct mlx5_cq_modify_params *params);
+int mlx5_debug_cq_add(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq);
+void mlx5_debug_cq_remove(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq);
+
+#endif /* MLX5_CORE_CQ_H */
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
new file mode 100644
index 000000000000..8de8d8f22384
--- /dev/null
+++ b/include/linux/mlx5/device.h
@@ -0,0 +1,893 @@
+/*
+ * Copyright (c) 2013, Mellanox Technologies inc.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef MLX5_DEVICE_H
+#define MLX5_DEVICE_H
+
+#include <linux/types.h>
+#include <rdma/ib_verbs.h>
+
+#if defined(__LITTLE_ENDIAN)
+#define MLX5_SET_HOST_ENDIANNESS        0
+#elif defined(__BIG_ENDIAN)
+#define MLX5_SET_HOST_ENDIANNESS        0x80
+#else
+#error Host endianness not defined
+#endif
+
+enum {
+        MLX5_MAX_COMMANDS               = 32,
+        MLX5_CMD_DATA_BLOCK_SIZE        = 512,
+        MLX5_PCI_CMD_XPORT              = 7,
+};
+
+enum {
+        MLX5_EXTENDED_UD_AV             = 0x80000000,
+};
+
+enum {
+        MLX5_CQ_STATE_ARMED             = 9,
+        MLX5_CQ_STATE_ALWAYS_ARMED      = 0xb,
+        MLX5_CQ_STATE_FIRED             = 0xa,
+};
+
+enum {
+        MLX5_STAT_RATE_OFFSET   = 5,
+};
+
+enum {
+        MLX5_INLINE_SEG = 0x80000000,
+};
+
+enum {
+        MLX5_PERM_LOCAL_READ    = 1 << 2,
+        MLX5_PERM_LOCAL_WRITE   = 1 << 3,
+        MLX5_PERM_REMOTE_READ   = 1 << 4,
+        MLX5_PERM_REMOTE_WRITE  = 1 << 5,
+        MLX5_PERM_ATOMIC        = 1 << 6,
+        MLX5_PERM_UMR_EN        = 1 << 7,
+};
+
+enum {
+        MLX5_PCIE_CTRL_SMALL_FENCE      = 1 << 0,
+        MLX5_PCIE_CTRL_RELAXED_ORDERING = 1 << 2,
+        MLX5_PCIE_CTRL_NO_SNOOP         = 1 << 3,
+        MLX5_PCIE_CTRL_TLP_PROCE_EN     = 1 << 6,
+        MLX5_PCIE_CTRL_TPH_MASK         = 3 << 4,
+};
+
+enum {
+        MLX5_ACCESS_MODE_PA     = 0,
+        MLX5_ACCESS_MODE_MTT    = 1,
+        MLX5_ACCESS_MODE_KLM    = 2
+};
+
+enum {
+        MLX5_MKEY_REMOTE_INVAL  = 1 << 24,
+        MLX5_MKEY_FLAG_SYNC_UMR = 1 << 29,
+        MLX5_MKEY_BSF_EN        = 1 << 30,
+        MLX5_MKEY_LEN64         = 1 << 31,
+};
+
+enum {
+        MLX5_EN_RD      = (u64)1,
+        MLX5_EN_WR      = (u64)2
+};
+
+enum {
+        MLX5_BF_REGS_PER_PAGE   = 4,
+        MLX5_MAX_UAR_PAGES      = 1 << 8,
+        MLX5_MAX_UUARS          = MLX5_MAX_UAR_PAGES * MLX5_BF_REGS_PER_PAGE,
+};
+
+enum {
+        MLX5_MKEY_MASK_LEN              = 1ull << 0,
+        MLX5_MKEY_MASK_PAGE_SIZE        = 1ull << 1,
+        MLX5_MKEY_MASK_START_ADDR       = 1ull << 6,
+        MLX5_MKEY_MASK_PD               = 1ull << 7,
+        MLX5_MKEY_MASK_EN_RINVAL        = 1ull << 8,
+        MLX5_MKEY_MASK_BSF_EN           = 1ull << 12,
+        MLX5_MKEY_MASK_KEY              = 1ull << 13,
+        MLX5_MKEY_MASK_QPN              = 1ull << 14,
+        MLX5_MKEY_MASK_LR               = 1ull << 17,
+        MLX5_MKEY_MASK_LW               = 1ull << 18,
+        MLX5_MKEY_MASK_RR               = 1ull << 19,
+        MLX5_MKEY_MASK_RW               = 1ull << 20,
+        MLX5_MKEY_MASK_A                = 1ull << 21,
+        MLX5_MKEY_MASK_SMALL_FENCE      = 1ull << 23,
+        MLX5_MKEY_MASK_FREE             = 1ull << 29,
+};
+
+enum mlx5_event {
+        MLX5_EVENT_TYPE_COMP               = 0x0,
+
+        MLX5_EVENT_TYPE_PATH_MIG           = 0x01,
+        MLX5_EVENT_TYPE_COMM_EST           = 0x02,
+        MLX5_EVENT_TYPE_SQ_DRAINED         = 0x03,
+        MLX5_EVENT_TYPE_SRQ_LAST_WQE       = 0x13,
+        MLX5_EVENT_TYPE_SRQ_RQ_LIMIT       = 0x14,
+
+        MLX5_EVENT_TYPE_CQ_ERROR           = 0x04,
+        MLX5_EVENT_TYPE_WQ_CATAS_ERROR     = 0x05,
+        MLX5_EVENT_TYPE_PATH_MIG_FAILED    = 0x07,
+        MLX5_EVENT_TYPE_WQ_INVAL_REQ_ERROR = 0x10,
+        MLX5_EVENT_TYPE_WQ_ACCESS_ERROR    = 0x11,
+        MLX5_EVENT_TYPE_SRQ_CATAS_ERROR    = 0x12,
+
+        MLX5_EVENT_TYPE_INTERNAL_ERROR     = 0x08,
+        MLX5_EVENT_TYPE_PORT_CHANGE        = 0x09,
+        MLX5_EVENT_TYPE_GPIO_EVENT         = 0x15,
+        MLX5_EVENT_TYPE_REMOTE_CONFIG      = 0x19,
+
+        MLX5_EVENT_TYPE_DB_BF_CONGESTION   = 0x1a,
+        MLX5_EVENT_TYPE_STALL_EVENT        = 0x1b,
+
+        MLX5_EVENT_TYPE_CMD                = 0x0a,
+        MLX5_EVENT_TYPE_PAGE_REQUEST       = 0xb,
+};
+
+enum {
+        MLX5_PORT_CHANGE_SUBTYPE_DOWN           = 1,
+        MLX5_PORT_CHANGE_SUBTYPE_ACTIVE         = 4,
+        MLX5_PORT_CHANGE_SUBTYPE_INITIALIZED    = 5,
+        MLX5_PORT_CHANGE_SUBTYPE_LID            = 6,
+        MLX5_PORT_CHANGE_SUBTYPE_PKEY           = 7,
+        MLX5_PORT_CHANGE_SUBTYPE_GUID           = 8,
+        MLX5_PORT_CHANGE_SUBTYPE_CLIENT_REREG   = 9,
+};
+
+enum {
+        MLX5_DEV_CAP_FLAG_RC            = 1LL <<  0,
+        MLX5_DEV_CAP_FLAG_UC            = 1LL <<  1,
+        MLX5_DEV_CAP_FLAG_UD            = 1LL <<  2,
+        MLX5_DEV_CAP_FLAG_XRC           = 1LL <<  3,
+        MLX5_DEV_CAP_FLAG_SRQ           = 1LL <<  6,
+        MLX5_DEV_CAP_FLAG_BAD_PKEY_CNTR = 1LL <<  8,
+        MLX5_DEV_CAP_FLAG_BAD_QKEY_CNTR = 1LL <<  9,
+        MLX5_DEV_CAP_FLAG_APM           = 1LL << 17,
+        MLX5_DEV_CAP_FLAG_ATOMIC        = 1LL << 18,
+        MLX5_DEV_CAP_FLAG_ON_DMND_PG    = 1LL << 24,
+        MLX5_DEV_CAP_FLAG_RESIZE_SRQ    = 1LL << 32,
+        MLX5_DEV_CAP_FLAG_REMOTE_FENCE  = 1LL << 38,
+        MLX5_DEV_CAP_FLAG_TLP_HINTS     = 1LL << 39,
+        MLX5_DEV_CAP_FLAG_SIG_HAND_OVER = 1LL << 40,
+        MLX5_DEV_CAP_FLAG_DCT           = 1LL << 41,
+        MLX5_DEV_CAP_FLAG_CMDIF_CSUM    = 1LL << 46,
+};
+
+enum {
+        MLX5_OPCODE_NOP                 = 0x00,
+        MLX5_OPCODE_SEND_INVAL          = 0x01,
+        MLX5_OPCODE_RDMA_WRITE          = 0x08,
+        MLX5_OPCODE_RDMA_WRITE_IMM      = 0x09,
+        MLX5_OPCODE_SEND                = 0x0a,
+        MLX5_OPCODE_SEND_IMM            = 0x0b,
+        MLX5_OPCODE_RDMA_READ           = 0x10,
+        MLX5_OPCODE_ATOMIC_CS           = 0x11,
+        MLX5_OPCODE_ATOMIC_FA           = 0x12,
+        MLX5_OPCODE_ATOMIC_MASKED_CS    = 0x14,
+        MLX5_OPCODE_ATOMIC_MASKED_FA    = 0x15,
+        MLX5_OPCODE_BIND_MW             = 0x18,
+        MLX5_OPCODE_CONFIG_CMD          = 0x1f,
+
+        MLX5_RECV_OPCODE_RDMA_WRITE_IMM = 0x00,
+        MLX5_RECV_OPCODE_SEND           = 0x01,
+        MLX5_RECV_OPCODE_SEND_IMM       = 0x02,
+        MLX5_RECV_OPCODE_SEND_INVAL     = 0x03,
+
+        MLX5_CQE_OPCODE_ERROR           = 0x1e,
+        MLX5_CQE_OPCODE_RESIZE          = 0x16,
+
+        MLX5_OPCODE_SET_PSV             = 0x20,
+        MLX5_OPCODE_GET_PSV             = 0x21,
+        MLX5_OPCODE_CHECK_PSV           = 0x22,
+        MLX5_OPCODE_RGET_PSV            = 0x26,
+        MLX5_OPCODE_RCHECK_PSV          = 0x27,
+
+        MLX5_OPCODE_UMR                 = 0x25,
+
+};
+
+enum {
+        MLX5_SET_PORT_RESET_QKEY        = 0,
+        MLX5_SET_PORT_GUID0             = 16,
+        MLX5_SET_PORT_NODE_GUID         = 17,
+        MLX5_SET_PORT_SYS_GUID          = 18,
+        MLX5_SET_PORT_GID_TABLE         = 19,
+        MLX5_SET_PORT_PKEY_TABLE        = 20,
+};
+
+enum {
+        MLX5_MAX_PAGE_SHIFT             = 31
+};
+
+struct mlx5_inbox_hdr {
+        __be16          opcode;
+        u8              rsvd[4];
+        __be16          opmod;
+};
+
+struct mlx5_outbox_hdr {
+        u8              status;
+        u8              rsvd[3];
+        __be32          syndrome;
+};
+
+struct mlx5_cmd_query_adapter_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_cmd_query_adapter_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd0[24];
+        u8                      intapin;
+        u8                      rsvd1[13];
+        __be16                  vsd_vendor_id;
+        u8                      vsd[208];
+        u8                      vsd_psid[16];
+};
+
+struct mlx5_hca_cap {
+        u8      rsvd1[16];
+        u8      log_max_srq_sz;
+        u8      log_max_qp_sz;
+        u8      rsvd2;
+        u8      log_max_qp;
+        u8      log_max_strq_sz;
+        u8      log_max_srqs;
+        u8      rsvd4[2];
+        u8      rsvd5;
+        u8      log_max_cq_sz;
+        u8      rsvd6;
+        u8      log_max_cq;
+        u8      log_max_eq_sz;
+        u8      log_max_mkey;
+        u8      rsvd7;
+        u8      log_max_eq;
+        u8      max_indirection;
+        u8      log_max_mrw_sz;
+        u8      log_max_bsf_list_sz;
+        u8      log_max_klm_list_sz;
+        u8      rsvd_8_0;
+        u8      log_max_ra_req_dc;
+        u8      rsvd_8_1;
+        u8      log_max_ra_res_dc;
+        u8      rsvd9;
+        u8      log_max_ra_req_qp;
+        u8      rsvd10;
+        u8      log_max_ra_res_qp;
+        u8      rsvd11[4];
+        __be16  max_qp_count;
+        __be16  rsvd12;
+        u8      rsvd13;
+        u8      local_ca_ack_delay;
+        u8      rsvd14;
+        u8      num_ports;
+        u8      log_max_msg;
+        u8      rsvd15[3];
+        __be16  stat_rate_support;
+        u8      rsvd16[2];
+        __be64  flags;
+        u8      rsvd17;
+        u8      uar_sz;
+        u8      rsvd18;
+        u8      log_pg_sz;
+        __be16  bf_log_bf_reg_size;
+        u8      rsvd19[4];
+        __be16  max_desc_sz_sq;
+        u8      rsvd20[2];
+        __be16  max_desc_sz_rq;
+        u8      rsvd21[2];
+        __be16  max_desc_sz_sq_dc;
+        u8      rsvd22[4];
+        __be16  max_qp_mcg;
+        u8      rsvd23;
+        u8      log_max_mcg;
+        u8      rsvd24;
+        u8      log_max_pd;
+        u8      rsvd25;
+        u8      log_max_xrcd;
+        u8      rsvd26[42];
+        __be16  log_uar_page_sz;
+        u8      rsvd27[28];
+        u8      log_msx_atomic_size_qp;
+        u8      rsvd28[2];
+        u8      log_msx_atomic_size_dc;
+        u8      rsvd29[76];
+};
+
+
+struct mlx5_cmd_query_hca_cap_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd[8];
+};
+
+
+struct mlx5_cmd_query_hca_cap_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd0[8];
+        struct mlx5_hca_cap     hca_cap;
+};
+
+
+struct mlx5_cmd_set_hca_cap_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd[8];
+        struct mlx5_hca_cap     hca_cap;
+};
+
+
+struct mlx5_cmd_set_hca_cap_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd0[8];
+};
+
+
+struct mlx5_cmd_init_hca_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd0[2];
+        __be16                  profile;
+        u8                      rsvd1[4];
+};
+
+struct mlx5_cmd_init_hca_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_cmd_teardown_hca_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd0[2];
+        __be16                  profile;
+        u8                      rsvd1[4];
+};
+
+struct mlx5_cmd_teardown_hca_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_cmd_layout {
+        u8              type;
+        u8              rsvd0[3];
+        __be32          inlen;
+        __be64          in_ptr;
+        __be32          in[4];
+        __be32          out[4];
+        __be64          out_ptr;
+        __be32          outlen;
+        u8              token;
+        u8              sig;
+        u8              rsvd1;
+        u8              status_own;
+};
+
+
+struct health_buffer {
+        __be32          assert_var[5];
+        __be32          rsvd0[3];
+        __be32          assert_exit_ptr;
+        __be32          assert_callra;
+        __be32          rsvd1[2];
+        __be32          fw_ver;
+        __be32          hw_id;
+        __be32          rsvd2;
+        u8              irisc_index;
+        u8              synd;
+        __be16          ext_sync;
+};
+
+struct mlx5_init_seg {
+        __be32                  fw_rev;
+        __be32                  cmdif_rev_fw_sub;
+        __be32                  rsvd0[2];
+        __be32                  cmdq_addr_h;
+        __be32                  cmdq_addr_l_sz;
+        __be32                  cmd_dbell;
+        __be32                  rsvd1[121];
+        struct health_buffer    health;
+        __be32                  rsvd2[884];
+        __be32                  health_counter;
+        __be32                  rsvd3[1023];
+        __be64                  ieee1588_clk;
+        __be32                  ieee1588_clk_type;
+        __be32                  clr_intx;
+};
+
+struct mlx5_eqe_comp {
+        __be32  reserved[6];
+        __be32  cqn;
+};
+
+struct mlx5_eqe_qp_srq {
+        __be32  reserved[6];
+        __be32  qp_srq_n;
+};
+
+struct mlx5_eqe_cq_err {
+        __be32  cqn;
+        u8      reserved1[7];
+        u8      syndrome;
+};
+
+struct mlx5_eqe_dropped_packet {
+};
+
+struct mlx5_eqe_port_state {
+        u8      reserved0[8];
+        u8      port;
+};
+
+struct mlx5_eqe_gpio {
+        __be32  reserved0[2];
+        __be64  gpio_event;
+};
+
+struct mlx5_eqe_congestion {
+        u8      type;
+        u8      rsvd0;
+        u8      congestion_level;
+};
+
+struct mlx5_eqe_stall_vl {
+        u8      rsvd0[3];
+        u8      port_vl;
+};
+
+struct mlx5_eqe_cmd {
+        __be32  vector;
+        __be32  rsvd[6];
+};
+
+struct mlx5_eqe_page_req {
+        u8              rsvd0[2];
+        __be16          func_id;
+        u8              rsvd1[2];
+        __be16          num_pages;
+        __be32          rsvd2[5];
+};
+
+union ev_data {
+        __be32                          raw[7];
+        struct mlx5_eqe_cmd             cmd;
+        struct mlx5_eqe_comp            comp;
+        struct mlx5_eqe_qp_srq          qp_srq;
+        struct mlx5_eqe_cq_err          cq_err;
+        struct mlx5_eqe_dropped_packet  dp;
+        struct mlx5_eqe_port_state      port;
+        struct mlx5_eqe_gpio            gpio;
+        struct mlx5_eqe_congestion      cong;
+        struct mlx5_eqe_stall_vl        stall_vl;
+        struct mlx5_eqe_page_req        req_pages;
+} __packed;
+
+struct mlx5_eqe {
+        u8              rsvd0;
+        u8              type;
+        u8              rsvd1;
+        u8              sub_type;
+        __be32          rsvd2[7];
+        union ev_data   data;
+        __be16          rsvd3;
+        u8              signature;
+        u8              owner;
+} __packed;
+
+struct mlx5_cmd_prot_block {
+        u8              data[MLX5_CMD_DATA_BLOCK_SIZE];
+        u8              rsvd0[48];
+        __be64          next;
+        __be32          block_num;
+        u8              rsvd1;
+        u8              token;
+        u8              ctrl_sig;
+        u8              sig;
+};
+
+struct mlx5_err_cqe {
+        u8      rsvd0[32];
+        __be32  srqn;
+        u8      rsvd1[18];
+        u8      vendor_err_synd;
+        u8      syndrome;
+        __be32  s_wqe_opcode_qpn;
+        __be16  wqe_counter;
+        u8      signature;
+        u8      op_own;
+};
+
+struct mlx5_cqe64 {
+        u8              rsvd0[17];
+        u8              ml_path;
+        u8              rsvd20[4];
+        __be16          slid;
+        __be32          flags_rqpn;
+        u8              rsvd28[4];
+        __be32          srqn;
+        __be32          imm_inval_pkey;
+        u8              rsvd40[4];
+        __be32          byte_cnt;
+        __be64          timestamp;
+        __be32          sop_drop_qpn;
+        __be16          wqe_counter;
+        u8              signature;
+        u8              op_own;
+};
+
+struct mlx5_wqe_srq_next_seg {
+        u8                      rsvd0[2];
+        __be16                  next_wqe_index;
+        u8                      signature;
+        u8                      rsvd1[11];
+};
+
+union mlx5_ext_cqe {
+        struct ib_grh   grh;
+        u8              inl[64];
+};
+
+struct mlx5_cqe128 {
+        union mlx5_ext_cqe      inl_grh;
+        struct mlx5_cqe64       cqe64;
+};
+
+struct mlx5_srq_ctx {
+        u8                      state_log_sz;
+        u8                      rsvd0[3];
+        __be32                  flags_xrcd;
+        __be32                  pgoff_cqn;
+        u8                      rsvd1[4];
+        u8                      log_pg_sz;
+        u8                      rsvd2[7];
+        __be32                  pd;
+        __be16                  lwm;
+        __be16                  wqe_cnt;
+        u8                      rsvd3[8];
+        __be64                  db_record;
+};
+
+struct mlx5_create_srq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  input_srqn;
+        u8                      rsvd0[4];
+        struct mlx5_srq_ctx     ctx;
+        u8                      rsvd1[208];
+        __be64                  pas[0];
+};
+
+struct mlx5_create_srq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        __be32                  srqn;
+        u8                      rsvd[4];
+};
+
+struct mlx5_destroy_srq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  srqn;
+        u8                      rsvd[4];
+};
+
+struct mlx5_destroy_srq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_query_srq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  srqn;
+        u8                      rsvd0[4];
+};
+
+struct mlx5_query_srq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd0[8];
+        struct mlx5_srq_ctx     ctx;
+        u8                      rsvd1[32];
+        __be64                  pas[0];
+};
+
+struct mlx5_arm_srq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  srqn;
+        __be16                  rsvd;
+        __be16                  lwm;
+};
+
+struct mlx5_arm_srq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_cq_context {
+        u8                      status;
+        u8                      cqe_sz_flags;
+        u8                      st;
+        u8                      rsvd3;
+        u8                      rsvd4[6];
+        __be16                  page_offset;
+        __be32                  log_sz_usr_page;
+        __be16                  cq_period;
+        __be16                  cq_max_count;
+        __be16                  rsvd20;
+        __be16                  c_eqn;
+        u8                      log_pg_sz;
+        u8                      rsvd25[7];
+        __be32                  last_notified_index;
+        __be32                  solicit_producer_index;
+        __be32                  consumer_counter;
+        __be32                  producer_counter;
+        u8                      rsvd48[8];
+        __be64                  db_record_addr;
+};
+
+struct mlx5_create_cq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  input_cqn;
+        u8                      rsvdx[4];
+        struct mlx5_cq_context  ctx;
+        u8                      rsvd6[192];
+        __be64                  pas[0];
+};
+
+struct mlx5_create_cq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        __be32                  cqn;
+        u8                      rsvd0[4];
+};
+
+struct mlx5_destroy_cq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  cqn;
+        u8                      rsvd0[4];
+};
+
+struct mlx5_destroy_cq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd0[8];
+};
+
+struct mlx5_query_cq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  cqn;
+        u8                      rsvd0[4];
+};
+
+struct mlx5_query_cq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd0[8];
+        struct mlx5_cq_context  ctx;
+        u8                      rsvd6[16];
+        __be64                  pas[0];
+};
+
+struct mlx5_eq_context {
+        u8                      status;
+        u8                      ec_oi;
+        u8                      st;
+        u8                      rsvd2[7];
+        __be16                  page_pffset;
+        __be32                  log_sz_usr_page;
+        u8                      rsvd3[7];
+        u8                      intr;
+        u8                      log_page_size;
+        u8                      rsvd4[15];
+        __be32                  consumer_counter;
+        __be32                  produser_counter;
+        u8                      rsvd5[16];
+};
+
+struct mlx5_create_eq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd0[3];
+        u8                      input_eqn;
+        u8                      rsvd1[4];
+        struct mlx5_eq_context  ctx;
+        u8                      rsvd2[8];
+        __be64                  events_mask;
+        u8                      rsvd3[176];
+        __be64                  pas[0];
+};
+
+struct mlx5_create_eq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd0[3];
+        u8                      eq_number;
+        u8                      rsvd1[4];
+};
+
+struct mlx5_destroy_eq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd0[3];
+        u8                      eqn;
+        u8                      rsvd1[4];
+};
+
+struct mlx5_destroy_eq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_map_eq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be64                  mask;
+        u8                      mu;
+        u8                      rsvd0[2];
+        u8                      eqn;
+        u8                      rsvd1[24];
+};
+
+struct mlx5_map_eq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_query_eq_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd0[3];
+        u8                      eqn;
+        u8                      rsvd1[4];
+};
+
+struct mlx5_query_eq_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+        struct mlx5_eq_context  ctx;
+};
+
+struct mlx5_mkey_seg {
+        /* This is a two bit field occupying bits 31-30.
+         * bit 31 is always 0,
+         * bit 30 is zero for regular MRs and 1 (e.g free) for UMRs that do not have tanslation
+         */
+        u8              status;
+        u8              pcie_control;
+        u8              flags;
+        u8              version;
+        __be32          qpn_mkey7_0;
+        u8              rsvd1[4];
+        __be32          flags_pd;
+        __be64          start_addr;
+        __be64          len;
+        __be32          bsfs_octo_size;
+        u8              rsvd2[16];
+        __be32          xlt_oct_size;
+        u8              rsvd3[3];
+        u8              log2_page_size;
+        u8              rsvd4[4];
+};
+
+struct mlx5_query_special_ctxs_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_query_special_ctxs_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        __be32                  dump_fill_mkey;
+        __be32                  reserved_lkey;
+};
+
+struct mlx5_create_mkey_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  input_mkey_index;
+        u8                      rsvd0[4];
+        struct mlx5_mkey_seg    seg;
+        u8                      rsvd1[16];
+        __be32                  xlat_oct_act_size;
+        __be32                  bsf_coto_act_size;
+        u8                      rsvd2[168];
+        __be64                  pas[0];
+};
+
+struct mlx5_create_mkey_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        __be32                  mkey;
+        u8                      rsvd[4];
+};
+
+struct mlx5_destroy_mkey_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  mkey;
+        u8                      rsvd[4];
+};
+
+struct mlx5_destroy_mkey_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_query_mkey_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  mkey;
+};
+
+struct mlx5_query_mkey_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        __be64                  pas[0];
+};
+
+struct mlx5_modify_mkey_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  mkey;
+        __be64                  pas[0];
+};
+
+struct mlx5_modify_mkey_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+};
+
+struct mlx5_dump_mkey_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+};
+
+struct mlx5_dump_mkey_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        __be32                  mkey;
+};
+
+struct mlx5_mad_ifc_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be16                  remote_lid;
+        u8                      rsvd0;
+        u8                      port;
+        u8                      rsvd1[4];
+        u8                      data[256];
+};
+
+struct mlx5_mad_ifc_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+        u8                      data[256];
+};
+
+struct mlx5_access_reg_mbox_in {
+        struct mlx5_inbox_hdr           hdr;
+        u8                              rsvd0[2];
+        __be16                          register_id;
+        __be32                          arg;
+        __be32                          data[0];
+};
+
+struct mlx5_access_reg_mbox_out {
+        struct mlx5_outbox_hdr          hdr;
+        u8                              rsvd[8];
+        __be32                          data[0];
+};
+
+#define MLX5_ATTR_EXTENDED_PORT_INFO    cpu_to_be16(0xff90)
+
+enum {
+        MLX_EXT_PORT_CAP_FLAG_EXTENDED_PORT_INFO        = 1 <<  0
+};
+
+#endif /* MLX5_DEVICE_H */
diff --git a/include/linux/mlx5/doorbell.h b/include/linux/mlx5/doorbell.h
new file mode 100644
index 000000000000..163a818411e7
--- /dev/null
+++ b/include/linux/mlx5/doorbell.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2013, Mellanox Technologies inc.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef MLX5_DOORBELL_H
+#define MLX5_DOORBELL_H
+
+#define MLX5_BF_OFFSET        0x800
+#define MLX5_CQ_DOORBELL      0x20
+
+#if BITS_PER_LONG == 64
+/* Assume that we can just write a 64-bit doorbell atomically.  s390
+ * actually doesn't have writeq() but S/390 systems don't even have
+ * PCI so we won't worry about it.
+ */
+
+#define MLX5_DECLARE_DOORBELL_LOCK(name)
+#define MLX5_INIT_DOORBELL_LOCK(ptr)    do { } while (0)
+#define MLX5_GET_DOORBELL_LOCK(ptr)      (NULL)
+
+static inline void mlx5_write64(__be32 val[2], void __iomem *dest,
+                                spinlock_t *doorbell_lock)
+{
+        __raw_writeq(*(u64 *)val, dest);
+}
+
+#else
+
+/* Just fall back to a spinlock to protect the doorbell if
+ * BITS_PER_LONG is 32 -- there's no portable way to do atomic 64-bit
+ * MMIO writes.
+ */
+
+#define MLX5_DECLARE_DOORBELL_LOCK(name) spinlock_t name;
+#define MLX5_INIT_DOORBELL_LOCK(ptr)     spin_lock_init(ptr)
+#define MLX5_GET_DOORBELL_LOCK(ptr)      (ptr)
+
+static inline void mlx5_write64(__be32 val[2], void __iomem *dest,
+                                spinlock_t *doorbell_lock)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(doorbell_lock, flags);
+        __raw_writel((__force u32) val[0], dest);
+        __raw_writel((__force u32) val[1], dest + 4);
+        spin_unlock_irqrestore(doorbell_lock, flags);
+}
+
+#endif
+
+#endif /* MLX5_DOORBELL_H */
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
new file mode 100644
index 000000000000..f22e4419839b
--- /dev/null
+++ b/include/linux/mlx5/driver.h
@@ -0,0 +1,769 @@
+/*
+ * Copyright (c) 2013, Mellanox Technologies inc.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef MLX5_DRIVER_H
+#define MLX5_DRIVER_H
+
+#include <linux/kernel.h>
+#include <linux/completion.h>
+#include <linux/pci.h>
+#include <linux/spinlock_types.h>
+#include <linux/semaphore.h>
+#include <linux/vmalloc.h>
+#include <linux/radix-tree.h>
+#include <linux/mlx5/device.h>
+#include <linux/mlx5/doorbell.h>
+
+enum {
+        MLX5_BOARD_ID_LEN = 64,
+        MLX5_MAX_NAME_LEN = 16,
+};
+
+enum {
+        /* one minute for the sake of bringup. Generally, commands must always
+         * complete and we may need to increase this timeout value
+         */
+        MLX5_CMD_TIMEOUT_MSEC   = 7200 * 1000,
+        MLX5_CMD_WQ_MAX_NAME    = 32,
+};
+
+enum {
+        CMD_OWNER_SW            = 0x0,
+        CMD_OWNER_HW            = 0x1,
+        CMD_STATUS_SUCCESS      = 0,
+};
+
+enum mlx5_sqp_t {
+        MLX5_SQP_SMI            = 0,
+        MLX5_SQP_GSI            = 1,
+        MLX5_SQP_IEEE_1588      = 2,
+        MLX5_SQP_SNIFFER        = 3,
+        MLX5_SQP_SYNC_UMR       = 4,
+};
+
+enum {
+        MLX5_MAX_PORTS  = 2,
+};
+
+enum {
+        MLX5_EQ_VEC_PAGES        = 0,
+        MLX5_EQ_VEC_CMD          = 1,
+        MLX5_EQ_VEC_ASYNC        = 2,
+        MLX5_EQ_VEC_COMP_BASE,
+};
+
+enum {
+        MLX5_MAX_EQ_NAME        = 20
+};
+
+enum {
+        MLX5_ATOMIC_MODE_IB_COMP        = 1 << 16,
+        MLX5_ATOMIC_MODE_CX             = 2 << 16,
+        MLX5_ATOMIC_MODE_8B             = 3 << 16,
+        MLX5_ATOMIC_MODE_16B            = 4 << 16,
+        MLX5_ATOMIC_MODE_32B            = 5 << 16,
+        MLX5_ATOMIC_MODE_64B            = 6 << 16,
+        MLX5_ATOMIC_MODE_128B           = 7 << 16,
+        MLX5_ATOMIC_MODE_256B           = 8 << 16,
+};
+
+enum {
+        MLX5_CMD_OP_QUERY_HCA_CAP               = 0x100,
+        MLX5_CMD_OP_QUERY_ADAPTER               = 0x101,
+        MLX5_CMD_OP_INIT_HCA                    = 0x102,
+        MLX5_CMD_OP_TEARDOWN_HCA                = 0x103,
+        MLX5_CMD_OP_QUERY_PAGES                 = 0x107,
+        MLX5_CMD_OP_MANAGE_PAGES                = 0x108,
+        MLX5_CMD_OP_SET_HCA_CAP                 = 0x109,
+
+        MLX5_CMD_OP_CREATE_MKEY                 = 0x200,
+        MLX5_CMD_OP_QUERY_MKEY                  = 0x201,
+        MLX5_CMD_OP_DESTROY_MKEY                = 0x202,
+        MLX5_CMD_OP_QUERY_SPECIAL_CONTEXTS      = 0x203,
+
+        MLX5_CMD_OP_CREATE_EQ                   = 0x301,
+        MLX5_CMD_OP_DESTROY_EQ                  = 0x302,
+        MLX5_CMD_OP_QUERY_EQ                    = 0x303,
+
+        MLX5_CMD_OP_CREATE_CQ                   = 0x400,
+        MLX5_CMD_OP_DESTROY_CQ                  = 0x401,
+        MLX5_CMD_OP_QUERY_CQ                    = 0x402,
+        MLX5_CMD_OP_MODIFY_CQ                   = 0x403,
+
+        MLX5_CMD_OP_CREATE_QP                   = 0x500,
+        MLX5_CMD_OP_DESTROY_QP                  = 0x501,
+        MLX5_CMD_OP_RST2INIT_QP                 = 0x502,
+        MLX5_CMD_OP_INIT2RTR_QP                 = 0x503,
+        MLX5_CMD_OP_RTR2RTS_QP                  = 0x504,
+        MLX5_CMD_OP_RTS2RTS_QP                  = 0x505,
+        MLX5_CMD_OP_SQERR2RTS_QP                = 0x506,
+        MLX5_CMD_OP_2ERR_QP                     = 0x507,
+        MLX5_CMD_OP_RTS2SQD_QP                  = 0x508,
+        MLX5_CMD_OP_SQD2RTS_QP                  = 0x509,
+        MLX5_CMD_OP_2RST_QP                     = 0x50a,
+        MLX5_CMD_OP_QUERY_QP                    = 0x50b,
+        MLX5_CMD_OP_CONF_SQP                    = 0x50c,
+        MLX5_CMD_OP_MAD_IFC                     = 0x50d,
+        MLX5_CMD_OP_INIT2INIT_QP                = 0x50e,
+        MLX5_CMD_OP_SUSPEND_QP                  = 0x50f,
+        MLX5_CMD_OP_UNSUSPEND_QP                = 0x510,
+        MLX5_CMD_OP_SQD2SQD_QP                  = 0x511,
+        MLX5_CMD_OP_ALLOC_QP_COUNTER_SET        = 0x512,
+        MLX5_CMD_OP_DEALLOC_QP_COUNTER_SET      = 0x513,
+        MLX5_CMD_OP_QUERY_QP_COUNTER_SET        = 0x514,
+
+        MLX5_CMD_OP_CREATE_PSV                  = 0x600,
+        MLX5_CMD_OP_DESTROY_PSV                 = 0x601,
+        MLX5_CMD_OP_QUERY_PSV                   = 0x602,
+        MLX5_CMD_OP_QUERY_SIG_RULE_TABLE        = 0x603,
+        MLX5_CMD_OP_QUERY_BLOCK_SIZE_TABLE      = 0x604,
+
+        MLX5_CMD_OP_CREATE_SRQ                  = 0x700,
+        MLX5_CMD_OP_DESTROY_SRQ                 = 0x701,
+        MLX5_CMD_OP_QUERY_SRQ                   = 0x702,
+        MLX5_CMD_OP_ARM_RQ                      = 0x703,
+        MLX5_CMD_OP_RESIZE_SRQ                  = 0x704,
+
+        MLX5_CMD_OP_ALLOC_PD                    = 0x800,
+        MLX5_CMD_OP_DEALLOC_PD                  = 0x801,
+        MLX5_CMD_OP_ALLOC_UAR                   = 0x802,
+        MLX5_CMD_OP_DEALLOC_UAR                 = 0x803,
+
+        MLX5_CMD_OP_ATTACH_TO_MCG               = 0x806,
+        MLX5_CMD_OP_DETACH_FROM_MCG             = 0x807,
+
+
+        MLX5_CMD_OP_ALLOC_XRCD                  = 0x80e,
+        MLX5_CMD_OP_DEALLOC_XRCD                = 0x80f,
+
+        MLX5_CMD_OP_ACCESS_REG                  = 0x805,
+        MLX5_CMD_OP_MAX                         = 0x810,
+};
+
+enum {
+        MLX5_REG_PCAP            = 0x5001,
+        MLX5_REG_PMTU            = 0x5003,
+        MLX5_REG_PTYS            = 0x5004,
+        MLX5_REG_PAOS            = 0x5006,
+        MLX5_REG_PMAOS           = 0x5012,
+        MLX5_REG_PUDE            = 0x5009,
+        MLX5_REG_PMPE            = 0x5010,
+        MLX5_REG_PELC            = 0x500e,
+        MLX5_REG_PMLP            = 0, /* TBD */
+        MLX5_REG_NODE_DESC       = 0x6001,
+        MLX5_REG_HOST_ENDIANNESS = 0x7004,
+};
+
+enum dbg_rsc_type {
+        MLX5_DBG_RSC_QP,
+        MLX5_DBG_RSC_EQ,
+        MLX5_DBG_RSC_CQ,
+};
+
+struct mlx5_field_desc {
+        struct dentry          *dent;
+        int                     i;
+};
+
+struct mlx5_rsc_debug {
+        struct mlx5_core_dev   *dev;
+        void                   *object;
+        enum dbg_rsc_type       type;
+        struct dentry          *root;
+        struct mlx5_field_desc  fields[0];
+};
+
+enum mlx5_dev_event {
+        MLX5_DEV_EVENT_SYS_ERROR,
+        MLX5_DEV_EVENT_PORT_UP,
+        MLX5_DEV_EVENT_PORT_DOWN,
+        MLX5_DEV_EVENT_PORT_INITIALIZED,
+        MLX5_DEV_EVENT_LID_CHANGE,
+        MLX5_DEV_EVENT_PKEY_CHANGE,
+        MLX5_DEV_EVENT_GUID_CHANGE,
+        MLX5_DEV_EVENT_CLIENT_REREG,
+};
+
+struct mlx5_uuar_info {
+        struct mlx5_uar        *uars;
+        int                     num_uars;
+        int                     num_low_latency_uuars;
+        unsigned long          *bitmap;
+        unsigned int           *count;
+        struct mlx5_bf         *bfs;
+
+        /*
+         * protect uuar allocation data structs
+         */
+        struct mutex            lock;
+};
+
+struct mlx5_bf {
+        void __iomem           *reg;
+        void __iomem           *regreg;
+        int                     buf_size;
+        struct mlx5_uar        *uar;
+        unsigned long           offset;
+        int                     need_lock;
+        /* protect blue flame buffer selection when needed
+         */
+        spinlock_t              lock;
+
+        /* serialize 64 bit writes when done as two 32 bit accesses
+         */
+        spinlock_t              lock32;
+        int                     uuarn;
+};
+
+struct mlx5_cmd_first {
+        __be32          data[4];
+};
+
+struct mlx5_cmd_msg {
+        struct list_head                list;
+        struct cache_ent               *cache;
+        u32                             len;
+        struct mlx5_cmd_first           first;
+        struct mlx5_cmd_mailbox        *next;
+};
+
+struct mlx5_cmd_debug {
+        struct dentry          *dbg_root;
+        struct dentry          *dbg_in;
+        struct dentry          *dbg_out;
+        struct dentry          *dbg_outlen;
+        struct dentry          *dbg_status;
+        struct dentry          *dbg_run;
+        void                   *in_msg;
+        void                   *out_msg;
+        u8                      status;
+        u16                     inlen;
+        u16                     outlen;
+};
+
+struct cache_ent {
+        /* protect block chain allocations
+         */
+        spinlock_t              lock;
+        struct list_head        head;
+};
+
+struct cmd_msg_cache {
+        struct cache_ent        large;
+        struct cache_ent        med;
+
+};
+
+struct mlx5_cmd_stats {
+        u64             sum;
+        u64             n;
+        struct dentry  *root;
+        struct dentry  *avg;
+        struct dentry  *count;
+        /* protect command average calculations */
+        spinlock_t      lock;
+};
+
+struct mlx5_cmd {
+        void           *cmd_buf;
+        dma_addr_t      dma;
+        u16             cmdif_rev;
+        u8              log_sz;
+        u8              log_stride;
+        int             max_reg_cmds;
+        int             events;
+        u32 __iomem    *vector;
+
+        /* protect command queue allocations
+         */
+        spinlock_t      alloc_lock;
+
+        /* protect token allocations
+         */
+        spinlock_t      token_lock;
+        u8              token;
+        unsigned long   bitmask;
+        char            wq_name[MLX5_CMD_WQ_MAX_NAME];
+        struct workqueue_struct *wq;
+        struct semaphore sem;
+        struct semaphore pages_sem;
+        int     mode;
+        struct mlx5_cmd_work_ent *ent_arr[MLX5_MAX_COMMANDS];
+        struct pci_pool *pool;
+        struct mlx5_cmd_debug dbg;
+        struct cmd_msg_cache cache;
+        int checksum_disabled;
+        struct mlx5_cmd_stats stats[MLX5_CMD_OP_MAX];
+};
+
+struct mlx5_port_caps {
+        int     gid_table_len;
+        int     pkey_table_len;
+};
+
+struct mlx5_caps {
+        u8      log_max_eq;
+        u8      log_max_cq;
+        u8      log_max_qp;
+        u8      log_max_mkey;
+        u8      log_max_pd;
+        u8      log_max_srq;
+        u32     max_cqes;
+        int     max_wqes;
+        int     max_sq_desc_sz;
+        int     max_rq_desc_sz;
+        u64     flags;
+        u16     stat_rate_support;
+        int     log_max_msg;
+        int     num_ports;
+        int     max_ra_res_qp;
+        int     max_ra_req_qp;
+        int     max_srq_wqes;
+        int     bf_reg_size;
+        int     bf_regs_per_page;
+        struct mlx5_port_caps   port[MLX5_MAX_PORTS];
+        u8                      ext_port_cap[MLX5_MAX_PORTS];
+        int     max_vf;
+        u32     reserved_lkey;
+        u8      local_ca_ack_delay;
+        u8      log_max_mcg;
+        u16     max_qp_mcg;
+        int     min_page_sz;
+};
+
+struct mlx5_cmd_mailbox {
+        void           *buf;
+        dma_addr_t      dma;
+        struct mlx5_cmd_mailbox *next;
+};
+
+struct mlx5_buf_list {
+        void                   *buf;
+        dma_addr_t              map;
+};
+
+struct mlx5_buf {
+        struct mlx5_buf_list    direct;
+        struct mlx5_buf_list   *page_list;
+        int                     nbufs;
+        int                     npages;
+        int                     page_shift;
+        int                     size;
+};
+
+struct mlx5_eq {
+        struct mlx5_core_dev   *dev;
+        __be32 __iomem         *doorbell;
+        u32                     cons_index;
+        struct mlx5_buf         buf;
+        int                     size;
+        u8                      irqn;
+        u8                      eqn;
+        int                     nent;
+        u64                     mask;
+        char                    name[MLX5_MAX_EQ_NAME];
+        struct list_head        list;
+        int                     index;
+        struct mlx5_rsc_debug   *dbg;
+};
+
+
+struct mlx5_core_mr {
+        u64                     iova;
+        u64                     size;
+        u32                     key;
+        u32                     pd;
+        u32                     access;
+};
+
+struct mlx5_core_srq {
+        u32             srqn;
+        int             max;
+        int             max_gs;
+        int             max_avail_gather;
+        int             wqe_shift;
+        void (*event)   (struct mlx5_core_srq *, enum mlx5_event);
+
+        atomic_t                refcount;
+        struct completion       free;
+};
+
+struct mlx5_eq_table {
+        void __iomem           *update_ci;
+        void __iomem           *update_arm_ci;
+        struct list_head       *comp_eq_head;
+        struct mlx5_eq          pages_eq;
+        struct mlx5_eq          async_eq;
+        struct mlx5_eq          cmd_eq;
+        struct msix_entry       *msix_arr;
+        int                     num_comp_vectors;
+        /* protect EQs list
+         */
+        spinlock_t              lock;
+};
+
+struct mlx5_uar {
+        u32                     index;
+        struct list_head        bf_list;
+        unsigned                free_bf_bmap;
+        void __iomem           *wc_map;
+        void __iomem           *map;
+};
+
+
+struct mlx5_core_health {
+        struct health_buffer __iomem   *health;
+        __be32 __iomem                 *health_counter;
+        struct timer_list               timer;
+        struct list_head                list;
+        u32                             prev;
+        int                             miss_counter;
+};
+
+struct mlx5_cq_table {
+        /* protect radix tree
+         */
+        spinlock_t              lock;
+        struct radix_tree_root  tree;
+};
+
+struct mlx5_qp_table {
+        /* protect radix tree
+         */
+        spinlock_t              lock;
+        struct radix_tree_root  tree;
+};
+
+struct mlx5_srq_table {
+        /* protect radix tree
+         */
+        spinlock_t              lock;
+        struct radix_tree_root  tree;
+};
+
+struct mlx5_priv {
+        char                    name[MLX5_MAX_NAME_LEN];
+        struct mlx5_eq_table    eq_table;
+        struct mlx5_uuar_info   uuari;
+        MLX5_DECLARE_DOORBELL_LOCK(cq_uar_lock);
+
+        /* pages stuff */
+        struct workqueue_struct *pg_wq;
+        struct rb_root          page_root;
+        int                     fw_pages;
+        int                     reg_pages;
+
+        struct mlx5_core_health health;
+
+        struct mlx5_srq_table   srq_table;
+
+        /* start: qp staff */
+        struct mlx5_qp_table    qp_table;
+        struct dentry          *qp_debugfs;
+        struct dentry          *eq_debugfs;
+        struct dentry          *cq_debugfs;
+        struct dentry          *cmdif_debugfs;
+        /* end: qp staff */
+
+        /* start: cq staff */
+        struct mlx5_cq_table    cq_table;
+        /* end: cq staff */
+
+        /* start: alloc staff */
+        struct mutex            pgdir_mutex;
+        struct list_head        pgdir_list;
+        /* end: alloc staff */
+        struct dentry          *dbg_root;
+
+        /* protect mkey key part */
+        spinlock_t              mkey_lock;
+        u8                      mkey_key;
+};
+
+struct mlx5_core_dev {
+        struct pci_dev         *pdev;
+        u8                      rev_id;
+        char                    board_id[MLX5_BOARD_ID_LEN];
+        struct mlx5_cmd         cmd;
+        struct mlx5_caps        caps;
+        phys_addr_t             iseg_base;
+        struct mlx5_init_seg __iomem *iseg;
+        void                    (*event) (struct mlx5_core_dev *dev,
+                                          enum mlx5_dev_event event,
+                                          void *data);
+        struct mlx5_priv        priv;
+        struct mlx5_profile     *profile;
+        atomic_t                num_qps;
+};
+
+struct mlx5_db {
+        __be32                  *db;
+        union {
+                struct mlx5_db_pgdir            *pgdir;
+                struct mlx5_ib_user_db_page     *user_page;
+        }                       u;
+        dma_addr_t              dma;
+        int                     index;
+};
+
+enum {
+        MLX5_DB_PER_PAGE = PAGE_SIZE / L1_CACHE_BYTES,
+};
+
+enum {
+        MLX5_COMP_EQ_SIZE = 1024,
+};
+
+struct mlx5_db_pgdir {
+        struct list_head        list;
+        DECLARE_BITMAP(bitmap, MLX5_DB_PER_PAGE);
+        __be32                 *db_page;
+        dma_addr_t              db_dma;
+};
+
+typedef void (*mlx5_cmd_cbk_t)(int status, void *context);
+
+struct mlx5_cmd_work_ent {
+        struct mlx5_cmd_msg    *in;
+        struct mlx5_cmd_msg    *out;
+        mlx5_cmd_cbk_t          callback;
+        void                   *context;
+        int idx;
+        struct completion       done;
+        struct mlx5_cmd        *cmd;
+        struct work_struct      work;
+        struct mlx5_cmd_layout *lay;
+        int                     ret;
+        int                     page_queue;
+        u8                      status;
+        u8                      token;
+        struct timespec         ts1;
+        struct timespec         ts2;
+};
+
+struct mlx5_pas {
+        u64     pa;
+        u8      log_sz;
+};
+
+static inline void *mlx5_buf_offset(struct mlx5_buf *buf, int offset)
+{
+        if (likely(BITS_PER_LONG == 64 || buf->nbufs == 1))
+                return buf->direct.buf + offset;
+        else
+                return buf->page_list[offset >> PAGE_SHIFT].buf +
+                        (offset & (PAGE_SIZE - 1));
+}
+
+extern struct workqueue_struct *mlx5_core_wq;
+
+#define STRUCT_FIELD(header, field) \
+        .struct_offset_bytes = offsetof(struct ib_unpacked_ ## header, field),      \
+        .struct_size_bytes   = sizeof((struct ib_unpacked_ ## header *)0)->field
+
+struct ib_field {
+        size_t struct_offset_bytes;
+        size_t struct_size_bytes;
+        int    offset_bits;
+        int    size_bits;
+};
+
+static inline struct mlx5_core_dev *pci2mlx5_core_dev(struct pci_dev *pdev)
+{
+        return pci_get_drvdata(pdev);
+}
+
+extern struct dentry *mlx5_debugfs_root;
+
+static inline u16 fw_rev_maj(struct mlx5_core_dev *dev)
+{
+        return ioread32be(&dev->iseg->fw_rev) & 0xffff;
+}
+
+static inline u16 fw_rev_min(struct mlx5_core_dev *dev)
+{
+        return ioread32be(&dev->iseg->fw_rev) >> 16;
+}
+
+static inline u16 fw_rev_sub(struct mlx5_core_dev *dev)
+{
+        return ioread32be(&dev->iseg->cmdif_rev_fw_sub) & 0xffff;
+}
+
+static inline u16 cmdif_rev(struct mlx5_core_dev *dev)
+{
+        return ioread32be(&dev->iseg->cmdif_rev_fw_sub) >> 16;
+}
+
+static inline void *mlx5_vzalloc(unsigned long size)
+{
+        void *rtn;
+
+        rtn = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
+        if (!rtn)
+                rtn = vzalloc(size);
+        return rtn;
+}
+
+static inline void mlx5_vfree(const void *addr)
+{
+        if (addr && is_vmalloc_addr(addr))
+                vfree(addr);
+        else
+                kfree(addr);
+}
+
+int mlx5_dev_init(struct mlx5_core_dev *dev, struct pci_dev *pdev);
+void mlx5_dev_cleanup(struct mlx5_core_dev *dev);
+int mlx5_cmd_init(struct mlx5_core_dev *dev);
+void mlx5_cmd_cleanup(struct mlx5_core_dev *dev);
+void mlx5_cmd_use_events(struct mlx5_core_dev *dev);
+void mlx5_cmd_use_polling(struct mlx5_core_dev *dev);
+int mlx5_cmd_status_to_err(struct mlx5_outbox_hdr *hdr);
+int mlx5_cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,
+                  int out_size);
+int mlx5_cmd_alloc_uar(struct mlx5_core_dev *dev, u32 *uarn);
+int mlx5_cmd_free_uar(struct mlx5_core_dev *dev, u32 uarn);
+int mlx5_alloc_uuars(struct mlx5_core_dev *dev, struct mlx5_uuar_info *uuari);
+int mlx5_free_uuars(struct mlx5_core_dev *dev, struct mlx5_uuar_info *uuari);
+void mlx5_health_cleanup(void);
+void  __init mlx5_health_init(void);
+void mlx5_start_health_poll(struct mlx5_core_dev *dev);
+void mlx5_stop_health_poll(struct mlx5_core_dev *dev);
+int mlx5_buf_alloc(struct mlx5_core_dev *dev, int size, int max_direct,
+                   struct mlx5_buf *buf);
+void mlx5_buf_free(struct mlx5_core_dev *dev, struct mlx5_buf *buf);
+struct mlx5_cmd_mailbox *mlx5_alloc_cmd_mailbox_chain(struct mlx5_core_dev *dev,
+                                                      gfp_t flags, int npages);
+void mlx5_free_cmd_mailbox_chain(struct mlx5_core_dev *dev,
+                                 struct mlx5_cmd_mailbox *head);
+int mlx5_core_create_srq(struct mlx5_core_dev *dev, struct mlx5_core_srq *srq,
+                         struct mlx5_create_srq_mbox_in *in, int inlen);
+int mlx5_core_destroy_srq(struct mlx5_core_dev *dev, struct mlx5_core_srq *srq);
+int mlx5_core_query_srq(struct mlx5_core_dev *dev, struct mlx5_core_srq *srq,
+                        struct mlx5_query_srq_mbox_out *out);
+int mlx5_core_arm_srq(struct mlx5_core_dev *dev, struct mlx5_core_srq *srq,
+                      u16 lwm, int is_srq);
+int mlx5_core_create_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr,
+                          struct mlx5_create_mkey_mbox_in *in, int inlen);
+int mlx5_core_destroy_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr);
+int mlx5_core_query_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr,
+                         struct mlx5_query_mkey_mbox_out *out, int outlen);
+int mlx5_core_dump_fill_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr,
+                             u32 *mkey);
+int mlx5_core_alloc_pd(struct mlx5_core_dev *dev, u32 *pdn);
+int mlx5_core_dealloc_pd(struct mlx5_core_dev *dev, u32 pdn);
+int mlx5_core_mad_ifc(struct mlx5_core_dev *dev, void *inb, void *outb,
+                      u16 opmod, int port);
+void mlx5_pagealloc_init(struct mlx5_core_dev *dev);
+void mlx5_pagealloc_cleanup(struct mlx5_core_dev *dev);
+int mlx5_pagealloc_start(struct mlx5_core_dev *dev);
+void mlx5_pagealloc_stop(struct mlx5_core_dev *dev);
+void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
+                                 s16 npages);
+int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev);
+int mlx5_reclaim_startup_pages(struct mlx5_core_dev *dev);
+void mlx5_register_debugfs(void);
+void mlx5_unregister_debugfs(void);
+int mlx5_eq_init(struct mlx5_core_dev *dev);
+void mlx5_eq_cleanup(struct mlx5_core_dev *dev);
+void mlx5_fill_page_array(struct mlx5_buf *buf, __be64 *pas);
+void mlx5_cq_completion(struct mlx5_core_dev *dev, u32 cqn);
+void mlx5_qp_event(struct mlx5_core_dev *dev, u32 qpn, int event_type);
+void mlx5_srq_event(struct mlx5_core_dev *dev, u32 srqn, int event_type);
+struct mlx5_core_srq *mlx5_core_get_srq(struct mlx5_core_dev *dev, u32 srqn);
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector);
+void mlx5_cq_event(struct mlx5_core_dev *dev, u32 cqn, int event_type);
+int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
+                       int nent, u64 mask, const char *name, struct mlx5_uar *uar);
+int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq);
+int mlx5_start_eqs(struct mlx5_core_dev *dev);
+int mlx5_stop_eqs(struct mlx5_core_dev *dev);
+int mlx5_core_attach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid, u32 qpn);
+int mlx5_core_detach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid, u32 qpn);
+
+int mlx5_qp_debugfs_init(struct mlx5_core_dev *dev);
+void mlx5_qp_debugfs_cleanup(struct mlx5_core_dev *dev);
+int mlx5_core_access_reg(struct mlx5_core_dev *dev, void *data_in,
+                         int size_in, void *data_out, int size_out,
+                         u16 reg_num, int arg, int write);
+int mlx5_set_port_caps(struct mlx5_core_dev *dev, int port_num, u32 caps);
+
+int mlx5_debug_eq_add(struct mlx5_core_dev *dev, struct mlx5_eq *eq);
+void mlx5_debug_eq_remove(struct mlx5_core_dev *dev, struct mlx5_eq *eq);
+int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq,
+                       struct mlx5_query_eq_mbox_out *out, int outlen);
+int mlx5_eq_debugfs_init(struct mlx5_core_dev *dev);
+void mlx5_eq_debugfs_cleanup(struct mlx5_core_dev *dev);
+int mlx5_cq_debugfs_init(struct mlx5_core_dev *dev);
+void mlx5_cq_debugfs_cleanup(struct mlx5_core_dev *dev);
+int mlx5_db_alloc(struct mlx5_core_dev *dev, struct mlx5_db *db);
+void mlx5_db_free(struct mlx5_core_dev *dev, struct mlx5_db *db);
+
+typedef void (*health_handler_t)(struct pci_dev *pdev, struct health_buffer __iomem *buf, int size);
+int mlx5_register_health_report_handler(health_handler_t handler);
+void mlx5_unregister_health_report_handler(void);
+const char *mlx5_command_str(int command);
+int mlx5_cmdif_debugfs_init(struct mlx5_core_dev *dev);
+void mlx5_cmdif_debugfs_cleanup(struct mlx5_core_dev *dev);
+
+static inline u32 mlx5_mkey_to_idx(u32 mkey)
+{
+        return mkey >> 8;
+}
+
+static inline u32 mlx5_idx_to_mkey(u32 mkey_idx)
+{
+        return mkey_idx << 8;
+}
+
+enum {
+        MLX5_PROF_MASK_QP_SIZE          = (u64)1 << 0,
+        MLX5_PROF_MASK_CMDIF_CSUM       = (u64)1 << 1,
+        MLX5_PROF_MASK_MR_CACHE         = (u64)1 << 2,
+};
+
+enum {
+        MAX_MR_CACHE_ENTRIES    = 16,
+};
+
+struct mlx5_profile {
+        u64     mask;
+        u32     log_max_qp;
+        int     cmdif_csum;
+        struct {
+                int     size;
+                int     limit;
+        } mr_cache[MAX_MR_CACHE_ENTRIES];
+};
+
+#endif /* MLX5_DRIVER_H */
diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h
new file mode 100644
index 000000000000..d9e3eacb3a7f
--- /dev/null
+++ b/include/linux/mlx5/qp.h
@@ -0,0 +1,467 @@
+/*
+ * Copyright (c) 2013, Mellanox Technologies inc.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef MLX5_QP_H
+#define MLX5_QP_H
+
+#include <linux/mlx5/device.h>
+#include <linux/mlx5/driver.h>
+
+#define MLX5_INVALID_LKEY       0x100
+
+enum mlx5_qp_optpar {
+        MLX5_QP_OPTPAR_ALT_ADDR_PATH            = 1 << 0,
+        MLX5_QP_OPTPAR_RRE                      = 1 << 1,
+        MLX5_QP_OPTPAR_RAE                      = 1 << 2,
+        MLX5_QP_OPTPAR_RWE                      = 1 << 3,
+        MLX5_QP_OPTPAR_PKEY_INDEX               = 1 << 4,
+        MLX5_QP_OPTPAR_Q_KEY                    = 1 << 5,
+        MLX5_QP_OPTPAR_RNR_TIMEOUT              = 1 << 6,
+        MLX5_QP_OPTPAR_PRIMARY_ADDR_PATH        = 1 << 7,
+        MLX5_QP_OPTPAR_SRA_MAX                  = 1 << 8,
+        MLX5_QP_OPTPAR_RRA_MAX                  = 1 << 9,
+        MLX5_QP_OPTPAR_PM_STATE                 = 1 << 10,
+        MLX5_QP_OPTPAR_RETRY_COUNT              = 1 << 12,
+        MLX5_QP_OPTPAR_RNR_RETRY                = 1 << 13,
+        MLX5_QP_OPTPAR_ACK_TIMEOUT              = 1 << 14,
+        MLX5_QP_OPTPAR_PRI_PORT                 = 1 << 16,
+        MLX5_QP_OPTPAR_SRQN                     = 1 << 18,
+        MLX5_QP_OPTPAR_CQN_RCV                  = 1 << 19,
+        MLX5_QP_OPTPAR_DC_HS                    = 1 << 20,
+        MLX5_QP_OPTPAR_DC_KEY                   = 1 << 21,
+};
+
+enum mlx5_qp_state {
+        MLX5_QP_STATE_RST                       = 0,
+        MLX5_QP_STATE_INIT                      = 1,
+        MLX5_QP_STATE_RTR                       = 2,
+        MLX5_QP_STATE_RTS                       = 3,
+        MLX5_QP_STATE_SQER                      = 4,
+        MLX5_QP_STATE_SQD                       = 5,
+        MLX5_QP_STATE_ERR                       = 6,
+        MLX5_QP_STATE_SQ_DRAINING               = 7,
+        MLX5_QP_STATE_SUSPENDED                 = 9,
+        MLX5_QP_NUM_STATE
+};
+
+enum {
+        MLX5_QP_ST_RC                           = 0x0,
+        MLX5_QP_ST_UC                           = 0x1,
+        MLX5_QP_ST_UD                           = 0x2,
+        MLX5_QP_ST_XRC                          = 0x3,
+        MLX5_QP_ST_MLX                          = 0x4,
+        MLX5_QP_ST_DCI                          = 0x5,
+        MLX5_QP_ST_DCT                          = 0x6,
+        MLX5_QP_ST_QP0                          = 0x7,
+        MLX5_QP_ST_QP1                          = 0x8,
+        MLX5_QP_ST_RAW_ETHERTYPE                = 0x9,
+        MLX5_QP_ST_RAW_IPV6                     = 0xa,
+        MLX5_QP_ST_SNIFFER                      = 0xb,
+        MLX5_QP_ST_SYNC_UMR                     = 0xe,
+        MLX5_QP_ST_PTP_1588                     = 0xd,
+        MLX5_QP_ST_REG_UMR                      = 0xc,
+        MLX5_QP_ST_MAX
+};
+
+enum {
+        MLX5_QP_PM_MIGRATED                     = 0x3,
+        MLX5_QP_PM_ARMED                        = 0x0,
+        MLX5_QP_PM_REARM                        = 0x1
+};
+
+enum {
+        MLX5_NON_ZERO_RQ        = 0 << 24,
+        MLX5_SRQ_RQ             = 1 << 24,
+        MLX5_CRQ_RQ             = 2 << 24,
+        MLX5_ZERO_LEN_RQ        = 3 << 24
+};
+
+enum {
+        /* params1 */
+        MLX5_QP_BIT_SRE                         = 1 << 15,
+        MLX5_QP_BIT_SWE                         = 1 << 14,
+        MLX5_QP_BIT_SAE                         = 1 << 13,
+        /* params2 */
+        MLX5_QP_BIT_RRE                         = 1 << 15,
+        MLX5_QP_BIT_RWE                         = 1 << 14,
+        MLX5_QP_BIT_RAE                         = 1 << 13,
+        MLX5_QP_BIT_RIC                         = 1 <<  4,
+};
+
+enum {
+        MLX5_WQE_CTRL_CQ_UPDATE         = 2 << 2,
+        MLX5_WQE_CTRL_SOLICITED         = 1 << 1,
+};
+
+enum {
+        MLX5_SEND_WQE_BB        = 64,
+};
+
+enum {
+        MLX5_WQE_FMR_PERM_LOCAL_READ    = 1 << 27,
+        MLX5_WQE_FMR_PERM_LOCAL_WRITE   = 1 << 28,
+        MLX5_WQE_FMR_PERM_REMOTE_READ   = 1 << 29,
+        MLX5_WQE_FMR_PERM_REMOTE_WRITE  = 1 << 30,
+        MLX5_WQE_FMR_PERM_ATOMIC        = 1 << 31
+};
+
+enum {
+        MLX5_FENCE_MODE_NONE                    = 0 << 5,
+        MLX5_FENCE_MODE_INITIATOR_SMALL         = 1 << 5,
+        MLX5_FENCE_MODE_STRONG_ORDERING         = 3 << 5,
+        MLX5_FENCE_MODE_SMALL_AND_FENCE         = 4 << 5,
+};
+
+enum {
+        MLX5_QP_LAT_SENSITIVE   = 1 << 28,
+        MLX5_QP_ENABLE_SIG      = 1 << 31,
+};
+
+enum {
+        MLX5_RCV_DBR    = 0,
+        MLX5_SND_DBR    = 1,
+};
+
+struct mlx5_wqe_fmr_seg {
+        __be32                  flags;
+        __be32                  mem_key;
+        __be64                  buf_list;
+        __be64                  start_addr;
+        __be64                  reg_len;
+        __be32                  offset;
+        __be32                  page_size;
+        u32                     reserved[2];
+};
+
+struct mlx5_wqe_ctrl_seg {
+        __be32                  opmod_idx_opcode;
+        __be32                  qpn_ds;
+        u8                      signature;
+        u8                      rsvd[2];
+        u8                      fm_ce_se;
+        __be32                  imm;
+};
+
+struct mlx5_wqe_xrc_seg {
+        __be32                  xrc_srqn;
+        u8                      rsvd[12];
+};
+
+struct mlx5_wqe_masked_atomic_seg {
+        __be64                  swap_add;
+        __be64                  compare;
+        __be64                  swap_add_mask;
+        __be64                  compare_mask;
+};
+
+struct mlx5_av {
+        union {
+                struct {
+                        __be32  qkey;
+                        __be32  reserved;
+                } qkey;
+                __be64  dc_key;
+        } key;
+        __be32  dqp_dct;
+        u8      stat_rate_sl;
+        u8      fl_mlid;
+        __be16  rlid;
+        u8      reserved0[10];
+        u8      tclass;
+        u8      hop_limit;
+        __be32  grh_gid_fl;
+        u8      rgid[16];
+};
+
+struct mlx5_wqe_datagram_seg {
+        struct mlx5_av  av;
+};
+
+struct mlx5_wqe_raddr_seg {
+        __be64                  raddr;
+        __be32                  rkey;
+        u32                     reserved;
+};
+
+struct mlx5_wqe_atomic_seg {
+        __be64                  swap_add;
+        __be64                  compare;
+};
+
+struct mlx5_wqe_data_seg {
+        __be32                  byte_count;
+        __be32                  lkey;
+        __be64                  addr;
+};
+
+struct mlx5_wqe_umr_ctrl_seg {
+        u8              flags;
+        u8              rsvd0[3];
+        __be16          klm_octowords;
+        __be16          bsf_octowords;
+        __be64          mkey_mask;
+        u8              rsvd1[32];
+};
+
+struct mlx5_seg_set_psv {
+        __be32          psv_num;
+        __be16          syndrome;
+        __be16          status;
+        __be32          transient_sig;
+        __be32          ref_tag;
+};
+
+struct mlx5_seg_get_psv {
+        u8              rsvd[19];
+        u8              num_psv;
+        __be32          l_key;
+        __be64          va;
+        __be32          psv_index[4];
+};
+
+struct mlx5_seg_check_psv {
+        u8              rsvd0[2];
+        __be16          err_coalescing_op;
+        u8              rsvd1[2];
+        __be16          xport_err_op;
+        u8              rsvd2[2];
+        __be16          xport_err_mask;
+        u8              rsvd3[7];
+        u8              num_psv;
+        __be32          l_key;
+        __be64          va;
+        __be32          psv_index[4];
+};
+
+struct mlx5_rwqe_sig {
+        u8      rsvd0[4];
+        u8      signature;
+        u8      rsvd1[11];
+};
+
+struct mlx5_wqe_signature_seg {
+        u8      rsvd0[4];
+        u8      signature;
+        u8      rsvd1[11];
+};
+
+struct mlx5_wqe_inline_seg {
+        __be32  byte_count;
+};
+
+struct mlx5_core_qp {
+        void (*event)           (struct mlx5_core_qp *, int);
+        int                     qpn;
+        atomic_t                refcount;
+        struct completion       free;
+        struct mlx5_rsc_debug   *dbg;
+        int                     pid;
+};
+
+struct mlx5_qp_path {
+        u8                      fl;
+        u8                      rsvd3;
+        u8                      free_ar;
+        u8                      pkey_index;
+        u8                      rsvd0;
+        u8                      grh_mlid;
+        __be16                  rlid;
+        u8                      ackto_lt;
+        u8                      mgid_index;
+        u8                      static_rate;
+        u8                      hop_limit;
+        __be32                  tclass_flowlabel;
+        u8                      rgid[16];
+        u8                      rsvd1[4];
+        u8                      sl;
+        u8                      port;
+        u8                      rsvd2[6];
+};
+
+struct mlx5_qp_context {
+        __be32                  flags;
+        __be32                  flags_pd;
+        u8                      mtu_msgmax;
+        u8                      rq_size_stride;
+        __be16                  sq_crq_size;
+        __be32                  qp_counter_set_usr_page;
+        __be32                  wire_qpn;
+        __be32                  log_pg_sz_remote_qpn;
+        struct                  mlx5_qp_path pri_path;
+        struct                  mlx5_qp_path alt_path;
+        __be32                  params1;
+        u8                      reserved2[4];
+        __be32                  next_send_psn;
+        __be32                  cqn_send;
+        u8                      reserved3[8];
+        __be32                  last_acked_psn;
+        __be32                  ssn;
+        __be32                  params2;
+        __be32                  rnr_nextrecvpsn;
+        __be32                  xrcd;
+        __be32                  cqn_recv;
+        __be64                  db_rec_addr;
+        __be32                  qkey;
+        __be32                  rq_type_srqn;
+        __be32                  rmsn;
+        __be16                  hw_sq_wqe_counter;
+        __be16                  sw_sq_wqe_counter;
+        __be16                  hw_rcyclic_byte_counter;
+        __be16                  hw_rq_counter;
+        __be16                  sw_rcyclic_byte_counter;
+        __be16                  sw_rq_counter;
+        u8                      rsvd0[5];
+        u8                      cgs;
+        u8                      cs_req;
+        u8                      cs_res;
+        __be64                  dc_access_key;
+        u8                      rsvd1[24];
+};
+
+struct mlx5_create_qp_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  input_qpn;
+        u8                      rsvd0[4];
+        __be32                  opt_param_mask;
+        u8                      rsvd1[4];
+        struct mlx5_qp_context  ctx;
+        u8                      rsvd3[16];
+        __be64                  pas[0];
+};
+
+struct mlx5_create_qp_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        __be32                  qpn;
+        u8                      rsvd0[4];
+};
+
+struct mlx5_destroy_qp_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  qpn;
+        u8                      rsvd0[4];
+};
+
+struct mlx5_destroy_qp_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd0[8];
+};
+
+struct mlx5_modify_qp_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  qpn;
+        u8                      rsvd1[4];
+        __be32                  optparam;
+        u8                      rsvd0[4];
+        struct mlx5_qp_context  ctx;
+};
+
+struct mlx5_modify_qp_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd0[8];
+};
+
+struct mlx5_query_qp_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  qpn;
+        u8                      rsvd[4];
+};
+
+struct mlx5_query_qp_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd1[8];
+        __be32                  optparam;
+        u8                      rsvd0[4];
+        struct mlx5_qp_context  ctx;
+        u8                      rsvd2[16];
+        __be64                  pas[0];
+};
+
+struct mlx5_conf_sqp_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  qpn;
+        u8                      rsvd[3];
+        u8                      type;
+};
+
+struct mlx5_conf_sqp_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_alloc_xrcd_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_alloc_xrcd_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        __be32                  xrcdn;
+        u8                      rsvd[4];
+};
+
+struct mlx5_dealloc_xrcd_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        __be32                  xrcdn;
+        u8                      rsvd[4];
+};
+
+struct mlx5_dealloc_xrcd_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+static inline struct mlx5_core_qp *__mlx5_qp_lookup(struct mlx5_core_dev *dev, u32 qpn)
+{
+        return radix_tree_lookup(&dev->priv.qp_table.tree, qpn);
+}
+
+int mlx5_core_create_qp(struct mlx5_core_dev *dev,
+                        struct mlx5_core_qp *qp,
+                        struct mlx5_create_qp_mbox_in *in,
+                        int inlen);
+int mlx5_core_qp_modify(struct mlx5_core_dev *dev, enum mlx5_qp_state cur_state,
+                        enum mlx5_qp_state new_state,
+                        struct mlx5_modify_qp_mbox_in *in, int sqd_event,
+                        struct mlx5_core_qp *qp);
+int mlx5_core_destroy_qp(struct mlx5_core_dev *dev,
+                         struct mlx5_core_qp *qp);
+int mlx5_core_qp_query(struct mlx5_core_dev *dev, struct mlx5_core_qp *qp,
+                       struct mlx5_query_qp_mbox_out *out, int outlen);
+
+int mlx5_core_xrcd_alloc(struct mlx5_core_dev *dev, u32 *xrcdn);
+int mlx5_core_xrcd_dealloc(struct mlx5_core_dev *dev, u32 xrcdn);
+void mlx5_init_qp_table(struct mlx5_core_dev *dev);
+void mlx5_cleanup_qp_table(struct mlx5_core_dev *dev);
+int mlx5_debug_qp_add(struct mlx5_core_dev *dev, struct mlx5_core_qp *qp);
+void mlx5_debug_qp_remove(struct mlx5_core_dev *dev, struct mlx5_core_qp *qp);
+
+#endif /* MLX5_QP_H */
diff --git a/include/linux/mlx5/srq.h b/include/linux/mlx5/srq.h
new file mode 100644
index 000000000000..e1a363a33663
--- /dev/null
+++ b/include/linux/mlx5/srq.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2013, Mellanox Technologies inc.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef MLX5_SRQ_H
+#define MLX5_SRQ_H
+
+#include <linux/mlx5/driver.h>
+
+void mlx5_init_srq_table(struct mlx5_core_dev *dev);
+void mlx5_cleanup_srq_table(struct mlx5_core_dev *dev);
+
+#endif /* MLX5_SRQ_H */
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index ace9a5f01c64..fb425aa16c01 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -330,12 +330,9 @@ struct mm_struct {
         unsigned long (*get_unmapped_area) (struct file *filp,
                                 unsigned long addr, unsigned long len,
                                 unsigned long pgoff, unsigned long flags);
-        void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
 #endif
         unsigned long mmap_base;                /* base of mmap area */
         unsigned long task_size;                /* size of task vm space */
-        unsigned long cached_hole_size;         /* if non-zero, the largest hole below free_area_cache */
-        unsigned long free_area_cache;          /* first hole of size cached_hole_size or larger */
         unsigned long highest_vm_end;           /* highest vma end address */
         pgd_t * pgd;
         atomic_t mm_users;                      /* How many users with user space? */
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index f31725ba49f3..842de3e21e70 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -94,7 +94,11 @@ struct mmc_ext_csd {
         u8                      raw_ext_csd_structure;  /* 194 */
         u8                      raw_card_type;          /* 196 */
         u8                      out_of_int_time;        /* 198 */
-        u8                      raw_s_a_timeout;                /* 217 */
+        u8                      raw_pwr_cl_52_195;      /* 200 */
+        u8                      raw_pwr_cl_26_195;      /* 201 */
+        u8                      raw_pwr_cl_52_360;      /* 202 */
+        u8                      raw_pwr_cl_26_360;      /* 203 */
+        u8                      raw_s_a_timeout;        /* 217 */
         u8                      raw_hc_erase_gap_size;  /* 221 */
         u8                      raw_erase_timeout_mult; /* 223 */
         u8                      raw_hc_erase_grp_size;  /* 224 */
@@ -102,6 +106,10 @@ struct mmc_ext_csd {
         u8                      raw_sec_erase_mult;     /* 230 */
         u8                      raw_sec_feature_support;/* 231 */
         u8                      raw_trim_mult;          /* 232 */
+        u8                      raw_pwr_cl_200_195;     /* 236 */
+        u8                      raw_pwr_cl_200_360;     /* 237 */
+        u8                      raw_pwr_cl_ddr_52_195;  /* 238 */
+        u8                      raw_pwr_cl_ddr_52_360;  /* 239 */
         u8                      raw_bkops_status;       /* 246 */
         u8                      raw_sectors[4];         /* 212 - 4 bytes */
 
@@ -512,6 +520,7 @@ struct mmc_driver {
         void (*remove)(struct mmc_card *);
         int (*suspend)(struct mmc_card *);
         int (*resume)(struct mmc_card *);
+        void (*shutdown)(struct mmc_card *);
 };
 
 extern int mmc_register_driver(struct mmc_driver *);
diff --git a/include/linux/mmc/core.h b/include/linux/mmc/core.h
index 39613b9a6fc5..443243b241d5 100644
--- a/include/linux/mmc/core.h
+++ b/include/linux/mmc/core.h
@@ -96,6 +96,8 @@ struct mmc_command {
  */
 
         unsigned int            cmd_timeout_ms; /* in milliseconds */
+        /* Set this flag only for blocking sanitize request */
+        bool                    sanitize_busy;
 
         struct mmc_data         *data;          /* data segment associated with cmd */
         struct mmc_request      *mrq;           /* associated request */
@@ -188,6 +190,9 @@ extern int __mmc_claim_host(struct mmc_host *host, atomic_t *abort);
 extern void mmc_release_host(struct mmc_host *host);
 extern int mmc_try_claim_host(struct mmc_host *host);
 
+extern void mmc_get_card(struct mmc_card *card);
+extern void mmc_put_card(struct mmc_card *card);
+
 extern int mmc_flush_cache(struct mmc_card *);
 
 extern int mmc_detect_card_removed(struct mmc_host *host);
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index e326ae2882a0..3b0c33ae13e1 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -239,7 +239,7 @@ struct mmc_host {
 #define MMC_CAP_SPI             (1 << 4)        /* Talks only SPI protocols */
 #define MMC_CAP_NEEDS_POLL      (1 << 5)        /* Needs polling for card-detection */
 #define MMC_CAP_8_BIT_DATA      (1 << 6)        /* Can the host do 8 bit transfers */
-
+#define MMC_CAP_AGGRESSIVE_PM   (1 << 7)        /* Suspend (e)MMC/SD at idle  */
 #define MMC_CAP_NONREMOVABLE    (1 << 8)        /* Nonremovable e.g. eMMC */
 #define MMC_CAP_WAIT_WHILE_BUSY (1 << 9)        /* Waits while card is busy */
 #define MMC_CAP_ERASE           (1 << 10)       /* Allow erase/trim commands */
@@ -264,7 +264,7 @@ struct mmc_host {
 
 #define MMC_CAP2_BOOTPART_NOACC (1 << 0)        /* Boot partition no access */
 #define MMC_CAP2_CACHE_CTRL     (1 << 1)        /* Allow cache control */
-#define MMC_CAP2_POWEROFF_NOTIFY (1 << 2)       /* Notify poweroff supported */
+#define MMC_CAP2_FULL_PWR_CYCLE (1 << 2)        /* Can do full power cycle */
 #define MMC_CAP2_NO_MULTI_READ  (1 << 3)        /* Multiblock reads don't work */
 #define MMC_CAP2_NO_SLEEP_CMD   (1 << 4)        /* Don't allow sleep command */
 #define MMC_CAP2_HS200_1_8V_SDR (1 << 5)        /* can support */
@@ -272,7 +272,6 @@ struct mmc_host {
 #define MMC_CAP2_HS200          (MMC_CAP2_HS200_1_8V_SDR | \
                                  MMC_CAP2_HS200_1_2V_SDR)
 #define MMC_CAP2_BROKEN_VOLTAGE (1 << 7)        /* Use the broken voltage */
-#define MMC_CAP2_DETECT_ON_ERR  (1 << 8)        /* On I/O err check card removal */
 #define MMC_CAP2_HC_ERASE_SZ    (1 << 9)        /* High-capacity erase size */
 #define MMC_CAP2_CD_ACTIVE_HIGH (1 << 10)       /* Card-detect signal active high */
 #define MMC_CAP2_RO_ACTIVE_HIGH (1 << 11)       /* Write-protect signal active high */
@@ -281,6 +280,7 @@ struct mmc_host {
 #define MMC_CAP2_PACKED_CMD     (MMC_CAP2_PACKED_RD | \
                                  MMC_CAP2_PACKED_WR)
 #define MMC_CAP2_NO_PRESCAN_POWERUP (1 << 14)   /* Don't power up before scan */
+#define MMC_CAP2_SANITIZE       (1 << 15)               /* Support Sanitize */
 
         mmc_pm_flag_t           pm_caps;        /* supported pm features */
 
@@ -369,7 +369,7 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *);
 int mmc_add_host(struct mmc_host *);
 void mmc_remove_host(struct mmc_host *);
 void mmc_free_host(struct mmc_host *);
-void mmc_of_parse(struct mmc_host *host);
+int mmc_of_parse(struct mmc_host *host);
 
 static inline void *mmc_priv(struct mmc_host *host)
 {
@@ -425,10 +425,6 @@ static inline int mmc_regulator_get_supply(struct mmc_host *mmc)
 }
 #endif
 
-int mmc_card_awake(struct mmc_host *host);
-int mmc_card_sleep(struct mmc_host *host);
-int mmc_card_can_sleep(struct mmc_host *host);
-
 int mmc_pm_notify(struct notifier_block *notify_block, unsigned long, void *);
 
 /* Module parameter */
diff --git a/include/linux/mmc/sdhci.h b/include/linux/mmc/sdhci.h
index b838ffc49e4a..e3c6a74d980a 100644
--- a/include/linux/mmc/sdhci.h
+++ b/include/linux/mmc/sdhci.h
@@ -95,6 +95,9 @@ struct sdhci_host {
 /* The system physically doesn't support 1.8v, even if the host does */
 #define SDHCI_QUIRK2_NO_1_8_V                           (1<<2)
 #define SDHCI_QUIRK2_PRESET_VALUE_BROKEN                (1<<3)
+#define SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON               (1<<4)
+/* Controller has a non-standard host control register */
+#define SDHCI_QUIRK2_BROKEN_HOST_CONTROL                (1<<5)
 
         int irq;                /* Device IRQ */
         void __iomem *ioaddr;   /* Mapped address */
@@ -126,7 +129,7 @@ struct sdhci_host {
 #define SDHCI_AUTO_CMD23        (1<<7)  /* Auto CMD23 support */
 #define SDHCI_PV_ENABLED        (1<<8)  /* Preset value enabled */
 #define SDHCI_SDIO_IRQ_ENABLED  (1<<9)  /* SDIO irq enabled */
-#define SDHCI_HS200_NEEDS_TUNING (1<<10)        /* HS200 needs tuning */
+#define SDHCI_SDR104_NEEDS_TUNING (1<<10)       /* SDR104/HS200 needs tuning */
 #define SDHCI_USING_RETUNING_TIMER (1<<11)      /* Host is using a retuning timer for the card */
 
         unsigned int version;   /* SDHCI spec. version */
@@ -139,6 +142,7 @@ struct sdhci_host {
         u8 pwr;                 /* Current voltage */
 
         bool runtime_suspended; /* Host is runtime suspended */
+        bool bus_on;            /* Bus power prevents runtime suspend */
 
         struct mmc_request *mrq;        /* Current request */
         struct mmc_command *cmd;        /* Current command */
diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
index 137b4198fc03..27d9da3f86ff 100644
--- a/include/linux/moduleparam.h
+++ b/include/linux/moduleparam.h
@@ -439,7 +439,7 @@ extern struct kernel_param_ops param_ops_string;
 extern int param_set_copystring(const char *val, const struct kernel_param *);
 extern int param_get_string(char *buffer, const struct kernel_param *kp);
 
-/* for exporting parameters in /sys/parameters */
+/* for exporting parameters in /sys/module/.../parameters */
 
 struct module;
 
diff --git a/include/linux/mutex.h b/include/linux/mutex.h
index 3793ed7feeeb..ccd4260834c5 100644
--- a/include/linux/mutex.h
+++ b/include/linux/mutex.h
@@ -78,40 +78,6 @@ struct mutex_waiter {
 #endif
 };
 
-struct ww_class {
-        atomic_long_t stamp;
-        struct lock_class_key acquire_key;
-        struct lock_class_key mutex_key;
-        const char *acquire_name;
-        const char *mutex_name;
-};
-
-struct ww_acquire_ctx {
-        struct task_struct *task;
-        unsigned long stamp;
-        unsigned acquired;
-#ifdef CONFIG_DEBUG_MUTEXES
-        unsigned done_acquire;
-        struct ww_class *ww_class;
-        struct ww_mutex *contending_lock;
-#endif
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-        struct lockdep_map dep_map;
-#endif
-#ifdef CONFIG_DEBUG_WW_MUTEX_SLOWPATH
-        unsigned deadlock_inject_interval;
-        unsigned deadlock_inject_countdown;
-#endif
-};
-
-struct ww_mutex {
-        struct mutex base;
-        struct ww_acquire_ctx *ctx;
-#ifdef CONFIG_DEBUG_MUTEXES
-        struct ww_class *ww_class;
-#endif
-};
-
 #ifdef CONFIG_DEBUG_MUTEXES
 # include <linux/mutex-debug.h>
 #else
@@ -136,11 +102,8 @@ static inline void mutex_destroy(struct mutex *lock) {}
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 # define __DEP_MAP_MUTEX_INITIALIZER(lockname) \
                 , .dep_map = { .name = #lockname }
-# define __WW_CLASS_MUTEX_INITIALIZER(lockname, ww_class) \
-                , .ww_class = &ww_class
 #else
 # define __DEP_MAP_MUTEX_INITIALIZER(lockname)
-# define __WW_CLASS_MUTEX_INITIALIZER(lockname, ww_class)
 #endif
 
 #define __MUTEX_INITIALIZER(lockname) \
@@ -150,49 +113,13 @@ static inline void mutex_destroy(struct mutex *lock) {}
                 __DEBUG_MUTEX_INITIALIZER(lockname) \
                 __DEP_MAP_MUTEX_INITIALIZER(lockname) }
 
-#define __WW_CLASS_INITIALIZER(ww_class) \
-                { .stamp = ATOMIC_LONG_INIT(0) \
-                , .acquire_name = #ww_class "_acquire" \
-                , .mutex_name = #ww_class "_mutex" }
-
-#define __WW_MUTEX_INITIALIZER(lockname, class) \
-                { .base = { \__MUTEX_INITIALIZER(lockname) } \
-                __WW_CLASS_MUTEX_INITIALIZER(lockname, class) }
-
 #define DEFINE_MUTEX(mutexname) \
         struct mutex mutexname = __MUTEX_INITIALIZER(mutexname)
 
-#define DEFINE_WW_CLASS(classname) \
-        struct ww_class classname = __WW_CLASS_INITIALIZER(classname)
-
-#define DEFINE_WW_MUTEX(mutexname, ww_class) \
-        struct ww_mutex mutexname = __WW_MUTEX_INITIALIZER(mutexname, ww_class)
-
-
 extern void __mutex_init(struct mutex *lock, const char *name,
                          struct lock_class_key *key);
 
 /**
- * ww_mutex_init - initialize the w/w mutex
- * @lock: the mutex to be initialized
- * @ww_class: the w/w class the mutex should belong to
- *
- * Initialize the w/w mutex to unlocked state and associate it with the given
- * class.
- *
- * It is not allowed to initialize an already locked mutex.
- */
-static inline void ww_mutex_init(struct ww_mutex *lock,
-                                 struct ww_class *ww_class)
-{
-        __mutex_init(&lock->base, ww_class->mutex_name, &ww_class->mutex_key);
-        lock->ctx = NULL;
-#ifdef CONFIG_DEBUG_MUTEXES
-        lock->ww_class = ww_class;
-#endif
-}
-
-/**
  * mutex_is_locked - is the mutex locked
  * @lock: the mutex to be queried
  *
@@ -246,291 +173,6 @@ extern int __must_check mutex_lock_killable(struct mutex *lock);
 extern int mutex_trylock(struct mutex *lock);
 extern void mutex_unlock(struct mutex *lock);
 
-/**
- * ww_acquire_init - initialize a w/w acquire context
- * @ctx: w/w acquire context to initialize
- * @ww_class: w/w class of the context
- *
- * Initializes an context to acquire multiple mutexes of the given w/w class.
- *
- * Context-based w/w mutex acquiring can be done in any order whatsoever within
- * a given lock class. Deadlocks will be detected and handled with the
- * wait/wound logic.
- *
- * Mixing of context-based w/w mutex acquiring and single w/w mutex locking can
- * result in undetected deadlocks and is so forbidden. Mixing different contexts
- * for the same w/w class when acquiring mutexes can also result in undetected
- * deadlocks, and is hence also forbidden. Both types of abuse will be caught by
- * enabling CONFIG_PROVE_LOCKING.
- *
- * Nesting of acquire contexts for _different_ w/w classes is possible, subject
- * to the usual locking rules between different lock classes.
- *
- * An acquire context must be released with ww_acquire_fini by the same task
- * before the memory is freed. It is recommended to allocate the context itself
- * on the stack.
- */
-static inline void ww_acquire_init(struct ww_acquire_ctx *ctx,
-                                   struct ww_class *ww_class)
-{
-        ctx->task = current;
-        ctx->stamp = atomic_long_inc_return(&ww_class->stamp);
-        ctx->acquired = 0;
-#ifdef CONFIG_DEBUG_MUTEXES
-        ctx->ww_class = ww_class;
-        ctx->done_acquire = 0;
-        ctx->contending_lock = NULL;
-#endif
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-        debug_check_no_locks_freed((void *)ctx, sizeof(*ctx));
-        lockdep_init_map(&ctx->dep_map, ww_class->acquire_name,
-                         &ww_class->acquire_key, 0);
-        mutex_acquire(&ctx->dep_map, 0, 0, _RET_IP_);
-#endif
-#ifdef CONFIG_DEBUG_WW_MUTEX_SLOWPATH
-        ctx->deadlock_inject_interval = 1;
-        ctx->deadlock_inject_countdown = ctx->stamp & 0xf;
-#endif
-}
-
-/**
- * ww_acquire_done - marks the end of the acquire phase
- * @ctx: the acquire context
- *
- * Marks the end of the acquire phase, any further w/w mutex lock calls using
- * this context are forbidden.
- *
- * Calling this function is optional, it is just useful to document w/w mutex
- * code and clearly designated the acquire phase from actually using the locked
- * data structures.
- */
-static inline void ww_acquire_done(struct ww_acquire_ctx *ctx)
-{
-#ifdef CONFIG_DEBUG_MUTEXES
-        lockdep_assert_held(ctx);
-
-        DEBUG_LOCKS_WARN_ON(ctx->done_acquire);
-        ctx->done_acquire = 1;
-#endif
-}
-
-/**
- * ww_acquire_fini - releases a w/w acquire context
- * @ctx: the acquire context to free
- *
- * Releases a w/w acquire context. This must be called _after_ all acquired w/w
- * mutexes have been released with ww_mutex_unlock.
- */
-static inline void ww_acquire_fini(struct ww_acquire_ctx *ctx)
-{
-#ifdef CONFIG_DEBUG_MUTEXES
-        mutex_release(&ctx->dep_map, 0, _THIS_IP_);
-
-        DEBUG_LOCKS_WARN_ON(ctx->acquired);
-        if (!config_enabled(CONFIG_PROVE_LOCKING))
-                /*
-                 * lockdep will normally handle this,
-                 * but fail without anyway
-                 */
-                ctx->done_acquire = 1;
-
-        if (!config_enabled(CONFIG_DEBUG_LOCK_ALLOC))
-                /* ensure ww_acquire_fini will still fail if called twice */
-                ctx->acquired = ~0U;
-#endif
-}
-
-extern int __must_check __ww_mutex_lock(struct ww_mutex *lock,
-                                        struct ww_acquire_ctx *ctx);
-extern int __must_check __ww_mutex_lock_interruptible(struct ww_mutex *lock,
-                                                      struct ww_acquire_ctx *ctx);
-
-/**
- * ww_mutex_lock - acquire the w/w mutex
- * @lock: the mutex to be acquired
- * @ctx: w/w acquire context, or NULL to acquire only a single lock.
- *
- * Lock the w/w mutex exclusively for this task.
- *
- * Deadlocks within a given w/w class of locks are detected and handled with the
- * wait/wound algorithm. If the lock isn't immediately avaiable this function
- * will either sleep until it is (wait case). Or it selects the current context
- * for backing off by returning -EDEADLK (wound case). Trying to acquire the
- * same lock with the same context twice is also detected and signalled by
- * returning -EALREADY. Returns 0 if the mutex was successfully acquired.
- *
- * In the wound case the caller must release all currently held w/w mutexes for
- * the given context and then wait for this contending lock to be available by
- * calling ww_mutex_lock_slow. Alternatively callers can opt to not acquire this
- * lock and proceed with trying to acquire further w/w mutexes (e.g. when
- * scanning through lru lists trying to free resources).
- *
- * The mutex must later on be released by the same task that
- * acquired it. The task may not exit without first unlocking the mutex. Also,
- * kernel memory where the mutex resides must not be freed with the mutex still
- * locked. The mutex must first be initialized (or statically defined) before it
- * can be locked. memset()-ing the mutex to 0 is not allowed. The mutex must be
- * of the same w/w lock class as was used to initialize the acquire context.
- *
- * A mutex acquired with this function must be released with ww_mutex_unlock.
- */
-static inline int ww_mutex_lock(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
-{
-        if (ctx)
-                return __ww_mutex_lock(lock, ctx);
-        else {
-                mutex_lock(&lock->base);
-                return 0;
-        }
-}
-
-/**
- * ww_mutex_lock_interruptible - acquire the w/w mutex, interruptible
- * @lock: the mutex to be acquired
- * @ctx: w/w acquire context
- *
- * Lock the w/w mutex exclusively for this task.
- *
- * Deadlocks within a given w/w class of locks are detected and handled with the
- * wait/wound algorithm. If the lock isn't immediately avaiable this function
- * will either sleep until it is (wait case). Or it selects the current context
- * for backing off by returning -EDEADLK (wound case). Trying to acquire the
- * same lock with the same context twice is also detected and signalled by
- * returning -EALREADY. Returns 0 if the mutex was successfully acquired. If a
- * signal arrives while waiting for the lock then this function returns -EINTR.
- *
- * In the wound case the caller must release all currently held w/w mutexes for
- * the given context and then wait for this contending lock to be available by
- * calling ww_mutex_lock_slow_interruptible. Alternatively callers can opt to
- * not acquire this lock and proceed with trying to acquire further w/w mutexes
- * (e.g. when scanning through lru lists trying to free resources).
- *
- * The mutex must later on be released by the same task that
- * acquired it. The task may not exit without first unlocking the mutex. Also,
- * kernel memory where the mutex resides must not be freed with the mutex still
- * locked. The mutex must first be initialized (or statically defined) before it
- * can be locked. memset()-ing the mutex to 0 is not allowed. The mutex must be
- * of the same w/w lock class as was used to initialize the acquire context.
- *
- * A mutex acquired with this function must be released with ww_mutex_unlock.
- */
-static inline int __must_check ww_mutex_lock_interruptible(struct ww_mutex *lock,
-                                                           struct ww_acquire_ctx *ctx)
-{
-        if (ctx)
-                return __ww_mutex_lock_interruptible(lock, ctx);
-        else
-                return mutex_lock_interruptible(&lock->base);
-}
-
-/**
- * ww_mutex_lock_slow - slowpath acquiring of the w/w mutex
- * @lock: the mutex to be acquired
- * @ctx: w/w acquire context
- *
- * Acquires a w/w mutex with the given context after a wound case. This function
- * will sleep until the lock becomes available.
- *
- * The caller must have released all w/w mutexes already acquired with the
- * context and then call this function on the contended lock.
- *
- * Afterwards the caller may continue to (re)acquire the other w/w mutexes it
- * needs with ww_mutex_lock. Note that the -EALREADY return code from
- * ww_mutex_lock can be used to avoid locking this contended mutex twice.
- *
- * It is forbidden to call this function with any other w/w mutexes associated
- * with the context held. It is forbidden to call this on anything else than the
- * contending mutex.
- *
- * Note that the slowpath lock acquiring can also be done by calling
- * ww_mutex_lock directly. This function here is simply to help w/w mutex
- * locking code readability by clearly denoting the slowpath.
- */
-static inline void
-ww_mutex_lock_slow(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
-{
-        int ret;
-#ifdef CONFIG_DEBUG_MUTEXES
-        DEBUG_LOCKS_WARN_ON(!ctx->contending_lock);
-#endif
-        ret = ww_mutex_lock(lock, ctx);
-        (void)ret;
-}
-
-/**
- * ww_mutex_lock_slow_interruptible - slowpath acquiring of the w/w mutex,
- *                                    interruptible
- * @lock: the mutex to be acquired
- * @ctx: w/w acquire context
- *
- * Acquires a w/w mutex with the given context after a wound case. This function
- * will sleep until the lock becomes available and returns 0 when the lock has
- * been acquired. If a signal arrives while waiting for the lock then this
- * function returns -EINTR.
- *
- * The caller must have released all w/w mutexes already acquired with the
- * context and then call this function on the contended lock.
- *
- * Afterwards the caller may continue to (re)acquire the other w/w mutexes it
- * needs with ww_mutex_lock. Note that the -EALREADY return code from
- * ww_mutex_lock can be used to avoid locking this contended mutex twice.
- *
- * It is forbidden to call this function with any other w/w mutexes associated
- * with the given context held. It is forbidden to call this on anything else
- * than the contending mutex.
- *
- * Note that the slowpath lock acquiring can also be done by calling
- * ww_mutex_lock_interruptible directly. This function here is simply to help
- * w/w mutex locking code readability by clearly denoting the slowpath.
- */
-static inline int __must_check
-ww_mutex_lock_slow_interruptible(struct ww_mutex *lock,
-                                 struct ww_acquire_ctx *ctx)
-{
-#ifdef CONFIG_DEBUG_MUTEXES
-        DEBUG_LOCKS_WARN_ON(!ctx->contending_lock);
-#endif
-        return ww_mutex_lock_interruptible(lock, ctx);
-}
-
-extern void ww_mutex_unlock(struct ww_mutex *lock);
-
-/**
- * ww_mutex_trylock - tries to acquire the w/w mutex without acquire context
- * @lock: mutex to lock
- *
- * Trylocks a mutex without acquire context, so no deadlock detection is
- * possible. Returns 1 if the mutex has been acquired successfully, 0 otherwise.
- */
-static inline int __must_check ww_mutex_trylock(struct ww_mutex *lock)
-{
-        return mutex_trylock(&lock->base);
-}
-
-/***
- * ww_mutex_destroy - mark a w/w mutex unusable
- * @lock: the mutex to be destroyed
- *
- * This function marks the mutex uninitialized, and any subsequent
- * use of the mutex is forbidden. The mutex must not be locked when
- * this function is called.
- */
-static inline void ww_mutex_destroy(struct ww_mutex *lock)
-{
-        mutex_destroy(&lock->base);
-}
-
-/**
- * ww_mutex_is_locked - is the w/w mutex locked
- * @lock: the mutex to be queried
- *
- * Returns 1 if the mutex is locked, 0 if unlocked.
- */
-static inline bool ww_mutex_is_locked(struct ww_mutex *lock)
-{
-        return mutex_is_locked(&lock->base);
-}
-
 extern int atomic_dec_and_mutex_lock(atomic_t *cnt, struct mutex *lock);
 
 #ifndef CONFIG_HAVE_ARCH_MUTEX_CPU_RELAX
diff --git a/include/linux/mv643xx_eth.h b/include/linux/mv643xx_eth.h
index 141d395bbb5f..6e8215b15998 100644
--- a/include/linux/mv643xx_eth.h
+++ b/include/linux/mv643xx_eth.h
@@ -30,6 +30,7 @@ struct mv643xx_eth_shared_platform_data {
 #define MV643XX_ETH_PHY_ADDR(x)         (0x80 | (x))
 #define MV643XX_ETH_PHY_NONE            0xff
 
+struct device_node;
 struct mv643xx_eth_platform_data {
         /*
          * Pointer back to our parent instance, and our port number.
@@ -41,6 +42,7 @@ struct mv643xx_eth_platform_data {
          * Whether a PHY is present, and if yes, at which address.
          */
         int                     phy_addr;
+        struct device_node      *phy_node;
 
         /*
          * Use this MAC address if it is valid, overriding the
diff --git a/include/linux/net.h b/include/linux/net.h
index 99c9f0c103c2..4f27575ce1d6 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -79,9 +79,9 @@ enum sock_type {
 #endif /* ARCH_HAS_SOCKET_TYPES */
 
 enum sock_shutdown_cmd {
-        SHUT_RD         = 0,
-        SHUT_WR         = 1,
-        SHUT_RDWR       = 2,
+        SHUT_RD,
+        SHUT_WR,
+        SHUT_RDWR,
 };
 
 struct socket_wq {
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 09906b7ca47d..a2a89a5c7be5 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -43,8 +43,9 @@ enum {
         NETIF_F_FSO_BIT,                /* ... FCoE segmentation */
         NETIF_F_GSO_GRE_BIT,            /* ... GRE with TSO */
         NETIF_F_GSO_UDP_TUNNEL_BIT,     /* ... UDP TUNNEL with TSO */
+        NETIF_F_GSO_MPLS_BIT,           /* ... MPLS segmentation */
         /**/NETIF_F_GSO_LAST =          /* last bit, see GSO_MASK */
-                NETIF_F_GSO_UDP_TUNNEL_BIT,
+                NETIF_F_GSO_MPLS_BIT,
 
         NETIF_F_FCOE_CRC_BIT,           /* FCoE CRC32 */
         NETIF_F_SCTP_CSUM_BIT,          /* SCTP checksum offload */
@@ -107,6 +108,7 @@ enum {
 #define NETIF_F_RXALL           __NETIF_F(RXALL)
 #define NETIF_F_GSO_GRE         __NETIF_F(GSO_GRE)
 #define NETIF_F_GSO_UDP_TUNNEL  __NETIF_F(GSO_UDP_TUNNEL)
+#define NETIF_F_GSO_MPLS        __NETIF_F(GSO_MPLS)
 #define NETIF_F_HW_VLAN_STAG_FILTER __NETIF_F(HW_VLAN_STAG_FILTER)
 #define NETIF_F_HW_VLAN_STAG_RX __NETIF_F(HW_VLAN_STAG_RX)
 #define NETIF_F_HW_VLAN_STAG_TX __NETIF_F(HW_VLAN_STAG_TX)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 96e4c21e15e0..0741a1e919a5 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -324,12 +324,15 @@ struct napi_struct {
         struct sk_buff          *gro_list;
         struct sk_buff          *skb;
         struct list_head        dev_list;
+        struct hlist_node       napi_hash_node;
+        unsigned int            napi_id;
 };
 
 enum {
         NAPI_STATE_SCHED,       /* Poll is scheduled */
         NAPI_STATE_DISABLE,     /* Disable pending */
         NAPI_STATE_NPSVC,       /* Netpoll - don't dequeue from poll_list */
+        NAPI_STATE_HASHED,      /* In NAPI hash */
 };
 
 enum gro_result {
@@ -446,6 +449,32 @@ extern void __napi_complete(struct napi_struct *n);
 extern void napi_complete(struct napi_struct *n);
 
 /**
+ *      napi_by_id - lookup a NAPI by napi_id
+ *      @napi_id: hashed napi_id
+ *
+ * lookup @napi_id in napi_hash table
+ * must be called under rcu_read_lock()
+ */
+extern struct napi_struct *napi_by_id(unsigned int napi_id);
+
+/**
+ *      napi_hash_add - add a NAPI to global hashtable
+ *      @napi: napi context
+ *
+ * generate a new napi_id and store a @napi under it in napi_hash
+ */
+extern void napi_hash_add(struct napi_struct *napi);
+
+/**
+ *      napi_hash_del - remove a NAPI from global table
+ *      @napi: napi context
+ *
+ * Warning: caller must observe rcu grace period
+ * before freeing memory containing @napi
+ */
+extern void napi_hash_del(struct napi_struct *napi);
+
+/**
  *      napi_disable - prevent NAPI from scheduling
  *      @n: napi context
  *
@@ -800,6 +829,7 @@ struct netdev_fcoe_hbainfo {
  * int (*ndo_set_vf_spoofchk)(struct net_device *dev, int vf, bool setting);
  * int (*ndo_get_vf_config)(struct net_device *dev,
  *                          int vf, struct ifla_vf_info *ivf);
+ * int (*ndo_set_vf_link_state)(struct net_device *dev, int vf, int link_state);
  * int (*ndo_set_vf_port)(struct net_device *dev, int vf,
  *                        struct nlattr *port[]);
  * int (*ndo_get_vf_port)(struct net_device *dev, int vf, struct sk_buff *skb);
@@ -943,6 +973,9 @@ struct net_device_ops {
                                                      gfp_t gfp);
         void                    (*ndo_netpoll_cleanup)(struct net_device *dev);
 #endif
+#ifdef CONFIG_NET_LL_RX_POLL
+        int                     (*ndo_busy_poll)(struct napi_struct *dev);
+#endif
         int                     (*ndo_set_vf_mac)(struct net_device *dev,
                                                   int queue, u8 *mac);
         int                     (*ndo_set_vf_vlan)(struct net_device *dev,
@@ -954,6 +987,8 @@ struct net_device_ops {
         int                     (*ndo_get_vf_config)(struct net_device *dev,
                                                      int vf,
                                                      struct ifla_vf_info *ivf);
+        int                     (*ndo_set_vf_link_state)(struct net_device *dev,
+                                                         int vf, int link_state);
         int                     (*ndo_set_vf_port)(struct net_device *dev,
                                                    int vf,
                                                    struct nlattr *port[]);
@@ -1088,6 +1123,8 @@ struct net_device {
          * need to set them appropriately.
          */
         netdev_features_t       hw_enc_features;
+        /* mask of fetures inheritable by MPLS */
+        netdev_features_t       mpls_features;
 
         /* Interface index. Unique device identifier    */
         int                     ifindex;
@@ -1140,8 +1177,10 @@ struct net_device {
         unsigned char           addr_assign_type; /* hw address assignment type */
         unsigned char           addr_len;       /* hardware address length      */
         unsigned char           neigh_priv_len;
-        unsigned short          dev_id;         /* for shared network cards */
-
+        unsigned short          dev_id;         /* Used to differentiate devices
+                                                 * that share the same link
+                                                 * layer address
+                                                 */
         spinlock_t              addr_list_lock;
         struct netdev_hw_addr_list      uc;     /* Unicast mac addresses */
         struct netdev_hw_addr_list      mc;     /* Multicast mac addresses */
@@ -1593,9 +1632,34 @@ struct packet_offload {
 #define NETDEV_RELEASE          0x0012
 #define NETDEV_NOTIFY_PEERS     0x0013
 #define NETDEV_JOIN             0x0014
+#define NETDEV_CHANGEUPPER      0x0015
 
 extern int register_netdevice_notifier(struct notifier_block *nb);
 extern int unregister_netdevice_notifier(struct notifier_block *nb);
+
+struct netdev_notifier_info {
+        struct net_device *dev;
+};
+
+struct netdev_notifier_change_info {
+        struct netdev_notifier_info info; /* must be first */
+        unsigned int flags_changed;
+};
+
+static inline void netdev_notifier_info_init(struct netdev_notifier_info *info,
+                                             struct net_device *dev)
+{
+        info->dev = dev;
+}
+
+static inline struct net_device *
+netdev_notifier_info_to_dev(const struct netdev_notifier_info *info)
+{
+        return info->dev;
+}
+
+extern int call_netdevice_notifiers_info(unsigned long val, struct net_device *dev,
+                                         struct netdev_notifier_info *info);
 extern int call_netdevice_notifiers(unsigned long val, struct net_device *dev);
 
 
@@ -1779,6 +1843,19 @@ static inline int unregister_gifconf(unsigned int family)
         return register_gifconf(family, NULL);
 }
 
+#ifdef CONFIG_NET_FLOW_LIMIT
+#define FLOW_LIMIT_HISTORY      (1 << 7)  /* must be ^2 and !overflow buckets */
+struct sd_flow_limit {
+        u64                     count;
+        unsigned int            num_buckets;
+        unsigned int            history_head;
+        u16                     history[FLOW_LIMIT_HISTORY];
+        u8                      buckets[];
+};
+
+extern int netdev_flow_limit_table_len;
+#endif /* CONFIG_NET_FLOW_LIMIT */
+
 /*
  * Incoming packets are placed on per-cpu queues
  */
@@ -1808,6 +1885,10 @@ struct softnet_data {
         unsigned int            dropped;
         struct sk_buff_head     input_pkt_queue;
         struct napi_struct      backlog;
+
+#ifdef CONFIG_NET_FLOW_LIMIT
+        struct sd_flow_limit __rcu *flow_limit;
+#endif
 };
 
 static inline void input_queue_head_incr(struct softnet_data *sd)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 0060fde3160e..de70f7b45b68 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -35,7 +35,7 @@ static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
         result->all[3] = a1->all[3] & mask->all[3];
 }
 
-extern void netfilter_init(void);
+extern int netfilter_init(void);
 
 /* Largest hook number + 1 */
 #define NF_MAX_HOOKS 8
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 6358da5eeee8..7a6c396a263b 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -46,6 +46,7 @@ struct netlink_kernel_cfg {
         void            (*input)(struct sk_buff *skb);
         struct mutex    *cb_mutex;
         void            (*bind)(int group);
+        bool            (*compare)(struct net *net, struct sock *sk);
 };
 
 extern struct sock *__netlink_kernel_create(struct net *net, int unit,
@@ -84,6 +85,22 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
 void netlink_detachskb(struct sock *sk, struct sk_buff *skb);
 int netlink_sendskb(struct sock *sk, struct sk_buff *skb);
 
+static inline struct sk_buff *
+netlink_skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
+{
+        struct sk_buff *nskb;
+
+        nskb = skb_clone(skb, gfp_mask);
+        if (!nskb)
+                return NULL;
+
+        /* This is a large skb, set destructor callback to release head */
+        if (is_vmalloc_addr(skb->head))
+                nskb->destructor = skb->destructor;
+
+        return nskb;
+}
+
 /*
  *      skb should fit one page. This choice is good for headerless malloc.
  *      But we should limit to 8K so that userspace does not have to
@@ -144,4 +161,14 @@ static inline int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         return __netlink_dump_start(ssk, skb, nlh, control);
 }
 
+struct netlink_tap {
+        struct net_device *dev;
+        struct module *module;
+        struct list_head list;
+};
+
+extern int netlink_add_tap(struct netlink_tap *nt);
+extern int __netlink_remove_tap(struct netlink_tap *nt);
+extern int netlink_remove_tap(struct netlink_tap *nt);
+
 #endif  /* __LINUX_NETLINK_H */
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index fa2cb76a7029..f3c7c24bec1c 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -53,10 +53,10 @@ struct netpoll_info {
 };
 
 #ifdef CONFIG_NETPOLL
-extern int netpoll_rx_disable(struct net_device *dev);
+extern void netpoll_rx_disable(struct net_device *dev);
 extern void netpoll_rx_enable(struct net_device *dev);
 #else
-static inline int netpoll_rx_disable(struct net_device *dev) { return 0; }
+static inline void netpoll_rx_disable(struct net_device *dev) { return; }
 static inline void netpoll_rx_enable(struct net_device *dev) { return; }
 #endif
 
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 0b176297aaf6..7125cef74164 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -348,6 +348,7 @@ extern int nfs_permission(struct inode *, int);
 extern int nfs_open(struct inode *, struct file *);
 extern int nfs_release(struct inode *, struct file *);
 extern int nfs_attribute_timeout(struct inode *inode);
+extern int nfs_attribute_cache_expired(struct inode *inode);
 extern int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode);
 extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index db50840e6355..6a45fb583ff1 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -46,7 +46,7 @@ static inline bool trigger_all_cpu_backtrace(void)
 #ifdef CONFIG_LOCKUP_DETECTOR
 int hw_nmi_is_cpu_stuck(struct pt_regs *);
 u64 hw_nmi_get_sample_period(int watchdog_thresh);
-extern int watchdog_enabled;
+extern int watchdog_user_enabled;
 extern int watchdog_thresh;
 struct ctl_table;
 extern int proc_dowatchdog(struct ctl_table *, int ,
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 8873f82c7baa..c43f6eabad5b 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -826,7 +826,7 @@ static inline void perf_restore_debug_store(void)			{ }
  */
 #define perf_cpu_notifier(fn)                                           \
 do {                                                                    \
-        static struct notifier_block fn##_nb __cpuinitdata =            \
+        static struct notifier_block fn##_nb =                          \
                 { .notifier_call = fn, .priority = CPU_PRI_PERF };      \
         unsigned long cpu = smp_processor_id();                         \
         unsigned long flags;                                            \
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 9e11039dd7a3..64ab823f7b74 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -49,6 +49,7 @@
 
 #define PHY_HAS_INTERRUPT       0x00000001
 #define PHY_HAS_MAGICANEG       0x00000002
+#define PHY_IS_INTERNAL         0x00000004
 
 /* Interface Mode definitions */
 typedef enum {
@@ -57,6 +58,7 @@ typedef enum {
         PHY_INTERFACE_MODE_GMII,
         PHY_INTERFACE_MODE_SGMII,
         PHY_INTERFACE_MODE_TBI,
+        PHY_INTERFACE_MODE_REVMII,
         PHY_INTERFACE_MODE_RMII,
         PHY_INTERFACE_MODE_RGMII,
         PHY_INTERFACE_MODE_RGMII_ID,
@@ -261,6 +263,7 @@ struct phy_c45_device_ids {
  * phy_id: UID for this device found during discovery
  * c45_ids: 802.3-c45 Device Identifers if is_c45.
  * is_c45:  Set to true if this phy uses clause 45 addressing.
+ * is_internal: Set to true if this phy is internal to a MAC.
  * state: state of the PHY for management purposes
  * dev_flags: Device-specific flags used by the PHY driver.
  * addr: Bus address of PHY
@@ -298,6 +301,7 @@ struct phy_device {
 
         struct phy_c45_device_ids c45_ids;
         bool is_c45;
+        bool is_internal;
 
         enum phy_state state;
 
@@ -508,6 +512,27 @@ static inline int phy_write(struct phy_device *phydev, u32 regnum, u16 val)
         return mdiobus_write(phydev->bus, phydev->addr, regnum, val);
 }
 
+/**
+ * phy_interrupt_is_valid - Convenience function for testing a given PHY irq
+ * @phydev: the phy_device struct
+ *
+ * NOTE: must be kept in sync with addition/removal of PHY_POLL and
+ * PHY_IGNORE_INTERRUPT
+ */
+static inline bool phy_interrupt_is_valid(struct phy_device *phydev)
+{
+        return phydev->irq != PHY_POLL && phydev->irq != PHY_IGNORE_INTERRUPT;
+}
+
+/**
+ * phy_is_internal - Convenience function for testing if a PHY is internal
+ * @phydev: the phy_device struct
+ */
+static inline bool phy_is_internal(struct phy_device *phydev)
+{
+        return phydev->is_internal;
+}
+
 struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
                 bool is_c45, struct phy_c45_device_ids *c45_ids);
 struct phy_device *get_phy_device(struct mii_bus *bus, int addr, bool is_c45);
@@ -545,6 +570,8 @@ void phy_drivers_unregister(struct phy_driver *drv, int n);
 int phy_driver_register(struct phy_driver *new_driver);
 int phy_drivers_register(struct phy_driver *new_driver, int n);
 void phy_state_machine(struct work_struct *work);
+void phy_change(struct work_struct *work);
+void phy_mac_interrupt(struct phy_device *phydev, int new_link);
 void phy_start_machine(struct phy_device *phydev,
                 void (*handler)(struct net_device *));
 void phy_stop_machine(struct phy_device *phydev);
diff --git a/include/linux/platform_data/brcmfmac-sdio.h b/include/linux/platform_data/brcmfmac-sdio.h
index 1ade657d5fc1..b7174998c24a 100644
--- a/include/linux/platform_data/brcmfmac-sdio.h
+++ b/include/linux/platform_data/brcmfmac-sdio.h
@@ -90,6 +90,10 @@ void __init brcmfmac_init_pdata(void)
  * oob_irq_nr, oob_irq_flags: the OOB interrupt information. The values are
  * used for registering the irq using request_irq function.
  *
+ * broken_sg_support: flag for broken sg list support of SDIO host controller.
+ * Set this to true if the SDIO host controller has higher align requirement
+ * than 32 bytes for each scatterlist item.
+ *
  * power_on: This function is called by the brcmfmac when the module gets
  * loaded. This can be particularly useful for low power devices. The platform
  * spcific routine may for example decide to power up the complete device.
@@ -116,6 +120,7 @@ struct brcmfmac_sdio_platform_data {
         bool oob_irq_supported;
         unsigned int oob_irq_nr;
         unsigned long oob_irq_flags;
+        bool broken_sg_support;
         void (*power_on)(void);
         void (*power_off)(void);
         void (*reset)(void);
diff --git a/include/linux/platform_data/mmc-esdhc-imx.h b/include/linux/platform_data/mmc-esdhc-imx.h
index b4a0521ce411..d44912d81578 100644
--- a/include/linux/platform_data/mmc-esdhc-imx.h
+++ b/include/linux/platform_data/mmc-esdhc-imx.h
@@ -40,5 +40,6 @@ struct esdhc_platform_data {
         enum wp_types wp_type;
         enum cd_types cd_type;
         int max_bus_width;
+        unsigned int f_max;
 };
 #endif /* __ASM_ARCH_IMX_ESDHC_H */
diff --git a/include/linux/platform_data/net-cw1200.h b/include/linux/platform_data/net-cw1200.h
new file mode 100644
index 000000000000..c6fbc3ce4ab0
--- /dev/null
+++ b/include/linux/platform_data/net-cw1200.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) ST-Ericsson SA 2011
+ *
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ * License terms: GNU General Public License (GPL) version 2
+ */
+
+#ifndef CW1200_PLAT_H_INCLUDED
+#define CW1200_PLAT_H_INCLUDED
+
+struct cw1200_platform_data_spi {
+        u8 spi_bits_per_word;           /* REQUIRED */
+        u16 ref_clk;                    /* REQUIRED (in KHz) */
+
+        /* All others are optional */
+        bool have_5ghz;
+        int reset;                     /* GPIO to RSTn signal (0 disables) */
+        int powerup;                   /* GPIO to POWERUP signal (0 disables) */
+        int (*power_ctrl)(const struct cw1200_platform_data_spi *pdata,
+                          bool enable); /* Control 3v3 / 1v8 supply */
+        int (*clk_ctrl)(const struct cw1200_platform_data_spi *pdata,
+                        bool enable); /* Control CLK32K */
+        const u8 *macaddr;  /* if NULL, use cw1200_mac_template module parameter */
+        const char *sdd_file;  /* if NULL, will use default for detected hw type */
+};
+
+struct cw1200_platform_data_sdio {
+        u16 ref_clk;                    /* REQUIRED (in KHz) */
+
+        /* All others are optional */
+        bool have_5ghz;
+        bool no_nptb;       /* SDIO hardware does not support non-power-of-2-blocksizes */
+        int reset;          /* GPIO to RSTn signal (0 disables) */
+        int powerup;        /* GPIO to POWERUP signal (0 disables) */
+        int irq;            /* IRQ line or 0 to use SDIO IRQ */
+        int (*power_ctrl)(const struct cw1200_platform_data_sdio *pdata,
+                          bool enable); /* Control 3v3 / 1v8 supply */
+        int (*clk_ctrl)(const struct cw1200_platform_data_sdio *pdata,
+                        bool enable); /* Control CLK32K */
+        const u8 *macaddr;  /* if NULL, use cw1200_mac_template module parameter */
+        const char *sdd_file;  /* if NULL, will use default for detected hw type */
+};
+
+
+/* An example of SPI support in your board setup file:
+
+   static struct cw1200_platform_data_spi cw1200_platform_data = {
+       .ref_clk = 38400,
+       .spi_bits_per_word = 16,
+       .reset = GPIO_RF_RESET,
+       .powerup = GPIO_RF_POWERUP,
+       .macaddr = wifi_mac_addr,
+       .sdd_file = "sdd_sagrad_1091_1098.bin",
+  };
+  static struct spi_board_info myboard_spi_devices[] __initdata = {
+       {
+               .modalias = "cw1200_wlan_spi",
+               .max_speed_hz = 52000000,
+               .bus_num = 0,
+               .irq = WIFI_IRQ,
+               .platform_data = &cw1200_platform_data,
+               .chip_select = 0,
+       },
+  };
+
+ */
+
+/* An example of SDIO support in your board setup file:
+
+  static struct cw1200_platform_data_sdio my_cw1200_platform_data = {
+        .ref_clk = 38400,
+        .have_5ghz = false,
+        .sdd_file = "sdd_myplatform.bin",
+  };
+  cw1200_sdio_set_platform_data(&my_cw1200_platform_data);
+
+ */
+
+void __init cw1200_sdio_set_platform_data(struct cw1200_platform_data_sdio *pdata);
+
+#endif /* CW1200_PLAT_H_INCLUDED */
diff --git a/include/linux/platform_data/pwm-renesas-tpu.h b/include/linux/platform_data/pwm-renesas-tpu.h
new file mode 100644
index 000000000000..a7220b10ddab
--- /dev/null
+++ b/include/linux/platform_data/pwm-renesas-tpu.h
@@ -0,0 +1,16 @@
+#ifndef __PWM_RENESAS_TPU_H__
+#define __PWM_RENESAS_TPU_H__
+
+#include <linux/pwm.h>
+
+#define TPU_CHANNEL_MAX         4
+
+struct tpu_pwm_channel_data {
+        enum pwm_polarity polarity;
+};
+
+struct tpu_pwm_platform_data {
+        struct tpu_pwm_channel_data channels[TPU_CHANNEL_MAX];
+};
+
+#endif /* __PWM_RENESAS_TPU_H__ */
diff --git a/include/linux/platform_data/rcar-du.h b/include/linux/platform_data/rcar-du.h
new file mode 100644
index 000000000000..80587fdbba3e
--- /dev/null
+++ b/include/linux/platform_data/rcar-du.h
@@ -0,0 +1,54 @@
+/*
+ * rcar_du.h  --  R-Car Display Unit DRM driver
+ *
+ * Copyright (C) 2013 Renesas Corporation
+ *
+ * Contact: Laurent Pinchart (laurent.pinchart@ideasonboard.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __RCAR_DU_H__
+#define __RCAR_DU_H__
+
+#include <drm/drm_mode.h>
+
+enum rcar_du_encoder_type {
+        RCAR_DU_ENCODER_UNUSED = 0,
+        RCAR_DU_ENCODER_VGA,
+        RCAR_DU_ENCODER_LVDS,
+};
+
+struct rcar_du_panel_data {
+        unsigned int width_mm;          /* Panel width in mm */
+        unsigned int height_mm;         /* Panel height in mm */
+        struct drm_mode_modeinfo mode;
+};
+
+struct rcar_du_encoder_lvds_data {
+        struct rcar_du_panel_data panel;
+};
+
+struct rcar_du_encoder_vga_data {
+        /* TODO: Add DDC information for EDID retrieval */
+};
+
+struct rcar_du_encoder_data {
+        enum rcar_du_encoder_type encoder;
+        unsigned int output;
+
+        union {
+                struct rcar_du_encoder_lvds_data lvds;
+                struct rcar_du_encoder_vga_data vga;
+        } u;
+};
+
+struct rcar_du_platform_data {
+        struct rcar_du_encoder_data *encoders;
+        unsigned int num_encoders;
+};
+
+#endif /* __RCAR_DU_H__ */
diff --git a/include/linux/platform_data/remoteproc-omap.h b/include/linux/platform_data/remoteproc-omap.h
index 3c1c6444ec4b..bfbd12b41162 100644
--- a/include/linux/platform_data/remoteproc-omap.h
+++ b/include/linux/platform_data/remoteproc-omap.h
@@ -50,7 +50,7 @@ void __init omap_rproc_reserve_cma(void);
 
 #else
 
-void __init omap_rproc_reserve_cma(void)
+static inline void __init omap_rproc_reserve_cma(void)
 {
 }
 
diff --git a/include/linux/platform_data/ti_am335x_adc.h b/include/linux/platform_data/ti_am335x_adc.h
deleted file mode 100644
index e41d5834cb84..000000000000
--- a/include/linux/platform_data/ti_am335x_adc.h
+++ /dev/null
@@ -1,14 +0,0 @@
-#ifndef __LINUX_TI_AM335X_ADC_H
-#define __LINUX_TI_AM335X_ADC_H
-
-/**
- * struct adc_data      ADC Input information
- * @adc_channels:       Number of analog inputs
- *                      available for ADC.
- */
-
-struct adc_data {
-        unsigned int adc_channels;
-};
-
-#endif
diff --git a/include/linux/pm_wakeup.h b/include/linux/pm_wakeup.h
index 569781faa504..a0f70808d7f4 100644
--- a/include/linux/pm_wakeup.h
+++ b/include/linux/pm_wakeup.h
@@ -36,8 +36,8 @@
  * @last_time: Monotonic clock when the wakeup source's was touched last time.
  * @prevent_sleep_time: Total time this source has been preventing autosleep.
  * @event_count: Number of signaled wakeup events.
- * @active_count: Number of times the wakeup sorce was activated.
- * @relax_count: Number of times the wakeup sorce was deactivated.
+ * @active_count: Number of times the wakeup source was activated.
+ * @relax_count: Number of times the wakeup source was deactivated.
  * @expire_count: Number of times the wakeup source's timeout has expired.
  * @wakeup_count: Number of times the wakeup source might abort suspend.
  * @active: Status of the wakeup source.
diff --git a/include/linux/power_supply.h b/include/linux/power_supply.h
index 3828cefb4f65..804b90643a85 100644
--- a/include/linux/power_supply.h
+++ b/include/linux/power_supply.h
@@ -162,6 +162,8 @@ union power_supply_propval {
         const char *strval;
 };
 
+struct device_node;
+
 struct power_supply {
         const char *name;
         enum power_supply_type type;
@@ -173,9 +175,7 @@ struct power_supply {
 
         char **supplied_from;
         size_t num_supplies;
-#ifdef CONFIG_OF
         struct device_node *of_node;
-#endif
 
         int (*get_property)(struct power_supply *psy,
                             enum power_supply_property psp,
diff --git a/include/linux/pwm.h b/include/linux/pwm.h
index a4df2042b79c..f0feafd184a0 100644
--- a/include/linux/pwm.h
+++ b/include/linux/pwm.h
@@ -76,6 +76,7 @@ enum pwm_polarity {
 enum {
         PWMF_REQUESTED = 1 << 0,
         PWMF_ENABLED = 1 << 1,
+        PWMF_EXPORTED = 1 << 2,
 };
 
 struct pwm_device {
@@ -86,7 +87,9 @@ struct pwm_device {
         struct pwm_chip         *chip;
         void                    *chip_data;
 
-        unsigned int            period; /* in nanoseconds */
+        unsigned int            period;         /* in nanoseconds */
+        unsigned int            duty_cycle;     /* in nanoseconds */
+        enum pwm_polarity       polarity;
 };
 
 static inline void pwm_set_period(struct pwm_device *pwm, unsigned int period)
@@ -100,6 +103,17 @@ static inline unsigned int pwm_get_period(struct pwm_device *pwm)
         return pwm ? pwm->period : 0;
 }
 
+static inline void pwm_set_duty_cycle(struct pwm_device *pwm, unsigned int duty)
+{
+        if (pwm)
+                pwm->duty_cycle = duty;
+}
+
+static inline unsigned int pwm_get_duty_cycle(struct pwm_device *pwm)
+{
+        return pwm ? pwm->duty_cycle : 0;
+}
+
 /*
  * pwm_set_polarity - configure the polarity of a PWM signal
  */
@@ -278,4 +292,17 @@ static inline void pwm_add_table(struct pwm_lookup *table, size_t num)
 }
 #endif
 
+#ifdef CONFIG_PWM_SYSFS
+void pwmchip_sysfs_export(struct pwm_chip *chip);
+void pwmchip_sysfs_unexport(struct pwm_chip *chip);
+#else
+static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+{
+}
+
+static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+{
+}
+#endif /* CONFIG_PWM_SYSFS */
+
 #endif /* __LINUX_PWM_H */
diff --git a/include/linux/reservation.h b/include/linux/reservation.h
new file mode 100644
index 000000000000..813dae960ebd
--- /dev/null
+++ b/include/linux/reservation.h
@@ -0,0 +1,62 @@
+/*
+ * Header file for reservations for dma-buf and ttm
+ *
+ * Copyright(C) 2011 Linaro Limited. All rights reserved.
+ * Copyright (C) 2012-2013 Canonical Ltd
+ * Copyright (C) 2012 Texas Instruments
+ *
+ * Authors:
+ * Rob Clark <rob.clark@linaro.org>
+ * Maarten Lankhorst <maarten.lankhorst@canonical.com>
+ * Thomas Hellstrom <thellstrom-at-vmware-dot-com>
+ *
+ * Based on bo.c which bears the following copyright notice,
+ * but is dual licensed:
+ *
+ * Copyright (c) 2006-2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifndef _LINUX_RESERVATION_H
+#define _LINUX_RESERVATION_H
+
+#include <linux/ww_mutex.h>
+
+extern struct ww_class reservation_ww_class;
+
+struct reservation_object {
+        struct ww_mutex lock;
+};
+
+static inline void
+reservation_object_init(struct reservation_object *obj)
+{
+        ww_mutex_init(&obj->lock, &reservation_ww_class);
+}
+
+static inline void
+reservation_object_fini(struct reservation_object *obj)
+{
+        ww_mutex_destroy(&obj->lock);
+}
+
+#endif /* _LINUX_RESERVATION_H */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 75324d8157e3..50d04b92ceda 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -322,8 +322,6 @@ extern unsigned long
 arch_get_unmapped_area_topdown(struct file *filp, unsigned long addr,
                           unsigned long len, unsigned long pgoff,
                           unsigned long flags);
-extern void arch_unmap_area(struct mm_struct *, unsigned long);
-extern void arch_unmap_area_topdown(struct mm_struct *, unsigned long);
 #else
 static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
 #endif
@@ -2434,6 +2432,15 @@ extern int __cond_resched_softirq(void);
         __cond_resched_softirq();                                       \
 })
 
+static inline void cond_resched_rcu(void)
+{
+#if defined(CONFIG_DEBUG_ATOMIC_SLEEP) || !defined(CONFIG_PREEMPT_RCU)
+        rcu_read_unlock();
+        cond_resched();
+        rcu_read_lock();
+#endif
+}
+
 /*
  * Does a critical section need to be broken due to another
  * task waiting?: (technically does not depend on CONFIG_PREEMPT,
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index dec1748cd002..5afefa01a13c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -319,6 +319,8 @@ enum {
         SKB_GSO_GRE = 1 << 6,
 
         SKB_GSO_UDP_TUNNEL = 1 << 7,
+
+        SKB_GSO_MPLS = 1 << 8,
 };
 
 #if BITS_PER_LONG > 32
@@ -384,11 +386,13 @@ typedef unsigned char *sk_buff_data_t;
  *      @no_fcs:  Request NIC to treat last 4 bytes as Ethernet FCS
  *      @dma_cookie: a cookie to one of several possible DMA operations
  *              done by skb DMA functions
+  *     @napi_id: id of the NAPI struct this skb came from
  *      @secmark: security marking
  *      @mark: Generic packet mark
  *      @dropcount: total number of sk_receive_queue overflows
  *      @vlan_proto: vlan encapsulation protocol
  *      @vlan_tci: vlan tag control information
+ *      @inner_protocol: Protocol (encapsulation)
  *      @inner_transport_header: Inner transport layer header (encapsulation)
  *      @inner_network_header: Network layer header (encapsulation)
  *      @inner_mac_header: Link layer header (encapsulation)
@@ -497,8 +501,11 @@ struct sk_buff {
         /* 7/9 bit hole (depending on ndisc_nodetype presence) */
         kmemcheck_bitfield_end(flags2);
 
-#ifdef CONFIG_NET_DMA
-        dma_cookie_t            dma_cookie;
+#if defined CONFIG_NET_DMA || defined CONFIG_NET_LL_RX_POLL
+        union {
+                unsigned int    napi_id;
+                dma_cookie_t    dma_cookie;
+        };
 #endif
 #ifdef CONFIG_NETWORK_SECMARK
         __u32                   secmark;
@@ -509,12 +516,13 @@ struct sk_buff {
                 __u32           reserved_tailroom;
         };
 
-        sk_buff_data_t          inner_transport_header;
-        sk_buff_data_t          inner_network_header;
-        sk_buff_data_t          inner_mac_header;
-        sk_buff_data_t          transport_header;
-        sk_buff_data_t          network_header;
-        sk_buff_data_t          mac_header;
+        __be16                  inner_protocol;
+        __u16                   inner_transport_header;
+        __u16                   inner_network_header;
+        __u16                   inner_mac_header;
+        __u16                   transport_header;
+        __u16                   network_header;
+        __u16                   mac_header;
         /* These elements must be at the end, see alloc_skb() for details.  */
         sk_buff_data_t          tail;
         sk_buff_data_t          end;
@@ -1388,6 +1396,7 @@ static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset)
         skb_reset_tail_pointer(skb);
         skb->tail += offset;
 }
+
 #else /* NET_SKBUFF_DATA_USES_OFFSET */
 static inline unsigned char *skb_tail_pointer(const struct sk_buff *skb)
 {
@@ -1528,7 +1537,6 @@ static inline void skb_reset_mac_len(struct sk_buff *skb)
         skb->mac_len = skb->network_header - skb->mac_header;
 }
 
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
 static inline unsigned char *skb_inner_transport_header(const struct sk_buff
                                                         *skb)
 {
@@ -1582,7 +1590,7 @@ static inline void skb_set_inner_mac_header(struct sk_buff *skb,
 }
 static inline bool skb_transport_header_was_set(const struct sk_buff *skb)
 {
-        return skb->transport_header != ~0U;
+        return skb->transport_header != (typeof(skb->transport_header))~0U;
 }
 
 static inline unsigned char *skb_transport_header(const struct sk_buff *skb)
@@ -1625,7 +1633,7 @@ static inline unsigned char *skb_mac_header(const struct sk_buff *skb)
 
 static inline int skb_mac_header_was_set(const struct sk_buff *skb)
 {
-        return skb->mac_header != ~0U;
+        return skb->mac_header != (typeof(skb->mac_header))~0U;
 }
 
 static inline void skb_reset_mac_header(struct sk_buff *skb)
@@ -1639,112 +1647,6 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
         skb->mac_header += offset;
 }
 
-#else /* NET_SKBUFF_DATA_USES_OFFSET */
-static inline unsigned char *skb_inner_transport_header(const struct sk_buff
-                                                        *skb)
-{
-        return skb->inner_transport_header;
-}
-
-static inline void skb_reset_inner_transport_header(struct sk_buff *skb)
-{
-        skb->inner_transport_header = skb->data;
-}
-
-static inline void skb_set_inner_transport_header(struct sk_buff *skb,
-                                                   const int offset)
-{
-        skb->inner_transport_header = skb->data + offset;
-}
-
-static inline unsigned char *skb_inner_network_header(const struct sk_buff *skb)
-{
-        return skb->inner_network_header;
-}
-
-static inline void skb_reset_inner_network_header(struct sk_buff *skb)
-{
-        skb->inner_network_header = skb->data;
-}
-
-static inline void skb_set_inner_network_header(struct sk_buff *skb,
-                                                const int offset)
-{
-        skb->inner_network_header = skb->data + offset;
-}
-
-static inline unsigned char *skb_inner_mac_header(const struct sk_buff *skb)
-{
-        return skb->inner_mac_header;
-}
-
-static inline void skb_reset_inner_mac_header(struct sk_buff *skb)
-{
-        skb->inner_mac_header = skb->data;
-}
-
-static inline void skb_set_inner_mac_header(struct sk_buff *skb,
-                                                const int offset)
-{
-        skb->inner_mac_header = skb->data + offset;
-}
-static inline bool skb_transport_header_was_set(const struct sk_buff *skb)
-{
-        return skb->transport_header != NULL;
-}
-
-static inline unsigned char *skb_transport_header(const struct sk_buff *skb)
-{
-        return skb->transport_header;
-}
-
-static inline void skb_reset_transport_header(struct sk_buff *skb)
-{
-        skb->transport_header = skb->data;
-}
-
-static inline void skb_set_transport_header(struct sk_buff *skb,
-                                            const int offset)
-{
-        skb->transport_header = skb->data + offset;
-}
-
-static inline unsigned char *skb_network_header(const struct sk_buff *skb)
-{
-        return skb->network_header;
-}
-
-static inline void skb_reset_network_header(struct sk_buff *skb)
-{
-        skb->network_header = skb->data;
-}
-
-static inline void skb_set_network_header(struct sk_buff *skb, const int offset)
-{
-        skb->network_header = skb->data + offset;
-}
-
-static inline unsigned char *skb_mac_header(const struct sk_buff *skb)
-{
-        return skb->mac_header;
-}
-
-static inline int skb_mac_header_was_set(const struct sk_buff *skb)
-{
-        return skb->mac_header != NULL;
-}
-
-static inline void skb_reset_mac_header(struct sk_buff *skb)
-{
-        skb->mac_header = skb->data;
-}
-
-static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
-{
-        skb->mac_header = skb->data + offset;
-}
-#endif /* NET_SKBUFF_DATA_USES_OFFSET */
-
 static inline void skb_probe_transport_header(struct sk_buff *skb,
                                               const int offset_hint)
 {
@@ -2483,6 +2385,7 @@ extern void	       skb_split(struct sk_buff *skb,
                                  struct sk_buff *skb1, const u32 len);
 extern int             skb_shift(struct sk_buff *tgt, struct sk_buff *skb,
                                  int shiftlen);
+extern void            skb_scrub_packet(struct sk_buff *skb);
 
 extern struct sk_buff *skb_segment(struct sk_buff *skb,
                                    netdev_features_t features);
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 0c621752caa6..6c5cc0ea8713 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -169,11 +169,7 @@ struct kmem_cache {
         struct list_head list;  /* List of all slab caches on the system */
 };
 
-#define KMALLOC_MAX_SIZE (1UL << 30)
-
-#include <linux/slob_def.h>
-
-#else /* CONFIG_SLOB */
+#endif /* CONFIG_SLOB */
 
 /*
  * Kmalloc array related definitions
@@ -195,7 +191,9 @@ struct kmem_cache {
 #ifndef KMALLOC_SHIFT_LOW
 #define KMALLOC_SHIFT_LOW       5
 #endif
-#else
+#endif
+
+#ifdef CONFIG_SLUB
 /*
  * SLUB allocates up to order 2 pages directly and otherwise
  * passes the request to the page allocator.
@@ -207,6 +205,19 @@ struct kmem_cache {
 #endif
 #endif
 
+#ifdef CONFIG_SLOB
+/*
+ * SLOB passes all page size and larger requests to the page allocator.
+ * No kmalloc array is necessary since objects of different sizes can
+ * be allocated from the same page.
+ */
+#define KMALLOC_SHIFT_MAX       30
+#define KMALLOC_SHIFT_HIGH      PAGE_SHIFT
+#ifndef KMALLOC_SHIFT_LOW
+#define KMALLOC_SHIFT_LOW       3
+#endif
+#endif
+
 /* Maximum allocatable size */
 #define KMALLOC_MAX_SIZE        (1UL << KMALLOC_SHIFT_MAX)
 /* Maximum size for which we actually use a slab cache */
@@ -221,6 +232,7 @@ struct kmem_cache {
 #define KMALLOC_MIN_SIZE (1 << KMALLOC_SHIFT_LOW)
 #endif
 
+#ifndef CONFIG_SLOB
 extern struct kmem_cache *kmalloc_caches[KMALLOC_SHIFT_HIGH + 1];
 #ifdef CONFIG_ZONE_DMA
 extern struct kmem_cache *kmalloc_dma_caches[KMALLOC_SHIFT_HIGH + 1];
@@ -275,13 +287,18 @@ static __always_inline int kmalloc_index(size_t size)
         /* Will never be reached. Needed because the compiler may complain */
         return -1;
 }
+#endif /* !CONFIG_SLOB */
 
 #ifdef CONFIG_SLAB
 #include <linux/slab_def.h>
-#elif defined(CONFIG_SLUB)
+#endif
+
+#ifdef CONFIG_SLUB
 #include <linux/slub_def.h>
-#else
-#error "Unknown slab allocator"
+#endif
+
+#ifdef CONFIG_SLOB
+#include <linux/slob_def.h>
 #endif
 
 /*
@@ -291,6 +308,7 @@ static __always_inline int kmalloc_index(size_t size)
  */
 static __always_inline int kmalloc_size(int n)
 {
+#ifndef CONFIG_SLOB
         if (n > 2)
                 return 1 << n;
 
@@ -299,10 +317,9 @@ static __always_inline int kmalloc_size(int n)
 
         if (n == 2 && KMALLOC_MIN_SIZE <= 64)
                 return 192;
-
+#endif
         return 0;
 }
-#endif /* !CONFIG_SLOB */
 
 /*
  * Setting ARCH_SLAB_MINALIGN in arch headers allows a different alignment.
@@ -356,9 +373,8 @@ int cache_show(struct kmem_cache *s, struct seq_file *m);
 void print_slabinfo_header(struct seq_file *m);
 
 /**
- * kmalloc_array - allocate memory for an array.
- * @n: number of elements.
- * @size: element size.
+ * kmalloc - allocate memory
+ * @size: how many bytes of memory are required.
  * @flags: the type of memory to allocate.
  *
  * The @flags argument may be one of:
@@ -405,6 +421,17 @@ void print_slabinfo_header(struct seq_file *m);
  * There are other flags available as well, but these are not intended
  * for general use, and so are not documented here. For a full list of
  * potential flags, always refer to linux/gfp.h.
+ *
+ * kmalloc is the normal method of allocating memory
+ * in the kernel.
+ */
+static __always_inline void *kmalloc(size_t size, gfp_t flags);
+
+/**
+ * kmalloc_array - allocate memory for an array.
+ * @n: number of elements.
+ * @size: element size.
+ * @flags: the type of memory to allocate (see kmalloc).
  */
 static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags)
 {
@@ -428,7 +455,7 @@ static inline void *kcalloc(size_t n, size_t size, gfp_t flags)
 /**
  * kmalloc_node - allocate memory from a specific node
  * @size: how many bytes of memory are required.
- * @flags: the type of memory to allocate (see kcalloc).
+ * @flags: the type of memory to allocate (see kmalloc).
  * @node: node to allocate from.
  *
  * kmalloc() for non-local nodes, used to allocate from a specific node
diff --git a/include/linux/slob_def.h b/include/linux/slob_def.h
index f28e14a12e3f..095a5a4a8516 100644
--- a/include/linux/slob_def.h
+++ b/include/linux/slob_def.h
@@ -18,14 +18,6 @@ static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
         return __kmalloc_node(size, flags, node);
 }
 
-/**
- * kmalloc - allocate memory
- * @size: how many bytes of memory are required.
- * @flags: the type of memory to allocate (see kcalloc).
- *
- * kmalloc is the normal method of allocating memory
- * in the kernel.
- */
 static __always_inline void *kmalloc(size_t size, gfp_t flags)
 {
         return __kmalloc_node(size, flags, NUMA_NO_NODE);
diff --git a/include/linux/socket.h b/include/linux/socket.h
index b10ce4b341ea..230c04bda3e2 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -167,6 +167,7 @@ struct ucred {
 #define AF_PPPOX        24      /* PPPoX sockets                */
 #define AF_WANPIPE      25      /* Wanpipe API Sockets */
 #define AF_LLC          26      /* Linux LLC                    */
+#define AF_IB           27      /* Native InfiniBand address    */
 #define AF_CAN          29      /* Controller Area Network      */
 #define AF_TIPC         30      /* TIPC sockets                 */
 #define AF_BLUETOOTH    31      /* Bluetooth sockets            */
@@ -211,6 +212,7 @@ struct ucred {
 #define PF_PPPOX        AF_PPPOX
 #define PF_WANPIPE      AF_WANPIPE
 #define PF_LLC          AF_LLC
+#define PF_IB           AF_IB
 #define PF_CAN          AF_CAN
 #define PF_TIPC         AF_TIPC
 #define PF_BLUETOOTH    AF_BLUETOOTH
diff --git a/include/linux/ssb/ssb_driver_mips.h b/include/linux/ssb/ssb_driver_mips.h
index afe79d40a99e..6535e4718fde 100644
--- a/include/linux/ssb/ssb_driver_mips.h
+++ b/include/linux/ssb/ssb_driver_mips.h
@@ -20,6 +20,18 @@ struct ssb_pflash {
         u32 window_size;
 };
 
+#ifdef CONFIG_SSB_SFLASH
+struct ssb_sflash {
+        bool present;
+        u32 window;
+        u32 blocksize;
+        u16 numblocks;
+        u32 size;
+
+        void *priv;
+};
+#endif
+
 struct ssb_mipscore {
         struct ssb_device *dev;
 
@@ -27,6 +39,9 @@ struct ssb_mipscore {
         struct ssb_serial_port serial_ports[4];
 
         struct ssb_pflash pflash;
+#ifdef CONFIG_SSB_SFLASH
+        struct ssb_sflash sflash;
+#endif
 };
 
 extern void ssb_mipscore_init(struct ssb_mipscore *mcore);
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index 3a7256955b10..f9f931c89e3e 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -172,6 +172,7 @@
 #define SSB_SPROMSIZE_WORDS_R4          220
 #define SSB_SPROMSIZE_BYTES_R123        (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
 #define SSB_SPROMSIZE_BYTES_R4          (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
+#define SSB_SPROMSIZE_WORDS_R10         230
 #define SSB_SPROM_BASE1                 0x1000
 #define SSB_SPROM_BASE31                0x0800
 #define SSB_SPROM_REVISION              0x007E
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index c1b3ed3fb787..9e495d31516e 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -80,6 +80,10 @@ struct stmmac_mdio_bus_data {
         unsigned int phy_mask;
         int *irqs;
         int probed_phy_irq;
+#ifdef CONFIG_OF
+        int reset_gpio, active_low;
+        u32 delays[3];
+#endif
 };
 
 struct stmmac_dma_cfg {
diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h
index 303399b1ba59..6ce690de447f 100644
--- a/include/linux/sunrpc/cache.h
+++ b/include/linux/sunrpc/cache.h
@@ -57,6 +57,7 @@ struct cache_head {
 #define CACHE_VALID     0       /* Entry contains valid data */
 #define CACHE_NEGATIVE  1       /* Negative entry - there is no match for the key */
 #define CACHE_PENDING   2       /* An upcall has been sent but no reply received yet*/
+#define CACHE_CLEANED   3       /* Entry has been cleaned from cache */
 
 #define CACHE_NEW_EXPIRY 120    /* keep new things pending confirmation for 120 seconds */
 
@@ -148,6 +149,24 @@ struct cache_deferred_req {
                                            int too_many);
 };
 
+/*
+ * timestamps kept in the cache are expressed in seconds
+ * since boot.  This is the best for measuring differences in
+ * real time.
+ */
+static inline time_t seconds_since_boot(void)
+{
+        struct timespec boot;
+        getboottime(&boot);
+        return get_seconds() - boot.tv_sec;
+}
+
+static inline time_t convert_to_wallclock(time_t sinceboot)
+{
+        struct timespec boot;
+        getboottime(&boot);
+        return boot.tv_sec + sinceboot;
+}
 
 extern const struct file_operations cache_file_operations_pipefs;
 extern const struct file_operations content_file_operations_pipefs;
@@ -181,15 +200,10 @@ static inline void cache_put(struct cache_head *h, struct cache_detail *cd)
         kref_put(&h->ref, cd->cache_put);
 }
 
-static inline int cache_valid(struct cache_head *h)
+static inline int cache_is_expired(struct cache_detail *detail, struct cache_head *h)
 {
-        /* If an item has been unhashed pending removal when
-         * the refcount drops to 0, the expiry_time will be
-         * set to 0.  We don't want to consider such items
-         * valid in this context even though CACHE_VALID is
-         * set.
-         */
-        return (h->expiry_time != 0 && test_bit(CACHE_VALID, &h->flags));
+        return  (h->expiry_time < seconds_since_boot()) ||
+                (detail->flush_time > h->last_refresh);
 }
 
 extern int cache_check(struct cache_detail *detail,
@@ -250,25 +264,6 @@ static inline int get_uint(char **bpp, unsigned int *anint)
         return 0;
 }
 
-/*
- * timestamps kept in the cache are expressed in seconds
- * since boot.  This is the best for measuring differences in
- * real time.
- */
-static inline time_t seconds_since_boot(void)
-{
-        struct timespec boot;
-        getboottime(&boot);
-        return get_seconds() - boot.tv_sec;
-}
-
-static inline time_t convert_to_wallclock(time_t sinceboot)
-{
-        struct timespec boot;
-        getboottime(&boot);
-        return boot.tv_sec + sinceboot;
-}
-
 static inline time_t get_expiry(char **bpp)
 {
         int rv;
diff --git a/include/linux/sunrpc/gss_api.h b/include/linux/sunrpc/gss_api.h
index 161463e59624..1f911ccb2a75 100644
--- a/include/linux/sunrpc/gss_api.h
+++ b/include/linux/sunrpc/gss_api.h
@@ -151,6 +151,8 @@ struct gss_api_mech *gss_mech_get_by_pseudoflavor(u32);
 /* Fill in an array with a list of supported pseudoflavors */
 int gss_mech_list_pseudoflavors(rpc_authflavor_t *, int);
 
+struct gss_api_mech * gss_mech_get(struct gss_api_mech *);
+
 /* For every successful gss_mech_get or gss_mech_get_by_* call there must be a
  * corresponding call to gss_mech_put. */
 void gss_mech_put(struct gss_api_mech *);
diff --git a/include/linux/sunrpc/rpc_pipe_fs.h b/include/linux/sunrpc/rpc_pipe_fs.h
index a7b422b33eda..aa5b582cc471 100644
--- a/include/linux/sunrpc/rpc_pipe_fs.h
+++ b/include/linux/sunrpc/rpc_pipe_fs.h
@@ -73,12 +73,12 @@ extern ssize_t rpc_pipe_generic_upcall(struct file *, struct rpc_pipe_msg *,
 extern int rpc_queue_upcall(struct rpc_pipe *, struct rpc_pipe_msg *);
 
 struct rpc_clnt;
-extern struct dentry *rpc_create_client_dir(struct dentry *, struct qstr *, struct rpc_clnt *);
+extern struct dentry *rpc_create_client_dir(struct dentry *, const char *, struct rpc_clnt *);
 extern int rpc_remove_client_dir(struct dentry *);
 
 struct cache_detail;
 extern struct dentry *rpc_create_cache_dir(struct dentry *,
-                                           struct qstr *,
+                                           const char *,
                                            umode_t umode,
                                            struct cache_detail *);
 extern void rpc_remove_cache_dir(struct dentry *);
diff --git a/include/linux/sunrpc/svcauth.h b/include/linux/sunrpc/svcauth.h
index ff374ab30839..8d71d6577459 100644
--- a/include/linux/sunrpc/svcauth.h
+++ b/include/linux/sunrpc/svcauth.h
@@ -14,6 +14,7 @@
 #include <linux/string.h>
 #include <linux/sunrpc/msg_prot.h>
 #include <linux/sunrpc/cache.h>
+#include <linux/sunrpc/gss_api.h>
 #include <linux/hash.h>
 #include <linux/cred.h>
 
@@ -23,13 +24,23 @@ struct svc_cred {
         struct group_info       *cr_group_info;
         u32                     cr_flavor; /* pseudoflavor */
         char                    *cr_principal; /* for gss */
+        struct gss_api_mech     *cr_gss_mech;
 };
 
+static inline void init_svc_cred(struct svc_cred *cred)
+{
+        cred->cr_group_info = NULL;
+        cred->cr_principal = NULL;
+        cred->cr_gss_mech = NULL;
+}
+
 static inline void free_svc_cred(struct svc_cred *cred)
 {
         if (cred->cr_group_info)
                 put_group_info(cred->cr_group_info);
         kfree(cred->cr_principal);
+        gss_mech_put(cred->cr_gss_mech);
+        init_svc_cred(cred);
 }
 
 struct svc_rqst;                /* forward decl */
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index e2cee22f578a..9e8a9b555ad6 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -17,10 +17,12 @@
 #include <linux/list.h>
 #include <linux/lockdep.h>
 #include <linux/kobject_ns.h>
+#include <linux/stat.h>
 #include <linux/atomic.h>
 
 struct kobject;
 struct module;
+struct bin_attribute;
 enum kobj_ns_type;
 
 struct attribute {
@@ -59,26 +61,28 @@ struct attribute_group {
         umode_t                 (*is_visible)(struct kobject *,
                                               struct attribute *, int);
         struct attribute        **attrs;
+        struct bin_attribute    **bin_attrs;
 };
 
-
-
 /**
  * Use these macros to make defining attributes easier. See include/linux/device.h
  * for examples..
  */
 
-#define __ATTR(_name,_mode,_show,_store) { \
-        .attr = {.name = __stringify(_name), .mode = _mode },   \
-        .show   = _show,                                        \
-        .store  = _store,                                       \
+#define __ATTR(_name,_mode,_show,_store) {                              \
+        .attr = {.name = __stringify(_name), .mode = _mode },           \
+        .show   = _show,                                                \
+        .store  = _store,                                               \
 }
 
-#define __ATTR_RO(_name) { \
-        .attr   = { .name = __stringify(_name), .mode = 0444 }, \
-        .show   = _name##_show,                                 \
+#define __ATTR_RO(_name) {                                              \
+        .attr   = { .name = __stringify(_name), .mode = S_IRUGO },      \
+        .show   = _name##_show,                                         \
 }
 
+#define __ATTR_RW(_name) __ATTR(_name, (S_IWUSR | S_IRUGO),             \
+                         _name##_show, _name##_store)
+
 #define __ATTR_NULL { .attr = { .name = NULL } }
 
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
@@ -92,6 +96,18 @@ struct attribute_group {
 #define __ATTR_IGNORE_LOCKDEP   __ATTR
 #endif
 
+#define __ATTRIBUTE_GROUPS(_name)                               \
+static const struct attribute_group *_name##_groups[] = {       \
+        &_name##_group,                                         \
+        NULL,                                                   \
+}
+
+#define ATTRIBUTE_GROUPS(_name)                                 \
+static const struct attribute_group _name##_group = {           \
+        .attrs = _name##_attrs,                                 \
+};                                                              \
+__ATTRIBUTE_GROUPS(_name)
+
 #define attr_name(_attr) (_attr).attr.name
 
 struct file;
@@ -121,6 +137,36 @@ struct bin_attribute {
  */
 #define sysfs_bin_attr_init(bin_attr) sysfs_attr_init(&(bin_attr)->attr)
 
+/* macros to create static binary attributes easier */
+#define __BIN_ATTR(_name, _mode, _read, _write, _size) {                \
+        .attr = { .name = __stringify(_name), .mode = _mode },          \
+        .read   = _read,                                                \
+        .write  = _write,                                               \
+        .size   = _size,                                                \
+}
+
+#define __BIN_ATTR_RO(_name, _size) {                                   \
+        .attr   = { .name = __stringify(_name), .mode = S_IRUGO },      \
+        .read   = _name##_read,                                         \
+        .size   = _size,                                                \
+}
+
+#define __BIN_ATTR_RW(_name, _size) __BIN_ATTR(_name,                   \
+                                   (S_IWUSR | S_IRUGO), _name##_read,   \
+                                   _name##_write)
+
+#define __BIN_ATTR_NULL __ATTR_NULL
+
+#define BIN_ATTR(_name, _mode, _read, _write, _size)                    \
+struct bin_attribute bin_attr_##_name = __BIN_ATTR(_name, _mode, _read, \
+                                        _write, _size)
+
+#define BIN_ATTR_RO(_name, _size)                                       \
+struct bin_attribute bin_attr_##_name = __BIN_ATTR_RO(_name, _size)
+
+#define BIN_ATTR_RW(_name, _size)                                       \
+struct bin_attribute bin_attr_##_name = __BIN_ATTR_RW(_name, _size)
+
 struct sysfs_ops {
         ssize_t (*show)(struct kobject *, struct attribute *,char *);
         ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 5adbc33d1ab3..472120b4fac5 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -246,7 +246,6 @@ struct tcp_sock {
 
         /* from STCP, retrans queue hinting */
         struct sk_buff* lost_skb_hint;
-        struct sk_buff *scoreboard_skb_hint;
         struct sk_buff *retransmit_skb_hint;
 
         struct sk_buff_head     out_of_order_queue; /* Out of order segments go here */
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index e94c75ded111..36d36cc89329 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -63,6 +63,10 @@ void virtqueue_disable_cb(struct virtqueue *vq);
 
 bool virtqueue_enable_cb(struct virtqueue *vq);
 
+unsigned virtqueue_enable_cb_prepare(struct virtqueue *vq);
+
+bool virtqueue_poll(struct virtqueue *vq, unsigned);
+
 bool virtqueue_enable_cb_delayed(struct virtqueue *vq);
 
 void *virtqueue_detach_unused_buf(struct virtqueue *vq);
diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
index ca3ad41c2c82..b300787af8e0 100644
--- a/include/linux/virtio_ring.h
+++ b/include/linux/virtio_ring.h
@@ -1,6 +1,7 @@
 #ifndef _LINUX_VIRTIO_RING_H
 #define _LINUX_VIRTIO_RING_H
 
+#include <asm/barrier.h>
 #include <linux/irqreturn.h>
 #include <uapi/linux/virtio_ring.h>
 
diff --git a/include/linux/ww_mutex.h b/include/linux/ww_mutex.h
new file mode 100644
index 000000000000..760399a470bd
--- /dev/null
+++ b/include/linux/ww_mutex.h
@@ -0,0 +1,378 @@
+/*
+ * Wound/Wait Mutexes: blocking mutual exclusion locks with deadlock avoidance
+ *
+ * Original mutex implementation started by Ingo Molnar:
+ *
+ *  Copyright (C) 2004, 2005, 2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
+ *
+ * Wound/wait implementation:
+ *  Copyright (C) 2013 Canonical Ltd.
+ *
+ * This file contains the main data structure and API definitions.
+ */
+
+#ifndef __LINUX_WW_MUTEX_H
+#define __LINUX_WW_MUTEX_H
+
+#include <linux/mutex.h>
+
+struct ww_class {
+        atomic_long_t stamp;
+        struct lock_class_key acquire_key;
+        struct lock_class_key mutex_key;
+        const char *acquire_name;
+        const char *mutex_name;
+};
+
+struct ww_acquire_ctx {
+        struct task_struct *task;
+        unsigned long stamp;
+        unsigned acquired;
+#ifdef CONFIG_DEBUG_MUTEXES
+        unsigned done_acquire;
+        struct ww_class *ww_class;
+        struct ww_mutex *contending_lock;
+#endif
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        struct lockdep_map dep_map;
+#endif
+#ifdef CONFIG_DEBUG_WW_MUTEX_SLOWPATH
+        unsigned deadlock_inject_interval;
+        unsigned deadlock_inject_countdown;
+#endif
+};
+
+struct ww_mutex {
+        struct mutex base;
+        struct ww_acquire_ctx *ctx;
+#ifdef CONFIG_DEBUG_MUTEXES
+        struct ww_class *ww_class;
+#endif
+};
+
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+# define __WW_CLASS_MUTEX_INITIALIZER(lockname, ww_class) \
+                , .ww_class = &ww_class
+#else
+# define __WW_CLASS_MUTEX_INITIALIZER(lockname, ww_class)
+#endif
+
+#define __WW_CLASS_INITIALIZER(ww_class) \
+                { .stamp = ATOMIC_LONG_INIT(0) \
+                , .acquire_name = #ww_class "_acquire" \
+                , .mutex_name = #ww_class "_mutex" }
+
+#define __WW_MUTEX_INITIALIZER(lockname, class) \
+                { .base = { \__MUTEX_INITIALIZER(lockname) } \
+                __WW_CLASS_MUTEX_INITIALIZER(lockname, class) }
+
+#define DEFINE_WW_CLASS(classname) \
+        struct ww_class classname = __WW_CLASS_INITIALIZER(classname)
+
+#define DEFINE_WW_MUTEX(mutexname, ww_class) \
+        struct ww_mutex mutexname = __WW_MUTEX_INITIALIZER(mutexname, ww_class)
+
+/**
+ * ww_mutex_init - initialize the w/w mutex
+ * @lock: the mutex to be initialized
+ * @ww_class: the w/w class the mutex should belong to
+ *
+ * Initialize the w/w mutex to unlocked state and associate it with the given
+ * class.
+ *
+ * It is not allowed to initialize an already locked mutex.
+ */
+static inline void ww_mutex_init(struct ww_mutex *lock,
+                                 struct ww_class *ww_class)
+{
+        __mutex_init(&lock->base, ww_class->mutex_name, &ww_class->mutex_key);
+        lock->ctx = NULL;
+#ifdef CONFIG_DEBUG_MUTEXES
+        lock->ww_class = ww_class;
+#endif
+}
+
+/**
+ * ww_acquire_init - initialize a w/w acquire context
+ * @ctx: w/w acquire context to initialize
+ * @ww_class: w/w class of the context
+ *
+ * Initializes an context to acquire multiple mutexes of the given w/w class.
+ *
+ * Context-based w/w mutex acquiring can be done in any order whatsoever within
+ * a given lock class. Deadlocks will be detected and handled with the
+ * wait/wound logic.
+ *
+ * Mixing of context-based w/w mutex acquiring and single w/w mutex locking can
+ * result in undetected deadlocks and is so forbidden. Mixing different contexts
+ * for the same w/w class when acquiring mutexes can also result in undetected
+ * deadlocks, and is hence also forbidden. Both types of abuse will be caught by
+ * enabling CONFIG_PROVE_LOCKING.
+ *
+ * Nesting of acquire contexts for _different_ w/w classes is possible, subject
+ * to the usual locking rules between different lock classes.
+ *
+ * An acquire context must be released with ww_acquire_fini by the same task
+ * before the memory is freed. It is recommended to allocate the context itself
+ * on the stack.
+ */
+static inline void ww_acquire_init(struct ww_acquire_ctx *ctx,
+                                   struct ww_class *ww_class)
+{
+        ctx->task = current;
+        ctx->stamp = atomic_long_inc_return(&ww_class->stamp);
+        ctx->acquired = 0;
+#ifdef CONFIG_DEBUG_MUTEXES
+        ctx->ww_class = ww_class;
+        ctx->done_acquire = 0;
+        ctx->contending_lock = NULL;
+#endif
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        debug_check_no_locks_freed((void *)ctx, sizeof(*ctx));
+        lockdep_init_map(&ctx->dep_map, ww_class->acquire_name,
+                         &ww_class->acquire_key, 0);
+        mutex_acquire(&ctx->dep_map, 0, 0, _RET_IP_);
+#endif
+#ifdef CONFIG_DEBUG_WW_MUTEX_SLOWPATH
+        ctx->deadlock_inject_interval = 1;
+        ctx->deadlock_inject_countdown = ctx->stamp & 0xf;
+#endif
+}
+
+/**
+ * ww_acquire_done - marks the end of the acquire phase
+ * @ctx: the acquire context
+ *
+ * Marks the end of the acquire phase, any further w/w mutex lock calls using
+ * this context are forbidden.
+ *
+ * Calling this function is optional, it is just useful to document w/w mutex
+ * code and clearly designated the acquire phase from actually using the locked
+ * data structures.
+ */
+static inline void ww_acquire_done(struct ww_acquire_ctx *ctx)
+{
+#ifdef CONFIG_DEBUG_MUTEXES
+        lockdep_assert_held(ctx);
+
+        DEBUG_LOCKS_WARN_ON(ctx->done_acquire);
+        ctx->done_acquire = 1;
+#endif
+}
+
+/**
+ * ww_acquire_fini - releases a w/w acquire context
+ * @ctx: the acquire context to free
+ *
+ * Releases a w/w acquire context. This must be called _after_ all acquired w/w
+ * mutexes have been released with ww_mutex_unlock.
+ */
+static inline void ww_acquire_fini(struct ww_acquire_ctx *ctx)
+{
+#ifdef CONFIG_DEBUG_MUTEXES
+        mutex_release(&ctx->dep_map, 0, _THIS_IP_);
+
+        DEBUG_LOCKS_WARN_ON(ctx->acquired);
+        if (!config_enabled(CONFIG_PROVE_LOCKING))
+                /*
+                 * lockdep will normally handle this,
+                 * but fail without anyway
+                 */
+                ctx->done_acquire = 1;
+
+        if (!config_enabled(CONFIG_DEBUG_LOCK_ALLOC))
+                /* ensure ww_acquire_fini will still fail if called twice */
+                ctx->acquired = ~0U;
+#endif
+}
+
+extern int __must_check __ww_mutex_lock(struct ww_mutex *lock,
+                                        struct ww_acquire_ctx *ctx);
+extern int __must_check __ww_mutex_lock_interruptible(struct ww_mutex *lock,
+                                                      struct ww_acquire_ctx *ctx);
+
+/**
+ * ww_mutex_lock - acquire the w/w mutex
+ * @lock: the mutex to be acquired
+ * @ctx: w/w acquire context, or NULL to acquire only a single lock.
+ *
+ * Lock the w/w mutex exclusively for this task.
+ *
+ * Deadlocks within a given w/w class of locks are detected and handled with the
+ * wait/wound algorithm. If the lock isn't immediately avaiable this function
+ * will either sleep until it is (wait case). Or it selects the current context
+ * for backing off by returning -EDEADLK (wound case). Trying to acquire the
+ * same lock with the same context twice is also detected and signalled by
+ * returning -EALREADY. Returns 0 if the mutex was successfully acquired.
+ *
+ * In the wound case the caller must release all currently held w/w mutexes for
+ * the given context and then wait for this contending lock to be available by
+ * calling ww_mutex_lock_slow. Alternatively callers can opt to not acquire this
+ * lock and proceed with trying to acquire further w/w mutexes (e.g. when
+ * scanning through lru lists trying to free resources).
+ *
+ * The mutex must later on be released by the same task that
+ * acquired it. The task may not exit without first unlocking the mutex. Also,
+ * kernel memory where the mutex resides must not be freed with the mutex still
+ * locked. The mutex must first be initialized (or statically defined) before it
+ * can be locked. memset()-ing the mutex to 0 is not allowed. The mutex must be
+ * of the same w/w lock class as was used to initialize the acquire context.
+ *
+ * A mutex acquired with this function must be released with ww_mutex_unlock.
+ */
+static inline int ww_mutex_lock(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
+{
+        if (ctx)
+                return __ww_mutex_lock(lock, ctx);
+
+        mutex_lock(&lock->base);
+        return 0;
+}
+
+/**
+ * ww_mutex_lock_interruptible - acquire the w/w mutex, interruptible
+ * @lock: the mutex to be acquired
+ * @ctx: w/w acquire context
+ *
+ * Lock the w/w mutex exclusively for this task.
+ *
+ * Deadlocks within a given w/w class of locks are detected and handled with the
+ * wait/wound algorithm. If the lock isn't immediately avaiable this function
+ * will either sleep until it is (wait case). Or it selects the current context
+ * for backing off by returning -EDEADLK (wound case). Trying to acquire the
+ * same lock with the same context twice is also detected and signalled by
+ * returning -EALREADY. Returns 0 if the mutex was successfully acquired. If a
+ * signal arrives while waiting for the lock then this function returns -EINTR.
+ *
+ * In the wound case the caller must release all currently held w/w mutexes for
+ * the given context and then wait for this contending lock to be available by
+ * calling ww_mutex_lock_slow_interruptible. Alternatively callers can opt to
+ * not acquire this lock and proceed with trying to acquire further w/w mutexes
+ * (e.g. when scanning through lru lists trying to free resources).
+ *
+ * The mutex must later on be released by the same task that
+ * acquired it. The task may not exit without first unlocking the mutex. Also,
+ * kernel memory where the mutex resides must not be freed with the mutex still
+ * locked. The mutex must first be initialized (or statically defined) before it
+ * can be locked. memset()-ing the mutex to 0 is not allowed. The mutex must be
+ * of the same w/w lock class as was used to initialize the acquire context.
+ *
+ * A mutex acquired with this function must be released with ww_mutex_unlock.
+ */
+static inline int __must_check ww_mutex_lock_interruptible(struct ww_mutex *lock,
+                                                           struct ww_acquire_ctx *ctx)
+{
+        if (ctx)
+                return __ww_mutex_lock_interruptible(lock, ctx);
+        else
+                return mutex_lock_interruptible(&lock->base);
+}
+
+/**
+ * ww_mutex_lock_slow - slowpath acquiring of the w/w mutex
+ * @lock: the mutex to be acquired
+ * @ctx: w/w acquire context
+ *
+ * Acquires a w/w mutex with the given context after a wound case. This function
+ * will sleep until the lock becomes available.
+ *
+ * The caller must have released all w/w mutexes already acquired with the
+ * context and then call this function on the contended lock.
+ *
+ * Afterwards the caller may continue to (re)acquire the other w/w mutexes it
+ * needs with ww_mutex_lock. Note that the -EALREADY return code from
+ * ww_mutex_lock can be used to avoid locking this contended mutex twice.
+ *
+ * It is forbidden to call this function with any other w/w mutexes associated
+ * with the context held. It is forbidden to call this on anything else than the
+ * contending mutex.
+ *
+ * Note that the slowpath lock acquiring can also be done by calling
+ * ww_mutex_lock directly. This function here is simply to help w/w mutex
+ * locking code readability by clearly denoting the slowpath.
+ */
+static inline void
+ww_mutex_lock_slow(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
+{
+        int ret;
+#ifdef CONFIG_DEBUG_MUTEXES
+        DEBUG_LOCKS_WARN_ON(!ctx->contending_lock);
+#endif
+        ret = ww_mutex_lock(lock, ctx);
+        (void)ret;
+}
+
+/**
+ * ww_mutex_lock_slow_interruptible - slowpath acquiring of the w/w mutex, interruptible
+ * @lock: the mutex to be acquired
+ * @ctx: w/w acquire context
+ *
+ * Acquires a w/w mutex with the given context after a wound case. This function
+ * will sleep until the lock becomes available and returns 0 when the lock has
+ * been acquired. If a signal arrives while waiting for the lock then this
+ * function returns -EINTR.
+ *
+ * The caller must have released all w/w mutexes already acquired with the
+ * context and then call this function on the contended lock.
+ *
+ * Afterwards the caller may continue to (re)acquire the other w/w mutexes it
+ * needs with ww_mutex_lock. Note that the -EALREADY return code from
+ * ww_mutex_lock can be used to avoid locking this contended mutex twice.
+ *
+ * It is forbidden to call this function with any other w/w mutexes associated
+ * with the given context held. It is forbidden to call this on anything else
+ * than the contending mutex.
+ *
+ * Note that the slowpath lock acquiring can also be done by calling
+ * ww_mutex_lock_interruptible directly. This function here is simply to help
+ * w/w mutex locking code readability by clearly denoting the slowpath.
+ */
+static inline int __must_check
+ww_mutex_lock_slow_interruptible(struct ww_mutex *lock,
+                                 struct ww_acquire_ctx *ctx)
+{
+#ifdef CONFIG_DEBUG_MUTEXES
+        DEBUG_LOCKS_WARN_ON(!ctx->contending_lock);
+#endif
+        return ww_mutex_lock_interruptible(lock, ctx);
+}
+
+extern void ww_mutex_unlock(struct ww_mutex *lock);
+
+/**
+ * ww_mutex_trylock - tries to acquire the w/w mutex without acquire context
+ * @lock: mutex to lock
+ *
+ * Trylocks a mutex without acquire context, so no deadlock detection is
+ * possible. Returns 1 if the mutex has been acquired successfully, 0 otherwise.
+ */
+static inline int __must_check ww_mutex_trylock(struct ww_mutex *lock)
+{
+        return mutex_trylock(&lock->base);
+}
+
+/***
+ * ww_mutex_destroy - mark a w/w mutex unusable
+ * @lock: the mutex to be destroyed
+ *
+ * This function marks the mutex uninitialized, and any subsequent
+ * use of the mutex is forbidden. The mutex must not be locked when
+ * this function is called.
+ */
+static inline void ww_mutex_destroy(struct ww_mutex *lock)
+{
+        mutex_destroy(&lock->base);
+}
+
+/**
+ * ww_mutex_is_locked - is the w/w mutex locked
+ * @lock: the mutex to be queried
+ *
+ * Returns 1 if the mutex is locked, 0 if unlocked.
+ */
+static inline bool ww_mutex_is_locked(struct ww_mutex *lock)
+{
+        return mutex_is_locked(&lock->base);
+}
+
+#endif
diff --git a/include/linux/zbud.h b/include/linux/zbud.h
new file mode 100644
index 000000000000..2571a5cfa5fc
--- /dev/null
+++ b/include/linux/zbud.h
@@ -0,0 +1,22 @@
+#ifndef _ZBUD_H_
+#define _ZBUD_H_
+
+#include <linux/types.h>
+
+struct zbud_pool;
+
+struct zbud_ops {
+        int (*evict)(struct zbud_pool *pool, unsigned long handle);
+};
+
+struct zbud_pool *zbud_create_pool(gfp_t gfp, struct zbud_ops *ops);
+void zbud_destroy_pool(struct zbud_pool *pool);
+int zbud_alloc(struct zbud_pool *pool, int size, gfp_t gfp,
+        unsigned long *handle);
+void zbud_free(struct zbud_pool *pool, unsigned long handle);
+int zbud_reclaim_page(struct zbud_pool *pool, unsigned int retries);
+void *zbud_map(struct zbud_pool *pool, unsigned long handle);
+void zbud_unmap(struct zbud_pool *pool, unsigned long handle);
+u64 zbud_get_pool_size(struct zbud_pool *pool);
+
+#endif /* _ZBUD_H_ */
diff --git a/include/media/davinci/vpbe_osd.h b/include/media/davinci/vpbe_osd.h
index 42628fcfe1bd..de59364d7ed2 100644
--- a/include/media/davinci/vpbe_osd.h
+++ b/include/media/davinci/vpbe_osd.h
@@ -82,9 +82,9 @@ enum osd_pix_format {
         PIXFMT_4BPP,
         PIXFMT_8BPP,
         PIXFMT_RGB565,
-        PIXFMT_YCbCrI,
+        PIXFMT_YCBCRI,
         PIXFMT_RGB888,
-        PIXFMT_YCrCbI,
+        PIXFMT_YCRCBI,
         PIXFMT_NV12,
         PIXFMT_OSD_ATTR,
 };
diff --git a/include/media/media-device.h b/include/media/media-device.h
index eaade9815bb6..12155a9596c4 100644
--- a/include/media/media-device.h
+++ b/include/media/media-device.h
@@ -45,6 +45,7 @@ struct device;
  * @entities:   List of registered entities
  * @lock:       Entities list lock
  * @graph_mutex: Entities graph operation lock
+ * @link_notify: Link state change notification callback
  *
  * This structure represents an abstract high-level media device. It allows easy
  * access to entities and provides basic media device-level support. The
@@ -75,10 +76,14 @@ struct media_device {
         /* Serializes graph operations. */
         struct mutex graph_mutex;
 
-        int (*link_notify)(struct media_pad *source,
-                           struct media_pad *sink, u32 flags);
+        int (*link_notify)(struct media_link *link, u32 flags,
+                           unsigned int notification);
 };
 
+/* Supported link_notify @notification values. */
+#define MEDIA_DEV_NOTIFY_PRE_LINK_CH    0
+#define MEDIA_DEV_NOTIFY_POST_LINK_CH   1
+
 /* media_devnode to media_device */
 #define to_media_device(node) container_of(node, struct media_device, devnode)
 
diff --git a/include/media/media-entity.h b/include/media/media-entity.h
index 0c16f518ee09..06bacf937d61 100644
--- a/include/media/media-entity.h
+++ b/include/media/media-entity.h
@@ -128,11 +128,14 @@ void media_entity_cleanup(struct media_entity *entity);
 
 int media_entity_create_link(struct media_entity *source, u16 source_pad,
                 struct media_entity *sink, u16 sink_pad, u32 flags);
+void __media_entity_remove_links(struct media_entity *entity);
+void media_entity_remove_links(struct media_entity *entity);
+
 int __media_entity_setup_link(struct media_link *link, u32 flags);
 int media_entity_setup_link(struct media_link *link, u32 flags);
 struct media_link *media_entity_find_link(struct media_pad *source,
                 struct media_pad *sink);
-struct media_pad *media_entity_remote_source(struct media_pad *pad);
+struct media_pad *media_entity_remote_pad(struct media_pad *pad);
 
 struct media_entity *media_entity_get(struct media_entity *entity);
 void media_entity_put(struct media_entity *entity);
diff --git a/include/media/rc-map.h b/include/media/rc-map.h
index 5d5d3a30f04a..6628f5d01f52 100644
--- a/include/media/rc-map.h
+++ b/include/media/rc-map.h
@@ -111,6 +111,7 @@ void rc_map_init(void);
 #define RC_MAP_BUDGET_CI_OLD             "rc-budget-ci-old"
 #define RC_MAP_CINERGY_1400              "rc-cinergy-1400"
 #define RC_MAP_CINERGY                   "rc-cinergy"
+#define RC_MAP_DELOCK_61959              "rc-delock-61959"
 #define RC_MAP_DIB0700_NEC_TABLE         "rc-dib0700-nec"
 #define RC_MAP_DIB0700_RC5_TABLE         "rc-dib0700-rc5"
 #define RC_MAP_DIGITALNOW_TINYTWIN       "rc-digitalnow-tinytwin"
diff --git a/include/media/s5p_fimc.h b/include/media/s5p_fimc.h
index f50969025ef3..b975c285c8a9 100644
--- a/include/media/s5p_fimc.h
+++ b/include/media/s5p_fimc.h
@@ -13,6 +13,7 @@
 #define S5P_FIMC_H_
 
 #include <media/media-entity.h>
+#include <media/v4l2-dev.h>
 #include <media/v4l2-mediabus.h>
 
 /*
@@ -115,6 +116,7 @@ struct s5p_platform_fimc {
  * @color: the driver's private color format id
  * @memplanes: number of physically non-contiguous data planes
  * @colplanes: number of physically contiguous data planes
+ * @colorspace: v4l2 colorspace (V4L2_COLORSPACE_*)
  * @depth: per plane driver's private 'number of bits per pixel'
  * @mdataplanes: bitmask indicating meta data plane(s), (1 << plane_no)
  * @flags: flags indicating which operation mode format applies to
@@ -126,6 +128,7 @@ struct fimc_fmt {
         u32     color;
         u16     memplanes;
         u16     colplanes;
+        u8      colorspace;
         u8      depth[FIMC_MAX_PLANES];
         u16     mdataplanes;
         u16     flags;
@@ -140,37 +143,40 @@ struct fimc_fmt {
 #define FMT_FLAGS_YUV           (1 << 7)
 };
 
-enum fimc_subdev_index {
-        IDX_SENSOR,
-        IDX_CSIS,
-        IDX_FLITE,
-        IDX_IS_ISP,
-        IDX_FIMC,
-        IDX_MAX,
-};
+struct exynos_media_pipeline;
 
-struct media_pipeline;
-struct v4l2_subdev;
+/*
+ * Media pipeline operations to be called from within a video node,  i.e. the
+ * last entity within the pipeline. Implemented by related media device driver.
+ */
+struct exynos_media_pipeline_ops {
+        int (*prepare)(struct exynos_media_pipeline *p,
+                                                struct media_entity *me);
+        int (*unprepare)(struct exynos_media_pipeline *p);
+        int (*open)(struct exynos_media_pipeline *p, struct media_entity *me,
+                                                        bool resume);
+        int (*close)(struct exynos_media_pipeline *p);
+        int (*set_stream)(struct exynos_media_pipeline *p, bool state);
+};
 
-struct fimc_pipeline {
-        struct v4l2_subdev *subdevs[IDX_MAX];
-        struct media_pipeline *m_pipeline;
+struct exynos_video_entity {
+        struct video_device vdev;
+        struct exynos_media_pipeline *pipe;
 };
 
-/*
- * Media pipeline operations to be called from within the fimc(-lite)
- * video node when it is the last entity of the pipeline. Implemented
- * by corresponding media device driver.
- */
-struct fimc_pipeline_ops {
-        int (*open)(struct fimc_pipeline *p, struct media_entity *me,
-                          bool resume);
-        int (*close)(struct fimc_pipeline *p);
-        int (*set_stream)(struct fimc_pipeline *p, bool state);
+struct exynos_media_pipeline {
+        struct media_pipeline mp;
+        const struct exynos_media_pipeline_ops *ops;
 };
 
-#define fimc_pipeline_call(f, op, p, args...)                           \
-        (!(f) ? -ENODEV : (((f)->pipeline_ops && (f)->pipeline_ops->op) ? \
-                            (f)->pipeline_ops->op((p), ##args) : -ENOIOCTLCMD))
+static inline struct exynos_video_entity *vdev_to_exynos_video_entity(
+                                        struct video_device *vdev)
+{
+        return container_of(vdev, struct exynos_video_entity, vdev);
+}
+
+#define fimc_pipeline_call(ent, op, args...)                              \
+        (!(ent) ? -ENOENT : (((ent)->pipe->ops && (ent)->pipe->ops->op) ? \
+        (ent)->pipe->ops->op(((ent)->pipe), ##args) : -ENOIOCTLCMD))      \
 
 #endif /* S5P_FIMC_H_ */
diff --git a/include/media/sh_mobile_ceu.h b/include/media/sh_mobile_ceu.h
index 6fdb6adf6b2b..7f57056c22ba 100644
--- a/include/media/sh_mobile_ceu.h
+++ b/include/media/sh_mobile_ceu.h
@@ -22,6 +22,8 @@ struct sh_mobile_ceu_info {
         int max_width;
         int max_height;
         struct sh_mobile_ceu_companion *csi2;
+        struct v4l2_async_subdev **asd; /* Flat array, arranged in groups */
+        unsigned int *asd_sizes;        /* 0-terminated array pf asd group sizes */
 };
 
 #endif /* __ASM_SH_MOBILE_CEU_H__ */
diff --git a/include/media/sh_mobile_csi2.h b/include/media/sh_mobile_csi2.h
index c586c4f7f16b..14030db51f13 100644
--- a/include/media/sh_mobile_csi2.h
+++ b/include/media/sh_mobile_csi2.h
@@ -33,6 +33,7 @@ struct sh_csi2_client_config {
         unsigned char lanes;            /* bitmask[3:0] */
         unsigned char channel;          /* 0..3 */
         struct platform_device *pdev;   /* client platform device */
+        const char *name;               /* async matching: client name */
 };
 
 struct v4l2_device;
@@ -42,7 +43,6 @@ struct sh_csi2_pdata {
         unsigned int flags;
         struct sh_csi2_client_config *clients;
         int num_clients;
-        struct v4l2_device *v4l2_dev;
 };
 
 #endif
diff --git a/include/media/soc_camera.h b/include/media/soc_camera.h
index ff77d08c30fd..34d2414f2b8c 100644
--- a/include/media/soc_camera.h
+++ b/include/media/soc_camera.h
@@ -19,11 +19,13 @@
 #include <linux/videodev2.h>
 #include <media/videobuf-core.h>
 #include <media/videobuf2-core.h>
+#include <media/v4l2-async.h>
 #include <media/v4l2-ctrls.h>
 #include <media/v4l2-device.h>
 
 struct file;
 struct soc_camera_desc;
+struct soc_camera_async_client;
 
 struct soc_camera_device {
         struct list_head list;          /* list of all registered devices */
@@ -49,6 +51,10 @@ struct soc_camera_device {
         /* soc_camera.c private count. Only accessed with .host_lock held */
         int use_count;
         struct file *streamer;          /* stream owner */
+        struct v4l2_clk *clk;
+        /* Asynchronous subdevice management */
+        struct soc_camera_async_client *sasc;
+        /* video buffer queue */
         union {
                 struct videobuf_queue vb_vidq;
                 struct vb2_queue vb2_vidq;
@@ -58,21 +64,38 @@ struct soc_camera_device {
 /* Host supports programmable stride */
 #define SOCAM_HOST_CAP_STRIDE           (1 << 0)
 
+enum soc_camera_subdev_role {
+        SOCAM_SUBDEV_DATA_SOURCE = 1,
+        SOCAM_SUBDEV_DATA_SINK,
+        SOCAM_SUBDEV_DATA_PROCESSOR,
+};
+
+struct soc_camera_async_subdev {
+        struct v4l2_async_subdev asd;
+        enum soc_camera_subdev_role role;
+};
+
 struct soc_camera_host {
         struct v4l2_device v4l2_dev;
         struct list_head list;
-        struct mutex host_lock;         /* Protect pipeline modifications */
+        struct mutex host_lock;         /* Main synchronisation lock */
+        struct mutex clk_lock;          /* Protect pipeline modifications */
         unsigned char nr;               /* Host number */
         u32 capabilities;
+        struct soc_camera_device *icd;  /* Currently attached client */
         void *priv;
         const char *drv_name;
         struct soc_camera_host_ops *ops;
+        struct v4l2_async_subdev **asd; /* Flat array, arranged in groups */
+        unsigned int *asd_sizes;        /* 0-terminated array of asd group sizes */
 };
 
 struct soc_camera_host_ops {
         struct module *owner;
         int (*add)(struct soc_camera_device *);
         void (*remove)(struct soc_camera_device *);
+        int (*clock_start)(struct soc_camera_host *);
+        void (*clock_stop)(struct soc_camera_host *);
         /*
          * .get_formats() is called for each client device format, but
          * .put_formats() is only called once. Further, if any of the calls to
@@ -157,6 +180,7 @@ struct soc_camera_host_desc {
 };
 
 /*
+ * Platform data for "soc-camera-pdrv"
  * This MUST be kept binary-identical to struct soc_camera_link below, until
  * it is completely replaced by this one, after which we can split it into its
  * two components.
@@ -322,14 +346,17 @@ static inline void soc_camera_limit_side(int *start, int *length,
 unsigned long soc_camera_apply_board_flags(struct soc_camera_subdev_desc *ssdd,
                                            const struct v4l2_mbus_config *cfg);
 
-int soc_camera_power_on(struct device *dev, struct soc_camera_subdev_desc *ssdd);
-int soc_camera_power_off(struct device *dev, struct soc_camera_subdev_desc *ssdd);
+int soc_camera_power_init(struct device *dev, struct soc_camera_subdev_desc *ssdd);
+int soc_camera_power_on(struct device *dev, struct soc_camera_subdev_desc *ssdd,
+                        struct v4l2_clk *clk);
+int soc_camera_power_off(struct device *dev, struct soc_camera_subdev_desc *ssdd,
+                         struct v4l2_clk *clk);
 
 static inline int soc_camera_set_power(struct device *dev,
-                                struct soc_camera_subdev_desc *ssdd, bool on)
+                struct soc_camera_subdev_desc *ssdd, struct v4l2_clk *clk, bool on)
 {
-        return on ? soc_camera_power_on(dev, ssdd)
-                  : soc_camera_power_off(dev, ssdd);
+        return on ? soc_camera_power_on(dev, ssdd, clk)
+                  : soc_camera_power_off(dev, ssdd, clk);
 }
 
 /* This is only temporary here - until v4l2-subdev begins to link to video_device */
@@ -346,9 +373,9 @@ static inline struct soc_camera_subdev_desc *soc_camera_i2c_to_desc(const struct
         return client->dev.platform_data;
 }
 
-static inline struct v4l2_subdev *soc_camera_vdev_to_subdev(const struct video_device *vdev)
+static inline struct v4l2_subdev *soc_camera_vdev_to_subdev(struct video_device *vdev)
 {
-        struct soc_camera_device *icd = dev_get_drvdata(vdev->parent);
+        struct soc_camera_device *icd = video_get_drvdata(vdev);
         return soc_camera_to_subdev(icd);
 }
 
diff --git a/include/media/ths7303.h b/include/media/ths7303.h
index 980ec51d574d..a7b49297da82 100644
--- a/include/media/ths7303.h
+++ b/include/media/ths7303.h
@@ -30,13 +30,11 @@
  * @ch_1: Bias value for channel one.
  * @ch_2: Bias value for channel two.
  * @ch_3: Bias value for channel three.
- * @init_enable: initalize on init.
  */
 struct ths7303_platform_data {
         u8 ch_1;
         u8 ch_2;
         u8 ch_3;
-        u8 init_enable;
 };
 
 #endif
diff --git a/include/media/tveeprom.h b/include/media/tveeprom.h
index a8ad75a9152a..4a1191abd936 100644
--- a/include/media/tveeprom.h
+++ b/include/media/tveeprom.h
@@ -1,6 +1,17 @@
 /*
  */
 
+enum tveeprom_audio_processor {
+        /* No audio processor present */
+        TVEEPROM_AUDPROC_NONE,
+        /* The audio processor is internal to the video processor */
+        TVEEPROM_AUDPROC_INTERNAL,
+        /* The audio processor is a MSPXXXX device */
+        TVEEPROM_AUDPROC_MSP,
+        /* The audio processor is another device */
+        TVEEPROM_AUDPROC_OTHER,
+};
+
 struct tveeprom {
         u32 has_radio;
         /* If has_ir == 0, then it is unknown what the IR capabilities are,
diff --git a/include/media/tvp7002.h b/include/media/tvp7002.h
index ee4353459ef5..fadb6afe9ef0 100644
--- a/include/media/tvp7002.h
+++ b/include/media/tvp7002.h
@@ -26,31 +26,29 @@
 #ifndef _TVP7002_H_
 #define _TVP7002_H_
 
-/* Platform-dependent data
- *
- * clk_polarity:
- *                      0 -> data clocked out on rising edge of DATACLK signal
- *                      1 -> data clocked out on falling edge of DATACLK signal
- * hs_polarity:
- *                      0 -> active low HSYNC output
- *                      1 -> active high HSYNC output
- * sog_polarity:
- *                      0 -> normal operation
- *                      1 -> operation with polarity inverted
- * vs_polarity:
- *                      0 -> active low VSYNC output
- *                      1 -> active high VSYNC output
- * fid_polarity:
- *                      0 -> the field ID output is set to logic 1 for an odd
- *                           field (field 1) and set to logic 0 for an even
- *                           field (field 0).
- *                      1 -> operation with polarity inverted.
+#define TVP7002_MODULE_NAME "tvp7002"
+
+/**
+ * struct tvp7002_config - Platform dependent data
+ *@clk_polarity: Clock polarity
+ *              0 - Data clocked out on rising edge of DATACLK signal
+ *              1 - Data clocked out on falling edge of DATACLK signal
+ *@hs_polarity:  HSYNC polarity
+ *              0 - Active low HSYNC output, 1 - Active high HSYNC output
+ *@vs_polarity: VSYNC Polarity
+ *              0 - Active low VSYNC output, 1 - Active high VSYNC output
+ *@fid_polarity: Active-high Field ID polarity.
+ *              0 - The field ID output is set to logic 1 for an odd field
+ *                  (field 1) and set to logic 0 for an even field (field 0).
+ *              1 - Operation with polarity inverted.
+ *@sog_polarity: Active high Sync on Green output polarity.
+ *              0 - Normal operation, 1 - Operation with polarity inverted
  */
 struct tvp7002_config {
-        u8 clk_polarity;
-        u8 hs_polarity;
-        u8 vs_polarity;
-        u8 fid_polarity;
-        u8 sog_polarity;
+        bool clk_polarity;
+        bool hs_polarity;
+        bool vs_polarity;
+        bool fid_polarity;
+        bool sog_polarity;
 };
 #endif
diff --git a/include/media/v4l2-async.h b/include/media/v4l2-async.h
new file mode 100644
index 000000000000..c3ec6ac75f7e
--- /dev/null
+++ b/include/media/v4l2-async.h
@@ -0,0 +1,105 @@
+/*
+ * V4L2 asynchronous subdevice registration API
+ *
+ * Copyright (C) 2012-2013, Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef V4L2_ASYNC_H
+#define V4L2_ASYNC_H
+
+#include <linux/list.h>
+#include <linux/mutex.h>
+
+struct device;
+struct v4l2_device;
+struct v4l2_subdev;
+struct v4l2_async_notifier;
+
+/* A random max subdevice number, used to allocate an array on stack */
+#define V4L2_MAX_SUBDEVS 128U
+
+enum v4l2_async_bus_type {
+        V4L2_ASYNC_BUS_CUSTOM,
+        V4L2_ASYNC_BUS_PLATFORM,
+        V4L2_ASYNC_BUS_I2C,
+};
+
+/**
+ * struct v4l2_async_subdev - sub-device descriptor, as known to a bridge
+ * @bus_type:   subdevice bus type to select the appropriate matching method
+ * @match:      union of per-bus type matching data sets
+ * @list:       used to link struct v4l2_async_subdev objects, waiting to be
+ *              probed, to a notifier->waiting list
+ */
+struct v4l2_async_subdev {
+        enum v4l2_async_bus_type bus_type;
+        union {
+                struct {
+                        const char *name;
+                } platform;
+                struct {
+                        int adapter_id;
+                        unsigned short address;
+                } i2c;
+                struct {
+                        bool (*match)(struct device *,
+                                      struct v4l2_async_subdev *);
+                        void *priv;
+                } custom;
+        } match;
+
+        /* v4l2-async core private: not to be used by drivers */
+        struct list_head list;
+};
+
+/**
+ * v4l2_async_subdev_list - provided by subdevices
+ * @list:       links struct v4l2_async_subdev_list objects to a global list
+ *              before probing, and onto notifier->done after probing
+ * @asd:        pointer to respective struct v4l2_async_subdev
+ * @notifier:   pointer to managing notifier
+ */
+struct v4l2_async_subdev_list {
+        struct list_head list;
+        struct v4l2_async_subdev *asd;
+        struct v4l2_async_notifier *notifier;
+};
+
+/**
+ * v4l2_async_notifier - v4l2_device notifier data
+ * @num_subdevs:number of subdevices
+ * @subdev:     array of pointers to subdevice descriptors
+ * @v4l2_dev:   pointer to struct v4l2_device
+ * @waiting:    list of struct v4l2_async_subdev, waiting for their drivers
+ * @done:       list of struct v4l2_async_subdev_list, already probed
+ * @list:       member in a global list of notifiers
+ * @bound:      a subdevice driver has successfully probed one of subdevices
+ * @complete:   all subdevices have been probed successfully
+ * @unbind:     a subdevice is leaving
+ */
+struct v4l2_async_notifier {
+        unsigned int num_subdevs;
+        struct v4l2_async_subdev **subdev;
+        struct v4l2_device *v4l2_dev;
+        struct list_head waiting;
+        struct list_head done;
+        struct list_head list;
+        int (*bound)(struct v4l2_async_notifier *notifier,
+                     struct v4l2_subdev *subdev,
+                     struct v4l2_async_subdev *asd);
+        int (*complete)(struct v4l2_async_notifier *notifier);
+        void (*unbind)(struct v4l2_async_notifier *notifier,
+                       struct v4l2_subdev *subdev,
+                       struct v4l2_async_subdev *asd);
+};
+
+int v4l2_async_notifier_register(struct v4l2_device *v4l2_dev,
+                                 struct v4l2_async_notifier *notifier);
+void v4l2_async_notifier_unregister(struct v4l2_async_notifier *notifier);
+int v4l2_async_register_subdev(struct v4l2_subdev *sd);
+void v4l2_async_unregister_subdev(struct v4l2_subdev *sd);
+#endif
diff --git a/include/media/v4l2-chip-ident.h b/include/media/v4l2-chip-ident.h
deleted file mode 100644
index c259b36bf1e9..000000000000
--- a/include/media/v4l2-chip-ident.h
+++ /dev/null
@@ -1,352 +0,0 @@
-/*
-    v4l2 chip identifiers header
-
-    This header provides a list of chip identifiers that can be returned
-    through the VIDIOC_DBG_G_CHIP_IDENT ioctl.
-
-    Copyright (C) 2007 Hans Verkuil <hverkuil@xs4all.nl>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-
-#ifndef V4L2_CHIP_IDENT_H_
-#define V4L2_CHIP_IDENT_H_
-
-/* VIDIOC_DBG_G_CHIP_IDENT: identifies the actual chip installed on the board */
-
-/* KEEP THIS LIST ORDERED BY ID!
-   Otherwise it will be hard to see which ranges are already in use when
-   adding support to a new chip family. */
-enum {
-        /* general idents: reserved range 0-49 */
-        V4L2_IDENT_NONE      = 0,       /* No chip matched */
-        V4L2_IDENT_AMBIGUOUS = 1,       /* Match too general, multiple chips matched */
-        V4L2_IDENT_UNKNOWN   = 2,       /* Chip found, but cannot identify */
-
-        /* module tvaudio: reserved range 50-99 */
-        V4L2_IDENT_TVAUDIO = 50,        /* A tvaudio chip, unknown which it is exactly */
-
-        /* Sony IMX074 */
-        V4L2_IDENT_IMX074 = 74,
-
-        /* module saa7110: just ident 100 */
-        V4L2_IDENT_SAA7110 = 100,
-
-        /* module saa7115: reserved range 101-149 */
-        V4L2_IDENT_SAA7111 = 101,
-        V4L2_IDENT_SAA7111A = 102,
-        V4L2_IDENT_SAA7113 = 103,
-        V4L2_IDENT_SAA7114 = 104,
-        V4L2_IDENT_SAA7115 = 105,
-        V4L2_IDENT_SAA7118 = 108,
-
-        /* module saa7127: reserved range 150-199 */
-        V4L2_IDENT_SAA7127 = 157,
-        V4L2_IDENT_SAA7129 = 159,
-
-        /* module cx25840: reserved range 200-249 */
-        V4L2_IDENT_CX25836 = 236,
-        V4L2_IDENT_CX25837 = 237,
-        V4L2_IDENT_CX25840 = 240,
-        V4L2_IDENT_CX25841 = 241,
-        V4L2_IDENT_CX25842 = 242,
-        V4L2_IDENT_CX25843 = 243,
-
-        /* OmniVision sensors: reserved range 250-299 */
-        V4L2_IDENT_OV7670 = 250,
-        V4L2_IDENT_OV7720 = 251,
-        V4L2_IDENT_OV7725 = 252,
-        V4L2_IDENT_OV7660 = 253,
-        V4L2_IDENT_OV9650 = 254,
-        V4L2_IDENT_OV9655 = 255,
-        V4L2_IDENT_SOI968 = 256,
-        V4L2_IDENT_OV9640 = 257,
-        V4L2_IDENT_OV6650 = 258,
-        V4L2_IDENT_OV2640 = 259,
-        V4L2_IDENT_OV9740 = 260,
-        V4L2_IDENT_OV5642 = 261,
-
-        /* module saa7146: reserved range 300-309 */
-        V4L2_IDENT_SAA7146 = 300,
-
-        /* Conexant MPEG encoder/decoders: reserved range 400-420 */
-        V4L2_IDENT_CX23418_843 = 403, /* Integrated A/V Decoder on the '418 */
-        V4L2_IDENT_CX23415 = 415,
-        V4L2_IDENT_CX23416 = 416,
-        V4L2_IDENT_CX23417 = 417,
-        V4L2_IDENT_CX23418 = 418,
-
-        /* module bt819: reserved range 810-819 */
-        V4L2_IDENT_BT815A = 815,
-        V4L2_IDENT_BT817A = 817,
-        V4L2_IDENT_BT819A = 819,
-
-        /* module au0828 */
-        V4L2_IDENT_AU0828 = 828,
-
-        /* module bttv: ident 848 + 849 */
-        V4L2_IDENT_BT848 = 848,
-        V4L2_IDENT_BT849 = 849,
-
-        /* module bt856: just ident 856 */
-        V4L2_IDENT_BT856 = 856,
-
-        /* module bt866: just ident 866 */
-        V4L2_IDENT_BT866 = 866,
-
-        /* module bttv: ident 878 + 879 */
-        V4L2_IDENT_BT878 = 878,
-        V4L2_IDENT_BT879 = 879,
-
-        /* module ks0127: reserved range 1120-1129 */
-        V4L2_IDENT_KS0122S = 1122,
-        V4L2_IDENT_KS0127  = 1127,
-        V4L2_IDENT_KS0127B = 1128,
-
-        /* module indycam: just ident 2000 */
-        V4L2_IDENT_INDYCAM = 2000,
-
-        /* module vp27smpx: just ident 2700 */
-        V4L2_IDENT_VP27SMPX = 2700,
-
-        /* module vpx3220: reserved range: 3210-3229 */
-        V4L2_IDENT_VPX3214C = 3214,
-        V4L2_IDENT_VPX3216B = 3216,
-        V4L2_IDENT_VPX3220A = 3220,
-
-        /* VX855 just ident 3409 */
-        /* Other via devs could use 3314, 3324, 3327, 3336, 3364, 3353 */
-        V4L2_IDENT_VIA_VX855 = 3409,
-
-        /* module tvp5150 */
-        V4L2_IDENT_TVP5150 = 5150,
-
-        /* module saa5246a: just ident 5246 */
-        V4L2_IDENT_SAA5246A = 5246,
-
-        /* module saa5249: just ident 5249 */
-        V4L2_IDENT_SAA5249 = 5249,
-
-        /* module cs5345: just ident 5345 */
-        V4L2_IDENT_CS5345 = 5345,
-
-        /* module tea6415c: just ident 6415 */
-        V4L2_IDENT_TEA6415C = 6415,
-
-        /* module tea6420: just ident 6420 */
-        V4L2_IDENT_TEA6420 = 6420,
-
-        /* module saa6588: just ident 6588 */
-        V4L2_IDENT_SAA6588 = 6588,
-
-        /* module vs6624: just ident 6624 */
-        V4L2_IDENT_VS6624 = 6624,
-
-        /* module saa6752hs: reserved range 6750-6759 */
-        V4L2_IDENT_SAA6752HS = 6752,
-        V4L2_IDENT_SAA6752HS_AC3 = 6753,
-
-        /* modules tef6862: just ident 6862 */
-        V4L2_IDENT_TEF6862 = 6862,
-
-        /* module tvp7002: just ident 7002 */
-        V4L2_IDENT_TVP7002 = 7002,
-
-        /* module adv7170: just ident 7170 */
-        V4L2_IDENT_ADV7170 = 7170,
-
-        /* module adv7175: just ident 7175 */
-        V4L2_IDENT_ADV7175 = 7175,
-
-        /* module adv7180: just ident 7180 */
-        V4L2_IDENT_ADV7180 = 7180,
-
-        /* module adv7183: just ident 7183 */
-        V4L2_IDENT_ADV7183 = 7183,
-
-        /* module saa7185: just ident 7185 */
-        V4L2_IDENT_SAA7185 = 7185,
-
-        /* module saa7191: just ident 7191 */
-        V4L2_IDENT_SAA7191 = 7191,
-
-        /* module ths7303: just ident 7303 */
-        V4L2_IDENT_THS7303 = 7303,
-
-        /* module adv7343: just ident 7343 */
-        V4L2_IDENT_ADV7343 = 7343,
-
-        /* module ths7353: just ident 7353 */
-        V4L2_IDENT_THS7353 = 7353,
-
-        /* module adv7393: just ident 7393 */
-        V4L2_IDENT_ADV7393 = 7393,
-
-        /* module adv7604: just ident 7604 */
-        V4L2_IDENT_ADV7604 = 7604,
-
-        /* module saa7706h: just ident 7706 */
-        V4L2_IDENT_SAA7706H = 7706,
-
-        /* module mt9v011, just ident 8243 */
-        V4L2_IDENT_MT9V011 = 8243,
-
-        /* module wm8739: just ident 8739 */
-        V4L2_IDENT_WM8739 = 8739,
-
-        /* module wm8775: just ident 8775 */
-        V4L2_IDENT_WM8775 = 8775,
-
-        /* Marvell controllers starting at 8801 */
-        V4L2_IDENT_CAFE = 8801,
-        V4L2_IDENT_ARMADA610 = 8802,
-
-        /* AKM AK8813/AK8814 */
-        V4L2_IDENT_AK8813 = 8813,
-        V4L2_IDENT_AK8814 = 8814,
-
-        /* module cx23885 and cx25840 */
-        V4L2_IDENT_CX23885    = 8850,
-        V4L2_IDENT_CX23885_AV = 8851, /* Integrated A/V decoder */
-        V4L2_IDENT_CX23887    = 8870,
-        V4L2_IDENT_CX23887_AV = 8871, /* Integrated A/V decoder */
-        V4L2_IDENT_CX23888    = 8880,
-        V4L2_IDENT_CX23888_AV = 8881, /* Integrated A/V decoder */
-        V4L2_IDENT_CX23888_IR = 8882, /* Integrated infrared controller */
-
-        /* module ad9389b: just ident 9389 */
-        V4L2_IDENT_AD9389B = 9389,
-
-        /* module tda9840: just ident 9840 */
-        V4L2_IDENT_TDA9840 = 9840,
-
-        /* module tw9910: just ident 9910 */
-        V4L2_IDENT_TW9910 = 9910,
-
-        /* module sn9c20x: just ident 10000 */
-        V4L2_IDENT_SN9C20X = 10000,
-
-        /* module cx231xx and cx25840 */
-        V4L2_IDENT_CX2310X_AV = 23099, /* Integrated A/V decoder; not in '100 */
-        V4L2_IDENT_CX23100    = 23100,
-        V4L2_IDENT_CX23101    = 23101,
-        V4L2_IDENT_CX23102    = 23102,
-
-        /* module msp3400: reserved range 34000-34999 for msp34xx */
-        V4L2_IDENT_MSPX4XX  = 34000, /* generic MSPX4XX identifier, only
-                                        use internally (tveeprom.c). */
-
-        V4L2_IDENT_MSP3400B = 34002,
-        V4L2_IDENT_MSP3400C = 34003,
-        V4L2_IDENT_MSP3400D = 34004,
-        V4L2_IDENT_MSP3400G = 34007,
-        V4L2_IDENT_MSP3401G = 34017,
-        V4L2_IDENT_MSP3402G = 34027,
-        V4L2_IDENT_MSP3405D = 34054,
-        V4L2_IDENT_MSP3405G = 34057,
-        V4L2_IDENT_MSP3407D = 34074,
-        V4L2_IDENT_MSP3407G = 34077,
-
-        V4L2_IDENT_MSP3410B = 34102,
-        V4L2_IDENT_MSP3410C = 34103,
-        V4L2_IDENT_MSP3410D = 34104,
-        V4L2_IDENT_MSP3410G = 34107,
-        V4L2_IDENT_MSP3411G = 34117,
-        V4L2_IDENT_MSP3412G = 34127,
-        V4L2_IDENT_MSP3415D = 34154,
-        V4L2_IDENT_MSP3415G = 34157,
-        V4L2_IDENT_MSP3417D = 34174,
-        V4L2_IDENT_MSP3417G = 34177,
-
-        V4L2_IDENT_MSP3420G = 34207,
-        V4L2_IDENT_MSP3421G = 34217,
-        V4L2_IDENT_MSP3422G = 34227,
-        V4L2_IDENT_MSP3425G = 34257,
-        V4L2_IDENT_MSP3427G = 34277,
-
-        V4L2_IDENT_MSP3430G = 34307,
-        V4L2_IDENT_MSP3431G = 34317,
-        V4L2_IDENT_MSP3435G = 34357,
-        V4L2_IDENT_MSP3437G = 34377,
-
-        V4L2_IDENT_MSP3440G = 34407,
-        V4L2_IDENT_MSP3441G = 34417,
-        V4L2_IDENT_MSP3442G = 34427,
-        V4L2_IDENT_MSP3445G = 34457,
-        V4L2_IDENT_MSP3447G = 34477,
-
-        V4L2_IDENT_MSP3450G = 34507,
-        V4L2_IDENT_MSP3451G = 34517,
-        V4L2_IDENT_MSP3452G = 34527,
-        V4L2_IDENT_MSP3455G = 34557,
-        V4L2_IDENT_MSP3457G = 34577,
-
-        V4L2_IDENT_MSP3460G = 34607,
-        V4L2_IDENT_MSP3461G = 34617,
-        V4L2_IDENT_MSP3465G = 34657,
-        V4L2_IDENT_MSP3467G = 34677,
-
-        /* module msp3400: reserved range 44000-44999 for msp44xx */
-        V4L2_IDENT_MSP4400G = 44007,
-        V4L2_IDENT_MSP4408G = 44087,
-        V4L2_IDENT_MSP4410G = 44107,
-        V4L2_IDENT_MSP4418G = 44187,
-        V4L2_IDENT_MSP4420G = 44207,
-        V4L2_IDENT_MSP4428G = 44287,
-        V4L2_IDENT_MSP4440G = 44407,
-        V4L2_IDENT_MSP4448G = 44487,
-        V4L2_IDENT_MSP4450G = 44507,
-        V4L2_IDENT_MSP4458G = 44587,
-
-        /* Micron CMOS sensor chips: 45000-45099 */
-        V4L2_IDENT_MT9M001C12ST         = 45000,
-        V4L2_IDENT_MT9M001C12STM        = 45005,
-        V4L2_IDENT_MT9M111              = 45007,
-        V4L2_IDENT_MT9M112              = 45008,
-        V4L2_IDENT_MT9V022IX7ATC        = 45010, /* No way to detect "normal" I77ATx */
-        V4L2_IDENT_MT9V022IX7ATM        = 45015, /* and "lead free" IA7ATx chips */
-        V4L2_IDENT_MT9T031              = 45020,
-        V4L2_IDENT_MT9T111              = 45021,
-        V4L2_IDENT_MT9T112              = 45022,
-        V4L2_IDENT_MT9V111              = 45031,
-        V4L2_IDENT_MT9V112              = 45032,
-
-        /* HV7131R CMOS sensor: just ident 46000 */
-        V4L2_IDENT_HV7131R              = 46000,
-
-        /* Sharp RJ54N1CB0C, 0xCB0C = 51980 */
-        V4L2_IDENT_RJ54N1CB0C = 51980,
-
-        /* module m52790: just ident 52790 */
-        V4L2_IDENT_M52790 = 52790,
-
-        /* module cs53132a: just ident 53132 */
-        V4L2_IDENT_CS53l32A = 53132,
-
-        /* modules upd61151 MPEG2 encoder: just ident 54000 */
-        V4L2_IDENT_UPD61161 = 54000,
-        /* modules upd61152 MPEG2 encoder with AC3: just ident 54001 */
-        V4L2_IDENT_UPD61162 = 54001,
-
-        /* module upd64031a: just ident 64031 */
-        V4L2_IDENT_UPD64031A = 64031,
-
-        /* module upd64083: just ident 64083 */
-        V4L2_IDENT_UPD64083 = 64083,
-
-        /* Don't just add new IDs at the end: KEEP THIS LIST ORDERED BY ID! */
-};
-
-#endif
diff --git a/include/media/v4l2-clk.h b/include/media/v4l2-clk.h
new file mode 100644
index 000000000000..0503a90b48bb
--- /dev/null
+++ b/include/media/v4l2-clk.h
@@ -0,0 +1,54 @@
+/*
+ * V4L2 clock service
+ *
+ * Copyright (C) 2012-2013, Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * ATTENTION: This is a temporary API and it shall be replaced by the generic
+ * clock API, when the latter becomes widely available.
+ */
+
+#ifndef MEDIA_V4L2_CLK_H
+#define MEDIA_V4L2_CLK_H
+
+#include <linux/atomic.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+
+struct module;
+struct device;
+
+struct v4l2_clk {
+        struct list_head list;
+        const struct v4l2_clk_ops *ops;
+        const char *dev_id;
+        const char *id;
+        int enable;
+        struct mutex lock; /* Protect the enable count */
+        atomic_t use_count;
+        void *priv;
+};
+
+struct v4l2_clk_ops {
+        struct module   *owner;
+        int             (*enable)(struct v4l2_clk *clk);
+        void            (*disable)(struct v4l2_clk *clk);
+        unsigned long   (*get_rate)(struct v4l2_clk *clk);
+        int             (*set_rate)(struct v4l2_clk *clk, unsigned long);
+};
+
+struct v4l2_clk *v4l2_clk_register(const struct v4l2_clk_ops *ops,
+                                   const char *dev_name,
+                                   const char *name, void *priv);
+void v4l2_clk_unregister(struct v4l2_clk *clk);
+struct v4l2_clk *v4l2_clk_get(struct device *dev, const char *id);
+void v4l2_clk_put(struct v4l2_clk *clk);
+int v4l2_clk_enable(struct v4l2_clk *clk);
+void v4l2_clk_disable(struct v4l2_clk *clk);
+unsigned long v4l2_clk_get_rate(struct v4l2_clk *clk);
+int v4l2_clk_set_rate(struct v4l2_clk *clk, unsigned long rate);
+
+#endif
diff --git a/include/media/v4l2-common.h b/include/media/v4l2-common.h
index 1d93c48cb371..015ff82da73c 100644
--- a/include/media/v4l2-common.h
+++ b/include/media/v4l2-common.h
@@ -100,16 +100,6 @@ u32 v4l2_ctrl_next(const u32 * const *ctrl_classes, u32 id);
 
 /* ------------------------------------------------------------------------- */
 
-/* Register/chip ident helper function */
-
-struct i2c_client; /* forward reference */
-int v4l2_chip_match_i2c_client(struct i2c_client *c, const struct v4l2_dbg_match *match);
-int v4l2_chip_ident_i2c_client(struct i2c_client *c, struct v4l2_dbg_chip_ident *chip,
-                u32 ident, u32 revision);
-int v4l2_chip_match_host(const struct v4l2_dbg_match *match);
-
-/* ------------------------------------------------------------------------- */
-
 /* I2C Helper functions */
 
 struct i2c_driver;
diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
index 95d1c91770f4..c768c9f8abc2 100644
--- a/include/media/v4l2-dev.h
+++ b/include/media/v4l2-dev.h
@@ -96,9 +96,9 @@ struct video_device
         struct device dev;              /* v4l device */
         struct cdev *cdev;              /* character device */
 
-        /* Set either parent or v4l2_dev if your driver uses v4l2_device */
-        struct device *parent;          /* device parent */
         struct v4l2_device *v4l2_dev;   /* v4l2_device parent */
+        /* Only set parent if that can't be deduced from v4l2_dev */
+        struct device *dev_parent;      /* device parent */
 
         /* Control handler associated with this device node. May be NULL. */
         struct v4l2_ctrl_handler *ctrl_handler;
@@ -129,7 +129,6 @@ struct video_device
 
         /* Video standard vars */
         v4l2_std_id tvnorms;            /* Supported tv norms */
-        v4l2_std_id current_norm;       /* Current tvnorm */
 
         /* callbacks */
         void (*release)(struct video_device *vdev);
diff --git a/include/media/v4l2-int-device.h b/include/media/v4l2-int-device.h
index e6aa2318367b..0286c95814ff 100644
--- a/include/media/v4l2-int-device.h
+++ b/include/media/v4l2-int-device.h
@@ -220,8 +220,6 @@ enum v4l2_int_ioctl_num {
         vidioc_int_reset_num,
         /* VIDIOC_INT_INIT */
         vidioc_int_init_num,
-        /* VIDIOC_DBG_G_CHIP_IDENT */
-        vidioc_int_g_chip_ident_num,
 
         /*
          *
@@ -303,6 +301,5 @@ V4L2_INT_WRAPPER_1(enum_frameintervals, struct v4l2_frmivalenum, *);
 
 V4L2_INT_WRAPPER_0(reset);
 V4L2_INT_WRAPPER_0(init);
-V4L2_INT_WRAPPER_1(g_chip_ident, int, *);
 
 #endif
diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h
index 931652f0e2af..e0b74a430b3a 100644
--- a/include/media/v4l2-ioctl.h
+++ b/include/media/v4l2-ioctl.h
@@ -247,8 +247,6 @@ struct v4l2_ioctl_ops {
         int (*vidioc_g_chip_info)      (struct file *file, void *fh,
                                         struct v4l2_dbg_chip_info *chip);
 #endif
-        int (*vidioc_g_chip_ident)     (struct file *file, void *fh,
-                                        struct v4l2_dbg_chip_ident *chip);
 
         int (*vidioc_enum_framesizes)   (struct file *file, void *fh,
                                          struct v4l2_frmsizeenum *fsize);
diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h
index 5298d678d0f3..3250cc5e7925 100644
--- a/include/media/v4l2-subdev.h
+++ b/include/media/v4l2-subdev.h
@@ -24,6 +24,7 @@
 #include <linux/types.h>
 #include <linux/v4l2-subdev.h>
 #include <media/media-entity.h>
+#include <media/v4l2-async.h>
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
 #include <media/v4l2-fh.h>
@@ -88,7 +89,6 @@ struct v4l2_decode_vbi_line {
 
 /* Core ops: it is highly recommended to implement at least these ops:
 
-   g_chip_ident
    log_status
    g_register
    s_register
@@ -145,7 +145,6 @@ struct v4l2_subdev_io_pin_config {
         performed later.  It must not sleep.  *Called from an IRQ context*.
  */
 struct v4l2_subdev_core_ops {
-        int (*g_chip_ident)(struct v4l2_subdev *sd, struct v4l2_dbg_chip_ident *chip);
         int (*log_status)(struct v4l2_subdev *sd);
         int (*s_io_pin_config)(struct v4l2_subdev *sd, size_t n,
                                       struct v4l2_subdev_io_pin_config *pincfg);
@@ -585,8 +584,17 @@ struct v4l2_subdev {
         void *host_priv;
         /* subdev device node */
         struct video_device *devnode;
+        /* pointer to the physical device, if any */
+        struct device *dev;
+        struct v4l2_async_subdev_list asdl;
 };
 
+static inline struct v4l2_subdev *v4l2_async_to_subdev(
+                        struct v4l2_async_subdev_list *asdl)
+{
+        return container_of(asdl, struct v4l2_subdev, asdl);
+}
+
 #define media_entity_to_v4l2_subdev(ent) \
         container_of(ent, struct v4l2_subdev, entity)
 #define vdev_to_v4l2_subdev(vdev) \
@@ -660,7 +668,7 @@ void v4l2_subdev_init(struct v4l2_subdev *sd,
 /* Call an ops of a v4l2_subdev, doing the right checks against
    NULL pointers.
 
-   Example: err = v4l2_subdev_call(sd, core, g_chip_ident, &chip);
+   Example: err = v4l2_subdev_call(sd, core, s_std, norm);
  */
 #define v4l2_subdev_call(sd, o, f, args...)                             \
         (!(sd) ? -ENODEV : (((sd)->ops->o && (sd)->ops->o->f) ? \
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index adcbb20f6511..d9fa68f26c41 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -26,6 +26,9 @@
 #ifndef NET_9P_TRANSPORT_H
 #define NET_9P_TRANSPORT_H
 
+#define P9_DEF_MIN_RESVPORT     (665U)
+#define P9_DEF_MAX_RESVPORT     (1023U)
+
 /**
  * struct p9_trans_module - transport module interface
  * @list: used to maintain a list of currently available transports
@@ -37,6 +40,8 @@
  * @close: member function to discard a connection on this transport
  * @request: member function to issue a request to the transport
  * @cancel: member function to cancel a request (if it hasn't been sent)
+ * @cancelled: member function to notify that a cancelled request will not
+ *             not receive a reply
  *
  * This is the basic API for a transport module which is registered by the
  * transport module with the 9P core network module and used by the client
@@ -55,6 +60,7 @@ struct p9_trans_module {
         void (*close) (struct p9_client *);
         int (*request) (struct p9_client *, struct p9_req_t *req);
         int (*cancel) (struct p9_client *, struct p9_req_t *req);
+        int (*cancelled)(struct p9_client *, struct p9_req_t *req);
         int (*zc_request)(struct p9_client *, struct p9_req_t *,
                           char *, char *, int , int, int, int);
 };
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 06ef7e926a66..b8ffac7b6bab 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -18,7 +18,7 @@ struct tcf_common {
         struct tcf_t                    tcfc_tm;
         struct gnet_stats_basic_packed  tcfc_bstats;
         struct gnet_stats_queue         tcfc_qstats;
-        struct gnet_stats_rate_est      tcfc_rate_est;
+        struct gnet_stats_rate_est64    tcfc_rate_est;
         spinlock_t                      tcfc_lock;
         struct rcu_head                 tcfc_rcu;
 };
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 21f702704f24..c7b181cb47a6 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -86,6 +86,9 @@ extern int			ipv6_dev_get_saddr(struct net *net,
                                                const struct in6_addr *daddr,
                                                unsigned int srcprefs,
                                                struct in6_addr *saddr);
+extern int                      __ipv6_get_lladdr(struct inet6_dev *idev,
+                                                  struct in6_addr *addr,
+                                                  unsigned char banned_flags);
 extern int                      ipv6_get_lladdr(struct net_device *dev,
                                                 struct in6_addr *addr,
                                                 unsigned char banned_flags);
@@ -155,6 +158,7 @@ extern bool ipv6_chk_mcast_addr(struct net_device *dev,
                                 const struct in6_addr *group,
                                 const struct in6_addr *src_addr);
 
+extern void ipv6_mc_dad_complete(struct inet6_dev *idev);
 /*
  * identify MLD packets for MLD filter exceptions
  */
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index e0512aaef4b8..3c592cf473da 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -107,7 +107,6 @@ enum {
         HCI_MGMT,
         HCI_PAIRABLE,
         HCI_SERVICE_CACHE,
-        HCI_LINK_KEYS,
         HCI_DEBUG_KEYS,
         HCI_UNREGISTER,
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7cb6d360d147..f77885ea78c2 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -117,13 +117,6 @@ struct oob_data {
         u8 randomizer[16];
 };
 
-struct le_scan_params {
-        u8 type;
-        u16 interval;
-        u16 window;
-        int timeout;
-};
-
 #define HCI_MAX_SHORT_NAME_LENGTH       10
 
 struct amp_assoc {
@@ -283,9 +276,6 @@ struct hci_dev {
 
         struct delayed_work     le_scan_disable;
 
-        struct work_struct      le_scan;
-        struct le_scan_params   le_scan_params;
-
         __s8                    adv_tx_power;
         __u8                    adv_data[HCI_MAX_AD_LENGTH];
         __u8                    adv_data_len;
@@ -432,6 +422,7 @@ void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
                                       struct inquiry_entry *ie);
 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
                               bool name_known, bool *ssp);
+void hci_inquiry_cache_flush(struct hci_dev *hdev);
 
 /* ----- HCI Connections ----- */
 enum {
@@ -1114,6 +1105,16 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event);
                                          BIT(BDADDR_LE_PUBLIC) | \
                                          BIT(BDADDR_LE_RANDOM))
 
+/* These LE scan and inquiry parameters were chosen according to LE General
+ * Discovery Procedure specification.
+ */
+#define DISCOV_LE_SCAN_WIN              0x12
+#define DISCOV_LE_SCAN_INT              0x12
+#define DISCOV_LE_TIMEOUT               msecs_to_jiffies(10240)
+#define DISCOV_INTERLEAVED_TIMEOUT      msecs_to_jiffies(5120)
+#define DISCOV_INTERLEAVED_INQUIRY_LEN  0x04
+#define DISCOV_BREDR_INQUIRY_LEN        0x08
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_index_added(struct hci_dev *hdev);
 int mgmt_index_removed(struct hci_dev *hdev);
@@ -1169,10 +1170,7 @@ int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                       u8 ssp, u8 *eir, u16 eir_len);
 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                      u8 addr_type, s8 rssi, u8 *name, u8 name_len);
-int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status);
-int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status);
 int mgmt_discovering(struct hci_dev *hdev, u8 discovering);
-int mgmt_interleaved_discovery(struct hci_dev *hdev);
 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 bool mgmt_valid_hdev(struct hci_dev *hdev);
@@ -1212,11 +1210,6 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
                                                         __u8 ltk[16]);
-int hci_do_inquiry(struct hci_dev *hdev, u8 length);
-int hci_cancel_inquiry(struct hci_dev *hdev);
-int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
-                int timeout);
-int hci_cancel_le_scan(struct hci_dev *hdev);
 
 u8 bdaddr_to_le(u8 bdaddr_type);
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index fb94cf13c777..1a966afbbfa8 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -242,7 +242,7 @@ struct l2cap_conn_rsp {
 #define L2CAP_CID_SIGNALING     0x0001
 #define L2CAP_CID_CONN_LESS     0x0002
 #define L2CAP_CID_A2MP          0x0003
-#define L2CAP_CID_LE_DATA       0x0004
+#define L2CAP_CID_ATT           0x0004
 #define L2CAP_CID_LE_SIGNALING  0x0005
 #define L2CAP_CID_SMP           0x0006
 #define L2CAP_CID_DYN_START     0x0040
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
new file mode 100644
index 000000000000..a14339c2985f
--- /dev/null
+++ b/include/net/busy_poll.h
@@ -0,0 +1,185 @@
+/*
+ * net busy poll support
+ * Copyright(c) 2013 Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Author: Eliezer Tamir
+ *
+ * Contact Information:
+ * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
+ */
+
+#ifndef _LINUX_NET_BUSY_POLL_H
+#define _LINUX_NET_BUSY_POLL_H
+
+#include <linux/netdevice.h>
+#include <net/ip.h>
+
+#ifdef CONFIG_NET_LL_RX_POLL
+
+struct napi_struct;
+extern unsigned int sysctl_net_busy_read __read_mostly;
+extern unsigned int sysctl_net_busy_poll __read_mostly;
+
+/* return values from ndo_ll_poll */
+#define LL_FLUSH_FAILED         -1
+#define LL_FLUSH_BUSY           -2
+
+static inline bool net_busy_loop_on(void)
+{
+        return sysctl_net_busy_poll;
+}
+
+/* a wrapper to make debug_smp_processor_id() happy
+ * we can use sched_clock() because we don't care much about precision
+ * we only care that the average is bounded
+ */
+#ifdef CONFIG_DEBUG_PREEMPT
+static inline u64 busy_loop_us_clock(void)
+{
+        u64 rc;
+
+        preempt_disable_notrace();
+        rc = sched_clock();
+        preempt_enable_no_resched_notrace();
+
+        return rc >> 10;
+}
+#else /* CONFIG_DEBUG_PREEMPT */
+static inline u64 busy_loop_us_clock(void)
+{
+        return sched_clock() >> 10;
+}
+#endif /* CONFIG_DEBUG_PREEMPT */
+
+static inline unsigned long sk_busy_loop_end_time(struct sock *sk)
+{
+        return busy_loop_us_clock() + ACCESS_ONCE(sk->sk_ll_usec);
+}
+
+/* in poll/select we use the global sysctl_net_ll_poll value */
+static inline unsigned long busy_loop_end_time(void)
+{
+        return busy_loop_us_clock() + ACCESS_ONCE(sysctl_net_busy_poll);
+}
+
+static inline bool sk_can_busy_loop(struct sock *sk)
+{
+        return sk->sk_ll_usec && sk->sk_napi_id &&
+               !need_resched() && !signal_pending(current);
+}
+
+
+static inline bool busy_loop_timeout(unsigned long end_time)
+{
+        unsigned long now = busy_loop_us_clock();
+
+        return time_after(now, end_time);
+}
+
+/* when used in sock_poll() nonblock is known at compile time to be true
+ * so the loop and end_time will be optimized out
+ */
+static inline bool sk_busy_loop(struct sock *sk, int nonblock)
+{
+        unsigned long end_time = !nonblock ? sk_busy_loop_end_time(sk) : 0;
+        const struct net_device_ops *ops;
+        struct napi_struct *napi;
+        int rc = false;
+
+        /*
+         * rcu read lock for napi hash
+         * bh so we don't race with net_rx_action
+         */
+        rcu_read_lock_bh();
+
+        napi = napi_by_id(sk->sk_napi_id);
+        if (!napi)
+                goto out;
+
+        ops = napi->dev->netdev_ops;
+        if (!ops->ndo_busy_poll)
+                goto out;
+
+        do {
+                rc = ops->ndo_busy_poll(napi);
+
+                if (rc == LL_FLUSH_FAILED)
+                        break; /* permanent failure */
+
+                if (rc > 0)
+                        /* local bh are disabled so it is ok to use _BH */
+                        NET_ADD_STATS_BH(sock_net(sk),
+                                         LINUX_MIB_LOWLATENCYRXPACKETS, rc);
+
+        } while (!nonblock && skb_queue_empty(&sk->sk_receive_queue) &&
+                 !need_resched() && !busy_loop_timeout(end_time));
+
+        rc = !skb_queue_empty(&sk->sk_receive_queue);
+out:
+        rcu_read_unlock_bh();
+        return rc;
+}
+
+/* used in the NIC receive handler to mark the skb */
+static inline void skb_mark_napi_id(struct sk_buff *skb,
+                                    struct napi_struct *napi)
+{
+        skb->napi_id = napi->napi_id;
+}
+
+/* used in the protocol hanlder to propagate the napi_id to the socket */
+static inline void sk_mark_napi_id(struct sock *sk, struct sk_buff *skb)
+{
+        sk->sk_napi_id = skb->napi_id;
+}
+
+#else /* CONFIG_NET_LL_RX_POLL */
+static inline unsigned long net_busy_loop_on(void)
+{
+        return 0;
+}
+
+static inline unsigned long busy_loop_end_time(void)
+{
+        return 0;
+}
+
+static inline bool sk_can_busy_loop(struct sock *sk)
+{
+        return false;
+}
+
+static inline bool sk_busy_poll(struct sock *sk, int nonblock)
+{
+        return false;
+}
+
+static inline void skb_mark_napi_id(struct sk_buff *skb,
+                                    struct napi_struct *napi)
+{
+}
+
+static inline void sk_mark_napi_id(struct sock *sk, struct sk_buff *skb)
+{
+}
+
+static inline bool busy_loop_timeout(unsigned long end_time)
+{
+        return true;
+}
+
+#endif /* CONFIG_NET_LL_RX_POLL */
+#endif /* _LINUX_NET_BUSY_POLL_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 26b5b692c22b..7b0730aeb892 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -188,6 +188,8 @@ struct ieee80211_channel {
  *      when used with 802.11g (on the 2.4 GHz band); filled by the
  *      core code when registering the wiphy.
  * @IEEE80211_RATE_ERP_G: This is an ERP rate in 802.11g mode.
+ * @IEEE80211_RATE_SUPPORTS_5MHZ: Rate can be used in 5 MHz mode
+ * @IEEE80211_RATE_SUPPORTS_10MHZ: Rate can be used in 10 MHz mode
  */
 enum ieee80211_rate_flags {
         IEEE80211_RATE_SHORT_PREAMBLE   = 1<<0,
@@ -195,6 +197,8 @@ enum ieee80211_rate_flags {
         IEEE80211_RATE_MANDATORY_B      = 1<<2,
         IEEE80211_RATE_MANDATORY_G      = 1<<3,
         IEEE80211_RATE_ERP_G            = 1<<4,
+        IEEE80211_RATE_SUPPORTS_5MHZ    = 1<<5,
+        IEEE80211_RATE_SUPPORTS_10MHZ   = 1<<6,
 };
 
 /**
@@ -433,6 +437,30 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                              u32 prohibited_flags);
 
 /**
+ * ieee80211_chandef_rate_flags - returns rate flags for a channel
+ *
+ * In some channel types, not all rates may be used - for example CCK
+ * rates may not be used in 5/10 MHz channels.
+ *
+ * @chandef: channel definition for the channel
+ *
+ * Returns: rate flags which apply for this channel
+ */
+static inline enum ieee80211_rate_flags
+ieee80211_chandef_rate_flags(struct cfg80211_chan_def *chandef)
+{
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+                return IEEE80211_RATE_SUPPORTS_5MHZ;
+        case NL80211_CHAN_WIDTH_10:
+                return IEEE80211_RATE_SUPPORTS_10MHZ;
+        default:
+                break;
+        }
+        return 0;
+}
+
+/**
  * enum survey_info_flags - survey information flags
  *
  * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
@@ -753,6 +781,8 @@ int cfg80211_check_station_change(struct wiphy *wiphy,
  * @STATION_INFO_LOCAL_PM: @local_pm filled
  * @STATION_INFO_PEER_PM: @peer_pm filled
  * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
+ * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
+ * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
  */
 enum station_info_flags {
         STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -781,6 +811,8 @@ enum station_info_flags {
         STATION_INFO_NONPEER_PM         = 1<<23,
         STATION_INFO_RX_BYTES64         = 1<<24,
         STATION_INFO_TX_BYTES64         = 1<<25,
+        STATION_INFO_CHAIN_SIGNAL       = 1<<26,
+        STATION_INFO_CHAIN_SIGNAL_AVG   = 1<<27,
 };
 
 /**
@@ -857,6 +889,8 @@ struct sta_bss_parameters {
         u16 beacon_interval;
 };
 
+#define IEEE80211_MAX_CHAINS    4
+
 /**
  * struct station_info - station information
  *
@@ -874,6 +908,9 @@ struct sta_bss_parameters {
  *      For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
  * @signal_avg: Average signal strength, type depends on the wiphy's signal_type.
  *      For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
+ * @chains: bitmask for filled values in @chain_signal, @chain_signal_avg
+ * @chain_signal: per-chain signal strength of last received packet in dBm
+ * @chain_signal_avg: per-chain signal strength average in dBm
  * @txrate: current unicast bitrate from this station
  * @rxrate: current unicast bitrate to this station
  * @rx_packets: packets received from this station
@@ -909,6 +946,11 @@ struct station_info {
         u8 plink_state;
         s8 signal;
         s8 signal_avg;
+
+        u8 chains;
+        s8 chain_signal[IEEE80211_MAX_CHAINS];
+        s8 chain_signal_avg[IEEE80211_MAX_CHAINS];
+
         struct rate_info txrate;
         struct rate_info rxrate;
         u32 rx_packets;
@@ -947,6 +989,7 @@ struct station_info {
  * @MONITOR_FLAG_CONTROL: pass control frames
  * @MONITOR_FLAG_OTHER_BSS: disable BSSID filtering
  * @MONITOR_FLAG_COOK_FRAMES: report frames after processing
+ * @MONITOR_FLAG_ACTIVE: active monitor, ACKs frames on its MAC address
  */
 enum monitor_flags {
         MONITOR_FLAG_FCSFAIL            = 1<<NL80211_MNTR_FLAG_FCSFAIL,
@@ -954,6 +997,7 @@ enum monitor_flags {
         MONITOR_FLAG_CONTROL            = 1<<NL80211_MNTR_FLAG_CONTROL,
         MONITOR_FLAG_OTHER_BSS          = 1<<NL80211_MNTR_FLAG_OTHER_BSS,
         MONITOR_FLAG_COOK_FRAMES        = 1<<NL80211_MNTR_FLAG_COOK_FRAMES,
+        MONITOR_FLAG_ACTIVE             = 1<<NL80211_MNTR_FLAG_ACTIVE,
 };
 
 /**
@@ -1108,6 +1152,9 @@ struct bss_parameters {
  *      setting for new peer links.
  * @dot11MeshAwakeWindowDuration: The duration in TUs the STA will remain awake
  *      after transmitting its beacon.
+ * @plink_timeout: If no tx activity is seen from a STA we've established
+ *      peering with for longer than this time (in seconds), then remove it
+ *      from the STA's list of peers.  Default is 30 minutes.
  */
 struct mesh_config {
         u16 dot11MeshRetryTimeout;
@@ -1137,6 +1184,7 @@ struct mesh_config {
         u16 dot11MeshHWMPconfirmationInterval;
         enum nl80211_mesh_power_mode power_mode;
         u16 dot11MeshAwakeWindowDuration;
+        u32 plink_timeout;
 };
 
 /**
@@ -1147,6 +1195,7 @@ struct mesh_config {
  * @sync_method: which synchronization method to use
  * @path_sel_proto: which path selection protocol to use
  * @path_metric: which metric to use
+ * @auth_id: which authentication method this mesh is using
  * @ie: vendor information elements (optional)
  * @ie_len: length of vendor information elements
  * @is_authenticated: this mesh requires authentication
@@ -1155,6 +1204,7 @@ struct mesh_config {
  * @dtim_period: DTIM period to use
  * @beacon_interval: beacon interval to use
  * @mcast_rate: multicat rate for Mesh Node [6Mbps is the default for 802.11a]
+ * @basic_rates: basic rates to use when creating the mesh
  *
  * These parameters are fixed when the mesh is created.
  */
@@ -1165,6 +1215,7 @@ struct mesh_setup {
         u8 sync_method;
         u8 path_sel_proto;
         u8 path_metric;
+        u8 auth_id;
         const u8 *ie;
         u8 ie_len;
         bool is_authenticated;
@@ -1173,6 +1224,7 @@ struct mesh_setup {
         u8 dtim_period;
         u16 beacon_interval;
         int mcast_rate[IEEE80211_NUM_BANDS];
+        u32 basic_rates;
 };
 
 /**
@@ -1241,6 +1293,7 @@ struct cfg80211_ssid {
  * @scan_start: time (in jiffies) when the scan started
  * @wdev: the wireless device to scan for
  * @aborted: (internal) scan request was notified as aborted
+ * @notified: (internal) scan request was notified as done or aborted
  * @no_cck: used to send probe requests at non CCK rate in 2GHz band
  */
 struct cfg80211_scan_request {
@@ -1258,7 +1311,7 @@ struct cfg80211_scan_request {
         /* internal */
         struct wiphy *wiphy;
         unsigned long scan_start;
-        bool aborted;
+        bool aborted, notified;
         bool no_cck;
 
         /* keep last */
@@ -1406,7 +1459,8 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
  * This structure provides information needed to complete IEEE 802.11
  * authentication.
  *
- * @bss: The BSS to authenticate with.
+ * @bss: The BSS to authenticate with, the callee must obtain a reference
+ *      to it if it needs to keep it.
  * @auth_type: Authentication type (algorithm)
  * @ie: Extra IEs to add to Authentication frame or %NULL
  * @ie_len: Length of ie buffer in octets
@@ -1444,11 +1498,10 @@ enum cfg80211_assoc_req_flags {
  *
  * This structure provides information needed to complete IEEE 802.11
  * (re)association.
- * @bss: The BSS to associate with. If the call is successful the driver
- *      is given a reference that it must release, normally via a call to
- *      cfg80211_send_rx_assoc(), or, if association timed out, with a
- *      call to cfg80211_put_bss() (in addition to calling
- *      cfg80211_send_assoc_timeout())
+ * @bss: The BSS to associate with. If the call is successful the driver is
+ *      given a reference that it must give back to cfg80211_send_rx_assoc()
+ *      or to cfg80211_assoc_timeout(). To ensure proper refcounting, new
+ *      association requests while already associating must be rejected.
  * @ie: Extra IEs to add to (Re)Association Request frame or %NULL
  * @ie_len: Length of ie buffer in octets
  * @use_mfp: Use management frame protection (IEEE 802.11w) in this association
@@ -1850,7 +1903,9 @@ struct cfg80211_update_ft_ies_params {
  * @get_mpath: get a mesh path for the given parameters
  * @dump_mpath: dump mesh path callback -- resume dump at index @idx
  * @join_mesh: join the mesh network with the specified parameters
+ *      (invoked with the wireless_dev mutex held)
  * @leave_mesh: leave the current mesh network
+ *      (invoked with the wireless_dev mutex held)
  *
  * @get_mesh_config: Get the current mesh configuration
  *
@@ -1877,20 +1932,28 @@ struct cfg80211_update_ft_ies_params {
  *      the scan/scan_done bracket too.
  *
  * @auth: Request to authenticate with the specified peer
+ *      (invoked with the wireless_dev mutex held)
  * @assoc: Request to (re)associate with the specified peer
+ *      (invoked with the wireless_dev mutex held)
  * @deauth: Request to deauthenticate from the specified peer
+ *      (invoked with the wireless_dev mutex held)
  * @disassoc: Request to disassociate from the specified peer
+ *      (invoked with the wireless_dev mutex held)
  *
  * @connect: Connect to the ESS with the specified parameters. When connected,
  *      call cfg80211_connect_result() with status code %WLAN_STATUS_SUCCESS.
  *      If the connection fails for some reason, call cfg80211_connect_result()
  *      with the status from the AP.
+ *      (invoked with the wireless_dev mutex held)
  * @disconnect: Disconnect from the BSS/ESS.
+ *      (invoked with the wireless_dev mutex held)
  *
  * @join_ibss: Join the specified IBSS (or create if necessary). Once done, call
  *      cfg80211_ibss_joined(), also call that function when changing BSSID due
  *      to a merge.
+ *      (invoked with the wireless_dev mutex held)
  * @leave_ibss: Leave the IBSS.
+ *      (invoked with the wireless_dev mutex held)
  *
  * @set_mcast_rate: Set the specified multicast rate (only if vif is in ADHOC or
  *      MESH mode)
@@ -2307,6 +2370,7 @@ struct cfg80211_ops {
  *      responds to probe-requests in hardware.
  * @WIPHY_FLAG_OFFCHAN_TX: Device supports direct off-channel TX.
  * @WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL: Device supports remain-on-channel call.
+ * @WIPHY_FLAG_SUPPORTS_5_10_MHZ: Device supports 5 MHz and 10 MHz channels.
  */
 enum wiphy_flags {
         WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
@@ -2330,6 +2394,7 @@ enum wiphy_flags {
         WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD        = BIT(19),
         WIPHY_FLAG_OFFCHAN_TX                   = BIT(20),
         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL        = BIT(21),
+        WIPHY_FLAG_SUPPORTS_5_10_MHZ            = BIT(22),
 };
 
 /**
@@ -2556,6 +2621,9 @@ struct wiphy_wowlan_support {
  *      may request, if implemented.
  *
  * @wowlan: WoWLAN support information
+ * @wowlan_config: current WoWLAN configuration; this should usually not be
+ *      used since access to it is necessarily racy, use the parameter passed
+ *      to the suspend() operation instead.
  *
  * @ap_sme_capa: AP SME capabilities, flags from &enum nl80211_ap_sme_features.
  * @ht_capa_mod_mask:  Specify what ht_cap values can be over-ridden.
@@ -2622,7 +2690,8 @@ struct wiphy {
         u32 hw_version;
 
 #ifdef CONFIG_PM
-        struct wiphy_wowlan_support wowlan;
+        const struct wiphy_wowlan_support *wowlan;
+        struct cfg80211_wowlan *wowlan_config;
 #endif
 
         u16 max_remain_on_channel_duration;
@@ -2820,7 +2889,7 @@ struct cfg80211_cached_keys;
  * @current_bss: (private) Used by the internal configuration code
  * @channel: (private) Used by the internal configuration code to track
  *      the user-set AP, monitor and WDS channel
- * @preset_chan: (private) Used by the internal configuration code to
+ * @preset_chandef: (private) Used by the internal configuration code to
  *      track the channel to be used for AP later
  * @bssid: (private) Used by the internal configuration code
  * @ssid: (private) Used by the internal configuration code
@@ -2834,14 +2903,23 @@ struct cfg80211_cached_keys;
  *      by cfg80211 on change_interface
  * @mgmt_registrations: list of registrations for management frames
  * @mgmt_registrations_lock: lock for the list
- * @mtx: mutex used to lock data in this struct
- * @cleanup_work: work struct used for cleanup that can't be done directly
+ * @mtx: mutex used to lock data in this struct, may be used by drivers
+ *      and some API functions require it held
  * @beacon_interval: beacon interval used on this device for transmitting
  *      beacons, 0 when not valid
  * @address: The address for this device, valid only if @netdev is %NULL
  * @p2p_started: true if this is a P2P Device that has been started
  * @cac_started: true if DFS channel availability check has been started
  * @cac_start_time: timestamp (jiffies) when the dfs state was entered.
+ * @ps: powersave mode is enabled
+ * @ps_timeout: dynamic powersave timeout
+ * @ap_unexpected_nlportid: (private) netlink port ID of application
+ *      registered for unexpected class 3 frames (AP mode)
+ * @conn: (private) cfg80211 software SME connection state machine data
+ * @connect_keys: (private) keys to set after connection is established
+ * @ibss_fixed: (private) IBSS is using fixed BSSID
+ * @event_list: (private) list for internal event processing
+ * @event_lock: (private) lock for event list
  */
 struct wireless_dev {
         struct wiphy *wiphy;
@@ -2858,8 +2936,6 @@ struct wireless_dev {
 
         struct mutex mtx;
 
-        struct work_struct cleanup_work;
-
         bool use_4addr, p2p_started;
 
         u8 address[ETH_ALEN] __aligned(sizeof(u16));
@@ -2867,11 +2943,6 @@ struct wireless_dev {
         /* currently used for IBSS and SME - might be rearranged later */
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         u8 ssid_len, mesh_id_len, mesh_id_up_len;
-        enum {
-                CFG80211_SME_IDLE,
-                CFG80211_SME_CONNECTING,
-                CFG80211_SME_CONNECTED,
-        } sme_state;
         struct cfg80211_conn *conn;
         struct cfg80211_cached_keys *connect_keys;
 
@@ -2989,6 +3060,15 @@ struct ieee80211_rate *
 ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
                             u32 basic_rates, int bitrate);
 
+/**
+ * ieee80211_mandatory_rates - get mandatory rates for a given band
+ * @sband: the band to look for rates in
+ *
+ * This function returns a bitmap of the mandatory rates for the given
+ * band, bits are set according to the rate position in the bitrates array.
+ */
+u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband);
+
 /*
  * Radiotap parsing functions -- for controlled injection support
  *
@@ -3392,122 +3472,87 @@ void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *bss);
 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *bss);
 
 /**
- * cfg80211_send_rx_auth - notification of processed authentication
+ * cfg80211_rx_mlme_mgmt - notification of processed MLME management frame
  * @dev: network device
  * @buf: authentication frame (header + body)
  * @len: length of the frame data
  *
- * This function is called whenever an authentication has been processed in
- * station mode. The driver is required to call either this function or
- * cfg80211_send_auth_timeout() to indicate the result of cfg80211_ops::auth()
- * call. This function may sleep.
+ * This function is called whenever an authentication, disassociation or
+ * deauthentication frame has been received and processed in station mode.
+ * After being asked to authenticate via cfg80211_ops::auth() the driver must
+ * call either this function or cfg80211_auth_timeout().
+ * After being asked to associate via cfg80211_ops::assoc() the driver must
+ * call either this function or cfg80211_auth_timeout().
+ * While connected, the driver must calls this for received and processed
+ * disassociation and deauthentication frames. If the frame couldn't be used
+ * because it was unprotected, the driver must call the function
+ * cfg80211_rx_unprot_mlme_mgmt() instead.
+ *
+ * This function may sleep. The caller must hold the corresponding wdev's mutex.
  */
-void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
+void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len);
 
 /**
- * cfg80211_send_auth_timeout - notification of timed out authentication
+ * cfg80211_auth_timeout - notification of timed out authentication
  * @dev: network device
  * @addr: The MAC address of the device with which the authentication timed out
  *
- * This function may sleep.
+ * This function may sleep. The caller must hold the corresponding wdev's
+ * mutex.
  */
-void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr);
+void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr);
 
 /**
- * cfg80211_send_rx_assoc - notification of processed association
+ * cfg80211_rx_assoc_resp - notification of processed association response
  * @dev: network device
- * @bss: the BSS struct association was requested for, the struct reference
- *      is owned by cfg80211 after this call
- * @buf: (re)association response frame (header + body)
+ * @bss: the BSS that association was requested with, ownership of the pointer
+ *      moves to cfg80211 in this call
+ * @buf: authentication frame (header + body)
  * @len: length of the frame data
  *
- * This function is called whenever a (re)association response has been
- * processed in station mode. The driver is required to call either this
- * function or cfg80211_send_assoc_timeout() to indicate the result of
- * cfg80211_ops::assoc() call. This function may sleep.
+ * After being asked to associate via cfg80211_ops::assoc() the driver must
+ * call either this function or cfg80211_auth_timeout().
+ *
+ * This function may sleep. The caller must hold the corresponding wdev's mutex.
  */
-void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
+void cfg80211_rx_assoc_resp(struct net_device *dev,
+                            struct cfg80211_bss *bss,
                             const u8 *buf, size_t len);
 
 /**
- * cfg80211_send_assoc_timeout - notification of timed out association
+ * cfg80211_assoc_timeout - notification of timed out association
  * @dev: network device
- * @addr: The MAC address of the device with which the association timed out
+ * @bss: The BSS entry with which association timed out.
  *
- * This function may sleep.
+ * This function may sleep. The caller must hold the corresponding wdev's mutex.
  */
-void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr);
+void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
 
 /**
- * cfg80211_send_deauth - notification of processed deauthentication
+ * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
  * @dev: network device
- * @buf: deauthentication frame (header + body)
+ * @buf: 802.11 frame (header + body)
  * @len: length of the frame data
  *
  * This function is called whenever deauthentication has been processed in
  * station mode. This includes both received deauthentication frames and
- * locally generated ones. This function may sleep.
- */
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len);
-
-/**
- * __cfg80211_send_deauth - notification of processed deauthentication
- * @dev: network device
- * @buf: deauthentication frame (header + body)
- * @len: length of the frame data
- *
- * Like cfg80211_send_deauth(), but doesn't take the wdev lock.
- */
-void __cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len);
-
-/**
- * cfg80211_send_disassoc - notification of processed disassociation
- * @dev: network device
- * @buf: disassociation response frame (header + body)
- * @len: length of the frame data
- *
- * This function is called whenever disassociation has been processed in
- * station mode. This includes both received disassociation frames and locally
- * generated ones. This function may sleep.
- */
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len);
-
-/**
- * __cfg80211_send_disassoc - notification of processed disassociation
- * @dev: network device
- * @buf: disassociation response frame (header + body)
- * @len: length of the frame data
- *
- * Like cfg80211_send_disassoc(), but doesn't take the wdev lock.
+ * locally generated ones. This function may sleep. The caller must hold the
+ * corresponding wdev's mutex.
  */
-void __cfg80211_send_disassoc(struct net_device *dev, const u8 *buf,
-        size_t len);
+void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len);
 
 /**
- * cfg80211_send_unprot_deauth - notification of unprotected deauthentication
+ * cfg80211_rx_unprot_mlme_mgmt - notification of unprotected mlme mgmt frame
  * @dev: network device
  * @buf: deauthentication frame (header + body)
  * @len: length of the frame data
  *
- * This function is called whenever a received Deauthentication frame has been
- * dropped in station mode because of MFP being used but the Deauthentication
+ * This function is called whenever a received deauthentication or dissassoc
+ * frame has been dropped in station mode because of MFP being used but the
  * frame was not protected. This function may sleep.
  */
-void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
-                                 size_t len);
-
-/**
- * cfg80211_send_unprot_disassoc - notification of unprotected disassociation
- * @dev: network device
- * @buf: disassociation frame (header + body)
- * @len: length of the frame data
- *
- * This function is called whenever a received Disassociation frame has been
- * dropped in station mode because of MFP being used but the Disassociation
- * frame was not protected. This function may sleep.
- */
-void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
-                                   size_t len);
+void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev,
+                                  const u8 *buf, size_t len);
 
 /**
  * cfg80211_michael_mic_failure - notification of Michael MIC failure (TKIP)
@@ -4153,6 +4198,7 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
  * cfg80211_crit_proto_stopped() - indicate critical protocol stopped by driver.
  *
  * @wdev: the wireless device for which critical protocol is stopped.
+ * @gfp: allocation flags
  *
  * This function can be called by the driver to indicate it has reverted
  * operation back to normal. One reason could be that the duration given
diff --git a/include/net/gen_stats.h b/include/net/gen_stats.h
index a79b6cfb02a8..cf8439ba4d11 100644
--- a/include/net/gen_stats.h
+++ b/include/net/gen_stats.h
@@ -30,7 +30,7 @@ extern int gnet_stats_copy_basic(struct gnet_dump *d,
                                  struct gnet_stats_basic_packed *b);
 extern int gnet_stats_copy_rate_est(struct gnet_dump *d,
                                     const struct gnet_stats_basic_packed *b,
-                                    struct gnet_stats_rate_est *r);
+                                    struct gnet_stats_rate_est64 *r);
 extern int gnet_stats_copy_queue(struct gnet_dump *d,
                                  struct gnet_stats_queue *q);
 extern int gnet_stats_copy_app(struct gnet_dump *d, void *st, int len);
@@ -38,13 +38,13 @@ extern int gnet_stats_copy_app(struct gnet_dump *d, void *st, int len);
 extern int gnet_stats_finish_copy(struct gnet_dump *d);
 
 extern int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
-                             struct gnet_stats_rate_est *rate_est,
+                             struct gnet_stats_rate_est64 *rate_est,
                              spinlock_t *stats_lock, struct nlattr *opt);
 extern void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
-                               struct gnet_stats_rate_est *rate_est);
+                               struct gnet_stats_rate_est64 *rate_est);
 extern int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
-                                 struct gnet_stats_rate_est *rate_est,
+                                 struct gnet_stats_rate_est64 *rate_est,
                                  spinlock_t *stats_lock, struct nlattr *opt);
 extern bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
-                                 const struct gnet_stats_rate_est *rate_est);
+                                 const struct gnet_stats_rate_est64 *rate_est);
 #endif
diff --git a/include/net/gre.h b/include/net/gre.h
index 9f03a390c826..57e4afdf7879 100644
--- a/include/net/gre.h
+++ b/include/net/gre.h
@@ -7,6 +7,7 @@
 #define GREPROTO_CISCO          0
 #define GREPROTO_PPTP           1
 #define GREPROTO_MAX            2
+#define GRE_IP_PROTO_MAX        2
 
 struct gre_protocol {
         int  (*handler)(struct sk_buff *skb);
@@ -22,6 +23,36 @@ struct gre_base_hdr {
 int gre_add_protocol(const struct gre_protocol *proto, u8 version);
 int gre_del_protocol(const struct gre_protocol *proto, u8 version);
 
+struct gre_cisco_protocol {
+        int (*handler)(struct sk_buff *skb, const struct tnl_ptk_info *tpi);
+        int (*err_handler)(struct sk_buff *skb, u32 info,
+                           const struct tnl_ptk_info *tpi);
+        u8 priority;
+};
+
+int gre_cisco_register(struct gre_cisco_protocol *proto);
+int gre_cisco_unregister(struct gre_cisco_protocol *proto);
+
+int gre_offload_init(void);
+void gre_offload_exit(void);
+
+void gre_build_header(struct sk_buff *skb, const struct tnl_ptk_info *tpi,
+                      int hdr_len);
+struct sk_buff *gre_handle_offloads(struct sk_buff *skb, bool gre_csum);
+
+static inline int ip_gre_calc_hlen(__be16 o_flags)
+{
+        int addend = 4;
+
+        if (o_flags&TUNNEL_CSUM)
+                addend += 4;
+        if (o_flags&TUNNEL_KEY)
+                addend += 4;
+        if (o_flags&TUNNEL_SEQ)
+                addend += 4;
+        return addend;
+}
+
 static inline __be16 gre_flags_to_tnl_flags(__be16 flags)
 {
         __be16 tflags = 0;
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index c3999632e616..c6d07cb074bc 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -269,6 +269,7 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_MCS_HAVE_GI          0x04
 #define IEEE80211_RADIOTAP_MCS_HAVE_FMT         0x08
 #define IEEE80211_RADIOTAP_MCS_HAVE_FEC         0x10
+#define IEEE80211_RADIOTAP_MCS_HAVE_STBC        0x20
 
 #define IEEE80211_RADIOTAP_MCS_BW_MASK          0x03
 #define         IEEE80211_RADIOTAP_MCS_BW_20    0
@@ -278,6 +279,12 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_MCS_SGI              0x04
 #define IEEE80211_RADIOTAP_MCS_FMT_GF           0x08
 #define IEEE80211_RADIOTAP_MCS_FEC_LDPC         0x10
+#define IEEE80211_RADIOTAP_MCS_STBC_MASK        0x60
+#define         IEEE80211_RADIOTAP_MCS_STBC_1   1
+#define         IEEE80211_RADIOTAP_MCS_STBC_2   2
+#define         IEEE80211_RADIOTAP_MCS_STBC_3   3
+
+#define IEEE80211_RADIOTAP_MCS_STBC_SHIFT       5
 
 /* For IEEE80211_RADIOTAP_AMPDU_STATUS */
 #define IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN         0x0001
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 100fb8cec17c..736b5fb95474 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -50,7 +50,7 @@ struct inet6_ifaddr {
 
         int                     state;
 
-        __u8                    probes;
+        __u8                    dad_probes;
         __u8                    flags;
 
         __u16                   scope;
@@ -58,7 +58,7 @@ struct inet6_ifaddr {
         unsigned long           cstamp; /* created timestamp */
         unsigned long           tstamp; /* updated timestamp */
 
-        struct timer_list       timer;
+        struct timer_list       dad_timer;
 
         struct inet6_dev        *idev;
         struct rt6_info         *rt;
@@ -74,6 +74,7 @@ struct inet6_ifaddr {
         bool                    tokenized;
 
         struct rcu_head         rcu;
+        struct in6_addr         peer_addr;
 };
 
 struct ip6_sf_socklist {
@@ -165,6 +166,7 @@ struct inet6_dev {
         struct net_device       *dev;
 
         struct list_head        addr_list;
+        int                     valid_ll_addr_cnt;
 
         struct ifmcaddr6        *mc_list;
         struct ifmcaddr6        *mc_tomb;
@@ -172,10 +174,12 @@ struct inet6_dev {
         unsigned char           mc_qrv;
         unsigned char           mc_gq_running;
         unsigned char           mc_ifc_count;
+        unsigned char           mc_dad_count;
         unsigned long           mc_v1_seen;
         unsigned long           mc_maxdelay;
         struct timer_list       mc_gq_timer;    /* general query timer */
         struct timer_list       mc_ifc_timer;   /* interface change timer */
+        struct timer_list       mc_dad_timer;   /* dad complete mc timer */
 
         struct ifacaddr6        *ac_list;
         rwlock_t                lock;
@@ -192,9 +196,12 @@ struct inet6_dev {
         struct in6_addr         token;
 
         struct neigh_parms      *nd_parms;
-        struct inet6_dev        *next;
         struct ipv6_devconf     cnf;
         struct ipv6_devstat     stats;
+
+        struct timer_list       rs_timer;
+        __u8                    rs_probes;
+
         unsigned long           tstamp; /* ipv6InterfaceTable update timestamp */
         struct rcu_head         rcu;
 };
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index aab73757bc4d..3bd22795c3e2 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -134,12 +134,14 @@ static inline int INET_ECN_set_ce(struct sk_buff *skb)
 {
         switch (skb->protocol) {
         case cpu_to_be16(ETH_P_IP):
-                if (skb->network_header + sizeof(struct iphdr) <= skb->tail)
+                if (skb_network_header(skb) + sizeof(struct iphdr) <=
+                    skb_tail_pointer(skb))
                         return IP_ECN_set_ce(ip_hdr(skb));
                 break;
 
         case cpu_to_be16(ETH_P_IPV6):
-                if (skb->network_header + sizeof(struct ipv6hdr) <= skb->tail)
+                if (skb_network_header(skb) + sizeof(struct ipv6hdr) <=
+                    skb_tail_pointer(skb))
                         return IP6_ECN_set_ce(ipv6_hdr(skb));
                 break;
         }
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 7235ae73a1e8..b21a7f06d6a4 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -32,7 +32,6 @@
  *
  * @faddr - Saved first hop address
  * @nexthop - Saved nexthop address in LSRR and SSRR
- * @is_data - Options in __data, rather than skb
  * @is_strictroute - Strict source route
  * @srr_is_hit - Packet destination addr was our one
  * @is_changed - IP checksum more not valid
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index e49db91593a9..cbf2be37c91a 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -51,11 +51,13 @@ struct rtable;
 
 struct fib_nh_exception {
         struct fib_nh_exception __rcu   *fnhe_next;
+        int                             fnhe_genid;
         __be32                          fnhe_daddr;
         u32                             fnhe_pmtu;
         __be32                          fnhe_gw;
         unsigned long                   fnhe_expires;
-        struct rtable __rcu             *fnhe_rth;
+        struct rtable __rcu             *fnhe_rth_input;
+        struct rtable __rcu             *fnhe_rth_output;
         unsigned long                   fnhe_stamp;
 };
 
@@ -289,7 +291,6 @@ static inline int fib_num_tclassid_users(struct net *net)
 extern int ip_fib_check_default(__be32 gw, struct net_device *dev);
 extern int fib_sync_down_dev(struct net_device *dev, int force);
 extern int fib_sync_down_addr(struct net *net, __be32 local);
-extern void fib_update_nh_saddrs(struct net_device *dev);
 extern int fib_sync_up(struct net_device *dev);
 extern void fib_select_multipath(struct fib_result *res);
 
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 09b1360e10bf..781b3cf86a2f 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -42,6 +42,7 @@ struct ip_tunnel {
         struct ip_tunnel __rcu  *next;
         struct hlist_node hash_node;
         struct net_device       *dev;
+        struct net              *net;   /* netns for packet i/o */
 
         int             err_count;      /* Number of arrived ICMP errors */
         unsigned long   err_time;       /* Time when the last ICMP error
@@ -73,6 +74,7 @@ struct ip_tunnel {
 #define TUNNEL_REC      __cpu_to_be16(0x20)
 #define TUNNEL_VERSION  __cpu_to_be16(0x40)
 #define TUNNEL_NO_KEY   __cpu_to_be16(0x80)
+#define TUNNEL_DONT_FRAGMENT    __cpu_to_be16(0x0100)
 
 struct tnl_ptk_info {
         __be16 flags;
@@ -92,6 +94,8 @@ struct ip_tunnel_net {
         struct net_device *fb_tunnel_dev;
 };
 
+#ifdef CONFIG_INET
+
 int ip_tunnel_init(struct net_device *dev);
 void ip_tunnel_uninit(struct net_device *dev);
 void  ip_tunnel_dellink(struct net_device *dev, struct list_head *head);
@@ -101,7 +105,7 @@ int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
 void ip_tunnel_delete_net(struct ip_tunnel_net *itn);
 
 void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
-                    const struct iphdr *tnl_params);
+                    const struct iphdr *tnl_params, const u8 protocol);
 int ip_tunnel_ioctl(struct net_device *dev, struct ip_tunnel_parm *p, int cmd);
 int ip_tunnel_change_mtu(struct net_device *dev, int new_mtu);
 
@@ -155,23 +159,31 @@ static inline void tunnel_ip_select_ident(struct sk_buff *skb,
                                   (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 }
 
-static inline void iptunnel_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-        int err;
-        int pkt_len = skb->len - skb_transport_offset(skb);
-        struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
+int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto);
+int iptunnel_xmit(struct net *net, struct rtable *rt,
+                  struct sk_buff *skb,
+                  __be32 src, __be32 dst, __u8 proto,
+                  __u8 tos, __u8 ttl, __be16 df);
 
-        nf_reset(skb);
+static inline void iptunnel_xmit_stats(int err,
+                                       struct net_device_stats *err_stats,
+                                       struct pcpu_tstats __percpu *stats)
+{
+        if (err > 0) {
+                struct pcpu_tstats *tstats = this_cpu_ptr(stats);
 
-        err = ip_local_out(skb);
-        if (likely(net_xmit_eval(err) == 0)) {
                 u64_stats_update_begin(&tstats->syncp);
-                tstats->tx_bytes += pkt_len;
+                tstats->tx_bytes += err;
                 tstats->tx_packets++;
                 u64_stats_update_end(&tstats->syncp);
+        } else if (err < 0) {
+                err_stats->tx_errors++;
+                err_stats->tx_aborted_errors++;
         } else {
-                dev->stats.tx_errors++;
-                dev->stats.tx_aborted_errors++;
+                err_stats->tx_dropped++;
         }
 }
+
+#endif /* CONFIG_INET */
+
 #endif /* __NET_IP_TUNNELS_H */
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 4c062ccff9aa..f0d70f066f3d 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -197,31 +197,6 @@ ip_vs_fill_iph_skb(int af, const struct sk_buff *skb, struct ip_vs_iphdr *iphdr)
         }
 }
 
-/* This function is a faster version of ip_vs_fill_iph_skb().
- * Where we only populate {s,d}addr (and avoid calling ipv6_find_hdr()).
- * This is used by the some of the ip_vs_*_schedule() functions.
- * (Mostly done to avoid ABI breakage of external schedulers)
- */
-static inline void
-ip_vs_fill_iph_addr_only(int af, const struct sk_buff *skb,
-                         struct ip_vs_iphdr *iphdr)
-{
-#ifdef CONFIG_IP_VS_IPV6
-        if (af == AF_INET6) {
-                const struct ipv6hdr *iph =
-                        (struct ipv6hdr *)skb_network_header(skb);
-                iphdr->saddr.in6 = iph->saddr;
-                iphdr->daddr.in6 = iph->daddr;
-        } else
-#endif
-        {
-                const struct iphdr *iph =
-                        (struct iphdr *)skb_network_header(skb);
-                iphdr->saddr.ip = iph->saddr;
-                iphdr->daddr.ip = iph->daddr;
-        }
-}
-
 static inline void ip_vs_addr_copy(int af, union nf_inet_addr *dst,
                                    const union nf_inet_addr *src)
 {
@@ -405,17 +380,18 @@ enum {
  */
 enum ip_vs_sctp_states {
         IP_VS_SCTP_S_NONE,
-        IP_VS_SCTP_S_INIT_CLI,
-        IP_VS_SCTP_S_INIT_SER,
-        IP_VS_SCTP_S_INIT_ACK_CLI,
-        IP_VS_SCTP_S_INIT_ACK_SER,
-        IP_VS_SCTP_S_ECHO_CLI,
-        IP_VS_SCTP_S_ECHO_SER,
+        IP_VS_SCTP_S_INIT1,
+        IP_VS_SCTP_S_INIT,
+        IP_VS_SCTP_S_COOKIE_SENT,
+        IP_VS_SCTP_S_COOKIE_REPLIED,
+        IP_VS_SCTP_S_COOKIE_WAIT,
+        IP_VS_SCTP_S_COOKIE,
+        IP_VS_SCTP_S_COOKIE_ECHOED,
         IP_VS_SCTP_S_ESTABLISHED,
-        IP_VS_SCTP_S_SHUT_CLI,
-        IP_VS_SCTP_S_SHUT_SER,
-        IP_VS_SCTP_S_SHUT_ACK_CLI,
-        IP_VS_SCTP_S_SHUT_ACK_SER,
+        IP_VS_SCTP_S_SHUTDOWN_SENT,
+        IP_VS_SCTP_S_SHUTDOWN_RECEIVED,
+        IP_VS_SCTP_S_SHUTDOWN_ACK_SENT,
+        IP_VS_SCTP_S_REJECTED,
         IP_VS_SCTP_S_CLOSED,
         IP_VS_SCTP_S_LAST
 };
@@ -814,7 +790,8 @@ struct ip_vs_scheduler {
 
         /* selecting a server from the given service */
         struct ip_vs_dest* (*schedule)(struct ip_vs_service *svc,
-                                       const struct sk_buff *skb);
+                                       const struct sk_buff *skb,
+                                       struct ip_vs_iphdr *iph);
 };
 
 /* The persistence engine object */
@@ -905,7 +882,7 @@ struct ip_vs_app {
 struct ipvs_master_sync_state {
         struct list_head        sync_queue;
         struct ip_vs_sync_buff  *sync_buff;
-        int                     sync_queue_len;
+        unsigned long           sync_queue_len;
         unsigned int            sync_queue_delay;
         struct task_struct      *master_thread;
         struct delayed_work     master_wakeup_work;
@@ -998,10 +975,13 @@ struct netns_ipvs {
         int                     sysctl_snat_reroute;
         int                     sysctl_sync_ver;
         int                     sysctl_sync_ports;
-        int                     sysctl_sync_qlen_max;
+        int                     sysctl_sync_persist_mode;
+        unsigned long           sysctl_sync_qlen_max;
         int                     sysctl_sync_sock_size;
         int                     sysctl_cache_bypass;
         int                     sysctl_expire_nodest_conn;
+        int                     sysctl_sloppy_tcp;
+        int                     sysctl_sloppy_sctp;
         int                     sysctl_expire_quiescent_template;
         int                     sysctl_sync_threshold[2];
         unsigned int            sysctl_sync_refresh_period;
@@ -1044,6 +1024,8 @@ struct netns_ipvs {
 #define DEFAULT_SYNC_THRESHOLD  3
 #define DEFAULT_SYNC_PERIOD     50
 #define DEFAULT_SYNC_VER        1
+#define DEFAULT_SLOPPY_TCP      0
+#define DEFAULT_SLOPPY_SCTP     0
 #define DEFAULT_SYNC_REFRESH_PERIOD     (0U * HZ)
 #define DEFAULT_SYNC_RETRIES            0
 #define IPVS_SYNC_WAKEUP_RATE   8
@@ -1080,12 +1062,27 @@ static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
         return ipvs->sysctl_sync_ver;
 }
 
+static inline int sysctl_sloppy_tcp(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sloppy_tcp;
+}
+
+static inline int sysctl_sloppy_sctp(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sloppy_sctp;
+}
+
 static inline int sysctl_sync_ports(struct netns_ipvs *ipvs)
 {
         return ACCESS_ONCE(ipvs->sysctl_sync_ports);
 }
 
-static inline int sysctl_sync_qlen_max(struct netns_ipvs *ipvs)
+static inline int sysctl_sync_persist_mode(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sync_persist_mode;
+}
+
+static inline unsigned long sysctl_sync_qlen_max(struct netns_ipvs *ipvs)
 {
         return ipvs->sysctl_sync_qlen_max;
 }
@@ -1133,12 +1130,27 @@ static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
         return DEFAULT_SYNC_VER;
 }
 
+static inline int sysctl_sloppy_tcp(struct netns_ipvs *ipvs)
+{
+        return DEFAULT_SLOPPY_TCP;
+}
+
+static inline int sysctl_sloppy_sctp(struct netns_ipvs *ipvs)
+{
+        return DEFAULT_SLOPPY_SCTP;
+}
+
 static inline int sysctl_sync_ports(struct netns_ipvs *ipvs)
 {
         return 1;
 }
 
-static inline int sysctl_sync_qlen_max(struct netns_ipvs *ipvs)
+static inline int sysctl_sync_persist_mode(struct netns_ipvs *ipvs)
+{
+        return 0;
+}
+
+static inline unsigned long sysctl_sync_qlen_max(struct netns_ipvs *ipvs)
 {
         return IPVS_SYNC_QLEN_MAX;
 }
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 0810aa57c780..5fe564985171 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -260,6 +260,12 @@ static inline void fl6_sock_release(struct ip6_flowlabel *fl)
 
 extern void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info);
 
+int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
+                               struct icmp6hdr *thdr, int len);
+
+struct dst_entry *icmpv6_route_lookup(struct net *net, struct sk_buff *skb,
+                                      struct sock *sk, struct flowi6 *fl6);
+
 extern int                      ip6_ra_control(struct sock *sk, int sel);
 
 extern int                      ipv6_parse_hopopts(struct sk_buff *skb);
@@ -853,8 +859,8 @@ static inline int snmp6_unregister_dev(struct inet6_dev *idev) { return 0; }
 #endif
 
 #ifdef CONFIG_SYSCTL
-extern ctl_table ipv6_route_table_template[];
-extern ctl_table ipv6_icmp_table_template[];
+extern struct ctl_table ipv6_route_table_template[];
+extern struct ctl_table ipv6_icmp_table_template[];
 
 extern struct ctl_table *ipv6_icmp_sysctl_init(struct net *net);
 extern struct ctl_table *ipv6_route_sysctl_init(struct net *net);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 885898a40d13..5b7a3dadadde 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -217,8 +217,8 @@ struct ieee80211_chanctx_conf {
  * @BSS_CHANGED_TXPOWER: TX power setting changed for this interface
  * @BSS_CHANGED_P2P_PS: P2P powersave settings (CTWindow, opportunistic PS)
  *      changed (currently only in P2P client mode, GO mode will be later)
- * @BSS_CHANGED_DTIM_PERIOD: the DTIM period value was changed (set when
- *      it becomes valid, managed mode only)
+ * @BSS_CHANGED_BEACON_INFO: Data from the AP's beacon became available:
+ *      currently dtim_period only is under consideration.
  * @BSS_CHANGED_BANDWIDTH: The bandwidth used by this interface changed,
  *      note that this is only called when it changes after the channel
  *      context had been assigned.
@@ -244,7 +244,7 @@ enum ieee80211_bss_change {
         BSS_CHANGED_PS                  = 1<<17,
         BSS_CHANGED_TXPOWER             = 1<<18,
         BSS_CHANGED_P2P_PS              = 1<<19,
-        BSS_CHANGED_DTIM_PERIOD         = 1<<20,
+        BSS_CHANGED_BEACON_INFO         = 1<<20,
         BSS_CHANGED_BANDWIDTH           = 1<<21,
 
         /* when adding here, make sure to change ieee80211_reconfig */
@@ -288,7 +288,7 @@ enum ieee80211_rssi_event {
  *      IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE hardware flag
  * @dtim_period: num of beacons before the next DTIM, for beaconing,
  *      valid in station mode only if after the driver was notified
- *      with the %BSS_CHANGED_DTIM_PERIOD flag, will be non-zero then.
+ *      with the %BSS_CHANGED_BEACON_INFO flag, will be non-zero then.
  * @sync_tsf: last beacon's/probe response's TSF timestamp (could be old
  *      as it may have been received during scanning long ago). If the
  *      HW flag %IEEE80211_HW_TIMING_BEACON_ONLY is set, then this can
@@ -305,6 +305,7 @@ enum ieee80211_rssi_event {
  * @basic_rates: bitmap of basic rates, each bit stands for an
  *      index into the rate table configured by the driver in
  *      the current band.
+ * @beacon_rate: associated AP's beacon TX rate
  * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
  * @bssid: The BSSID for this BSS
  * @enable_beacon: whether beaconing should be enabled or not
@@ -352,6 +353,7 @@ struct ieee80211_bss_conf {
         u32 sync_device_ts;
         u8 sync_dtim_count;
         u32 basic_rates;
+        struct ieee80211_rate *beacon_rate;
         int mcast_rate[IEEE80211_NUM_BANDS];
         u16 ht_operation_mode;
         s32 cqm_rssi_thold;
@@ -460,6 +462,8 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_DONTFRAG: Don't fragment this packet even if it
  *      would be fragmented by size (this is optional, only used for
  *      monitor injection).
+ * @IEEE80211_TX_CTL_PS_RESPONSE: This frame is a response to a poll
+ *      frame (PS-Poll or uAPSD).
  *
  * Note: If you have to add new flags to the enumeration, then don't
  *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
@@ -495,6 +499,7 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_STATUS_EOSP                = BIT(28),
         IEEE80211_TX_CTL_USE_MINRATE            = BIT(29),
         IEEE80211_TX_CTL_DONTFRAG               = BIT(30),
+        IEEE80211_TX_CTL_PS_RESPONSE            = BIT(31),
 };
 
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
@@ -805,6 +810,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  *      on this subframe
  * @RX_FLAG_AMPDU_DELIM_CRC_KNOWN: The delimiter CRC field is known (the CRC
  *      is stored in the @ampdu_delimiter_crc field)
+ * @RX_FLAG_STBC_MASK: STBC 2 bit bitmask. 1 - Nss=1, 2 - Nss=2, 3 - Nss=3
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR              = BIT(0),
@@ -832,8 +838,11 @@ enum mac80211_rx_flags {
         RX_FLAG_80MHZ                   = BIT(23),
         RX_FLAG_80P80MHZ                = BIT(24),
         RX_FLAG_160MHZ                  = BIT(25),
+        RX_FLAG_STBC_MASK               = BIT(26) | BIT(27),
 };
 
+#define RX_FLAG_STBC_SHIFT              26
+
 /**
  * struct ieee80211_rx_status - receive status
  *
@@ -850,6 +859,10 @@ enum mac80211_rx_flags {
  * @signal: signal strength when receiving this frame, either in dBm, in dB or
  *      unspecified depending on the hardware capabilities flags
  *      @IEEE80211_HW_SIGNAL_*
+ * @chains: bitmask of receive chains for which separate signal strength
+ *      values were filled.
+ * @chain_signal: per-chain signal strength, in dBm (unlike @signal, doesn't
+ *      support dB or unspecified units)
  * @antenna: antenna used
  * @rate_idx: index of data rate into band's supported rates or MCS index if
  *      HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
@@ -881,6 +894,8 @@ struct ieee80211_rx_status {
         u8 band;
         u8 antenna;
         s8 signal;
+        u8 chains;
+        s8 chain_signal[IEEE80211_MAX_CHAINS];
         u8 ampdu_delimiter_crc;
         u8 vendor_radiotap_align;
         u8 vendor_radiotap_oui[3];
@@ -1235,7 +1250,7 @@ enum ieee80211_sta_rx_bandwidth {
  * struct ieee80211_sta_rates - station rate selection table
  *
  * @rcu_head: RCU head used for freeing the table on update
- * @rates: transmit rates/flags to be used by default.
+ * @rate: transmit rates/flags to be used by default.
  *      Overriding entries per-packet is possible by using cb tx control.
  */
 struct ieee80211_sta_rates {
@@ -1276,7 +1291,7 @@ struct ieee80211_sta_rates {
  *      notifications and capabilities. The value is only valid after
  *      the station moves to associated state.
  * @smps_mode: current SMPS mode (off, static or dynamic)
- * @tx_rates: rate control selection table
+ * @rates: rate control selection table
  */
 struct ieee80211_sta {
         u32 supp_rates[IEEE80211_NUM_BANDS];
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 745bf741e029..949d77528f2f 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -230,7 +230,7 @@ extern int 			ndisc_ifinfo_sysctl_change(struct ctl_table *ctl,
                                                            void __user *buffer,
                                                            size_t *lenp,
                                                            loff_t *ppos);
-int ndisc_ifinfo_sysctl_strategy(ctl_table *ctl,
+int ndisc_ifinfo_sysctl_strategy(struct ctl_table *ctl,
                                  void __user *oldval, size_t __user *oldlenp,
                                  void __user *newval, size_t newlen);
 #endif
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index b17697827482..84e37b1ca9e1 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -115,9 +115,12 @@ struct net {
 #ifdef CONFIG_XFRM
         struct netns_xfrm       xfrm;
 #endif
+#if IS_ENABLED(CONFIG_IP_VS)
         struct netns_ipvs       *ipvs;
+#endif
         struct sock             *diag_nlsk;
         atomic_t                rt_genid;
+        atomic_t                fnhe_genid;
 };
 
 /*
@@ -340,4 +343,14 @@ static inline void rt_genid_bump(struct net *net)
         atomic_inc(&net->rt_genid);
 }
 
+static inline int fnhe_genid(struct net *net)
+{
+        return atomic_read(&net->fnhe_genid);
+}
+
+static inline void fnhe_genid_bump(struct net *net)
+{
+        atomic_inc(&net->fnhe_genid);
+}
+
 #endif /* __NET_NET_NAMESPACE_H */
diff --git a/include/net/netfilter/xt_rateest.h b/include/net/netfilter/xt_rateest.h
index 5a2978d1cb22..495c71f66e7e 100644
--- a/include/net/netfilter/xt_rateest.h
+++ b/include/net/netfilter/xt_rateest.h
@@ -6,7 +6,7 @@ struct xt_rateest {
         struct gnet_stats_basic_packed  bstats;
         spinlock_t                      lock;
         /* keep rstats and lock on same cache line to speedup xt_rateest_mt() */
-        struct gnet_stats_rate_est      rstats;
+        struct gnet_stats_rate_est64    rstats;
 
         /* following fields not accessed in hot path */
         struct hlist_node               list;
diff --git a/include/net/netns/x_tables.h b/include/net/netns/x_tables.h
index c24060ee411e..02fe40f8c8fd 100644
--- a/include/net/netns/x_tables.h
+++ b/include/net/netns/x_tables.h
@@ -15,5 +15,11 @@ struct netns_xt {
         struct ebt_table *frame_filter;
         struct ebt_table *frame_nat;
 #endif
+#if IS_ENABLED(CONFIG_IP_NF_TARGET_ULOG)
+        bool ulog_warn_deprecated;
+#endif
+#if IS_ENABLED(CONFIG_BRIDGE_EBT_ULOG)
+        bool ebt_ulog_warn_deprecated;
+#endif
 };
 #endif
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index b87a1692b086..0af851c3b038 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -59,8 +59,10 @@ struct nfc_hci_ops {
                               struct nfc_target *target);
         int (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
                               struct sk_buff *skb);
-        int (*enable_se)(struct nfc_dev *dev, u32 secure_element);
-        int (*disable_se)(struct nfc_dev *dev, u32 secure_element);
+        int (*fw_upload)(struct nfc_hci_dev *hdev, const char *firmware_name);
+        int (*discover_se)(struct nfc_hci_dev *dev);
+        int (*enable_se)(struct nfc_hci_dev *dev, u32 se_idx);
+        int (*disable_se)(struct nfc_hci_dev *dev, u32 se_idx);
 };
 
 /* Pipes */
@@ -152,7 +154,6 @@ struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
                                             struct nfc_hci_init_data *init_data,
                                             unsigned long quirks,
                                             u32 protocols,
-                                            u32 supported_se,
                                             const char *llc_name,
                                             int tx_headroom,
                                             int tx_tailroom,
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 5bc0c460edc0..99fc1f3a392a 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -3,6 +3,7 @@
  *  NFC Controller (NFCC) and a Device Host (DH).
  *
  *  Copyright (C) 2011 Texas Instruments, Inc.
+ *  Copyright (C) 2013 Intel Corporation. All rights reserved.
  *
  *  Written by Ilan Elias <ilane@ti.com>
  *
@@ -66,7 +67,7 @@ struct nci_dev;
 struct nci_ops {
         int (*open)(struct nci_dev *ndev);
         int (*close)(struct nci_dev *ndev);
-        int (*send)(struct sk_buff *skb);
+        int (*send)(struct nci_dev *ndev, struct sk_buff *skb);
 };
 
 #define NCI_MAX_SUPPORTED_RF_INTERFACES         4
@@ -147,13 +148,12 @@ struct nci_dev {
 /* ----- NCI Devices ----- */
 struct nci_dev *nci_allocate_device(struct nci_ops *ops,
                                     __u32 supported_protocols,
-                                    __u32 supported_se,
                                     int tx_headroom,
                                     int tx_tailroom);
 void nci_free_device(struct nci_dev *ndev);
 int nci_register_device(struct nci_dev *ndev);
 void nci_unregister_device(struct nci_dev *ndev);
-int nci_recv_frame(struct sk_buff *skb);
+int nci_recv_frame(struct nci_dev *ndev, struct sk_buff *skb);
 
 static inline struct sk_buff *nci_skb_alloc(struct nci_dev *ndev,
                                             unsigned int len,
@@ -202,4 +202,56 @@ void nci_req_complete(struct nci_dev *ndev, int result);
 /* ----- NCI status code ----- */
 int nci_to_errno(__u8 code);
 
+/* ----- NCI over SPI acknowledge modes ----- */
+#define NCI_SPI_CRC_DISABLED    0x00
+#define NCI_SPI_CRC_ENABLED     0x01
+
+/* ----- NCI SPI structures ----- */
+struct nci_spi_dev;
+
+struct nci_spi_ops {
+        int (*open)(struct nci_spi_dev *ndev);
+        int (*close)(struct nci_spi_dev *ndev);
+        void (*assert_int)(struct nci_spi_dev *ndev);
+        void (*deassert_int)(struct nci_spi_dev *ndev);
+};
+
+struct nci_spi_dev {
+        struct nci_dev          *nci_dev;
+        struct spi_device       *spi;
+        struct nci_spi_ops      *ops;
+
+        unsigned int            xfer_udelay;    /* microseconds delay between
+                                                  transactions */
+        u8                      acknowledge_mode;
+
+        struct completion       req_completion;
+        u8                      req_result;
+
+        void                    *driver_data;
+};
+
+/* ----- NCI SPI Devices ----- */
+struct nci_spi_dev *nci_spi_allocate_device(struct spi_device *spi,
+                                                struct nci_spi_ops *ops,
+                                                u32 supported_protocols,
+                                                u32 supported_se,
+                                                u8 acknowledge_mode,
+                                                unsigned int delay);
+void nci_spi_free_device(struct nci_spi_dev *ndev);
+int nci_spi_register_device(struct nci_spi_dev *ndev);
+void nci_spi_unregister_device(struct nci_spi_dev *ndev);
+int nci_spi_recv_frame(struct nci_spi_dev *ndev);
+
+static inline void nci_spi_set_drvdata(struct nci_spi_dev *ndev,
+                                            void *data)
+{
+        ndev->driver_data = data;
+}
+
+static inline void *nci_spi_get_drvdata(struct nci_spi_dev *ndev)
+{
+        return ndev->driver_data;
+}
+
 #endif /* __NCI_CORE_H */
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 5eb80bb3cbb2..0e353f1658bb 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -68,8 +68,12 @@ struct nfc_ops {
                              void *cb_context);
         int (*tm_send)(struct nfc_dev *dev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
-        int (*enable_se)(struct nfc_dev *dev, u32 secure_element);
-        int (*disable_se)(struct nfc_dev *dev, u32 secure_element);
+        int (*fw_upload)(struct nfc_dev *dev, const char *firmware_name);
+
+        /* Secure Element API */
+        int (*discover_se)(struct nfc_dev *dev);
+        int (*enable_se)(struct nfc_dev *dev, u32 se_idx);
+        int (*disable_se)(struct nfc_dev *dev, u32 se_idx);
 };
 
 #define NFC_TARGET_IDX_ANY -1
@@ -83,6 +87,8 @@ struct nfc_target {
         u8 sel_res;
         u8 nfcid1_len;
         u8 nfcid1[NFC_NFCID1_MAXSIZE];
+        u8 nfcid2_len;
+        u8 nfcid2[NFC_NFCID2_MAXSIZE];
         u8 sensb_res_len;
         u8 sensb_res[NFC_SENSB_RES_MAXSIZE];
         u8 sensf_res_len;
@@ -91,6 +97,23 @@ struct nfc_target {
         u8 logical_idx;
 };
 
+/**
+ * nfc_se - A structure for NFC accessible secure elements.
+ *
+ * @idx: The secure element index. User space will enable or
+ *       disable a secure element by its index.
+ * @type: The secure element type. It can be SE_UICC or
+ *        SE_EMBEDDED.
+ * @state: The secure element state, either enabled or disabled.
+ *
+ */
+struct nfc_se {
+        struct list_head list;
+        u32 idx;
+        u16 type;
+        u16 state;
+};
+
 struct nfc_genl_data {
         u32 poll_req_portid;
         struct mutex genl_data_mutex;
@@ -104,6 +127,7 @@ struct nfc_dev {
         int targets_generation;
         struct device dev;
         bool dev_up;
+        bool fw_upload_in_progress;
         u8 rf_mode;
         bool polling;
         struct nfc_target *active_target;
@@ -111,8 +135,7 @@ struct nfc_dev {
         struct nfc_genl_data genl_data;
         u32 supported_protocols;
 
-        u32 supported_se;
-        u32 active_se;
+        struct list_head secure_elements;
 
         int tx_headroom;
         int tx_tailroom;
@@ -132,7 +155,6 @@ extern struct class nfc_class;
 
 struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
                                     u32 supported_protocols,
-                                    u32 supported_se,
                                     int tx_headroom,
                                     int tx_tailroom);
 
@@ -216,4 +238,7 @@ int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
 
 void nfc_driver_failure(struct nfc_dev *dev, int err);
 
+int nfc_add_se(struct nfc_dev *dev, u32 se_idx, u16 type);
+int nfc_remove_se(struct nfc_dev *dev, u32 se_idx);
+
 #endif /* __NET_NFC_H */
diff --git a/include/net/ping.h b/include/net/ping.h
index 682b5ae9af51..5db0224b73ac 100644
--- a/include/net/ping.h
+++ b/include/net/ping.h
@@ -13,6 +13,7 @@
 #ifndef _PING_H
 #define _PING_H
 
+#include <net/icmp.h>
 #include <net/netns/hash.h>
 
 /* PING_HTABLE_SIZE must be power of 2 */
@@ -28,6 +29,18 @@
  */
 #define GID_T_MAX (((gid_t)~0U) >> 1)
 
+/* Compatibility glue so we can support IPv6 when it's compiled as a module */
+struct pingv6_ops {
+        int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len);
+        int (*ip6_datagram_recv_ctl)(struct sock *sk, struct msghdr *msg,
+                                     struct sk_buff *skb);
+        int (*icmpv6_err_convert)(u8 type, u8 code, int *err);
+        void (*ipv6_icmp_error)(struct sock *sk, struct sk_buff *skb, int err,
+                                __be16 port, u32 info, u8 *payload);
+        int (*ipv6_chk_addr)(struct net *net, const struct in6_addr *addr,
+                             const struct net_device *dev, int strict);
+};
+
 struct ping_table {
         struct hlist_nulls_head hash[PING_HTABLE_SIZE];
         rwlock_t                lock;
@@ -36,20 +49,66 @@ struct ping_table {
 struct ping_iter_state {
         struct seq_net_private  p;
         int                     bucket;
+        sa_family_t             family;
 };
 
 extern struct proto ping_prot;
+extern struct ping_table ping_table;
+#if IS_ENABLED(CONFIG_IPV6)
+extern struct pingv6_ops pingv6_ops;
+#endif
+
+struct pingfakehdr {
+        struct icmphdr icmph;
+        struct iovec *iov;
+        sa_family_t family;
+        __wsum wcheck;
+};
+
+int  ping_get_port(struct sock *sk, unsigned short ident);
+void ping_hash(struct sock *sk);
+void ping_unhash(struct sock *sk);
 
+int  ping_init_sock(struct sock *sk);
+void ping_close(struct sock *sk, long timeout);
+int  ping_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len);
+void ping_err(struct sk_buff *skb, int offset, u32 info);
+int  ping_getfrag(void *from, char *to, int offset, int fraglen, int odd,
+                  struct sk_buff *);
 
-extern void ping_rcv(struct sk_buff *);
-extern void ping_err(struct sk_buff *, u32 info);
+int  ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                  size_t len, int noblock, int flags, int *addr_len);
+int  ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
+                         void *user_icmph, size_t icmph_len);
+int  ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                     size_t len);
+int  ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                     size_t len);
+int  ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
+void ping_rcv(struct sk_buff *skb);
 
 #ifdef CONFIG_PROC_FS
+struct ping_seq_afinfo {
+        char                            *name;
+        sa_family_t                     family;
+        const struct file_operations    *seq_fops;
+        const struct seq_operations     seq_ops;
+};
+
+extern const struct file_operations ping_seq_fops;
+
+void *ping_seq_start(struct seq_file *seq, loff_t *pos, sa_family_t family);
+void *ping_seq_next(struct seq_file *seq, void *v, loff_t *pos);
+void ping_seq_stop(struct seq_file *seq, void *v);
+int ping_proc_register(struct net *net, struct ping_seq_afinfo *afinfo);
+void ping_proc_unregister(struct net *net, struct ping_seq_afinfo *afinfo);
+
 extern int __init ping_proc_init(void);
 extern void ping_proc_exit(void);
 #endif
 
 void __init ping_init(void);
-
+int  __init pingv6_init(void);
+void pingv6_exit(void);
 
 #endif /* _PING_H */
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index e7f4e21cc3e1..6eab63363e59 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -58,14 +58,12 @@ struct Qdisc {
                                       * multiqueue device.
                                       */
 #define TCQ_F_WARN_NONWC        (1 << 16)
-        int                     padded;
+        u32                     limit;
         const struct Qdisc_ops  *ops;
         struct qdisc_size_table __rcu *stab;
         struct list_head        list;
         u32                     handle;
         u32                     parent;
-        atomic_t                refcnt;
-        struct gnet_stats_rate_est      rate_est;
         int                     (*reshape_fail)(struct sk_buff *skb,
                                         struct Qdisc *q);
 
@@ -76,8 +74,9 @@ struct Qdisc {
          */
         struct Qdisc            *__parent;
         struct netdev_queue     *dev_queue;
-        struct Qdisc            *next_sched;
 
+        struct gnet_stats_rate_est64    rate_est;
+        struct Qdisc            *next_sched;
         struct sk_buff          *gso_skb;
         /*
          * For performance sake on SMP, we put highly modified fields at the end
@@ -88,8 +87,10 @@ struct Qdisc {
         unsigned int            __state;
         struct gnet_stats_queue qstats;
         struct rcu_head         rcu_head;
-        spinlock_t              busylock;
-        u32                     limit;
+        int                     padded;
+        atomic_t                refcnt;
+
+        spinlock_t              busylock ____cacheline_aligned_in_smp;
 };
 
 static inline bool qdisc_is_running(const struct Qdisc *qdisc)
@@ -679,7 +680,7 @@ static inline struct sk_buff *skb_act_clone(struct sk_buff *skb, gfp_t gfp_mask,
 #endif
 
 struct psched_ratecfg {
-        u64     rate_bps;
+        u64     rate_bytes_ps; /* bytes per second */
         u32     mult;
         u16     overhead;
         u8      shift;
@@ -697,7 +698,7 @@ static inline void psched_ratecfg_getrate(struct tc_ratespec *res,
                                           const struct psched_ratecfg *r)
 {
         memset(res, 0, sizeof(*res));
-        res->rate = r->rate_bps >> 3;
+        res->rate = r->rate_bytes_ps;
         res->overhead = r->overhead;
 }
 
diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h
index 5a2110d3176d..0cb08e6fb6df 100644
--- a/include/net/sctp/checksum.h
+++ b/include/net/sctp/checksum.h
@@ -42,6 +42,9 @@
  * be incorporated into the next SCTP release.
  */
 
+#ifndef __sctp_checksum_h__
+#define __sctp_checksum_h__
+
 #include <linux/types.h>
 #include <net/sctp/sctp.h>
 #include <linux/crc32c.h>
@@ -81,3 +84,5 @@ static inline __le32 sctp_end_cksum(__u32 crc32)
 {
         return cpu_to_le32(~crc32);
 }
+
+#endif /* __sctp_checksum_h__ */
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index cd89510eab2a..d8e37ecea691 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -83,30 +83,12 @@
 #include <net/sctp/structs.h>
 #include <net/sctp/constants.h>
 
-
-/* Set SCTP_DEBUG flag via config if not already set. */
-#ifndef SCTP_DEBUG
-#ifdef CONFIG_SCTP_DBG_MSG
-#define SCTP_DEBUG      1
-#else
-#define SCTP_DEBUG      0
-#endif /* CONFIG_SCTP_DBG */
-#endif /* SCTP_DEBUG */
-
 #ifdef CONFIG_IP_SCTP_MODULE
 #define SCTP_PROTOSW_FLAG 0
 #else /* static! */
 #define SCTP_PROTOSW_FLAG INET_PROTOSW_PERMANENT
 #endif
 
-
-/* Certain internal static functions need to be exported when
- * compiled into the test frame.
- */
-#ifndef SCTP_STATIC
-#define SCTP_STATIC static
-#endif
-
 /*
  * Function declarations.
  */
@@ -196,11 +178,6 @@ extern struct kmem_cache *sctp_bucket_cachep __read_mostly;
  *  Section:  Macros, externs, and inlines
  */
 
-
-#ifdef TEST_FRAME
-#include <test_frame.h>
-#else
-
 /* spin lock wrappers. */
 #define sctp_spin_lock_irqsave(lock, flags) spin_lock_irqsave(lock, flags)
 #define sctp_spin_unlock_irqrestore(lock, flags)  \
@@ -226,8 +203,6 @@ extern struct kmem_cache *sctp_bucket_cachep __read_mostly;
 #define SCTP_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)->sctp.sctp_statistics, field)
 #define SCTP_DEC_STATS(net, field)      SNMP_DEC_STATS((net)->sctp.sctp_statistics, field)
 
-#endif /* !TEST_FRAME */
-
 /* sctp mib definitions */
 enum {
         SCTP_MIB_NUM = 0,
@@ -285,61 +260,6 @@ static inline void sctp_max_rto(struct sctp_association *asoc,
         }
 }
 
-/* Print debugging messages.  */
-#if SCTP_DEBUG
-extern int sctp_debug_flag;
-#define SCTP_DEBUG_PRINTK(fmt, args...)                 \
-do {                                                    \
-        if (sctp_debug_flag)                            \
-                printk(KERN_DEBUG pr_fmt(fmt), ##args); \
-} while (0)
-#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)            \
-do {                                                    \
-        if (sctp_debug_flag)                            \
-                pr_cont(fmt, ##args);                   \
-} while (0)
-#define SCTP_DEBUG_PRINTK_IPADDR(fmt_lead, fmt_trail,                   \
-                                 args_lead, addr, args_trail...)        \
-do {                                                                    \
-        const union sctp_addr *_addr = (addr);                          \
-        if (sctp_debug_flag) {                                          \
-                if (_addr->sa.sa_family == AF_INET6) {                  \
-                        printk(KERN_DEBUG                               \
-                               pr_fmt(fmt_lead "%pI6" fmt_trail),       \
-                               args_lead,                               \
-                               &_addr->v6.sin6_addr,                    \
-                               args_trail);                             \
-                } else {                                                \
-                        printk(KERN_DEBUG                               \
-                               pr_fmt(fmt_lead "%pI4" fmt_trail),       \
-                               args_lead,                               \
-                               &_addr->v4.sin_addr.s_addr,              \
-                               args_trail);                             \
-                }                                                       \
-        }                                                               \
-} while (0)
-#define SCTP_ENABLE_DEBUG { sctp_debug_flag = 1; }
-#define SCTP_DISABLE_DEBUG { sctp_debug_flag = 0; }
-
-#define SCTP_ASSERT(expr, str, func) \
-        if (!(expr)) { \
-                SCTP_DEBUG_PRINTK("Assertion Failed: %s(%s) at %s:%s:%d\n", \
-                        str, (#expr), __FILE__, __func__, __LINE__); \
-                func; \
-        }
-
-#else   /* SCTP_DEBUG */
-
-#define SCTP_DEBUG_PRINTK(whatever...)
-#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
-#define SCTP_ENABLE_DEBUG
-#define SCTP_DISABLE_DEBUG
-#define SCTP_ASSERT(expr, str, func)
-
-#endif /* SCTP_DEBUG */
-
-
 /*
  * Macros for keeping a global reference of object allocations.
  */
@@ -575,27 +495,6 @@ for (pos = chunk->subh.fwdtsn_hdr->skip;\
 /* Round an int up to the next multiple of 4.  */
 #define WORD_ROUND(s) (((s)+3)&~3)
 
-/* Make a new instance of type.  */
-#define t_new(type, flags)      kzalloc(sizeof(type), flags)
-
-/* Compare two timevals.  */
-#define tv_lt(s, t) \
-   (s.tv_sec < t.tv_sec || (s.tv_sec == t.tv_sec && s.tv_usec < t.tv_usec))
-
-/* Add tv1 to tv2. */
-#define TIMEVAL_ADD(tv1, tv2) \
-({ \
-        suseconds_t usecs = (tv2).tv_usec + (tv1).tv_usec; \
-        time_t secs = (tv2).tv_sec + (tv1).tv_sec; \
-\
-        if (usecs >= 1000000) { \
-                usecs -= 1000000; \
-                secs++; \
-        } \
-        (tv2).tv_sec = secs; \
-        (tv2).tv_usec = usecs; \
-})
-
 /* External references. */
 
 extern struct proto sctp_prot;
@@ -633,16 +532,6 @@ static inline int param_type2af(__be16 type)
         }
 }
 
-/* Perform some sanity checks. */
-static inline int sctp_sanity_check(void)
-{
-        SCTP_ASSERT(sizeof(struct sctp_ulpevent) <=
-                    sizeof(((struct sk_buff *)0)->cb),
-                    "SCTP: ulpevent does not fit in skb!\n", return 0);
-
-        return 1;
-}
-
 /* Warning: The following hash functions assume a power of two 'size'. */
 /* This is the hash function for the SCTP port hash table. */
 static inline int sctp_phashfn(struct net *net, __u16 lport)
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 1bd4c4144fe8..e745c92a1532 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -54,7 +54,7 @@
 #ifndef __sctp_structs_h__
 #define __sctp_structs_h__
 
-#include <linux/time.h>         /* We get struct timespec.    */
+#include <linux/ktime.h>
 #include <linux/socket.h>       /* linux/in.h needs this!!    */
 #include <linux/in.h>           /* We get struct sockaddr_in. */
 #include <linux/in6.h>          /* We get struct in6_addr     */
@@ -284,7 +284,7 @@ struct sctp_cookie {
         __u32 peer_ttag;
 
         /* When does this cookie expire? */
-        struct timeval expiration;
+        ktime_t expiration;
 
         /* Number of inbound/outbound streams which are set
          * and negotiated during the INIT process.
@@ -1537,7 +1537,7 @@ struct sctp_association {
         sctp_state_t state;
 
         /* The cookie life I award for any cookie.  */
-        struct timeval cookie_life;
+        ktime_t cookie_life;
 
         /* Overall     : The overall association error count.
          * Error Count : [Clear this any time I get something.]
diff --git a/include/net/sock.h b/include/net/sock.h
index 66772cf8c3c5..95a5a2c6925a 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -229,6 +229,8 @@ struct cg_proto;
   *     @sk_omem_alloc: "o" is "option" or "other"
   *     @sk_wmem_queued: persistent queue size
   *     @sk_forward_alloc: space allocated forward
+  *     @sk_napi_id: id of the last napi context to receive data for sk
+  *     @sk_ll_usec: usecs to busypoll when there is no data
   *     @sk_allocation: allocation mode
   *     @sk_sndbuf: size of send buffer in bytes
   *     @sk_flags: %SO_LINGER (l_onoff), %SO_BROADCAST, %SO_KEEPALIVE,
@@ -325,6 +327,10 @@ struct sock {
 #ifdef CONFIG_RPS
         __u32                   sk_rxhash;
 #endif
+#ifdef CONFIG_NET_LL_RX_POLL
+        unsigned int            sk_napi_id;
+        unsigned int            sk_ll_usec;
+#endif
         atomic_t                sk_drops;
         int                     sk_rcvbuf;
 
@@ -2041,18 +2047,21 @@ static inline void sk_wake_async(struct sock *sk, int how, int band)
                 sock_wake_async(sk->sk_socket, how, band);
 }
 
-#define SOCK_MIN_SNDBUF 2048
-/*
- * Since sk_rmem_alloc sums skb->truesize, even a small frame might need
- * sizeof(sk_buff) + MTU + padding, unless net driver perform copybreak
+/* Since sk_{r,w}mem_alloc sums skb->truesize, even a small frame might
+ * need sizeof(sk_buff) + MTU + padding, unless net driver perform copybreak.
+ * Note: for send buffers, TCP works better if we can build two skbs at
+ * minimum.
  */
-#define SOCK_MIN_RCVBUF (2048 + sizeof(struct sk_buff))
+#define TCP_SKB_MIN_TRUESIZE    (2048 + SKB_DATA_ALIGN(sizeof(struct sk_buff)))
+
+#define SOCK_MIN_SNDBUF         (TCP_SKB_MIN_TRUESIZE * 2)
+#define SOCK_MIN_RCVBUF          TCP_SKB_MIN_TRUESIZE
 
 static inline void sk_stream_moderate_sndbuf(struct sock *sk)
 {
         if (!(sk->sk_userlocks & SOCK_SNDBUF_LOCK)) {
                 sk->sk_sndbuf = min(sk->sk_sndbuf, sk->sk_wmem_queued >> 1);
-                sk->sk_sndbuf = max(sk->sk_sndbuf, SOCK_MIN_SNDBUF);
+                sk->sk_sndbuf = max_t(u32, sk->sk_sndbuf, SOCK_MIN_SNDBUF);
         }
 }
 
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 5bba80fbd1d9..d1980054ec75 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -61,9 +61,6 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
  */
 #define MAX_TCP_WINDOW          32767U
 
-/* Offer an initial receive window of 10 mss. */
-#define TCP_DEFAULT_INIT_RCVWND 10
-
 /* Minimal accepted MSS. It is (60+60+8) - (20+20). */
 #define TCP_MIN_MSS             88U
 
@@ -1047,6 +1044,8 @@ static inline void tcp_sack_reset(struct tcp_options_received *rx_opt)
         rx_opt->num_sacks = 0;
 }
 
+extern u32 tcp_default_init_rwnd(u32 mss);
+
 /* Determine a window scaling and initial window to offer. */
 extern void tcp_select_initial_window(int __space, __u32 mss,
                                       __u32 *rcv_wnd, __u32 *window_clamp,
@@ -1193,7 +1192,6 @@ static inline void tcp_mib_init(struct net *net)
 static inline void tcp_clear_retrans_hints_partial(struct tcp_sock *tp)
 {
         tp->lost_skb_hint = NULL;
-        tp->scoreboard_skb_hint = NULL;
 }
 
 static inline void tcp_clear_all_retrans_hints(struct tcp_sock *tp)
@@ -1284,11 +1282,13 @@ static inline struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk,
 #define tcp_twsk_md5_key(twsk)  NULL
 #endif
 
-extern struct tcp_md5sig_pool __percpu *tcp_alloc_md5sig_pool(struct sock *);
-extern void tcp_free_md5sig_pool(void);
+extern bool tcp_alloc_md5sig_pool(void);
 
 extern struct tcp_md5sig_pool   *tcp_get_md5sig_pool(void);
-extern void tcp_put_md5sig_pool(void);
+static inline void tcp_put_md5sig_pool(void)
+{
+        local_bh_enable();
+}
 
 extern int tcp_md5_hash_header(struct tcp_md5sig_pool *, const struct tcphdr *);
 extern int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *, const struct sk_buff *,
@@ -1319,9 +1319,9 @@ void tcp_fastopen_cookie_gen(__be32 addr, struct tcp_fastopen_cookie *foc);
 
 /* Fastopen key context */
 struct tcp_fastopen_context {
-        struct crypto_cipher __rcu      *tfm;
-        __u8                            key[TCP_FASTOPEN_KEY_LENGTH];
-        struct rcu_head                 rcu;
+        struct crypto_cipher    *tfm;
+        __u8                    key[TCP_FASTOPEN_KEY_LENGTH];
+        struct rcu_head         rcu;
 };
 
 /* write queue abstraction */
@@ -1540,15 +1540,14 @@ extern struct request_sock_ops tcp6_request_sock_ops;
 
 extern void tcp_v4_destroy_sock(struct sock *sk);
 
-extern int tcp_v4_gso_send_check(struct sk_buff *skb);
 extern struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
                                        netdev_features_t features);
 extern struct sk_buff **tcp_gro_receive(struct sk_buff **head,
                                         struct sk_buff *skb);
-extern struct sk_buff **tcp4_gro_receive(struct sk_buff **head,
-                                         struct sk_buff *skb);
 extern int tcp_gro_complete(struct sk_buff *skb);
-extern int tcp4_gro_complete(struct sk_buff *skb);
+
+extern void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr,
+                                __be32 daddr);
 
 #ifdef CONFIG_PROC_FS
 extern int tcp4_proc_init(void);
@@ -1583,6 +1582,8 @@ struct tcp_request_sock_ops {
 #endif
 };
 
+extern int tcpv4_offload_init(void);
+
 extern void tcp_v4_init(void);
 extern void tcp_init(void);
 
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index 938b7fd11204..48660e50ae90 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -3,56 +3,57 @@
 
 #include <net/checksum.h>
 
-/*
- *      IPv6 transport protocols
- */
-
+/* IPv6 transport protocols */
 extern struct proto rawv6_prot;
 extern struct proto udpv6_prot;
 extern struct proto udplitev6_prot;
 extern struct proto tcpv6_prot;
+extern struct proto pingv6_prot;
 
 struct flowi6;
 
 /* extension headers */
-extern int                              ipv6_exthdrs_init(void);
-extern void                             ipv6_exthdrs_exit(void);
-extern int                              ipv6_frag_init(void);
-extern void                             ipv6_frag_exit(void);
+int ipv6_exthdrs_init(void);
+void ipv6_exthdrs_exit(void);
+int ipv6_frag_init(void);
+void ipv6_frag_exit(void);
 
 /* transport protocols */
-extern int                              rawv6_init(void);
-extern void                             rawv6_exit(void);
-extern int                              udpv6_init(void);
-extern void                             udpv6_exit(void);
-extern int                              udplitev6_init(void);
-extern void                             udplitev6_exit(void);
-extern int                              tcpv6_init(void);
-extern void                             tcpv6_exit(void);
-
-extern int                              udpv6_connect(struct sock *sk,
-                                                      struct sockaddr *uaddr,
-                                                      int addr_len);
-
-extern int                      ip6_datagram_recv_ctl(struct sock *sk,
-                                                      struct msghdr *msg,
-                                                      struct sk_buff *skb);
-
-extern int                      ip6_datagram_send_ctl(struct net *net,
-                                                      struct sock *sk,
-                                                      struct msghdr *msg,
-                                                      struct flowi6 *fl6,
-                                                      struct ipv6_txoptions *opt,
-                                                      int *hlimit, int *tclass,
-                                                      int *dontfrag);
-
-#define         LOOPBACK4_IPV6          cpu_to_be32(0x7f000006)
-
-/*
- *      address family specific functions
- */
+int pingv6_init(void);
+void pingv6_exit(void);
+int rawv6_init(void);
+void rawv6_exit(void);
+int udpv6_init(void);
+void udpv6_exit(void);
+int udplitev6_init(void);
+void udplitev6_exit(void);
+int tcpv6_init(void);
+void tcpv6_exit(void);
+
+int udpv6_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
+
+int ip6_datagram_recv_ctl(struct sock *sk, struct msghdr *msg,
+                          struct sk_buff *skb);
+
+int ip6_datagram_send_ctl(struct net *net, struct sock *sk, struct msghdr *msg,
+                          struct flowi6 *fl6, struct ipv6_txoptions *opt,
+                          int *hlimit, int *tclass, int *dontfrag);
+
+void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
+                             __u16 srcp, __u16 destp, int bucket);
+
+#define LOOPBACK4_IPV6 cpu_to_be32(0x7f000006)
+
+/* address family specific functions */
 extern const struct inet_connection_sock_af_ops ipv4_specific;
 
-extern void inet6_destroy_sock(struct sock *sk);
+void inet6_destroy_sock(struct sock *sk);
+
+#define IPV6_SEQ_DGRAM_HEADER                                          \
+        "  sl  "                                                       \
+        "local_address                         "                       \
+        "remote_address                        "                       \
+        "st tx_queue rx_queue tr tm->when retrnsmt"                    \
+        "   uid  timeout inode ref pointer drops\n"
 
 #endif
diff --git a/include/net/udp.h b/include/net/udp.h
index 065f379c6503..74c10ec5e74f 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -181,12 +181,15 @@ extern int udp_get_port(struct sock *sk, unsigned short snum,
 extern void udp_err(struct sk_buff *, u32);
 extern int udp_sendmsg(struct kiocb *iocb, struct sock *sk,
                             struct msghdr *msg, size_t len);
+extern int udp_push_pending_frames(struct sock *sk);
 extern void udp_flush_pending_frames(struct sock *sk);
 extern int udp_rcv(struct sk_buff *skb);
 extern int udp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 extern int udp_disconnect(struct sock *sk, int flags);
 extern unsigned int udp_poll(struct file *file, struct socket *sock,
                              poll_table *wait);
+extern struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
+                                              netdev_features_t features);
 extern int udp_lib_getsockopt(struct sock *sk, int level, int optname,
                               char __user *optval, int __user *optlen);
 extern int udp_lib_setsockopt(struct sock *sk, int level, int optname,
@@ -262,11 +265,10 @@ extern int udp4_proc_init(void);
 extern void udp4_proc_exit(void);
 #endif
 
+extern int udpv4_offload_init(void);
+
 extern void udp_init(void);
 
-extern int udp4_ufo_send_check(struct sk_buff *skb);
-extern struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
-        netdev_features_t features);
 extern void udp_encap_enable(void);
 #if IS_ENABLED(CONFIG_IPV6)
 extern void udpv6_encap_enable(void);
diff --git a/include/rdma/ib.h b/include/rdma/ib.h
new file mode 100644
index 000000000000..cf8f9e700e48
--- /dev/null
+++ b/include/rdma/ib.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2010 Intel Corporation.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#if !defined(_RDMA_IB_H)
+#define _RDMA_IB_H
+
+#include <linux/types.h>
+
+struct ib_addr {
+        union {
+                __u8            uib_addr8[16];
+                __be16          uib_addr16[8];
+                __be32          uib_addr32[4];
+                __be64          uib_addr64[2];
+        } ib_u;
+#define sib_addr8               ib_u.uib_addr8
+#define sib_addr16              ib_u.uib_addr16
+#define sib_addr32              ib_u.uib_addr32
+#define sib_addr64              ib_u.uib_addr64
+#define sib_raw                 ib_u.uib_addr8
+#define sib_subnet_prefix       ib_u.uib_addr64[0]
+#define sib_interface_id        ib_u.uib_addr64[1]
+};
+
+static inline int ib_addr_any(const struct ib_addr *a)
+{
+        return ((a->sib_addr64[0] | a->sib_addr64[1]) == 0);
+}
+
+static inline int ib_addr_loopback(const struct ib_addr *a)
+{
+        return ((a->sib_addr32[0] | a->sib_addr32[1] |
+                 a->sib_addr32[2] | (a->sib_addr32[3] ^ htonl(1))) == 0);
+}
+
+static inline void ib_addr_set(struct ib_addr *addr,
+                               __be32 w1, __be32 w2, __be32 w3, __be32 w4)
+{
+        addr->sib_addr32[0] = w1;
+        addr->sib_addr32[1] = w2;
+        addr->sib_addr32[2] = w3;
+        addr->sib_addr32[3] = w4;
+}
+
+static inline int ib_addr_cmp(const struct ib_addr *a1, const struct ib_addr *a2)
+{
+        return memcmp(a1, a2, sizeof(struct ib_addr));
+}
+
+struct sockaddr_ib {
+        unsigned short int      sib_family;     /* AF_IB */
+        __be16                  sib_pkey;
+        __be32                  sib_flowinfo;
+        struct ib_addr          sib_addr;
+        __be64                  sib_sid;
+        __be64                  sib_sid_mask;
+        __u64                   sib_scope_id;
+};
+
+#endif /* _RDMA_IB_H */
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
index 99965395c5f3..f3ac0f2c4c66 100644
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
@@ -102,11 +102,7 @@ void rdma_addr_cancel(struct rdma_dev_addr *addr);
 int rdma_copy_addr(struct rdma_dev_addr *dev_addr, struct net_device *dev,
               const unsigned char *dst_dev_addr);
 
-static inline int ip_addr_size(struct sockaddr *addr)
-{
-        return addr->sa_family == AF_INET6 ?
-               sizeof(struct sockaddr_in6) : sizeof(struct sockaddr_in);
-}
+int rdma_addr_size(struct sockaddr *addr);
 
 static inline u16 ib_addr_get_pkey(struct rdma_dev_addr *dev_addr)
 {
diff --git a/include/rdma/ib_sa.h b/include/rdma/ib_sa.h
index 8275e539bace..125f8714301d 100644
--- a/include/rdma/ib_sa.h
+++ b/include/rdma/ib_sa.h
@@ -402,6 +402,12 @@ int ib_init_ah_from_path(struct ib_device *device, u8 port_num,
                          struct ib_ah_attr *ah_attr);
 
 /**
+ * ib_sa_pack_path - Conert a path record from struct ib_sa_path_rec
+ * to IB MAD wire format.
+ */
+void ib_sa_pack_path(struct ib_sa_path_rec *rec, void *attribute);
+
+/**
  * ib_sa_unpack_path - Convert a path record from MAD format to struct
  * ib_sa_path_rec.
  */
@@ -418,4 +424,5 @@ int ib_sa_guid_info_rec_query(struct ib_sa_client *client,
                                                void *context),
                               void *context,
                               struct ib_sa_query **sa_query);
+
 #endif /* IB_SA_H */
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 98cc4b29fc5b..645c3cedce9c 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -610,7 +610,21 @@ enum ib_qp_type {
         IB_QPT_RAW_PACKET = 8,
         IB_QPT_XRC_INI = 9,
         IB_QPT_XRC_TGT,
-        IB_QPT_MAX
+        IB_QPT_MAX,
+        /* Reserve a range for qp types internal to the low level driver.
+         * These qp types will not be visible at the IB core layer, so the
+         * IB_QPT_MAX usages should not be affected in the core layer
+         */
+        IB_QPT_RESERVED1 = 0x1000,
+        IB_QPT_RESERVED2,
+        IB_QPT_RESERVED3,
+        IB_QPT_RESERVED4,
+        IB_QPT_RESERVED5,
+        IB_QPT_RESERVED6,
+        IB_QPT_RESERVED7,
+        IB_QPT_RESERVED8,
+        IB_QPT_RESERVED9,
+        IB_QPT_RESERVED10,
 };
 
 enum ib_qp_create_flags {
@@ -766,6 +780,19 @@ enum ib_wr_opcode {
         IB_WR_MASKED_ATOMIC_CMP_AND_SWP,
         IB_WR_MASKED_ATOMIC_FETCH_AND_ADD,
         IB_WR_BIND_MW,
+        /* reserve values for low level drivers' internal use.
+         * These values will not be used at all in the ib core layer.
+         */
+        IB_WR_RESERVED1 = 0xf0,
+        IB_WR_RESERVED2,
+        IB_WR_RESERVED3,
+        IB_WR_RESERVED4,
+        IB_WR_RESERVED5,
+        IB_WR_RESERVED6,
+        IB_WR_RESERVED7,
+        IB_WR_RESERVED8,
+        IB_WR_RESERVED9,
+        IB_WR_RESERVED10,
 };
 
 enum ib_send_flags {
@@ -773,7 +800,11 @@ enum ib_send_flags {
         IB_SEND_SIGNALED        = (1<<1),
         IB_SEND_SOLICITED       = (1<<2),
         IB_SEND_INLINE          = (1<<3),
-        IB_SEND_IP_CSUM         = (1<<4)
+        IB_SEND_IP_CSUM         = (1<<4),
+
+        /* reserve bits 26-31 for low level drivers' internal use */
+        IB_SEND_RESERVED_START  = (1 << 26),
+        IB_SEND_RESERVED_END    = (1 << 31),
 };
 
 struct ib_sge {
diff --git a/include/rdma/rdma_cm.h b/include/rdma/rdma_cm.h
index ad3a3142383a..1ed2088dc9f5 100644
--- a/include/rdma/rdma_cm.h
+++ b/include/rdma/rdma_cm.h
@@ -70,6 +70,11 @@ enum rdma_port_space {
         RDMA_PS_UDP   = 0x0111,
 };
 
+#define RDMA_IB_IP_PS_MASK   0xFFFFFFFFFFFF0000ULL
+#define RDMA_IB_IP_PS_TCP    0x0000000001060000ULL
+#define RDMA_IB_IP_PS_UDP    0x0000000001110000ULL
+#define RDMA_IB_IP_PS_IB     0x00000000013F0000ULL
+
 struct rdma_addr {
         struct sockaddr_storage src_addr;
         struct sockaddr_storage dst_addr;
@@ -93,6 +98,7 @@ struct rdma_conn_param {
         /* Fields below ignored if a QP is created on the rdma_cm_id. */
         u8 srq;
         u32 qp_num;
+        u32 qkey;
 };
 
 struct rdma_ud_param {
@@ -367,4 +373,11 @@ int rdma_set_reuseaddr(struct rdma_cm_id *id, int reuse);
  */
 int rdma_set_afonly(struct rdma_cm_id *id, int afonly);
 
+ /**
+ * rdma_get_service_id - Return the IB service ID for a specified address.
+ * @id: Communication identifier associated with the address.
+ * @addr: Address for the service ID.
+ */
+__be64 rdma_get_service_id(struct rdma_cm_id *id, struct sockaddr *addr);
+
 #endif /* RDMA_CM_H */
diff --git a/include/target/iscsi/iscsi_transport.h b/include/target/iscsi/iscsi_transport.h
index 23a87d0cd72c..e5d09d242ba3 100644
--- a/include/target/iscsi/iscsi_transport.h
+++ b/include/target/iscsi/iscsi_transport.h
@@ -34,8 +34,6 @@ extern void iscsit_put_transport(struct iscsit_transport *);
 /*
  * From iscsi_target.c
  */
-extern int iscsit_add_reject_from_cmd(u8, int, int, unsigned char *,
-                                struct iscsi_cmd *);
 extern int iscsit_setup_scsi_cmd(struct iscsi_conn *, struct iscsi_cmd *,
                                 unsigned char *);
 extern void iscsit_set_unsoliticed_dataout(struct iscsi_cmd *);
@@ -45,18 +43,26 @@ extern int iscsit_check_dataout_hdr(struct iscsi_conn *, unsigned char *,
                                 struct iscsi_cmd **);
 extern int iscsit_check_dataout_payload(struct iscsi_cmd *, struct iscsi_data *,
                                 bool);
-extern int iscsit_handle_nop_out(struct iscsi_conn *, struct iscsi_cmd *,
-                                unsigned char *);
+extern int iscsit_setup_nop_out(struct iscsi_conn *, struct iscsi_cmd *,
+                                struct iscsi_nopout *);
+extern int iscsit_process_nop_out(struct iscsi_conn *, struct iscsi_cmd *,
+                                struct iscsi_nopout *);
 extern int iscsit_handle_logout_cmd(struct iscsi_conn *, struct iscsi_cmd *,
                                 unsigned char *);
 extern int iscsit_handle_task_mgt_cmd(struct iscsi_conn *, struct iscsi_cmd *,
                                 unsigned char *);
+extern int iscsit_setup_text_cmd(struct iscsi_conn *, struct iscsi_cmd *,
+                                 struct iscsi_text *);
+extern int iscsit_process_text_cmd(struct iscsi_conn *, struct iscsi_cmd *,
+                                   struct iscsi_text *);
 extern void iscsit_build_rsp_pdu(struct iscsi_cmd *, struct iscsi_conn *,
                                 bool, struct iscsi_scsi_rsp *);
 extern void iscsit_build_nopin_rsp(struct iscsi_cmd *, struct iscsi_conn *,
                                 struct iscsi_nopin *, bool);
 extern void iscsit_build_task_mgt_rsp(struct iscsi_cmd *, struct iscsi_conn *,
                                 struct iscsi_tm_rsp *);
+extern int iscsit_build_text_rsp(struct iscsi_cmd *, struct iscsi_conn *,
+                                struct iscsi_text_rsp *);
 extern void iscsit_build_reject(struct iscsi_cmd *, struct iscsi_conn *,
                                 struct iscsi_reject *);
 extern int iscsit_build_logout_rsp(struct iscsi_cmd *, struct iscsi_conn *,
@@ -67,6 +73,10 @@ extern int iscsit_logout_post_handler(struct iscsi_cmd *, struct iscsi_conn *);
  */
 extern void iscsit_increment_maxcmdsn(struct iscsi_cmd *, struct iscsi_session *);
 /*
+ * From iscsi_target_erl0.c
+ */
+extern void iscsit_cause_connection_reinstatement(struct iscsi_conn *, int);
+/*
  * From iscsi_target_erl1.c
  */
 extern void iscsit_stop_dataout_timer(struct iscsi_cmd *);
@@ -80,4 +90,5 @@ extern int iscsit_tmr_post_handler(struct iscsi_cmd *, struct iscsi_conn *);
  * From iscsi_target_util.c
  */
 extern struct iscsi_cmd *iscsit_allocate_cmd(struct iscsi_conn *, gfp_t);
-extern int iscsit_sequence_cmd(struct iscsi_conn *, struct iscsi_cmd *, __be32);
+extern int iscsit_sequence_cmd(struct iscsi_conn *, struct iscsi_cmd *,
+                               unsigned char *, __be32);
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 4ea4f985f394..e34fc904f2e1 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -218,14 +218,11 @@ enum tcm_tmreq_table {
 
 /* fabric independent task management response values */
 enum tcm_tmrsp_table {
-        TMR_FUNCTION_COMPLETE           = 0,
-        TMR_TASK_DOES_NOT_EXIST         = 1,
-        TMR_LUN_DOES_NOT_EXIST          = 2,
-        TMR_TASK_STILL_ALLEGIANT        = 3,
-        TMR_TASK_FAILOVER_NOT_SUPPORTED = 4,
-        TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED    = 5,
-        TMR_FUNCTION_AUTHORIZATION_FAILED = 6,
-        TMR_FUNCTION_REJECTED           = 255,
+        TMR_FUNCTION_COMPLETE           = 1,
+        TMR_TASK_DOES_NOT_EXIST         = 2,
+        TMR_LUN_DOES_NOT_EXIST          = 3,
+        TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED    = 4,
+        TMR_FUNCTION_REJECTED           = 5,
 };
 
 /*
@@ -339,8 +336,6 @@ struct t10_pr_registration {
         /* Used during APTPL metadata reading */
 #define PR_APTPL_MAX_TPORT_LEN                  256
         unsigned char pr_tport[PR_APTPL_MAX_TPORT_LEN];
-        /* For writing out live meta data */
-        unsigned char *pr_aptpl_buf;
         u16 pr_aptpl_rpti;
         u16 pr_reg_tpgt;
         /* Reservation effects all target ports */
@@ -374,9 +369,7 @@ struct t10_reservation {
         /* Activate Persistence across Target Power Loss enabled
          * for SCSI device */
         int pr_aptpl_active;
-        /* Used by struct t10_reservation->pr_aptpl_buf_len */
 #define PR_APTPL_BUF_LEN                        8192
-        u32 pr_aptpl_buf_len;
         u32 pr_generation;
         spinlock_t registration_lock;
         spinlock_t aptpl_reg_lock;
@@ -424,8 +417,6 @@ struct se_cmd {
         int                     sam_task_attr;
         /* Transport protocol dependent state, see transport_state_table */
         enum transport_state_table t_state;
-        /* Used to signal cmd->se_tfo->check_release_cmd() usage per cmd */
-        unsigned                check_release:1;
         unsigned                cmd_wait_set:1;
         unsigned                unknown_data_length:1;
         /* See se_cmd_flags_table */
@@ -458,7 +449,6 @@ struct se_cmd {
         unsigned char           *t_task_cdb;
         unsigned char           __t_task_cdb[TCM_MAX_COMMAND_SIZE];
         unsigned long long      t_task_lba;
-        atomic_t                t_fe_count;
         unsigned int            transport_state;
 #define CMD_T_ABORTED           (1 << 0)
 #define CMD_T_ACTIVE            (1 << 1)
@@ -802,11 +792,12 @@ struct se_portal_group {
         struct target_core_fabric_ops *se_tpg_tfo;
         struct se_wwn           *se_tpg_wwn;
         struct config_group     tpg_group;
-        struct config_group     *tpg_default_groups[6];
+        struct config_group     *tpg_default_groups[7];
         struct config_group     tpg_lun_group;
         struct config_group     tpg_np_group;
         struct config_group     tpg_acl_group;
         struct config_group     tpg_attrib_group;
+        struct config_group     tpg_auth_group;
         struct config_group     tpg_param_group;
 };
 
diff --git a/include/target/target_core_configfs.h b/include/target/target_core_configfs.h
index 612509592ffd..713c5004f4ae 100644
--- a/include/target/target_core_configfs.h
+++ b/include/target/target_core_configfs.h
@@ -23,6 +23,7 @@ struct target_fabric_configfs_template {
         struct config_item_type tfc_tpg_np_cit;
         struct config_item_type tfc_tpg_np_base_cit;
         struct config_item_type tfc_tpg_attrib_cit;
+        struct config_item_type tfc_tpg_auth_cit;
         struct config_item_type tfc_tpg_param_cit;
         struct config_item_type tfc_tpg_nacl_cit;
         struct config_item_type tfc_tpg_nacl_base_cit;
diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
index 1dcce9cc99b9..7a16178424f9 100644
--- a/include/target/target_core_fabric.h
+++ b/include/target/target_core_fabric.h
@@ -61,7 +61,7 @@ struct target_core_fabric_ops {
         int (*get_cmd_state)(struct se_cmd *);
         int (*queue_data_in)(struct se_cmd *);
         int (*queue_status)(struct se_cmd *);
-        int (*queue_tm_rsp)(struct se_cmd *);
+        void (*queue_tm_rsp)(struct se_cmd *);
         /*
          * fabric module calls for target_core_fabric_configfs.c
          */
diff --git a/include/target/target_core_fabric_configfs.h b/include/target/target_core_fabric_configfs.h
index a26fb7586a09..b32a14905cfa 100644
--- a/include/target/target_core_fabric_configfs.h
+++ b/include/target/target_core_fabric_configfs.h
@@ -62,6 +62,17 @@ static struct target_fabric_tpg_attrib_attribute _fabric##_tpg_attrib_##_name =
         _fabric##_tpg_attrib_show_##_name,                              \
         _fabric##_tpg_attrib_store_##_name);
 
+CONFIGFS_EATTR_STRUCT(target_fabric_tpg_auth, se_portal_group);
+#define TF_TPG_AUTH_ATTR(_fabric, _name, _mode)                         \
+static struct target_fabric_tpg_auth_attribute _fabric##_tpg_auth_##_name = \
+        __CONFIGFS_EATTR(_name, _mode,                                  \
+        _fabric##_tpg_auth_show_##_name,                                \
+        _fabric##_tpg_auth_store_##_name);
+
+#define TF_TPG_AUTH_ATTR_RO(_fabric, _name)                             \
+static struct target_fabric_tpg_auth_attribute _fabric##_tpg_auth_##_name = \
+        __CONFIGFS_EATTR_RO(_name,                                      \
+        _fabric##_tpg_auth_show_##_name);
 
 CONFIGFS_EATTR_STRUCT(target_fabric_tpg_param, se_portal_group);
 #define TF_TPG_PARAM_ATTR(_fabric, _name, _mode)                        \
diff --git a/include/trace/events/bcache.h b/include/trace/events/bcache.h
index 3cc5a0b278c3..5ebda976ea93 100644
--- a/include/trace/events/bcache.h
+++ b/include/trace/events/bcache.h
@@ -9,9 +9,7 @@
 struct search;
 
 DECLARE_EVENT_CLASS(bcache_request,
-
         TP_PROTO(struct search *s, struct bio *bio),
-
         TP_ARGS(s, bio),
 
         TP_STRUCT__entry(
@@ -22,7 +20,6 @@ DECLARE_EVENT_CLASS(bcache_request,
                 __field(dev_t,          orig_sector             )
                 __field(unsigned int,   nr_sector               )
                 __array(char,           rwbs,   6               )
-                __array(char,           comm,   TASK_COMM_LEN   )
         ),
 
         TP_fast_assign(
@@ -33,36 +30,66 @@ DECLARE_EVENT_CLASS(bcache_request,
                 __entry->orig_sector    = bio->bi_sector - 16;
                 __entry->nr_sector      = bio->bi_size >> 9;
                 blk_fill_rwbs(__entry->rwbs, bio->bi_rw, bio->bi_size);
-                memcpy(__entry->comm, current->comm, TASK_COMM_LEN);
         ),
 
-        TP_printk("%d,%d %s %llu + %u [%s] (from %d,%d @ %llu)",
+        TP_printk("%d,%d %s %llu + %u (from %d,%d @ %llu)",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
-                  __entry->rwbs,
-                  (unsigned long long)__entry->sector,
-                  __entry->nr_sector, __entry->comm,
-                  __entry->orig_major, __entry->orig_minor,
+                  __entry->rwbs, (unsigned long long)__entry->sector,
+                  __entry->nr_sector, __entry->orig_major, __entry->orig_minor,
                   (unsigned long long)__entry->orig_sector)
 );
 
-DEFINE_EVENT(bcache_request, bcache_request_start,
+DECLARE_EVENT_CLASS(bkey,
+        TP_PROTO(struct bkey *k),
+        TP_ARGS(k),
 
-        TP_PROTO(struct search *s, struct bio *bio),
+        TP_STRUCT__entry(
+                __field(u32,    size                            )
+                __field(u32,    inode                           )
+                __field(u64,    offset                          )
+                __field(bool,   dirty                           )
+        ),
 
-        TP_ARGS(s, bio)
+        TP_fast_assign(
+                __entry->inode  = KEY_INODE(k);
+                __entry->offset = KEY_OFFSET(k);
+                __entry->size   = KEY_SIZE(k);
+                __entry->dirty  = KEY_DIRTY(k);
+        ),
+
+        TP_printk("%u:%llu len %u dirty %u", __entry->inode,
+                  __entry->offset, __entry->size, __entry->dirty)
 );
 
-DEFINE_EVENT(bcache_request, bcache_request_end,
+DECLARE_EVENT_CLASS(btree_node,
+        TP_PROTO(struct btree *b),
+        TP_ARGS(b),
+
+        TP_STRUCT__entry(
+                __field(size_t,         bucket                  )
+        ),
 
+        TP_fast_assign(
+                __entry->bucket = PTR_BUCKET_NR(b->c, &b->key, 0);
+        ),
+
+        TP_printk("bucket %zu", __entry->bucket)
+);
+
+/* request.c */
+
+DEFINE_EVENT(bcache_request, bcache_request_start,
         TP_PROTO(struct search *s, struct bio *bio),
+        TP_ARGS(s, bio)
+);
 
+DEFINE_EVENT(bcache_request, bcache_request_end,
+        TP_PROTO(struct search *s, struct bio *bio),
         TP_ARGS(s, bio)
 );
 
 DECLARE_EVENT_CLASS(bcache_bio,
-
         TP_PROTO(struct bio *bio),
-
         TP_ARGS(bio),
 
         TP_STRUCT__entry(
@@ -70,7 +97,6 @@ DECLARE_EVENT_CLASS(bcache_bio,
                 __field(sector_t,       sector                  )
                 __field(unsigned int,   nr_sector               )
                 __array(char,           rwbs,   6               )
-                __array(char,           comm,   TASK_COMM_LEN   )
         ),
 
         TP_fast_assign(
@@ -78,191 +104,328 @@ DECLARE_EVENT_CLASS(bcache_bio,
                 __entry->sector         = bio->bi_sector;
                 __entry->nr_sector      = bio->bi_size >> 9;
                 blk_fill_rwbs(__entry->rwbs, bio->bi_rw, bio->bi_size);
-                memcpy(__entry->comm, current->comm, TASK_COMM_LEN);
         ),
 
-        TP_printk("%d,%d  %s %llu + %u [%s]",
-                  MAJOR(__entry->dev), MINOR(__entry->dev),
-                  __entry->rwbs,
-                  (unsigned long long)__entry->sector,
-                  __entry->nr_sector, __entry->comm)
+        TP_printk("%d,%d  %s %llu + %u",
+                  MAJOR(__entry->dev), MINOR(__entry->dev), __entry->rwbs,
+                  (unsigned long long)__entry->sector, __entry->nr_sector)
 );
 
-
-DEFINE_EVENT(bcache_bio, bcache_passthrough,
-
+DEFINE_EVENT(bcache_bio, bcache_bypass_sequential,
         TP_PROTO(struct bio *bio),
+        TP_ARGS(bio)
+);
 
+DEFINE_EVENT(bcache_bio, bcache_bypass_congested,
+        TP_PROTO(struct bio *bio),
         TP_ARGS(bio)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_cache_hit,
+TRACE_EVENT(bcache_read,
+        TP_PROTO(struct bio *bio, bool hit, bool bypass),
+        TP_ARGS(bio, hit, bypass),
 
-        TP_PROTO(struct bio *bio),
+        TP_STRUCT__entry(
+                __field(dev_t,          dev                     )
+                __field(sector_t,       sector                  )
+                __field(unsigned int,   nr_sector               )
+                __array(char,           rwbs,   6               )
+                __field(bool,           cache_hit               )
+                __field(bool,           bypass                  )
+        ),
 
-        TP_ARGS(bio)
+        TP_fast_assign(
+                __entry->dev            = bio->bi_bdev->bd_dev;
+                __entry->sector         = bio->bi_sector;
+                __entry->nr_sector      = bio->bi_size >> 9;
+                blk_fill_rwbs(__entry->rwbs, bio->bi_rw, bio->bi_size);
+                __entry->cache_hit = hit;
+                __entry->bypass = bypass;
+        ),
+
+        TP_printk("%d,%d  %s %llu + %u hit %u bypass %u",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->rwbs, (unsigned long long)__entry->sector,
+                  __entry->nr_sector, __entry->cache_hit, __entry->bypass)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_cache_miss,
+TRACE_EVENT(bcache_write,
+        TP_PROTO(struct bio *bio, bool writeback, bool bypass),
+        TP_ARGS(bio, writeback, bypass),
 
-        TP_PROTO(struct bio *bio),
+        TP_STRUCT__entry(
+                __field(dev_t,          dev                     )
+                __field(sector_t,       sector                  )
+                __field(unsigned int,   nr_sector               )
+                __array(char,           rwbs,   6               )
+                __field(bool,           writeback               )
+                __field(bool,           bypass                  )
+        ),
 
-        TP_ARGS(bio)
+        TP_fast_assign(
+                __entry->dev            = bio->bi_bdev->bd_dev;
+                __entry->sector         = bio->bi_sector;
+                __entry->nr_sector      = bio->bi_size >> 9;
+                blk_fill_rwbs(__entry->rwbs, bio->bi_rw, bio->bi_size);
+                __entry->writeback = writeback;
+                __entry->bypass = bypass;
+        ),
+
+        TP_printk("%d,%d  %s %llu + %u hit %u bypass %u",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->rwbs, (unsigned long long)__entry->sector,
+                  __entry->nr_sector, __entry->writeback, __entry->bypass)
 );
 
 DEFINE_EVENT(bcache_bio, bcache_read_retry,
-
         TP_PROTO(struct bio *bio),
-
         TP_ARGS(bio)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_writethrough,
+DEFINE_EVENT(bkey, bcache_cache_insert,
+        TP_PROTO(struct bkey *k),
+        TP_ARGS(k)
+);
 
-        TP_PROTO(struct bio *bio),
+/* Journal */
 
-        TP_ARGS(bio)
-);
+DECLARE_EVENT_CLASS(cache_set,
+        TP_PROTO(struct cache_set *c),
+        TP_ARGS(c),
 
-DEFINE_EVENT(bcache_bio, bcache_writeback,
+        TP_STRUCT__entry(
+                __array(char,           uuid,   16 )
+        ),
 
-        TP_PROTO(struct bio *bio),
+        TP_fast_assign(
+                memcpy(__entry->uuid, c->sb.set_uuid, 16);
+        ),
 
-        TP_ARGS(bio)
+        TP_printk("%pU", __entry->uuid)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_write_skip,
-
-        TP_PROTO(struct bio *bio),
+DEFINE_EVENT(bkey, bcache_journal_replay_key,
+        TP_PROTO(struct bkey *k),
+        TP_ARGS(k)
+);
 
-        TP_ARGS(bio)
+DEFINE_EVENT(cache_set, bcache_journal_full,
+        TP_PROTO(struct cache_set *c),
+        TP_ARGS(c)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_btree_read,
+DEFINE_EVENT(cache_set, bcache_journal_entry_full,
+        TP_PROTO(struct cache_set *c),
+        TP_ARGS(c)
+);
 
+DEFINE_EVENT(bcache_bio, bcache_journal_write,
         TP_PROTO(struct bio *bio),
-
         TP_ARGS(bio)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_btree_write,
+/* Btree */
 
-        TP_PROTO(struct bio *bio),
+DEFINE_EVENT(cache_set, bcache_btree_cache_cannibalize,
+        TP_PROTO(struct cache_set *c),
+        TP_ARGS(c)
+);
 
-        TP_ARGS(bio)
+DEFINE_EVENT(btree_node, bcache_btree_read,
+        TP_PROTO(struct btree *b),
+        TP_ARGS(b)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_write_dirty,
+TRACE_EVENT(bcache_btree_write,
+        TP_PROTO(struct btree *b),
+        TP_ARGS(b),
 
-        TP_PROTO(struct bio *bio),
+        TP_STRUCT__entry(
+                __field(size_t,         bucket                  )
+                __field(unsigned,       block                   )
+                __field(unsigned,       keys                    )
+        ),
 
-        TP_ARGS(bio)
+        TP_fast_assign(
+                __entry->bucket = PTR_BUCKET_NR(b->c, &b->key, 0);
+                __entry->block  = b->written;
+                __entry->keys   = b->sets[b->nsets].data->keys;
+        ),
+
+        TP_printk("bucket %zu", __entry->bucket)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_read_dirty,
+DEFINE_EVENT(btree_node, bcache_btree_node_alloc,
+        TP_PROTO(struct btree *b),
+        TP_ARGS(b)
+);
 
-        TP_PROTO(struct bio *bio),
+DEFINE_EVENT(btree_node, bcache_btree_node_alloc_fail,
+        TP_PROTO(struct btree *b),
+        TP_ARGS(b)
+);
 
-        TP_ARGS(bio)
+DEFINE_EVENT(btree_node, bcache_btree_node_free,
+        TP_PROTO(struct btree *b),
+        TP_ARGS(b)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_write_moving,
+TRACE_EVENT(bcache_btree_gc_coalesce,
+        TP_PROTO(unsigned nodes),
+        TP_ARGS(nodes),
 
-        TP_PROTO(struct bio *bio),
+        TP_STRUCT__entry(
+                __field(unsigned,       nodes                   )
+        ),
 
-        TP_ARGS(bio)
+        TP_fast_assign(
+                __entry->nodes  = nodes;
+        ),
+
+        TP_printk("coalesced %u nodes", __entry->nodes)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_read_moving,
+DEFINE_EVENT(cache_set, bcache_gc_start,
+        TP_PROTO(struct cache_set *c),
+        TP_ARGS(c)
+);
 
-        TP_PROTO(struct bio *bio),
+DEFINE_EVENT(cache_set, bcache_gc_end,
+        TP_PROTO(struct cache_set *c),
+        TP_ARGS(c)
+);
 
-        TP_ARGS(bio)
+DEFINE_EVENT(bkey, bcache_gc_copy,
+        TP_PROTO(struct bkey *k),
+        TP_ARGS(k)
 );
 
-DEFINE_EVENT(bcache_bio, bcache_journal_write,
+DEFINE_EVENT(bkey, bcache_gc_copy_collision,
+        TP_PROTO(struct bkey *k),
+        TP_ARGS(k)
+);
 
-        TP_PROTO(struct bio *bio),
+TRACE_EVENT(bcache_btree_insert_key,
+        TP_PROTO(struct btree *b, struct bkey *k, unsigned op, unsigned status),
+        TP_ARGS(b, k, op, status),
 
-        TP_ARGS(bio)
-);
+        TP_STRUCT__entry(
+                __field(u64,    btree_node                      )
+                __field(u32,    btree_level                     )
+                __field(u32,    inode                           )
+                __field(u64,    offset                          )
+                __field(u32,    size                            )
+                __field(u8,     dirty                           )
+                __field(u8,     op                              )
+                __field(u8,     status                          )
+        ),
 
-DECLARE_EVENT_CLASS(bcache_cache_bio,
+        TP_fast_assign(
+                __entry->btree_node = PTR_BUCKET_NR(b->c, &b->key, 0);
+                __entry->btree_level = b->level;
+                __entry->inode  = KEY_INODE(k);
+                __entry->offset = KEY_OFFSET(k);
+                __entry->size   = KEY_SIZE(k);
+                __entry->dirty  = KEY_DIRTY(k);
+                __entry->op = op;
+                __entry->status = status;
+        ),
 
-        TP_PROTO(struct bio *bio,
-                 sector_t orig_sector,
-                 struct block_device* orig_bdev),
+        TP_printk("%u for %u at %llu(%u): %u:%llu len %u dirty %u",
+                  __entry->status, __entry->op,
+                  __entry->btree_node, __entry->btree_level,
+                  __entry->inode, __entry->offset,
+                  __entry->size, __entry->dirty)
+);
 
-        TP_ARGS(bio, orig_sector, orig_bdev),
+DECLARE_EVENT_CLASS(btree_split,
+        TP_PROTO(struct btree *b, unsigned keys),
+        TP_ARGS(b, keys),
 
         TP_STRUCT__entry(
-                __field(dev_t,          dev                     )
-                __field(dev_t,          orig_dev                )
-                __field(sector_t,       sector                  )
-                __field(sector_t,       orig_sector             )
-                __field(unsigned int,   nr_sector               )
-                __array(char,           rwbs,   6               )
-                __array(char,           comm,   TASK_COMM_LEN   )
+                __field(size_t,         bucket                  )
+                __field(unsigned,       keys                    )
         ),
 
         TP_fast_assign(
-                __entry->dev            = bio->bi_bdev->bd_dev;
-                __entry->orig_dev       = orig_bdev->bd_dev;
-                __entry->sector         = bio->bi_sector;
-                __entry->orig_sector    = orig_sector;
-                __entry->nr_sector      = bio->bi_size >> 9;
-                blk_fill_rwbs(__entry->rwbs, bio->bi_rw, bio->bi_size);
-                memcpy(__entry->comm, current->comm, TASK_COMM_LEN);
+                __entry->bucket = PTR_BUCKET_NR(b->c, &b->key, 0);
+                __entry->keys   = keys;
         ),
 
-        TP_printk("%d,%d  %s %llu + %u [%s] (from %d,%d %llu)",
-                  MAJOR(__entry->dev), MINOR(__entry->dev),
-                  __entry->rwbs,
-                  (unsigned long long)__entry->sector,
-                  __entry->nr_sector, __entry->comm,
-                  MAJOR(__entry->orig_dev), MINOR(__entry->orig_dev),
-                  (unsigned long long)__entry->orig_sector)
+        TP_printk("bucket %zu keys %u", __entry->bucket, __entry->keys)
 );
 
-DEFINE_EVENT(bcache_cache_bio, bcache_cache_insert,
-
-        TP_PROTO(struct bio *bio,
-                 sector_t orig_sector,
-                 struct block_device *orig_bdev),
+DEFINE_EVENT(btree_split, bcache_btree_node_split,
+        TP_PROTO(struct btree *b, unsigned keys),
+        TP_ARGS(b, keys)
+);
 
-        TP_ARGS(bio, orig_sector, orig_bdev)
+DEFINE_EVENT(btree_split, bcache_btree_node_compact,
+        TP_PROTO(struct btree *b, unsigned keys),
+        TP_ARGS(b, keys)
 );
 
-DECLARE_EVENT_CLASS(bcache_gc,
+DEFINE_EVENT(btree_node, bcache_btree_set_root,
+        TP_PROTO(struct btree *b),
+        TP_ARGS(b)
+);
 
-        TP_PROTO(uint8_t *uuid),
+/* Allocator */
 
-        TP_ARGS(uuid),
+TRACE_EVENT(bcache_alloc_invalidate,
+        TP_PROTO(struct cache *ca),
+        TP_ARGS(ca),
 
         TP_STRUCT__entry(
-                __field(uint8_t *,      uuid)
+                __field(unsigned,       free                    )
+                __field(unsigned,       free_inc                )
+                __field(unsigned,       free_inc_size           )
+                __field(unsigned,       unused                  )
         ),
 
         TP_fast_assign(
-                __entry->uuid           = uuid;
+                __entry->free           = fifo_used(&ca->free);
+                __entry->free_inc       = fifo_used(&ca->free_inc);
+                __entry->free_inc_size  = ca->free_inc.size;
+                __entry->unused         = fifo_used(&ca->unused);
         ),
 
-        TP_printk("%pU", __entry->uuid)
+        TP_printk("free %u free_inc %u/%u unused %u", __entry->free,
+                  __entry->free_inc, __entry->free_inc_size, __entry->unused)
 );
 
+TRACE_EVENT(bcache_alloc_fail,
+        TP_PROTO(struct cache *ca),
+        TP_ARGS(ca),
 
-DEFINE_EVENT(bcache_gc, bcache_gc_start,
+        TP_STRUCT__entry(
+                __field(unsigned,       free                    )
+                __field(unsigned,       free_inc                )
+                __field(unsigned,       unused                  )
+                __field(unsigned,       blocked                 )
+        ),
 
-             TP_PROTO(uint8_t *uuid),
+        TP_fast_assign(
+                __entry->free           = fifo_used(&ca->free);
+                __entry->free_inc       = fifo_used(&ca->free_inc);
+                __entry->unused         = fifo_used(&ca->unused);
+                __entry->blocked        = atomic_read(&ca->set->prio_blocked);
+        ),
 
-             TP_ARGS(uuid)
+        TP_printk("free %u free_inc %u unused %u blocked %u", __entry->free,
+                  __entry->free_inc, __entry->unused, __entry->blocked)
 );
 
-DEFINE_EVENT(bcache_gc, bcache_gc_end,
+/* Background writeback */
 
-             TP_PROTO(uint8_t *uuid),
+DEFINE_EVENT(bkey, bcache_writeback,
+        TP_PROTO(struct bkey *k),
+        TP_ARGS(k)
+);
 
-             TP_ARGS(uuid)
+DEFINE_EVENT(bkey, bcache_writeback_collision,
+        TP_PROTO(struct bkey *k),
+        TP_ARGS(k)
 );
 
 #endif /* _TRACE_BCACHE_H */
diff --git a/include/trace/events/target.h b/include/trace/events/target.h
new file mode 100644
index 000000000000..aef8fc354025
--- /dev/null
+++ b/include/trace/events/target.h
@@ -0,0 +1,214 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM target
+
+#if !defined(_TRACE_TARGET_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_TARGET_H
+
+#include <linux/tracepoint.h>
+#include <linux/trace_seq.h>
+#include <scsi/scsi.h>
+#include <scsi/scsi_tcq.h>
+#include <target/target_core_base.h>
+
+/* cribbed verbatim from <trace/event/scsi.h> */
+#define scsi_opcode_name(opcode)        { opcode, #opcode }
+#define show_opcode_name(val)                                   \
+        __print_symbolic(val,                                   \
+                scsi_opcode_name(TEST_UNIT_READY),              \
+                scsi_opcode_name(REZERO_UNIT),                  \
+                scsi_opcode_name(REQUEST_SENSE),                \
+                scsi_opcode_name(FORMAT_UNIT),                  \
+                scsi_opcode_name(READ_BLOCK_LIMITS),            \
+                scsi_opcode_name(REASSIGN_BLOCKS),              \
+                scsi_opcode_name(INITIALIZE_ELEMENT_STATUS),    \
+                scsi_opcode_name(READ_6),                       \
+                scsi_opcode_name(WRITE_6),                      \
+                scsi_opcode_name(SEEK_6),                       \
+                scsi_opcode_name(READ_REVERSE),                 \
+                scsi_opcode_name(WRITE_FILEMARKS),              \
+                scsi_opcode_name(SPACE),                        \
+                scsi_opcode_name(INQUIRY),                      \
+                scsi_opcode_name(RECOVER_BUFFERED_DATA),        \
+                scsi_opcode_name(MODE_SELECT),                  \
+                scsi_opcode_name(RESERVE),                      \
+                scsi_opcode_name(RELEASE),                      \
+                scsi_opcode_name(COPY),                         \
+                scsi_opcode_name(ERASE),                        \
+                scsi_opcode_name(MODE_SENSE),                   \
+                scsi_opcode_name(START_STOP),                   \
+                scsi_opcode_name(RECEIVE_DIAGNOSTIC),           \
+                scsi_opcode_name(SEND_DIAGNOSTIC),              \
+                scsi_opcode_name(ALLOW_MEDIUM_REMOVAL),         \
+                scsi_opcode_name(SET_WINDOW),                   \
+                scsi_opcode_name(READ_CAPACITY),                \
+                scsi_opcode_name(READ_10),                      \
+                scsi_opcode_name(WRITE_10),                     \
+                scsi_opcode_name(SEEK_10),                      \
+                scsi_opcode_name(POSITION_TO_ELEMENT),          \
+                scsi_opcode_name(WRITE_VERIFY),                 \
+                scsi_opcode_name(VERIFY),                       \
+                scsi_opcode_name(SEARCH_HIGH),                  \
+                scsi_opcode_name(SEARCH_EQUAL),                 \
+                scsi_opcode_name(SEARCH_LOW),                   \
+                scsi_opcode_name(SET_LIMITS),                   \
+                scsi_opcode_name(PRE_FETCH),                    \
+                scsi_opcode_name(READ_POSITION),                \
+                scsi_opcode_name(SYNCHRONIZE_CACHE),            \
+                scsi_opcode_name(LOCK_UNLOCK_CACHE),            \
+                scsi_opcode_name(READ_DEFECT_DATA),             \
+                scsi_opcode_name(MEDIUM_SCAN),                  \
+                scsi_opcode_name(COMPARE),                      \
+                scsi_opcode_name(COPY_VERIFY),                  \
+                scsi_opcode_name(WRITE_BUFFER),                 \
+                scsi_opcode_name(READ_BUFFER),                  \
+                scsi_opcode_name(UPDATE_BLOCK),                 \
+                scsi_opcode_name(READ_LONG),                    \
+                scsi_opcode_name(WRITE_LONG),                   \
+                scsi_opcode_name(CHANGE_DEFINITION),            \
+                scsi_opcode_name(WRITE_SAME),                   \
+                scsi_opcode_name(UNMAP),                        \
+                scsi_opcode_name(READ_TOC),                     \
+                scsi_opcode_name(LOG_SELECT),                   \
+                scsi_opcode_name(LOG_SENSE),                    \
+                scsi_opcode_name(XDWRITEREAD_10),               \
+                scsi_opcode_name(MODE_SELECT_10),               \
+                scsi_opcode_name(RESERVE_10),                   \
+                scsi_opcode_name(RELEASE_10),                   \
+                scsi_opcode_name(MODE_SENSE_10),                \
+                scsi_opcode_name(PERSISTENT_RESERVE_IN),        \
+                scsi_opcode_name(PERSISTENT_RESERVE_OUT),       \
+                scsi_opcode_name(VARIABLE_LENGTH_CMD),          \
+                scsi_opcode_name(REPORT_LUNS),                  \
+                scsi_opcode_name(MAINTENANCE_IN),               \
+                scsi_opcode_name(MAINTENANCE_OUT),              \
+                scsi_opcode_name(MOVE_MEDIUM),                  \
+                scsi_opcode_name(EXCHANGE_MEDIUM),              \
+                scsi_opcode_name(READ_12),                      \
+                scsi_opcode_name(WRITE_12),                     \
+                scsi_opcode_name(WRITE_VERIFY_12),              \
+                scsi_opcode_name(SEARCH_HIGH_12),               \
+                scsi_opcode_name(SEARCH_EQUAL_12),              \
+                scsi_opcode_name(SEARCH_LOW_12),                \
+                scsi_opcode_name(READ_ELEMENT_STATUS),          \
+                scsi_opcode_name(SEND_VOLUME_TAG),              \
+                scsi_opcode_name(WRITE_LONG_2),                 \
+                scsi_opcode_name(READ_16),                      \
+                scsi_opcode_name(WRITE_16),                     \
+                scsi_opcode_name(VERIFY_16),                    \
+                scsi_opcode_name(WRITE_SAME_16),                \
+                scsi_opcode_name(SERVICE_ACTION_IN),            \
+                scsi_opcode_name(SAI_READ_CAPACITY_16),         \
+                scsi_opcode_name(SAI_GET_LBA_STATUS),           \
+                scsi_opcode_name(MI_REPORT_TARGET_PGS),         \
+                scsi_opcode_name(MO_SET_TARGET_PGS),            \
+                scsi_opcode_name(READ_32),                      \
+                scsi_opcode_name(WRITE_32),                     \
+                scsi_opcode_name(WRITE_SAME_32),                \
+                scsi_opcode_name(ATA_16),                       \
+                scsi_opcode_name(ATA_12))
+
+#define show_task_attribute_name(val)                           \
+        __print_symbolic(val,                                   \
+                { MSG_SIMPLE_TAG,       "SIMPLE"        },      \
+                { MSG_HEAD_TAG,         "HEAD"          },      \
+                { MSG_ORDERED_TAG,      "ORDERED"       },      \
+                { MSG_ACA_TAG,          "ACA"           } )
+
+#define show_scsi_status_name(val)                              \
+        __print_symbolic(val,                                   \
+                { SAM_STAT_GOOD,        "GOOD" },               \
+                { SAM_STAT_CHECK_CONDITION, "CHECK CONDITION" }, \
+                { SAM_STAT_CONDITION_MET, "CONDITION MET" },    \
+                { SAM_STAT_BUSY,        "BUSY" },               \
+                { SAM_STAT_INTERMEDIATE, "INTERMEDIATE" },      \
+                { SAM_STAT_INTERMEDIATE_CONDITION_MET, "INTERMEDIATE CONDITION MET" }, \
+                { SAM_STAT_RESERVATION_CONFLICT, "RESERVATION CONFLICT" }, \
+                { SAM_STAT_COMMAND_TERMINATED, "COMMAND TERMINATED" }, \
+                { SAM_STAT_TASK_SET_FULL, "TASK SET FULL" },    \
+                { SAM_STAT_ACA_ACTIVE, "ACA ACTIVE" },          \
+                { SAM_STAT_TASK_ABORTED, "TASK ABORTED" } )
+
+TRACE_EVENT(target_sequencer_start,
+
+        TP_PROTO(struct se_cmd *cmd),
+
+        TP_ARGS(cmd),
+
+        TP_STRUCT__entry(
+                __field( unsigned int,  unpacked_lun    )
+                __field( unsigned int,  opcode          )
+                __field( unsigned int,  data_length     )
+                __field( unsigned int,  task_attribute  )
+                __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE       )
+                __string( initiator,    cmd->se_sess->se_node_acl->initiatorname        )
+        ),
+
+        TP_fast_assign(
+                __entry->unpacked_lun   = cmd->se_lun->unpacked_lun;
+                __entry->opcode         = cmd->t_task_cdb[0];
+                __entry->data_length    = cmd->data_length;
+                __entry->task_attribute = cmd->sam_task_attr;
+                memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE);
+                __assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname);
+        ),
+
+        TP_printk("%s -> LUN %03u %s data_length %6u  CDB %s  (TA:%s C:%02x)",
+                  __get_str(initiator), __entry->unpacked_lun,
+                  show_opcode_name(__entry->opcode),
+                  __entry->data_length, __print_hex(__entry->cdb, 16),
+                  show_task_attribute_name(__entry->task_attribute),
+                  scsi_command_size(__entry->cdb) <= 16 ?
+                        __entry->cdb[scsi_command_size(__entry->cdb) - 1] :
+                        __entry->cdb[1]
+        )
+);
+
+TRACE_EVENT(target_cmd_complete,
+
+        TP_PROTO(struct se_cmd *cmd),
+
+        TP_ARGS(cmd),
+
+        TP_STRUCT__entry(
+                __field( unsigned int,  unpacked_lun    )
+                __field( unsigned int,  opcode          )
+                __field( unsigned int,  data_length     )
+                __field( unsigned int,  task_attribute  )
+                __field( unsigned char, scsi_status     )
+                __field( unsigned char, sense_length    )
+                __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE       )
+                __array( unsigned char, sense_data, 18  )
+                __string(initiator,     cmd->se_sess->se_node_acl->initiatorname)
+        ),
+
+        TP_fast_assign(
+                __entry->unpacked_lun   = cmd->se_lun->unpacked_lun;
+                __entry->opcode         = cmd->t_task_cdb[0];
+                __entry->data_length    = cmd->data_length;
+                __entry->task_attribute = cmd->sam_task_attr;
+                __entry->scsi_status    = cmd->scsi_status;
+                __entry->sense_length   = cmd->scsi_status == SAM_STAT_CHECK_CONDITION ?
+                        min(18, ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET] + 8) : 0;
+                memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE);
+                memcpy(__entry->sense_data, cmd->sense_buffer, __entry->sense_length);
+                __assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname);
+        ),
+
+        TP_printk("%s <- LUN %03u status %s (sense len %d%s%s)  %s data_length %6u  CDB %s  (TA:%s C:%02x)",
+                  __get_str(initiator), __entry->unpacked_lun,
+                  show_scsi_status_name(__entry->scsi_status),
+                  __entry->sense_length, __entry->sense_length ? " / " : "",
+                  __print_hex(__entry->sense_data, __entry->sense_length),
+                  show_opcode_name(__entry->opcode),
+                  __entry->data_length, __print_hex(__entry->cdb, 16),
+                  show_task_attribute_name(__entry->task_attribute),
+                  scsi_command_size(__entry->cdb) <= 16 ?
+                        __entry->cdb[scsi_command_size(__entry->cdb) - 1] :
+                        __entry->cdb[1]
+        )
+);
+
+#endif /*  _TRACE_TARGET_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index d615f78cc6b6..41a6643e2136 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -670,10 +670,6 @@ perf_trace_##call(void *__data, proto)					\
                              sizeof(u64));                              \
         __entry_size -= sizeof(u32);                                    \
                                                                         \
-        if (WARN_ONCE(__entry_size > PERF_MAX_TRACE_SIZE,               \
-                      "profile buffer not large enough"))               \
-                return;                                                 \
-                                                                        \
         entry = (struct ftrace_raw_##call *)perf_trace_buf_prepare(     \
                 __entry_size, event_call->event.type, &__regs, &rctx);  \
         if (!entry)                                                     \
diff --git a/include/trace/syscall.h b/include/trace/syscall.h
index 84bc4197e736..fed853f3d7aa 100644
--- a/include/trace/syscall.h
+++ b/include/trace/syscall.h
@@ -16,6 +16,7 @@
  * @nb_args: number of parameters it takes
  * @types: list of types as strings
  * @args: list of args as strings (args[i] matches types[i])
+ * @enter_fields: list of fields for syscall_enter trace event
  * @enter_event: associated syscall_enter trace event
  * @exit_event: associated syscall_exit trace event
  */
diff --git a/include/uapi/asm-generic/fcntl.h b/include/uapi/asm-generic/fcntl.h
index 06632beaa6d5..95e46c8e05f9 100644
--- a/include/uapi/asm-generic/fcntl.h
+++ b/include/uapi/asm-generic/fcntl.h
@@ -84,10 +84,14 @@
 #define O_PATH          010000000
 #endif
 
-#ifndef O_TMPFILE
-#define O_TMPFILE       020000000
+#ifndef __O_TMPFILE
+#define __O_TMPFILE     020000000
 #endif
 
+/* a horrid kludge trying to make sure that this will fail on old kernels */
+#define O_TMPFILE (__O_TMPFILE | O_DIRECTORY)
+#define O_TMPFILE_MASK (__O_TMPFILE | O_DIRECTORY | O_CREAT)      
+
 #ifndef O_NDELAY
 #define O_NDELAY        O_NONBLOCK
 #endif
diff --git a/include/uapi/asm-generic/poll.h b/include/uapi/asm-generic/poll.h
index 9ce7f44aebd2..a9694982689f 100644
--- a/include/uapi/asm-generic/poll.h
+++ b/include/uapi/asm-generic/poll.h
@@ -30,6 +30,8 @@
 
 #define POLLFREE        0x4000  /* currently only for epoll */
 
+#define POLL_BUSY_LOOP  0x8000
+
 struct pollfd {
         int fd;
         short events;
diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index c5d2e3a1cf68..f04b69b6abf2 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -76,4 +76,6 @@
 
 #define SO_SELECT_ERR_QUEUE     45
 
+#define SO_BUSY_POLL            46
+
 #endif /* __ASM_GENERIC_SOCKET_H */
diff --git a/include/uapi/drm/drm.h b/include/uapi/drm/drm.h
index 5a57be68bab7..238a166b9fe6 100644
--- a/include/uapi/drm/drm.h
+++ b/include/uapi/drm/drm.h
@@ -732,6 +732,7 @@ struct drm_prime_handle {
 #define DRM_IOCTL_MODE_ADDFB2           DRM_IOWR(0xB8, struct drm_mode_fb_cmd2)
 #define DRM_IOCTL_MODE_OBJ_GETPROPERTIES        DRM_IOWR(0xB9, struct drm_mode_obj_get_properties)
 #define DRM_IOCTL_MODE_OBJ_SETPROPERTY  DRM_IOWR(0xBA, struct drm_mode_obj_set_property)
+#define DRM_IOCTL_MODE_CURSOR2          DRM_IOWR(0xBB, struct drm_mode_cursor2)
 
 /**
  * Device specific ioctls should only be in their respective headers
diff --git a/include/uapi/drm/drm_mode.h b/include/uapi/drm/drm_mode.h
index 090e5331ab7e..53db7cea373b 100644
--- a/include/uapi/drm/drm_mode.h
+++ b/include/uapi/drm/drm_mode.h
@@ -388,6 +388,19 @@ struct drm_mode_cursor {
         __u32 handle;
 };
 
+struct drm_mode_cursor2 {
+        __u32 flags;
+        __u32 crtc_id;
+        __s32 x;
+        __s32 y;
+        __u32 width;
+        __u32 height;
+        /* driver specific handle */
+        __u32 handle;
+        __s32 hot_x;
+        __s32 hot_y;
+};
+
 struct drm_mode_crtc_lut {
         __u32 crtc_id;
         __u32 gamma_size;
diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
index 07d59419fe6b..923ed7fe5775 100644
--- a/include/uapi/drm/i915_drm.h
+++ b/include/uapi/drm/i915_drm.h
@@ -305,7 +305,7 @@ typedef struct drm_i915_irq_wait {
 #define I915_PARAM_HAS_WAIT_TIMEOUT      19
 #define I915_PARAM_HAS_SEMAPHORES        20
 #define I915_PARAM_HAS_PRIME_VMAP_FLUSH  21
-#define I915_PARAM_RSVD_FOR_FUTURE_USE   22
+#define I915_PARAM_HAS_VEBOX             22
 #define I915_PARAM_HAS_SECURE_BATCHES    23
 #define I915_PARAM_HAS_PINNED_BATCHES    24
 #define I915_PARAM_HAS_EXEC_NO_RELOC     25
@@ -660,6 +660,7 @@ struct drm_i915_gem_execbuffer2 {
 #define I915_EXEC_RENDER                 (1<<0)
 #define I915_EXEC_BSD                    (2<<0)
 #define I915_EXEC_BLT                    (3<<0)
+#define I915_EXEC_VEBOX                  (4<<0)
 
 /* Used for switching the constants addressing mode on gen4+ RENDER ring.
  * Gen6+ only supports relative addressing to dynamic state (default) and
diff --git a/include/uapi/drm/tegra_drm.h b/include/uapi/drm/tegra_drm.h
index 6e132a2f7420..73bde4eaf16c 100644
--- a/include/uapi/drm/tegra_drm.h
+++ b/include/uapi/drm/tegra_drm.h
@@ -17,6 +17,8 @@
 #ifndef _UAPI_TEGRA_DRM_H_
 #define _UAPI_TEGRA_DRM_H_
 
+#include <drm/drm.h>
+
 struct drm_tegra_gem_create {
         __u64 size;
         __u32 flags;
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index bdc6e87ff3eb..997f9f2f0963 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -62,6 +62,7 @@ header-y += auxvec.h
 header-y += ax25.h
 header-y += b1lli.h
 header-y += baycom.h
+header-y += bcm933xx_hcs.h
 header-y += bfs_fs.h
 header-y += binfmts.h
 header-y += blkpg.h
diff --git a/include/uapi/linux/bcm933xx_hcs.h b/include/uapi/linux/bcm933xx_hcs.h
new file mode 100644
index 000000000000..d22821831549
--- /dev/null
+++ b/include/uapi/linux/bcm933xx_hcs.h
@@ -0,0 +1,24 @@
+/*
+ * Broadcom Cable Modem firmware format
+ */
+
+#ifndef __BCM933XX_HCS_H
+#define __BCM933XX_HCS_H
+
+#include <linux/types.h>
+
+struct bcm_hcs {
+        __u16 magic;
+        __u16 control;
+        __u16 rev_maj;
+        __u16 rev_min;
+        __u32 build_date;
+        __u32 filelen;
+        __u32 ldaddress;
+        char filename[64];
+        __u16 hcs;
+        __u16 her_znaet_chto;
+        __u32 crc;
+};
+
+#endif /* __BCM933XX_HCS */
diff --git a/include/uapi/linux/dm-ioctl.h b/include/uapi/linux/dm-ioctl.h
index 7e75b6fd8d45..afd0cbd52edb 100644
--- a/include/uapi/linux/dm-ioctl.h
+++ b/include/uapi/linux/dm-ioctl.h
@@ -267,9 +267,9 @@ enum {
 #define DM_DEV_SET_GEOMETRY     _IOWR(DM_IOCTL, DM_DEV_SET_GEOMETRY_CMD, struct dm_ioctl)
 
 #define DM_VERSION_MAJOR        4
-#define DM_VERSION_MINOR        24
+#define DM_VERSION_MINOR        25
 #define DM_VERSION_PATCHLEVEL   0
-#define DM_VERSION_EXTRA        "-ioctl (2013-01-15)"
+#define DM_VERSION_EXTRA        "-ioctl (2013-06-26)"
 
 /* Status bits */
 #define DM_READONLY_FLAG        (1 << 0) /* In/Out */
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 0c9b44871df0..38dbafaa5341 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -993,8 +993,8 @@ enum ethtool_sfeatures_retval_bits {
 #define PORT_OTHER              0xff
 
 /* Which transceiver to use. */
-#define XCVR_INTERNAL           0x00
-#define XCVR_EXTERNAL           0x01
+#define XCVR_INTERNAL           0x00 /* PHY and MAC are in the same package */
+#define XCVR_EXTERNAL           0x01 /* PHY and MAC are in different packages */
 #define XCVR_DUMMY1             0x02
 #define XCVR_DUMMY2             0x03
 #define XCVR_DUMMY3             0x04
diff --git a/include/uapi/linux/gen_stats.h b/include/uapi/linux/gen_stats.h
index 552c8a0a12d1..6487317ea619 100644
--- a/include/uapi/linux/gen_stats.h
+++ b/include/uapi/linux/gen_stats.h
@@ -9,6 +9,7 @@ enum {
         TCA_STATS_RATE_EST,
         TCA_STATS_QUEUE,
         TCA_STATS_APP,
+        TCA_STATS_RATE_EST64,
         __TCA_STATS_MAX,
 };
 #define TCA_STATS_MAX (__TCA_STATS_MAX - 1)
@@ -38,6 +39,16 @@ struct gnet_stats_rate_est {
 };
 
 /**
+ * struct gnet_stats_rate_est64 - rate estimator
+ * @bps: current byte rate
+ * @pps: current packet rate
+ */
+struct gnet_stats_rate_est64 {
+        __u64   bps;
+        __u64   pps;
+};
+
+/**
  * struct gnet_stats_queue - queuing statistics
  * @qlen: queue length
  * @backlog: backlog size of queue
diff --git a/include/uapi/linux/if_arp.h b/include/uapi/linux/if_arp.h
index 82c7d1bdadeb..d7fea3496f32 100644
--- a/include/uapi/linux/if_arp.h
+++ b/include/uapi/linux/if_arp.h
@@ -93,6 +93,7 @@
 #define ARPHRD_PHONET_PIPE 821          /* PhoNet pipe header           */
 #define ARPHRD_CAIF     822             /* CAIF media type              */
 #define ARPHRD_IP6GRE   823             /* GRE over IPv6                */
+#define ARPHRD_NETLINK  824             /* Netlink header               */
 
 #define ARPHRD_VOID       0xFFFF        /* Void type, nothing is known */
 #define ARPHRD_NONE       0xFFFE        /* zero header length */
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index b05823cae784..03f6170ab337 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -221,6 +221,8 @@ enum {
         IFLA_BRPORT_GUARD,      /* bpdu guard              */
         IFLA_BRPORT_PROTECT,    /* root port protection    */
         IFLA_BRPORT_FAST_LEAVE, /* multicast fast leave    */
+        IFLA_BRPORT_LEARNING,   /* mac learning */
+        IFLA_BRPORT_UNICAST_FLOOD, /* flood unicast traffic */
         __IFLA_BRPORT_MAX
 };
 #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
@@ -336,6 +338,7 @@ enum {
         IFLA_VF_VLAN,
         IFLA_VF_TX_RATE,        /* TX Bandwidth Allocation */
         IFLA_VF_SPOOFCHK,       /* Spoof Checking on/off switch */
+        IFLA_VF_LINK_STATE,     /* link state enable/disable/auto switch */
         __IFLA_VF_MAX,
 };
 
@@ -362,6 +365,18 @@ struct ifla_vf_spoofchk {
         __u32 setting;
 };
 
+enum {
+        IFLA_VF_LINK_STATE_AUTO,        /* link state of the uplink */
+        IFLA_VF_LINK_STATE_ENABLE,      /* link always up */
+        IFLA_VF_LINK_STATE_DISABLE,     /* link always down */
+        __IFLA_VF_LINK_STATE_MAX,
+};
+
+struct ifla_vf_link_state {
+        __u32 vf;
+        __u32 link_state;
+};
+
 /* VF ports management section
  *
  *      Nested layout of set/get msg is:
diff --git a/include/uapi/linux/if_pppox.h b/include/uapi/linux/if_pppox.h
index 0b46fd57c8f6..e36a4aecd311 100644
--- a/include/uapi/linux/if_pppox.h
+++ b/include/uapi/linux/if_pppox.h
@@ -135,11 +135,11 @@ struct pppoe_tag {
 
 struct pppoe_hdr {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
-        __u8 ver : 4;
         __u8 type : 4;
+        __u8 ver : 4;
 #elif defined(__BIG_ENDIAN_BITFIELD)
-        __u8 type : 4;
         __u8 ver : 4;
+        __u8 type : 4;
 #else
 #error  "Please fix <asm/byteorder.h>"
 #endif
diff --git a/include/uapi/linux/if_tun.h b/include/uapi/linux/if_tun.h
index 2835b85fd46d..82334f88967e 100644
--- a/include/uapi/linux/if_tun.h
+++ b/include/uapi/linux/if_tun.h
@@ -68,6 +68,8 @@
 #define IFF_MULTI_QUEUE 0x0100
 #define IFF_ATTACH_QUEUE 0x0200
 #define IFF_DETACH_QUEUE 0x0400
+/* read-only flag */
+#define IFF_PERSIST     0x0800
 
 /* Features for GSO (TUNSETOFFLOAD). */
 #define TUN_F_CSUM      0x01    /* You can hand me unchecksummed packets. */
diff --git a/include/uapi/linux/ip_vs.h b/include/uapi/linux/ip_vs.h
index a24537725e80..29458223d044 100644
--- a/include/uapi/linux/ip_vs.h
+++ b/include/uapi/linux/ip_vs.h
@@ -20,6 +20,12 @@
 #define IP_VS_SVC_F_PERSISTENT  0x0001          /* persistent port */
 #define IP_VS_SVC_F_HASHED      0x0002          /* hashed entry */
 #define IP_VS_SVC_F_ONEPACKET   0x0004          /* one-packet scheduling */
+#define IP_VS_SVC_F_SCHED1      0x0008          /* scheduler flag 1 */
+#define IP_VS_SVC_F_SCHED2      0x0010          /* scheduler flag 2 */
+#define IP_VS_SVC_F_SCHED3      0x0020          /* scheduler flag 3 */
+
+#define IP_VS_SVC_F_SCHED_SH_FALLBACK   IP_VS_SVC_F_SCHED1 /* SH fallback */
+#define IP_VS_SVC_F_SCHED_SH_PORT       IP_VS_SVC_F_SCHED2 /* SH use port */
 
 /*
  *      Destination Server Flags
diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h
index a2308ae5a73d..3a9b92147339 100644
--- a/include/uapi/linux/netfilter/nfnetlink_queue.h
+++ b/include/uapi/linux/netfilter/nfnetlink_queue.h
@@ -105,5 +105,7 @@ enum nfqnl_attr_config {
 #define NFQA_SKB_CSUMNOTREADY (1 << 0)
 /* packet is GSO (i.e., exceeds device mtu) */
 #define NFQA_SKB_GSO (1 << 1)
+/* csum not validated (incoming device doesn't support hw checksum, etc.) */
+#define NFQA_SKB_CSUM_NOTVERIFIED (1 << 2)
 
 #endif /* _NFNETLINK_QUEUE_H */
diff --git a/include/uapi/linux/netfilter/xt_socket.h b/include/uapi/linux/netfilter/xt_socket.h
index 26d7217bd4f1..6315e2ac3474 100644
--- a/include/uapi/linux/netfilter/xt_socket.h
+++ b/include/uapi/linux/netfilter/xt_socket.h
@@ -5,10 +5,17 @@
 
 enum {
         XT_SOCKET_TRANSPARENT = 1 << 0,
+        XT_SOCKET_NOWILDCARD = 1 << 1,
 };
 
 struct xt_socket_mtinfo1 {
         __u8 flags;
 };
+#define XT_SOCKET_FLAGS_V1 XT_SOCKET_TRANSPARENT
+
+struct xt_socket_mtinfo2 {
+        __u8 flags;
+};
+#define XT_SOCKET_FLAGS_V2 (XT_SOCKET_TRANSPARENT | XT_SOCKET_NOWILDCARD)
 
 #endif /* _XT_SOCKET_H */
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 7c6f627a717d..caed0f324d5f 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -69,6 +69,8 @@
  *      starting a poll from a device which has a secure element enabled means
  *      we want to do SE based card emulation.
  * @NFC_CMD_DISABLE_SE: Disable the physical link to a specific secure element.
+ * @NFC_CMD_FW_UPLOAD: Request to Load/flash firmware, or event to inform that
+ *      some firmware was loaded
  */
 enum nfc_commands {
         NFC_CMD_UNSPEC,
@@ -92,6 +94,9 @@ enum nfc_commands {
         NFC_CMD_DISABLE_SE,
         NFC_CMD_LLC_SDREQ,
         NFC_EVENT_LLC_SDRES,
+        NFC_CMD_FW_UPLOAD,
+        NFC_EVENT_SE_ADDED,
+        NFC_EVENT_SE_REMOVED,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -121,6 +126,9 @@ enum nfc_commands {
  * @NFC_ATTR_LLC_PARAM_RW: Receive Window size parameter
  * @NFC_ATTR_LLC_PARAM_MIUX: MIU eXtension parameter
  * @NFC_ATTR_SE: Available Secure Elements
+ * @NFC_ATTR_FIRMWARE_NAME: Free format firmware version
+ * @NFC_ATTR_SE_INDEX: Secure element index
+ * @NFC_ATTR_SE_TYPE: Secure element type (UICC or EMBEDDED)
  */
 enum nfc_attrs {
         NFC_ATTR_UNSPEC,
@@ -143,6 +151,9 @@ enum nfc_attrs {
         NFC_ATTR_LLC_PARAM_MIUX,
         NFC_ATTR_SE,
         NFC_ATTR_LLC_SDP,
+        NFC_ATTR_FIRMWARE_NAME,
+        NFC_ATTR_SE_INDEX,
+        NFC_ATTR_SE_TYPE,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
@@ -159,9 +170,12 @@ enum nfc_sdp_attr {
 
 #define NFC_DEVICE_NAME_MAXSIZE 8
 #define NFC_NFCID1_MAXSIZE 10
+#define NFC_NFCID2_MAXSIZE 8
+#define NFC_NFCID3_MAXSIZE 10
 #define NFC_SENSB_RES_MAXSIZE 12
 #define NFC_SENSF_RES_MAXSIZE 18
 #define NFC_GB_MAXSIZE        48
+#define NFC_FIRMWARE_NAME_MAXSIZE 32
 
 /* NFC protocols */
 #define NFC_PROTO_JEWEL         1
@@ -191,10 +205,12 @@ enum nfc_sdp_attr {
 #define NFC_PROTO_ISO14443_B_MASK (1 << NFC_PROTO_ISO14443_B)
 
 /* NFC Secure Elements */
-#define NFC_SE_NONE     0x0
 #define NFC_SE_UICC     0x1
 #define NFC_SE_EMBEDDED 0x2
 
+#define NFC_SE_DISABLED 0x0
+#define NFC_SE_ENABLED  0x1
+
 struct sockaddr_nfc {
         sa_family_t sa_family;
         __u32 dev_idx;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index d1e48b5e348f..861e5eba3953 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -27,6 +27,8 @@
 
 #include <linux/types.h>
 
+#define NL80211_GENL_NAME "nl80211"
+
 /**
  * DOC: Station handling
  *
@@ -1429,6 +1431,11 @@ enum nl80211_commands {
  * @NL80211_ATTR_MAX_CRIT_PROT_DURATION: duration in milliseconds in which
  *      the connection should have increased reliability (u16).
  *
+ * @NL80211_ATTR_PEER_AID: Association ID for the peer TDLS station (u16).
+ *      This is similar to @NL80211_ATTR_STA_AID but with a difference of being
+ *      allowed to be used with the first @NL80211_CMD_SET_STATION command to
+ *      update a TDLS peer STA entry.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1727,6 +1734,8 @@ enum nl80211_attrs {
         NL80211_ATTR_CRIT_PROT_ID,
         NL80211_ATTR_MAX_CRIT_PROT_DURATION,
 
+        NL80211_ATTR_PEER_AID,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1991,6 +2000,10 @@ enum nl80211_sta_bss_param {
  * @NL80211_STA_INFO_PEER_PM: peer mesh STA link-specific power mode
  * @NL80211_STA_INFO_NONPEER_PM: neighbor mesh STA power save mode towards
  *      non-peer STA
+ * @NL80211_STA_INFO_CHAIN_SIGNAL: per-chain signal strength of last PPDU
+ *      Contains a nested array of signal strength attributes (u8, dBm)
+ * @NL80211_STA_INFO_CHAIN_SIGNAL_AVG: per-chain signal strength average
+ *      Same format as NL80211_STA_INFO_CHAIN_SIGNAL.
  * @__NL80211_STA_INFO_AFTER_LAST: internal
  * @NL80211_STA_INFO_MAX: highest possible station info attribute
  */
@@ -2020,6 +2033,8 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_NONPEER_PM,
         NL80211_STA_INFO_RX_BYTES64,
         NL80211_STA_INFO_TX_BYTES64,
+        NL80211_STA_INFO_CHAIN_SIGNAL,
+        NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
@@ -2413,6 +2428,8 @@ enum nl80211_survey_info {
  * @NL80211_MNTR_FLAG_OTHER_BSS: disable BSSID filtering
  * @NL80211_MNTR_FLAG_COOK_FRAMES: report frames after processing.
  *      overrides all other flags.
+ * @NL80211_MNTR_FLAG_ACTIVE: use the configured MAC address
+ *      and ACK incoming unicast packets.
  *
  * @__NL80211_MNTR_FLAG_AFTER_LAST: internal use
  * @NL80211_MNTR_FLAG_MAX: highest possible monitor flag
@@ -2424,6 +2441,7 @@ enum nl80211_mntr_flags {
         NL80211_MNTR_FLAG_CONTROL,
         NL80211_MNTR_FLAG_OTHER_BSS,
         NL80211_MNTR_FLAG_COOK_FRAMES,
+        NL80211_MNTR_FLAG_ACTIVE,
 
         /* keep last */
         __NL80211_MNTR_FLAG_AFTER_LAST,
@@ -2559,6 +2577,10 @@ enum nl80211_mesh_power_mode {
  *
  * @NL80211_MESHCONF_AWAKE_WINDOW: awake window duration (in TUs)
  *
+ * @NL80211_MESHCONF_PLINK_TIMEOUT: If no tx activity is seen from a STA we've
+ *      established peering with for longer than this time (in seconds), then
+ *      remove it from the STA's list of peers.  Default is 30 minutes.
+ *
  * @__NL80211_MESHCONF_ATTR_AFTER_LAST: internal use
  */
 enum nl80211_meshconf_params {
@@ -2590,6 +2612,7 @@ enum nl80211_meshconf_params {
         NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
         NL80211_MESHCONF_POWER_MODE,
         NL80211_MESHCONF_AWAKE_WINDOW,
+        NL80211_MESHCONF_PLINK_TIMEOUT,
 
         /* keep last */
         __NL80211_MESHCONF_ATTR_AFTER_LAST,
@@ -2637,6 +2660,10 @@ enum nl80211_meshconf_params {
  * @NL80211_MESH_SETUP_USERSPACE_MPM: Enable this option if userspace will
  *      implement an MPM which handles peer allocation and state.
  *
+ * @NL80211_MESH_SETUP_AUTH_PROTOCOL: Inform the kernel of the authentication
+ *      method (u8, as defined in IEEE 8.4.2.100.6, e.g. 0x1 for SAE).
+ *      Default is no authentication method required.
+ *
  * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
  *
  * @__NL80211_MESH_SETUP_ATTR_AFTER_LAST: Internal use
@@ -2650,6 +2677,7 @@ enum nl80211_mesh_setup_params {
         NL80211_MESH_SETUP_USERSPACE_AMPE,
         NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC,
         NL80211_MESH_SETUP_USERSPACE_MPM,
+        NL80211_MESH_SETUP_AUTH_PROTOCOL,
 
         /* keep last */
         __NL80211_MESH_SETUP_ATTR_AFTER_LAST,
@@ -2730,6 +2758,8 @@ enum nl80211_channel_type {
  *      and %NL80211_ATTR_CENTER_FREQ2 attributes must be provided as well
  * @NL80211_CHAN_WIDTH_160: 160 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
  *      attribute must be provided as well
+ * @NL80211_CHAN_WIDTH_5: 5 MHz OFDM channel
+ * @NL80211_CHAN_WIDTH_10: 10 MHz OFDM channel
  */
 enum nl80211_chan_width {
         NL80211_CHAN_WIDTH_20_NOHT,
@@ -2738,6 +2768,8 @@ enum nl80211_chan_width {
         NL80211_CHAN_WIDTH_80,
         NL80211_CHAN_WIDTH_80P80,
         NL80211_CHAN_WIDTH_160,
+        NL80211_CHAN_WIDTH_5,
+        NL80211_CHAN_WIDTH_10,
 };
 
 /**
@@ -3556,6 +3588,10 @@ enum nl80211_ap_sme_features {
  *      Peering Management entity which may be implemented by registering for
  *      beacons or NL80211_CMD_NEW_PEER_CANDIDATE events. The mesh beacon is
  *      still generated by the driver.
+ * @NL80211_FEATURE_ACTIVE_MONITOR: This driver supports an active monitor
+ *      interface. An active monitor interface behaves like a normal monitor
+ *      interface, but gets added to the driver. It ensures that incoming
+ *      unicast packets directed at the configured interface address get ACKed.
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3575,6 +3611,7 @@ enum nl80211_feature_flags {
         NL80211_FEATURE_ADVERTISE_CHAN_LIMITS           = 1 << 14,
         NL80211_FEATURE_FULL_AP_CLIENT_STATE            = 1 << 15,
         NL80211_FEATURE_USERSPACE_MPM                   = 1 << 16,
+        NL80211_FEATURE_ACTIVE_MONITOR                  = 1 << 17,
 };
 
 /**
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 405918dd7b3f..c55efaaa9bb4 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -164,6 +164,7 @@ enum ovs_vport_type {
         OVS_VPORT_TYPE_UNSPEC,
         OVS_VPORT_TYPE_NETDEV,   /* network device */
         OVS_VPORT_TYPE_INTERNAL, /* network device implemented by datapath */
+        OVS_VPORT_TYPE_GRE,      /* GRE tunnel. */
         __OVS_VPORT_TYPE_MAX
 };
 
@@ -192,7 +193,6 @@ enum ovs_vport_type {
  * optional; if not specified a free port number is automatically selected.
  * Whether %OVS_VPORT_ATTR_OPTIONS is required or optional depends on the type
  * of vport.
- * and other attributes are ignored.
  *
  * For other requests, if %OVS_VPORT_ATTR_NAME is specified then it is used to
  * look up the vport to operate on; otherwise dp_idx from the &struct
@@ -247,11 +247,29 @@ enum ovs_key_attr {
         OVS_KEY_ATTR_ARP,       /* struct ovs_key_arp */
         OVS_KEY_ATTR_ND,        /* struct ovs_key_nd */
         OVS_KEY_ATTR_SKB_MARK,  /* u32 skb mark */
+        OVS_KEY_ATTR_TUNNEL,    /* Nested set of ovs_tunnel attributes */
+
+#ifdef __KERNEL__
+        OVS_KEY_ATTR_IPV4_TUNNEL,  /* struct ovs_key_ipv4_tunnel */
+#endif
         __OVS_KEY_ATTR_MAX
 };
 
 #define OVS_KEY_ATTR_MAX (__OVS_KEY_ATTR_MAX - 1)
 
+enum ovs_tunnel_key_attr {
+        OVS_TUNNEL_KEY_ATTR_ID,                 /* be64 Tunnel ID */
+        OVS_TUNNEL_KEY_ATTR_IPV4_SRC,           /* be32 src IP address. */
+        OVS_TUNNEL_KEY_ATTR_IPV4_DST,           /* be32 dst IP address. */
+        OVS_TUNNEL_KEY_ATTR_TOS,                /* u8 Tunnel IP ToS. */
+        OVS_TUNNEL_KEY_ATTR_TTL,                /* u8 Tunnel IP TTL. */
+        OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT,      /* No argument, set DF. */
+        OVS_TUNNEL_KEY_ATTR_CSUM,               /* No argument. CSUM packet. */
+        __OVS_TUNNEL_KEY_ATTR_MAX
+};
+
+#define OVS_TUNNEL_KEY_ATTR_MAX (__OVS_TUNNEL_KEY_ATTR_MAX - 1)
+
 /**
  * enum ovs_frag_type - IPv4 and IPv6 fragment type
  * @OVS_FRAG_TYPE_NONE: Packet is not a fragment.
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index 7a2144e1afae..eb0f1a554d7b 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -386,6 +386,8 @@ enum {
 #define RTAX_RTO_MIN RTAX_RTO_MIN
         RTAX_INITRWND,
 #define RTAX_INITRWND RTAX_INITRWND
+        RTAX_QUICKACK,
+#define RTAX_QUICKACK RTAX_QUICKACK
         __RTAX_MAX
 };
 
diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index df2e8b4f9c03..af0a674cc677 100644
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -253,6 +253,7 @@ enum
         LINUX_MIB_TCPFASTOPENLISTENOVERFLOW,    /* TCPFastOpenListenOverflow */
         LINUX_MIB_TCPFASTOPENCOOKIEREQD,        /* TCPFastOpenCookieReqd */
         LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES, /* TCPSpuriousRtxHostQueues */
+        LINUX_MIB_LOWLATENCYRXPACKETS,          /* LowLatencyRxPackets */
         __LINUX_MIB_MAX
 };
 
@@ -287,6 +288,7 @@ enum
         LINUX_MIB_XFRMOUTPOLERROR,              /* XfrmOutPolError */
         LINUX_MIB_XFRMFWDHDRERROR,              /* XfrmFwdHdrError*/
         LINUX_MIB_XFRMOUTSTATEINVALID,          /* XfrmOutStateInvalid */
+        LINUX_MIB_XFRMACQUIREERROR,             /* XfrmAcquireError */
         __LINUX_MIB_XFRMMAX
 };
 
diff --git a/include/uapi/linux/tipc.h b/include/uapi/linux/tipc.h
index f2d90091cc20..852373d27dbb 100644
--- a/include/uapi/linux/tipc.h
+++ b/include/uapi/linux/tipc.h
@@ -1,5 +1,5 @@
 /*
- * include/linux/tipc.h: Include file for TIPC socket interface
+ * include/uapi/linux/tipc.h: Header for TIPC socket interface
  *
  * Copyright (c) 2003-2006, Ericsson AB
  * Copyright (c) 2005, 2010-2011, Wind River Systems
diff --git a/include/uapi/linux/tipc_config.h b/include/uapi/linux/tipc_config.h
index 0b1e3f218a36..6b0bff09b3a7 100644
--- a/include/uapi/linux/tipc_config.h
+++ b/include/uapi/linux/tipc_config.h
@@ -1,5 +1,5 @@
 /*
- * include/linux/tipc_config.h: Include file for TIPC configuration interface
+ * include/uapi/linux/tipc_config.h: Header for TIPC configuration interface
  *
  * Copyright (c) 2003-2006, Ericsson AB
  * Copyright (c) 2005-2007, 2010-2011, Wind River Systems
diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
index 69bd5bb0d5af..e90a88a8708f 100644
--- a/include/uapi/linux/v4l2-controls.h
+++ b/include/uapi/linux/v4l2-controls.h
@@ -53,13 +53,13 @@
 #define V4L2_CTRL_CLASS_USER            0x00980000      /* Old-style 'user' controls */
 #define V4L2_CTRL_CLASS_MPEG            0x00990000      /* MPEG-compression controls */
 #define V4L2_CTRL_CLASS_CAMERA          0x009a0000      /* Camera class controls */
-#define V4L2_CTRL_CLASS_FM_TX           0x009b0000      /* FM Modulator control class */
+#define V4L2_CTRL_CLASS_FM_TX           0x009b0000      /* FM Modulator controls */
 #define V4L2_CTRL_CLASS_FLASH           0x009c0000      /* Camera flash controls */
 #define V4L2_CTRL_CLASS_JPEG            0x009d0000      /* JPEG-compression controls */
 #define V4L2_CTRL_CLASS_IMAGE_SOURCE    0x009e0000      /* Image source controls */
 #define V4L2_CTRL_CLASS_IMAGE_PROC      0x009f0000      /* Image processing controls */
 #define V4L2_CTRL_CLASS_DV              0x00a00000      /* Digital Video controls */
-#define V4L2_CTRL_CLASS_FM_RX           0x00a10000      /* Digital Video controls */
+#define V4L2_CTRL_CLASS_FM_RX           0x00a10000      /* FM Receiver controls */
 
 /* User-class control IDs */
 
diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index 87ee4f4cff25..916e444e6f74 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -362,10 +362,14 @@ struct vfio_iommu_type1_dma_map {
 #define VFIO_IOMMU_MAP_DMA _IO(VFIO_TYPE, VFIO_BASE + 13)
 
 /**
- * VFIO_IOMMU_UNMAP_DMA - _IOW(VFIO_TYPE, VFIO_BASE + 14, struct vfio_dma_unmap)
+ * VFIO_IOMMU_UNMAP_DMA - _IOWR(VFIO_TYPE, VFIO_BASE + 14,
+ *                                                      struct vfio_dma_unmap)
  *
  * Unmap IO virtual addresses using the provided struct vfio_dma_unmap.
- * Caller sets argsz.
+ * Caller sets argsz.  The actual unmapped size is returned in the size
+ * field.  No guarantee is made to the user that arbitrary unmaps of iova
+ * or size different from those used in the original mapping call will
+ * succeed.
  */
 struct vfio_iommu_type1_dma_unmap {
         __u32   argsz;
diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
index f40b41c7e108..95ef4551edc1 100644
--- a/include/uapi/linux/videodev2.h
+++ b/include/uapi/linux/videodev2.h
@@ -395,7 +395,7 @@ struct v4l2_pix_format {
 #define V4L2_PIX_FMT_H263     v4l2_fourcc('H', '2', '6', '3') /* H263          */
 #define V4L2_PIX_FMT_MPEG1    v4l2_fourcc('M', 'P', 'G', '1') /* MPEG-1 ES     */
 #define V4L2_PIX_FMT_MPEG2    v4l2_fourcc('M', 'P', 'G', '2') /* MPEG-2 ES     */
-#define V4L2_PIX_FMT_MPEG4    v4l2_fourcc('M', 'P', 'G', '4') /* MPEG-4 ES     */
+#define V4L2_PIX_FMT_MPEG4    v4l2_fourcc('M', 'P', 'G', '4') /* MPEG-4 part 2 ES */
 #define V4L2_PIX_FMT_XVID     v4l2_fourcc('X', 'V', 'I', 'D') /* Xvid           */
 #define V4L2_PIX_FMT_VC1_ANNEX_G v4l2_fourcc('V', 'C', '1', 'G') /* SMPTE 421M Annex G compliant stream */
 #define V4L2_PIX_FMT_VC1_ANNEX_L v4l2_fourcc('V', 'C', '1', 'L') /* SMPTE 421M Annex L compliant stream */
@@ -555,7 +555,7 @@ struct v4l2_jpegcompression {
         __u32 jpeg_markers;     /* Which markers should go into the JPEG
                                  * output. Unless you exactly know what
                                  * you do, leave them untouched.
-                                 * Inluding less markers will make the
+                                 * Including less markers will make the
                                  * resulting code smaller, but there will
                                  * be fewer applications which can read it.
                                  * The presence of the APP and COM marker
@@ -567,7 +567,7 @@ struct v4l2_jpegcompression {
 #define V4L2_JPEG_MARKER_DRI (1<<5)    /* Define Restart Interval */
 #define V4L2_JPEG_MARKER_COM (1<<6)    /* Comment segment */
 #define V4L2_JPEG_MARKER_APP (1<<7)    /* App segment, driver will
-                                        * allways use APP0 */
+                                        * always use APP0 */
 };
 
 /*
@@ -900,7 +900,7 @@ typedef __u64 v4l2_std_id;
 /*
  * "Common" PAL - This macro is there to be compatible with the old
  * V4L1 concept of "PAL": /BGDKHI.
- * Several PAL standards are mising here: /M, /N and /Nc
+ * Several PAL standards are missing here: /M, /N and /Nc
  */
 #define V4L2_STD_PAL            (V4L2_STD_PAL_BG        |\
                                  V4L2_STD_PAL_DK        |\
@@ -1787,11 +1787,13 @@ struct v4l2_event_subscription {
 /* VIDIOC_DBG_G_REGISTER and VIDIOC_DBG_S_REGISTER */
 
 #define V4L2_CHIP_MATCH_BRIDGE      0  /* Match against chip ID on the bridge (0 for the bridge) */
+#define V4L2_CHIP_MATCH_SUBDEV      4  /* Match against subdev index */
+
+/* The following four defines are no longer in use */
 #define V4L2_CHIP_MATCH_HOST V4L2_CHIP_MATCH_BRIDGE
 #define V4L2_CHIP_MATCH_I2C_DRIVER  1  /* Match against I2C driver name */
 #define V4L2_CHIP_MATCH_I2C_ADDR    2  /* Match against I2C 7-bit address */
-#define V4L2_CHIP_MATCH_AC97        3  /* Match against anciliary AC97 chip */
-#define V4L2_CHIP_MATCH_SUBDEV      4  /* Match against subdev index */
+#define V4L2_CHIP_MATCH_AC97        3  /* Match against ancillary AC97 chip */
 
 struct v4l2_dbg_match {
         __u32 type; /* Match type */
@@ -1808,13 +1810,6 @@ struct v4l2_dbg_register {
         __u64 val;
 } __attribute__ ((packed));
 
-/* VIDIOC_DBG_G_CHIP_IDENT */
-struct v4l2_dbg_chip_ident {
-        struct v4l2_dbg_match match;
-        __u32 ident;       /* chip identifier as specified in <media/v4l2-chip-ident.h> */
-        __u32 revision;    /* chip revision, chip specific */
-} __attribute__ ((packed));
-
 #define V4L2_CHIP_FL_READABLE (1 << 0)
 #define V4L2_CHIP_FL_WRITABLE (1 << 1)
 
@@ -1915,12 +1910,6 @@ struct v4l2_create_buffers {
 #define VIDIOC_DBG_S_REGISTER    _IOW('V', 79, struct v4l2_dbg_register)
 #define VIDIOC_DBG_G_REGISTER   _IOWR('V', 80, struct v4l2_dbg_register)
 
-/* Experimental, meant for debugging, testing and internal use.
-   Never use this ioctl in applications!
-   Note: this ioctl is deprecated in favor of VIDIOC_DBG_G_CHIP_INFO and
-   will go away in the future. */
-#define VIDIOC_DBG_G_CHIP_IDENT _IOWR('V', 81, struct v4l2_dbg_chip_ident)
-
 #define VIDIOC_S_HW_FREQ_SEEK    _IOW('V', 82, struct v4l2_hw_freq_seek)
 
 #define VIDIOC_S_DV_TIMINGS     _IOWR('V', 87, struct v4l2_dv_timings)
diff --git a/include/uapi/linux/virtio_config.h b/include/uapi/linux/virtio_config.h
index b7cda390fd00..3ce768c6910d 100644
--- a/include/uapi/linux/virtio_config.h
+++ b/include/uapi/linux/virtio_config.h
@@ -51,4 +51,7 @@
  * suppressed them? */
 #define VIRTIO_F_NOTIFY_ON_EMPTY        24
 
+/* Can the device handle any descriptor layout? */
+#define VIRTIO_F_ANY_LAYOUT             27
+
 #endif /* _UAPI_LINUX_VIRTIO_CONFIG_H */
diff --git a/include/uapi/rdma/rdma_user_cm.h b/include/uapi/rdma/rdma_user_cm.h
index 1ee9239ff8c2..99b80abf360a 100644
--- a/include/uapi/rdma/rdma_user_cm.h
+++ b/include/uapi/rdma/rdma_user_cm.h
@@ -45,8 +45,8 @@
 enum {
         RDMA_USER_CM_CMD_CREATE_ID,
         RDMA_USER_CM_CMD_DESTROY_ID,
-        RDMA_USER_CM_CMD_BIND_ADDR,
-        RDMA_USER_CM_CMD_RESOLVE_ADDR,
+        RDMA_USER_CM_CMD_BIND_IP,
+        RDMA_USER_CM_CMD_RESOLVE_IP,
         RDMA_USER_CM_CMD_RESOLVE_ROUTE,
         RDMA_USER_CM_CMD_QUERY_ROUTE,
         RDMA_USER_CM_CMD_CONNECT,
@@ -59,9 +59,13 @@ enum {
         RDMA_USER_CM_CMD_GET_OPTION,
         RDMA_USER_CM_CMD_SET_OPTION,
         RDMA_USER_CM_CMD_NOTIFY,
-        RDMA_USER_CM_CMD_JOIN_MCAST,
+        RDMA_USER_CM_CMD_JOIN_IP_MCAST,
         RDMA_USER_CM_CMD_LEAVE_MCAST,
-        RDMA_USER_CM_CMD_MIGRATE_ID
+        RDMA_USER_CM_CMD_MIGRATE_ID,
+        RDMA_USER_CM_CMD_QUERY,
+        RDMA_USER_CM_CMD_BIND,
+        RDMA_USER_CM_CMD_RESOLVE_ADDR,
+        RDMA_USER_CM_CMD_JOIN_MCAST
 };
 
 /*
@@ -95,28 +99,51 @@ struct rdma_ucm_destroy_id_resp {
         __u32 events_reported;
 };
 
-struct rdma_ucm_bind_addr {
+struct rdma_ucm_bind_ip {
         __u64 response;
         struct sockaddr_in6 addr;
         __u32 id;
 };
 
-struct rdma_ucm_resolve_addr {
+struct rdma_ucm_bind {
+        __u32 id;
+        __u16 addr_size;
+        __u16 reserved;
+        struct sockaddr_storage addr;
+};
+
+struct rdma_ucm_resolve_ip {
         struct sockaddr_in6 src_addr;
         struct sockaddr_in6 dst_addr;
         __u32 id;
         __u32 timeout_ms;
 };
 
+struct rdma_ucm_resolve_addr {
+        __u32 id;
+        __u32 timeout_ms;
+        __u16 src_size;
+        __u16 dst_size;
+        __u32 reserved;
+        struct sockaddr_storage src_addr;
+        struct sockaddr_storage dst_addr;
+};
+
 struct rdma_ucm_resolve_route {
         __u32 id;
         __u32 timeout_ms;
 };
 
-struct rdma_ucm_query_route {
+enum {
+        RDMA_USER_CM_QUERY_ADDR,
+        RDMA_USER_CM_QUERY_PATH,
+        RDMA_USER_CM_QUERY_GID
+};
+
+struct rdma_ucm_query {
         __u64 response;
         __u32 id;
-        __u32 reserved;
+        __u32 option;
 };
 
 struct rdma_ucm_query_route_resp {
@@ -129,9 +156,26 @@ struct rdma_ucm_query_route_resp {
         __u8 reserved[3];
 };
 
+struct rdma_ucm_query_addr_resp {
+        __u64 node_guid;
+        __u8  port_num;
+        __u8  reserved;
+        __u16 pkey;
+        __u16 src_size;
+        __u16 dst_size;
+        struct sockaddr_storage src_addr;
+        struct sockaddr_storage dst_addr;
+};
+
+struct rdma_ucm_query_path_resp {
+        __u32 num_paths;
+        __u32 reserved;
+        struct ib_path_rec_data path_data[0];
+};
+
 struct rdma_ucm_conn_param {
         __u32 qp_num;
-        __u32 reserved;
+        __u32 qkey;
         __u8  private_data[RDMA_MAX_PRIVATE_DATA];
         __u8  private_data_len;
         __u8  srq;
@@ -192,13 +236,22 @@ struct rdma_ucm_notify {
         __u32 event;
 };
 
-struct rdma_ucm_join_mcast {
+struct rdma_ucm_join_ip_mcast {
         __u64 response;         /* rdma_ucm_create_id_resp */
         __u64 uid;
         struct sockaddr_in6 addr;
         __u32 id;
 };
 
+struct rdma_ucm_join_mcast {
+        __u64 response;         /* rdma_ucma_create_id_resp */
+        __u64 uid;
+        __u32 id;
+        __u16 addr_size;
+        __u16 reserved;
+        struct sockaddr_storage addr;
+};
+
 struct rdma_ucm_get_event {
         __u64 response;
 };
diff --git a/include/video/display_timing.h b/include/video/display_timing.h
index 5d0259b08e01..28d9d0d566ca 100644
--- a/include/video/display_timing.h
+++ b/include/video/display_timing.h
@@ -27,6 +27,7 @@ enum display_flags {
         DISPLAY_FLAGS_PIXDATA_NEGEDGE   = BIT(7),
         DISPLAY_FLAGS_INTERLACED        = BIT(8),
         DISPLAY_FLAGS_DOUBLESCAN        = BIT(9),
+        DISPLAY_FLAGS_DOUBLECLK         = BIT(10),
 };
 
 /*
diff --git a/include/video/of_display_timing.h b/include/video/of_display_timing.h
index 8016eb727cf3..79e6697af6cf 100644
--- a/include/video/of_display_timing.h
+++ b/include/video/of_display_timing.h
@@ -10,10 +10,13 @@
 #define __LINUX_OF_DISPLAY_TIMING_H
 
 struct device_node;
+struct display_timing;
 struct display_timings;
 
 #define OF_USE_NATIVE_MODE -1
 
+int of_get_display_timing(struct device_node *np, const char *name,
+                struct display_timing *dt);
 struct display_timings *of_get_display_timings(struct device_node *np);
 int of_display_timings_exist(struct device_node *np);
 
diff --git a/include/video/omap-panel-data.h b/include/video/omap-panel-data.h
index 0c3b46d3daf3..6b2366fb6e53 100644
--- a/include/video/omap-panel-data.h
+++ b/include/video/omap-panel-data.h
@@ -27,6 +27,9 @@
 #ifndef __OMAP_PANEL_DATA_H
 #define __OMAP_PANEL_DATA_H
 
+#include <video/omapdss.h>
+#include <video/display_timing.h>
+
 struct omap_dss_device;
 
 /**
@@ -147,4 +150,210 @@ struct panel_tpo_td043_data {
         int nreset_gpio;
 };
 
+/**
+ * encoder_tfp410 platform data
+ * @name: name for this display entity
+ * @power_down_gpio: gpio number for PD pin (or -1 if not available)
+ * @data_lines: number of DPI datalines
+ */
+struct encoder_tfp410_platform_data {
+        const char *name;
+        const char *source;
+        int power_down_gpio;
+        int data_lines;
+};
+
+/**
+ * encoder_tpd12s015 platform data
+ * @name: name for this display entity
+ * @ct_cp_hpd_gpio: CT_CP_HPD gpio number
+ * @ls_oe_gpio: LS_OE gpio number
+ * @hpd_gpio: HPD gpio number
+ */
+struct encoder_tpd12s015_platform_data {
+        const char *name;
+        const char *source;
+
+        int ct_cp_hpd_gpio;
+        int ls_oe_gpio;
+        int hpd_gpio;
+};
+
+/**
+ * connector_dvi platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ * @i2c_bus_num: i2c bus number to be used for reading EDID
+ */
+struct connector_dvi_platform_data {
+        const char *name;
+        const char *source;
+        int i2c_bus_num;
+};
+
+/**
+ * connector_hdmi platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ */
+struct connector_hdmi_platform_data {
+        const char *name;
+        const char *source;
+};
+
+/**
+ * connector_atv platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ * @connector_type: composite/svideo
+ * @invert_polarity: invert signal polarity
+ */
+struct connector_atv_platform_data {
+        const char *name;
+        const char *source;
+
+        enum omap_dss_venc_type connector_type;
+        bool invert_polarity;
+};
+
+/**
+ * panel_dpi platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ * @data_lines: number of DPI datalines
+ * @display_timing: timings for this panel
+ * @backlight_gpio: gpio to enable/disable the backlight (or -1)
+ * @enable_gpio: gpio to enable/disable the panel (or -1)
+ */
+struct panel_dpi_platform_data {
+        const char *name;
+        const char *source;
+
+        int data_lines;
+
+        const struct display_timing *display_timing;
+
+        int backlight_gpio;
+        int enable_gpio;
+};
+
+/**
+ * panel_dsicm platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ * @reset_gpio: gpio to reset the panel (or -1)
+ * @use_ext_te: use external TE GPIO
+ * @ext_te_gpio: external TE GPIO
+ * @ulps_timeout: time to wait before entering ULPS, 0 = disabled (ms)
+ * @use_dsi_backlight: true if panel uses DSI command to control backlight
+ * @pin_config: DSI pin configuration
+ */
+struct panel_dsicm_platform_data {
+        const char *name;
+        const char *source;
+
+        int reset_gpio;
+
+        bool use_ext_te;
+        int ext_te_gpio;
+
+        unsigned ulps_timeout;
+
+        bool use_dsi_backlight;
+
+        struct omap_dsi_pin_config pin_config;
+};
+
+/**
+ * panel_acx565akm platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ * @reset_gpio: gpio to reset the panel (or -1)
+ * @datapairs: number of SDI datapairs
+ */
+struct panel_acx565akm_platform_data {
+        const char *name;
+        const char *source;
+
+        int reset_gpio;
+
+        int datapairs;
+};
+
+/**
+ * panel_lb035q02 platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ * @data_lines: number of DPI datalines
+ * @backlight_gpio: gpio to enable/disable the backlight (or -1)
+ * @enable_gpio: gpio to enable/disable the panel (or -1)
+ */
+struct panel_lb035q02_platform_data {
+        const char *name;
+        const char *source;
+
+        int data_lines;
+
+        int backlight_gpio;
+        int enable_gpio;
+};
+
+/**
+ * panel_sharp_ls037v7dw01 platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ * @data_lines: number of DPI datalines
+ * @resb_gpio: reset signal GPIO
+ * @ini_gpio: power on control GPIO
+ * @mo_gpio: selection for resolution(VGA/QVGA) GPIO
+ * @lr_gpio: selection for horizontal scanning direction GPIO
+ * @ud_gpio: selection for vertical scanning direction GPIO
+ */
+struct panel_sharp_ls037v7dw01_platform_data {
+        const char *name;
+        const char *source;
+
+        int data_lines;
+
+        int resb_gpio;
+        int ini_gpio;
+        int mo_gpio;
+        int lr_gpio;
+        int ud_gpio;
+};
+
+/**
+ * panel-tpo-td043mtea1 platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ * @data_lines: number of DPI datalines
+ * @nreset_gpio: reset signal
+ */
+struct panel_tpo_td043mtea1_platform_data {
+        const char *name;
+        const char *source;
+
+        int data_lines;
+
+        int nreset_gpio;
+};
+
+/**
+ * panel-nec-nl8048hl11 platform data
+ * @name: name for this display entity
+ * @source: name of the display entity used as a video source
+ * @data_lines: number of DPI datalines
+ * @res_gpio: reset signal
+ * @qvga_gpio: selection for resolution(QVGA/WVGA)
+ */
+struct panel_nec_nl8048hl11_platform_data {
+        const char *name;
+        const char *source;
+
+        int data_lines;
+
+        int res_gpio;
+        int qvga_gpio;
+};
+
 #endif /* __OMAP_PANEL_DATA_H */
diff --git a/include/video/omapdss.h b/include/video/omapdss.h
index aeb4e9a0c5d1..b39463553845 100644
--- a/include/video/omapdss.h
+++ b/include/video/omapdss.h
@@ -23,6 +23,8 @@
 #include <linux/device.h>
 #include <linux/interrupt.h>
 
+#include <video/videomode.h>
+
 #define DISPC_IRQ_FRAMEDONE             (1 << 0)
 #define DISPC_IRQ_VSYNC                 (1 << 1)
 #define DISPC_IRQ_EVSYNC_EVEN           (1 << 2)
@@ -68,6 +70,7 @@ enum omap_display_type {
         OMAP_DISPLAY_TYPE_DSI           = 1 << 3,
         OMAP_DISPLAY_TYPE_VENC          = 1 << 4,
         OMAP_DISPLAY_TYPE_HDMI          = 1 << 5,
+        OMAP_DISPLAY_TYPE_DVI           = 1 << 6,
 };
 
 enum omap_plane {
@@ -169,6 +172,11 @@ enum omap_dss_audio_state {
         OMAP_DSS_AUDIO_PLAYING,
 };
 
+struct omap_dss_audio {
+        struct snd_aes_iec958 *iec;
+        struct snd_cea_861_aud_if *cea;
+};
+
 enum omap_dss_rotation_type {
         OMAP_DSS_ROT_DMA        = 1 << 0,
         OMAP_DSS_ROT_VRFB       = 1 << 1,
@@ -365,6 +373,7 @@ struct omap_dss_board_info {
         int num_devices;
         struct omap_dss_device **devices;
         struct omap_dss_device *default_device;
+        const char *default_display_name;
         int (*dsi_enable_pads)(int dsi_id, unsigned lane_mask);
         void (*dsi_disable_pads)(int dsi_id, unsigned lane_mask);
         int (*set_min_bus_tput)(struct device *dev, unsigned long r);
@@ -512,7 +521,7 @@ struct omap_overlay_manager {
         enum omap_dss_output_id supported_outputs;
 
         /* dynamic fields */
-        struct omap_dss_output *output;
+        struct omap_dss_device *output;
 
         /*
          * The following functions do not block:
@@ -526,7 +535,7 @@ struct omap_overlay_manager {
          */
 
         int (*set_output)(struct omap_overlay_manager *mgr,
-                struct omap_dss_output *output);
+                struct omap_dss_device *output);
         int (*unset_output)(struct omap_overlay_manager *mgr);
 
         int (*set_manager_info)(struct omap_overlay_manager *mgr,
@@ -569,33 +578,192 @@ struct omap_dss_writeback_info {
         u8 pre_mult_alpha;
 };
 
-struct omap_dss_output {
-        struct list_head list;
+struct omapdss_dpi_ops {
+        int (*connect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+        void (*disconnect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
 
-        const char *name;
+        int (*enable)(struct omap_dss_device *dssdev);
+        void (*disable)(struct omap_dss_device *dssdev);
 
-        /* display type supported by the output */
-        enum omap_display_type type;
+        int (*check_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*set_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*get_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
 
-        /* DISPC channel for this output */
-        enum omap_channel dispc_channel;
+        void (*set_data_lines)(struct omap_dss_device *dssdev, int data_lines);
+};
 
-        /* output instance */
-        enum omap_dss_output_id id;
+struct omapdss_sdi_ops {
+        int (*connect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+        void (*disconnect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
 
-        /* output's platform device pointer */
-        struct platform_device *pdev;
+        int (*enable)(struct omap_dss_device *dssdev);
+        void (*disable)(struct omap_dss_device *dssdev);
 
-        /* dynamic fields */
-        struct omap_overlay_manager *manager;
+        int (*check_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*set_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*get_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
 
-        struct omap_dss_device *device;
+        void (*set_datapairs)(struct omap_dss_device *dssdev, int datapairs);
+};
+
+struct omapdss_dvi_ops {
+        int (*connect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+        void (*disconnect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+
+        int (*enable)(struct omap_dss_device *dssdev);
+        void (*disable)(struct omap_dss_device *dssdev);
+
+        int (*check_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*set_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*get_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+};
+
+struct omapdss_atv_ops {
+        int (*connect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+        void (*disconnect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+
+        int (*enable)(struct omap_dss_device *dssdev);
+        void (*disable)(struct omap_dss_device *dssdev);
+
+        int (*check_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*set_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*get_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+
+        void (*set_type)(struct omap_dss_device *dssdev,
+                enum omap_dss_venc_type type);
+        void (*invert_vid_out_polarity)(struct omap_dss_device *dssdev,
+                bool invert_polarity);
+
+        int (*set_wss)(struct omap_dss_device *dssdev, u32 wss);
+        u32 (*get_wss)(struct omap_dss_device *dssdev);
+};
+
+struct omapdss_hdmi_ops {
+        int (*connect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+        void (*disconnect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+
+        int (*enable)(struct omap_dss_device *dssdev);
+        void (*disable)(struct omap_dss_device *dssdev);
+
+        int (*check_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*set_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+        void (*get_timings)(struct omap_dss_device *dssdev,
+                        struct omap_video_timings *timings);
+
+        int (*read_edid)(struct omap_dss_device *dssdev, u8 *buf, int len);
+        bool (*detect)(struct omap_dss_device *dssdev);
+
+        /*
+         * Note: These functions might sleep. Do not call while
+         * holding a spinlock/readlock.
+         */
+        int (*audio_enable)(struct omap_dss_device *dssdev);
+        void (*audio_disable)(struct omap_dss_device *dssdev);
+        bool (*audio_supported)(struct omap_dss_device *dssdev);
+        int (*audio_config)(struct omap_dss_device *dssdev,
+                struct omap_dss_audio *audio);
+        /* Note: These functions may not sleep */
+        int (*audio_start)(struct omap_dss_device *dssdev);
+        void (*audio_stop)(struct omap_dss_device *dssdev);
+};
+
+struct omapdss_dsi_ops {
+        int (*connect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+        void (*disconnect)(struct omap_dss_device *dssdev,
+                        struct omap_dss_device *dst);
+
+        int (*enable)(struct omap_dss_device *dssdev);
+        void (*disable)(struct omap_dss_device *dssdev, bool disconnect_lanes,
+                        bool enter_ulps);
+
+        /* bus configuration */
+        int (*set_config)(struct omap_dss_device *dssdev,
+                        const struct omap_dss_dsi_config *cfg);
+        int (*configure_pins)(struct omap_dss_device *dssdev,
+                        const struct omap_dsi_pin_config *pin_cfg);
+
+        void (*enable_hs)(struct omap_dss_device *dssdev, int channel,
+                        bool enable);
+        int (*enable_te)(struct omap_dss_device *dssdev, bool enable);
+
+        int (*update)(struct omap_dss_device *dssdev, int channel,
+                        void (*callback)(int, void *), void *data);
+
+        void (*bus_lock)(struct omap_dss_device *dssdev);
+        void (*bus_unlock)(struct omap_dss_device *dssdev);
+
+        int (*enable_video_output)(struct omap_dss_device *dssdev, int channel);
+        void (*disable_video_output)(struct omap_dss_device *dssdev,
+                        int channel);
+
+        int (*request_vc)(struct omap_dss_device *dssdev, int *channel);
+        int (*set_vc_id)(struct omap_dss_device *dssdev, int channel,
+                        int vc_id);
+        void (*release_vc)(struct omap_dss_device *dssdev, int channel);
+
+        /* data transfer */
+        int (*dcs_write)(struct omap_dss_device *dssdev, int channel,
+                        u8 *data, int len);
+        int (*dcs_write_nosync)(struct omap_dss_device *dssdev, int channel,
+                        u8 *data, int len);
+        int (*dcs_read)(struct omap_dss_device *dssdev, int channel, u8 dcs_cmd,
+                        u8 *data, int len);
+
+        int (*gen_write)(struct omap_dss_device *dssdev, int channel,
+                        u8 *data, int len);
+        int (*gen_write_nosync)(struct omap_dss_device *dssdev, int channel,
+                        u8 *data, int len);
+        int (*gen_read)(struct omap_dss_device *dssdev, int channel,
+                        u8 *reqdata, int reqlen,
+                        u8 *data, int len);
+
+        int (*bta_sync)(struct omap_dss_device *dssdev, int channel);
+
+        int (*set_max_rx_packet_size)(struct omap_dss_device *dssdev,
+                        int channel, u16 plen);
 };
 
 struct omap_dss_device {
-        struct device dev;
+        /* old device, to be removed */
+        struct device old_dev;
+
+        /* new device, pointer to panel device */
+        struct device *dev;
+
+        struct module *owner;
+
+        struct list_head panel_list;
+
+        /* alias in the form of "display%d" */
+        char alias[16];
 
         enum omap_display_type type;
+        enum omap_display_type output_type;
 
         /* obsolete, to be removed */
         enum omap_channel channel;
@@ -616,9 +784,6 @@ struct omap_dss_device {
 
                 struct {
                         int module;
-
-                        bool ext_te;
-                        u8 ext_te_gpio;
                 } dsi;
 
                 struct {
@@ -639,10 +804,6 @@ struct omap_dss_device {
                 struct rfbi_timings rfbi_timings;
         } ctrl;
 
-        int reset_gpio;
-
-        int max_backlight_level;
-
         const char *name;
 
         /* used to match device to driver */
@@ -652,22 +813,40 @@ struct omap_dss_device {
 
         struct omap_dss_driver *driver;
 
+        union {
+                const struct omapdss_dpi_ops *dpi;
+                const struct omapdss_sdi_ops *sdi;
+                const struct omapdss_dvi_ops *dvi;
+                const struct omapdss_hdmi_ops *hdmi;
+                const struct omapdss_atv_ops *atv;
+                const struct omapdss_dsi_ops *dsi;
+        } ops;
+
         /* helper variable for driver suspend/resume */
         bool activate_after_resume;
 
         enum omap_display_caps caps;
 
-        struct omap_dss_output *output;
+        struct omap_dss_device *output;
 
         enum omap_dss_display_state state;
 
         enum omap_dss_audio_state audio_state;
 
-        /* platform specific  */
-        int (*platform_enable)(struct omap_dss_device *dssdev);
-        void (*platform_disable)(struct omap_dss_device *dssdev);
-        int (*set_backlight)(struct omap_dss_device *dssdev, int level);
-        int (*get_backlight)(struct omap_dss_device *dssdev);
+        /* OMAP DSS output specific fields */
+
+        struct list_head list;
+
+        /* DISPC channel for this output */
+        enum omap_channel dispc_channel;
+
+        /* output instance */
+        enum omap_dss_output_id id;
+
+        /* dynamic fields */
+        struct omap_overlay_manager *manager;
+
+        struct omap_dss_device *device;
 };
 
 struct omap_dss_hdmi_data
@@ -677,17 +856,15 @@ struct omap_dss_hdmi_data
         int hpd_gpio;
 };
 
-struct omap_dss_audio {
-        struct snd_aes_iec958 *iec;
-        struct snd_cea_861_aud_if *cea;
-};
-
 struct omap_dss_driver {
         struct device_driver driver;
 
         int (*probe)(struct omap_dss_device *);
         void (*remove)(struct omap_dss_device *);
 
+        int (*connect)(struct omap_dss_device *dssdev);
+        void (*disconnect)(struct omap_dss_device *dssdev);
+
         int (*enable)(struct omap_dss_device *display);
         void (*disable)(struct omap_dss_device *display);
         int (*run_test)(struct omap_dss_device *display, int test);
@@ -753,7 +930,10 @@ bool omapdss_is_initialized(void);
 int omap_dss_register_driver(struct omap_dss_driver *);
 void omap_dss_unregister_driver(struct omap_dss_driver *);
 
-void omap_dss_get_device(struct omap_dss_device *dssdev);
+int omapdss_register_display(struct omap_dss_device *dssdev);
+void omapdss_unregister_display(struct omap_dss_device *dssdev);
+
+struct omap_dss_device *omap_dss_get_device(struct omap_dss_device *dssdev);
 void omap_dss_put_device(struct omap_dss_device *dssdev);
 #define for_each_dss_dev(d) while ((d = omap_dss_get_next_device(d)) != NULL)
 struct omap_dss_device *omap_dss_get_next_device(struct omap_dss_device *from);
@@ -761,8 +941,10 @@ struct omap_dss_device *omap_dss_find_device(void *data,
                 int (*match)(struct omap_dss_device *dssdev, void *data));
 const char *omapdss_get_default_display_name(void);
 
-int omap_dss_start_device(struct omap_dss_device *dssdev);
-void omap_dss_stop_device(struct omap_dss_device *dssdev);
+void videomode_to_omap_video_timings(const struct videomode *vm,
+                struct omap_video_timings *ovt);
+void omap_video_timings_to_videomode(const struct omap_video_timings *ovt,
+                struct videomode *vm);
 
 int dss_feat_get_num_mgrs(void);
 int dss_feat_get_num_ovls(void);
@@ -778,10 +960,17 @@ struct omap_overlay_manager *omap_dss_get_overlay_manager(int num);
 int omap_dss_get_num_overlays(void);
 struct omap_overlay *omap_dss_get_overlay(int num);
 
-struct omap_dss_output *omap_dss_get_output(enum omap_dss_output_id id);
-int omapdss_output_set_device(struct omap_dss_output *out,
+int omapdss_register_output(struct omap_dss_device *output);
+void omapdss_unregister_output(struct omap_dss_device *output);
+struct omap_dss_device *omap_dss_get_output(enum omap_dss_output_id id);
+struct omap_dss_device *omap_dss_find_output(const char *name);
+struct omap_dss_device *omap_dss_find_output_by_node(struct device_node *node);
+int omapdss_output_set_device(struct omap_dss_device *out,
                 struct omap_dss_device *dssdev);
-int omapdss_output_unset_device(struct omap_dss_output *out);
+int omapdss_output_unset_device(struct omap_dss_device *out);
+
+struct omap_dss_device *omapdss_find_output_from_display(struct omap_dss_device *dssdev);
+struct omap_overlay_manager *omapdss_find_mgr_from_display(struct omap_dss_device *dssdev);
 
 void omapdss_default_get_resolution(struct omap_dss_device *dssdev,
                 u16 *xres, u16 *yres);
@@ -832,7 +1021,7 @@ int dispc_ovl_setup(enum omap_plane plane, const struct omap_overlay_info *oi,
                 bool mem_to_mem);
 
 #define to_dss_driver(x) container_of((x), struct omap_dss_driver, driver)
-#define to_dss_device(x) container_of((x), struct omap_dss_device, dev)
+#define to_dss_device(x) container_of((x), struct omap_dss_device, old_dev)
 
 void omapdss_dsi_vc_enable_hs(struct omap_dss_device *dssdev, int channel,
                 bool enable);
@@ -883,6 +1072,11 @@ int omapdss_compat_init(void);
 void omapdss_compat_uninit(void);
 
 struct dss_mgr_ops {
+        int (*connect)(struct omap_overlay_manager *mgr,
+                struct omap_dss_device *dst);
+        void (*disconnect)(struct omap_overlay_manager *mgr,
+                struct omap_dss_device *dst);
+
         void (*start_update)(struct omap_overlay_manager *mgr);
         int (*enable)(struct omap_overlay_manager *mgr);
         void (*disable)(struct omap_overlay_manager *mgr);
@@ -899,6 +1093,10 @@ struct dss_mgr_ops {
 int dss_install_mgr_ops(const struct dss_mgr_ops *mgr_ops);
 void dss_uninstall_mgr_ops(void);
 
+int dss_mgr_connect(struct omap_overlay_manager *mgr,
+                struct omap_dss_device *dst);
+void dss_mgr_disconnect(struct omap_overlay_manager *mgr,
+                struct omap_dss_device *dst);
 void dss_mgr_set_timings(struct omap_overlay_manager *mgr,
                 const struct omap_video_timings *timings);
 void dss_mgr_set_lcd_config(struct omap_overlay_manager *mgr,
@@ -910,4 +1108,15 @@ int dss_mgr_register_framedone_handler(struct omap_overlay_manager *mgr,
                 void (*handler)(void *), void *data);
 void dss_mgr_unregister_framedone_handler(struct omap_overlay_manager *mgr,
                 void (*handler)(void *), void *data);
+
+static inline bool omapdss_device_is_connected(struct omap_dss_device *dssdev)
+{
+        return dssdev->output;
+}
+
+static inline bool omapdss_device_is_enabled(struct omap_dss_device *dssdev)
+{
+        return dssdev->state == OMAP_DSS_DISPLAY_ACTIVE;
+}
+
 #endif
diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
index 1a91850cb961..30f53625415c 100644
--- a/include/video/uvesafb.h
+++ b/include/video/uvesafb.h
@@ -134,6 +134,7 @@ struct uvesafb_par {
 
         int mode_idx;
         struct vbe_crtc_ib crtc;
+        int mtrr_handle;
 };
 
 #endif /* _UVESAFB_H */
diff --git a/include/xen/interface/io/blkif.h b/include/xen/interface/io/blkif.h
index ffd4652de91c..65e12099ef89 100644
--- a/include/xen/interface/io/blkif.h
+++ b/include/xen/interface/io/blkif.h
@@ -103,12 +103,46 @@ typedef uint64_t blkif_sector_t;
 #define BLKIF_OP_DISCARD           5
 
 /*
+ * Recognized if "feature-max-indirect-segments" in present in the backend
+ * xenbus info. The "feature-max-indirect-segments" node contains the maximum
+ * number of segments allowed by the backend per request. If the node is
+ * present, the frontend might use blkif_request_indirect structs in order to
+ * issue requests with more than BLKIF_MAX_SEGMENTS_PER_REQUEST (11). The
+ * maximum number of indirect segments is fixed by the backend, but the
+ * frontend can issue requests with any number of indirect segments as long as
+ * it's less than the number provided by the backend. The indirect_grefs field
+ * in blkif_request_indirect should be filled by the frontend with the
+ * grant references of the pages that are holding the indirect segments.
+ * This pages are filled with an array of blkif_request_segment_aligned
+ * that hold the information about the segments. The number of indirect
+ * pages to use is determined by the maximum number of segments
+ * a indirect request contains. Every indirect page can contain a maximum
+ * of 512 segments (PAGE_SIZE/sizeof(blkif_request_segment_aligned)),
+ * so to calculate the number of indirect pages to use we have to do
+ * ceil(indirect_segments/512).
+ *
+ * If a backend does not recognize BLKIF_OP_INDIRECT, it should *not*
+ * create the "feature-max-indirect-segments" node!
+ */
+#define BLKIF_OP_INDIRECT          6
+
+/*
  * Maximum scatter/gather segments per request.
  * This is carefully chosen so that sizeof(struct blkif_ring) <= PAGE_SIZE.
  * NB. This could be 12 if the ring indexes weren't stored in the same page.
  */
 #define BLKIF_MAX_SEGMENTS_PER_REQUEST 11
 
+#define BLKIF_MAX_INDIRECT_PAGES_PER_REQUEST 8
+
+struct blkif_request_segment_aligned {
+        grant_ref_t gref;        /* reference to I/O buffer frame        */
+        /* @first_sect: first sector in frame to transfer (inclusive).   */
+        /* @last_sect: last sector in frame to transfer (inclusive).     */
+        uint8_t     first_sect, last_sect;
+        uint16_t    _pad; /* padding to make it 8 bytes, so it's cache-aligned */
+} __attribute__((__packed__));
+
 struct blkif_request_rw {
         uint8_t        nr_segments;  /* number of segments                   */
         blkif_vdev_t   handle;       /* only for read/write requests         */
@@ -147,12 +181,31 @@ struct blkif_request_other {
         uint64_t     id;           /* private guest value, echoed in resp  */
 } __attribute__((__packed__));
 
+struct blkif_request_indirect {
+        uint8_t        indirect_op;
+        uint16_t       nr_segments;
+#ifdef CONFIG_X86_64
+        uint32_t       _pad1;        /* offsetof(blkif_...,u.indirect.id) == 8 */
+#endif
+        uint64_t       id;
+        blkif_sector_t sector_number;
+        blkif_vdev_t   handle;
+        uint16_t       _pad2;
+        grant_ref_t    indirect_grefs[BLKIF_MAX_INDIRECT_PAGES_PER_REQUEST];
+#ifdef CONFIG_X86_64
+        uint32_t      _pad3;         /* make it 64 byte aligned */
+#else
+        uint64_t      _pad3;         /* make it 64 byte aligned */
+#endif
+} __attribute__((__packed__));
+
 struct blkif_request {
         uint8_t        operation;    /* BLKIF_OP_???                         */
         union {
                 struct blkif_request_rw rw;
                 struct blkif_request_discard discard;
                 struct blkif_request_other other;
+                struct blkif_request_indirect indirect;
         } u;
 } __attribute__((__packed__));
 
diff --git a/include/xen/interface/io/netif.h b/include/xen/interface/io/netif.h
index 3ef3fe05ee99..eb262e3324d2 100644
--- a/include/xen/interface/io/netif.h
+++ b/include/xen/interface/io/netif.h
@@ -38,6 +38,18 @@
  * that it cannot safely queue packets (as it may not be kicked to send them).
  */
 
+ /*
+ * "feature-split-event-channels" is introduced to separate guest TX
+ * and RX notificaion. Backend either doesn't support this feature or
+ * advertise it via xenstore as 0 (disabled) or 1 (enabled).
+ *
+ * To make use of this feature, frontend should allocate two event
+ * channels for TX and RX, advertise them to backend as
+ * "event-channel-tx" and "event-channel-rx" respectively. If frontend
+ * doesn't want to use this feature, it just writes "event-channel"
+ * node as before.
+ */
+
 /*
  * This is the 'wire' format for packets:
  *  Request 1: xen_netif_tx_request  -- XEN_NETTXF_* (any flags)
diff --git a/include/xen/interface/io/ring.h b/include/xen/interface/io/ring.h
index 75271b9a8f61..7d28aff605c7 100644
--- a/include/xen/interface/io/ring.h
+++ b/include/xen/interface/io/ring.h
@@ -188,6 +188,11 @@ struct __name##_back_ring {						\
 #define RING_REQUEST_CONS_OVERFLOW(_r, _cons)                           \
     (((_cons) - (_r)->rsp_prod_pvt) >= RING_SIZE(_r))
 
+/* Ill-behaved frontend determination: Can there be this many requests? */
+#define RING_REQUEST_PROD_OVERFLOW(_r, _prod)               \
+    (((_prod) - (_r)->rsp_prod_pvt) > RING_SIZE(_r))
+
+
 #define RING_PUSH_REQUESTS(_r) do {                                     \
     wmb(); /* back sees requests /before/ updated producer index */     \
     (_r)->sring->req_prod = (_r)->req_prod_pvt;                         \